diff --git a/crypto/external/bsd/heimdal/Makefile.rules.inc b/crypto/external/bsd/heimdal/Makefile.rules.inc
index 1f8d65a38..153c4b0fb 100644
--- a/crypto/external/bsd/heimdal/Makefile.rules.inc
+++ b/crypto/external/bsd/heimdal/Makefile.rules.inc
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.rules.inc,v 1.7 2012/09/05 19:31:04 christos Exp $
+# $NetBSD: Makefile.rules.inc,v 1.8 2017/01/28 21:31:43 christos Exp $
 
 SRCS+= ${HEIMSRCS:N*.et:N*.in:N*.asn1}
 
@@ -72,7 +72,7 @@ NORMALIZE_SRC=-e "s@${NETBSDSRCDIR}@/usr/src@g"
 
 .for x2c in ${ASN1_FILES.${src}}
 ${x2c:.x=.c}: ${x2c}
-	@${TOOL_SED} ${NORMALIZE_SRC} < ${x2c} > ${x2c}.r
+	@${TOOL_SED} ${NORMALIZE_SRC} < ${.ALLSRC} > ${x2c}.r
 	@cmp -s ${x2c}.r ${x2c:.x=.c} 2> /dev/null || cp ${x2c}.r ${x2c:.x=.c}
 	@rm -f ${x2c}.r
 .endfor
diff --git a/crypto/external/bsd/heimdal/bin/Makefile.inc b/crypto/external/bsd/heimdal/bin/Makefile.inc
index 39678749f..7dbbca8c8 100644
--- a/crypto/external/bsd/heimdal/bin/Makefile.inc
+++ b/crypto/external/bsd/heimdal/bin/Makefile.inc
@@ -1,11 +1,13 @@
-# $NetBSD: Makefile.inc,v 1.2 2011/05/25 19:21:16 he Exp $
+# $NetBSD: Makefile.inc,v 1.3 2017/01/28 21:31:43 christos Exp $
 
 BINDIR=/usr/bin
 
 LDADD+= -lkrb5 -lhx509 -lasn1 -lroken -lcom_err -lwind
 LDADD+= -lheimbase ${LIBVERS}
 LDADD+= -lcrypto -lcrypt
+LDADD+= -lsqlite3
 
 DPADD+= ${LIBKRB5} ${LIBHX509} ${LIBASN1} ${LIBROKEN} ${LIBCOM_ERR} ${LIBWIND}
 DPADD+= ${LIBHEIMBASE} ${LIBVERS}
 DPADD+= ${LIBCRYPTO} ${LIBCRYPT}
+DPADD+= ${LIBSQLITE3}
diff --git a/crypto/external/bsd/heimdal/bin/kcc/Makefile b/crypto/external/bsd/heimdal/bin/kcc/Makefile
index 40d97abf8..cdfb14fa2 100644
--- a/crypto/external/bsd/heimdal/bin/kcc/Makefile
+++ b/crypto/external/bsd/heimdal/bin/kcc/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2011/05/25 19:21:16 he Exp $
+# $NetBSD: Makefile,v 1.3 2017/01/28 21:31:43 christos Exp $
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
@@ -12,14 +12,15 @@ LINKS+= ${BINDIR}/kcc ${BINDIR}/klist
 
 MAN= klist.1
 
-HEIMSRCS= kcc-commands.in
+HEIMSRCS= heimtools-commands.in
 
 SRCS=	copy_cred_cache.c	\
-	kcc.c			\
+	heimtools.c		\
 	klist.c			\
 	kswitch.c
 
 CPPFLAGS+= -I${DESTDIR}/usr/include/krb5
+CPPFLAGS+= -I${HEIMDIST}/kuser
 
 LDADD+= -lkafs -lsl
 LDADD+= -ledit -lterminfo
diff --git a/crypto/external/bsd/heimdal/dist/LICENSE b/crypto/external/bsd/heimdal/dist/LICENSE
index 404347b4b..c76fc234a 100644
--- a/crypto/external/bsd/heimdal/dist/LICENSE
+++ b/crypto/external/bsd/heimdal/dist/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 1995 - 2011 Kungliga Tekniska Högskolan
+Copyright (c) 1995 - 2014 Kungliga Tekniska Högskolan
 (Royal Institute of Technology, Stockholm, Sweden). 
 All rights reserved. 
 
diff --git a/crypto/external/bsd/heimdal/dist/Makefile.am b/crypto/external/bsd/heimdal/dist/Makefile.am
index 603f8236b..3a2f52fe3 100644
--- a/crypto/external/bsd/heimdal/dist/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/Makefile.am
@@ -6,7 +6,7 @@ if KCM
 kcm_dir = kcm
 endif
 
-SUBDIRS=  include base lib kuser kdc admin kadmin kpasswd 
+SUBDIRS=  include lib kuser kdc admin kadmin kpasswd 
 SUBDIRS+= $(kcm_dir) appl tools tests packages etc po
 
 if HEIMDAL_DOCUMENTATION
@@ -38,6 +38,7 @@ EXTRA_DIST = \
 	autogen.sh \
 	krb5.conf \
 	cf/make-proto.pl \
+	cf/roken-h-process.pl \
 	cf/install-catman.sh \
 	cf/ChangeLog \
 	cf/c-function.m4 \
@@ -52,6 +53,13 @@ EXTRA_DIST = \
 	cf/krb-version.m4 \
 	cf/roken.m4 \
 	cf/valgrind-suppressions \
+	cf/maybe-valgrind.sh \
+	cf/symbol-version.py \
+	cf/w32-check-exported-symbols.pl \
+	cf/w32-def-from-dll.pl \
+	cf/w32-detect-vc-version.pl \
+	cf/w32-hh-toc-from-info.pl \
+	cf/w32-list-externs-from-objs.pl \
 	cf/vararray.m4
 
 print-distdir:
diff --git a/crypto/external/bsd/heimdal/dist/NEWS b/crypto/external/bsd/heimdal/dist/NEWS
index df8c95bbb..6d37ba33f 100644
--- a/crypto/external/bsd/heimdal/dist/NEWS
+++ b/crypto/external/bsd/heimdal/dist/NEWS
@@ -1,3 +1,134 @@
+Release Notes - Heimdal - Version Heimdal 7.1
+
+ Security
+
+ - kx509 realm-chopping security bug
+ - non-authorization of alias additions/removals in kadmind
+   (CVE-2016-2400)
+
+ Feature
+
+ - iprop has been revamped to fix a number of race conditions that could
+   lead to inconsistent replication
+ - Hierarchical capath support
+ - AES Encryption with HMAC-SHA2 for Kerberos 5
+   draft-ietf-kitten-aes-cts-hmac-sha2-11
+ - hcrypto is now thread safe on all platforms
+ - libhcrypto has new backends: CNG (Windows), PKCS#11 (mainly for
+   Solaris), and OpenSSL.  OpenSSL is now a first-class libhcrypto backend.
+   OpenSSL 1.0.x and 1.1 are both supported. AES-NI used when supported by
+   backend
+ - HDB now supports LMDB
+ - Thread support on Windows
+ - RFC 6113  Generalized Framework for Kerberos Pre-Authentication (FAST)
+ - New GSS APIs:
+   . gss_localname
+ - Allow setting what encryption types a principal should have with
+   [kadmin] default_key_rules, see krb5.conf manpage for more info
+ - Unify libhcrypto with LTC (libtomcrypto)
+ - asn1_compile 64-bit INTEGER functionality
+ - HDB key history support including --keepold kadmin password option
+ - Improved cross-realm key rollover safety
+ - New krb5_kuserok() and krb5_aname_to_localname() plug-in interfaces
+ - Improved MIT compatibility
+   . kadm5 API
+   . Migration from MIT KDB via "mitdb" HDB backend
+   . Capable of writing the HDB in MIT dump format
+ - Improved Active Directory interoperability
+   . Enctype selection issues for PAC and other authz-data signatures
+   . Cross realm key rollover (kvno 0)
+ - New [kdc] enctype negotiation configuration:
+   . tgt-use-strongest-session-key
+   . svc-use-strongest-session-key
+   . preauth-use-strongest-session-key
+   . use-strongest-server-key
+ - The KDC process now uses a multi-process model improving
+   resiliency and performance
+ - Allow batch-mode kinit with password file
+ - SIGINFO support added to kinit cmd
+ - New kx509 configuration options:
+   . kx509_ca
+   . kca_service
+   . kx509_include_pkinit_san
+   . kx509_template
+ - Improved Heimdal library/plugin version safety
+ - Name canonicalization
+   . DNS resolver searchlist
+   . Improved referral support
+   . Support host:port host-based services
+ - Pluggable libheimbase interface for DBs
+ - Improve IPv6 Support
+ - LDAP
+   . Bind DN and password
+   . Start TLS
+ - klist --json
+ - DIR credential cache type
+ - Updated upstream SQLite and libedit
+ - Removed legacy applications: ftp, kx, login, popper, push, rcp, rsh,
+   telnet, xnlock
+ - Completely remove RAND_egd support
+ - Moved kadmin and ktutil to /usr/bin
+ - Stricter fcache checks (see fcache_strict_checking krb5.conf setting)
+    . use O_NOFOLLOW
+    . don't follow symlinks
+    . require cache files to be owned by the user
+    . require sensible permissions (not group/other readable)
+ - Implemented gss_store_cred()
+ - Many more
+
+ Bug fixes
+ - iprop has been revamped to fix a number of race conditions that could
+   lead to data loss
+ - Include non-loopback addresses assigned to loopback interfaces
+   when requesting tickets with addresses
+ - KDC 1DES session key selection (for AFS rxkad-k5 compatibility)
+ - Keytab file descriptor and lock leak
+ - Credential cache corruption bugs
+   (NOTE: The FILE ccache is still not entirely safe due to the
+   fundamentally unsafe design of POSIX file locking)
+ - gss_pseudo_random() interop bug
+ - Plugins are now preferentially loaded from the run-time install tree
+ - Reauthentication after password change in init_creds_password
+ - Memory leak in the client kadmin library
+ - TGS client requests renewable/forwardable/proxiable when possible
+ - Locking issues in DB1 and DB3 HDB backends
+ - Master HDB can remain locked while waiting for network I/O
+ - Renewal/refresh logic when kinit is provided with a command
+ - KDC handling of enterprise principals
+ - Use correct bit for anon-pkinit
+ - Many more
+
+ Acknowledgements
+
+ This release of Heimdal includes contributions from:
+
+    Abhinav Upadhyay        Heath Kehoe             Nico Williams
+    Andreas Schneider       Henry Jacques           Patrik Lundin
+    Andrew Bartlett         Howard Chu              Philip Boulain
+    Andrew Tridgell         Igor Sobrado            Ragnar Sundblad
+    Antoine Jacoutot        Ingo Schwarze           Remi Ferrand
+    Arran Cudbard-Bell      Jakub ÄŒajka             Rod Widdowson
+    Arvid Requate           James Le Cuirot         Rok Papež
+    Asanka Herath           James Lee               Roland C. Dowdeswell
+    Ben Kaduk               Jeffrey Altman          Ross L Richardson
+    Benjamin Kaduk          Jeffrey Clark           Russ Allbery
+    Bernard Spil            Jeffrey Hutzelman       Samuel Cabrero
+    Brian May               Jelmer Vernooij         Samuel Thibault
+    Chas Williams           Ken Dreyer              Santosh Kumar Pradhan
+    Chaskiel Grundman       Kiran S J               Sean Davis
+    Dana Koch               Kumar Thangavelu        Sergio Gelato
+    Daniel Schepler         Landon Fuller           Simon Wilkinson
+    David Mulder            Linus Nordberg          Stef Walter
+    Douglas Bagnall         Love Hörnquist Åstrand  Stefan Metzmacher
+    Ed Maste                Luke Howard             Steffen Jaeckel
+    Eray Aslan              Magnus Ahltorp          Timothy Pearson
+    Florian Best            Marc Balmer             Tollef Fog Heen
+    Fredrik Pettai          Marcin Cieślak          Tony Acero
+    Greg Hudson             Marco Molteni           Uri Simchoni
+    Gustavo Zacarias        Matthieu Hautreux       Viktor Dukhovni
+    Günther Deschner        Michael Meffie          Volker Lendecke
+    Harald Barth            Moritz Lenz
+
 Release Notes - Heimdal - Version Heimdal 1.5.3
 
  Bug fixes
@@ -102,7 +233,7 @@ Release Notes - Heimdal - Version Heimdal 1.3
 
  - Support for settin friendly name on credential caches
  - Move to using doxygen to generate documentation.
- - Sprinkling __attribute__((depricated)) for old function to be removed
+ - Sprinkling __attribute__((__deprecated__)) for old function to be removed
  - Support to export LAST-REQUST information in AS-REQ
  - Support for client deferrals in in AS-REQ
  - Add seek support for krb5_storage.
diff --git a/crypto/external/bsd/heimdal/dist/NTMakefile b/crypto/external/bsd/heimdal/dist/NTMakefile
index fcd60a3d3..299d96c1f 100644
--- a/crypto/external/bsd/heimdal/dist/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/NTMakefile
@@ -29,12 +29,17 @@
 # POSSIBILITY OF SUCH DAMAGE.
 #
 
-!if exist(thirdparty/NTMakefile)
+!if exist("thirdparty\NTMakefile")
 thirdparty=thirdparty
 !endif
 
-SUBDIRS = include lib\roken base lib kuser kdc admin kadmin kpasswd appl doc \
+!ifdef APPVEYOR
+SUBDIRS = include lib kuser kdc admin kadmin kpasswd appl doc \
+	tools tests packages etc
+!else
+SUBDIRS = include lib kuser kdc admin kadmin kpasswd appl doc \
 	tools tests packages etc $(thirdparty) packages\windows\installer
+!endif
 
 !include windows/NTMakefile.w32
 
diff --git a/crypto/external/bsd/heimdal/dist/README.fast b/crypto/external/bsd/heimdal/dist/README.fast
new file mode 100644
index 000000000..389b6af47
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/README.fast
@@ -0,0 +1,17 @@
+
+-- in order of preference
+
+- client: support KRB5_PADATA_ENCRYPTED_CHALLENGE in lib/krb5/init_creds_pw.c
+- client: don't support ENC-TS in FAST
+
+- client: plugin support for fast plugins
+
+- kdc: plugin support for fast plugins
+	partly done with "struct kdc_patypes"
+
+- kcm: support FAST armor ticket
+-- using PK-INIT anonymous
+-- using host key
+
+- client: tgs-req fast support
+- kdc: tgs-req fast support
diff --git a/crypto/external/bsd/heimdal/dist/admin/Makefile.am b/crypto/external/bsd/heimdal/dist/admin/Makefile.am
index aa1d83b52..6db87a740 100644
--- a/crypto/external/bsd/heimdal/dist/admin/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/admin/Makefile.am
@@ -2,11 +2,11 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_readline) $(INCLUDE_hcrypto)
+AM_CPPFLAGS += $(INCLUDE_readline)
 
-man_MANS = ktutil.8
+man_MANS = ktutil.1
 
-sbin_PROGRAMS = ktutil
+bin_PROGRAMS = ktutil
 
 dist_ktutil_SOURCES =				\
 	add.c					\
diff --git a/crypto/external/bsd/heimdal/dist/admin/add.c b/crypto/external/bsd/heimdal/dist/admin/add.c
index d94a80c62..17e88c4cb 100644
--- a/crypto/external/bsd/heimdal/dist/admin/add.c
+++ b/crypto/external/bsd/heimdal/dist/admin/add.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: add.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: add.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 static char *
 readstring(const char *prompt, char *buf, size_t len)
diff --git a/crypto/external/bsd/heimdal/dist/admin/change.c b/crypto/external/bsd/heimdal/dist/admin/change.c
index cd4e5ab5b..afcccbfb5 100644
--- a/crypto/external/bsd/heimdal/dist/admin/change.c
+++ b/crypto/external/bsd/heimdal/dist/admin/change.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: change.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: change.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: change.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 static krb5_error_code
 change_entry (krb5_keytab keytab,
diff --git a/crypto/external/bsd/heimdal/dist/admin/copy.c b/crypto/external/bsd/heimdal/dist/admin/copy.c
index e299efa45..346662489 100644
--- a/crypto/external/bsd/heimdal/dist/admin/copy.c
+++ b/crypto/external/bsd/heimdal/dist/admin/copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: copy.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: copy.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: copy.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 
 static krb5_boolean
diff --git a/crypto/external/bsd/heimdal/dist/admin/destroy.c b/crypto/external/bsd/heimdal/dist/admin/destroy.c
index 8ea14d771..e089c3cda 100644
--- a/crypto/external/bsd/heimdal/dist/admin/destroy.c
+++ b/crypto/external/bsd/heimdal/dist/admin/destroy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: destroy.c,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: destroy.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/admin/get.c b/crypto/external/bsd/heimdal/dist/admin/get.c
index e73d1f16b..0b9e3ee47 100644
--- a/crypto/external/bsd/heimdal/dist/admin/get.c
+++ b/crypto/external/bsd/heimdal/dist/admin/get.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: get.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: get.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 static void*
 open_kadmin_connection(char *principal,
diff --git a/crypto/external/bsd/heimdal/dist/admin/ktutil-commands.in b/crypto/external/bsd/heimdal/dist/admin/ktutil-commands.in
index ce3a8a0c0..550b3c916 100644
--- a/crypto/external/bsd/heimdal/dist/admin/ktutil-commands.in
+++ b/crypto/external/bsd/heimdal/dist/admin/ktutil-commands.in
@@ -206,7 +206,7 @@ command = {
 		short = "V"
 		type = "integer"
 		help = "key version to remove"
-		argument = "enctype"
+		argument = "kvno"
 		default = "0"
 	}
 	option = {
diff --git a/crypto/external/bsd/heimdal/dist/admin/ktutil.8 b/crypto/external/bsd/heimdal/dist/admin/ktutil.1
similarity index 98%
rename from crypto/external/bsd/heimdal/dist/admin/ktutil.8
rename to crypto/external/bsd/heimdal/dist/admin/ktutil.1
index e1dbb25b9..4fa1fba74 100644
--- a/crypto/external/bsd/heimdal/dist/admin/ktutil.8
+++ b/crypto/external/bsd/heimdal/dist/admin/ktutil.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: ktutil.8,v 1.4 2014/04/25 00:26:16 pettai Exp $
+.\"	$NetBSD: ktutil.1,v 1.2 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -34,7 +34,7 @@
 .\" Id
 .\"
 .Dd April 14, 2005
-.Dt KTUTIL 8
+.Dt KTUTIL 1
 .Os
 .Sh NAME
 .Nm ktutil
@@ -123,4 +123,4 @@ that is at least
 (default one week) old.
 .El
 .Sh SEE ALSO
-.Xr kadmin 8
+.Xr kadmin 1
diff --git a/crypto/external/bsd/heimdal/dist/admin/ktutil.c b/crypto/external/bsd/heimdal/dist/admin/ktutil.c
index 387a3db83..070fba4a9 100644
--- a/crypto/external/bsd/heimdal/dist/admin/ktutil.c
+++ b/crypto/external/bsd/heimdal/dist/admin/ktutil.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ktutil.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: ktutil.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "ktutil_locl.h"
 #include <err.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: ktutil.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 static int help_flag;
 static int version_flag;
diff --git a/crypto/external/bsd/heimdal/dist/admin/ktutil_locl.h b/crypto/external/bsd/heimdal/dist/admin/ktutil_locl.h
index 0e2d37e53..ef8699275 100644
--- a/crypto/external/bsd/heimdal/dist/admin/ktutil_locl.h
+++ b/crypto/external/bsd/heimdal/dist/admin/ktutil_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ktutil_locl.h,v 1.1.1.2 2011/04/14 14:08:06 elric Exp $	*/
+/*	$NetBSD: ktutil_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/admin/list.c b/crypto/external/bsd/heimdal/dist/admin/list.c
index c65c9d09c..8f992b253 100644
--- a/crypto/external/bsd/heimdal/dist/admin/list.c
+++ b/crypto/external/bsd/heimdal/dist/admin/list.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: list.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: list.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "ktutil_locl.h"
 #include <krb5/rtbl.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: list.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 static int
 do_list(struct list_options *opt, const char *keytab_str)
@@ -134,11 +134,12 @@ do_list(struct list_options *opt, const char *keytab_str)
 
 	    for (i = 0; i< entry.aliases->len; i++) {
 		krb5_unparse_name_fixed(context, entry.principal, buf, sizeof(buf));
-		rk_strpoolprintf(p, "%s%s", buf,
-				 i + 1 < entry.aliases->len ? ", " : "");
+		p = rk_strpoolprintf(p, "%s%s", buf,
+                                     i + 1 < entry.aliases->len ? ", " : "");
 
 	    }
-	    rtbl_add_column_entry_by_id(table, 5, rk_strpoolcollect(p));
+	    rtbl_add_column_entry_by_id(table, 5, (s = rk_strpoolcollect(p)));
+            free(s);
 	}
 
 	krb5_kt_free_entry(context, &entry);
diff --git a/crypto/external/bsd/heimdal/dist/admin/purge.c b/crypto/external/bsd/heimdal/dist/admin/purge.c
index 2925922a6..f6c293145 100644
--- a/crypto/external/bsd/heimdal/dist/admin/purge.c
+++ b/crypto/external/bsd/heimdal/dist/admin/purge.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: purge.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: purge.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: purge.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 /*
  * keep track of the highest version for every principal.
diff --git a/crypto/external/bsd/heimdal/dist/admin/remove.c b/crypto/external/bsd/heimdal/dist/admin/remove.c
index b6b731e80..5628b6454 100644
--- a/crypto/external/bsd/heimdal/dist/admin/remove.c
+++ b/crypto/external/bsd/heimdal/dist/admin/remove.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: remove.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: remove.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: remove.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 int
 kt_remove(struct remove_options *opt, int argc, char **argv)
diff --git a/crypto/external/bsd/heimdal/dist/admin/rename.c b/crypto/external/bsd/heimdal/dist/admin/rename.c
index c85a4025a..76b63f8cc 100644
--- a/crypto/external/bsd/heimdal/dist/admin/rename.c
+++ b/crypto/external/bsd/heimdal/dist/admin/rename.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rename.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: rename.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2001-2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "ktutil_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: rename.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 int
 kt_rename(struct rename_options *opt, int argc, char **argv)
diff --git a/crypto/external/bsd/heimdal/dist/appveyor.yml b/crypto/external/bsd/heimdal/dist/appveyor.yml
new file mode 100644
index 000000000..837eb18d6
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/appveyor.yml
@@ -0,0 +1,54 @@
+#
+# This file tells appveyor.com how to build Heimdal on Windows.
+# Appveyor is a continuous integration (CI) service for github and other
+# users, and is free for public repositories.
+#
+
+install:
+  - C:\msys64\usr\bin\bash -lc "pacman --needed --noconfirm -Sy pacman-mirrors"
+  - C:\msys64\usr\bin\bash -lc "pacman --noconfirm -Sy"
+  - C:\msys64\usr\bin\bash -lc "pacman --noconfirm -S autoconf automake bison flex"
+
+build_script:
+  - set PSDKDir=C:\Program Files\Microsoft SDKs\Windows\v7.1
+  - call "C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.Cmd" %1 %2 /xp
+  - set WIXDIR="c:\Program Files (x86)\Windows Installer XML v3.5"
+  # We're not doing any codesigning in the Appveyor build yet.
+  - SET CODESIGN_PKT=0000000000000000
+  - set PATH=%PATH%;C:\Python26;C:\Perl64\bin;C:\tools\cygwin\bin;C:\Program Files (x86)\HTML Help Workshop
+  - set PATH=%PATH%;C:/msys64/usr/bin
+  - set PATH=%PATH%;C:\program files (x86)\windows installer xml v3.5\bin;C:\cygwin\bin
+  - set dbg__type=Debug
+  - title Heimdal Build %CPU% %dbg__type%
+  - echo PATH=%PATH%
+  # Newer texinfo has no .exe's, so we have to invoke it as
+  # "perl ...\makeinfo ...".  See doc/NTMakefile.
+  - nmake /f NTMakefile APPVEYOR=1 MAKEINFO=makeinfo NO_INSTALLERS=1
+  - 7z a heimdal-out.zip C:\projects\heimdal\out\
+
+test_script:
+  # Packages are not validated in the Appveyor build, FYI.
+  - nmake /f NTMakefile APPVEYOR=1 MAKEINFO=makeinfo NO_INSTALLERS=1 test
+
+artifacts:
+  - path: heimdal-out.zip
+    name: heimdal-out
+
+on_failure:
+  - appveyor PushArtifact heimdal-out.zip
+
+# To get RDP access to an appveyor worker for debugging a build, just
+# uncomment these next two lines and the last two lines too.
+#init:
+#  - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
+
+# Uncomment this to allow the RDP session to continue after the build
+# finishes.
+#
+# There's a delete-me file on the desktop that one should delete when
+# one is done with the worker.  RDP sessions are capped at 60 minutes as
+# of this writing.
+#
+#on_finish:
+#  - ps: $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
+
diff --git a/crypto/external/bsd/heimdal/dist/autogen.sh b/crypto/external/bsd/heimdal/dist/autogen.sh
index c57ba81e7..fc504dca2 100755
--- a/crypto/external/bsd/heimdal/dist/autogen.sh
+++ b/crypto/external/bsd/heimdal/dist/autogen.sh
@@ -5,3 +5,5 @@
 set -e
 autoreconf -f -i || { echo "autoreconf failed: $?"; exit 1; }
 find . \( -name '*-private.h' -o -name '*-protos.h' \) | xargs rm -f
+perl -MJSON -e 'print foo;' || \
+    { echo "you must install JSON perl module (cpan install JSON)"; exit 1; }
diff --git a/crypto/external/bsd/heimdal/dist/base/array.c b/crypto/external/bsd/heimdal/dist/base/array.c
deleted file mode 100644
index e2d5df207..000000000
--- a/crypto/external/bsd/heimdal/dist/base/array.c
+++ /dev/null
@@ -1,236 +0,0 @@
-/*	$NetBSD: array.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
-
-/*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "baselocl.h"
-
-/*
- *
- */
-
-struct heim_array_data {
-    size_t len;
-    heim_object_t *val;
-};
-
-static void
-array_dealloc(heim_object_t ptr)
-{
-    heim_array_t array = ptr;
-    size_t n;
-    for (n = 0; n < array->len; n++)
-	heim_release(array->val[n]);
-    free(array->val);
-}
-
-struct heim_type_data array_object = {
-    HEIM_TID_ARRAY,
-    "dict-object",
-    NULL,
-    array_dealloc,
-    NULL,
-    NULL,
-    NULL
-};
-
-/**
- * Allocate an array
- *
- * @return A new allocated array, free with heim_release()
- */
-
-heim_array_t
-heim_array_create(void)
-{
-    heim_array_t array;
-
-    array = _heim_alloc_object(&array_object, sizeof(*array));
-    if (array == NULL)
-	return NULL;
-
-    array->val = NULL;
-    array->len = 0;
-
-    return array;
-}
-
-/**
- * Get type id of an dict
- *
- * @return the type id
- */
-
-heim_tid_t
-heim_array_get_type_id(void)
-{
-    return HEIM_TID_ARRAY;
-}
-
-/**
- * Append object to array
- *
- * @param array array to add too
- * @param object the object to add
- *
- * @return zero if added, errno otherwise
- */
-
-int
-heim_array_append_value(heim_array_t array, heim_object_t object)
-{
-    heim_object_t *ptr;
-
-    ptr = realloc(array->val, (array->len + 1) * sizeof(array->val[0]));
-    if (ptr == NULL)
-	return ENOMEM;
-    array->val = ptr;
-    array->val[array->len++] = heim_retain(object);
-
-    return 0;
-}
-
-/**
- * Iterate over all objects in array
- *
- * @param array array to iterate over
- * @param fn function to call on each object
- * @param ctx context passed to fn
- */
-
-void
-heim_array_iterate_f(heim_array_t array, heim_array_iterator_f_t fn, void *ctx)
-{
-    size_t n;
-    for (n = 0; n < array->len; n++)
-	fn(array->val[n], ctx);
-}
-
-#ifdef __BLOCKS__
-/**
- * Iterate over all objects in array
- *
- * @param array array to iterate over
- * @param fn block to call on each object
- */
-
-void
-heim_array_iterate(heim_array_t array, void (^fn)(heim_object_t))
-{
-    size_t n;
-    for (n = 0; n < array->len; n++)
-	fn(array->val[n]);
-}
-#endif
-
-/**
- * Get length of array
- *
- * @param array array to get length of
- *
- * @return length of array
- */
-
-size_t
-heim_array_get_length(heim_array_t array)
-{
-    return array->len;
-}
-
-/**
- * Copy value of array
- *
- * @param array array copy object from
- * @param idx index of object, 0 based, must be smaller then
- *        heim_array_get_length()
- *
- * @return a retained copy of the object
- */
-
-heim_object_t
-heim_array_copy_value(heim_array_t array, size_t idx)
-{
-    if (idx >= array->len)
-	heim_abort("index too large");
-    return heim_retain(array->val[idx]);
-}
-
-/**
- * Delete value at idx
- *
- * @param array the array to modify
- * @param idx the key to delete
- */
-
-void
-heim_array_delete_value(heim_array_t array, size_t idx)
-{
-    heim_object_t obj;
-    if (idx >= array->len)
-	heim_abort("index too large");
-    obj = array->val[idx];
-
-    array->len--;
-
-    if (idx < array->len)
-	memmove(&array->val[idx], &array->val[idx + 1],
-		(array->len - idx) * sizeof(array->val[0]));
-
-    heim_release(obj);
-}
-
-#ifdef __BLOCKS__
-/**
- * Get value at idx
- *
- * @param array the array to modify
- * @param idx the key to delete
- */
-
-void
-heim_array_filter(heim_array_t array, int (^block)(heim_object_t))
-{
-    size_t n = 0;
-
-    while (n < array->len) {
-	if (block(array->val[n])) {
-	    heim_array_delete_value(array, n);
-	} else {
-	    n++;
-	}
-    }
-}
-
-#endif /* __BLOCKS__ */
diff --git a/crypto/external/bsd/heimdal/dist/base/heimbase.c b/crypto/external/bsd/heimdal/dist/base/heimbase.c
deleted file mode 100644
index f5ed22b46..000000000
--- a/crypto/external/bsd/heimdal/dist/base/heimbase.c
+++ /dev/null
@@ -1,561 +0,0 @@
-/*	$NetBSD: heimbase.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
-
-/*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "baselocl.h"
-#include <syslog.h>
-
-static heim_base_atomic_type tidglobal = HEIM_TID_USER;
-
-struct heim_base {
-    heim_type_t isa;
-    heim_base_atomic_type ref_cnt;
-    HEIM_TAILQ_ENTRY(heim_base) autorel;
-    heim_auto_release_t autorelpool;
-    uintptr_t isaextra[3];
-};
-
-/* specialized version of base */
-struct heim_base_mem {
-    heim_type_t isa;
-    heim_base_atomic_type ref_cnt;
-    HEIM_TAILQ_ENTRY(heim_base) autorel;
-    heim_auto_release_t autorelpool;
-    const char *name;
-    void (*dealloc)(void *);
-    uintptr_t isaextra[1];
-};
-
-#define PTR2BASE(ptr) (((struct heim_base *)ptr) - 1)
-#define BASE2PTR(ptr) ((void *)(((struct heim_base *)ptr) + 1))
-
-#ifdef HEIM_BASE_NEED_ATOMIC_MUTEX
-HEIMDAL_MUTEX _heim_base_mutex = HEIMDAL_MUTEX_INITIALIZER;
-#endif
-
-/*
- * Auto release structure
- */
-
-struct heim_auto_release {
-    HEIM_TAILQ_HEAD(, heim_base) pool;
-    HEIMDAL_MUTEX pool_mutex;
-    struct heim_auto_release *parent;
-};
-
-
-/**
- * Retain object
- *
- * @param object to be released, NULL is ok
- *
- * @return the same object as passed in
- */
-
-void *
-heim_retain(void *ptr)
-{
-    struct heim_base *p = PTR2BASE(ptr);
-
-    if (ptr == NULL || heim_base_is_tagged(ptr))
-	return ptr;
-
-    if (p->ref_cnt == heim_base_atomic_max)
-	return ptr;
-
-    if ((heim_base_atomic_inc(&p->ref_cnt) - 1) == 0)
-	heim_abort("resurection");
-    return ptr;
-}
-
-/**
- * Release object, free is reference count reaches zero
- *
- * @param object to be released
- */
-
-void
-heim_release(void *ptr)
-{
-    heim_base_atomic_type old;
-    struct heim_base *p = PTR2BASE(ptr);
-
-    if (ptr == NULL || heim_base_is_tagged(ptr))
-	return;
-
-    if (p->ref_cnt == heim_base_atomic_max)
-	return;
-
-    old = heim_base_atomic_dec(&p->ref_cnt) + 1;
-
-    if (old > 1)
-	return;
-
-    if (old == 1) {
-	heim_auto_release_t ar = p->autorelpool;
-	/* remove from autorel pool list */
-	if (ar) {
-	    p->autorelpool = NULL;
-	    HEIMDAL_MUTEX_lock(&ar->pool_mutex);
-	    HEIM_TAILQ_REMOVE(&ar->pool, p, autorel);
-	    HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
-	}
-	if (p->isa->dealloc)
-	    p->isa->dealloc(ptr);
-	free(p);
-    } else
-	heim_abort("over release");
-}
-
-static heim_type_t tagged_isa[9] = {
-    &_heim_number_object,
-    &_heim_null_object,
-    &_heim_bool_object,
-
-    NULL,
-    NULL,
-    NULL,
-
-    NULL,
-    NULL,
-    NULL
-};
-
-heim_type_t
-_heim_get_isa(heim_object_t ptr)
-{
-    struct heim_base *p;
-    if (heim_base_is_tagged(ptr)) {
-	if (heim_base_is_tagged_object(ptr))
-	    return tagged_isa[heim_base_tagged_object_tid(ptr)];
-	heim_abort("not a supported tagged type");
-    }
-    p = PTR2BASE(ptr);
-    return p->isa;
-}
-
-/**
- * Get type ID of object
- *
- * @param object object to get type id of
- *
- * @return type id of object
- */
-
-heim_tid_t
-heim_get_tid(heim_object_t ptr)
-{
-    heim_type_t isa = _heim_get_isa(ptr);
-    return isa->tid;
-}
-
-/**
- * Get hash value of object
- *
- * @param object object to get hash value for
- *
- * @return a hash value
- */
-
-unsigned long
-heim_get_hash(heim_object_t ptr)
-{
-    heim_type_t isa = _heim_get_isa(ptr);
-    if (isa->hash)
-	return isa->hash(ptr);
-    return (unsigned long)ptr;
-}
-
-/**
- * Compare two objects, returns 0 if equal, can use used for qsort()
- * and friends.
- *
- * @param a first object to compare
- * @param b first object to compare
- *
- * @return 0 if objects are equal
- */
-
-int
-heim_cmp(heim_object_t a, heim_object_t b)
-{
-    heim_tid_t ta, tb;
-    heim_type_t isa;
-
-    ta = heim_get_tid(a);
-    tb = heim_get_tid(b);
-
-    if (ta != tb)
-	return ta - tb;
-
-    isa = _heim_get_isa(a);
-
-    if (isa->cmp)
-	return isa->cmp(a, b);
-
-    return (uintptr_t)a - (uintptr_t)b;
-}
-
-/*
- * Private - allocates an memory object
- */
-
-static void
-memory_dealloc(void *ptr)
-{
-    struct heim_base_mem *p = (struct heim_base_mem *)PTR2BASE(ptr);
-    if (p->dealloc)
-	p->dealloc(ptr);
-}
-
-struct heim_type_data memory_object = {
-    HEIM_TID_MEMORY,
-    "memory-object",
-    NULL,
-    memory_dealloc,
-    NULL,
-    NULL,
-    NULL
-};
-
-void *
-heim_alloc(size_t size, const char *name, heim_type_dealloc dealloc)
-{
-    /* XXX use posix_memalign */
-
-    struct heim_base_mem *p = calloc(1, size + sizeof(*p));
-    if (p == NULL)
-	return NULL;
-    p->isa = &memory_object;
-    p->ref_cnt = 1;
-    p->name = name;
-    p->dealloc = dealloc;
-    return BASE2PTR(p);
-}
-
-heim_type_t
-_heim_create_type(const char *name,
-		  heim_type_init init,
-		  heim_type_dealloc dealloc,
-		  heim_type_copy copy,
-		  heim_type_cmp cmp,
-		  heim_type_hash hash)
-{
-    heim_type_t type;
-
-    type = calloc(1, sizeof(*type));
-    if (type == NULL)
-	return NULL;
-
-    type->tid = heim_base_atomic_inc(&tidglobal);
-    type->name = name;
-    type->init = init;
-    type->dealloc = dealloc;
-    type->copy = copy;
-    type->cmp = cmp;
-    type->hash = hash;
-
-    return type;
-}
-
-heim_object_t
-_heim_alloc_object(heim_type_t type, size_t size)
-{
-    /* XXX should use posix_memalign */
-    struct heim_base *p = calloc(1, size + sizeof(*p));
-    if (p == NULL)
-	return NULL;
-    p->isa = type;
-    p->ref_cnt = 1;
-
-    return BASE2PTR(p);
-}
-
-heim_tid_t
-_heim_type_get_tid(heim_type_t type)
-{
-    return type->tid;
-}
-
-/**
- * Call func once and only once
- *
- * @param once pointer to a heim_base_once_t
- * @param ctx context passed to func
- * @param func function to be called
- */
-
-void
-heim_base_once_f(heim_base_once_t *once, void *ctx, void (*func)(void *))
-{
-#ifdef HAVE_DISPATCH_DISPATCH_H
-    dispatch_once_f(once, ctx, func);
-#else
-    static HEIMDAL_MUTEX mutex = HEIMDAL_MUTEX_INITIALIZER;
-    HEIMDAL_MUTEX_lock(&mutex);
-    if (*once == 0) {
-	*once = 1;
-	HEIMDAL_MUTEX_unlock(&mutex);
-	func(ctx);
-	HEIMDAL_MUTEX_lock(&mutex);
-	*once = 2;
-	HEIMDAL_MUTEX_unlock(&mutex);
-    } else if (*once == 2) {
-	HEIMDAL_MUTEX_unlock(&mutex);
-    } else {
-	HEIMDAL_MUTEX_unlock(&mutex);
-	while (1) {
-	    struct timeval tv = { 0, 1000 };
-	    select(0, NULL, NULL, NULL, &tv);
-	    HEIMDAL_MUTEX_lock(&mutex);
-	    if (*once == 2)
-		break;
-	    HEIMDAL_MUTEX_unlock(&mutex);
-	}
-	HEIMDAL_MUTEX_unlock(&mutex);
-    }
-#endif
-}
-
-/**
- * Abort and log the failure (using syslog)
- */
-
-void
-heim_abort(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    heim_abortv(fmt, ap);
-    va_end(ap);
-}
-
-/**
- * Abort and log the failure (using syslog)
- */
-
-void
-heim_abortv(const char *fmt, va_list ap)
-{
-    static char str[1024];
-
-    vsnprintf(str, sizeof(str), fmt, ap);
-    syslog(LOG_ERR, "heim_abort: %s", str);
-    abort();
-}
-
-/*
- *
- */
-
-static int ar_created = 0;
-static HEIMDAL_thread_key ar_key;
-
-struct ar_tls {
-    struct heim_auto_release *head;
-    struct heim_auto_release *current;
-    HEIMDAL_MUTEX tls_mutex;
-};
-
-static void
-ar_tls_delete(void *ptr)
-{
-    struct ar_tls *tls = ptr;
-    if (tls->head)
-	heim_release(tls->head);
-    free(tls);
-}
-
-static void
-init_ar_tls(void *ptr)
-{
-    int ret;
-    HEIMDAL_key_create(&ar_key, ar_tls_delete, ret);
-    if (ret == 0)
-	ar_created = 1;
-}
-
-static struct ar_tls *
-autorel_tls(void)
-{
-    static heim_base_once_t once = HEIM_BASE_ONCE_INIT;
-    struct ar_tls *arp;
-    int ret;
-
-    heim_base_once_f(&once, NULL, init_ar_tls);
-    if (!ar_created)
-	return NULL;
-
-    arp = HEIMDAL_getspecific(ar_key);
-    if (arp == NULL) {
-
-	arp = calloc(1, sizeof(*arp));
-	if (arp == NULL)
-	    return NULL;
-	HEIMDAL_setspecific(ar_key, arp, ret);
-	if (ret) {
-	    free(arp);
-	    return NULL;
-	}
-    }
-    return arp;
-
-}
-
-static void
-autorel_dealloc(void *ptr)
-{
-    heim_auto_release_t ar = ptr;
-    struct ar_tls *tls;
-
-    tls = autorel_tls();
-    if (tls == NULL)
-	heim_abort("autorelease pool released on thread w/o autorelease inited");
-
-    heim_auto_release_drain(ar);
-
-    if (!HEIM_TAILQ_EMPTY(&ar->pool))
-	heim_abort("pool not empty after draining");
-
-    HEIMDAL_MUTEX_lock(&tls->tls_mutex);
-    if (tls->current != ptr)
-	heim_abort("autorelease not releaseing top pool");
-
-    if (tls->current != tls->head)
-	tls->current = ar->parent;
-    HEIMDAL_MUTEX_unlock(&tls->tls_mutex);
-}
-
-static int
-autorel_cmp(void *a, void *b)
-{
-    return (a == b);
-}
-
-static unsigned long
-autorel_hash(void *ptr)
-{
-    return (unsigned long)ptr;
-}
-
-
-static struct heim_type_data _heim_autorel_object = {
-    HEIM_TID_AUTORELEASE,
-    "autorelease-pool",
-    NULL,
-    autorel_dealloc,
-    NULL,
-    autorel_cmp,
-    autorel_hash
-};
-
-/**
- *
- */
-
-heim_auto_release_t
-heim_auto_release_create(void)
-{
-    struct ar_tls *tls = autorel_tls();
-    heim_auto_release_t ar;
-
-    if (tls == NULL)
-	heim_abort("Failed to create/get autorelease head");
-
-    ar = _heim_alloc_object(&_heim_autorel_object, sizeof(struct heim_auto_release));
-    if (ar) {
-	HEIMDAL_MUTEX_lock(&tls->tls_mutex);
-	if (tls->head == NULL)
-	    tls->head = ar;
-	ar->parent = tls->current;
-	tls->current = ar;
-	HEIMDAL_MUTEX_unlock(&tls->tls_mutex);
-    }
-
-    return ar;
-}
-
-/**
- * Mark the current object as a
- */
-
-void
-heim_auto_release(heim_object_t ptr)
-{
-    struct heim_base *p = PTR2BASE(ptr);
-    struct ar_tls *tls = autorel_tls();
-    heim_auto_release_t ar;
-
-    if (ptr == NULL || heim_base_is_tagged(ptr))
-	return;
-
-    /* drop from old pool */
-    if ((ar = p->autorelpool) != NULL) {
-	HEIMDAL_MUTEX_lock(&ar->pool_mutex);
-	HEIM_TAILQ_REMOVE(&ar->pool, p, autorel);
-	p->autorelpool = NULL;
-	HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
-    }
-
-    if (tls == NULL || (ar = tls->current) == NULL)
-	heim_abort("no auto relase pool in place, would leak");
-
-    HEIMDAL_MUTEX_lock(&ar->pool_mutex);
-    HEIM_TAILQ_INSERT_HEAD(&ar->pool, p, autorel);
-    p->autorelpool = ar;
-    HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
-}
-
-/**
- *
- */
-
-void
-heim_auto_release_drain(heim_auto_release_t autorel)
-{
-    heim_object_t obj;
-
-    /* release all elements on the tail queue */
-
-    HEIMDAL_MUTEX_lock(&autorel->pool_mutex);
-    while(!HEIM_TAILQ_EMPTY(&autorel->pool)) {
-	obj = HEIM_TAILQ_FIRST(&autorel->pool);
-	HEIMDAL_MUTEX_unlock(&autorel->pool_mutex);
-	heim_release(BASE2PTR(obj));
-	HEIMDAL_MUTEX_lock(&autorel->pool_mutex);
-    }
-    HEIMDAL_MUTEX_unlock(&autorel->pool_mutex);
-}
diff --git a/crypto/external/bsd/heimdal/dist/base/heimbase.h b/crypto/external/bsd/heimdal/dist/base/heimbase.h
deleted file mode 100644
index 7fe85a1f7..000000000
--- a/crypto/external/bsd/heimdal/dist/base/heimbase.h
+++ /dev/null
@@ -1,190 +0,0 @@
-/*	$NetBSD: heimbase.h,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
-
-/*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef HEIM_BASE_H
-#define HEIM_BASE_H 1
-
-#include <sys/types.h>
-#include <krb5/krb5-types.h>
-#include <stdarg.h>
-#include <stdbool.h>
-
-typedef void * heim_object_t;
-typedef unsigned int heim_tid_t;
-typedef heim_object_t heim_bool_t;
-typedef heim_object_t heim_null_t;
-#define HEIM_BASE_ONCE_INIT 0
-typedef long heim_base_once_t; /* XXX arch dependant */
-
-#if !defined(__has_extension)
-#define __has_extension(x) 0
-#endif
-
-#define HEIM_REQUIRE_GNUC(m,n,p) \
-    (((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + __GNUC_PATCHLEVEL__) >= \
-     (((m) * 10000) + ((n) * 100) + (p)))
-
-
-#if __has_extension(__builtin_expect) || HEIM_REQUIRE_GNUC(3,0,0)
-#define heim_builtin_expect(_op,_res) __builtin_expect(_op,_res)
-#else
-#define heim_builtin_expect(_op,_res) (_op)
-#endif
-
-
-void *	heim_retain(heim_object_t);
-void	heim_release(heim_object_t);
-
-typedef void (*heim_type_dealloc)(void *);
-
-void *
-heim_alloc(size_t size, const char *name, heim_type_dealloc dealloc);
-
-heim_tid_t
-heim_get_tid(heim_object_t object);
-
-int
-heim_cmp(heim_object_t a, heim_object_t b);
-
-unsigned long
-heim_get_hash(heim_object_t ptr);
-
-void
-heim_base_once_f(heim_base_once_t *, void *, void (*)(void *));
-
-void
-heim_abort(const char *fmt, ...)
-    HEIMDAL_NORETURN_ATTRIBUTE
-    HEIMDAL_PRINTF_ATTRIBUTE((printf, 1, 2));
-
-void
-heim_abortv(const char *fmt, va_list ap)
-    HEIMDAL_NORETURN_ATTRIBUTE
-    HEIMDAL_PRINTF_ATTRIBUTE((printf, 1, 0));
-
-#define heim_assert(e,t) \
-    (heim_builtin_expect(!(e), 0) ? heim_abort(t ":" #e) : (void)0)
-
-/*
- *
- */
-
-heim_null_t
-heim_null_create(void);
-
-heim_bool_t
-heim_bool_create(int);
-
-int
-heim_bool_val(heim_bool_t);
-
-/*
- * Array
- */
-
-typedef struct heim_array_data *heim_array_t;
-
-heim_array_t heim_array_create(void);
-heim_tid_t heim_array_get_type_id(void);
-
-typedef void (*heim_array_iterator_f_t)(heim_object_t, void *);
-
-int	heim_array_append_value(heim_array_t, heim_object_t);
-void	heim_array_iterate_f(heim_array_t, heim_array_iterator_f_t, void *);
-#ifdef __BLOCKS__
-void	heim_array_iterate(heim_array_t, void (^)(heim_object_t));
-#endif
-size_t	heim_array_get_length(heim_array_t);
-heim_object_t
-	heim_array_copy_value(heim_array_t, size_t);
-void	heim_array_delete_value(heim_array_t, size_t);
-#ifdef __BLOCKS__
-void	heim_array_filter(heim_array_t, int (^)(heim_object_t));
-#endif
-
-/*
- * Dict
- */
-
-typedef struct heim_dict_data *heim_dict_t;
-
-heim_dict_t heim_dict_create(size_t size);
-heim_tid_t heim_dict_get_type_id(void);
-
-typedef void (*heim_dict_iterator_f_t)(heim_object_t, heim_object_t, void *);
-
-int	heim_dict_add_value(heim_dict_t, heim_object_t, heim_object_t);
-void	heim_dict_iterate_f(heim_dict_t, heim_dict_iterator_f_t, void *);
-#ifdef __BLOCKS__
-void	heim_dict_iterate(heim_dict_t, void (^)(heim_object_t, heim_object_t));
-#endif
-
-heim_object_t
-	heim_dict_copy_value(heim_dict_t, heim_object_t);
-void	heim_dict_delete_key(heim_dict_t, heim_object_t);
-
-/*
- * String
- */
-
-typedef struct heim_string_data *heim_string_t;
-
-heim_string_t heim_string_create(const char *);
-heim_tid_t heim_string_get_type_id(void);
-const char * heim_string_get_utf8(heim_string_t);
-
-/*
- * Number
- */
-
-typedef struct heim_number_data *heim_number_t;
-
-heim_number_t heim_number_create(int);
-heim_tid_t heim_number_get_type_id(void);
-int heim_number_get_int(heim_number_t);
-
-/*
- *
- */
-
-typedef struct heim_auto_release * heim_auto_release_t;
-
-heim_auto_release_t heim_auto_release_create(void);
-void heim_auto_release_drain(heim_auto_release_t);
-void heim_auto_release(heim_object_t);
-
-#endif /* HEIM_BASE_H */
diff --git a/crypto/external/bsd/heimdal/dist/base/json.c b/crypto/external/bsd/heimdal/dist/base/json.c
deleted file mode 100644
index ed4d2aee2..000000000
--- a/crypto/external/bsd/heimdal/dist/base/json.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/*	$NetBSD: json.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
-
-/*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "baselocl.h"
-
-
-int
-heim_base2json(heim_object_t obj,
-	       void (*out)(char *, void *), void *ctx)
-{
-    heim_tid_t type = heim_get_tid(obj);
-    __block int fail = 0, needcomma = 0;
-
-    switch (type) {
-    case HEIM_TID_ARRAY:
-	out("[ ", ctx);
-	heim_array_iterate(obj, ^(heim_object_t sub) {
-		if (needcomma)
-		    out(", ", ctx);
-		fail |= heim_base2json(sub, out, ctx);
-		needcomma = 1;
-	    });
-	out("]", ctx);
-	break;
-
-    case HEIM_TID_DICT:
-	out("{ ", ctx);
-	heim_dict_iterate(obj, ^(heim_object_t key, heim_object_t value) {
-		if (needcomma)
-		    out(", ", ctx);
-		fail |= heim_base2json(key, out, ctx);
-		out(" = ", ctx);
-		fail |= heim_base2json(value, out, ctx);
-		needcomma = 1;
-	    });
-	out("}", ctx);
-	break;
-
-    case HEIM_TID_STRING:
-	out("\"", ctx);
-	out(heim_string_get_utf8(obj), ctx);
-	out("\"", ctx);
-	break;
-
-    case HEIM_TID_NUMBER: {
-	char num[16];
-	snprintf(num, sizeof(num), "%d", heim_number_get_int(obj));
-	out(num, ctx);
-	break;
-    }
-    case HEIM_TID_NULL:
-	out("null", ctx);
-	break;
-    case HEIM_TID_BOOL:
-	out(heim_bool_val(obj) ? "true" : "false", ctx);
-	break;
-    default:
-	return 1;
-    }
-    return fail;
-}
-
-static int
-parse_dict(heim_dict_t dict, char * const *pp, size_t *len)
-{
-    const char *p = *pp;
-    while (*len) {
-	(*len)--;
-
-	if (*p == '\n') {
-	    p += 1;
-	} else if (isspace(*p)) {
-	    p += 1;
-	} else if (*p == '}') {
-	    *pp = p + 1;
-	    return 0;
-	} else {
-	}
-    }
-    return ENOENT;
-}
-
-
-heim_object_t
-heim_json2base(const void *data, size_t length)
-{
-    heim_array_t stack;
-    heim_object_t o = NULL;
-    const char *p = data;
-    unsigned long lineno = 1;
-
-    while (length) {
-	length--;
-
-	if (*p == '\n') {
-	    lineno++;
-	} else if (isspace((int)*p)) {
-	    ;
-	} else if (*p == '{') {
-	    o = heim_dict_create();
-
-	    if ((ret = parse_dict(&p, &length)) != 0)
-		goto out;
-	} else
-	    abort();
-    }
-
- out:
-    if (ret && o) {
-	heim_release(o);
-	o = NULL;
-    }
-
-    return o;
-}
diff --git a/crypto/external/bsd/heimdal/dist/base/test_base.c b/crypto/external/bsd/heimdal/dist/base/test_base.c
deleted file mode 100644
index eaf038403..000000000
--- a/crypto/external/bsd/heimdal/dist/base/test_base.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*	$NetBSD: test_base.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
-
-/*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdio.h>
-#include <err.h>
-
-#include <krb5/heimbase.h>
-#include "heimbasepriv.h"
-
-static void
-memory_free(heim_object_t obj)
-{
-}
-
-static int
-test_memory(void)
-{
-    void *ptr;
-
-    ptr = heim_alloc(10, "memory", memory_free);
-
-    heim_retain(ptr);
-    heim_release(ptr);
-
-    heim_retain(ptr);
-    heim_release(ptr);
-
-    heim_release(ptr);
-
-    ptr = heim_alloc(10, "memory", NULL);
-    heim_release(ptr);
-
-    return 0;
-}
-
-static int
-test_dict(void)
-{
-    heim_dict_t dict;
-    heim_number_t a1 = heim_number_create(1);
-    heim_string_t a2 = heim_string_create("hejsan");
-    heim_number_t a3 = heim_number_create(3);
-    heim_string_t a4 = heim_string_create("foosan");
-
-    dict = heim_dict_create(10);
-
-    heim_dict_add_value(dict, a1, a2);
-    heim_dict_add_value(dict, a3, a4);
-
-    heim_dict_delete_key(dict, a3);
-    heim_dict_delete_key(dict, a1);
-
-    heim_release(a1);
-    heim_release(a2);
-    heim_release(a3);
-    heim_release(a4);
-
-    heim_release(dict);
-
-    return 0;
-}
-
-static int
-test_auto_release(void)
-{
-    heim_auto_release_t ar1, ar2;
-    heim_number_t n1;
-    heim_string_t s1;
-
-    ar1 = heim_auto_release_create();
-
-    s1 = heim_string_create("hejsan");
-    heim_auto_release(s1);
-
-    n1 = heim_number_create(1);
-    heim_auto_release(n1);
-
-    ar2 = heim_auto_release_create();
-
-    n1 = heim_number_create(1);
-    heim_auto_release(n1);
-
-    heim_release(ar2);
-    heim_release(ar1);
-
-    return 0;
-}
-
-static int
-test_string(void)
-{
-    heim_string_t s1, s2;
-    const char *string = "hejsan";
-
-    s1 = heim_string_create(string);
-    s2 = heim_string_create(string);
-
-    if (heim_cmp(s1, s2) != 0) {
-	printf("the same string is not the same\n");
-	exit(1);
-    }
-
-    heim_release(s1);
-    heim_release(s2);
-
-    return 0;
-}
-
-int
-main(int argc, char **argv)
-{
-    int res = 0;
-
-    res |= test_memory();
-    res |= test_dict();
-    res |= test_auto_release();
-    res |= test_string();
-
-    return res;
-}
diff --git a/crypto/external/bsd/heimdal/dist/base/version-script.map b/crypto/external/bsd/heimdal/dist/base/version-script.map
deleted file mode 100644
index 007052bae..000000000
--- a/crypto/external/bsd/heimdal/dist/base/version-script.map
+++ /dev/null
@@ -1,28 +0,0 @@
-HEIMDAL_BASE_1.0 {
-	global:
-		heim_abort;
-		heim_alloc;
-		heim_array_append_value;
-		heim_array_copy_value;
-		heim_array_create;
-		heim_array_delete_value;
-		heim_array_get_length;
-		heim_array_iterate_f;
-		heim_auto_release;
-		heim_auto_release_create;
-		heim_auto_release_drain;
-		heim_base_once_f;
-		heim_cmp;
-		heim_dict_add_value;
-		heim_dict_copy_value;
-		heim_dict_create;
-		heim_dict_delete_key;
-		heim_dict_iterate_f;
-		heim_release;
-		heim_retain;
-		heim_string_create;
-		heim_string_get_utf8;
-		heim_number_create;
-	local:
-		*;
-};
diff --git a/crypto/external/bsd/heimdal/dist/cf/Makefile.am.common b/crypto/external/bsd/heimdal/dist/cf/Makefile.am.common
index 88e3c49f8..be65e3bf1 100644
--- a/crypto/external/bsd/heimdal/dist/cf/Makefile.am.common
+++ b/crypto/external/bsd/heimdal/dist/cf/Makefile.am.common
@@ -1,6 +1,6 @@
 # Id
 
-SUFFIXES = .et .h
+SUFFIXES = .et .h .pc.in .pc
 
 DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir)/include -I$(top_srcdir)/include
 
@@ -45,10 +45,8 @@ LIB_tgetent		= @LIB_tgetent@
 LIB_com_err		= @LIB_com_err@
 LIB_door_create		= @LIB_door_create@
 
-HESIODLIB = @HESIODLIB@
-HESIODINCLUDE = @HESIODINCLUDE@
-INCLUDE_hesiod = @INCLUDE_hesiod@
-LIB_hesiod = @LIB_hesiod@
+LIB_openssl_crypto      = @LIB_openssl_crypto@
+INCLUDE_openssl_crypto  = @INCLUDE_openssl_crypto@
 
 INCLUDE_krb4 = @INCLUDE_krb4@
 LIB_krb4 = @LIB_krb4@
@@ -66,17 +64,31 @@ libexec_heimdaldir = $(libexecdir)/heimdal
 install-suid-programs:
 	@foo='$(bin_SUIDS)'; \
 	for file in $$foo; do \
-	x=$(DESTDIR)$(bindir)/$$file; \
-	if chown 0:0 $$x && chmod u+s $$x; then :; else \
-	echo "*"; \
-	echo "* Failed to install $$x setuid root"; \
-	echo "*"; \
-	fi; done
+		x=$(DESTDIR)$(bindir)/$$file; \
+		if chown 0:0 $$x && chmod u+s $$x; then :; else \
+			echo "*"; \
+			echo "* Failed to install $$x setuid root"; \
+			echo "*"; \
+		fi; \
+	done
 
-install-exec-hook: install-suid-programs
+install-exec-local: install-suid-programs
 
-install-build-headers:: $(include_HEADERS) $(dist_include_HEADERS) $(nodist_include_HEADERS) $(build_HEADERZ) $(nobase_include_HEADERS)
-	@foo='$(include_HEADERS) $(dist_include_HEADERS) $(nodist_include_HEADERS) $(build_HEADERZ)'; \
+codesign-all:
+	@if [ X"$$CODE_SIGN_IDENTITY" != X ] ; then \
+		foo='$(bin_PROGRAMS) $(sbin_PROGRAMS) $(libexec_PROGRAMS)' ; \
+		for file in $$foo ; do \
+			echo "CODESIGN $$file" ; \
+			codesign -f -s "$$CODE_SIGN_IDENTITY" $$file || exit 1 ; \
+		done ; \
+	fi
+	
+
+
+all-local: codesign-all
+
+install-build-headers:: $(include_HEADERS) $(dist_include_HEADERS) $(nodist_include_HEADERS) $(build_HEADERZ) $(nobase_include_HEADERS) $(noinst_HEADERS)
+	@foo='$(include_HEADERS) $(dist_include_HEADERS) $(nodist_include_HEADERS) $(build_HEADERZ) $(noinst_HEADERS)'; \
 	for f in $$foo; do \
 		f=`basename $$f`; \
 		if test -f "$(srcdir)/$$f"; then file="$(srcdir)/$$f"; \
@@ -84,7 +96,7 @@ install-build-headers:: $(include_HEADERS) $(dist_include_HEADERS) $(nodist_incl
 		if cmp -s  $$file $(buildinclude)/$$f 2> /dev/null ; then \
 		: ; else \
 			echo " $(CP) $$file $(buildinclude)/$$f"; \
-			$(CP) $$file $(buildinclude)/$$f; \
+			$(CP) $$file $(buildinclude)/$$f || true; \
 		fi ; \
 	done ; \
 	foo='$(nobase_include_HEADERS)'; \
@@ -137,7 +149,7 @@ SUFFIXES += .x .z .hx
 .hx.h:
 	@cmp -s $< $@ 2> /dev/null || cp $< $@
 
-SUFFIXES += .1 .3 .5 .8 .cat1 .cat3 .cat5 .cat8
+SUFFIXES += .1 .3 .5 .7 .8 .cat1 .cat3 .cat5 .cat7 .cat8
 
 NROFF_MAN = groff -mandoc -Tascii
 #NROFF_MAN = nroff -man
@@ -147,6 +159,8 @@ NROFF_MAN = groff -mandoc -Tascii
 	$(NROFF_MAN) $< > $@
 .5.cat5:
 	$(NROFF_MAN) $< > $@
+.7.cat7:
+	$(NROFF_MAN) $< > $@
 .8.cat8:
 	$(NROFF_MAN) $< > $@
 
@@ -191,6 +205,19 @@ dist-cat5-mans:
 		$(NROFF_MAN) $(srcdir)/$$i > $(distdir)/$$x; \
 	done
 
+dist-cat7-mans:
+	@foo='$(man7_MANS)'; \
+	bar='$(man_MANS)'; \
+	for i in $$bar; do \
+	case $$i in \
+	*.7) foo="$$foo $$i";; \
+	esac; done ;\
+	for i in $$foo; do \
+		x=`echo $$i | sed 's/\.[^.]*$$/.cat7/'`; \
+		echo "$(NROFF_MAN) $(srcdir)/$$i > $(distdir)/$$x"; \
+		$(NROFF_MAN) $(srcdir)/$$i > $(distdir)/$$x; \
+	done
+
 dist-cat8-mans:
 	@foo='$(man8_MANS)'; \
 	bar='$(man_MANS)'; \
@@ -204,13 +231,13 @@ dist-cat8-mans:
 		$(NROFF_MAN) $(srcdir)/$$i > $(distdir)/$$x; \
 	done
 
-dist-hook: dist-cat1-mans dist-cat3-mans dist-cat5-mans dist-cat8-mans
+dist-hook: dist-cat1-mans dist-cat3-mans dist-cat5-mans dist-cat7-mans dist-cat8-mans
 
 install-cat-mans:
-	$(SHELL) $(top_srcdir)/cf/install-catman.sh install "$(INSTALL_DATA)" "$(mkinstalldirs)" "$(srcdir)" "$(DESTDIR)$(mandir)" '$(CATMANEXT)' $(man_MANS) $(man1_MANS) $(man3_MANS) $(man5_MANS) $(man8_MANS)
+	$(SHELL) $(top_srcdir)/cf/install-catman.sh install "$(INSTALL_DATA)" "$(mkinstalldirs)" "$(srcdir)" "$(DESTDIR)$(mandir)" '$(CATMANEXT)' $(man_MANS) $(man1_MANS) $(man3_MANS) $(man5_MANS) $(man7_MANS) $(man8_MANS)
 
 uninstall-cat-mans:
-	$(SHELL) $(top_srcdir)/cf/install-catman.sh uninstall "$(INSTALL_DATA)" "$(mkinstalldirs)" "$(srcdir)" "$(DESTDIR)$(mandir)" '$(CATMANEXT)' $(man_MANS) $(man1_MANS) $(man3_MANS) $(man5_MANS) $(man8_MANS)
+	$(SHELL) $(top_srcdir)/cf/install-catman.sh uninstall "$(INSTALL_DATA)" "$(mkinstalldirs)" "$(srcdir)" "$(DESTDIR)$(mandir)" '$(CATMANEXT)' $(man_MANS) $(man1_MANS) $(man3_MANS) $(man5_MANS) $(man7_MANS) $(man8_MANS)
 
 install-data-hook: install-cat-mans
 uninstall-hook: uninstall-cat-mans
@@ -221,7 +248,11 @@ uninstall-hook: uninstall-cat-mans
 .et.c:
 	$(COMPILE_ET) $<
 
+if NO_AFS
+LIB_kafs =
+else
 LIB_kafs = $(top_builddir)/lib/kafs/libkafs.la $(AIX_EXTRA_KAFS)
+endif
 
 if KRB5
 LIB_krb5 = $(top_builddir)/lib/krb5/libkrb5.la \
@@ -229,7 +260,7 @@ LIB_krb5 = $(top_builddir)/lib/krb5/libkrb5.la \
 LIB_gssapi = $(top_builddir)/lib/gssapi/libgssapi.la
 endif
 
-LIB_heimbase = $(top_builddir)/base/libheimbase.la
+LIB_heimbase = $(top_builddir)/lib/base/libheimbase.la
 
 if DCE
 LIB_kdfs = $(top_builddir)/lib/kdfs/libkdfs.la
@@ -255,3 +286,10 @@ distdir-in-tree: $(DISTFILES) $(INFO_DEPS)
 	  (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) distdir-in-tree) ; \
 	  fi ; \
 	done
+
+
+#silent-rules
+
+heim_verbose = $(heim_verbose_$(V))
+heim_verbose_ = $(heim_verbose_$(AM_DEFAULT_VERBOSITY))
+heim_verbose_0 = @echo "  GEN    "$@;
diff --git a/crypto/external/bsd/heimdal/dist/cf/check-compile-et.m4 b/crypto/external/bsd/heimdal/dist/cf/check-compile-et.m4
index 299d608ff..5efa4105d 100644
--- a/crypto/external/bsd/heimdal/dist/cf/check-compile-et.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/check-compile-et.m4
@@ -3,12 +3,12 @@ dnl
 dnl CHECK_COMPILE_ET
 AC_DEFUN([CHECK_COMPILE_ET], [
 
-AC_CHECK_PROG(COMPILE_ET, compile_et, [compile_et])
+AC_CHECK_PROG(COMPILE_ET, compile_et, [compile_et], [no])
 
 krb_cv_compile_et="no"
 krb_cv_com_err_need_r=""
 krb_cv_compile_et_cross=no
-if test "${COMPILE_ET}" = "compile_et"; then
+if test "${COMPILE_ET}" != "no"; then
 
 dnl We have compile_et.  Now let's see if it supports `prefix' and `index'.
 AC_MSG_CHECKING(whether compile_et has the features we need)
@@ -28,7 +28,8 @@ if ${COMPILE_ET} conftest_et.et >/dev/null 2>&1; then
     CPPFLAGS="-I/usr/include/et ${CPPFLAGS}"
   fi
   dnl Check that the `prefix' and `index' directives were honored.
-  AC_RUN_IFELSE([
+  AC_LANG(C)
+  AC_RUN_IFELSE([AC_LANG_SOURCE([
 #include <com_err.h>
 #include <string.h>
 #include "conftest_et.h"
@@ -37,7 +38,7 @@ int main(int argc, char **argv){
 #error compile_et does not handle error_table N M
 #endif
 return (CONFTEST_CODE2 - CONFTEST_CODE1) != 127;}
-  ], [krb_cv_compile_et="yes"],[CPPFLAGS="${save_CPPFLAGS}"],
+  ])], [krb_cv_compile_et="yes"],[CPPFLAGS="${save_CPPFLAGS}"],
   [krb_cv_compile_et="yes" krb_cv_compile_et_cross=yes] )
 fi
 AC_MSG_RESULT(${krb_cv_compile_et})
diff --git a/crypto/external/bsd/heimdal/dist/cf/check-getpwuid_r-posix.m4 b/crypto/external/bsd/heimdal/dist/cf/check-getpwuid_r-posix.m4
new file mode 100644
index 000000000..2cc303bcd
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/cf/check-getpwuid_r-posix.m4
@@ -0,0 +1,40 @@
+dnl Id
+dnl
+dnl check for getpwuid_r, and if it's posix or not
+
+AC_DEFUN([AC_CHECK_GETPWUID_R_POSIX],[
+AC_FIND_FUNC_NO_LIBS(getpwuid_r,c_r)
+if test "$ac_cv_func_getpwuid_r" = yes; then
+	AC_CACHE_CHECK(if getpwuid_r is posix,ac_cv_func_getpwuid_r_posix,
+	ac_libs="$LIBS"
+	LIBS="$LIBS $LIB_getpwuid_r"
+	AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#define _POSIX_PTHREAD_SEMANTICS
+#include <pwd.h>
+int main(int argc, char **argv)
+{
+	struct passwd pw, *pwd;
+	return getpwuid_r(0, &pw, 0, 0, &pwd) < 0;
+}
+]])],[ac_cv_func_getpwuid_r_posix=yes],[ac_cv_func_getpwuid_r_posix=no],[:])
+LIBS="$ac_libs")
+	AC_CACHE_CHECK(if _POSIX_PTHREAD_SEMANTICS is needed,ac_cv_func_getpwuid_r_posix_def,
+	ac_libs="$LIBS"
+	LIBS="$LIBS $LIB_getpwuid_r"
+	AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <pwd.h>
+int main(int argc, char **argv)
+{
+	struct passwd pw, *pwd;
+	return getpwuid_r(0, &pw, 0, 0, &pwd) < 0;
+}
+]])],[ac_cv_func_getpwuid_r_posix_def=no],[ac_cv_func_getpwuid_r_posix_def=yes],[:])
+LIBS="$ac_libs")
+if test "$ac_cv_func_getpwuid_r_posix" = yes; then
+	AC_DEFINE(POSIX_GETPWUID_R, 1, [Define if getpwuid_r has POSIX flavour.])
+fi
+if test "$ac_cv_func_getpwuid_r_posix" = yes -a "$ac_cv_func_getpwuid_r_posix_def" = yes; then
+	AC_DEFINE(_POSIX_PTHREAD_SEMANTICS, 1, [Define to get POSIX getpwuid_r in some systems.])
+fi
+fi
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/check-x.m4 b/crypto/external/bsd/heimdal/dist/cf/check-x.m4
deleted file mode 100644
index c10e45714..000000000
--- a/crypto/external/bsd/heimdal/dist/cf/check-x.m4
+++ /dev/null
@@ -1,53 +0,0 @@
-dnl 
-dnl See if there is any X11 present
-dnl
-dnl Id
-
-AC_DEFUN([KRB_CHECK_X],[
-AC_PATH_XTRA
-
-# try to figure out if we need any additional ld flags, like -R
-# and yes, the autoconf X test is utterly broken
-if test "$no_x" != yes; then
-	AC_CACHE_CHECK(for special X linker flags,krb_cv_sys_x_libs_rpath,[
-	ac_save_libs="$LIBS"
-	ac_save_cflags="$CFLAGS"
-	CFLAGS="$CFLAGS $X_CFLAGS"
-	krb_cv_sys_x_libs_rpath=""
-	krb_cv_sys_x_libs=""
-	for rflag in "" "-R" "-R " "-rpath "; do
-		if test "$rflag" = ""; then
-			foo="$X_LIBS"
-		else
-			foo=""
-			for flag in $X_LIBS; do
-			case $flag in
-			-L*)
-				foo="$foo $flag `echo $flag | sed \"s/-L/$rflag/\"`"
-				;;
-			*)
-				foo="$foo $flag"
-				;;
-			esac
-			done
-		fi
-		LIBS="$ac_save_libs $foo $X_PRE_LIBS -lX11 $X_EXTRA_LIBS"
-		AC_RUN_IFELSE([
-		#include <X11/Xlib.h>
-		foo(void)
-		{
-		XOpenDisplay(NULL);
-		}
-		main(int argc, char **argv)
-		{
-		return 0;
-		}
-		],krb_cv_sys_x_libs_rpath="$rflag"; krb_cv_sys_x_libs="$foo"; break,:,
-		krb_cv_sys_x_libs_rpath="" ; krb_cv_sys_x_libs="" ; break)
-	done
-	LIBS="$ac_save_libs"
-	CFLAGS="$ac_save_cflags"
-	])
-	X_LIBS="$krb_cv_sys_x_libs"
-fi
-])
diff --git a/crypto/external/bsd/heimdal/dist/cf/check-xau.m4 b/crypto/external/bsd/heimdal/dist/cf/check-xau.m4
deleted file mode 100644
index 82f91175b..000000000
--- a/crypto/external/bsd/heimdal/dist/cf/check-xau.m4
+++ /dev/null
@@ -1,64 +0,0 @@
-dnl Id
-dnl
-dnl check for Xau{Read,Write}Auth and XauFileName
-dnl
-AC_DEFUN([AC_CHECK_XAU],[
-save_CFLAGS="$CFLAGS"
-CFLAGS="$X_CFLAGS $CFLAGS"
-save_LIBS="$LIBS"
-dnl LIBS="$X_LIBS $X_PRE_LIBS $X_EXTRA_LIBS $LIBS"
-LIBS="$X_PRE_LIBS $X_EXTRA_LIBS $LIBS"
-save_LDFLAGS="$LDFLAGS"
-LDFLAGS="$LDFLAGS $X_LIBS"
-
-## check for XauWriteAuth first, so we detect the case where
-## XauReadAuth is in -lX11, but XauWriteAuth is only in -lXau this
-## could be done by checking for XauReadAuth in -lXau first, but this
-## breaks in IRIX 6.5
-
-AC_FIND_FUNC_NO_LIBS(XauWriteAuth, X11 Xau,[#include <X11/Xauth.h>],[0,0])
-ac_xxx="$LIBS"
-LIBS="$LIB_XauWriteAuth $LIBS"
-AC_FIND_FUNC_NO_LIBS(XauReadAuth, X11 Xau,[#include <X11/Xauth.h>],[0])
-LIBS="$LIB_XauReadAauth $LIBS"
-AC_FIND_FUNC_NO_LIBS(XauFileName, X11 Xau,[#include <X11/Xauth.h>])
-LIBS="$ac_xxx"
-
-## set LIB_XauReadAuth to union of these tests, since this is what the
-## Makefiles are using
-case "$ac_cv_funclib_XauWriteAuth" in
-yes)	;;
-no)	;;
-*)	if test "$ac_cv_funclib_XauReadAuth" = yes; then
-		if test "$ac_cv_funclib_XauFileName" = yes; then
-			LIB_XauReadAuth="$LIB_XauWriteAuth"
-		else
-			LIB_XauReadAuth="$LIB_XauWriteAuth $LIB_XauFileName"
-		fi
-	else
-		if test "$ac_cv_funclib_XauFileName" = yes; then
-			LIB_XauReadAuth="$LIB_XauReadAuth $LIB_XauWriteAuth"
-		else
-			LIB_XauReadAuth="$LIB_XauReadAuth $LIB_XauWriteAuth $LIB_XauFileName"
-		fi
-	fi
-	;;
-esac
-
-if test "$AUTOMAKE" != ""; then
-	AM_CONDITIONAL(NEED_WRITEAUTH, test "$ac_cv_func_XauWriteAuth" != "yes")
-else
-	AC_SUBST(NEED_WRITEAUTH_TRUE)
-	AC_SUBST(NEED_WRITEAUTH_FALSE)
-	if test "$ac_cv_func_XauWriteAuth" != "yes"; then
-		NEED_WRITEAUTH_TRUE=
-		NEED_WRITEAUTH_FALSE='#'
-	else
-		NEED_WRITEAUTH_TRUE='#'
-		NEED_WRITEAUTH_FALSE=
-	fi
-fi
-CFLAGS=$save_CFLAGS
-LIBS=$save_LIBS
-LDFLAGS=$save_LDFLAGS
-])
diff --git a/crypto/external/bsd/heimdal/dist/cf/crypto.m4 b/crypto/external/bsd/heimdal/dist/cf/crypto.m4
index a64a09ff6..1f557927a 100644
--- a/crypto/external/bsd/heimdal/dist/cf/crypto.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/crypto.m4
@@ -6,17 +6,21 @@ dnl - own-built libhcrypto
 
 m4_define([test_headers], [
 		#undef KRB5 /* makes md4.h et al unhappy */
-		#ifdef HAVE_OPENSSL
+		#ifdef HAVE_HCRYPTO_W_OPENSSL
 		#ifdef HAVE_SYS_TYPES_H
 		#include <sys/types.h>
 		#endif
 		#include <openssl/evp.h>
+		#include <openssl/bn.h>
 		#include <openssl/md4.h>
 		#include <openssl/md5.h>
 		#include <openssl/sha.h>
 		#include <openssl/des.h>
 		#include <openssl/rc4.h>
 		#include <openssl/aes.h>
+		#include <openssl/rsa.h>
+		#include <openssl/dsa.h>
+		#include <openssl/dh.h>
 		#include <openssl/ec.h>
 		#include <openssl/engine.h>
 		#include <openssl/ui.h>
@@ -50,7 +54,7 @@ m4_define([test_body], [
 		EVP_CIPHER_iv_length(((EVP_CIPHER*)0));
 		UI_UTIL_read_pw_string(0,0,0,0);
 		RAND_status();
-		#ifdef HAVE_OPENSSL
+		#ifdef HAVE_HCRYPTO_W_OPENSSL
 		EC_KEY_new();
 		#endif
 
@@ -59,119 +63,102 @@ m4_define([test_body], [
 		DES_cbc_encrypt(0, 0, 0, schedule, 0, 0);
 		RC4(0, 0, 0, 0);])
 
-
 AC_DEFUN([KRB_CRYPTO],[
-crypto_lib=unknown
+AC_ARG_WITH([hcrypto-default-backend],
+            AS_HELP_STRING([--with-hcrypto-default-backend=cc|pkcs11_hcrypto|ossl|w32crypto|hcrypto],
+                           [specify the default hcrypto backend]),
+            [
+            CFLAGS="${CFLAGS} -DHCRYPTO_DEF_PROVIDER=${withval}"
+            case "$withval" in
+            cc) AC_DEFINE(HCRYPTO_DEF_PROVIDER, [cc], [Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default hcrypto provider]);;
+            pkcs11_hcrypto) AC_DEFINE(HCRYPTO_DEF_PROVIDER, [pkcs11_hcrypto], [Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default hcrypto provider]);;
+            ossl) AC_DEFINE(HCRYPTO_DEF_PROVIDER, [ossl], [Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default hcrypto provider]);;
+            w32crypto) AC_DEFINE(HCRYPTO_DEF_PROVIDER, [w32crypto], [Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default hcrypto provider]);;
+            hcrypto) AC_DEFINE(HCRYPTO_DEF_PROVIDER, [hcrypto], [Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default hcrypto provider]);;
+            *) echo "Invalid hcrypto provider name ($withval)"; exit 5;;
+            esac
+            ],
+            [])
+AC_ARG_WITH([hcrypto-fallback],
+            AS_HELP_STRING([--without-hcrypto-fallback],
+                           [disable fallback on hcrypto for unavailable algorithms]),
+            [AC_DEFINE([HCRYPTO_FALLBACK],0,[Set to 1 to allow fallback to hcrypto for unavailable algorithms])],
+            [AC_DEFINE([HCRYPTO_FALLBACK],1,[Set to 1 to allow fallback to hcrypto for unavailable algorithms])])
 AC_WITH_ALL([openssl])
 
-DIR_hcrypto=
-
 AC_MSG_CHECKING([for crypto library])
 
 openssl=no
 
-if test "$crypto_lib" = "unknown" -a "$with_krb4" != "no"; then
-	save_CPPFLAGS="$CPPFLAGS"
-	save_LIBS="$LIBS"
-
-	cdirs= clibs=
-	for i in $LIB_krb4; do
-		case "$i" in
-		-L*) cdirs="$cdirs $i";;
-		-l*) clibs="$clibs $i";;
-		esac
-	done
-
-	ires=
-	for i in $INCLUDE_krb4; do
-		CFLAGS="-DHAVE_OPENSSL $i $save_CFLAGS"
-		for j in $cdirs; do
-			for k in $clibs; do
-				LIBS="$j $k $save_LIBS"
-				AC_LINK_IFELSE([AC_LANG_PROGRAM([test_headers],
-						[test_body])],
-					[openssl=yes ires="$i" lres="$j $k"; break 3])
-			done
-		done
-		CFLAGS="$i $save_CFLAGS"
-		for j in $cdirs; do
-			for k in $clibs; do
-				LIBS="$j $k $save_LIBS"
-				AC_LINK_IFELSE([AC_LANG_PROGRAM([test_headers],[test_body])],
-					[openssl=no ires="$i" lres="$j $k"; break 3])
-			done
-		done
-	done
-		
-	CFLAGS="$save_CFLAGS"
-	LIBS="$save_LIBS"
-	if test "$ires" -a "$lres"; then
-		INCLUDE_hcrypto="$ires"
-		LIB_hcrypto="$lres"
-		crypto_lib=krb4
-		AC_MSG_RESULT([same as krb4])
-		LIB_hcrypto_a='$(LIB_hcrypto)'
-		LIB_hcrypto_so='$(LIB_hcrypto)'
-		LIB_hcrypto_appl='$(LIB_hcrypto)'
-	fi
+if test "$with_openssl" = "yes"; then
+        with_openssl=/usr
 fi
-
-if test "$crypto_lib" = "unknown" -a "$with_openssl" != "no"; then
-	save_CFLAGS="$CFLAGS"
-	save_LIBS="$LIBS"
-	INCLUDE_hcrypto=
-	LIB_hcrypto=
+if test "$with_openssl" != "no"; then
+        saved_CFLAGS="${CFLAGS}"
+        saved_LDFLAGS="${LDFLAGS}"
+	INCLUDE_openssl_crypto=
+	LIB_openssl_crypto=
 	if test "$with_openssl_include" != ""; then
-		INCLUDE_hcrypto="-I${with_openssl_include}"
+		INCLUDE_openssl_crypto="-I${with_openssl_include}"
+        else
+                INCLUDE_openssl_crypto="-I${with_openssl}/include"
 	fi
 	if test "$with_openssl_lib" != ""; then
-		LIB_hcrypto="-L${with_openssl_lib}"
+		LIB_openssl_crypto="-L${with_openssl_lib}"
+        elif test "${with_openssl}" != "/usr" -a -d "${with_openssl}/lib"; then
+                LIB_openssl_crypto="-L${with_openssl}/lib"
 	fi
-	CFLAGS="-DHAVE_OPENSSL ${INCLUDE_hcrypto} ${CFLAGS}"
-	saved_LIB_hcrypto="$LIB_hcrypto"
-	for lres in "" "-ldl" "-lnsl -lsocket" "-lnsl -lsocket -ldl"; do
-		LIB_hcrypto="${saved_LIB_hcrypto} -lcrypto $lres"
-		LIB_hcrypto_a="$LIB_hcrypto"
-		LIB_hcrypto_so="$LIB_hcrypto"
-		LIB_hcrypto_appl="$LIB_hcrypto"
-		LIBS="${LIBS} ${LIB_hcrypto}"
-		AC_LINK_IFELSE([AC_LANG_PROGRAM([test_headers],[test_body])], [
-			crypto_lib=libcrypto openssl=yes
-			AC_MSG_RESULT([libcrypto])
-		])
-		if test "$crypto_lib" = libcrypto ; then
-			break;
-		fi
-	done
-	CFLAGS="$save_CFLAGS"
-	LIBS="$save_LIBS"
+	CFLAGS="-DHAVE_HCRYPTO_W_OPENSSL ${INCLUDE_openssl_crypto} ${CFLAGS}"
+        LDFLAGS="${LIB_openssl_crypto} ${LDFLAGS}"
+        AC_CHECK_LIB([crypto], [OPENSSL_init],
+                     [LIB_openssl_crypto="${LIB_openssl_crypto} -lcrypto"; openssl=yes], [openssl=no], [])
+        # These cases are just for static linking on older OSes,
+        # presumably.
+        if test "$openssl" = "no"; then
+                AC_CHECK_LIB([crypto], [OPENSSL_init],
+                             [LIB_openssl_crypto="${LIB_openssl_crypto} -lcrypto -ldl"; openssl=yes], [openssl=no], [-ldl])
+        fi
+        if test "$openssl" = "no"; then
+                AC_CHECK_LIB([crypto], [OPENSSL_init],
+                             [LIB_openssl_crypto="${LIB_openssl_crypto} -lcrypto -ldl -lnsl"; openssl=yes], [openssl=no], [-ldl -lnsl])
+        fi
+        if test "$openssl" = "no"; then
+                AC_CHECK_LIB([crypto], [OPENSSL_init],
+                             [LIB_openssl_crypto="${LIB_openssl_crypto} -lcrypto -ldl -lnsl -lsocket"; openssl=yes], [openssl=no], [-ldl -lnsl -lsocket])
+        fi
+        if test "$openssl" = "no"; then
+                INCLUDE_openssl_crypto=
+                LIB_openssl_crypto=
+        fi
+        CFLAGS="${saved_CFLAGS}"
+        LDFLAGS="${saved_LDFLAGS}"
 fi
 
-if test "$crypto_lib" = "unknown"; then
+LIB_hcrypto='$(top_builddir)/lib/hcrypto/libhcrypto.la'
+LIB_hcrypto_a='$(top_builddir)/lib/hcrypto/.libs/libhcrypto.a'
+LIB_hcrypto_so='$(top_builddir)/lib/hcrypto/.libs/libhcrypto.so'
+LIB_hcrypto_appl="-lhcrypto"
 
-  DIR_hcrypto='hcrypto'
-  LIB_hcrypto='$(top_builddir)/lib/hcrypto/libhcrypto.la'
-  LIB_hcrypto_a='$(top_builddir)/lib/hcrypto/.libs/libhcrypto.a'
-  LIB_hcrypto_so='$(top_builddir)/lib/hcrypto/.libs/libhcrypto.so'
-  LIB_hcrypto_appl="-lhcrypto"
+AC_MSG_RESULT([included libhcrypto])
 
-  AC_MSG_RESULT([included libhcrypto])
+AC_ARG_WITH(pkcs11-module,
+                       AS_HELP_STRING([--with-pkcs11-module=path],
+                                      [use PKCS11 module in path]),
+                       [pkcs11_module="$withval"],
+                       [])
 
-fi
-
-if test "$with_krb4" != no -a "$crypto_lib" != krb4; then
-	AC_MSG_ERROR([the crypto library used by krb4 lacks features
-required by Kerberos 5; to continue, you need to install a newer 
-Kerberos 4 or configure --without-krb4])
+if test "$pkcs11_module" != ""; then
+  AC_DEFINE_UNQUOTED(PKCS11_MODULE_PATH, "$pkcs11_module", [path to PKCS11 module])
+  openssl=no
 fi
 
 if test "$openssl" = "yes"; then
-  AC_DEFINE([HAVE_OPENSSL], 1, [define to use openssl's libcrypto])
+  AC_DEFINE([HAVE_HCRYPTO_W_OPENSSL], 1, [define to use openssl's libcrypto as the default backend for libhcrypto])
 fi
-AM_CONDITIONAL(HAVE_OPENSSL, test "$openssl" = yes)dnl
+AM_CONDITIONAL(HAVE_HCRYPTO_W_OPENSSL, test "$openssl" = yes)dnl
 
-AC_SUBST(DIR_hcrypto)
-AC_SUBST(INCLUDE_hcrypto)
+AC_SUBST(INCLUDE_openssl_crypto)
+AC_SUBST(LIB_openssl_crypto)
 AC_SUBST(LIB_hcrypto)
 AC_SUBST(LIB_hcrypto_a)
 AC_SUBST(LIB_hcrypto_so)
diff --git a/crypto/external/bsd/heimdal/dist/cf/db.m4 b/crypto/external/bsd/heimdal/dist/cf/db.m4
index 29ad403aa..a3442ea6f 100644
--- a/crypto/external/bsd/heimdal/dist/cf/db.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/db.m4
@@ -4,6 +4,11 @@ dnl tests for various db libraries
 dnl
 
 AC_DEFUN([rk_DB],[
+AC_ARG_WITH(db-type-preference,
+                       AS_HELP_STRING([--with-db-type-preference=list],
+                                      [specify HDB backend DB type preference as whitespace-separated list of db1, db3, lmdb, and/or sqlite]),
+                       [db_type_preference="$withval"],
+                       [db_type_preference="lmdb db3 db1 sqlite"])
 AC_ARG_WITH(berkeley-db,
                        AS_HELP_STRING([--with-berkeley-db],
                                       [enable support for berkeley db @<:@default=check@:>@]),
@@ -22,7 +27,14 @@ AC_ARG_ENABLE(ndbm-db,
                                       [if you don't want ndbm db]),[
 ])
 
-have_ndbm=no
+AC_ARG_ENABLE(mdb-db,
+                       AS_HELP_STRING([--disable-mdb-db],
+                                      [if you don't want LMDB]),[
+])
+
+have_db1=no
+have_db3=no
+have_lmdb=no
 db_type=unknown
 
 AS_IF([test "x$with_berkeley_db" != xno],
@@ -47,7 +59,7 @@ AS_IF([test "x$with_berkeley_db" != xno],
 
 dnl db_create is used by db3 and db4 and db5
 
-  AC_FIND_FUNC_NO_LIBS(db_create, [$dbheader] db5 db4 db3 db, [
+  AC_FIND_FUNC_NO_LIBS(db_create, [$dbheader] db-5 db5 db4 db3 db, [
   #include <stdio.h>
   #ifdef HAVE_DBHEADER
   #include <$dbheader/db.h>
@@ -65,11 +77,11 @@ dnl db_create is used by db3 and db4 and db5
   ],[NULL, NULL, 0])
 
   if test "$ac_cv_func_db_create" = "yes"; then
-    db_type=db3
+    have_db3=yes
     if test "$ac_cv_funclib_db_create" != "yes"; then
-      DBLIB="$ac_cv_funclib_db_create"
+      DB3LIB="$ac_cv_funclib_db_create"
     else
-      DBLIB=""
+      DB3LIB=""
     fi
     AC_DEFINE(HAVE_DB3, 1, [define if you have a berkeley db3/4/5 library])
   fi
@@ -88,11 +100,11 @@ dnl dbopen is used by db1/db2
   ],[NULL, 0, 0, 0, NULL])
 
   if test "$ac_cv_func_dbopen" = "yes"; then
-    db_type=db1
+    have_db1=yes
     if test "$ac_cv_funclib_dbopen" != "yes"; then
-      DBLIB="$ac_cv_funclib_dbopen"
+      DB1LIB="$ac_cv_funclib_dbopen"
     else
-      DBLIB=""
+      DB1LIB=""
     fi
     AC_DEFINE(HAVE_DB1, 1, [define if you have a berkeley db1/2 library])
   fi
@@ -109,9 +121,9 @@ dnl test for ndbm compatability
   
     if test "$ac_cv_func_dbm_firstkey" = "yes"; then
       if test "$ac_cv_funclib_dbm_firstkey" != "yes"; then
-        LIB_NDBM="$ac_cv_funclib_dbm_firstkey"
+        NDBMLIB="$ac_cv_funclib_dbm_firstkey"
       else
-        LIB_NDBM=""
+        NDBMLIB=""
       fi
       AC_DEFINE(HAVE_DB_NDBM, 1, [define if you have ndbm compat in db])
       AC_DEFINE(HAVE_NEW_DB, 1, [Define if NDBM really is DB (creates files *.db)])
@@ -123,6 +135,23 @@ dnl test for ndbm compatability
 
 ]) # fi berkeley db
 
+
+AS_IF([test "x$enable_mdb_db" != xno],
+    [AC_CHECK_HEADER(lmdb.h, [
+		AC_CHECK_LIB(lmdb, mdb_env_create, have_lmdb=yes; LMDBLIB="-llmdb"
+		AC_DEFINE(HAVE_LMDB, 1, [define if you have the LMDB library]))])])
+
+for db_type in unknown $db_type_preference; do
+    if eval test \"x\$have_${db_type}\" = xyes -o ${db_type} = sqlite; then
+        break
+    fi
+    db_type=unknown
+done
+
+AS_IF([test "x$have_db3" = xyes -a "$db_type" = unknown], db_type=db3, db_type="$db_type")
+AS_IF([test "x$have_db1" = xyes -a "$db_type" = unknown], db_type=db1, db_type="$db_type")
+AS_IF([test "x$have_lmdb" = xyes -a "$db_type" = unknown], db_type=lmdb, db_type="$db_type")
+
 if test "$enable_ndbm_db" != "no"; then
 
   if test "$db_type" = "unknown" -o "$ac_cv_func_dbm_firstkey" = ""; then
@@ -144,16 +173,12 @@ if test "$enable_ndbm_db" != "no"; then
   
     if test "$ac_cv_func_dbm_firstkey" = "yes"; then
       if test "$ac_cv_funclib_dbm_firstkey" != "yes"; then
-        LIB_NDBM="$ac_cv_funclib_dbm_firstkey"
+        NDBMLIB="$ac_cv_funclib_dbm_firstkey"
       else
-        LIB_NDBM=""
+        NDBMLIB=""
       fi
       AC_DEFINE(HAVE_NDBM, 1, [define if you have a ndbm library])dnl
       have_ndbm=yes
-      if test "$db_type" = "unknown"; then
-        db_type=ndbm
-        DBLIB="$LIB_NDBM"
-      fi
     else
   
       $as_unset ac_cv_func_dbm_firstkey
@@ -171,15 +196,14 @@ if test "$enable_ndbm_db" != "no"; then
   
       if test "$ac_cv_func_dbm_firstkey" = "yes"; then
         if test "$ac_cv_funclib_dbm_firstkey" != "yes"; then
-  	LIB_NDBM="$ac_cv_funclib_dbm_firstkey"
+	NDBMLIB="$ac_cv_funclib_dbm_firstkey"
         else
-  	LIB_NDBM=""
+	NDBMLIB=""
         fi
         AC_DEFINE(HAVE_NDBM, 1, [define if you have a ndbm library])dnl
         have_ndbm=yes
         if test "$db_type" = "unknown"; then
   	db_type=ndbm
-  	DBLIB="$LIB_NDBM"
         fi
       fi
     fi
@@ -216,9 +240,10 @@ int main(int argc, char **argv)
     fi],[AC_MSG_RESULT([no])],[AC_MSG_RESULT([no-cross])])
 fi
 
-AM_CONDITIONAL(HAVE_DB1, test "$db_type" = db1)dnl
-AM_CONDITIONAL(HAVE_DB3, test "$db_type" = db3)dnl
-AM_CONDITIONAL(HAVE_NDBM, test "$db_type" = ndbm)dnl
+AM_CONDITIONAL(HAVE_DB1, test "$have_db1" = yes)dnl
+AM_CONDITIONAL(HAVE_DB3, test "$have_db3" = yes)dnl
+AM_CONDITIONAL(HAVE_LMDB, test "$have_lmdb" = yes)dnl
+AM_CONDITIONAL(HAVE_NDBM, test "$have_ndbm" = yes)dnl
 AM_CONDITIONAL(HAVE_DBHEADER, test "$dbheader" != "")dnl
 
 ## it's probably not correct to include LDFLAGS here, but we might
@@ -229,7 +254,15 @@ for i in $LDFLAGS; do
 	-L*) z="$z $i";;
 	esac
 done
-DBLIB="$z $DBLIB"
-AC_SUBST(DBLIB)dnl
-AC_SUBST(LIB_NDBM)dnl
+DB3LIB="$z $DB3LIB"
+DB1LIB="$z $DB1LIB"
+LMDBLIB="$z $LMDBLIB"
+NDMBLIB="$z $NDBMLIB"
+AC_SUBST(DB3LIB)dnl
+AC_SUBST(DB1LIB)dnl
+AC_SUBST(LMDBLIB)dnl
+AC_SUBST(NDBMLIB)dnl
+AC_SUBST(NDBMLIB)dnl
+AC_SUBST(db_type)dnl
+AC_SUBST(db_type_preference)dnl
 ])
diff --git a/crypto/external/bsd/heimdal/dist/cf/dispatch.m4 b/crypto/external/bsd/heimdal/dist/cf/dispatch.m4
index 68b39fd48..76c5f47ee 100644
--- a/crypto/external/bsd/heimdal/dist/cf/dispatch.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/dispatch.m4
@@ -1,20 +1,23 @@
 
 AC_DEFUN([rk_LIBDISPATCH],[
 
-AC_CHECK_HEADERS([dispatch/dispatch.h])
+AC_CHECK_PROGS(GCD_MIG, mig, no)
 
-AC_FIND_FUNC_NO_LIBS(dispatch_async_f, dispatch,
-[#ifdef HAVE_DISPATCH_DISPATCH_H
-#include <dispatch/dispatch.h>
-#endif],[0,0,0])
+if test "$GCD_MIG" != no; then
+  AC_CHECK_HEADERS([dispatch/dispatch.h])
+  AC_FIND_FUNC_NO_LIBS(dispatch_async_f, dispatch,
+  [#ifdef HAVE_DISPATCH_DISPATCH_H
+  #include <dispatch/dispatch.h>
+  #endif],[0,0,0])
+
+  if test "$ac_cv_func_dispatch_async_f" = yes -a "$GCD_MIG" != no; then
+      AC_DEFINE([HAVE_GCD], 1, [Define if os support gcd.])
+      libdispatch=yes
+  else
+      libdispatch=no
+  fi
 
-if test "$ac_cv_func_dispatch_async_f" = yes ; then
-    AC_DEFINE([HAVE_GCD], 1, [Define if os support gcd.])
-    libdispatch=yes
-else
-    libdispatch=no
 fi
+AM_CONDITIONAL(have_gcd, test "$libdispatch" = yes -a "$GCD_MIG" != no)
 
-AM_CONDITIONAL(have_gcd, test "$libdispatch" = yes)
-
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/dlopen.m4 b/crypto/external/bsd/heimdal/dist/cf/dlopen.m4
index 5215093ba..55db761de 100644
--- a/crypto/external/bsd/heimdal/dist/cf/dlopen.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/dlopen.m4
@@ -9,3 +9,11 @@ AC_DEFUN([rk_DLOPEN], [
 #endif],[0,0])
 	AM_CONDITIONAL(HAVE_DLOPEN, test "$ac_cv_funclib_dlopen" != no)
 ])
+
+AC_DEFUN([rk_DLADDR], [
+	AC_FIND_FUNC_NO_LIBS(dladdr, dl,[
+#ifdef HAVE_DLFCN_H
+#include <dlfcn.h>
+#endif],[0,0])
+	AM_CONDITIONAL(HAVE_DLADDR, test "$ac_cv_funclib_dladdr" != no)
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/find-func-no-libs2.m4 b/crypto/external/bsd/heimdal/dist/cf/find-func-no-libs2.m4
index 8a236d467..452e5589d 100644
--- a/crypto/external/bsd/heimdal/dist/cf/find-func-no-libs2.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/find-func-no-libs2.m4
@@ -53,7 +53,6 @@ case "$ac_res" in
 	;;
 	*)
 	eval "ac_cv_func_$1=yes"
-	eval "ac_cv_lib_`echo "$ac_res" | sed 's/-l//'`=yes"
 	AC_DEFINE_UNQUOTED($ac_tr_func)
 	AC_DEFINE_UNQUOTED($ac_tr_lib)
 	AC_MSG_RESULT([yes, in $ac_res])
diff --git a/crypto/external/bsd/heimdal/dist/cf/install-catman.sh b/crypto/external/bsd/heimdal/dist/cf/install-catman.sh
index 08fe037f0..f3dbecf35 100644
--- a/crypto/external/bsd/heimdal/dist/cf/install-catman.sh
+++ b/crypto/external/bsd/heimdal/dist/cf/install-catman.sh
@@ -14,7 +14,7 @@ catinstall="${INSTALL_CATPAGES-yes}"
 
 for f in "$@"; do
         echo $f
-	base=`echo "$f" | sed 's/\.[^.]*$//'`
+	base=`echo "$f" | sed 's~\.[^.]*$~~; s~.*/~~'`
 	section=`echo "$f" | sed 's/^[^.]*\.//'`
 	mandir="$manbase/man$section"
 	catdir="$manbase/cat$section"
diff --git a/crypto/external/bsd/heimdal/dist/cf/krb-ipv6.m4 b/crypto/external/bsd/heimdal/dist/cf/krb-ipv6.m4
index 81ff57cba..e0d7f7c7f 100644
--- a/crypto/external/bsd/heimdal/dist/cf/krb-ipv6.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/krb-ipv6.m4
@@ -151,4 +151,4 @@ sin6.sin6_addr = in6addr_loopback;
 			[Define if you have the in6addr_loopback variable])
 	fi
 fi
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/krb-prog-perl.m4 b/crypto/external/bsd/heimdal/dist/cf/krb-prog-perl.m4
new file mode 100644
index 000000000..b359111fc
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/cf/krb-prog-perl.m4
@@ -0,0 +1,21 @@
+dnl
+dnl perl and some of its module are required to build some headers
+dnl
+
+AC_DEFUN([AC_KRB_PROG_PERL],
+[AC_CHECK_PROGS(PERL, perl, perl)
+if test "$PERL" = ""; then
+  AC_MSG_ERROR([perl not found - Cannot build Heimdal without perl])
+fi
+])
+
+AC_DEFUN([AC_KRB_PERL_MOD],
+[
+AC_MSG_CHECKING([for Perl5 module $1])
+if ! $PERL -M$1 -e 'exit(0);' >/dev/null 2>&1; then
+  AC_MSG_RESULT([no])
+  AC_MSG_ERROR([perl module $1 not found - Cannot build Heimdal without perl module $1])
+else
+  AC_MSG_RESULT([yes])
+fi
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/make-proto.pl b/crypto/external/bsd/heimdal/dist/cf/make-proto.pl
index 845e17549..e4fe824a9 100644
--- a/crypto/external/bsd/heimdal/dist/cf/make-proto.pl
+++ b/crypto/external/bsd/heimdal/dist/cf/make-proto.pl
@@ -4,16 +4,31 @@
 use Getopt::Std;
 use File::Compare;
 
+use JSON;
+
 my $comment = 0;
+my $doxygen = 0;
+my $funcdoc = 0;
 my $if_0 = 0;
 my $brace = 0;
 my $line = "";
 my $debug = 0;
 my $oproto = 1;
 my $private_func_re = "^_";
-my %depfunction = ();
+my %depfunction;
+my %exported;
+my %deprecated;
+my $apple = 0;
+my %documentation;
 
 getopts('x:m:o:p:dqE:R:P:') || die "foo";
+if($opt_a) {
+    $apple = 1;
+}
+
+if($opt_a) {
+    $apple = 1;
+}
 
 if($opt_d) {
     $debug = 1;
@@ -52,18 +67,20 @@ if($opt_m) {
 }
 
 if($opt_x) {
-    open(EXP, $opt_x);
-    while(<EXP>) {
-	chomp;
-	s/\#.*//g;
-	s/\s+/ /g;
-	if(/^([a-zA-Z0-9_]+)\s?(.*)$/) {
-	    $exported{$1} = $2;
-	} else {
-	    print $_, "\n";
+    my $EXP;
+    local $/;
+    open(EXP, '<', $opt_x) || die "open ${opt_x}";
+    my $obj = JSON->new->utf8->decode(<EXP>);
+    close $EXP;
+
+    foreach my $x (keys %$obj) {
+	if (defined $obj->{$x}->{"export"}) {
+	    $exported{$x} = $obj->{$x};
+	}
+	if (defined $obj->{$x}->{"deprecated"}) {
+	    $deprecated{$x} = $obj->{$x}->{"deprecated"};
 	}
     }
-    close EXP;
 }
 
 while(<>) {
@@ -72,8 +89,10 @@ while(<>) {
     # Handle C comments
     s@/\*.*\*/@@;
     s@//.*/@@;
-    if ( s@/\*.*@@) { $comment = 1;
-    } elsif ($comment && s@.*\*/@@) { $comment = 0;
+    if ( s@/\*\*(.*)@@) { $comment = 1; $doxygen = 1; $funcdoc = $1;
+    } elsif ( s@/\*.*@@) { $comment = 1;
+    } elsif ($comment && s@.*\*/@@) { $comment = 0; $doxygen = 0;
+    } elsif ($doxygen) { $funcdoc .= $_; next;
     } elsif ($comment) { next; }
 
     if(/^\#if 0/) {
@@ -117,6 +136,10 @@ while(<>) {
 		    $attr .= " $2";
 		    $_ = "$1 $3";
 		}
+		if(m/(.*)\s(HEIMDAL_\w+_ATTRIBUTE)\s?(\(.*\))?(.*)/) {
+		    $attr .= " $2$3";
+		    $_ = "$1 $4";
+		}
 		# remove outer ()
 		s/\s*\(/</;
 		s/\)\s?$/>/;
@@ -165,6 +188,22 @@ while(<>) {
 		if($attr ne "") {
 		    $_ .= "\n    $attr";
 		}
+		if ($funcdoc) {
+		    $documentation{$f} = $funcdoc;
+		}
+		$funcdoc = undef;
+		if ($apple && exists $exported{$f}) {
+		    $ios = $exported{$f}{ios};
+		    $ios = "NA" if (!defined $ios);
+		    $mac = $exported{$f}{macos};
+		    $mac = "NA" if (!defined $mac);
+		    die "$f neither" if ($mac eq "NA" and $ios eq "NA");
+		    $_ = $_ . "  __OSX_AVAILABLE_STARTING(__MAC_${mac}, __IPHONE_${ios})";
+		}
+		if (exists $deprecated{$f}) {
+		    $_ = $_ . "  GSSAPI_DEPRECATED_FUNCTION(\"$deprecated{$f}\")";
+		    $depfunction{GSSAPI_DEPRECATED_FUNCTION} = 1;
+		}
 		$_ = $_ . ";";
 		$funcs{$f} = $_;
 	    }
@@ -182,6 +221,9 @@ while(<>) {
     }
 }
 
+die "reached end of code and still in doxygen comment" if ($doxygen);
+die "reached end of code and still in comment" if ($comment);
+
 sub foo {
     local ($arg) = @_;
     $_ = $arg;
@@ -211,6 +253,7 @@ $private_h = "";
 $public_h_header .= "/* This is a generated file */
 #ifndef $block
 #define $block
+#ifndef DOXY
 
 ";
 if ($oproto) {
@@ -258,20 +301,32 @@ if($oproto) {
 }
 $private_h_trailer = "";
 
+
 foreach(sort keys %funcs){
-    if(/^(main)$/) { next }
+    if(/^(DllMain|main)$/) { next }
     if ($funcs{$_} =~ /\^/) {
 	$beginblock = "#ifdef __BLOCKS__\n";
 	$endblock = "#endif /* __BLOCKS__ */\n";
     } else {
 	$beginblock = $endblock = "";
     }
-    if(!defined($exported{$_}) && /$private_func_re/) {
-	$private_h .= $beginblock . $funcs{$_} . "\n" . $endblock . "\n";
+    # if we have an export table and doesn't have content, or matches private RE
+    if((scalar(keys(%exported)) ne 0 && !exists $exported{$_} ) || /$private_func_re/) {
+	$private_h .= $beginblock;
+#	if ($apple and not /$private_func_re/) {
+#	    $private_h .= "#define $_ __ApplePrivate_${_}\n";
+#	}
+	$private_h .= $funcs{$_} . "\n" ;
+	$private_h .= $endblock . "\n";
 	if($funcs{$_} =~ /__attribute__/) {
 	    $private_attribute_seen = 1;
 	}
     } else {
+	if($documentation{$_}) {
+	    $public_h .= "/**\n";
+	    $public_h .= "$documentation{$_}";
+	    $public_h .= " */\n\n";
+	}
 	if($flags{"function-blocking"}) {
 	    $fupper = uc $_;
 	    if($exported{$_} =~ /proto/) {
@@ -396,7 +451,7 @@ $private_h_trailer .= $undepstr;
 
 if ($public_h ne "" && $flags{"header"}) {
     $public_h = $public_h_header . $public_h . 
-	$public_h_trailer . "#endif /* $block */\n";
+	$public_h_trailer . "#endif /* DOXY */\n#endif /* $block */\n";
 }
 if ($private_h ne "" && $flags{"header"}) {
     $private_h = $private_h_header . $private_h .
diff --git a/crypto/external/bsd/heimdal/dist/cf/maybe-valgrind.sh b/crypto/external/bsd/heimdal/dist/cf/maybe-valgrind.sh
index 0ffa7ed98..4077a3278 100755
--- a/crypto/external/bsd/heimdal/dist/cf/maybe-valgrind.sh
+++ b/crypto/external/bsd/heimdal/dist/cf/maybe-valgrind.sh
@@ -56,7 +56,7 @@ doit=1
 
 libtool="${tobjdir}/libtool --mode=execute"
 
-valgrind="valgrind --leak-check=full --trace-children=yes --quiet -q --num-callers=30 --suppressions=${tsrcdir}/cf/valgrind-suppressions"
+valgrind="valgrind --leak-check=full --quiet -q --num-callers=30 --suppressions=${tsrcdir}/cf/valgrind-suppressions"
 
 if head -10 "$1" | grep 'Generated by ltmain.sh' > /dev/null ; then
     uselibtool=1
diff --git a/crypto/external/bsd/heimdal/dist/cf/misc.m4 b/crypto/external/bsd/heimdal/dist/cf/misc.m4
index 3c6186ce6..d21efa6e8 100644
--- a/crypto/external/bsd/heimdal/dist/cf/misc.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/misc.m4
@@ -12,4 +12,4 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define MaxHostNameLen (64+4)
 #define MaxPathLen (1024+4)
 
-])])
\ No newline at end of file
+])])
diff --git a/crypto/external/bsd/heimdal/dist/cf/proto-compat.m4 b/crypto/external/bsd/heimdal/dist/cf/proto-compat.m4
index 221a76902..9c0b53773 100644
--- a/crypto/external/bsd/heimdal/dist/cf/proto-compat.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/proto-compat.m4
@@ -18,4 +18,4 @@ if test "$ac_cv_func_$2_proto_compat" = yes; then
 	$3])
 fi
 undefine([foo])
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/pthreads.m4 b/crypto/external/bsd/heimdal/dist/cf/pthreads.m4
index 484d98a2e..769fb6d1d 100644
--- a/crypto/external/bsd/heimdal/dist/cf/pthreads.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/pthreads.m4
@@ -12,12 +12,12 @@ case "$host" in
 *-*-solaris2*)
 	native_pthread_support=yes
 	if test "$GCC" = yes; then
-		PTHREAD_CFLAGS=-pthreads
-		PTHREAD_LIBADD=-pthreads
+		PTHREAD_CFLAGS="-D_REENTRANT -D_TS_ERRNO"
+		PTHREAD_LIBADD=-lpthread
 	else
-		PTHREAD_CFLAGS=-mt
+		PTHREAD_CFLAGS="-mt -D_REENTRANT -D_TS_ERRNO"
 		PTHREAD_LDADD=-mt
-		PTHREAD_LIBADD=-mt
+		PTHREAD_LIBADD="-mt -lpthread"
 	fi
 	;;
 *-*-netbsd[[12]]*)
@@ -30,7 +30,9 @@ case "$host" in
 	dnl heim_threads.h knows this
 	PTHREAD_LIBADD="-lpthread"
 	;;
-*-*-freebsd[[56789]]*)
+*-*-freebsd[[1234]])
+    ;;
+*-*-freebsd*)
 	native_pthread_support=yes
 	PTHREAD_LIBADD="-pthread"
 	;;
@@ -39,6 +41,11 @@ case "$host" in
 	PTHREAD_CFLAGS=-pthread
 	PTHREAD_LIBADD=-pthread
 	;;
+*-*-gnu*)
+	native_pthread_support=yes
+	PTHREADS_CFLAGS=-pthread
+	PTHREAD_LIBADD="-pthread -lpthread"
+	;;
 *-*-linux* | *-*-linux-gnu)
 	case `uname -r` in
 	2.*|3.*)
@@ -56,6 +63,17 @@ case "$host" in
 *-*-aix*)
 	dnl AIX is disabled since we don't handle the utmp/utmpx
         dnl problems that aix causes when compiling with pthread support
+        dnl (2016-11-14, we longer use utmp).  Original logic was:
+        dnl     if test "$GCC" = yes; then
+        dnl             native_pthread_support=yes
+        dnl             PTHREADS_LIBS="-pthread"
+        dnl     elif expr "$CC" : ".*_r" > /dev/null ; then
+        dnl             native_pthread_support=yes
+        dnl             PTHREADS_CFLAGS=""
+        dnl             PTHREADS_LIBS=""
+        dnl     else
+        dnl             native_pthread_support=no
+        dnl     fi
 	native_pthread_support=no
 	;;
 mips-sgi-irix6.[[5-9]])  # maybe works for earlier versions too
@@ -85,6 +103,12 @@ else
   PTHREAD_LIBADD=""
 fi
 
+AM_CONDITIONAL(ENABLE_PTHREAD_SUPPORT, test "$enable_pthread_support" != no)
+
+CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+LDADD="$LDADD $PTHREAD_LDADD"
+LIBADD="$LIBADD $PTHREAD_LIBADD"
+
 AC_SUBST(PTHREAD_CFLAGS)
 AC_SUBST(PTHREAD_LDADD)
 AC_SUBST(PTHREAD_LIBADD)
diff --git a/crypto/external/bsd/heimdal/dist/cf/retsigtype.m4 b/crypto/external/bsd/heimdal/dist/cf/retsigtype.m4
index 01b6b1c35..dc6f36172 100644
--- a/crypto/external/bsd/heimdal/dist/cf/retsigtype.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/retsigtype.m4
@@ -15,4 +15,4 @@ AH_BOTTOM([#ifdef VOID_RETSIGTYPE
 #else
 #define SIGRETURN(x) return (RETSIGTYPE)(x)
 #endif])
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/roken-frag.m4 b/crypto/external/bsd/heimdal/dist/cf/roken-frag.m4
index e342b5220..55a7b7802 100644
--- a/crypto/external/bsd/heimdal/dist/cf/roken-frag.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/roken-frag.m4
@@ -17,7 +17,7 @@ AC_REQUIRE([AC_PROG_CC])
 AC_REQUIRE([AC_PROG_AWK])
 AC_REQUIRE([AC_OBJEXT])
 AC_REQUIRE([AC_EXEEXT])
-AC_REQUIRE([AC_PROG_LIBTOOL])
+AC_REQUIRE([LT_INIT])
 
 AC_REQUIRE([AC_MIPS_ABI])
 
@@ -28,7 +28,10 @@ dnl C characteristics
 AC_REQUIRE([AC_C___ATTRIBUTE__])
 AC_REQUIRE([AC_C_INLINE])
 AC_REQUIRE([AC_C_CONST])
-rk_WFLAGS(-Wall -Wmissing-prototypes -Wpointer-arith -Wbad-function-cast -Wmissing-declarations -Wnested-externs)
+rk_WFLAGS(-Wall -Wextra -Wno-sign-compare -Wno-unused-parameter -Wmissing-prototypes -Wpointer-arith -Wbad-function-cast -Wmissing-declarations -Wnested-externs -Wshadow)
+
+dnl -Wmissing-prototypes -Wpointer-arith -Wreturn-type -Wstrict-prototypes
+dnl -Wcast-qual -Wswitch -Wformat=2 -Wwrite-strings
 
 AC_REQUIRE([rk_DB])
 
@@ -68,7 +71,9 @@ AC_CHECK_HEADERS([\
 	search.h				\
 	shadow.h				\
 	stdint.h				\
+	sys/auxv.h				\
 	sys/bswap.h				\
+	sys/errno.h				\
 	sys/ioctl.h				\
 	sys/mman.h				\
 	sys/param.h				\
@@ -180,6 +185,7 @@ AC_CHECK_FUNCS([				\
 	asprintf				\
 	atexit					\
 	cgetent					\
+	getauxval				\
 	getconfattr				\
 	getprogname				\
 	getrlimit				\
@@ -266,6 +272,14 @@ AC_FIND_FUNC_NO_LIBS(bswap32,,
 #include <sys/bswap.h>
 #endif],0)
 
+AC_FIND_FUNC_NO_LIBS(bswap64,,
+[#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_BSWAP_H
+#include <sys/bswap.h>
+#endif],0)
+
 AC_FIND_FUNC_NO_LIBS(pidfile,util,
 [#ifdef HAVE_UTIL_H
 #include <util.h>
@@ -303,14 +317,12 @@ AC_FIND_IF_NOT_BROKEN(gai_strerror,,
 #include <ws2tcpip.h>
 #endif],[0])
 
-dnl Darwin is weird, and in some senses not unix, launchd doesn't want
-dnl servers to use daemon(), so its deprecated.
+AC_CHECK_LIB(util, emalloc)
+
 case "$host_os" in
 	darwin*)
 		;;
 	*)
-		AC_DEFINE([SUPPORT_DETACH], 1,
-		    [Define if os support want to detach is daemonens.])
 		AC_BROKEN([daemon]) ;;
 esac
 
@@ -347,6 +359,7 @@ AC_BROKEN([					\
 	localtime_r				\
 	lstat					\
 	memmove					\
+	memset_s				\
 	mkstemp					\
 	putenv					\
 	rcmd					\
@@ -370,6 +383,8 @@ AC_BROKEN([					\
 	strsep					\
 	strsep_copy				\
 	strtok_r				\
+	strtoll					\
+	strtoull				\
 	strupr					\
 	swab					\
 	tsearch					\
@@ -391,6 +406,14 @@ AM_CONDITIONAL(have_fnmatch_h,
 AC_FOREACH([rk_func], [strndup strsep strtok_r],
 	[AC_NEED_PROTO([#include <string.h>], rk_func)])
 
+AC_CHECK_FUNC([strtoll],
+    [AC_DEFINE_UNQUOTED(HAVE_STRTOLL, 1,
+        [Define if you have the function strtoll.])])
+
+AC_CHECK_FUNC([strtoull],
+    [AC_DEFINE_UNQUOTED(HAVE_STRTOULL, 1,
+        [Define if you have the function strtoull.])])
+
 AC_FOREACH([rk_func], [strsvis strsvisx strunvis strvis strvisx svis unvis vis],
 [AC_NEED_PROTO([#ifdef HAVE_VIS_H
 #include <vis.h>
diff --git a/crypto/external/bsd/heimdal/dist/cf/roken-h-process.pl b/crypto/external/bsd/heimdal/dist/cf/roken-h-process.pl
index a54c9216d..e797dd224 100644
--- a/crypto/external/bsd/heimdal/dist/cf/roken-h-process.pl
+++ b/crypto/external/bsd/heimdal/dist/cf/roken-h-process.pl
@@ -1,10 +1,10 @@
 #!/usr/bin/perl
 
-require 'getopts.pl';
+use Getopt::Std;
 
 my $debug = 0;
 
-Getopts('dc:p:o:') || die "foo";
+getopts('dc:p:o:') || die "foo";
 
 if ($opt_d) {
     $debug = 1;
@@ -145,12 +145,15 @@ sub parse_if
     if (m/^\s*$/) {
 	print "end $_\n" if ($debug);
 	return 1;
+    } elsif (m/^\(([^&]+)\&\&(.*)\)\s*\|\|\s*\(([^&]+)\&\&(.*)\)$/) {
+	print "($1 and $2) or ($3 and $4)\n" if ($debug);
+	return ((parse_if($1) and parse_if($2)) or (parse_if($3) and parse_if($4)));
     } elsif (m/^([^&]+)\&\&(.*)$/) {
 	print "$1 and $2\n" if ($debug);
 	return parse_if($1) and parse_if($2);
     } elsif (m/^([^\|]+)\|\|(.*)$/) {
 	print "$1 or $2\n" if ($debug);
-	return parse_if($1) or parse_if($2);
+	return (parse_if($1) or parse_if($2));
     } elsif (m/^\s*(\!)?\s*defined\((\w+)\)/) {
 	($neg, $var) = ($1, $2);
 	print "def: ${neg}-defined(${var})\n" if ($debug);
diff --git a/crypto/external/bsd/heimdal/dist/cf/sunos.m4 b/crypto/external/bsd/heimdal/dist/cf/sunos.m4
index 0af0a3afa..6513edf50 100644
--- a/crypto/external/bsd/heimdal/dist/cf/sunos.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/sunos.m4
@@ -8,7 +8,12 @@ case "$host" in
 *-*-solaris2.7)
 	sunos=57
 	;;
-*-*-solaris2.[[89]] | *-*-solaris2.1[[0-9]])
+*-*-solaris2.1[[1-9]])
+	AC_DEFINE([__EXTENSIONS__], [1],
+		  [Enable general extensions on Solaris.])
+	sunos=511
+	;;
+*-*-solaris2.[[89]] | *-*-solaris2.10)
 	sunos=58
 	;;
 *-*-solaris2*)
@@ -19,4 +24,4 @@ if test "$sunos" != no; then
 	AC_DEFINE_UNQUOTED(SunOS, $sunos, 
 		[Define to what version of SunOS you are running.])
 fi
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/test-package.m4 b/crypto/external/bsd/heimdal/dist/cf/test-package.m4
index a5c5304a6..8d6c0aeb5 100644
--- a/crypto/external/bsd/heimdal/dist/cf/test-package.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/test-package.m4
@@ -1,6 +1,6 @@
 dnl Id
 dnl
-dnl rk_TEST_PACKAGE(package,headers,libraries,extra libs,
+dnl rk_TEST_PACKAGE(package,program,libraries,extra libs,
 dnl			default locations, conditional, config-program, headers)
 
 AC_DEFUN([rk_TEST_PACKAGE],[
diff --git a/crypto/external/bsd/heimdal/dist/cf/valgrind-suppressions b/crypto/external/bsd/heimdal/dist/cf/valgrind-suppressions
index d1e7c6ea5..44f3f379e 100644
--- a/crypto/external/bsd/heimdal/dist/cf/valgrind-suppressions
+++ b/crypto/external/bsd/heimdal/dist/cf/valgrind-suppressions
@@ -1,4 +1,3 @@
-# Id
 {
    linux db init brokenness
    Memcheck:Param
@@ -82,3 +81,88 @@
    obj:/lib/ld-2.5.so
    obj:/lib/ld-2.5.so
 }
+{
+   glibc sed leak 1
+   Memcheck:Leak
+   fun:calloc
+   obj:/bin/sed
+   obj:/bin/sed
+   obj:/bin/sed
+   obj:/bin/sed
+   obj:/bin/sed
+   fun:(below main)
+}
+{
+   Heimdal one-time init leak 1
+   Memcheck:Leak
+   ...
+   fun:heim_base_once_f
+   ...
+}
+{
+   Heimdal one-time init leak 2
+   Memcheck:Leak
+   fun:pthread_once
+   ...
+}
+{
+   Heimdal one-time init leak 3
+   Memcheck:Leak
+   fun:calloc
+   fun:_heim_alloc_object
+   fun:heim_dict_create
+   fun:_krb5_load_plugins
+   fun:init_context_once
+   fun:once_callback_caller
+   fun:pthread_once
+   fun:heim_base_once_f
+   fun:krb5_init_context
+   fun:main
+}
+{
+   Heimdal one-time init leak 4
+   Memcheck:Leak
+   fun:calloc
+   fun:heim_dict_create
+   fun:_krb5_load_plugins
+   fun:init_context_once
+   fun:once_callback_caller
+   fun:pthread_once
+   fun:heim_base_once_f
+   fun:krb5_init_context
+   fun:main
+}
+{
+   Heimdal ipropd-master leak 1
+   Memcheck:Leak
+   ...
+   fun:krb5_kt_resolve
+   fun:main
+   obj:*ipropd-master
+}
+{
+   Heimdal ipropd-master leak 2
+   Memcheck:Leak
+   ...
+   fun:kadm5_init_with_skey_ctx
+   fun:main
+   obj:*ipropd-master
+}
+{
+   Heimdal ipropd-slave leak 1
+   Memcheck:Leak
+   ...
+   fun:krb5_auth_con_init
+   ...
+   fun:krb5_sendauth
+   fun:main
+   obj:*ipropd-slave
+}
+{
+   Heimdal ipropd-slave leak 2
+   Memcheck:Leak
+   ...
+   fun:kadm5_init_with_password_ctx
+   fun:main
+   obj:*ipropd-slave
+}
diff --git a/crypto/external/bsd/heimdal/dist/cf/version-script.m4 b/crypto/external/bsd/heimdal/dist/cf/version-script.m4
index f08e01344..ce780f765 100644
--- a/crypto/external/bsd/heimdal/dist/cf/version-script.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/version-script.m4
@@ -36,4 +36,4 @@ AC_SUBST(VERSIONING)
 AM_CONDITIONAL(versionscript,test $doversioning = yes)
 AC_SUBST(LDFLAGS_VERSION_SCRIPT)
 
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/cf/wflags.m4 b/crypto/external/bsd/heimdal/dist/cf/wflags.m4
index 386e37be6..8d44fb233 100644
--- a/crypto/external/bsd/heimdal/dist/cf/wflags.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/wflags.m4
@@ -9,21 +9,25 @@ AC_ARG_ENABLE(developer,
 if test "X$enable_developer" = Xyes; then
     dwflags="-Werror"
 fi
+AM_CONDITIONAL(DEVELOPER_MODE, test "X$enable_developer" = Xyes)
 
 WFLAGS_NOUNUSED=""
-WFLAGS_NOIMPLICITINT=""
 if test -z "$WFLAGS" -a "$GCC" = "yes"; then
-  # -Wno-implicit-int for broken X11 headers
   # leave these out for now:
   #   -Wcast-align doesn't work well on alpha osf/1
   #   -Wmissing-prototypes -Wpointer-arith -Wbad-function-cast
   #   -Wmissing-declarations -Wnested-externs
   #   -Wstrict-overflow=5
   WFLAGS="ifelse($#, 0,-Wall, $1) $dwflags"
-  WFLAGS_NOUNUSED="-Wno-unused"
-  WFLAGS_NOIMPLICITINT="-Wno-implicit-int"
+
+  #
+  # WFLAGS_LITE can be appended to WFLAGS to turn off a host of warnings
+  # that fail for various bits of older code in appl/.  Let's not use it
+  # for the main libraries, though.
+  WFLAGS_LITE="-Wno-extra -Wno-missing-field-initializers -Wno-strict-aliasing -Wno-shadow"
+  # -Wno-unused-result (not supported on gcc-4.2)
+
 fi
 AC_SUBST(WFLAGS)dnl
-AC_SUBST(WFLAGS_NOUNUSED)dnl
-AC_SUBST(WFLAGS_NOIMPLICITINT)dnl
+AC_SUBST(WFLAGS_LITE)dnl
 ])
diff --git a/crypto/external/bsd/heimdal/dist/cf/with-all.m4 b/crypto/external/bsd/heimdal/dist/cf/with-all.m4
index 0f0e2a568..4a150ce3b 100644
--- a/crypto/external/bsd/heimdal/dist/cf/with-all.m4
+++ b/crypto/external/bsd/heimdal/dist/cf/with-all.m4
@@ -39,4 +39,4 @@ no)	;;
 	fi
 	;;
 esac
-])
\ No newline at end of file
+])
diff --git a/crypto/external/bsd/heimdal/dist/configure.ac b/crypto/external/bsd/heimdal/dist/configure.ac
index 38c5ae890..811289d9b 100644
--- a/crypto/external/bsd/heimdal/dist/configure.ac
+++ b/crypto/external/bsd/heimdal/dist/configure.ac
@@ -1,20 +1,25 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_REVISION(Revision)
+AC_REVISION($Revision: 1.2.4.1 $)
 AC_PREREQ(2.62)
 test -z "$CFLAGS" && CFLAGS="-g"
-AC_INIT([Heimdal],[1.5.3],[heimdal-bugs@h5l.org])
+AC_INIT([Heimdal],[7.99.1],[https://github.com/heimdal/heimdal/issues])
 AC_CONFIG_SRCDIR([kuser/kinit.c])
 AC_CONFIG_HEADERS(include/config.h)
 AC_CONFIG_MACRO_DIR([cf])
 
-AM_INIT_AUTOMAKE([foreign 1.10.3])
+AM_INIT_AUTOMAKE([foreign 1.11])
 AM_MAINTAINER_MODE
 
+LT_PREREQ([2.2])
+LT_INIT([shared static win32-dll])
+
+
 dnl Checks for programs.
 AC_PROG_CC
 AM_PROG_CC_C_O
 AC_PROG_CPP
-AC_PROG_LIBTOOL
+
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
 AC_PREFIX_DEFAULT(/usr/heimdal)
 
@@ -40,6 +45,17 @@ AC_DEFINE([_GNU_SOURCE], 1,
 AC_OBJEXT
 AC_EXEEXT
 
+dnl
+dnl this is needed when der-protos.h or der-private.h has to be generated
+dnl
+if ! test -f "$srcdir/lib/asn1/der-protos.h" ||
+   ! test -f "$srcdir/lib/asn1/der-private.h"; then
+    AC_KRB_PROG_PERL
+    AC_KRB_PERL_MOD(Getopt::Std)
+    AC_KRB_PERL_MOD(File::Compare)
+    AC_KRB_PERL_MOD(JSON)
+fi
+
 dnl AC_KRB_PROG_YACC
 AC_PROG_YACC
 AM_PROG_LEX
@@ -53,9 +69,6 @@ libdir="$libdir$abilibdirext"
 
 AC_C___ATTRIBUTE__
 
-LT_PREREQ([2.2])
-LT_INIT([shared static win32-dll])
-
 AM_CONDITIONAL(ENABLE_SHARED, test "$enable_shared" = "yes")
 rk_VERSIONSCRIPT
 
@@ -98,7 +111,6 @@ AC_SUBST([ASN1_COMPILE_DEP])
 AC_SUBST([SLC])
 AC_SUBST([SLC_DEP])
 
-
 dnl ---
 
 AC_DEFINE(HEIM_WEAK_CRYPTO, 1, [Define if you want support for weak crypto])
@@ -199,12 +211,6 @@ DIR_hdbdir="$with_hdbdir"
 AC_SUBST([DIR_hdbdir])
 
 
-dnl no kerberos4 any more
-with_krb4=no
-AC_SUBST(INCLUDE_krb4)
-AC_SUBST(LIB_krb4)
-AM_CONDITIONAL(KRB4, false)
-
 AM_CONDITIONAL(KRB5, true)
 AM_CONDITIONAL(do_roken_rename, true)
 
@@ -246,6 +252,7 @@ if test "$enable_afs_support" = no; then
 	NO_AFS="1"
 fi
 AC_SUBST(NO_AFS)dnl
+AM_CONDITIONAL(NO_AFS, test "$enable_afs_support" = no)
 
 rk_DB
 
@@ -280,6 +287,12 @@ fi
 
 rk_CHECK_MAN
 
+AC_CHECK_HEADERS([\
+	readline/readline.h	\
+	readline.h		\
+	editline/readline.h	\
+])
+
 rk_TEST_PACKAGE(readline,
 [#include <stdio.h>
 #if defined(HAVE_READLINE_READLINE_H)
@@ -295,22 +308,16 @@ rk_TEST_PACKAGE(libedit,
 #include <readline/readline.h>
 #elif defined(HAVE_READLINE_H)
 #include <readline.h>
+#elif defined(HAVE_EDITLINE_READLINE_H)
+#include <editline/readline.h>
 #endif
-],-ledit,,, READLINE,, [readline.h readline/readline.h])
+],-ledit,,, READLINE,, [readline.h readline/readline.h editline/readline.h])
 
 AC_CONFIG_SUBDIRS([lib/libedit])
 
-rk_TEST_PACKAGE(hesiod,[#include <hesiod.h>],-lhesiod,,, HESIOD)
-
 KRB_C_BIGENDIAN
 AC_C_INLINE
 
-KRB_CHECK_X
-
-AM_CONDITIONAL(HAVE_X, test "$no_x" != yes)
-
-AC_CHECK_XAU
-
 dnl AM_C_PROTOTYPES
 
 dnl Checks for typedefs, structures, and compiler characteristics.
@@ -328,7 +335,6 @@ AC_HEADER_STDC
 AC_CHECK_HEADERS([\
 	CommonCrypto/CommonDigest.h		\
 	CommonCrypto/CommonCryptor.h		\
-	arpa/ftp.h				\
 	arpa/telnet.h				\
 	bind/bitypes.h				\
 	bsdsetjmp.h				\
@@ -379,8 +385,6 @@ AC_CHECK_HEADERS([\
 	tmpdir.h				\
 	udb.h					\
 	util.h					\
-	utmp.h					\
-	utmpx.h					\
 ])
 
 dnl On Solaris 8 there's a compilation warning for term.h because
@@ -464,9 +468,11 @@ AC_CHECK_FUNCS([				\
 	arc4random				\
 	backtrace				\
 	fcntl					\
+	fork					\
 	getpeereid				\
 	getpeerucred				\
 	grantpt					\
+	kill					\
 	mktime					\
 	ptsname					\
 	rand					\
@@ -489,6 +495,7 @@ AC_CHECK_FUNCS([				\
 	umask					\
 	unlockpt				\
 	vhangup					\
+	waitpid					\
 	yp_get_default_domain			\
 ])
 
@@ -504,8 +511,10 @@ AC_MSG_RESULT($ac_rk_have___sync_add_and_fetch)
 AC_FUNC_MMAP
 
 KRB_CAPABILITIES
+rk_DLADDR
 
 AC_CHECK_GETPWNAM_R_POSIX
+AC_CHECK_GETPWUID_R_POSIX
 
 dnl detect doors on solaris
 if test "$enable_pthread_support" != no; then
@@ -537,26 +546,6 @@ AC_CHECK_FUNCS(getudbnam setlim)
 
 dnl AC_KRB_FUNC_GETCWD_BROKEN
 
-dnl
-dnl Check for fields in struct utmp
-dnl
-
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_addr, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_host, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_id, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_pid, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_type, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmp, ut_user, [#include <utmp.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_host, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_id, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_line, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_pid, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_tv, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_type, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_user, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_exit, [#include <utmpx.h>])
-AC_HAVE_STRUCT_FIELD(struct utmpx, ut_syslen, [#include <utmpx.h>])
-
 AC_CHECK_TYPES([int8_t, int16_t, int32_t, int64_t, 
 	u_int8_t, u_int16_t, u_int32_t, u_int64_t,
 	uint8_t, uint16_t, uint32_t, uint64_t],,,[
@@ -613,7 +602,7 @@ AC_CONFIG_FILES(Makefile 		\
 	include/hcrypto/Makefile	\
 	include/kadm5/Makefile		\
 	lib/Makefile			\
-	base/Makefile			\
+	lib/base/Makefile			\
 	lib/asn1/Makefile		\
 	lib/com_err/Makefile		\
 	lib/hcrypto/Makefile		\
@@ -641,24 +630,10 @@ AC_CONFIG_FILES(Makefile 		\
 	kdc/Makefile			\
 	appl/Makefile			\
 	appl/afsutil/Makefile		\
-	appl/ftp/Makefile		\
-	appl/ftp/common/Makefile	\
-	appl/ftp/ftp/Makefile		\
-	appl/ftp/ftpd/Makefile		\
+	appl/dbutils/Makefile		\
 	appl/gssmask/Makefile		\
-	appl/kx/Makefile		\
-	appl/login/Makefile		\
 	appl/otp/Makefile		\
-	appl/popper/Makefile		\
-	appl/push/Makefile		\
-	appl/rsh/Makefile		\
-	appl/rcp/Makefile		\
 	appl/su/Makefile		\
-	appl/xnlock/Makefile		\
-	appl/telnet/Makefile		\
-	appl/telnet/libtelnet/Makefile	\
-	appl/telnet/telnet/Makefile	\
-	appl/telnet/telnetd/Makefile	\
 	appl/test/Makefile		\
 	appl/kf/Makefile		\
 	appl/dceutils/Makefile		\
diff --git a/crypto/external/bsd/heimdal/dist/doc/Makefile.am b/crypto/external/bsd/heimdal/dist/doc/Makefile.am
index e88cf9b79..c2c2d5073 100644
--- a/crypto/external/bsd/heimdal/dist/doc/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/doc/Makefile.am
@@ -24,6 +24,11 @@ hdb.dxy: hdb.din Makefile
 	chmod +x hdb.dxy.tmp
 	mv hdb.dxy.tmp hdb.dxy
 
+base.dxy: base.din Makefile
+	$(dxy_subst) < $(srcdir)/base.din > base.dxy.tmp
+	chmod +x base.dxy.tmp
+	mv base.dxy.tmp base.dxy
+
 hx509.dxy: hx509.din Makefile
 	$(dxy_subst) < $(srcdir)/hx509.din > hx509.dxy.tmp
 	chmod +x hx509.dxy.tmp
@@ -50,6 +55,7 @@ wind.dxy: wind.din Makefile
 	mv wind.dxy.tmp wind.dxy
 
 texi_subst = sed -e 's,[@]dbdir[@],$(localstatedir),g' \
+	-e 's,[@]dbtype[@],$(db_type),g' \
 	-e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g'
 
 vars.texi: vars.tin Makefile
@@ -57,16 +63,23 @@ vars.texi: vars.tin Makefile
 	chmod +x vars.texi.tmp
 	mv vars.texi.tmp vars.texi
 
-PROJECTS = hcrypto hdb hx509 gssapi krb5 ntlm wind 
+PROJECTS = base hdb hx509 gssapi krb5 ntlm wind 
 
-doxyout doxygen: hdb.dxy hx509.dxy hcrypto.dxy gssapi.dxy krb5.dxy ntlm.dxy wind.dxy
+PROJECTS += hcrypto
+
+doxyout doxygen: base.dxy hdb.dxy hx509.dxy hcrypto.dxy gssapi.dxy krb5.dxy ntlm.dxy wind.dxy
 	@find $(srcdir)/doxyout -type d ! -perm -200 -exec chmod u+w {} ';' ; \
 	rm -rf $(srcdir)/doxyout ; \
 	mkdir $(srcdir)/doxyout ; \
 	for a in $(PROJECTS) ; do \
 		echo $$a ; \
 		doxygen $$a.dxy; \
-		(cd $(srcdir)/doxyout && find $$a/man -type f > $$a/manpages ) ; \
+		(cd $(srcdir)/doxyout && \
+		    find $$a/man -name '_*' -type f -print | \
+			perl -lne unlink && \
+		    find $$a/html -name 'dir_*.html' -type f -print | \
+			perl -lne unlink && \
+		 find $$a/man -type f > $$a/manpages ) ; \
 	done
 
 install-data-hook: install-doxygen-manpage
@@ -123,6 +136,7 @@ EXTRA_DIST = \
 	hcrypto.din \
 	header.html \
 	heimdal.css \
+	base.din \
 	hx509.din \
 	krb5.din \
 	ntlm.din \
@@ -131,10 +145,14 @@ EXTRA_DIST = \
 	layman.asc \
 	doxytmpl.dxy \
 	wind.din \
+	base.hhp \
+	heimdal.hhp \
+	hx509.hhp \
 	vars.tin
 
 CLEANFILES = \
 	hcrypto.dxy* \
+	base.dxy* \
 	hx509.dxy* \
 	hdb.dxy* \
 	gssapi.dxy* \
diff --git a/crypto/external/bsd/heimdal/dist/doc/NTMakefile b/crypto/external/bsd/heimdal/dist/doc/NTMakefile
index 4894983ce..7567fad4b 100644
--- a/crypto/external/bsd/heimdal/dist/doc/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/doc/NTMakefile
@@ -57,10 +57,15 @@ hx509_TEXINFOS = \
 
 {}.tin{$(OBJ)}.texi:
 	$(SED) -e "s,[@]dbdir[@],x,g"	\
+	-e "s,[@]dbtype[@],sqlite,g" < $** > $@ \
 	-e "s,[@]PACKAGE_VERSION[@],$(VER_PACKAGE_VERSION),g" < $** > $@
 
 MAKEINFOFLAGS = --css-include=$(SRCDIR)/heimdal.css
 
+!ifdef APPVEYOR
+MAKEINFO = $(PERL) C:\msys64\usr\bin\makeinfo
+!endif
+
 ######################################################################
 # Build heimdal.chm
 
diff --git a/crypto/external/bsd/heimdal/dist/doc/ack.texi b/crypto/external/bsd/heimdal/dist/doc/ack.texi
index 92d110c0a..8ab30bae2 100644
--- a/crypto/external/bsd/heimdal/dist/doc/ack.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/ack.texi
@@ -1,7 +1,5 @@
-@c Id
-@c $NetBSD: ack.texi,v 1.1.1.3 2014/04/24 12:45:26 pettai Exp $
-
 @node  Acknowledgments, Copyrights and Licenses, Migration, Top
+@c $NetBSD: ack.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 @comment  node-name,  next,  previous,  up
 @appendix Acknowledgments
 
@@ -78,6 +76,7 @@ Bugfixes, documentation, encouragement, and code has been contributed by:
 @item Johan Gadsjö
 @item Johan Ihrén
 @item John Center
+@item Julian Ospald
 @item Jun-ichiro itojun Hagino
 @item KAMADA Ken'ichi
 @item Kamen Mazdrashki
@@ -115,6 +114,7 @@ Bugfixes, documentation, encouragement, and code has been contributed by:
 @item Simon Wilkinson
 @item Stefan Metzmacher
 @item Ted Percival
+@item Timothy Pearson
 @item Tom Payerle
 @item Victor Guerra
 @item Zeqing Xia
diff --git a/crypto/external/bsd/heimdal/dist/doc/apps.texi b/crypto/external/bsd/heimdal/dist/doc/apps.texi
index a9c42337e..fe477c519 100644
--- a/crypto/external/bsd/heimdal/dist/doc/apps.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/apps.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: apps.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $
+@c $NetBSD: apps.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Applications, Things in search for a better place, Setting up a realm, Top
 
diff --git a/crypto/external/bsd/heimdal/dist/doc/base.din b/crypto/external/bsd/heimdal/dist/doc/base.din
new file mode 100644
index 000000000..3ef6d404a
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/doc/base.din
@@ -0,0 +1,15 @@
+# Doxyfile 1.5.3
+
+PROJECT_NAME           = Heimdal base library
+PROJECT_NUMBER         = @PACKAGE_VERSION@
+OUTPUT_DIRECTORY       = @srcdir@/doxyout/base
+INPUT                  = @srcdir@/../lib/base
+
+WARN_IF_UNDOCUMENTED   = YES
+
+PERL_PATH              = /usr/bin/perl
+
+HTML_HEADER = "@srcdir@/header.html"
+HTML_FOOTER = "@srcdir@/footer.html"
+
+@INCLUDE = "@srcdir@/doxytmpl.dxy"
diff --git a/crypto/external/bsd/heimdal/dist/doc/base.hhp b/crypto/external/bsd/heimdal/dist/doc/base.hhp
new file mode 100644
index 000000000..e1a3d3cf5
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/doc/base.hhp
@@ -0,0 +1,8 @@
+[OPTIONS]
+Compatibility=1.1 or later
+Compiled file=heimbase.chm
+Contents file=toc.hhc
+Default topic=index.html
+Display compile progress=No
+Language=0x409 English (United States)
+Title=Heimdal Base
diff --git a/crypto/external/bsd/heimdal/dist/doc/copyright.texi b/crypto/external/bsd/heimdal/dist/doc/copyright.texi
index 9df826262..b82fb742b 100644
--- a/crypto/external/bsd/heimdal/dist/doc/copyright.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/copyright.texi
@@ -1,5 +1,5 @@
 
-@c $NetBSD: copyright.texi,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $
+@c $NetBSD: copyright.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 @macro copynext{} 
 @vskip 20pt plus 1fil
 @end macro
@@ -218,6 +218,9 @@ SUCH DAMAGE.
 @verbatim
 
 Copyright (c) 2003-2011, PADL Software Pty Ltd.
+Copyright (c) 2004, Andrew Bartlett.
+Copyright (c) 2003 - 2008, Kungliga Tekniska Högskolan
+Copyright (c) 2015, Timothy Pearson.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -444,7 +447,7 @@ Windows support
 
 @verbatim
 
-Copyright (c) 2009, Secure Endpoints Inc.
+Copyright (c) 2009-2015, Secure Endpoints Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
diff --git a/crypto/external/bsd/heimdal/dist/doc/doxytmpl.dxy b/crypto/external/bsd/heimdal/dist/doc/doxytmpl.dxy
index a16b0d8ce..1faab2f52 100644
--- a/crypto/external/bsd/heimdal/dist/doc/doxytmpl.dxy
+++ b/crypto/external/bsd/heimdal/dist/doc/doxytmpl.dxy
@@ -26,7 +26,6 @@ SHORT_NAMES            = NO
 JAVADOC_AUTOBRIEF      = NO
 QT_AUTOBRIEF           = NO
 MULTILINE_CPP_IS_BRIEF = NO
-DETAILS_AT_TOP         = NO
 INHERIT_DOCS           = YES
 SEPARATE_MEMBER_PAGES  = NO
 TAB_SIZE               = 8
@@ -65,7 +64,6 @@ GENERATE_DEPRECATEDLIST= YES
 ENABLED_SECTIONS       = 
 MAX_INITIALIZER_LINES  = 30
 SHOW_USED_FILES        = YES
-SHOW_DIRECTORIES       = NO
 FILE_VERSION_FILTER    = 
 #---------------------------------------------------------------------------
 # configuration options related to warning and progress messages
@@ -105,8 +103,7 @@ FILE_PATTERNS          = *.c \
                          *.inc \
                          *.m \
                          *.mm \
-                         *.dox \
-                         *.py
+                         *.dox
 RECURSIVE              = YES
 EXCLUDE                = 
 EXCLUDE_SYMLINKS       = NO
@@ -142,7 +139,6 @@ GENERATE_HTML          = YES
 HTML_OUTPUT            = html
 HTML_FILE_EXTENSION    = .html
 HTML_STYLESHEET        = 
-HTML_ALIGN_MEMBERS     = YES
 GENERATE_HTMLHELP      = NO
 HTML_DYNAMIC_SECTIONS  = NO
 CHM_FILE               = 
@@ -190,8 +186,6 @@ MAN_LINKS              = YES
 #---------------------------------------------------------------------------
 GENERATE_XML           = NO
 XML_OUTPUT             = xml
-XML_SCHEMA             = 
-XML_DTD                = 
 XML_PROGRAMLISTING     = YES
 #---------------------------------------------------------------------------
 # configuration options for the AutoGen Definitions output
@@ -213,7 +207,7 @@ EXPAND_ONLY_PREDEF     = NO
 SEARCH_INCLUDES        = YES
 INCLUDE_PATH           = 
 INCLUDE_FILE_PATTERNS  = 
-PREDEFINED             = 
+PREDEFINED             = DOXY
 EXPAND_AS_DEFINED      = 
 SKIP_FUNCTION_MACROS   = YES
 #---------------------------------------------------------------------------
@@ -227,7 +221,6 @@ EXTERNAL_GROUPS        = YES
 # Configuration options related to the dot tool   
 #---------------------------------------------------------------------------
 CLASS_DIAGRAMS         = NO
-MSCGEN_PATH            = /Applications/Doxygen.app/Contents/Resources/
 HIDE_UNDOC_RELATIONS   = YES
 HAVE_DOT               = YES
 CLASS_GRAPH            = YES
@@ -242,7 +235,6 @@ CALLER_GRAPH           = NO
 GRAPHICAL_HIERARCHY    = YES
 DIRECTORY_GRAPH        = YES
 DOT_IMAGE_FORMAT       = png
-DOT_PATH               = /Applications/Doxygen.app/Contents/Resources/
 DOTFILE_DIRS           = 
 DOT_GRAPH_MAX_NODES    = 50
 MAX_DOT_GRAPH_DEPTH    = 1000
diff --git a/crypto/external/bsd/heimdal/dist/doc/heimdal.hhp b/crypto/external/bsd/heimdal/dist/doc/heimdal.hhp
index 2996baa2f..b39e871fd 100644
--- a/crypto/external/bsd/heimdal/dist/doc/heimdal.hhp
+++ b/crypto/external/bsd/heimdal/dist/doc/heimdal.hhp
@@ -5,4 +5,4 @@ Contents file=toc.hhc
 Default topic=index.html
 Display compile progress=No
 Language=0x409 English (United States)
-Title=Heimdal
\ No newline at end of file
+Title=Heimdal
diff --git a/crypto/external/bsd/heimdal/dist/doc/heimdal.texi b/crypto/external/bsd/heimdal/dist/doc/heimdal.texi
index f12970c49..316866587 100644
--- a/crypto/external/bsd/heimdal/dist/doc/heimdal.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/heimdal.texi
@@ -1,5 +1,5 @@
 \input texinfo @c -*- texinfo -*-
-@c $NetBSD: heimdal.texi,v 1.1.1.3 2014/04/24 12:45:26 pettai Exp $
+@c $NetBSD: heimdal.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 @c %**start of header
 @c Id
 @setfilename heimdal.info
diff --git a/crypto/external/bsd/heimdal/dist/doc/hx509.hhp b/crypto/external/bsd/heimdal/dist/doc/hx509.hhp
index bce680aa9..a8dfd10af 100644
--- a/crypto/external/bsd/heimdal/dist/doc/hx509.hhp
+++ b/crypto/external/bsd/heimdal/dist/doc/hx509.hhp
@@ -5,4 +5,4 @@ Contents file=toc.hhc
 Default topic=index.html
 Display compile progress=No
 Language=0x409 English (United States)
-Title=HX509
\ No newline at end of file
+Title=HX509
diff --git a/crypto/external/bsd/heimdal/dist/doc/hx509.texi b/crypto/external/bsd/heimdal/dist/doc/hx509.texi
index 51813ce75..0b20193e3 100644
--- a/crypto/external/bsd/heimdal/dist/doc/hx509.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/hx509.texi
@@ -1,5 +1,5 @@
 \input texinfo @c -*- texinfo -*-
-@c $NetBSD: hx509.texi,v 1.1.1.3 2014/04/24 12:45:26 pettai Exp $
+@c $NetBSD: hx509.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 @c %**start of header
 @c Id
 @setfilename hx509.info
diff --git a/crypto/external/bsd/heimdal/dist/doc/install.texi b/crypto/external/bsd/heimdal/dist/doc/install.texi
index f8120c202..83d60298d 100644
--- a/crypto/external/bsd/heimdal/dist/doc/install.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/install.texi
@@ -1,5 +1,5 @@
 @node Building and Installing, Setting up a realm, What is Kerberos?, Top
-@c $NetBSD: install.texi,v 1.1.1.1 2011/04/13 18:14:33 elric Exp $
+@c $NetBSD: install.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 @comment  node-name,  next,  previous,  up
 @chapter Building and Installing
 
diff --git a/crypto/external/bsd/heimdal/dist/doc/intro.texi b/crypto/external/bsd/heimdal/dist/doc/intro.texi
index 7628c15cf..11892aa8c 100644
--- a/crypto/external/bsd/heimdal/dist/doc/intro.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/intro.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: intro.texi,v 1.1.1.3 2014/04/24 12:45:26 pettai Exp $
+@c $NetBSD: intro.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Introduction, What is Kerberos?, Top, Top
 @c @node Introduction, What is Kerberos?, Top, Top
diff --git a/crypto/external/bsd/heimdal/dist/doc/kerberos4.texi b/crypto/external/bsd/heimdal/dist/doc/kerberos4.texi
index 36b7f57b1..e5e5172ba 100644
--- a/crypto/external/bsd/heimdal/dist/doc/kerberos4.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/kerberos4.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: kerberos4.texi,v 1.1.1.3 2014/04/24 12:45:26 pettai Exp $
+@c $NetBSD: kerberos4.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Kerberos 4 issues, Windows compatibility, Things in search for a better place, Top
 @comment  node-name,  next,  previous,  up
diff --git a/crypto/external/bsd/heimdal/dist/doc/migration.texi b/crypto/external/bsd/heimdal/dist/doc/migration.texi
index 7d60b16f2..6804551be 100644
--- a/crypto/external/bsd/heimdal/dist/doc/migration.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/migration.texi
@@ -1,19 +1,39 @@
 @c Id
-@c $NetBSD: migration.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $
+@c $NetBSD: migration.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Migration, Acknowledgments, Programming with Kerberos, Top
 @chapter Migration
 
 @section Migration from MIT Kerberos to Heimdal
 
-hpropd can read MIT Kerberos dump, the format is the same as used in
-mit-kerberos 1.0b7, and to dump that format use the following command:
-@samp{kdb5_util dump -b7}.
+hpropd can read MIT Kerberos dump in "kdb5_util load_dump version 5" or
+version 6 format.  Simply run:
+@samp{kdb5_util dump}.
 
 To load the MIT Kerberos dump file, use the following command:
 
 @samp{/usr/heimdal/libexec/hprop --database=dump-file --master-key=/var/db/krb5kdc/mit_stash --source=mit-dump --decrypt --stdout | /usr/heimdal/libexec/hpropd --stdin}
 
+kadmin can dump in MIT Kerberos format.  Simply run:
+@samp{kadmin -l dump -f MIT}.
+
+The Heimdal KDC and kadmind, as well as kadmin -l and the libkadm5srv
+library can read and write MIT KDBs, and can read MIT stash files.  To
+build with KDB support requires having a standalone libdb from MIT
+Kerberos and associated headers, then you can configure Heildal as
+follows:
+
+@samp{./configure ... CPPFLAGS=-I/path-to-mit-db-headers LDFLAGS="-L/path-to-mit-db-object -Wl,-rpath -Wl,/path-to-mit-db-object" LDLIBS=-ldb}
+
+At this time support for MIT Kerberos KDB dump/load format and direct
+KDB access does not include support for PKINIT, or K/M key history,
+constrained delegation, and other advanced features.
+
+Heimdal supports using multiple HDBs at once, with all write going to
+just one HDB.  This allows for entries to be moved to a native HDB from
+an MIT KDB over time as those entries are changed.  Or you can use hprop
+and hpropd.
+
 @section General issues
 
 When migrating from a Kerberos 4 KDC.
diff --git a/crypto/external/bsd/heimdal/dist/doc/misc.texi b/crypto/external/bsd/heimdal/dist/doc/misc.texi
index 485631000..494698da0 100644
--- a/crypto/external/bsd/heimdal/dist/doc/misc.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/misc.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: misc.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $
+@c $NetBSD: misc.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Things in search for a better place, Kerberos 4 issues, Applications, Top
 @chapter Things in search for a better place
diff --git a/crypto/external/bsd/heimdal/dist/doc/oid.txt b/crypto/external/bsd/heimdal/dist/doc/oid.txt
deleted file mode 100644
index f907cdc98..000000000
--- a/crypto/external/bsd/heimdal/dist/doc/oid.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-OIDs used by Heimdal project.
-
-Contact       heimdal-contact@h5l.org
-
-Oid			Name
-
-1.2.752.43.13		Heimdal GSS-API extentions
-1.2.752.43.14		Heimdal GSS-API mechs
-1.2.752.43.16		Heimdal Internal crypto ops
-
-
-1.2.752.43.13.1		GSS_KRB5_COPY_CCACHE_X
-1.2.752.43.13.2		GSS_KRB5_GET_TKT_FLAGS_X
-1.2.752.43.13.3		GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X
-1.2.752.43.13.4		GSS_KRB5_COMPAT_DES3_MIC_X
-1.2.752.43.13.5		GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
-1.2.752.43.13.6		GSS_KRB5_EXPORT_LUCID_CONTEXT_X
-1.2.752.43.13.6.1	GSS_KRB5_EXPORT_LUCID_CONTEXT_V1_X
-1.2.752.43.13.7		GSS_KRB5_SET_DNS_CANONICALIZE_X
-1.2.752.43.13.8		GSS_KRB5_GET_SUBKEY_X
-1.2.752.43.13.9		GSS_KRB5_GET_INITIATOR_SUBKEY_X
-1.2.752.43.13.10	GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
-1.2.752.43.13.11	GSS_KRB5_SEND_TO_KDC_X
-1.2.752.43.13.12	GSS_KRB5_GET_AUTHTIME_X
-1.2.752.43.13.13	GSS_KRB5_GET_SERVICE_KEYBLOCK_X
-1.2.752.43.13.14	GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
-1.2.752.43.13.15	GSS_KRB5_SET_DEFAULT_REALM_X
-1.2.752.43.13.16	GSS_KRB5_CCACHE_NAME_X
-1.2.752.43.13.17	GSS_KRB5_CRED_NO_CI_FLAGS_X
-1.2.752.43.13.18	GSS_KRB5_IMPORT_CRED_X
-
-1.2.752.43.14.1		GSS_SASL_DIGEST_MD5_MECHANISM
diff --git a/crypto/external/bsd/heimdal/dist/doc/programming.texi b/crypto/external/bsd/heimdal/dist/doc/programming.texi
index 48f417f04..cc1339cbf 100644
--- a/crypto/external/bsd/heimdal/dist/doc/programming.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/programming.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: programming.texi,v 1.1.1.2 2011/04/14 14:08:09 elric Exp $
+@c $NetBSD: programming.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Programming with Kerberos, Migration, Windows compatibility, Top
 @chapter Programming with Kerberos
diff --git a/crypto/external/bsd/heimdal/dist/doc/setup.texi b/crypto/external/bsd/heimdal/dist/doc/setup.texi
index 42b943c2b..c6b3a03a1 100644
--- a/crypto/external/bsd/heimdal/dist/doc/setup.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/setup.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: setup.texi,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $
+@c $NetBSD: setup.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node Setting up a realm, Applications, Building and Installing, Top
 
@@ -109,7 +109,7 @@ SRV-record for your realm, or your Kerberos server has DNS CNAME
 
 @cindex KRB5_CONFIG
 If you want to use a different configuration file then the default you
-can point a file with the enviroment variable @samp{KRB5_CONFIG}.
+can point a file with the environment variable @samp{KRB5_CONFIG}.
 
 @example
 env KRB5_CONFIG=$HOME/etc/krb5.conf kinit user@@REALM
@@ -124,8 +124,30 @@ Make sure the directory has restrictive permissions.
 
 @example
 # mkdir /var/heimdal
+# chmod og-rwx /var/heimdal
 @end example
 
+Heimdal supports various database backends: lmdb (LMDB), db3 (Berkeley
+DB 3.x, 4.x, or 5.x), db1 (Berkeley DB 2.x), sqlite (SQLite3), and ldap
+(LDAP).  The default is @value{dbtype}, and is selected at build time
+from one of lmdb, db3, or db1.
+
+These defaults can be overriden in the 'database' key in the @samp{kdc}
+section of the configuration.
+
+@example
+[kdc]
+        database = @{
+                dbname = lmdb:/path/to/db-file
+                realm = REALM
+                acl_file = /path/to/kadmind.acl
+                mkey_file = /path/to/mkey
+                log_file = /path/to/iprop-log-file
+        @}
+@end example
+
+To use LDAP, see @xref{Using LDAP to store the database}.
+
 The keys of all the principals are stored in the database.  If you
 choose to, these can be encrypted with a master key.  You do not have to
 remember this key (or password), but just to enter it once and it will
@@ -597,6 +619,18 @@ slave#  /usr/heimdal/libexec/ipropd-slave master &
 To manage the iprop log file you should use the @command{iprop-log}
 command. With it you can dump, truncate and replay the logfile.
 
+@subsection Status of iprop master and slave
+
+Both the master and slave provides status of the world as they see it.
+
+The master write outs the current status of the slaves, last seen and
+their version number in @file{/var/heimdal/slaves-stats}.
+
+The slave write out the current status in @file{/var/heimdal/ipropd-slave-status}.
+
+These locations can be changed with command line options, and in the
+case of @command{ipropd_master}, the configuration file.
+
 @node Encryption types and salting, Credential cache server - KCM, Incremental propagation, Setting up a realm
 @section Encryption types and salting
 @cindex Salting
@@ -1042,7 +1076,8 @@ Its also possible to configure the ldap backend as a shared module,
 see option --hdb-openldap-module to configure.
 
 @item
-Configure OpenLDAP with @kbd{--enable-local} to enable the local transport.
+Optionally configure OpenLDAP with @kbd{--enable-local} to enable the
+local transport.
 
 @item
 Add the hdb schema to the LDAP server, it's included in the source-tree
@@ -1053,8 +1088,8 @@ include /usr/local/etc/openldap/schema/hdb.schema
 @end example
 
 @item
-Configure the LDAP server ACLs to accept writes from clients over the
-local transport. For example:
+Configure the LDAP server ACLs to accept writes from clients. For
+example:
 
 @example
 access to *
@@ -1074,10 +1109,15 @@ krb5Principal aux object with krb5PrincipalName set so that the
 Another option is to create an admins group and add the dn to that
 group.
 
-Since Heimdal talks to the LDAP server over a UNIX domain socket, and
-uses external sasl authentication, it's not possible to require
-security layer quality (ssf in cyrus-sasl lingo). So that requirement
-has to be turned off in OpenLDAP @command{slapd} configuration file
+If a non-local LDAP connection is used, the authz-regexp is not
+needed as Heimdal will bind to LDAP over the network using
+provided credentials.
+
+Since Heimdal talks to the LDAP server over a UNIX domain socket when
+configured for ldapi:///, and uses external sasl authentication, it's
+not possible to require security layer quality (ssf in cyrus-sasl lingo).
+So that requirement has to be turned off in OpenLDAP @command{slapd}
+configuration file
 @file{slapd.conf}.
 
 @example
@@ -1105,9 +1145,14 @@ enter the path to the kadmin acl file:
 
 @example
 [kdc]
+	# Optional configuration
+	hdb-ldap-structural-object = inetOrgPerson
+	hdb-ldap-url = ldapi:/// (default), ldap://hostname or ldaps://hostname
+	hdb-ldap-secret-file = /path/to/file/containing/ldap/credentials
+	hdb-ldap-start-tls = false
+
         database = @{
                 dbname = ldap:ou=KerberosPrincipals,dc=example,dc=com
-                hdb-ldap-structural-object = inetOrgPerson
                 acl_file = /path/to/kadmind.acl
                 mkey_file = /path/to/mkey
         @}
@@ -1118,7 +1163,18 @@ directory to have the raw keys inside it.  The
 hdb-ldap-structural-object is not necessary if you do not need Samba
 comatibility.
 
+If connecting to a server over a non-local transport, the @samp{hdb-ldap-url}
+and @samp{hdb-ldap-secret-file} options must be provided. The
+@samp{hdb-ldap-secret-file} must contain the bind credentials:
 
+@example
+[kdc]
+	hdb-ldap-bind-dn = uid=heimdal,dc=services,dc=example,dc=com
+	hdb-ldap-bind-password = secretBindPassword
+@end example
+
+The @samp{hdb-ldap-secret-file} and should be protected with appropriate
+file permissions
 
 @item
 Once you have built Heimdal and started the LDAP server, run kadmin
@@ -1249,8 +1305,8 @@ certificates to get the initial ticket (usually the krbtgt
 ticket-granting ticket).
 
 To use PK-INIT you must first have a PKI. If you don't have one, it is
-time to create it. You should first read the whole chapter of the
-document to see the requirements imposed on the CA software.
+time to create it. You should first read the whole current chapter of
+the document to see the requirements imposed on the CA software.
 
 A mapping between the PKI certificate and what principals that
 certificate is allowed to use must exist. There are several ways to do
@@ -1260,20 +1316,23 @@ the mapping in the principals entry in the kerberos database.
 
 @section Certificates
 
-This section documents the requirements on the KDC and client
-certificates and the format used in the id-pkinit-san OtherName
-extention.
+This and following subsection documents the requirements on the KDC
+and client certificates and the format used in the id-pkinit-san
+OtherName extension.
+
+On how to create certificates, you should read @ref{Use OpenSSL to
+create certificates}.
 
 @subsection KDC certificate
 
-The certificate for the KDC has serveral requirements.
+The certificate for the KDC has several requirements.
 
 First, the certificate should have an Extended Key Usage (EKU)
 id-pkkdcekuoid (1.3.6.1.5.2.3.5) set. Second, there must be a
 subjectAltName otherName using OID id-pkinit-san (1.3.6.1.5.2.2) in
 the type field and a DER encoded KRB5PrincipalName that matches the
 name of the TGS of the target realm.  Also, if the certificate has a
-nameConstraints extention with a Generalname with dNSName or iPAdress,
+nameConstraints extension with a Generalname with dNSName or iPAdress,
 it must match the hostname or adress of the KDC.
 
 The client is not required by the standard to check the server
@@ -1292,7 +1351,7 @@ secret.
 @subsection Client certificate
 
 The client certificate may need to have a EKU id-pkekuoid
-(1.3.6.1.5.2.3.4) set depending on the certifiate on the KDC.
+(1.3.6.1.5.2.3.4) set depending on the configuration on the KDC.
 
 It possible to store the principal (if allowed by the KDC) in the
 certificate and thus delegate responsibility to do the mapping between
@@ -1307,7 +1366,7 @@ This behavior is controlled by KDC configuration option:
 
 @subsubsection Using KRB5PrincipalName in id-pkinit-san
 
-The OtherName extention in the GeneralName is used to do the mapping
+The OtherName extension in the GeneralName is used to do the mapping
 between certificate and principal.  For the KDC certificate, this
 stores the krbtgt principal name for that KDC.  For the client
 certificate, this stores the principal for which that certificate is
@@ -1435,8 +1494,6 @@ Credentials cache: API:4
 Mar 26 23:40:10  Mar 27 09:40:10  krbtgt/EXAMPLE.ORG@@EXAMPLE.ORG
 @end example
 
-TODO: Write about the KDC.
-
 @section Configure the client
 
 @example
@@ -1455,6 +1512,45 @@ TODO: Write about the KDC.
 
 @section Configure the KDC
 
+Configuration options for the KDC.
+
+@table @asis
+@item enable-pkinit = bool
+
+Enable PKINIT for this KDC.
+
+@item pkinit_identity = string
+
+Identity that the KDC will use when talking to clients. Mandatory.
+
+@item pkinit_anchors = string
+
+Trust anchors that the KDC will use when evaluating the trust of the
+client certificate. Mandatory.
+
+@item pkinit_pool = strings ...
+
+Extra certificate the KDC will use when building trust chains if it
+can't find enough certificates in the request from the client.
+
+@item pkinit_allow_proxy_certificate = bool
+
+Allow clients to use proxy certificates. The root certificate
+of the client's End Entity certificate is used for authorisation.
+
+@item pkinit_win2k_require_binding = bool
+
+Require windows clients up be upgrade to not allow cut and paste
+attack on encrypted data, applies to Windows XP and windows 2000
+servers.
+
+@item pkinit_principal_in_certificate = bool
+
+Enable the KDC to use id-pkinit-san to determine to determine the
+mapping between a certificate and principal.
+
+@end table
+
 @example
 [kdc]
 	enable-pkinit = yes
@@ -1469,7 +1565,7 @@ TODO: Write about the KDC.
 
 @subsection Using pki-mapping file
 
-Note that the file name is space sensitive.
+Note that the file contents are space sensitive.
 
 @example
 # cat /var/heimdal/pki-mapping
@@ -1480,6 +1576,13 @@ lha@@EXAMPLE.ORG:CN=Love,UID=lha
 
 @subsection Using the Kerberos database
 
+You can also store the subject of the certificate in the principal
+entry in the kerberos database.
+
+@example
+kadmin modify --pkinit-acl="CN=baz,DC=test,DC=h5l,DC=se" user@@REALM
+@end example
+
 @section Use hxtool to create certificates
 
 @subsection Generate certificates
@@ -1548,6 +1651,7 @@ hxtool validate FILE:user.pem
 @end example
 
 @section Use OpenSSL to create certificates
+@anchor{Use OpenSSL to create certificates}
 
 This section tries to give the CA owners hints how to create
 certificates using OpenSSL (or CA software based on OpenSSL).
diff --git a/crypto/external/bsd/heimdal/dist/doc/vars.tin b/crypto/external/bsd/heimdal/dist/doc/vars.tin
index d3e67b7d4..0907397db 100644
--- a/crypto/external/bsd/heimdal/dist/doc/vars.tin
+++ b/crypto/external/bsd/heimdal/dist/doc/vars.tin
@@ -4,4 +4,5 @@
 @c
 
 @set dbdir @dbdir@
+@set dbtype @dbtype@
 @set PACKAGE_VERSION @PACKAGE_VERSION@
diff --git a/crypto/external/bsd/heimdal/dist/doc/whatis.texi b/crypto/external/bsd/heimdal/dist/doc/whatis.texi
index 4bfe01b56..2e6ab8a4a 100644
--- a/crypto/external/bsd/heimdal/dist/doc/whatis.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/whatis.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: whatis.texi,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $
+@c $NetBSD: whatis.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 @node What is Kerberos?, Building and Installing, Introduction, Top
 @chapter What is Kerberos?
diff --git a/crypto/external/bsd/heimdal/dist/doc/win2k.texi b/crypto/external/bsd/heimdal/dist/doc/win2k.texi
index 2412d86ec..c8b5165b2 100644
--- a/crypto/external/bsd/heimdal/dist/doc/win2k.texi
+++ b/crypto/external/bsd/heimdal/dist/doc/win2k.texi
@@ -1,5 +1,5 @@
 @c Id
-@c $NetBSD: win2k.texi,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $
+@c $NetBSD: win2k.texi,v 1.2 2017/01/28 21:31:44 christos Exp $
 
 
 @node Windows compatibility, Programming with Kerberos, Kerberos 4 issues, Top
diff --git a/crypto/external/bsd/heimdal/dist/include/Makefile.am b/crypto/external/bsd/heimdal/dist/include/Makefile.am
index 6c30e9e9f..6c428128b 100644
--- a/crypto/external/bsd/heimdal/dist/include/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/include/Makefile.am
@@ -13,7 +13,7 @@ nodist_include_HEADERS = krb5-types.h
 
 noinst_HEADERS = heim_threads.h crypto-headers.h
 
-EXTRA_DIST = NTMakefile krb5-types.cross
+EXTRA_DIST = NTMakefile krb5-types.cross config.h.w32
 
 if !CROSS_COMPILE
 
@@ -28,18 +28,20 @@ krb5-types.h: krb5-types.cross
 endif
 
 CLEANFILES =			\
-	asn1.h			\
+	an2ln_plugin.h		\
 	asn1-common.h		\
 	asn1-template.h		\
+	asn1.h			\
 	asn1_err.h		\
 	base64.h		\
+	ccache_plugin.h		\
 	cms_asn1.h 		\
-	crmf_asn1.h		\
 	com_err.h		\
 	com_right.h		\
-	ccache_plugin.h		\
-	der-protos.h 		\
+	crmf_asn1.h		\
+	db_plugin.h		\
 	der-private.h 		\
+	der-protos.h 		\
 	der.h			\
 	digest_asn1.h 		\
 	editline.h		\
@@ -47,6 +49,8 @@ CLEANFILES =			\
 	getarg.h		\
 	glob.h			\
 	gssapi.h		\
+	gssapi_mech.h		\
+	hdb-private.h		\
 	hdb-protos.h		\
 	hdb.h			\
 	hdb_asn1.h		\
@@ -58,11 +62,14 @@ CLEANFILES =			\
 	heimntlm-protos.h	\
 	heimntlm.h		\
 	hex.h			\
+	hx509-private.h		\
 	hx509-protos.h		\
 	hx509.h			\
 	hx509_err.h		\
 	k524_err.h		\
 	kafs.h			\
+	kcm-protos.h		\
+	kdc-private.h		\
 	kdc-protos.h		\
 	kdc.h			\
 	krb5-private.h		\
@@ -76,6 +83,7 @@ CLEANFILES =			\
 	kx509_asn1.h		\
 	kx509_err.h		\
 	locate_plugin.h		\
+	login-protos.h		\
 	ntlm_err.h		\
 	ocsp_asn1.h		\
 	otp.h			\
@@ -94,6 +102,8 @@ CLEANFILES =			\
 	rtbl.h			\
 	send_to_kdc_plugin.h	\
 	sl.h			\
+	sqlite3.h		\
+	sqlite3ext.h		\
 	test-mem.h		\
 	vers.h			\
 	vis.h			\
diff --git a/crypto/external/bsd/heimdal/dist/include/NTMakefile b/crypto/external/bsd/heimdal/dist/include/NTMakefile
index f3749fa4e..e494687d4 100644
--- a/crypto/external/bsd/heimdal/dist/include/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/include/NTMakefile
@@ -61,6 +61,7 @@ while(<>) {
     if ("$(KRB5)") { print "#define KRB5 1\n"; }
     if ("$(KRB4)") { print "#define KRB4 1\n"; }
     if ("$(WEAK_CRYPTO)") { print "#define HEIM_WEAK_CRYPTO 1\n"; }
+    if ("$(HCRYPTO_FALLBACK)") { print "#define HCRYPTO_FALLBACK 1\n"; } else { print "#define HCRYPTO_FALLBACK 0\n"; }
     if ("$(PKINIT)") { print "#define PKINIT 1\n"; }
     if ("$(NO_AFS)") { print "#define NO_AFS 1\n"; }
     if ("$(OPENLDAP)") { print "#define OPENLDAP 1\n"; }
@@ -75,6 +76,7 @@ while(<>) {
     if ("$(ENV_HACK)") { print "#define ENV_HACK 1\n"; }
     if ("$(HAVE_KCM)") { print "#define HAVE_KCM 1\n"; }
     if ("$(HAVE_SCC)") { print "#define HAVE_SCC 1\n"; }
+    if ("$(HAVE_STDINT_H)") { print "#define HAVE_STDINT_H 1\n"; }
     if ("$(DIR_hdbdir)") { print "#define HDB_DB_DIR \"".'$(DIR_hdbdir)'."\"\n"; }
     if ("$(HAVE_MSLSA_CACHE)") { print "#define HAVE_MSLSA_CACHE 1\n"; }
     if ("$(NO_LOCALNAME)") { print "#define NO_LOCALNAME 1\n"; }
@@ -84,14 +86,14 @@ while(<>) {
     if ("$(VER_PRERELEASE)") { print "#define VER_PRERELEASE 1\n"; }
     if ("$(VER_PRIVATE)") { print "#define VER_PRIVATE \"$(VER_PRIVATE)\"\n"; }
     if ("$(VER_SPECIAL)") { print "#define VER_SPECIAL \"$(VER_SPECIAL)\"\n"; }
-    if ("$(BUILD)" =~ "dbg") { print "#define VER_DEBUG 1\n"; }
+    if ("$(BUILD)" eq "dbg") { print "#define VER_DEBUG 1\n"; }
     print "#define HOST \"$(COMPUTERNAME)\"\n";
 
   } else {
 
     s/\@PACKAGE\@/$(VER_PACKAGE)/;
     s/\@PACKAGE_NAME\@/$(VER_PACKAGE_NAME)/;
-    s/\@PACKAGE_BUGREPORT\@/$(VER_PACKAGE_BUGREPORT:@=\@)/;
+    s{\@PACKAGE_BUGREPORT\@}{$(VER_PACKAGE_BUGREPORT:@=\@)};
     s/\@PACKAGE_VERSION\@/$(VER_PACKAGE_VERSION)/;
     s/\@PACKAGE_COPYRIGHT\@/$(VER_PACKAGE_COPYRIGHT)/;
     s/\@PACKAGE_COMPANY\@/$(VER_PACKAGE_COMPANY)/;
diff --git a/crypto/external/bsd/heimdal/dist/include/bits.c b/crypto/external/bsd/heimdal/dist/include/bits.c
index 67db04068..e3eea7a99 100644
--- a/crypto/external/bsd/heimdal/dist/include/bits.c
+++ b/crypto/external/bsd/heimdal/dist/include/bits.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bits.c,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: bits.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-__RCSID("NetBSD");
+__RCSID("$NetBSD: bits.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 #endif
 #include <stdio.h>
 #include <string.h>
@@ -70,13 +70,13 @@ __RCSID("NetBSD");
 #endif
 
 static void
-try_signed(FILE *f, int len)  __attribute__ ((unused));
+try_signed(FILE *f, int len)  __attribute__ ((__unused__));
 
 static void
-try_unsigned(FILE *f, int len) __attribute__ ((unused));
+try_unsigned(FILE *f, int len) __attribute__ ((__unused__));
 
 static int
-print_bt(FILE *f, int flag) __attribute__ ((unused));
+print_bt(FILE *f, int flag) __attribute__ ((__unused__));
 
 static void
 try_signed(FILE *f, int len)
@@ -120,7 +120,8 @@ int main(int argc, char **argv)
 {
     FILE *f;
     int flag;
-    const char *fn, *hb;
+    char *p = NULL;
+    const char *hb;
 
     if (argc > 1 && strcmp(argv[1], "--version") == 0) {
 	printf("some version");
@@ -128,14 +129,11 @@ int main(int argc, char **argv)
     }
 
     if(argc < 2){
-	fn = "bits.h";
 	hb = "__BITS_H__";
 	f = stdout;
     } else {
-	char *p;
-	fn = argv[1];
-	p = malloc(strlen(fn) + 5);
-	sprintf(p, "__%s__", fn);
+	p = malloc(strlen(argv[1]) + 5);
+	sprintf(p, "__%s__", argv[1]);
 	hb = p;
 	for(; *p; p++){
 	    if(!isalnum((unsigned char)*p))
@@ -143,9 +141,6 @@ int main(int argc, char **argv)
 	}
 	f = fopen(argv[1], "w");
     }
-    fprintf(f, "/* %s -- this file was generated for %s by\n", fn, HOST);
-    fprintf(f, "   %*s    %s */\n\n", (int)strlen(fn), "",
-	    "Id");
     fprintf(f, "#ifndef %s\n", hb);
     fprintf(f, "#define %s\n", hb);
     fprintf(f, "\n");
@@ -257,39 +252,57 @@ int main(int argc, char **argv)
 
 #endif /* KRB5 */
 
+    fprintf(f, "#if !defined(__has_extension)\n");
+    fprintf(f, "#define __has_extension(x) 0\n");
+    fprintf(f, "#endif\n\n");
+
+    fprintf(f, "#ifndef KRB5TYPES_REQUIRE_GNUC\n");
+    fprintf(f, "#define KRB5TYPES_REQUIRE_GNUC(m,n,p) \\\n");
+    fprintf(f, "    (((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + __GNUC_PATCHLEVEL__) >= \\\n");
+    fprintf(f, "     (((m) * 10000) + ((n) * 100) + (p)))\n");
+    fprintf(f, "#endif\n\n");
+
     fprintf(f, "#ifndef HEIMDAL_DEPRECATED\n");
-    fprintf(f, "#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))\n");
-    fprintf(f, "#define HEIMDAL_DEPRECATED __attribute__((deprecated))\n");
+    fprintf(f, "#if __has_extension(deprecated) || KRB5TYPES_REQUIRE_GNUC(3,1,0)\n");
+    fprintf(f, "#define HEIMDAL_DEPRECATED __attribute__ ((__deprecated__))\n");
     fprintf(f, "#elif defined(_MSC_VER) && (_MSC_VER>1200)\n");
     fprintf(f, "#define HEIMDAL_DEPRECATED __declspec(deprecated)\n");
     fprintf(f, "#else\n");
     fprintf(f, "#define HEIMDAL_DEPRECATED\n");
     fprintf(f, "#endif\n");
-    fprintf(f, "#endif\n");
+    fprintf(f, "#endif\n\n");
 
     fprintf(f, "#ifndef HEIMDAL_PRINTF_ATTRIBUTE\n");
-    fprintf(f, "#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))\n");
-    fprintf(f, "#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__((format x))\n");
+    fprintf(f, "#if __has_extension(format) || KRB5TYPES_REQUIRE_GNUC(3,1,0)\n");
+    fprintf(f, "#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__ ((__format__ x))\n");
     fprintf(f, "#else\n");
     fprintf(f, "#define HEIMDAL_PRINTF_ATTRIBUTE(x)\n");
     fprintf(f, "#endif\n");
-    fprintf(f, "#endif\n");
+    fprintf(f, "#endif\n\n");
 
     fprintf(f, "#ifndef HEIMDAL_NORETURN_ATTRIBUTE\n");
-    fprintf(f, "#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))\n");
-    fprintf(f, "#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__((noreturn))\n");
+    fprintf(f, "#if __has_extension(noreturn) || KRB5TYPES_REQUIRE_GNUC(3,1,0)\n");
+    fprintf(f, "#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__ ((__noreturn__))\n");
     fprintf(f, "#else\n");
     fprintf(f, "#define HEIMDAL_NORETURN_ATTRIBUTE\n");
     fprintf(f, "#endif\n");
-    fprintf(f, "#endif\n");
+    fprintf(f, "#endif\n\n");
 
     fprintf(f, "#ifndef HEIMDAL_UNUSED_ATTRIBUTE\n");
-    fprintf(f, "#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))\n");
-    fprintf(f, "#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__((unused))\n");
+    fprintf(f, "#if __has_extension(unused) || KRB5TYPES_REQUIRE_GNUC(3,1,0)\n");
+    fprintf(f, "#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__ ((__unused__))\n");
     fprintf(f, "#else\n");
     fprintf(f, "#define HEIMDAL_UNUSED_ATTRIBUTE\n");
     fprintf(f, "#endif\n");
+    fprintf(f, "#endif\n\n");
+
+    fprintf(f, "#ifndef HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE\n");
+    fprintf(f, "#if __has_extension(warn_unused_result) || KRB5TYPES_REQUIRE_GNUC(3,3,0)\n");
+    fprintf(f, "#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE __attribute__ ((__warn_unused_result__))\n");
+    fprintf(f, "#else\n");
+    fprintf(f, "#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE\n");
     fprintf(f, "#endif\n");
+    fprintf(f, "#endif\n\n");
 
     fprintf(f, "#endif /* %s */\n", hb);
 
diff --git a/crypto/external/bsd/heimdal/dist/include/config.h.w32 b/crypto/external/bsd/heimdal/dist/include/config.h.w32
index 1b0048b1f..993268def 100644
--- a/crypto/external/bsd/heimdal/dist/include/config.h.w32
+++ b/crypto/external/bsd/heimdal/dist/include/config.h.w32
@@ -1,5 +1,5 @@
 /***********************************************************************
- * Copyright (c) 2009, Secure Endpoints Inc.
+ * Copyright (c) 2009-2016, Secure Endpoints Inc.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -133,9 +133,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `arc4random' function. */
 /* #undef HAVE_ARC4RANDOM */
 
-/* Define to 1 if you have the <arpa/ftp.h> header file. */
-/* #undef HAVE_ARPA_FTP_H  */
-
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 /* #undef HAVE_ARPA_INET_H  */
 
@@ -303,6 +300,10 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* MSVC doesn't provide a <dlfcn.h>, but we implement it in lib/roken. */
 #define HAVE_DLOPEN 1
 
+/* Define to 1 if you have the `dladdr' function. */
+/* MSVC doesn't provide a <dlfcn.h>, but we implement it in lib/roken. */
+#define HAVE_DLADDR 1
+
 /* Define to 1 if you have the `dn_expand' function. */
 /* #undef HAVE_DN_EXPAND */
 
@@ -648,8 +649,8 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `openpty' function. */
 /* #define HAVE_OPENPTY 1 */
 
-/* define to use openssl's libcrypto */
-/* #undef HAVE_OPENSSL */
+/* define to 1 to use openssl's libcrypto as a (default) backend for libhcrypto */
+/* #undef HAVE_HCRYPTO_W_OPENSSL */
 
 /* Define to enable basic OSF C2 support. */
 /* #undef HAVE_OSFC2 */
@@ -917,30 +918,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if struct tm has field tm_zone. */
 /* #undef HAVE_STRUCT_TM_TM_ZONE */
 
-/* Define if struct utmpx has field ut_exit. */
-/* #undef HAVE_STRUCT_UTMPX_UT_EXIT */
-
-/* Define if struct utmpx has field ut_syslen. */
-/* #undef HAVE_STRUCT_UTMPX_UT_SYSLEN */
-
-/* Define if struct utmp has field ut_addr. */
-/* #define HAVE_STRUCT_UTMP_UT_ADDR 1 */
-
-/* Define if struct utmp has field ut_host. */
-/* #define HAVE_STRUCT_UTMP_UT_HOST 1 */
-
-/* Define if struct utmp has field ut_id. */
-/* #define HAVE_STRUCT_UTMP_UT_ID 1 */
-
-/* Define if struct utmp has field ut_pid. */
-/* #define HAVE_STRUCT_UTMP_UT_PID 1 */
-
-/* Define if struct utmp has field ut_type. */
-/* #define HAVE_STRUCT_UTMP_UT_TYPE 1 */
-
-/* Define if struct utmp has field ut_user. */
-/* #define HAVE_STRUCT_UTMP_UT_USER 1 */
-
 /* define if struct winsize is declared in sys/termios.h */
 /* #define HAVE_STRUCT_WINSIZE 1 */
 
@@ -1162,12 +1139,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <util.h> header file. */
 /* #undef HAVE_UTIL_H */
 
-/* Define to 1 if you have the <utmpx.h> header file. */
-/* #define HAVE_UTMPX_H 1 */
-
-/* Define to 1 if you have the <utmp.h> header file. */
-/* #define HAVE_UTMP_H 1 */
-
 /* Define to 1 if the system has the type `u_int16_t'. */
 /* #define HAVE_U_INT16_T 1 */
 
@@ -1236,15 +1207,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* define if struct winsize has ws_ypixel */
 /* #define HAVE_WS_YPIXEL 1 */
 
-/* Define to 1 if you have the `XauFileName' function. */
-/* #undef HAVE_XAUFILENAME */
-
-/* Define to 1 if you have the `XauReadAuth' function. */
-/* #undef HAVE_XAUREADAUTH */
-
-/* Define to 1 if you have the `XauWriteAuth' function. */
-/* #undef HAVE_XAUWRITEAUTH */
-
 /* Define to 1 if you have the `yp_get_default_domain' function. */
 /* #undef HAVE_YP_GET_DEFAULT_DOMAIN */
 
@@ -1263,9 +1225,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the `__progname' variable. */
 /* #define HAVE___PROGNAME 1 */
 
-/* Define if you have the hesiod package. */
-/* #undef HESIOD */
-
 /* Define if you are running IRIX 4. */
 /* #undef IRIX4 */
 
@@ -1359,9 +1318,6 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you don't want to use mmap. */
 #define NO_MMAP 1
 
-/* Define if EGD rand method is not defined */
-#define NO_RAND_EGD_METHOD 1
-
 /* Define if the Unix rand method is not defined */
 #define NO_RAND_UNIX_METHOD 1
 
diff --git a/crypto/external/bsd/heimdal/dist/include/crypto-headers.h b/crypto/external/bsd/heimdal/dist/include/crypto-headers.h
index ed2e3389a..9f2cfc090 100644
--- a/crypto/external/bsd/heimdal/dist/include/crypto-headers.h
+++ b/crypto/external/bsd/heimdal/dist/include/crypto-headers.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-headers.h,v 1.1.1.1 2011/04/13 18:14:34 elric Exp $	*/
+/*	$NetBSD: crypto-headers.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 #ifndef __crypto_header__
 #define __crypto_header__
@@ -7,7 +7,8 @@
 #error "need config.h"
 #endif
 
-#ifdef HAVE_OPENSSL
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+
 
 #define OPENSSL_DES_LIBDES_COMPATIBILITY
 
@@ -32,7 +33,7 @@
 #define BN_is_negative(bn) ((bn)->neg != 0)
 #endif
 
-#else /* !HAVE_OPENSSL */
+#else /* !HAVE_HCRYPTO_W_OPENSSL */
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
@@ -50,10 +51,7 @@
 #include <hcrypto/engine.h>
 #include <hcrypto/pkcs12.h>
 #include <hcrypto/hmac.h>
-#include <hcrypto/ec.h>
-#include <hcrypto/ecdsa.h>
-#include <hcrypto/ecdh.h>
 
-#endif /* HAVE_OPENSSL */
+#endif
 
 #endif /* __crypto_header__ */
diff --git a/crypto/external/bsd/heimdal/dist/include/hcrypto/Makefile.am b/crypto/external/bsd/heimdal/dist/include/hcrypto/Makefile.am
index 753a97836..3990fa29e 100644
--- a/crypto/external/bsd/heimdal/dist/include/hcrypto/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/include/hcrypto/Makefile.am
@@ -25,6 +25,7 @@ CLEANFILES =		\
 	rc4.h		\
 	rsa.h		\
 	sha.h		\
-	ui.h
+	ui.h		\
+	undef.h
 
 EXTRA_DIST = NTMakefile
diff --git a/crypto/external/bsd/heimdal/dist/include/heim_threads.h b/crypto/external/bsd/heimdal/dist/include/heim_threads.h
index 8f7b740a5..9f3e2e3c3 100644
--- a/crypto/external/bsd/heimdal/dist/include/heim_threads.h
+++ b/crypto/external/bsd/heimdal/dist/include/heim_threads.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: heim_threads.h,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: heim_threads.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
- * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -48,6 +48,24 @@
 #ifndef HEIM_THREADS_H
 #define HEIM_THREADS_H 1
 
+#ifdef _MSC_VER
+
+#define HEIMDAL_THREAD_LOCAL __declspec(thread)
+
+#else
+
+#if defined(__clang__) || defined(__GNUC__) || defined(__SUNPRO_CC) || defined(__lint__)
+#define HEIMDAL_THREAD_LOCAL __thread
+#else
+#error "thread-local attribute not defined for your compiler"
+#endif /* clang or gcc */
+
+#endif /* _MSC_VER */
+
+/* For testing the for-Windows implementation of thread keys on non-Windows */
+typedef unsigned long HEIM_PRIV_thread_key;
+
+
 /* assume headers already included */
 
 #if defined(__NetBSD__) && __NetBSD_Version__ >= 106120000 && __NetBSD_Version__< 299001200 && defined(ENABLE_PTHREAD_SUPPORT)
@@ -83,6 +101,9 @@
 #define HEIMDAL_getspecific(k) thr_getspecific(k)
 #define HEIMDAL_key_delete(k) thr_keydelete(k)
 
+#define HEIMDAL_THREAD_ID thr_t
+#define HEIMDAL_THREAD_create(t,f,a) thr_create((t), 0, (f), (a))
+
 #elif defined(ENABLE_PTHREAD_SUPPORT) && (!defined(__NetBSD__) || __NetBSD_Version__ >= 299001200)
 
 #include <pthread.h>
@@ -94,8 +115,8 @@
 #define HEIMDAL_MUTEX_unlock(m) pthread_mutex_unlock(m)
 #define HEIMDAL_MUTEX_destroy(m) pthread_mutex_destroy(m)
 
-#define HEIMDAL_RWLOCK rwlock_t
-#define HEIMDAL_RWLOCK_INITIALIZER RWLOCK_INITIALIZER
+#define HEIMDAL_RWLOCK pthread_rwlock_t
+#define HEIMDAL_RWLOCK_INITIALIZER PTHREAD_RWLOCK_INITIALIZER
 #define	HEIMDAL_RWLOCK_init(l) pthread_rwlock_init(l, NULL)
 #define	HEIMDAL_RWLOCK_rdlock(l) pthread_rwlock_rdlock(l)
 #define	HEIMDAL_RWLOCK_wrlock(l) pthread_rwlock_wrlock(l)
@@ -104,11 +125,172 @@
 #define	HEIMDAL_RWLOCK_unlock(l) pthread_rwlock_unlock(l)
 #define	HEIMDAL_RWLOCK_destroy(l) pthread_rwlock_destroy(l)
 
+#ifdef HEIM_BASE_MAINTAINER
+#define HEIMDAL_thread_key unsigned long
+#define HEIM_PRIV_thread_key HEIMDAL_thread_key
+#define HEIMDAL_key_create(k,d,r) do { r = heim_w32_key_create(k,d); } while(0)
+#define HEIMDAL_setspecific(k,s,r) do { r = heim_w32_setspecific(k,s); } while(0)
+#define HEIMDAL_getspecific(k) (heim_w32_getspecific(k))
+#define HEIMDAL_key_delete(k) (heim_w32_delete_key(k))
+#else
 #define HEIMDAL_thread_key pthread_key_t
 #define HEIMDAL_key_create(k,d,r) do { r = pthread_key_create(k,d); } while(0)
 #define HEIMDAL_setspecific(k,s,r) do { r = pthread_setspecific(k,s); } while(0)
 #define HEIMDAL_getspecific(k) pthread_getspecific(k)
 #define HEIMDAL_key_delete(k) pthread_key_delete(k)
+#endif
+
+#define HEIMDAL_THREAD_ID pthread_t
+#define HEIMDAL_THREAD_create(t,f,a) pthread_create((t), 0, (f), (a))
+
+#elif defined(_WIN32)
+
+typedef struct heim_mutex {
+    HANDLE	h;
+} heim_mutex_t;
+
+static inline int
+heim_mutex_init(heim_mutex_t *m)
+{
+    m->h = CreateSemaphore(NULL, 1, 1, NULL);
+    if (m->h == INVALID_HANDLE_VALUE)
+        return EAGAIN;
+    return 0;
+}
+
+static inline int
+heim_mutex_lock(heim_mutex_t *m)
+{
+    HANDLE h, new_h;
+    int created = 0;
+
+    h = InterlockedCompareExchangePointer(&m->h, m->h, m->h);
+    if (h == INVALID_HANDLE_VALUE || h == NULL) {
+	created = 1;
+	new_h = CreateSemaphore(NULL, 0, 1, NULL);
+	if (new_h == INVALID_HANDLE_VALUE)
+	    return EAGAIN;
+	if (InterlockedCompareExchangePointer(&m->h, new_h, h) != h) {
+	    created = 0;
+	    CloseHandle(new_h);
+	}
+    }
+    if (!created)
+	WaitForSingleObject(m->h, INFINITE);
+    return 0;
+}
+
+static inline int
+heim_mutex_unlock(heim_mutex_t *m)
+{
+    if (ReleaseSemaphore(m->h, 1, NULL) == FALSE)
+        return EPERM;
+    return 0;
+}
+
+static inline int
+heim_mutex_destroy(heim_mutex_t *m)
+{
+    HANDLE h;
+
+    h = InterlockedCompareExchangePointer(&m->h, INVALID_HANDLE_VALUE, m->h);
+    if (h != INVALID_HANDLE_VALUE)
+	CloseHandle(h);
+    return 0;
+}
+
+#define HEIMDAL_MUTEX heim_mutex_t
+#define HEIMDAL_MUTEX_INITIALIZER { INVALID_HANDLE_VALUE }
+#define HEIMDAL_MUTEX_init(m) heim_mutex_init((m))
+#define HEIMDAL_MUTEX_lock(m) heim_mutex_lock((m))
+#define HEIMDAL_MUTEX_unlock(m) heim_mutex_unlock((m))
+#define HEIMDAL_MUTEX_destroy(m) heim_mutex_destroy((m))
+
+typedef struct heim_rwlock {
+    SRWLOCK lock;
+    int     exclusive;
+} heim_rwlock_t;
+
+static inline int
+heim_rwlock_init(heim_rwlock_t *l)
+{
+    InitializeSRWLock(&l->lock);
+    l->exclusive = 0;
+    return 0;
+}
+
+static inline int
+heim_rwlock_rdlock(heim_rwlock_t *l)
+{
+    AcquireSRWLockShared(&l->lock);
+    return 0;
+}
+
+static inline int
+heim_rwlock_wrlock(heim_rwlock_t *l)
+{
+    AcquireSRWLockExclusive(&l->lock);
+    l->exclusive = 1;
+    return 0;
+}
+
+static inline int
+heim_rwlock_tryrdlock(heim_rwlock_t *l)
+{
+    if (TryAcquireSRWLockShared(&l->lock))
+        return 0;
+    return EBUSY;
+}
+
+static inline int
+heim_rwlock_trywrlock(heim_rwlock_t *l)
+{
+    if (TryAcquireSRWLockExclusive(&l->lock))
+        return 0;
+    return EBUSY;
+}
+
+static inline int
+heim_rwlock_unlock(heim_rwlock_t *l)
+{
+    if (l->exclusive) {
+	l->exclusive = 0;
+	ReleaseSRWLockExclusive(&(l)->lock);
+    } else {
+	ReleaseSRWLockShared(&(l)->lock);
+    }
+    return 0;
+}
+
+static inline int
+heim_rwlock_destroy(heim_rwlock_t *l)
+{
+    /* SRW locks cannot be destroyed so re-initialize */
+    InitializeSRWLock(&l->lock);
+    l->exclusive = 0;
+    return 0;
+}
+
+#define HEIMDAL_RWLOCK heim_rwlock_t
+#define HEIMDAL_RWLOCK_INITIALIZER {SRWLOCK_INIT, 0}
+#define	HEIMDAL_RWLOCK_init(l) heim_rwlock_init((l))
+#define	HEIMDAL_RWLOCK_rdlock(l) heim_rwlock_rdlock((l))
+#define	HEIMDAL_RWLOCK_wrlock(l) heim_rwlock_wrlock((l))
+#define	HEIMDAL_RWLOCK_tryrdlock(l) heim_rwlock_tryrdlock((l))
+#define	HEIMDAL_RWLOCK_trywrlock(l) heim_rwlock_trywrlock((l))
+#define	HEIMDAL_RWLOCK_unlock(l) heim_rwlock_unlock((l))
+#define	HEIMDAL_RWLOCK_destroy(l) heim_rwlock_destroy((l))
+
+#define HEIMDAL_thread_key unsigned long
+#define HEIM_PRIV_thread_key HEIMDAL_thread_key
+#define HEIMDAL_key_create(k,d,r) do { r = heim_w32_key_create(k,d); } while(0)
+#define HEIMDAL_setspecific(k,s,r) do { r = heim_w32_setspecific(k,s); } while(0)
+#define HEIMDAL_getspecific(k) (heim_w32_getspecific(k))
+#define HEIMDAL_key_delete(k) (heim_w32_delete_key(k))
+
+#define HEIMDAL_THREAD_ID DWORD
+#define HEIMDAL_THREAD_create(t,f,a) \
+    ((CreateThread(0, 0, (f), (a), 0, (t)) == INVALID_HANDLE_VALUE) ? EINVAL : 0)
 
 #elif defined(HEIMDAL_DEBUG_THREADS)
 
@@ -134,6 +316,9 @@
 
 #define HEIMDAL_internal_thread_key 1
 
+#define HEIMDAL_THREAD_ID int
+#define HEIMDAL_THREAD_create(t,f,a) abort()
+
 #else /* no thread support, no debug case */
 
 #define HEIMDAL_MUTEX int
@@ -153,6 +338,9 @@
 #define	HEIMDAL_RWLOCK_unlock(l) do { } while(0)
 #define	HEIMDAL_RWLOCK_destroy(l) do { } while(0)
 
+#define HEIMDAL_THREAD_ID int
+#define HEIMDAL_THREAD_create(t,f,a) abort()
+
 #define HEIMDAL_internal_thread_key 1
 
 #endif /* no thread support */
@@ -174,4 +362,9 @@ typedef struct heim_thread_key {
 #undef HEIMDAL_internal_thread_key
 #endif /* HEIMDAL_internal_thread_key */
 
+int heim_w32_key_create(HEIM_PRIV_thread_key *, void (*)(void *));
+int heim_w32_delete_key(HEIM_PRIV_thread_key);
+int heim_w32_setspecific(HEIM_PRIV_thread_key, void *);
+void *heim_w32_getspecific(HEIM_PRIV_thread_key);
+
 #endif /* HEIM_THREADS_H */
diff --git a/crypto/external/bsd/heimdal/dist/include/krb5-types.cross b/crypto/external/bsd/heimdal/dist/include/krb5-types.cross
index ee43abd4a..4dc5c6aa8 100644
--- a/crypto/external/bsd/heimdal/dist/include/krb5-types.cross
+++ b/crypto/external/bsd/heimdal/dist/include/krb5-types.cross
@@ -24,7 +24,7 @@ typedef ssize_t krb5_ssize_t;
 
 #ifndef HEIMDAL_DEPRECATED
 #if __has_extension(deprecated) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
-#define HEIMDAL_DEPRECATED __attribute__((deprecated))
+#define HEIMDAL_DEPRECATED __attribute__ ((__deprecated__))
 #elif defined(_MSC_VER) && (_MSC_VER>1200) 
 #define HEIMDAL_DEPRECATED __declspec(deprecated)
 #else
@@ -34,7 +34,7 @@ typedef ssize_t krb5_ssize_t;
 
 #ifndef HEIMDAL_PRINTF_ATTRIBUTE
 #if __has_extension(format) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
-#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__((format x))
+#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__ ((__format__ x))
 #else
 #define HEIMDAL_PRINTF_ATTRIBUTE(x)
 #endif
@@ -42,7 +42,7 @@ typedef ssize_t krb5_ssize_t;
 
 #ifndef HEIMDAL_NORETURN_ATTRIBUTE
 #if __has_extension(noreturn) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
-#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__((noreturn))
+#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__ ((__noreturn__))
 #else
 #define HEIMDAL_NORETURN_ATTRIBUTE
 #endif
@@ -50,12 +50,18 @@ typedef ssize_t krb5_ssize_t;
 
 #ifndef HEIMDAL_UNUSED_ATTRIBUTE
 #if __has_extension(unused) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
-#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__((unused))
+#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__ ((__unused__))
 #else
 #define HEIMDAL_UNUSED_ATTRIBUTE
 #endif
 #endif
 
+#ifndef HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+#if __has_extension(__warn_unused_result__) || KRB5TYPES_REQUIRE_GNUC(3,3,0)
+#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE __attribute__ ((__warn_unused_result__))
+#endif
+#endif
+
 typedef int krb5_socket_t;
 
 #endif /* __krb5_types_h__ */
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/Makefile.am b/crypto/external/bsd/heimdal/dist/kadmin/Makefile.am
index 163355dfd..b2e114cd7 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/kadmin/Makefile.am
@@ -2,13 +2,13 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_readline) $(INCLUDE_hcrypto) -I$(srcdir)/../lib/krb5 -I$(top_builddir)/include/gssapi
+AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_readline) -I$(srcdir)/../lib/krb5 -I$(top_builddir)/include/gssapi
 
-sbin_PROGRAMS = kadmin
+bin_PROGRAMS = kadmin
 
 libexec_PROGRAMS = kadmind
 
-man_MANS = kadmin.8 kadmind.8
+man_MANS = kadmin.1 kadmind.8
 
 noinst_PROGRAMS = add_random_users
 
@@ -65,7 +65,7 @@ LDADD_common = \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_roken) \
-	$(DBLIB)
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 kadmind_LDADD = $(top_builddir)/lib/kadm5/libkadm5srv.la \
 	../lib/gssapi/libgssapi.la \
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/add-random-users.c b/crypto/external/bsd/heimdal/dist/kadmin/add-random-users.c
index c8481e713..ae27724aa 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/add-random-users.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/add-random-users.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add-random-users.c,v 1.1.1.1 2011/04/13 18:14:34 elric Exp $	*/
+/*	$NetBSD: add-random-users.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
@@ -79,8 +79,7 @@ read_words (const char *filename, char ***ret_w)
 }
 
 static void
-add_user (krb5_context context, void *kadm_handle,
-	  unsigned nwords, char **words)
+add_user (krb5_context ctx, void *hndl, unsigned nwords, char **words)
 {
     kadm5_principal_ent_rec princ;
     char name[64];
@@ -96,14 +95,14 @@ add_user (krb5_context context, void *kadm_handle,
     mask = KADM5_PRINCIPAL;
 
     memset(&princ, 0, sizeof(princ));
-    ret = krb5_parse_name(context, name, &princ.principal);
+    ret = krb5_parse_name(ctx, name, &princ.principal);
     if (ret)
-	krb5_err(context, 1, ret, "krb5_parse_name");
+	krb5_err(ctx, 1, ret, "krb5_parse_name");
 
-    ret = kadm5_create_principal (kadm_handle, &princ, mask, name);
+    ret = kadm5_create_principal (hndl, &princ, mask, name);
     if (ret)
-	krb5_err (context, 1, ret, "kadm5_create_principal");
-    kadm5_free_principal_ent(kadm_handle, &princ);
+	krb5_err (ctx, 1, ret, "kadm5_create_principal");
+    kadm5_free_principal_ent(hndl, &princ);
     printf ("%s\n", name);
 }
 
@@ -112,37 +111,38 @@ add_users (const char *filename, unsigned n)
 {
     krb5_error_code ret;
     int i;
-    void *kadm_handle;
-    krb5_context context;
+    void *hndl;
+    krb5_context ctx;
     unsigned nwords;
     char **words;
 
-    ret = krb5_init_context(&context);
+    ret = krb5_init_context(&ctx);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
-    ret = kadm5_s_init_with_password_ctx(context,
+    ret = kadm5_s_init_with_password_ctx(ctx,
 					 KADM5_ADMIN_SERVICE,
 					 NULL,
 					 KADM5_ADMIN_SERVICE,
 					 NULL, 0, 0,
-					 &kadm_handle);
+					 &hndl);
     if(ret)
-	krb5_err(context, 1, ret, "kadm5_init_with_password");
+	krb5_err(ctx, 1, ret, "kadm5_init_with_password");
 
     nwords = read_words (filename, &words);
 
     for (i = 0; i < n; ++i)
-	add_user (context, kadm_handle, nwords, words);
-    kadm5_destroy(kadm_handle);
-    krb5_free_context(context);
+	add_user (ctx, hndl, nwords, words);
+    kadm5_destroy(hndl);
+    krb5_free_context(ctx);
+    free(words);
 }
 
 static int version_flag	= 0;
 static int help_flag	= 0;
 
 static struct getargs args[] = {
-    { "version", 	0,   arg_flag, &version_flag },
-    { "help",		0,   arg_flag, &help_flag }
+    { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
+    { "help",		0,   arg_flag, &help_flag,    NULL, NULL }
 };
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/add_enctype.c b/crypto/external/bsd/heimdal/dist/kadmin/add_enctype.c
index 477fed85a..8aeef6c40 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/add_enctype.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/add_enctype.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add_enctype.c,v 1.1.1.1 2011/04/13 18:14:34 elric Exp $	*/
+/*	$NetBSD: add_enctype.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1999-2006 Kungliga Tekniska Högskolan
@@ -57,7 +57,7 @@ add_enctype(struct add_enctype_options*opt, int argc, char **argv)
 	return 0;
     }
 
-    memset (&princ, 0, sizeof(princ));
+    memset(&princ, 0, sizeof(princ));
     princ_name = argv[0];
     n_etypes   = argc - 1;
     etypes     = malloc (n_etypes * sizeof(*etypes));
@@ -67,7 +67,7 @@ add_enctype(struct add_enctype_options*opt, int argc, char **argv)
     }
     argv++;
     for (i = 0; i < n_etypes; ++i) {
-	ret = krb5_string_to_enctype (context, argv[i], &etypes[i]);
+	ret = krb5_string_to_enctype(context, argv[i], &etypes[i]);
 	if (ret) {
 	    krb5_warnx (context, "bad enctype \"%s\"", argv[i]);
 	    goto out2;
@@ -76,20 +76,27 @@ add_enctype(struct add_enctype_options*opt, int argc, char **argv)
 
     ret = krb5_parse_name(context, princ_name, &princ_ent);
     if (ret) {
-	krb5_warn (context, ret, "krb5_parse_name %s", princ_name);
+	krb5_warn(context, ret, "krb5_parse_name %s", princ_name);
 	goto out2;
     }
 
+    /* The principal might have zero keys, but it will still have a kvno! */
     ret = kadm5_get_principal(kadm_handle, princ_ent, &princ,
-			      KADM5_PRINCIPAL | KADM5_KEY_DATA);
+			      KADM5_KVNO | KADM5_PRINCIPAL | KADM5_KEY_DATA);
     if (ret) {
-	krb5_free_principal (context, princ_ent);
-	krb5_warnx (context, "no such principal: %s", princ_name);
+	krb5_free_principal(context, princ_ent);
+	krb5_warnx(context, "no such principal: %s", princ_name);
 	goto out2;
     }
 
-    new_key_data   = malloc((princ.n_key_data + n_etypes)
-			    * sizeof(*new_key_data));
+    /* Check that we got key data */
+    if (kadm5_all_keys_are_bogus(princ.n_key_data, princ.key_data)) {
+	krb5_warnx(context, "user lacks get-keys privilege");
+	goto out;
+    }
+
+    new_key_data = calloc(princ.n_key_data + n_etypes,
+			  sizeof(*new_key_data));
     if (new_key_data == NULL) {
 	krb5_warnx (context, "out of memory");
 	goto out;
@@ -100,6 +107,7 @@ add_enctype(struct add_enctype_options*opt, int argc, char **argv)
 
 	for (j = 0; j < n_etypes; ++j) {
 	    if (etypes[j] == key->key_data_type[0]) {
+		/* XXX Should this be an error?  The admin can del_enctype... */
 		krb5_warnx(context, "enctype %d already exists",
 			   (int)etypes[j]);
 		free(new_key_data);
@@ -115,7 +123,7 @@ add_enctype(struct add_enctype_options*opt, int argc, char **argv)
 
 	memset(&new_key_data[n], 0, sizeof(new_key_data[n]));
 	new_key_data[n].key_data_ver = 2;
-	new_key_data[n].key_data_kvno = 0;
+	new_key_data[n].key_data_kvno = princ.kvno;
 
 	ret = krb5_generate_random_keyblock (context, etypes[i], &keyblock);
 	if (ret) {
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/ank.c b/crypto/external/bsd/heimdal/dist/kadmin/ank.c
index e644dac9b..189a4055a 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/ank.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/ank.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ank.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: ank.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
@@ -70,6 +70,7 @@ add_one_principal (const char *name,
 		   int rand_password,
 		   int use_defaults,
 		   char *password,
+		   char *policy,
 		   krb5_key_data *key_data,
 		   const char *max_ticket_life,
 		   const char *max_renewable_life,
@@ -96,7 +97,7 @@ add_one_principal (const char *name,
 
     ret = set_entry(context, &princ, &mask,
 		    max_ticket_life, max_renewable_life,
-		    expiration, pw_expiration, attributes);
+		    expiration, pw_expiration, attributes, policy);
     if (ret)
 	goto out;
 
@@ -126,10 +127,18 @@ add_one_principal (const char *name,
     } else if(password == NULL) {
 	char *princ_name;
 	char *prompt;
+	int aret;
 
-	krb5_unparse_name(context, princ_ent, &princ_name);
-	asprintf (&prompt, "%s's Password: ", princ_name);
+	ret = krb5_unparse_name(context, princ_ent, &princ_name);
+	if (ret)
+	    goto out;
+	aret = asprintf (&prompt, "%s's Password: ", princ_name);
 	free (princ_name);
+	if (aret == -1) {
+	    ret = ENOMEM;
+	    krb5_set_error_message(context, ret, "out of memory");
+	    goto out;
+	}
 	ret = UI_UTIL_read_pw_string (pwbuf, sizeof(pwbuf), prompt, 1);
 	free (prompt);
 	if (ret) {
@@ -160,11 +169,18 @@ add_one_principal (const char *name,
 	    free(new_keys);
 	kadm5_get_principal(kadm_handle, princ_ent, &princ,
 			    KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES);
+        krb5_free_principal(context, princ_ent);
+        princ_ent = princ.principal;
 	princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX);
+	/*
+	 * Updating kvno w/o key data and vice-versa gives _kadm5_setup_entry()
+	 * and _kadm5_set_keys2() headaches.  But we used to, so we handle
+	 * this in in those two functions.  Might as well leave this code as
+	 * it was then.
+	 */
 	princ.kvno = 1;
 	kadm5_modify_principal(kadm_handle, &princ,
 			       KADM5_ATTRIBUTES | KADM5_KVNO);
-	kadm5_free_principal_ent(kadm_handle, &princ);
     } else if (key_data) {
 	ret = kadm5_chpass_principal_with_key (kadm_handle, princ_ent,
 					       3, key_data);
@@ -173,9 +189,10 @@ add_one_principal (const char *name,
 	}
 	kadm5_get_principal(kadm_handle, princ_ent, &princ,
 			    KADM5_PRINCIPAL | KADM5_ATTRIBUTES);
+        krb5_free_principal(context, princ_ent);
+        princ_ent = princ.principal;
 	princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX);
 	kadm5_modify_principal(kadm_handle, &princ, KADM5_ATTRIBUTES);
-	kadm5_free_principal_ent(kadm_handle, &princ);
     } else if (rand_password) {
 	char *princ_name;
 
@@ -184,8 +201,7 @@ add_one_principal (const char *name,
 	free (princ_name);
     }
 out:
-    if (princ_ent)
-	krb5_free_principal (context, princ_ent);
+    kadm5_free_principal_ent(kadm_handle, &princ); /* frees princ_ent */
     if(default_ent)
 	kadm5_free_principal_ent (kadm_handle, default_ent);
     if (password != NULL)
@@ -247,6 +263,7 @@ add_new_key(struct add_options *opt, int argc, char **argv)
 				 opt->random_password_flag,
 				 opt->use_defaults_flag,
 				 opt->password_string,
+				 opt->policy_string,
 				 kdp,
 				 opt->max_ticket_life_string,
 				 opt->max_renewable_life_string,
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/check.c b/crypto/external/bsd/heimdal/dist/kadmin/check.c
index 69d306d42..0667cdfb7 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/check.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/check.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: check.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -53,7 +53,7 @@ get_check_entry(const char *name, kadm5_principal_ent_rec *ent)
     }
 
     memset(ent, 0, sizeof(*ent));
-    ret = kadm5_get_principal(kadm_handle, principal, ent, 0);
+    ret = kadm5_get_principal(kadm_handle, principal, ent, KADM5_ATTRIBUTES);
     krb5_free_principal(context, principal);
     if(ret)
 	return 1;
@@ -186,6 +186,35 @@ check(void *opt, int argc, char **argv)
 
     kadm5_free_principal_ent(kadm_handle, &ent);
 
+    /*
+     * Check default@REALM
+     *
+     * Check that disallow-all-tix is set on the default principal
+     * (or that the entry doesn't exists)
+     */
+
+    if (asprintf(&p, "default@%s", realm) == -1) {
+	krb5_warn(context, errno, "asprintf");
+	goto fail;
+    }
+
+    ret = get_check_entry(p, &ent);
+    if (ret == 0) {
+	if ((ent.attributes & KRB5_KDB_DISALLOW_ALL_TIX) == 0) {
+	    printf("default template entry is not disabled\n");
+	    ret = EINVAL;
+	}
+	kadm5_free_principal_ent(kadm_handle, &ent);
+
+    } else {
+	ret = 0;
+    }
+
+    free(p);
+
+    if (ret)
+	goto fail;
+
     /*
      * Check for duplicate afs keys
      */
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/cpw.c b/crypto/external/bsd/heimdal/dist/kadmin/cpw.c
index 8d5451626..d452b6fa7 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/cpw.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/cpw.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cpw.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: cpw.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -37,6 +37,7 @@
 #include "kadmin-commands.h"
 
 struct cpw_entry_data {
+    int keepold;
     int random_key;
     int random_password;
     char *password;
@@ -44,14 +45,15 @@ struct cpw_entry_data {
 };
 
 static int
-set_random_key (krb5_principal principal)
+set_random_key (krb5_principal principal, int keepold)
 {
     krb5_error_code ret;
     int i;
     krb5_keyblock *keys;
     int num_keys;
 
-    ret = kadm5_randkey_principal(kadm_handle, principal, &keys, &num_keys);
+    ret = kadm5_randkey_principal_3(kadm_handle, principal, keepold, 0, NULL,
+				    &keys, &num_keys);
     if(ret)
 	return ret;
     for(i = 0; i < num_keys; i++)
@@ -61,13 +63,13 @@ set_random_key (krb5_principal principal)
 }
 
 static int
-set_random_password (krb5_principal principal)
+set_random_password (krb5_principal principal, int keepold)
 {
     krb5_error_code ret;
     char pw[128];
 
     random_password (pw, sizeof(pw));
-    ret = kadm5_chpass_principal(kadm_handle, principal, pw);
+    ret = kadm5_chpass_principal_3(kadm_handle, principal, keepold, 0, NULL, pw);
     if (ret == 0) {
 	char *princ_name;
 
@@ -81,18 +83,23 @@ set_random_password (krb5_principal principal)
 }
 
 static int
-set_password (krb5_principal principal, char *password)
+set_password (krb5_principal principal, char *password, int keepold)
 {
     krb5_error_code ret = 0;
     char pwbuf[128];
+    int aret;
 
     if(password == NULL) {
 	char *princ_name;
 	char *prompt;
 
-	krb5_unparse_name(context, principal, &princ_name);
-	asprintf(&prompt, "%s's Password: ", princ_name);
+	ret = krb5_unparse_name(context, principal, &princ_name);
+	if (ret)
+	    return ret;
+	aret = asprintf(&prompt, "%s's Password: ", princ_name);
 	free (princ_name);
+	if (aret == -1)
+	    return ENOMEM;
 	ret = UI_UTIL_read_pw_string(pwbuf, sizeof(pwbuf), prompt, 1);
 	free (prompt);
 	if(ret){
@@ -101,18 +108,19 @@ set_password (krb5_principal principal, char *password)
 	password = pwbuf;
     }
     if(ret == 0)
-	ret = kadm5_chpass_principal(kadm_handle, principal, password);
+	ret = kadm5_chpass_principal_3(kadm_handle, principal, keepold, 0, NULL,
+				       password);
     memset(pwbuf, 0, sizeof(pwbuf));
     return ret;
 }
 
 static int
-set_key_data (krb5_principal principal, krb5_key_data *key_data)
+set_key_data (krb5_principal principal, krb5_key_data *key_data, int keepold)
 {
     krb5_error_code ret;
 
-    ret = kadm5_chpass_principal_with_key (kadm_handle, principal,
-					   3, key_data);
+    ret = kadm5_chpass_principal_with_key_3(kadm_handle, principal, keepold,
+					    3, key_data);
     return ret;
 }
 
@@ -122,13 +130,13 @@ do_cpw_entry(krb5_principal principal, void *data)
     struct cpw_entry_data *e = data;
 
     if (e->random_key)
-	return set_random_key (principal);
+	return set_random_key (principal, e->keepold);
     else if (e->random_password)
-	return set_random_password (principal);
+	return set_random_password (principal, e->keepold);
     else if (e->key_data)
-	return set_key_data (principal, e->key_data);
+	return set_key_data (principal, e->key_data, e->keepold);
     else
-	return set_password (principal, e->password);
+	return set_password (principal, e->password, e->keepold);
 }
 
 int
@@ -140,6 +148,7 @@ cpw_entry(struct passwd_options *opt, int argc, char **argv)
     int num;
     krb5_key_data key_data[3];
 
+    data.keepold = opt->keepold_flag;
     data.random_key = opt->random_key_flag;
     data.random_password = opt->random_password_flag;
     data.password = opt->password_string;
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/del.c b/crypto/external/bsd/heimdal/dist/kadmin/del.c
index 208f26ed7..69a624dcb 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/del.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/del.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: del.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: del.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/del_enctype.c b/crypto/external/bsd/heimdal/dist/kadmin/del_enctype.c
index c72e3f22e..d2b4b8975 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/del_enctype.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/del_enctype.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: del_enctype.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: del_enctype.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1999-2006 Kungliga Tekniska Högskolan
@@ -51,6 +51,7 @@ del_enctype(void *opt, int argc, char **argv)
     krb5_key_data *new_key_data;
     int n_etypes;
     krb5_enctype *etypes;
+    krb5_key_data *key;
 
     memset (&princ, 0, sizeof(princ));
     princ_name = argv[0];
@@ -83,6 +84,11 @@ del_enctype(void *opt, int argc, char **argv)
 	goto out2;
     }
 
+    if (kadm5_all_keys_are_bogus(princ.n_key_data, princ.key_data)) {
+	krb5_warnx(context, "user lacks get-keys privilege");
+	goto out;
+    }
+
     new_key_data   = malloc(princ.n_key_data * sizeof(*new_key_data));
     if (new_key_data == NULL && princ.n_key_data != 0) {
 	krb5_warnx (context, "out of memory");
@@ -90,14 +96,15 @@ del_enctype(void *opt, int argc, char **argv)
     }
 
     for (i = 0, j = 0; i < princ.n_key_data; ++i) {
-	krb5_key_data *key = &princ.key_data[i];
 	int docopy = 1;
+	key = &princ.key_data[i];
 
-	for (k = 0; k < n_etypes; ++k)
+	for (k = 0; k < n_etypes; ++k) {
 	    if (etypes[k] == key->key_data_type[0]) {
 		docopy = 0;
 		break;
 	    }
+	}
 	if (docopy) {
 	    new_key_data[j++] = *key;
 	} else {
@@ -108,6 +115,10 @@ del_enctype(void *opt, int argc, char **argv)
     }
 
     free (princ.key_data);
+    if (j == 0) {
+	free(new_key_data);
+	new_key_data = NULL;
+    }
     princ.n_key_data = j;
     princ.key_data   = new_key_data;
 
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/dump.c b/crypto/external/bsd/heimdal/dist/kadmin/dump.c
index 02c436baa..e32908d14 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/dump.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/dump.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dump.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: dump.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -44,32 +44,42 @@ dump(struct dump_options *opt, int argc, char **argv)
 {
     krb5_error_code ret;
     FILE *f;
+    struct hdb_print_entry_arg parg;
     HDB *db = NULL;
 
-    if(!local_flag) {
+    if (!local_flag) {
 	krb5_warnx(context, "dump is only available in local (-l) mode");
 	return 0;
     }
 
     db = _kadm5_s_get_db(kadm_handle);
 
-    if(argc == 0)
+    if (argc == 0)
 	f = stdout;
     else
 	f = fopen(argv[0], "w");
 
-    if(f == NULL) {
+    if (f == NULL) {
 	krb5_warn(context, errno, "open: %s", argv[0]);
 	goto out;
     }
     ret = db->hdb_open(context, db, O_RDONLY, 0600);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "hdb_open");
 	goto out;
     }
 
+    if (!opt->format_string || strcmp(opt->format_string, "Heimdal") == 0) {
+        parg.fmt = HDB_DUMP_HEIMDAL;
+    } else if (opt->format_string && strcmp(opt->format_string, "MIT") == 0) {
+        parg.fmt = HDB_DUMP_MIT;
+        fprintf(f, "kdb5_util load_dump version 5\n"); /* 5||6, either way */
+    } else {
+        krb5_errx(context, 1, "Supported dump formats: Heimdal and MIT");
+    }
+    parg.out = f;
     hdb_foreach(context, db, opt->decrypt_flag ? HDB_F_DECRYPT : 0,
-		hdb_print_entry, f);
+		hdb_print_entry, &parg);
 
     db->hdb_close(context, db);
 out:
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/ext.c b/crypto/external/bsd/heimdal/dist/kadmin/ext.c
index d0f38ecd6..7b0a52792 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/ext.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/ext.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ext.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: ext.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -38,6 +38,7 @@
 
 struct ext_keytab_data {
     krb5_keytab keytab;
+    int random_key_flag;
 };
 
 static int
@@ -48,43 +49,76 @@ do_ext_keytab(krb5_principal principal, void *data)
     struct ext_keytab_data *e = data;
     krb5_keytab_entry *keys = NULL;
     krb5_keyblock *k = NULL;
-    int i, n_k;
+    size_t i;
+    int n_k = 0;
+    uint32_t mask;
+    char *unparsed = NULL;
 
-    ret = kadm5_get_principal(kadm_handle, principal, &princ,
-			      KADM5_PRINCIPAL|KADM5_KVNO|KADM5_KEY_DATA);
-    if(ret)
+    mask = KADM5_PRINCIPAL;
+    if (!e->random_key_flag)
+        mask |= KADM5_KVNO | KADM5_KEY_DATA;
+
+    ret = kadm5_get_principal(kadm_handle, principal, &princ, mask);
+    if (ret)
 	return ret;
 
-    if (princ.n_key_data) {
-	keys = malloc(sizeof(*keys) * princ.n_key_data);
+    ret = krb5_unparse_name(context, principal, &unparsed);
+    if (ret)
+	goto out;
+
+    if (!e->random_key_flag) {
+        if (princ.n_key_data == 0) {
+            krb5_warnx(context, "principal has no keys, or user lacks "
+                       "get-keys privilege for %s", unparsed);
+            goto out;
+        }
+        /*
+         * kadmin clients and servers from master between 1.5 and 1.6
+         * can have corrupted a principal's keys in the HDB.  If some
+         * are bogus but not all are, then that must have happened.
+         *
+         * If all keys are bogus then the server may be a pre-1.6,
+         * post-1.5 server and the client lacks get-keys privilege, or
+         * the keys are corrupted.  We can't tell here.
+         */
+        if (kadm5_all_keys_are_bogus(princ.n_key_data, princ.key_data)) {
+            krb5_warnx(context, "user lacks get-keys privilege for %s",
+                       unparsed);
+            goto out;
+        }
+        if (kadm5_some_keys_are_bogus(princ.n_key_data, princ.key_data)) {
+            krb5_warnx(context, "some keys for %s are corrupted in the HDB",
+                       unparsed);
+        }
+	keys = calloc(sizeof(*keys), princ.n_key_data);
 	if (keys == NULL) {
-	    kadm5_free_principal_ent(kadm_handle, &princ);
-	    krb5_clear_error_message(context);
-	    return ENOMEM;
+	    ret = krb5_enomem(context);
+	    goto out;
 	}
 	for (i = 0; i < princ.n_key_data; i++) {
 	    krb5_key_data *kd = &princ.key_data[i];
 
+            /* Don't extract bogus keys */
+            if (kadm5_all_keys_are_bogus(1, kd))
+                continue;
+
 	    keys[i].principal = princ.principal;
 	    keys[i].vno = kd->key_data_kvno;
 	    keys[i].keyblock.keytype = kd->key_data_type[0];
 	    keys[i].keyblock.keyvalue.length = kd->key_data_length[0];
 	    keys[i].keyblock.keyvalue.data = kd->key_data_contents[0];
 	    keys[i].timestamp = time(NULL);
+            n_k++;
 	}
-
-	n_k = princ.n_key_data;
-    } else {
+    } else if (e->random_key_flag) {
 	ret = kadm5_randkey_principal(kadm_handle, principal, &k, &n_k);
-	if (ret) {
-	    kadm5_free_principal_ent(kadm_handle, &princ);
-	    return ret;
-	}
-	keys = malloc(sizeof(*keys) * n_k);
+	if (ret)
+	    goto out;
+
+	keys = calloc(sizeof(*keys), n_k);
 	if (keys == NULL) {
-	    kadm5_free_principal_ent(kadm_handle, &princ);
-	    krb5_clear_error_message(context);
-	    return ENOMEM;
+	    ret = krb5_enomem(context);
+	    goto out;
 	}
 	for (i = 0; i < n_k; i++) {
 	    keys[i].principal = principal;
@@ -94,19 +128,24 @@ do_ext_keytab(krb5_principal principal, void *data)
 	}
     }
 
-    for(i = 0; i < n_k; i++) {
+    if (n_k == 0)
+        krb5_warn(context, ret, "no keys written to keytab for %s", unparsed);
+
+    for (i = 0; i < n_k; i++) {
 	ret = krb5_kt_add_entry(context, e->keytab, &keys[i]);
-	if(ret)
-	    krb5_warn(context, ret, "krb5_kt_add_entry(%d)", i);
+	if (ret)
+	    krb5_warn(context, ret, "krb5_kt_add_entry(%lu)", (unsigned long)i);
     }
 
+  out:
+    kadm5_free_principal_ent(kadm_handle, &princ);
     if (k) {
-	memset(k, 0, n_k * sizeof(*k));
+        for (i = 0; i < n_k; i++)
+            memset(k[i].keyvalue.data, 0, k[i].keyvalue.length);
 	free(k);
     }
-    if (keys)
-	free(keys);
-    kadm5_free_principal_ent(kadm_handle, &princ);
+    free(unparsed);
+    free(keys);
     return 0;
 }
 
@@ -127,6 +166,8 @@ ext_keytab(struct ext_keytab_options *opt, int argc, char **argv)
 	return 1;
     }
 
+    data.random_key_flag = opt->random_key_flag;
+
     for(i = 0; i < argc; i++) {
 	ret = foreach_principal(argv[i], do_ext_keytab, "ext", &data);
 	if (ret)
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/get.c b/crypto/external/bsd/heimdal/dist/kadmin/get.c
index 9328352ec..f2b781b05 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/get.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/get.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get.c,v 1.3 2014/04/24 13:45:33 pettai Exp $	*/
+/*	$NetBSD: get.c,v 1.4 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
@@ -62,11 +62,13 @@ static struct field_name {
     { "last_failed", KADM5_LAST_FAILED, 0, 0, "Last fail", "Last failed login", 0 },
     { "fail_auth_count", KADM5_FAIL_AUTH_COUNT, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT },
     { "policy", KADM5_POLICY, 0, 0, "Policy", "Policy", 0 },
-    { "keytypes", KADM5_KEY_DATA, 0, KADM5_PRINCIPAL, "Keytypes", "Keytypes", 0 },
+    { "keytypes", KADM5_KEY_DATA, 0, KADM5_PRINCIPAL | KADM5_KVNO, "Keytypes", "Keytypes", 0 },
     { "password", KADM5_TL_DATA, KRB5_TL_PASSWORD, KADM5_KEY_DATA, "Password", "Password", 0 },
     { "pkinit-acl", KADM5_TL_DATA, KRB5_TL_PKINIT_ACL, 0, "PK-INIT ACL", "PK-INIT ACL", 0 },
     { "aliases", KADM5_TL_DATA, KRB5_TL_ALIASES, 0, "Aliases", "Aliases", 0 },
-    { .fieldname = NULL }
+    { "hist-kvno-diff-clnt", KADM5_TL_DATA, KRB5_TL_HIST_KVNO_DIFF_CLNT, 0, "Clnt hist keys", "Historic keys allowed for client", 0 },
+    { "hist-kvno-diff-svc", KADM5_TL_DATA, KRB5_TL_HIST_KVNO_DIFF_SVC, 0, "Svc hist keys", "Historic keys allowed for service", 0 },
+    { NULL, 0, 0, 0, NULL, NULL, 0 }
 };
 
 struct field_info {
@@ -125,12 +127,17 @@ format_keytype(krb5_key_data *k, krb5_salt *def_salt, char *buf, size_t buf_len)
 {
     krb5_error_code ret;
     char *s;
+    int aret;
 
+    buf[0] = '\0';
     ret = krb5_enctype_to_string (context,
 				  k->key_data_type[0],
 				  &s);
-    if (ret)
-	asprintf (&s, "unknown(%d)", k->key_data_type[0]);
+    if (ret) {
+	aret = asprintf (&s, "unknown(%d)", k->key_data_type[0]);
+	if (aret == -1)
+	    return;	/* Nothing to do here, we have no way to pass the err */
+    }
     strlcpy(buf, s, buf_len);
     free(s);
 
@@ -140,22 +147,33 @@ format_keytype(krb5_key_data *k, krb5_salt *def_salt, char *buf, size_t buf_len)
 				   k->key_data_type[0],
 				   k->key_data_type[1],
 				   &s);
-    if (ret)
-	asprintf (&s, "unknown(%d)", k->key_data_type[1]);
+    if (ret) {
+	aret = asprintf (&s, "unknown(%d)", k->key_data_type[1]);
+	if (aret == -1)
+	    return;	/* Again, nothing else to do... */
+    }
     strlcat(buf, s, buf_len);
     free(s);
 
+    aret = 0;
     if (cmp_salt(def_salt, k) == 0)
 	s = strdup("");
     else if(k->key_data_length[1] == 0)
 	s = strdup("()");
     else
-	asprintf (&s, "(%.*s)", k->key_data_length[1],
-		  (char *)k->key_data_contents[1]);
+	aret = asprintf (&s, "(%.*s)", k->key_data_length[1],
+			 (char *)k->key_data_contents[1]);
+    if (aret == -1 || s == NULL)
+	return;		/* Again, nothing else we can do... */
     strlcat(buf, s, buf_len);
     free(s);
-
+    aret = asprintf (&s, "[%d]", k->key_data_kvno);
+    if (aret == -1)
+	return;
     strlcat(buf, ")", buf_len);
+
+    strlcat(buf, s, buf_len);
+    free(s);
 }
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/init.c b/crypto/external/bsd/heimdal/dist/kadmin/init.c
index 668f75f2f..65ffcf24e 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/init.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/init.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: init.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -39,11 +39,14 @@
 #include "kadmin-commands.h"
 #include <kadm5/private.h>
 
+#define CRE_DUP_OK	1
+
 static kadm5_ret_t
 create_random_entry(krb5_principal princ,
 		    unsigned max_life,
 		    unsigned max_rlife,
-		    uint32_t attributes)
+		    uint32_t attributes,
+		    unsigned flags)
 {
     kadm5_principal_ent_rec ent;
     kadm5_ret_t ret;
@@ -80,6 +83,8 @@ create_random_entry(krb5_principal princ,
     /* Create the entry with a random password */
     ret = kadm5_create_principal(kadm_handle, &ent, mask, password);
     if(ret) {
+	if (ret == KADM5_DUP && (flags & CRE_DUP_OK))
+	    goto out;
 	krb5_warn(context, ret, "create_random_entry(%s): randkey failed",
 		  name);
 	goto out;
@@ -154,6 +159,10 @@ init(struct init_options *opt, int argc, char **argv)
 	krb5_warn(context, ret, "hdb_open");
 	return 0;
     }
+    ret = kadm5_log_reinit(kadm_handle, 0);
+    if (ret)
+        krb5_err(context, 1, ret, "Failed iprop log initialization");
+    kadm5_log_end(kadm_handle);
     db->hdb_close(context, db);
     for(i = 0; i < argc; i++){
 	krb5_principal princ;
@@ -179,7 +188,7 @@ init(struct init_options *opt, int argc, char **argv)
 	if(ret)
 	    return 0;
 
-	create_random_entry(princ, max_life, max_rlife, 0);
+	create_random_entry(princ, max_life, max_rlife, 0, 0);
 	krb5_free_principal(context, princ);
 
 	if (opt->bare_flag)
@@ -200,13 +209,14 @@ init(struct init_options *opt, int argc, char **argv)
 			    KRB5_KDB_DISALLOW_POSTDATED|
 			    KRB5_KDB_DISALLOW_RENEWABLE|
 			    KRB5_KDB_DISALLOW_PROXIABLE|
-			    KRB5_KDB_REQUIRES_PRE_AUTH);
+			    KRB5_KDB_REQUIRES_PRE_AUTH,
+			    0);
 	krb5_free_principal(context, princ);
 
 	/* Create `kadmin/admin' */
 	krb5_make_principal(context, &princ, realm,
 			    "kadmin", "admin", NULL);
-	create_random_entry(princ, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH);
+	create_random_entry(princ, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH, 0);
 	krb5_free_principal(context, princ);
 
 	/* Create `changepw/kerberos' (for v4 compat) */
@@ -214,7 +224,7 @@ init(struct init_options *opt, int argc, char **argv)
 			    "changepw", "kerberos", NULL);
 	create_random_entry(princ, 60*60, 60*60,
 			    KRB5_KDB_DISALLOW_TGT_BASED|
-			    KRB5_KDB_PWCHANGE_SERVICE);
+			    KRB5_KDB_PWCHANGE_SERVICE, 0);
 
 	krb5_free_principal(context, princ);
 
@@ -223,17 +233,26 @@ init(struct init_options *opt, int argc, char **argv)
 			    "kadmin", "hprop", NULL);
 	create_random_entry(princ, 60*60, 60*60,
 			    KRB5_KDB_REQUIRES_PRE_AUTH|
-			    KRB5_KDB_DISALLOW_TGT_BASED);
+			    KRB5_KDB_DISALLOW_TGT_BASED, 0);
 	krb5_free_principal(context, princ);
 
 	/* Create `WELLKNOWN/ANONYMOUS' for anonymous as-req */
 	krb5_make_principal(context, &princ, realm,
 			    KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME, NULL);
 	create_random_entry(princ, 60*60, 60*60,
-			    KRB5_KDB_REQUIRES_PRE_AUTH);
+			    KRB5_KDB_REQUIRES_PRE_AUTH, 0);
 	krb5_free_principal(context, princ);
 
 
+	/* Create `WELLKNONW/org.h5l.fast-cookie@WELLKNOWN:ORG.H5L' for FAST cookie */
+	krb5_make_principal(context, &princ, KRB5_WELLKNOWN_ORG_H5L_REALM,
+			    KRB5_WELLKNOWN_NAME, "org.h5l.fast-cookie", NULL);
+	create_random_entry(princ, 60*60, 60*60,
+			    KRB5_KDB_REQUIRES_PRE_AUTH|
+			    KRB5_KDB_DISALLOW_TGT_BASED|
+			    KRB5_KDB_DISALLOW_ALL_TIX, CRE_DUP_OK);
+	krb5_free_principal(context, princ);
+
 	/* Create `default' */
 	{
 	    kadm5_principal_ent_rec ent;
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadm_conn.c b/crypto/external/bsd/heimdal/dist/kadmin/kadm_conn.c
index 9f048739f..318fb192e 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadm_conn.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadm_conn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadm_conn.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kadm_conn.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
@@ -38,6 +38,8 @@
 #include <sys/wait.h>
 #endif
 
+extern int daemon_child;
+
 struct kadm_port {
     char *port;
     unsigned short def_port;
@@ -191,7 +193,8 @@ wait_for_connection(krb5_context contextp,
 
     pgrp = getpid();
 
-    if(setpgid(0, pgrp) < 0)
+    /* systemd may cause setpgid to fail with EPERM */
+    if(setpgid(0, pgrp) < 0 && errno != EPERM)
 	err(1, "setpgid");
 
     signal(SIGTERM, terminate);
@@ -263,6 +266,7 @@ start_server(krb5_context contextp, const char *port_str)
 	if(tmp == NULL) {
 	    krb5_warnx(contextp, "failed to reallocate %lu bytes",
 		       (unsigned long)(num_socks + i) * sizeof(*socks));
+            freeaddrinfo(ai);
 	    continue;
 	}
 	socks = tmp;
@@ -293,5 +297,8 @@ start_server(krb5_context contextp, const char *port_str)
     if(num_socks == 0)
 	krb5_errx(contextp, 1, "no sockets to listen to - exiting");
 
+    roken_detach_finish(NULL, daemon_child);
+
     wait_for_connection(contextp, socks, num_socks);
+    free(socks);
 }
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmin-commands.in b/crypto/external/bsd/heimdal/dist/kadmin/kadmin-commands.in
index b3abdd871..b4674a59f 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmin-commands.in
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmin-commands.in
@@ -76,6 +76,12 @@ command = {
 		type = "flag"
 		help = "decrypt keys"
 	}
+	option = {
+		long = "format"
+		short = "f"
+		type = "string"
+		help = "dump format, mit or heimdal (default: heimdal)"
+	}
 	argument = "[dump-file]"
 	min_args = "0"
 	max_args = "1"
@@ -174,11 +180,31 @@ command = {
 		argument = "time"
 		help = "password expiration time"
 	}
+	option = {
+		long = "hist-kvno-diff-clnt"
+		type = "integer"
+		argument = "kvno diff"
+		help = "historic keys allowed for client"
+		default = "-1"
+	}
+	option = {
+		long = "hist-kvno-diff-svc"
+		type = "integer"
+		argument = "kvno diff"
+		help = "historic keys allowed for service"
+		default = "-1"
+	}
 	option = {
 		long = "use-defaults"
 		type = "flag"
 		help = "use default values"
 	}
+	option = {
+		long = "policy"
+		type = "string"
+		argument = "policy"
+		help = "policy name"
+	}
 	argument = "principal..."
 	min_args = "1"
 	help = "Adds a principal to the database."
@@ -210,6 +236,11 @@ command = {
 		type = "string"
 		help = "DES key in hex"
 	}
+	option = {
+		long = "keepold"
+		type = "flag"
+		help = "keep old keys/password"
+	}
 	argument = "principal..."
 	min_args = "1"
 	help = "Changes the password of one or more principals matching the expressions."
@@ -249,6 +280,12 @@ command = {
 		type = "string"
 		help = "keytab to use"
 	}
+	option = {
+		long = "random-key"
+		short = "r"
+		type = "flag"
+		help = "set random key"
+	}
 	argument = "principal..."
 	min_args = "1"
 	help = "Extracts the keys of all principals matching the expressions, and stores them in a keytab." 
@@ -353,6 +390,26 @@ command = {
 		argument = "subject dn"
 		help = "aliases"
 	}
+	option = {
+		long = "policy"
+		type = "string"
+		argument = "policy"
+		help = "policy name"
+	}
+	option = {
+		long = "hist-kvno-diff-clnt"
+		type = "integer"
+		argument = "kvno diff"
+		help = "historic keys allowed for client"
+		default = "-1"
+	}
+	option = {
+		long = "hist-kvno-diff-svc"
+		type = "integer"
+		argument = "kvno diff"
+		help = "historic keys allowed for service"
+		default = "-1"
+	}
 	argument = "principal"
 	min_args = "1"
 	max_args = "1"
@@ -414,6 +471,22 @@ command = {
 	max_args = "1"
 	help = "Check the realm (if not given, the default realm) for configuration errors."
 }
+command = {
+	name = "lock"
+	function = "lock"
+	argument = ""
+	min_args = "0"
+	max_args = "0"
+	help = "Lock the database for writing (use with care)."
+}
+command = {
+	name = "unlock"
+	function = "unlock"
+	argument = ""
+	min_args = "0"
+	max_args = "0"
+	help = "Unlock the database."
+}
 command = {
 	name = "help"
 	name = "?"
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmin.8 b/crypto/external/bsd/heimdal/dist/kadmin/kadmin.1
similarity index 92%
rename from crypto/external/bsd/heimdal/dist/kadmin/kadmin.8
rename to crypto/external/bsd/heimdal/dist/kadmin/kadmin.1
index 3995a5e6b..7f3f78368 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmin.8
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmin.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kadmin.8,v 1.4 2015/04/28 09:48:30 prlw1 Exp $
+.\"	$NetBSD: kadmin.1,v 1.2 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -34,7 +34,7 @@
 .\" Id
 .\"
 .Dd Feb  22, 2007
-.Dt KADMIN 8
+.Dt KADMIN 1
 .Os
 .Sh NAME
 .Nm kadmin
@@ -112,10 +112,13 @@ Commands include:
 .Op Fl Fl attributes= Ns Ar attributes
 .Op Fl Fl expiration-time= Ns Ar time
 .Op Fl Fl pw-expiration-time= Ns Ar time
+.Op Fl Fl policy= Ns Ar policy-name
 .Ar principal...
 .Bd -ragged -offset indent
 Adds a new principal to the database. The options not passed on the
-command line will be prompted for.
+command line will be promped for.
+The only policy supported by Heimdal servers is
+.Ql default .
 .Ed
 .Pp
 .Nm add_enctype
@@ -123,7 +126,7 @@ command line will be prompted for.
 .Ar principal enctypes...
 .Pp
 .Bd -ragged -offset indent
-Adds a new encryption type to the principal, only random keys are
+Adds a new encryption type to the principal, only random key are
 supported.
 .Ed
 .Pp
@@ -148,7 +151,9 @@ enctypes.
 .Oc
 .Ar principal...
 .Bd -ragged -offset indent
-Creates a keytab with the keys of the specified principals.
+Creates a keytab with the keys of the specified principals.  Requires
+get-keys rights, otherwise the principal's keys are changed and saved in
+the keytab.
 .Ed
 .Pp
 .Nm get
@@ -202,12 +207,16 @@ and
 .Op Fl Fl expiration-time= Ns Ar time
 .Op Fl Fl pw-expiration-time= Ns Ar time
 .Op Fl Fl kvno= Ns Ar number
+.Op Fl Fl policy= Ns Ar policy-name
 .Ar principal...
 .Bd -ragged -offset indent
 Modifies certain attributes of a principal. If run without command
 line options, you will be prompted. With command line options, it will
 only change the ones specified.
 .Pp
+Only policy supported by Heimdal is
+.Ql default .
+.Pp
 Possible attributes are:
 .Li new-princ ,
 .Li support-desmd5 ,
@@ -230,6 +239,7 @@ kadmin -l modify -a -disallow-proxiable user
 .Ed
 .Pp
 .Nm passwd
+.Op Fl Fl keepold
 .Op Fl r | Fl Fl random-key
 .Op Fl Fl random-password
 .Oo Fl p Ar string \*(Ba Xo
@@ -262,6 +272,7 @@ Lists the operations you are allowed to perform. These include
 .Li delete ,
 .Li del_enctype ,
 .Li get ,
+.Li get-keys ,
 .Li list ,
 and
 .Li modify .
@@ -288,14 +299,18 @@ When running in local mode, the following commands can also be used:
 .Pp
 .Nm dump
 .Op Fl d | Fl Fl decrypt
+.Op Fl f Ns Ar format | Fl Fl format= Ns Ar format
 .Op Ar dump-file
 .Bd -ragged -offset indent
 Writes the database in
-.Dq human readable
+.Dq machine readable text
 form to the specified file, or standard out. If the database is
 encrypted, the dump will also have encrypted keys, unless
 .Fl Fl decrypt
-is used.
+is used.  If
+.Fl Fl format=MIT
+is used then the dump will be in MIT format.  Otherwise it will be in
+Heimdal format.
 .Ed
 .Pp
 .Nm init
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmin.c b/crypto/external/bsd/heimdal/dist/kadmin/kadmin.c
index 67e628876..f14f93051 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmin.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadmin.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kadmin.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -114,6 +114,18 @@ exit_kadmin (void *opt, int argc, char **argv)
     return 0;
 }
 
+int
+lock(void *opt, int argc, char **argv)
+{
+    return kadm5_lock(kadm_handle);
+}
+
+int
+unlock(void *opt, int argc, char **argv)
+{
+    return kadm5_unlock(kadm_handle);
+}
+
 static void
 usage(int ret)
 {
@@ -149,6 +161,7 @@ main(int argc, char **argv)
     kadm5_config_params conf;
     int optidx = 0;
     int exit_status = 0;
+    int aret;
 
     setprogname(argv[0]);
 
@@ -171,8 +184,8 @@ main(int argc, char **argv)
     argv += optidx;
 
     if (config_file == NULL) {
-	asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
-	if (config_file == NULL)
+	aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
+	if (aret == -1)
 	    errx(1, "out of memory");
     }
 
@@ -267,7 +280,7 @@ main(int argc, char **argv)
     if (argc != 0) {
 	ret = sl_command (commands, argc, argv);
 	if(ret == -1)
-	    krb5_warnx (context, "unrecognized command: %s", argv[0]);
+	    sl_did_you_mean(commands, argv[0]);
 	else if (ret == -2)
 	    ret = 0;
 	if(ret != 0)
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmin_locl.h b/crypto/external/bsd/heimdal/dist/kadmin/kadmin_locl.h
index 572d9743c..8624e4e21 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmin_locl.h
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmin_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadmin_locl.h,v 1.1.1.2 2011/04/14 14:08:10 elric Exp $	*/
+/*	$NetBSD: kadmin_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -111,6 +111,9 @@ int  str2attributes(const char *, krb5_flags *);
 int  parse_attributes (const char *, krb5_flags *, int *, int);
 int  edit_attributes (const char *, krb5_flags *, int *, int);
 
+int  parse_policy (const char *, char **, int *, int);
+int  edit_policy (const char *, char **, int *, int);
+
 void time_t2str(time_t, char *, size_t, int);
 int  str2time_t (const char *, time_t *);
 int  parse_timet (const char *, krb5_timestamp *, int *, int);
@@ -126,7 +129,7 @@ int edit_entry(kadm5_principal_ent_t, int *, kadm5_principal_ent_t, int);
 void set_defaults(kadm5_principal_ent_t, int *, kadm5_principal_ent_t, int);
 int set_entry(krb5_context, kadm5_principal_ent_t, int *,
 	      const char *, const char *, const char *,
-	      const char *, const char *);
+	      const char *, const char *, const char *);
 int
 foreach_principal(const char *, int (*)(krb5_principal, void*),
 		  const char *, void *);
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmind.8 b/crypto/external/bsd/heimdal/dist/kadmin/kadmind.8
index 0d68b0889..fe12d45a7 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmind.8
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmind.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kadmind.8,v 1.4 2014/04/24 13:45:33 pettai Exp $
+.\"	$NetBSD: kadmind.8,v 1.5 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2002 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -109,6 +109,8 @@ add
 .It
 get
 .It
+get-keys
+.It
 all
 .El
 .Pp
@@ -149,14 +151,15 @@ compiled in defaults:
 .D1 Nm Fl Fl ports Ns Li "=\*[q]+ 4711\*[q] &"
 .Pp
 This acl file will grant Joe all rights, and allow Mallory to view and
-add host principals.
+add host principals, as well as extract host principal keys (e.g., into
+keytabs).
 .Bd -literal -offset indent
 joe/admin@EXAMPLE.COM      all
-mallory/admin@EXAMPLE.COM  add,get  host/*@EXAMPLE.COM
+mallory/admin@EXAMPLE.COM  add,get-keys  host/*@EXAMPLE.COM
 .Ed
 .\".Sh DIAGNOSTICS
 .Sh SEE ALSO
 .Xr kpasswd 1 ,
-.Xr kadmin 8 ,
+.Xr kadmin 1 ,
 .Xr kdc 8 ,
 .Xr kpasswdd 8
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/kadmind.c b/crypto/external/bsd/heimdal/dist/kadmin/kadmind.c
index 24102327e..a60b7fcf6 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/kadmind.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/kadmind.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadmind.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kadmind.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@ static char *check_library  = NULL;
 static char *check_function = NULL;
 static getarg_strings policy_libraries = { 0, NULL };
 static char *config_file;
-static char sHDB[] = "HDB:";
+static char sHDB[] = "HDBGET:";
 static char *keytab_str = sHDB;
 static int help_flag;
 static int version_flag;
@@ -47,6 +47,9 @@ static int debug_flag;
 static char *port_str;
 char *realm;
 
+static int detach_from_console = -1;
+int daemon_child = -1;
+
 static struct getargs args[] = {
     {
 	"config-file",	'c',	arg_string,	&config_file,
@@ -70,6 +73,14 @@ static struct getargs args[] = {
     {	"debug",	'd',	arg_flag,   &debug_flag,
 	"enable debugging", NULL
     },
+    {
+        "detach",       0 ,      arg_flag, &detach_from_console,
+        "detach from console", NULL
+    },
+    {
+        "daemon-child",       0 ,      arg_integer, &daemon_child,
+        "private argument, do not use", NULL
+    },
     {	"ports",	'p',	arg_string, &port_str,
 	"ports to listen to", "port" },
     {	"help",		'h',	arg_flag,   &help_flag, NULL, NULL },
@@ -100,10 +111,6 @@ main(int argc, char **argv)
 
     setprogname(argv[0]);
 
-    ret = krb5_init_context(&context);
-    if (ret)
-	errx (1, "krb5_init_context failed: %d", ret);
-
     if (getarg(args, num_args, argc, argv, &optidx)) {
 	warnx("error at argument `%s'", argv[optidx]);
 	usage(1);
@@ -117,12 +124,21 @@ main(int argc, char **argv)
 	exit(0);
     }
 
+    if (detach_from_console > 0 && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
+
+    ret = krb5_init_context(&context);
+    if (ret)
+	errx (1, "krb5_init_context failed: %d", ret);
+
     argc -= optidx;
     argv += optidx;
 
     if (config_file == NULL) {
-	asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
-	if (config_file == NULL)
+	int aret;
+
+	aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
+	if (aret == -1)
 	    errx(1, "out of memory");
     }
 
@@ -142,7 +158,7 @@ main(int argc, char **argv)
     if (ret)
 	krb5_err(context, 1, ret, "krb5_set_warn_dest");
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
     if(ret)
 	krb5_err(context, 1, ret, "krb5_kt_register");
 
@@ -173,7 +189,6 @@ main(int argc, char **argv)
 	mini_inetd(debug_port, &sfd);
     } else {
 #ifdef _WIN32
-	pidfile(NULL);
 	start_server(context, port_str);
 #else
 	struct sockaddr_storage __ss;
@@ -187,7 +202,6 @@ main(int argc, char **argv)
 
 	if(roken_getsockname(STDIN_FILENO, sa, &sa_size) < 0 &&
 	   rk_SOCK_ERRNO == ENOTSOCK) {
-	    pidfile(NULL);
 	    start_server(context, port_str);
 	}
 #endif /* _WIN32 */
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/load.c b/crypto/external/bsd/heimdal/dist/kadmin/load.c
index 1111b450f..21a88e7b3 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/load.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/load.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: load.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: load.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -364,7 +364,7 @@ parse_extensions(char *str, HDB_extensions **e)
 static int
 doit(const char *filename, int mergep)
 {
-    krb5_error_code ret;
+    krb5_error_code ret = 0;
     FILE *f;
     char s[8192]; /* XXX should fix this properly */
     char *p;
@@ -379,10 +379,22 @@ doit(const char *filename, int mergep)
 	krb5_warn(context, errno, "fopen(%s)", filename);
 	return 1;
     }
-    ret = kadm5_log_truncate (kadm_handle);
+    /*
+     * We don't have a version number in the dump, so we don't know which iprop
+     * log entries to keep, if any.  We throw the log away.
+     *
+     * We could merge the ipropd-master/slave dump/load here as an option, in
+     * which case we would first load the dump.
+     *
+     * If we're merging, first recover unconfirmed records in the existing log.
+     */
+    if (mergep)
+        ret = kadm5_log_init(kadm_handle);
+    if (ret == 0)
+        ret = kadm5_log_reinit(kadm_handle, 0);
     if (ret) {
 	fclose (f);
-	krb5_warn(context, ret, "kadm5_log_truncate");
+	krb5_warn(context, ret, "kadm5_log_reinit");
 	return 1;
     }
 
@@ -537,6 +549,7 @@ doit(const char *filename, int mergep)
 	    break;
 	}
     }
+    (void) kadm5_log_end(kadm_handle);
     db->hdb_close(context, db);
     fclose(f);
     return ret != 0;
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/mod.c b/crypto/external/bsd/heimdal/dist/kadmin/mod.c
index c321a4702..1ef123939 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/mod.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/mod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mod.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: mod.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -43,7 +43,7 @@ add_tl(kadm5_principal_ent_rec *princ, int type, krb5_data *data)
 
     tl = ecalloc(1, sizeof(*tl));
     tl->tl_data_next = NULL;
-    tl->tl_data_type = KRB5_TL_EXTENSION;
+    tl->tl_data_type = type;
     tl->tl_data_length = data->length;
     tl->tl_data_contents = data->data;
 
@@ -187,6 +187,37 @@ add_pkinit_acl(krb5_context contextp, kadm5_principal_ent_rec *princ,
     add_tl(princ, KRB5_TL_EXTENSION, &buf);
 }
 
+static void
+add_kvno_diff(krb5_context contextp, kadm5_principal_ent_rec *princ,
+	      int is_svc_diff, krb5_kvno kvno_diff)
+{
+    krb5_error_code ret;
+    HDB_extension ext;
+    krb5_data buf;
+    size_t size = 0;
+
+    if (kvno_diff < 0)
+	return;
+    if (kvno_diff > 2048)
+	kvno_diff = 2048;
+
+    if (is_svc_diff) {
+	ext.data.element = choice_HDB_extension_data_hist_kvno_diff_svc;
+	ext.data.u.hist_kvno_diff_svc = (unsigned int)kvno_diff;
+    } else {
+	ext.data.element = choice_HDB_extension_data_hist_kvno_diff_clnt;
+	ext.data.u.hist_kvno_diff_clnt = (unsigned int)kvno_diff;
+    }
+    ASN1_MALLOC_ENCODE(HDB_extension, buf.data, buf.length,
+		       &ext, &size, ret);
+    if (ret)
+	abort();
+    if (buf.length != size)
+	abort();
+
+    add_tl(princ, KRB5_TL_EXTENSION, &buf);
+}
+
 static int
 do_mod_entry(krb5_principal principal, void *data)
 {
@@ -209,16 +240,20 @@ do_mod_entry(krb5_principal principal, void *data)
        e->expiration_time_string ||
        e->pw_expiration_time_string ||
        e->attributes_string ||
+       e->policy_string ||
        e->kvno_integer != -1 ||
        e->constrained_delegation_strings.num_strings ||
        e->alias_strings.num_strings ||
-       e->pkinit_acl_strings.num_strings) {
+       e->pkinit_acl_strings.num_strings ||
+       e->hist_kvno_diff_clnt_integer != -1 ||
+       e->hist_kvno_diff_svc_integer != -1) {
 	ret = set_entry(context, &princ, &mask,
 			e->max_ticket_life_string,
 			e->max_renewable_life_string,
 			e->expiration_time_string,
 			e->pw_expiration_time_string,
-			e->attributes_string);
+			e->attributes_string,
+			e->policy_string);
 	if(e->kvno_integer != -1) {
 	    princ.kvno = e->kvno_integer;
 	    mask |= KADM5_KVNO;
@@ -236,7 +271,14 @@ do_mod_entry(krb5_principal principal, void *data)
 	    add_pkinit_acl(context, &princ, &e->pkinit_acl_strings);
 	    mask |= KADM5_TL_DATA;
 	}
-
+	if (e->hist_kvno_diff_clnt_integer != -1) {
+	    add_kvno_diff(context, &princ, 0, e->hist_kvno_diff_clnt_integer);
+	    mask |= KADM5_TL_DATA;
+	}
+	if (e->hist_kvno_diff_svc_integer != -1) {
+	    add_kvno_diff(context, &princ, 1, e->hist_kvno_diff_svc_integer);
+	    mask |= KADM5_TL_DATA;
+	}
     } else
 	ret = edit_entry(&princ, &mask, NULL, 0);
     if(ret == 0) {
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/pw_quality.c b/crypto/external/bsd/heimdal/dist/kadmin/pw_quality.c
index 47f540b11..efa454493 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/pw_quality.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/pw_quality.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pw_quality.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: pw_quality.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/random_password.c b/crypto/external/bsd/heimdal/dist/kadmin/random_password.c
index 0e2877734..182be8514 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/random_password.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/random_password.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: random_password.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: random_password.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/rename.c b/crypto/external/bsd/heimdal/dist/kadmin/rename.c
index 7591d9901..3e18f12a5 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/rename.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/rename.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rename.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: rename.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/rpc.c b/crypto/external/bsd/heimdal/dist/kadmin/rpc.c
index ffd8ea532..deea8b4f9 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/rpc.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/rpc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rpc.c,v 1.2 2014/05/12 15:34:23 christos Exp $	*/
+/*	$NetBSD: rpc.c,v 1.3 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -1099,7 +1099,7 @@ handle_mit(krb5_context contextp, void *buf, size_t len, krb5_socket_t sock)
 
     dcontext = contextp;
 
-    sp = krb5_storage_from_fd(sock);
+    sp = krb5_storage_from_socket(sock);
     INSIST(sp != NULL);
 
     process_stream(contextp, buf, len, sp);
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/server.c b/crypto/external/bsd/heimdal/dist/kadmin/server.c
index 8d38d8304..61b04449b 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/server.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/server.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: server.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: server.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -36,6 +36,10 @@
 #include "kadmin_locl.h"
 #include <krb5/krb5-private.h>
 
+static kadm5_ret_t check_aliases(kadm5_server_context *,
+                                 kadm5_principal_ent_rec *,
+                                 kadm5_principal_ent_rec *);
+
 static kadm5_ret_t
 kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 		 krb5_data *in, krb5_data *out)
@@ -46,13 +50,18 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
     char client[128], name[128], name2[128];
     const char *op = "";
     krb5_principal princ, princ2;
-    kadm5_principal_ent_rec ent;
-    char *password, *expression;
+    kadm5_principal_ent_rec ent, ent_prev;
+    char *password = NULL, *expression;
     krb5_keyblock *new_keys;
+    krb5_key_salt_tuple *ks_tuple = NULL;
+    krb5_boolean keepold = FALSE;
+    int n_ks_tuple = 0;
     int n_keys;
     char **princs;
     int n_princs;
+    int keys_ok = 0;
     krb5_storage *sp;
+    int len;
 
     krb5_unparse_name_fixed(contextp->context, contextp->caller,
 			    client, sizeof(client));
@@ -76,17 +85,54 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	mask |= KADM5_PRINCIPAL;
 	krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 	krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
+
+        /* If the caller doesn't have KADM5_PRIV_GET, we're done. */
 	ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET, princ);
-	if(ret){
+        if (ret) {
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
-	}
+        }
+
+        /* Then check to see if it is ok to return keys */
+        if ((mask & KADM5_KEY_DATA) != 0) {
+            ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET_KEYS,
+                                              princ);
+            if (ret == 0) {
+                keys_ok = 1;
+            } else if ((mask == (KADM5_PRINCIPAL|KADM5_KEY_DATA)) ||
+                       (mask == (KADM5_PRINCIPAL|KADM5_KVNO|KADM5_KEY_DATA))) {
+                /*
+                 * Requests for keys will get bogus keys, which is useful if
+                 * the client just wants to see what (kvno, enctype)s the
+                 * principal has keys for, but terrible if the client wants to
+                 * write the keys into a keytab or modify the principal and
+                 * write the bogus keys back to the server.
+                 *
+                 * We use a heuristic to detect which case we're handling here.
+                 * If the client only asks for the flags in the above
+                 * condition, then it's very likely a kadmin ext_keytab,
+                 * add_enctype, or other request that should not see bogus
+                 * keys.  We deny them.
+                 *
+                 * The kadmin get command can be coaxed into making a request
+                 * with the same mask.  But the default long and terse output
+                 * modes request other things too, so in all likelihood this
+                 * heuristic will not hurt any kadmin get uses.
+                 */
+                krb5_free_principal(contextp->context, princ);
+                goto fail;
+            }
+        }
+
 	ret = kadm5_get_principal(kadm_handlep, princ, &ent, mask);
 	krb5_storage_free(sp);
 	sp = krb5_storage_emem();
 	krb5_store_int32(sp, ret);
-	if(ret == 0){
-	    kadm5_store_principal_ent(sp, &ent);
+	if (ret == 0){
+	    if (keys_ok)
+		kadm5_store_principal_ent(sp, &ent);
+	    else
+		kadm5_store_principal_ent_nokeys(sp, &ent);
 	    kadm5_free_principal_ent(kadm_handlep, &ent);
 	}
 	krb5_free_principal(contextp->context, princ);
@@ -104,6 +150,12 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
 	}
+
+        /*
+         * There's no need to check that the caller has permission to
+         * delete the victim principal's aliases.
+         */
+
 	ret = kadm5_delete_principal(kadm_handlep, princ);
 	krb5_free_principal(contextp->context, princ);
 	krb5_storage_free(sp);
@@ -118,12 +170,12 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    goto fail;
 	ret = krb5_ret_int32(sp, &mask);
 	if(ret){
-	    kadm5_free_principal_ent(contextp->context, &ent);
+	    kadm5_free_principal_ent(kadm_handlep, &ent);
 	    goto fail;
 	}
 	ret = krb5_ret_string(sp, &password);
 	if(ret){
-	    kadm5_free_principal_ent(contextp->context, &ent);
+	    kadm5_free_principal_ent(kadm_handlep, &ent);
 	    goto fail;
 	}
 	krb5_unparse_name_fixed(contextp->context, ent.principal,
@@ -132,16 +184,23 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD,
 					  ent.principal);
 	if(ret){
-	    kadm5_free_principal_ent(contextp->context, &ent);
-	    memset(password, 0, strlen(password));
-	    free(password);
+	    kadm5_free_principal_ent(kadm_handlep, &ent);
 	    goto fail;
 	}
+        if ((mask & KADM5_TL_DATA)) {
+            /*
+             * Also check that the caller can create the aliases, if the
+             * new principal has any.
+             */
+            ret = check_aliases(contextp, &ent, NULL);
+            if (ret) {
+                kadm5_free_principal_ent(kadm_handlep, &ent);
+                goto fail;
+            }
+        }
 	ret = kadm5_create_principal(kadm_handlep, &ent,
 				     mask, password);
 	kadm5_free_principal_ent(kadm_handlep, &ent);
-	memset(password, 0, strlen(password));
-	free(password);
 	krb5_storage_free(sp);
 	sp = krb5_storage_emem();
 	krb5_store_int32(sp, ret);
@@ -166,6 +225,25 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    kadm5_free_principal_ent(contextp, &ent);
 	    goto fail;
 	}
+        if ((mask & KADM5_TL_DATA)) {
+            /*
+             * Also check that the caller can create aliases that are in
+             * the new entry but not the old one.  There's no need to
+             * check that the caller can delete aliases it wants to
+             * drop.  See also handling of rename.
+             */
+            ret = kadm5_get_principal(kadm_handlep, ent.principal, &ent_prev, mask);
+            if (ret) {
+                kadm5_free_principal_ent(contextp, &ent);
+                goto fail;
+            }
+            ret = check_aliases(contextp, &ent, &ent_prev);
+            kadm5_free_principal_ent(contextp, &ent_prev);
+            if (ret) {
+                kadm5_free_principal_ent(contextp, &ent);
+                goto fail;
+            }
+        }
 	ret = kadm5_modify_principal(kadm_handlep, &ent, mask);
 	kadm5_free_principal_ent(kadm_handlep, &ent);
 	krb5_storage_free(sp);
@@ -184,15 +262,28 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    goto fail;
 	}
 	krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
-	krb5_unparse_name_fixed(contextp->context, princ2, name2, sizeof(name2));
+	krb5_unparse_name_fixed(contextp->context, princ2,
+                                name2, sizeof(name2));
 	krb5_warnx(contextp->context, "%s: %s %s -> %s",
 		   client, op, name, name2);
 	ret = _kadm5_acl_check_permission(contextp,
 					  KADM5_PRIV_ADD,
-					  princ2)
-	    || _kadm5_acl_check_permission(contextp,
-					   KADM5_PRIV_DELETE,
-					   princ);
+					  princ2);
+        if (ret == 0) {
+            /*
+             * Also require modify for the principal.  For backwards
+             * compatibility, allow delete permission on the old name to
+             * cure lack of modify permission on the old name.
+             */
+            ret = _kadm5_acl_check_permission(contextp,
+                                              KADM5_PRIV_MODIFY,
+                                              princ);
+            if (ret) {
+                ret = _kadm5_acl_check_permission(contextp,
+                                                  KADM5_PRIV_DELETE,
+                                                  princ);
+            }
+        }
 	if(ret){
 	    krb5_free_principal(contextp->context, princ);
 	    krb5_free_principal(contextp->context, princ2);
@@ -209,10 +300,15 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
     case kadm_chpass:{
 	op = "CHPASS";
 	ret = krb5_ret_principal(sp, &princ);
-	if(ret)
+	if (ret)
 	    goto fail;
 	ret = krb5_ret_string(sp, &password);
-	if(ret){
+	if (ret) {
+	    krb5_free_principal(contextp->context, princ);
+	    goto fail;
+	}
+	ret = krb5_ret_int32(sp, &keepold);
+	if (ret && ret != HEIM_ERR_EOF) {
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
 	}
@@ -252,14 +348,11 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 
 	if(ret) {
 	    krb5_free_principal(contextp->context, princ);
-	    memset(password, 0, strlen(password));
-	    free(password);
 	    goto fail;
 	}
-	ret = kadm5_chpass_principal(kadm_handlep, princ, password);
+	ret = kadm5_chpass_principal_3(kadm_handlep, princ, keepold, 0, NULL,
+				       password);
 	krb5_free_principal(contextp->context, princ);
-	memset(password, 0, strlen(password));
-	free(password);
 	krb5_storage_free(sp);
 	sp = krb5_storage_emem();
 	krb5_store_int32(sp, ret);
@@ -279,6 +372,11 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
 	}
+	ret = krb5_ret_int32(sp, &keepold);
+	if (ret && ret != HEIM_ERR_EOF) {
+	    krb5_free_principal(contextp->context, princ);
+	    goto fail;
+	}
 	/* n_key_data will be squeezed into an int16_t below. */
 	if (n_key_data < 0 || n_key_data >= 1 << 16 ||
 	    (size_t)n_key_data > UINT_MAX/sizeof(*key_data)) {
@@ -323,8 +421,8 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
 	}
-	ret = kadm5_chpass_principal_with_key(kadm_handlep, princ,
-					      n_key_data, key_data);
+	ret = kadm5_chpass_principal_with_key_3(kadm_handlep, princ, keepold,
+					        n_key_data, key_data);
 	{
 	    int16_t dummy = n_key_data;
 	    kadm5_free_key_data (contextp, &dummy, key_data);
@@ -360,9 +458,57 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    krb5_free_principal(contextp->context, princ);
 	    goto fail;
 	}
-	ret = kadm5_randkey_principal(kadm_handlep, princ,
-				      &new_keys, &n_keys);
+
+	/*
+	 * See comments in kadm5_c_randkey_principal() regarding the
+	 * protocol.
+	 */
+	ret = krb5_ret_int32(sp, &keepold);
+	if (ret != 0 && ret != HEIM_ERR_EOF) {
+	    krb5_free_principal(contextp->context, princ);
+	    goto fail;
+	}
+
+	ret = krb5_ret_int32(sp, &n_ks_tuple);
+	if (ret != 0 && ret != HEIM_ERR_EOF) {
+	    krb5_free_principal(contextp->context, princ);
+	    goto fail;
+	} else if (ret == 0) {
+	    size_t i;
+
+	    if (n_ks_tuple < 0) {
+		ret = EOVERFLOW;
+		krb5_free_principal(contextp->context, princ);
+		goto fail;
+	    }
+
+	    if ((ks_tuple = calloc(n_ks_tuple, sizeof (*ks_tuple))) == NULL) {
+		ret = errno;
+		krb5_free_principal(contextp->context, princ);
+		goto fail;
+	    }
+
+	    for (i = 0; i < n_ks_tuple; i++) {
+		ret = krb5_ret_int32(sp, &ks_tuple[i].ks_enctype);
+		if (ret != 0) {
+		    krb5_free_principal(contextp->context, princ);
+                    free(ks_tuple);
+		    goto fail;
+		}
+		ret = krb5_ret_int32(sp, &ks_tuple[i].ks_salttype);
+		if (ret != 0) {
+		    krb5_free_principal(contextp->context, princ);
+                    free(ks_tuple);
+		    goto fail;
+		}
+	    }
+	}
+	ret = kadm5_randkey_principal_3(kadm_handlep, princ, keepold,
+					n_ks_tuple, ks_tuple, &new_keys,
+					&n_keys);
 	krb5_free_principal(contextp->context, princ);
+        free(ks_tuple);
+
 	krb5_storage_free(sp);
 	sp = krb5_storage_emem();
 	krb5_store_int32(sp, ret);
@@ -370,7 +516,8 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	    int i;
 	    krb5_store_int32(sp, n_keys);
 	    for(i = 0; i < n_keys; i++){
-		krb5_store_keyblock(sp, new_keys[i]);
+                if (ret == 0)
+                    ret = krb5_store_keyblock(sp, new_keys[i]);
 		krb5_free_keyblock_contents(contextp->context, &new_keys[i]);
 	    }
 	    free(new_keys);
@@ -426,10 +573,20 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	krb5_store_int32(sp, KADM5_FAILURE);
 	break;
     }
+    if (password != NULL) {
+	len = strlen(password);
+	memset_s(password, len, 0, len);
+	free(password);
+    }
     krb5_storage_to_data(sp, out);
     krb5_storage_free(sp);
     return 0;
 fail:
+    if (password != NULL) {
+	len = strlen(password);
+	memset_s(password, len, 0, len);
+	free(password);
+    }
     krb5_warn(contextp->context, ret, "%s", op);
     krb5_storage_seek(sp, 0, SEEK_SET);
     krb5_store_int32(sp, ret);
@@ -438,6 +595,120 @@ fail:
     return 0;
 }
 
+struct iter_aliases_ctx {
+    HDB_Ext_Aliases aliases;
+    krb5_tl_data *tl;
+    int alias_idx;
+    int done;
+};
+
+static kadm5_ret_t
+iter_aliases(kadm5_principal_ent_rec *from,
+             struct iter_aliases_ctx *ctx,
+             krb5_principal *out)
+{
+    HDB_extension ext;
+    kadm5_ret_t ret;
+    size_t size;
+
+    *out = NULL;
+
+    if (ctx->done > 0)
+        return 0;
+
+    if (ctx->done == 0) {
+        if (ctx->alias_idx < ctx->aliases.aliases.len) {
+            *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
+            return 0;
+        }
+        /* Out of aliases in this TL, step to next TL */
+        ctx->tl = ctx->tl->tl_data_next;
+    } else if (ctx->done < 0) {
+        /* Setup iteration context */
+        memset(ctx, 0, sizeof(*ctx));
+        ctx->done = 0;
+        ctx->aliases.aliases.val = NULL;
+        ctx->aliases.aliases.len = 0;
+        ctx->tl = from->tl_data;
+    }
+
+    free_HDB_Ext_Aliases(&ctx->aliases);
+    ctx->alias_idx = 0;
+
+    /* Find TL with aliases */
+    for (; ctx->tl != NULL; ctx->tl = ctx->tl->tl_data_next) {
+        if (ctx->tl->tl_data_type != KRB5_TL_EXTENSION)
+            continue;
+
+        ret = decode_HDB_extension(ctx->tl->tl_data_contents,
+                                   ctx->tl->tl_data_length,
+                                   &ext, &size);
+        if (ret)
+            return ret;
+        if (ext.data.element == choice_HDB_extension_data_aliases &&
+            ext.data.u.aliases.aliases.len > 0) {
+            ctx->aliases = ext.data.u.aliases;
+            break;
+        }
+        free_HDB_extension(&ext);
+    }
+
+    if (ctx->tl != NULL && ctx->aliases.aliases.len > 0) {
+        *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
+        return 0;
+    }
+
+    ctx->done = 1;
+    return 0;
+}
+
+static kadm5_ret_t
+check_aliases(kadm5_server_context *contextp,
+              kadm5_principal_ent_rec *add_princ,
+              kadm5_principal_ent_rec *del_princ)
+{
+    kadm5_ret_t ret;
+    struct iter_aliases_ctx iter;
+    struct iter_aliases_ctx iter_del;
+    krb5_principal new_name, old_name;
+    int match;
+
+    /*
+     * Yeah, this is O(N^2).  Gathering and sorting all the aliases
+     * would be a bit of a pain; if we ever have principals with enough
+     * aliases for this to be a problem, we can fix it then.
+     */
+    for (iter.done = -1; iter.done != 1;) {
+        match = 0;
+        ret = iter_aliases(add_princ, &iter, &new_name);
+        if (ret)
+            return ret;
+        if (iter.done == 1)
+            break;
+        for (iter_del.done = -1; iter_del.done != 1;) {
+            ret = iter_aliases(del_princ, &iter_del, &old_name);
+            if (ret)
+                return ret;
+            if (iter_del.done == 1)
+                break;
+            if (!krb5_principal_compare(contextp->context, new_name, old_name))
+                continue;
+            free_HDB_Ext_Aliases(&iter_del.aliases);
+            match = 1;
+            break;
+        }
+        if (match)
+            continue;
+        ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD, new_name);
+        if (ret) {
+            free_HDB_Ext_Aliases(&iter.aliases);
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
 static void
 v5_loop (krb5_context contextp,
 	 krb5_auth_context ac,
@@ -490,7 +761,7 @@ handle_v5(krb5_context contextp,
     krb5_boolean initial;
     krb5_auth_context ac = NULL;
 
-    unsigned kadm_version;
+    unsigned kadm_version = 1;
     kadm5_config_params realm_params;
 
     ret = krb5_recvauth_match_version(contextp, &ac, &fd,
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/stash.c b/crypto/external/bsd/heimdal/dist/kadmin/stash.c
index 3e59eb5cc..2c6f4fb76 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/stash.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/stash.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: stash.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: stash.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -43,10 +43,11 @@ extern int local_flag;
 int
 stash(struct stash_options *opt, int argc, char **argv)
 {
-    char buf[1024];
+    char buf[1024+1];
     krb5_error_code ret;
     krb5_enctype enctype;
     hdb_master_key mkey;
+    int aret;
 
     if(!local_flag) {
 	krb5_warnx(context, "stash is only available in local (-l) mode");
@@ -60,8 +61,8 @@ stash(struct stash_options *opt, int argc, char **argv)
     }
 
     if(opt->key_file_string == NULL) {
-	asprintf(&opt->key_file_string, "%s/m-key", hdb_db_dir(context));
-	if (opt->key_file_string == NULL)
+	aret = asprintf(&opt->key_file_string, "%s/m-key", hdb_db_dir(context));
+	if (aret == -1)
 	    errx(1, "out of memory");
     }
 
@@ -76,6 +77,7 @@ stash(struct stash_options *opt, int argc, char **argv)
 	if (ret)
 	    krb5_warn(context, ret, "reading master key from %s",
 		      opt->key_file_string);
+	hdb_free_master_key(context, mkey);
 	return 0;
     } else {
 	krb5_keyblock key;
@@ -86,7 +88,7 @@ stash(struct stash_options *opt, int argc, char **argv)
 	salt.saltvalue.length = 0;
 	if(opt->master_key_fd_integer != -1) {
 	    ssize_t n;
-	    n = read(opt->master_key_fd_integer, buf, sizeof(buf));
+	    n = read(opt->master_key_fd_integer, buf, sizeof(buf)-1);
 	    if(n == 0)
 		krb5_warnx(context, "end of file reading passphrase");
 	    else if(n < 0) {
@@ -110,10 +112,15 @@ stash(struct stash_options *opt, int argc, char **argv)
     }
 
     {
-	char *new, *old;
-	asprintf(&old, "%s.old", opt->key_file_string);
-	asprintf(&new, "%s.new", opt->key_file_string);
-	if(old == NULL || new == NULL) {
+	char *new = NULL, *old = NULL;
+
+	aret = asprintf(&old, "%s.old", opt->key_file_string);
+	if (aret == -1) {
+	    ret = ENOMEM;
+	    goto out;
+	}
+	aret = asprintf(&new, "%s.new", opt->key_file_string);
+	if (aret == -1) {
 	    ret = ENOMEM;
 	    goto out;
 	}
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/test_util.c b/crypto/external/bsd/heimdal/dist/kadmin/test_util.c
index c4742176e..0973abc1b 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/test_util.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/test_util.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_util.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: test_util.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kadmin/util.c b/crypto/external/bsd/heimdal/dist/kadmin/util.c
index 3f586c61c..56c00e399 100644
--- a/crypto/external/bsd/heimdal/dist/kadmin/util.c
+++ b/crypto/external/bsd/heimdal/dist/kadmin/util.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: util.c,v 1.3 2014/04/24 13:45:33 pettai Exp $	*/
+/*	$NetBSD: util.c,v 1.4 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -147,6 +147,61 @@ edit_attributes (const char *prompt, krb5_flags *attr, int *mask, int bit)
     return 0;
 }
 
+/*
+ * try to parse the string `resp' into policy in `attr', also
+ * setting the `bit' in `mask' if attributes are given and valid.
+ */
+
+#define VALID_POLICY_NAME_CHARS \
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_"
+
+int
+parse_policy (const char *resp, char **policy, int *mask, int bit)
+{
+    if (strspn(resp, VALID_POLICY_NAME_CHARS) == strlen(resp) &&
+	*resp != '\0') {
+	
+	*policy = strdup(resp);
+	if (*policy == NULL) {
+	    fprintf (stderr, "Out of memory");
+	    return -1;
+	}
+	if (mask)
+	    *mask |= bit;
+	return 0;
+    } else if(*resp == '?') {
+	print_flags_table (kdb_attrs, stderr);
+    } else {
+	fprintf (stderr, "Unable to parse \"%s\"\n", resp);
+    }
+    return -1;
+}
+
+/*
+ * allow the user to edit the attributes in `attr', prompting with `prompt'
+ */
+
+int
+edit_policy (const char *prompt, char **policy, int *mask, int bit)
+{
+    char buf[1024], resp[1024];
+
+    if (mask && (*mask & bit))
+	return 0;
+
+    buf[0] = '\0';
+    strlcpy(buf, "default", sizeof (buf));
+    for (;;) {
+	if(get_response("Policy", buf, resp, sizeof(resp)) != 0)
+	    return 1;
+	if (resp[0] == '\0')
+	    break;
+	if (parse_policy (resp, policy, mask, bit) == 0)
+	    break;
+    }
+    return 0;
+}
+
 /*
  * time_t
  * the special value 0 means ``never''
@@ -393,6 +448,14 @@ set_defaults(kadm5_principal_ent_t ent, int *mask,
 	&& (default_mask & KADM5_ATTRIBUTES)
 	&& !(*mask & KADM5_ATTRIBUTES))
 	ent->attributes = default_ent->attributes & ~KRB5_KDB_DISALLOW_ALL_TIX;
+
+    if (default_ent
+	&& (default_mask & KADM5_POLICY)
+	&& !(*mask & KADM5_POLICY)) {
+	ent->policy = strdup(default_ent->policy);
+	if (ent->policy == NULL)
+	    abort();
+    }
 }
 
 int
@@ -422,6 +485,10 @@ edit_entry(kadm5_principal_ent_t ent, int *mask,
 			KADM5_ATTRIBUTES) != 0)
 	return 1;
 
+    if(edit_policy ("Policy", &ent->policy, mask,
+			KADM5_POLICY) != 0)
+	return 1;
+
     return 0;
 }
 
@@ -439,7 +506,8 @@ set_entry(krb5_context contextp,
 	  const char *max_renewable_life,
 	  const char *expiration,
 	  const char *pw_expiration,
-	  const char *attributes)
+	  const char *attributes,
+	  const char *policy)
 {
     if (max_ticket_life != NULL) {
 	if (parse_deltat (max_ticket_life, &ent->max_life,
@@ -477,6 +545,13 @@ set_entry(krb5_context contextp,
 	    return 1;
 	}
     }
+    if (policy != NULL) {
+	if (parse_policy (policy, &ent->policy,
+			      mask, KADM5_POLICY)) {
+	    krb5_warnx (contextp, "unable to parse `%s'", attributes);
+	    return 1;
+	}
+    }
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/Makefile.am b/crypto/external/bsd/heimdal/dist/kcm/Makefile.am
index 7c5481fa7..87f578063 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/kcm/Makefile.am
@@ -2,7 +2,7 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_krb4) $(INCLUDE_hcrypto) -I$(srcdir)/../lib/krb5
+AM_CPPFLAGS += $(INCLUDE_libintl) -I$(srcdir)/../lib/krb5
 
 libexec_PROGRAMS = kcm
 
@@ -17,14 +17,15 @@ kcm_SOURCES =		\
 	glue.c		\
 	headers.h	\
 	kcm_locl.h	\
-	kcm-protos.h	\
 	log.c		\
 	main.c		\
 	protocol.c	\
 	sessions.c	\
 	renew.c
 
-$(srcdir)/kcm-protos.h:
+noinst_HEADERS = $(srcdir)/kcm-protos.h
+
+$(srcdir)/kcm-protos.h: $(kcm_SOURCES)
 	cd $(srcdir); perl ../cf/make-proto.pl -o kcm-protos.h -q -P comment $(kcm_SOURCES) || rm -f kcm-protos.h
 
 $(kcm_OBJECTS): $(srcdir)/kcm-protos.h
@@ -33,7 +34,6 @@ man_MANS = kcm.8
 
 LDADD = $(top_builddir)/lib/hdb/libhdb.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
-	$(LIB_krb4) \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(top_builddir)/lib/ntlm/libheimntlm.la \
diff --git a/crypto/external/bsd/heimdal/dist/kcm/acl.c b/crypto/external/bsd/heimdal/dist/kcm/acl.c
index 377e17656..53c2a6d6a 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/acl.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/acl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acl.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $	*/
+/*	$NetBSD: acl.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/kcm/acquire.c b/crypto/external/bsd/heimdal/dist/kcm/acquire.c
index be9ccd46a..e1d884d78 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/acquire.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/acquire.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acquire.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: acquire.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -50,7 +50,9 @@ kcm_ccache_acquire(krb5_context context,
     krb5_get_init_creds_opt *opt = NULL;
     krb5_ccache_data ccdata;
     char *in_tkt_service = NULL;
+    const char *estr;
 
+    *credp = NULL;
     memset(&cred, 0, sizeof(cred));
 
     KCM_ASSERT_VALID(ccache);
@@ -79,9 +81,11 @@ kcm_ccache_acquire(krb5_context context,
     if (ccache->server != NULL) {
 	ret = krb5_unparse_name(context, ccache->server, &in_tkt_service);
 	if (ret) {
+	    estr = krb5_get_error_message(context, ret);
 	    kcm_log(0, "Failed to unparse service principal name for cache %s: %s",
-		    ccache->name, krb5_get_err_text(context, ret));
-	    return ret;
+		    ccache->name, estr);
+	    krb5_free_error_message(context, estr);
+	    goto out;
 	}
     }
 
@@ -116,28 +120,28 @@ kcm_ccache_acquire(krb5_context context,
     }
 
     if (ret) {
+	estr = krb5_get_error_message(context, ret);
 	kcm_log(0, "Failed to acquire credentials for cache %s: %s",
-		ccache->name, krb5_get_err_text(context, ret));
-	if (in_tkt_service != NULL)
-	    free(in_tkt_service);
+		ccache->name, estr);
+	krb5_free_error_message(context, estr);
 	goto out;
     }
 
-    if (in_tkt_service != NULL)
-	free(in_tkt_service);
-
     /* Swap them in */
     kcm_ccache_remove_creds_internal(context, ccache);
 
     ret = kcm_ccache_store_cred_internal(context, ccache, &cred, 0, credp);
     if (ret) {
+	estr = krb5_get_error_message(context, ret);
 	kcm_log(0, "Failed to store credentials for cache %s: %s",
-		ccache->name, krb5_get_err_text(context, ret));
+		ccache->name, estr);
+	krb5_free_error_message(context, estr);
 	krb5_free_cred_contents(context, &cred);
 	goto out;
     }
 
 out:
+    free(in_tkt_service);
     if (opt)
 	krb5_get_init_creds_opt_free(context, opt);
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/cache.c b/crypto/external/bsd/heimdal/dist/kcm/cache.c
index f06e83c67..8f7e9dcc2 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/cache.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/cache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cache.c,v 1.2 2014/07/24 22:54:10 joerg Exp $	*/
+/*	$NetBSD: cache.c,v 1.3 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -44,12 +44,15 @@ char *kcm_ccache_nextid(pid_t pid, uid_t uid, gid_t gid)
 {
     unsigned n;
     char *name;
+    int ret;
 
     HEIMDAL_MUTEX_lock(&ccache_mutex);
     n = ++ccache_nextid;
     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 
-    asprintf(&name, "%ld:%u", (long)uid, n);
+    ret = asprintf(&name, "%ld:%u", (long)uid, n);
+    if (ret == -1)
+	return NULL;
 
     return name;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kcm/client.c b/crypto/external/bsd/heimdal/dist/kcm/client.c
index f67a15b5e..1b4753e88 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/client.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/client.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: client.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: client.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -45,11 +45,13 @@ kcm_ccache_resolve_client(krb5_context context,
 			  kcm_ccache *ccache)
 {
     krb5_error_code ret;
+    const char *estr;
 
     ret = kcm_ccache_resolve(context, name, ccache);
     if (ret) {
-	kcm_log(1, "Failed to resolve cache %s: %s",
-		name, krb5_get_err_text(context, ret));
+	estr = krb5_get_error_message(context, ret);
+	kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
+	krb5_free_error_message(context, estr);
 	return ret;
     }
 
@@ -69,11 +71,13 @@ kcm_ccache_destroy_client(krb5_context context,
 {
     krb5_error_code ret;
     kcm_ccache ccache;
+    const char *estr;
 
     ret = kcm_ccache_resolve(context, name, &ccache);
     if (ret) {
-	kcm_log(1, "Failed to resolve cache %s: %s",
-		name, krb5_get_err_text(context, ret));
+	estr = krb5_get_error_message(context, ret);
+	kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
+	krb5_free_error_message(context, estr);
 	return ret;
     }
 
@@ -94,6 +98,7 @@ kcm_ccache_new_client(krb5_context context,
 {
     krb5_error_code ret;
     kcm_ccache ccache;
+    const char *estr;
 
     /* We insist the ccache name starts with UID or UID: */
     if (name_constraints != 0) {
@@ -129,8 +134,9 @@ kcm_ccache_new_client(krb5_context context,
     if (ret == KRB5_FCC_NOFILE) {
 	ret = kcm_ccache_new(context, name, &ccache);
 	if (ret) {
-	    kcm_log(1, "Failed to initialize cache %s: %s",
-		    name, krb5_get_err_text(context, ret));
+	    estr = krb5_get_error_message(context, ret);
+	    kcm_log(1, "Failed to initialize cache %s: %s", name, estr);
+	    krb5_free_error_message(context, estr);
 	    return ret;
 	}
 
@@ -141,8 +147,9 @@ kcm_ccache_new_client(krb5_context context,
     } else {
 	ret = kcm_zero_ccache_data(context, ccache);
 	if (ret) {
-	    kcm_log(1, "Failed to empty cache %s: %s",
-		    name, krb5_get_err_text(context, ret));
+	    estr = krb5_get_error_message(context, ret);
+	    kcm_log(1, "Failed to empty cache %s: %s", name, estr);
+	    krb5_free_error_message(context, estr);
 	    kcm_release_ccache(context, ccache);
 	    return ret;
 	}
@@ -167,8 +174,10 @@ kcm_ccache_new_client(krb5_context context,
 	if (matches == 0)
 	    matches = sscanf(name,"%ld",&uid);
 	if (matches == 1) {
-	    struct passwd *pwd = getpwuid(uid);
-	    if (pwd != NULL) {
+	    struct passwd pw, *pwd = NULL;
+	    char pwbuf[2048];
+
+	    if (rk_getpwuid_r(getuid(), &pw, pwbuf, sizeof(pwbuf), &pwd) == 0) {
 		gid_t gid = pwd->pw_gid;
 		kcm_chown(context, client, ccache, uid, gid);
 	    }
diff --git a/crypto/external/bsd/heimdal/dist/kcm/config.c b/crypto/external/bsd/heimdal/dist/kcm/config.c
index fea3dd793..4b4c295eb 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/config.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/config.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: config.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -46,10 +46,8 @@ char *door_path = NULL;
 
 static char *max_request_str;	/* `max_request' as a string */
 
-#ifdef SUPPORT_DETACH
 int detach_from_console = -1;
-#define DETACH_IS_DEFAULT FALSE
-#endif
+int daemon_child = -1;
 
 static const char *system_cache_name = NULL;
 static const char *system_keytab = NULL;
@@ -88,22 +86,17 @@ static struct getargs args[] = {
     },
     {
 	"launchd",	0,	arg_flag, &launchd_flag,
-	"when in use by launchd"
+	"when in use by launchd", NULL
     },
-#ifdef SUPPORT_DETACH
-#if DETACH_IS_DEFAULT
-    {
-	"detach",       'D',      arg_negative_flag, &detach_from_console,
-	"don't detach from console"
-    },
-#else
     {
 	"detach",       0 ,      arg_flag, &detach_from_console,
-	"detach from console"
+	"detach from console", NULL
     },
-#endif
-#endif
-    {	"help",		'h',	arg_flag,   &help_flag },
+    {
+        "daemon-child",       0 ,      arg_integer, &daemon_child,
+        "private argument, do not use", NULL
+    },
+    {	"help",		'h',	arg_flag,   &help_flag, NULL, NULL },
     {
 	"system-principal",	'k',	arg_string,	&system_principal,
 	"system principal name",	"principal"
@@ -118,11 +111,11 @@ static struct getargs args[] = {
     },
     {
 	"name-constraints",	'n', arg_negative_flag, &name_constraints,
-	"disable credentials cache name constraints"
+	"disable credentials cache name constraints", NULL
     },
     {
 	"disallow-getting-krbtgt", 0, arg_flag, &disallow_getting_krbtgt,
-	"disable fetching krbtgt from the cache"
+	"disable fetching krbtgt from the cache", NULL
     },
     {
 	"renewable-life",	'r', arg_string, &renew_life,
@@ -150,7 +143,7 @@ static struct getargs args[] = {
 	"user",		'u',	arg_string,	&system_user,
 	"system cache owner",	"user"
     },
-    {	"version",	'v',	arg_flag,   &version_flag }
+    {	"version",	'v',	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
@@ -166,28 +159,33 @@ static int parse_owners(kcm_ccache ccache)
 {
     uid_t uid = 0;
     gid_t gid = 0;
-    struct passwd *pw;
     struct group *gr;
     int uid_p = 0;
     int gid_p = 0;
+    struct passwd pw, *pwd = NULL;
+    char pwbuf[2048];
 
     if (system_user != NULL) {
 	if (isdigit((unsigned char)system_user[0])) {
-	    pw = getpwuid(atoi(system_user));
+	    if (rk_getpwuid_r(atoi(system_user), &pw, pwbuf, sizeof(pwbuf),
+		&pwd) != 0)
+		    pwd = NULL;
 	} else {
-	    pw = getpwnam(system_user);
+	    if (rk_getpwnam_r(system_user, &pw, pwbuf, sizeof(pwbuf),
+		&pwd) != 0)
+		    pwd = NULL;
 	}
-	if (pw == NULL) {
+	if (pwd == NULL) {
 	    return errno;
 	}
 
-	system_user = strdup(pw->pw_name);
+	system_user = strdup(pwd->pw_name);
 	if (system_user == NULL) {
 	    return ENOMEM;
 	}
 
-	uid = pw->pw_uid; uid_p = 1;
-	gid = pw->pw_gid; gid_p = 1;
+	uid = pwd->pw_uid; uid_p = 1;
+	gid = pwd->pw_gid; gid_p = 1;
     }
 
     if (system_group != NULL) {
@@ -279,7 +277,7 @@ ccache_init_system(void)
 	renew_life = kcm_system_config_get_string("renew_life");
 
     if (renew_life == NULL)
-	renew_life = "1 month";
+	renew_life = "6 months";
 
     if (renew_life != NULL) {
 	ccache->renew_life = parse_time(renew_life, "s");
@@ -330,13 +328,13 @@ void
 kcm_configure(int argc, char **argv)
 {
     krb5_error_code ret;
-    int optind = 0;
+    int optidx = 0;
     const char *p;
 
-    while(getarg(args, num_args, argc, argv, &optind))
-	warnx("error at argument `%s'", argv[optind]);
+    while (getarg(args, num_args, argc, argv, &optidx))
+	warnx("error at argument `%s'", argv[optidx]);
 
-    if(help_flag)
+    if (help_flag)
 	usage (0);
 
     if (version_flag) {
@@ -344,8 +342,8 @@ kcm_configure(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 0)
 	usage(1);
@@ -389,13 +387,11 @@ kcm_configure(int argc, char **argv)
 	    krb5_err(kcm_context, 1, ret, "initializing system ccache");
     }
 
-#ifdef SUPPORT_DETACH
     if(detach_from_console == -1)
 	detach_from_console = krb5_config_get_bool_default(kcm_context, NULL,
-							   DETACH_IS_DEFAULT,
+							   FALSE,
 							   "kcm",
 							   "detach", NULL);
-#endif
     kcm_openlog();
     if(max_request == 0)
 	max_request = 64 * 1024;
diff --git a/crypto/external/bsd/heimdal/dist/kcm/connect.c b/crypto/external/bsd/heimdal/dist/kcm/connect.c
index 7190c2a52..b0ba6ad99 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/connect.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/connect.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: connect.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: connect.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kcm/events.c b/crypto/external/bsd/heimdal/dist/kcm/events.c
index c6ac8f750..e812a82e3 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/events.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/events.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: events.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: events.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -34,7 +34,7 @@
 
 #include "kcm_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: events.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 /* thread-safe in case we multi-thread later */
 static HEIMDAL_MUTEX events_mutex = HEIMDAL_MUTEX_INITIALIZER;
@@ -63,10 +63,10 @@ kcm_enqueue_event(krb5_context context,
 }
 
 static void
-print_times(time_t time, char buf[64])
+print_times(time_t t, char buf[64])
 {
-    if (time)
-	strftime(buf, 64, "%m-%dT%H:%M", gmtime(&time));
+    if (t)
+	strftime(buf, 64, "%m-%dT%H:%M", gmtime(&t));
     else
 	strlcpy(buf, "never", 64);
 }
@@ -400,6 +400,7 @@ kcm_run_events(krb5_context context, time_t now)
 {
     krb5_error_code ret;
     kcm_event **e;
+    const char *estr;
 
     HEIMDAL_MUTEX_lock(&events_mutex);
 
@@ -417,14 +418,18 @@ kcm_run_events(krb5_context context, time_t now)
 	if (now >= (*e)->fire_time) {
 	    ret = kcm_fire_event(context, e);
 	    if (ret) {
+		estr = krb5_get_error_message(context, ret);
 		kcm_log(1, "Could not fire event for cache %s: %s",
-			(*e)->ccache->name, krb5_get_err_text(context, ret));
+			(*e)->ccache->name, estr);
+		krb5_free_error_message(context, estr);
 	    }
 	} else if ((*e)->expire_time && now >= (*e)->expire_time) {
 	    ret = kcm_remove_event_internal(context, e);
 	    if (ret) {
+		estr = krb5_get_error_message(context, ret);
 		kcm_log(1, "Could not expire event for cache %s: %s",
-			(*e)->ccache->name, krb5_get_err_text(context, ret));
+			(*e)->ccache->name, estr);
+		krb5_free_error_message(context, estr);
 	    }
 	}
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/glue.c b/crypto/external/bsd/heimdal/dist/kcm/glue.c
index d44a74873..f7dbe5c16 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/glue.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: glue.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: glue.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -34,7 +34,7 @@
 
 #include "kcm_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: glue.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 /*
  * Server-side loopback glue for credentials cache operations; this
@@ -265,7 +265,16 @@ static const krb5_cc_ops krb5_kcmss_ops = {
     kcmss_end_get,
     kcmss_remove_cred,
     kcmss_set_flags,
-    kcmss_get_version
+    kcmss_get_version,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
 };
 
 krb5_error_code
diff --git a/crypto/external/bsd/heimdal/dist/kcm/headers.h b/crypto/external/bsd/heimdal/dist/kcm/headers.h
index a38946294..d935bc5f1 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/headers.h
+++ b/crypto/external/bsd/heimdal/dist/kcm/headers.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: headers.h,v 1.1.1.1 2011/04/13 18:14:36 elric Exp $	*/
+/*	$NetBSD: headers.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/kcm/kcm.8 b/crypto/external/bsd/heimdal/dist/kcm/kcm.8
index 3b30822ec..2724fa56e 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/kcm.8
+++ b/crypto/external/bsd/heimdal/dist/kcm/kcm.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kcm.8,v 1.4 2014/04/24 13:45:33 pettai Exp $
+.\"	$NetBSD: kcm.8,v 1.5 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -97,7 +97,7 @@
 is a process based credential cache.
 To use it, set the
 .Ev KRB5CCNAME
-enviroment variable to
+environment variable to
 .Ql KCM: Ns Ar uid
 or add the stanza
 .Bd -literal
diff --git a/crypto/external/bsd/heimdal/dist/kcm/kcm_locl.h b/crypto/external/bsd/heimdal/dist/kcm/kcm_locl.h
index e2c084bc8..99d1732e0 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/kcm_locl.h
+++ b/crypto/external/bsd/heimdal/dist/kcm/kcm_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kcm_locl.h,v 1.1.1.2 2011/04/14 14:08:11 elric Exp $	*/
+/*	$NetBSD: kcm_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -171,9 +171,8 @@ extern char *door_path;
 extern size_t max_request;
 extern sig_atomic_t exit_flag;
 extern int name_constraints;
-#ifdef SUPPORT_DETACH
 extern int detach_from_console;
-#endif
+extern int daemon_child;
 extern int launchd_flag;
 extern int disallow_getting_krbtgt;
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/log.c b/crypto/external/bsd/heimdal/dist/kcm/log.c
index bbb145f45..49852b739 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/log.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/log.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: log.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: log.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 2002 Kungliga Tekniska Högskolan
@@ -35,32 +35,32 @@
 
 #include "kcm_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: log.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
-static krb5_log_facility *logf;
+static krb5_log_facility *logfac;
 
 void
 kcm_openlog(void)
 {
     char **s = NULL, **p;
-    krb5_initlog(kcm_context, "kcm", &logf);
+    krb5_initlog(kcm_context, "kcm", &logfac);
     s = krb5_config_get_strings(kcm_context, NULL, "kcm", "logging", NULL);
     if(s == NULL)
 	s = krb5_config_get_strings(kcm_context, NULL, "logging", "kcm", NULL);
     if(s){
 	for(p = s; *p; p++)
-	    krb5_addlog_dest(kcm_context, logf, *p);
+	    krb5_addlog_dest(kcm_context, logfac, *p);
 	krb5_config_free_strings(s);
     }else
-	krb5_addlog_dest(kcm_context, logf, DEFAULT_LOG_DEST);
-    krb5_set_warn_dest(kcm_context, logf);
+	krb5_addlog_dest(kcm_context, logfac, DEFAULT_LOG_DEST);
+    krb5_set_warn_dest(kcm_context, logfac);
 }
 
 char*
 kcm_log_msg_va(int level, const char *fmt, va_list ap)
 {
     char *msg;
-    krb5_vlog_msg(kcm_context, logf, &msg, level, fmt, ap);
+    krb5_vlog_msg(kcm_context, logfac, &msg, level, fmt, ap);
     return msg;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/main.c b/crypto/external/bsd/heimdal/dist/kcm/main.c
index c37e72341..9802fb0c2 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/main.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/main.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: main.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: main.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan
@@ -35,20 +35,12 @@
 
 #include "kcm_locl.h"
 
-__RCSID("NetBSD");
-
-sig_atomic_t exit_flag = 0;
+__RCSID("$NetBSD: main.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 krb5_context kcm_context = NULL;
 
 const char *service_name = "org.h5l.kcm";
 
-static RETSIGTYPE
-sigterm(int sig)
-{
-    exit_flag = 1;
-}
-
 static RETSIGTYPE
 sigusr1(int sig)
 {
@@ -80,13 +72,9 @@ main(int argc, char **argv)
 	struct sigaction sa;
 
 	sa.sa_flags = 0;
-	sa.sa_handler = sigterm;
+	sa.sa_handler = sigusr1;
 	sigemptyset(&sa.sa_mask);
 
-	sigaction(SIGINT, &sa, NULL);
-	sigaction(SIGTERM, &sa, NULL);
-
-	sa.sa_handler = sigusr1;
 	sigaction(SIGUSR1, &sa, NULL);
 
 	sa.sa_handler = sigusr2;
@@ -96,17 +84,13 @@ main(int argc, char **argv)
 	sigaction(SIGPIPE, &sa, NULL);
     }
 #else
-    signal(SIGINT, sigterm);
-    signal(SIGTERM, sigterm);
     signal(SIGUSR1, sigusr1);
     signal(SIGUSR2, sigusr2);
     signal(SIGPIPE, SIG_IGN);
 #endif
-#ifdef SUPPORT_DETACH
-    if (detach_from_console)
-	daemon(0, 0);
-#endif
-    pidfile(NULL);
+    if (detach_from_console && !launchd_flag && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
+    rk_pidfile(NULL);
 
     if (launchd_flag) {
 	heim_sipc mach;
@@ -116,6 +100,8 @@ main(int argc, char **argv)
 	heim_sipc_service_unix(service_name, kcm_service, NULL, &un);
     }
 
+    roken_detach_finish(NULL, daemon_child);
+
     heim_ipc_main();
 
     krb5_free_context(kcm_context);
diff --git a/crypto/external/bsd/heimdal/dist/kcm/protocol.c b/crypto/external/bsd/heimdal/dist/kcm/protocol.c
index 483c02da8..e98b88a10 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/protocol.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/protocol.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: protocol.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: protocol.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -826,7 +826,7 @@ kcm_op_get_initial_ticket(krb5_context context,
 
     if (ret != 0) {
 	krb5_free_principal(context, server);
-	krb5_free_keyblock(context, &key);
+	krb5_free_keyblock_contents(context, &key);
     }
 
     kcm_release_ccache(context, ccache);
@@ -1072,6 +1072,7 @@ kcm_op_get_default_cache(krb5_context context,
     krb5_error_code ret;
     const char *name = NULL;
     char *n = NULL;
+    int aret;
 
     KCM_LOG_REQUEST(context, client, opcode);
 
@@ -1085,8 +1086,9 @@ kcm_op_get_default_cache(krb5_context context,
 	name = n = kcm_ccache_first_name(client);
 
     if (name == NULL) {
-	asprintf(&n, "%d", (int)client->uid);
-	name = n;
+	aret = asprintf(&n, "%d", (int)client->uid);
+	if (aret != -1)
+	    name = n;
     }
     if (name == NULL)
 	return ENOMEM;
@@ -1137,17 +1139,19 @@ kcm_op_set_default_cache(krb5_context context,
     }
     if (c == NULL) {
 	c = malloc(sizeof(*c));
-	if (c == NULL)
+	if (c == NULL) {
+            free(name);
 	    return ENOMEM;
+        }
 	c->session = client->session;
 	c->uid = client->uid;
-	c->name = strdup(name);
+	c->name = name;
 
 	c->next = default_caches;
 	default_caches = c;
     } else {
 	free(c->name);
-	c->name = strdup(name);
+	c->name = name;
     }
 
     return 0;
@@ -1497,7 +1501,7 @@ kcm_op_do_ntlm(krb5_context context,
      */
 
     if (1 || type2.targetinfo.length == 0) {
-	struct ntlm_buf sessionkey;
+	struct ntlm_buf tmpsesskey;
 
 	if (type2.flags & NTLM_NEG_NTLM2_SESSION) {
 	    unsigned char nonce[8];
@@ -1524,7 +1528,7 @@ kcm_op_do_ntlm(krb5_context context,
 
 	ret = heim_ntlm_build_ntlm1_master(c->nthash.data,
 					   c->nthash.length,
-					   &sessionkey,
+					   &tmpsesskey,
 					   &type3.sessionkey);
 	if (ret) {
 	    if (type3.lm.data)
@@ -1534,7 +1538,7 @@ kcm_op_do_ntlm(krb5_context context,
 	    goto error;
 	}
 
-	free(sessionkey.data);
+	free(tmpsesskey.data);
 	if (ret) {
 	    if (type3.lm.data)
 		free(type3.lm.data);
@@ -1629,7 +1633,7 @@ kcm_op_do_ntlm(krb5_context context,
     }
 #endif
 
-    ret = heim_ntlm_encode_type3(&type3, &ndata);
+    ret = heim_ntlm_encode_type3(&type3, &ndata, NULL);
     if (ret)
 	goto error;
 
diff --git a/crypto/external/bsd/heimdal/dist/kcm/renew.c b/crypto/external/bsd/heimdal/dist/kcm/renew.c
index ef094dcd8..6c5117010 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/renew.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/renew.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: renew.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: renew.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -34,7 +34,7 @@
 
 #include "kcm_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: renew.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
 
 krb5_error_code
 kcm_ccache_refresh(krb5_context context,
@@ -46,6 +46,7 @@ kcm_ccache_refresh(krb5_context context,
     krb5_kdc_flags flags;
     krb5_const_realm realm;
     krb5_ccache_data ccdata;
+    const char *estr;
 
     memset(&in, 0, sizeof(in));
 
@@ -68,8 +69,10 @@ kcm_ccache_refresh(krb5_context context,
     if (ccache->server != NULL) {
 	ret = krb5_copy_principal(context, ccache->server, &in.server);
 	if (ret) {
+	    estr = krb5_get_error_message(context, ret);
 	    kcm_log(0, "Failed to copy service principal: %s",
-		    krb5_get_err_text(context, ret));
+		    estr);
+	    krb5_free_error_message(context, estr);
 	    goto out;
 	}
     } else {
@@ -77,8 +80,10 @@ kcm_ccache_refresh(krb5_context context,
 	ret = krb5_make_principal(context, &in.server, realm,
 				  KRB5_TGS_NAME, realm, NULL);
 	if (ret) {
+	    estr = krb5_get_error_message(context, ret);
 	    kcm_log(0, "Failed to make TGS principal for realm %s: %s",
-		    realm, krb5_get_err_text(context, ret));
+		    realm, estr);
+	    krb5_free_error_message(context, estr);
 	    goto out;
 	}
     }
@@ -100,8 +105,10 @@ kcm_ccache_refresh(krb5_context context,
 			    &in,
 			    &out);
     if (ret) {
+	estr = krb5_get_error_message(context, ret);
 	kcm_log(0, "Failed to renew credentials for cache %s: %s",
-		ccache->name, krb5_get_err_text(context, ret));
+		ccache->name, estr);
+	krb5_free_error_message(context, estr);
 	goto out;
     }
 
@@ -110,8 +117,10 @@ kcm_ccache_refresh(krb5_context context,
 
     ret = kcm_ccache_store_cred_internal(context, ccache, out, 0, credp);
     if (ret) {
+	estr = krb5_get_error_message(context, ret);
 	kcm_log(0, "Failed to store credentials for cache %s: %s",
-		ccache->name, krb5_get_err_text(context, ret));
+		ccache->name, estr);
+	krb5_free_error_message(context, estr);
 	krb5_free_creds(context, out);
 	goto out;
     }
diff --git a/crypto/external/bsd/heimdal/dist/kcm/sessions.c b/crypto/external/bsd/heimdal/dist/kcm/sessions.c
index 1d017b15a..2c40a1809 100644
--- a/crypto/external/bsd/heimdal/dist/kcm/sessions.c
+++ b/crypto/external/bsd/heimdal/dist/kcm/sessions.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sessions.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: sessions.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kdc/Makefile.am b/crypto/external/bsd/heimdal/dist/kdc/Makefile.am
index fbd9c07d8..084d895b6 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/kdc/Makefile.am
@@ -2,7 +2,7 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_krb4) $(INCLUDE_hcrypto) -I$(srcdir)/../lib/krb5
+AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_openssl_crypto) -I$(srcdir)/../lib/krb5
 
 lib_LTLIBRARIES = libkdc.la
 
@@ -12,7 +12,7 @@ sbin_PROGRAMS = kstash
 
 libexec_PROGRAMS = hprop hpropd kdc digest-service
 
-noinst_PROGRAMS = kdc-replay
+noinst_PROGRAMS = kdc-replay kdc-tester
 
 man_MANS = kdc.8 kstash.8 hprop.8 hpropd.8 string2key.8
 
@@ -31,16 +31,20 @@ kdc_SOURCES = connect.c	\
 	announce.c	\
 	main.c
 
+kdc_tester_SOURCES = \
+	config.c	\
+	kdc-tester.c
+
 libkdc_la_SOURCES = 		\
-	kdc-private.h	 	\
-	kdc-protos.h	 	\
 	default_config.c 	\
 	set_dbinfo.c	 	\
 	digest.c		\
+	fast.c			\
 	kdc_locl.h		\
 	kerberos5.c		\
 	krb5tgs.c		\
 	pkinit.c		\
+	pkinit-ec.c		\
 	log.c			\
 	misc.c			\
 	kx509.c			\
@@ -48,8 +52,19 @@ libkdc_la_SOURCES = 		\
 	windc.c			\
 	rx.h
 
+KDC_PROTOS = $(srcdir)/kdc-protos.h $(srcdir)/kdc-private.h
 
-$(libkdc_la_OBJECTS): $(srcdir)/kdc-protos.h $(srcdir)/kdc-private.h
+ALL_OBJECTS  = $(kdc_OBJECTS)
+ALL_OBJECTS += $(kdc_replay_OBJECTS)
+ALL_OBJECTS += $(kdc_tester_OBJECTS)
+ALL_OBJECTS += $(libkdc_la_OBJECTS)
+ALL_OBJECTS += $(string2key_OBJECTS)
+ALL_OBJECTS += $(kstash_OBJECTS)
+ALL_OBJECTS += $(hprop_OBJECTS)
+ALL_OBJECTS += $(hpropd_OBJECTS)
+ALL_OBJECTS += $(digest_service_OBJECTS)
+
+$(ALL_OBJECTS): $(KDC_PROTOS)
 
 libkdc_la_LDFLAGS = -version-info 2:0:0
 
@@ -58,30 +73,30 @@ libkdc_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 $(libkdc_la_OBJECTS): $(srcdir)/version-script.map
 
-$(srcdir)/kdc-protos.h:
+$(srcdir)/kdc-protos.h: $(libkdc_la_SOURCES)
 	cd $(srcdir) && perl ../cf/make-proto.pl -q -P comment -o kdc-protos.h $(libkdc_la_SOURCES) || rm -f kdc-protos.h
 
-$(srcdir)/kdc-private.h:
+$(srcdir)/kdc-private.h: $(libkdc_la_SOURCES)
 	cd $(srcdir) && perl ../cf/make-proto.pl -q -P comment -p kdc-private.h $(libkdc_la_SOURCES) || rm -f kdc-private.h
 
 
 hprop_LDADD = \
 	$(top_builddir)/lib/hdb/libhdb.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
-	$(LIB_kdb) $(LIB_krb4) \
+	$(LIB_kdb)  \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_roken) \
-	$(DBLIB) 
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 hpropd_LDADD = \
 	$(top_builddir)/lib/hdb/libhdb.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
-	$(LIB_kdb) $(LIB_krb4) \
+	$(LIB_kdb)  \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_roken) \
-	$(DBLIB) 
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 if PKINIT
 LIB_pkinit = $(top_builddir)/lib/hx509/libhx509.la
@@ -91,20 +106,20 @@ libkdc_la_LIBADD = \
 	$(LIB_pkinit) \
 	$(top_builddir)/lib/hdb/libhdb.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
-	$(LIB_kdb) $(LIB_krb4) \
+	$(LIB_kdb)  \
 	$(top_builddir)/lib/ntlm/libheimntlm.la \
 	$(LIB_hcrypto) \
+	$(LIB_openssl_crypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_roken) \
-	$(DBLIB) 
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 LDADD = $(top_builddir)/lib/hdb/libhdb.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
-	$(LIB_krb4) \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_roken) \
-	$(DBLIB)
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 kdc_LDADD = libkdc.la $(LDADD) $(LIB_pidfile) $(CAPNG_LIBS)
 
@@ -119,9 +134,11 @@ digest_service_LDADD = \
 	$(top_builddir)/lib/ipc/libheim-ipcs.la \
 	$(LDADD) $(LIB_pidfile)
 kdc_replay_LDADD = libkdc.la $(LDADD) $(LIB_pidfile)
+kdc_tester_LDADD = libkdc.la $(LDADD) $(LIB_pidfile) $(LIB_heimbase)
 
-include_HEADERS = kdc.h kdc-protos.h
+include_HEADERS = kdc.h $(srcdir)/kdc-protos.h
 
+noinst_HEADERS = $(srcdir)/kdc-private.h
 
 krb5dir = $(includedir)/krb5
 krb5_HEADERS = windc_plugin.h
diff --git a/crypto/external/bsd/heimdal/dist/kdc/NTMakefile b/crypto/external/bsd/heimdal/dist/kdc/NTMakefile
index bb5b51069..c4bc69ab1 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/kdc/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2009, Secure Endpoints Inc.
+# Copyright (c) 2009-2016, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -67,11 +67,6 @@ $(LIBEXECDIR)\hprop.exe: $(OBJ)\hprop.obj $(OBJ)\mit_dump.obj $(BIN_LIBS) $(OBJ)
 	$(EXECONLINK)
 	$(EXEPREP)
 
-!ifdef KRB4
-$(LIBEXECDIR)\hprop.exe: $(OBJ)\v4_dump.obj
-!endif
-
-
 $(LIBEXECDIR)\hpropd.exe: $(OBJ)\hpropd.obj $(BIN_LIBS) $(OBJ)\hpropd-version.res
 	$(EXECONLINK)
 	$(EXEPREP)
@@ -91,7 +86,7 @@ $(BINDIR)\digest-service.exe: $(OBJ)\digest-service.obj $(BIN_LIBS)
 $(LIBEXECDIR)\kdc.exe: \
 		$(OBJ)\connect.obj $(OBJ)\config.obj $(OBJ)\announce.obj \
 		$(OBJ)\main.obj $(OBJ)\kdc-version.res \
-		$(LIBKDC) $(BIN_LIBS)
+		$(LIBKDC) $(BIN_LIBS) $(LIB_openssl_crypto)
 	$(EXECONLINK)
 	$(EXEPREP)
 
@@ -99,32 +94,30 @@ LIBKDC_OBJS=\
 	$(OBJ)\default_config.obj	\
 	$(OBJ)\set_dbinfo.obj 	\
 	$(OBJ)\digest.obj	\
+	$(OBJ)\fast.obj	\
 	$(OBJ)\kerberos5.obj	\
 	$(OBJ)\krb5tgs.obj	\
 	$(OBJ)\pkinit.obj	\
+	$(OBJ)\pkinit-ec.obj	\
 	$(OBJ)\log.obj		\
 	$(OBJ)\misc.obj		\
 	$(OBJ)\kx509.obj	\
 	$(OBJ)\process.obj	\
 	$(OBJ)\windc.obj
 
-!ifdef KRB4
-LIBKDC_OBJS=$(LIBKDC_OBJS) \
-	$(OBJ)\524.obj		\
-	$(OBJ)\kerberos4.obj
-!endif
-
 LIBKDC_LIBS=\
-	$(LIBHDB)	\
-	$(LIBHEIMDAL)	\
-	$(LIBHEIMNTLM)	\
+	$(LIBHDB)		\
+	$(LIBHEIMBASE)		\
+	$(LIBHEIMDAL)		\
+	$(LIBHEIMNTLM)		\
+	$(LIB_openssl_crypto)	\
 	$(LIBROKEN)
 
 LIBKDCRES=$(OBJ)\libkdc-version.res
 
 $(LIBEXECDIR)\libkdc.dll: $(LIBKDC_OBJS) $(LIBKDC_LIBS) $(LIBKDCRES)
 	$(DLLGUILINK) -implib:$(LIBKDC) -def:libkdc-exports.def
-	$(DLLPREP)
+	$(DLLPREP_NODIST)
 
 $(LIBKDC): $(LIBEXECDIR)\libkdc.dll
 
@@ -135,10 +128,12 @@ libkdc_la_SOURCES = 		\
 	default_config.c 	\
 	set_dbinfo.c	 	\
 	digest.c		\
+	fast.c		\
 	kdc_locl.h		\
 	kerberos5.c		\
 	krb5tgs.c		\
 	pkinit.c		\
+	pkinit-ec.c		\
 	log.c			\
 	misc.c			\
 	kx509.c			\
@@ -146,12 +141,6 @@ libkdc_la_SOURCES = 		\
 	windc.c			\
 	rx.h
 
-!ifdef KRB4
-libkdc_la_SOURCES=$(libkdc_la_SOURCES) \
-	524.c			\
-	kerberos4.c
-!endif
-
 $(OBJ)\kdc-protos.h: $(libkdc_la_SOURCES)
 	$(PERL) ..\cf\make-proto.pl -q -P remove -o $@ $(libkdc_la_SOURCES) \
 	|| $(RM) $@
diff --git a/crypto/external/bsd/heimdal/dist/kdc/announce.c b/crypto/external/bsd/heimdal/dist/kdc/announce.c
index d341f2ddb..694159547 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/announce.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/announce.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: announce.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: announce.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Apple Inc.  All Rights Reserved.
diff --git a/crypto/external/bsd/heimdal/dist/kdc/config.c b/crypto/external/bsd/heimdal/dist/kdc/config.c
index 8f5dcde92..051591960 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/config.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/config.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: config.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -54,9 +54,25 @@ static char *max_request_str;	/* `max_request' as a string */
 static int disable_des = -1;
 
 static int builtin_hdb_flag;
+int testing_flag;
 static int help_flag;
 static int version_flag;
 
+/* Should we enable the HTTP hack? */
+int enable_http = -1;
+
+/* Log over requests to the KDC */
+const char *request_log;
+
+/* A string describing on what ports to listen */
+const char *port_str;
+
+krb5_addresses explicit_addresses;
+
+size_t max_request_udp;
+size_t max_request_tcp;
+
+
 static struct getarg_strings addresses_str;	/* addresses to listen on */
 
 char *runas_string;
@@ -81,18 +97,19 @@ static struct getargs args[] = {
     {	"ports",	'P', 	arg_string, rk_UNCONST(&port_str),
 	"ports to listen to", "portspec"
     },
-#ifdef SUPPORT_DETACH
-#if DETACH_IS_DEFAULT
-    {
-	"detach",       'D',      arg_negative_flag, &detach_from_console,
-	"don't detach from console", NULL
-    },
-#else
     {
 	"detach",       0 ,      arg_flag, &detach_from_console,
 	"detach from console", NULL
     },
-#endif
+    {
+        "daemon-child",       0 ,      arg_flag, &daemon_child,
+        "private argument, do not use", NULL
+    },
+#ifdef __APPLE__
+    {
+        "bonjour",       0 ,      arg_flag, &do_bonjour,
+        "private argument, do not use", NULL
+    },
 #endif
     {	"addresses",	0,	arg_strings, &addresses_str,
 	"addresses to listen on", "list of addresses" },
@@ -106,6 +123,7 @@ static struct getargs args[] = {
     {   "chroot",	0,	arg_string, &chroot_string,
 	"chroot directory to run in", NULL
     },
+    {	"testing",	0,	arg_flag,   &testing_flag, NULL, NULL },
     {	"help",		'h',	arg_flag,   &help_flag, NULL, NULL },
     {	"version",	'v',	arg_flag,   &version_flag, NULL, NULL }
 };
@@ -136,17 +154,19 @@ add_one_address (krb5_context context, const char *str, int first)
 }
 
 krb5_kdc_configuration *
-configure(krb5_context context, int argc, char **argv)
+configure(krb5_context context, int argc, char **argv, int *optidx)
 {
     krb5_kdc_configuration *config;
     krb5_error_code ret;
-    int optidx = 0;
+    
     const char *p;
 
-    while(getarg(args, num_args, argc, argv, &optidx))
-	warnx("error at argument `%s'", argv[optidx]);
+    *optidx = 0;
 
-    if(help_flag)
+    while (getarg(args, num_args, argc, argv, optidx))
+	warnx("error at argument `%s'", argv[*optidx]);
+
+    if (help_flag)
 	usage (0);
 
     if (version_flag) {
@@ -164,18 +184,22 @@ configure(krb5_context context, int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optidx;
-    argv += optidx;
+    if(detach_from_console == -1)
+	detach_from_console = krb5_config_get_bool_default(context, NULL,
+							   FALSE,
+							   "kdc",
+							   "detach", NULL);
 
-    if (argc != 0)
-	usage(1);
+    if (detach_from_console && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
 
     {
 	char **files;
+	int aret;
 
 	if (config_file == NULL) {
-	    asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
-	    if (config_file == NULL)
+	    aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
+	    if (aret == -1 || config_file == NULL)
 		errx(1, "out of memory");
 	}
 
@@ -255,14 +279,6 @@ configure(krb5_context context, int argc, char **argv)
 	krb5_errx(context, 1, "enforce-transited-policy deprecated, "
 		  "use [kdc]transited-policy instead");
 
-#ifdef SUPPORT_DETACH
-    if(detach_from_console == -1)
-	detach_from_console = krb5_config_get_bool_default(context, NULL,
-							   DETACH_IS_DEFAULT,
-							   "kdc",
-							   "detach", NULL);
-#endif /* SUPPORT_DETACH */
-
     if(max_request_tcp == 0)
 	max_request_tcp = 64 * 1024;
     if(max_request_udp == 0)
diff --git a/crypto/external/bsd/heimdal/dist/kdc/connect.c b/crypto/external/bsd/heimdal/dist/kdc/connect.c
index 8072f62a3..eae8cfa89 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/connect.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/connect.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: connect.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: connect.c,v 1.2.4.1 2018/05/06 10:29:30 martin Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -35,20 +35,6 @@
 
 #include "kdc_locl.h"
 
-/* Should we enable the HTTP hack? */
-int enable_http = -1;
-
-/* Log over requests to the KDC */
-const char *request_log;
-
-/* A string describing on what ports to listen */
-const char *port_str;
-
-krb5_addresses explicit_addresses;
-
-size_t max_request_udp;
-size_t max_request_tcp;
-
 /*
  * a tuple describing on what to listen
  */
@@ -63,6 +49,7 @@ struct port_desc{
 
 static struct port_desc *ports;
 static size_t num_ports;
+static pid_t bonjour_pid = -1;
 
 /*
  * add `family, port, protocol' to the list with duplicate suppresion.
@@ -274,6 +261,7 @@ init_socket(krb5_context context,
 	d->s = rk_INVALID_SOCKET;
 	return;
     }
+    rk_cloexec(d->s);
 #if defined(HAVE_SETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_REUSEADDR)
     {
 	int one = 1;
@@ -283,6 +271,8 @@ init_socket(krb5_context context,
     d->type = type;
     d->port = port;
 
+    socket_set_nonblocking(d->s, 1);
+
     if(rk_IS_SOCKET_ERROR(bind(d->s, sa, sa_size))){
 	char a_str[256];
 	size_t len;
@@ -473,16 +463,18 @@ handle_udp(krb5_context context,
     ssize_t n;
 
     buf = malloc(max_request_udp);
-    if(buf == NULL){
-	kdc_log(context, config, 0, "Failed to allocate %lu bytes", (unsigned long)max_request_udp);
+    if (buf == NULL){
+	kdc_log(context, config, 0, "Failed to allocate %lu bytes",
+	        (unsigned long)max_request_udp);
 	return;
     }
 
     d->sock_len = sizeof(d->__ss);
     n = recvfrom(d->s, buf, max_request_udp, 0, d->sa, &d->sock_len);
-    if(rk_IS_SOCKET_ERROR(n))
-	krb5_warn(context, rk_SOCK_ERRNO, "recvfrom");
-    else {
+    if (rk_IS_SOCKET_ERROR(n)) {
+	if (rk_SOCK_ERRNO != EAGAIN && rk_SOCK_ERRNO != EINTR)
+	    krb5_warn(context, rk_SOCK_ERRNO, "recvfrom");
+    } else {
 	addr_to_string (context, d->sa, d->sock_len,
 			d->addr_string, sizeof(d->addr_string));
 	if ((size_t)n == max_request_udp) {
@@ -558,7 +550,8 @@ add_new_tcp (krb5_context context,
     d[child].sock_len = sizeof(d[child].__ss);
     s = accept(d[parent].s, d[child].sa, &d[child].sock_len);
     if(rk_IS_BAD_SOCKET(s)) {
-	krb5_warn(context, rk_SOCK_ERRNO, "accept");
+	if (rk_SOCK_ERRNO != EAGAIN && rk_SOCK_ERRNO != EINTR)
+	    krb5_warn(context, rk_SOCK_ERRNO, "accept");
 	return;
     }
 
@@ -697,7 +690,7 @@ handle_http_tcp (krb5_context context,
 	free(data);
 	return -1;
     }
-    len = base64_decode(t, data);
+    len = rk_base64_decode(t, data);
     if(len <= 0){
 	const char *msg =
 	    " 404 Not found\r\n"
@@ -840,6 +833,19 @@ handle_tcp(krb5_context context,
     }
 }
 
+#ifdef HAVE_FORK
+static void
+handle_islive(int fd)
+{
+    char buf;
+    int ret;
+
+    ret = read(fd, &buf, 1);
+    if (ret != 1)
+	exit_flag = -1;
+}
+#endif
+
 krb5_boolean
 realloc_descrs(struct descr **d, unsigned int *ndescr)
 {
@@ -882,18 +888,12 @@ next_min_free(krb5_context context, struct descr **d, unsigned int *ndescr)
     return min_free;
 }
 
-void
-loop(krb5_context context,
-     krb5_kdc_configuration *config)
+static void
+loop(krb5_context context, krb5_kdc_configuration *config,
+     struct descr *d, unsigned int ndescr, int islive)
 {
-    struct descr *d;
-    unsigned int ndescr;
 
-    ndescr = init_sockets(context, config, &d);
-    if(ndescr <= 0)
-	krb5_errx(context, 1, "No sockets!");
-    kdc_log(context, config, 0, "KDC started");
-    while(exit_flag == 0){
+    while (exit_flag == 0) {
 	struct timeval tmout;
 	fd_set fds;
 	int min_free = -1;
@@ -901,9 +901,13 @@ loop(krb5_context context,
 	size_t i;
 
 	FD_ZERO(&fds);
-	for(i = 0; i < ndescr; i++) {
-	    if(!rk_IS_BAD_SOCKET(d[i].s)){
-		if(d[i].type == SOCK_STREAM &&
+        if (islive > -1) {
+            FD_SET(islive, &fds);
+            max_fd = islive;
+        }
+	for (i = 0; i < ndescr; i++) {
+	    if (!rk_IS_BAD_SOCKET(d[i].s)) {
+		if (d[i].type == SOCK_STREAM &&
 		   d[i].timeout && d[i].timeout < time(NULL)) {
 		    kdc_log(context, config, 1,
 			    "TCP-connection from %s expired after %lu bytes",
@@ -912,7 +916,7 @@ loop(krb5_context context,
 		    continue;
 		}
 #ifndef NO_LIMIT_FD_SETSIZE
-		if(max_fd < d[i].s)
+		if (max_fd < d[i].s)
 		    max_fd = d[i].s;
 #ifdef FD_SETSIZE
 		if (max_fd >= FD_SETSIZE)
@@ -933,25 +937,333 @@ loop(krb5_context context,
 		krb5_warn(context, rk_SOCK_ERRNO, "select");
 	    break;
 	default:
-	    for(i = 0; i < ndescr; i++)
-		if(!rk_IS_BAD_SOCKET(d[i].s) && FD_ISSET(d[i].s, &fds)) {
-            min_free = next_min_free(context, &d, &ndescr);
+#ifdef HAVE_FORK
+	    if (islive > -1 && FD_ISSET(islive, &fds))
+		handle_islive(islive);
+#endif
+	    for (i = 0; i < ndescr; i++)
+		if (!rk_IS_BAD_SOCKET(d[i].s) && FD_ISSET(d[i].s, &fds)) {
+		    min_free = next_min_free(context, &d, &ndescr);
 
-            if(d[i].type == SOCK_DGRAM)
-                handle_udp(context, config, &d[i]);
-            else if(d[i].type == SOCK_STREAM)
-                handle_tcp(context, config, d, i, min_free);
+		    if (d[i].type == SOCK_DGRAM)
+			handle_udp(context, config, &d[i]);
+		    else if (d[i].type == SOCK_STREAM)
+			handle_tcp(context, config, d, i, min_free);
 		}
 	}
     }
-    if (0);
+
+    switch (exit_flag) {
+    case -1:
+	kdc_log(context, config, 0,
+                "KDC worker process exiting because KDC master exited.");
+	break;
 #ifdef SIGXCPU
-    else if(exit_flag == SIGXCPU)
+    case SIGXCPU:
 	kdc_log(context, config, 0, "CPU time limit exceeded");
+	break;
 #endif
-    else if(exit_flag == SIGINT || exit_flag == SIGTERM)
+    case SIGINT:
+    case SIGTERM:
 	kdc_log(context, config, 0, "Terminated");
-    else
+	break;
+    default:
 	kdc_log(context, config, 0, "Unexpected exit reason: %d", exit_flag);
-    free (d);
+	break;
+    }
+}
+
+#ifdef __APPLE__
+static void
+bonjour_kid(krb5_context context, krb5_kdc_configuration *config, const char *argv0, int *islive)
+{
+    char buf;
+
+    if (do_bonjour > 0) {
+	bonjour_announce(context, config);
+
+	while (read(0, &buf, 1) == 1)
+	    continue;
+	_exit(0);
+    }
+
+    if ((bonjour_pid = fork()) != 0)
+	return;
+
+    close(islive[0]);
+    if (dup2(islive[1], 0) == -1)
+	err(1, "failed to announce with bonjour (dup)");
+    if (islive[1] != 0)
+        close(islive[1]);
+    execlp(argv0, "kdc", "--bonjour", NULL);
+    err(1, "failed to announce with bonjour (exec)");
+}
+#endif
+
+#ifdef HAVE_FORK
+static void
+kill_kids(pid_t *pids, int max_kids, int sig)
+{
+    int i;
+
+    for (i=0; i < max_kids; i++)
+	if (pids[i] > 0)
+	    kill(sig, pids[i]);
+    if (bonjour_pid > 0)
+        kill(sig, bonjour_pid);
+}
+
+static int
+reap_kid(krb5_context context, krb5_kdc_configuration *config,
+	 pid_t *pids, int max_kids, int options)
+{
+    pid_t pid;
+    char *what;
+    int status;
+    int i = 0; /* quiet warnings */
+
+    pid = waitpid(-1, &status, options);
+    if (pid < 1)
+	return 0;
+
+    if (pid != bonjour_pid) {
+        for (i=0; i < max_kids; i++) {
+            if (pids[i] == pid)
+                break;
+        }
+
+        if (i == max_kids) {
+            /* XXXrcd: this should not happen, have to do something, though */
+            return 0;
+        }
+    }
+
+    if (pid == bonjour_pid)
+        what = "bonjour";
+    else
+        what = "worker";
+    if (WIFEXITED(status))
+        kdc_log(context, config, 0, "KDC reaped %s process: %d, exit status: %d",
+                what, (int)pid, WEXITSTATUS(status));
+    else if (WIFSIGNALED(status))
+        kdc_log(context, config, 0, "KDC reaped %s process: %d, term signal %d%s",
+                what, (int)pid, WTERMSIG(status),
+                WCOREDUMP(status) ? " (core dumped)" : "");
+    else
+        kdc_log(context, config, 0, "KDC reaped %s process: %d",
+                what, (int)pid);
+    if (pid == bonjour_pid) {
+        bonjour_pid = (pid_t)-1;
+        return 0;
+    } else {
+        pids[i] = (pid_t)-1;
+        return 1;
+    }
+}
+
+static int
+reap_kids(krb5_context context, krb5_kdc_configuration *config,
+	  pid_t *pids, int max_kids)
+{
+    int reaped = 0;
+
+    for (;;) {
+	if (reap_kid(context, config, pids, max_kids, WNOHANG) == 0)
+	    break;
+	reaped++;
+    }
+
+    return reaped;
+}
+
+static void
+select_sleep(int microseconds)
+{
+    struct timeval tv;
+
+    tv.tv_sec = microseconds / 1000000;
+    tv.tv_usec = microseconds % 1000000;
+    select(0, NULL, NULL, NULL, &tv);
+}
+#endif
+
+void
+start_kdc(krb5_context context,
+	  krb5_kdc_configuration *config, const char *argv0)
+{
+    struct timeval tv1;
+    struct timeval tv2;
+    struct descr *d;
+    unsigned int ndescr;
+    pid_t pid = -1;
+#ifdef HAVE_FORK
+    pid_t *pids;
+    int max_kdcs = config->num_kdc_processes;
+    int num_kdcs = 0;
+    int i;
+    int islive[2];
+#endif
+
+#ifdef __APPLE__
+    if (do_bonjour > 0)
+        bonjour_kid(context, config, argv0, NULL);
+#endif
+
+#ifdef HAVE_FORK
+#ifdef _SC_NPROCESSORS_ONLN
+    if (max_kdcs < 1)
+	max_kdcs = sysconf(_SC_NPROCESSORS_ONLN);
+#endif
+
+    if (max_kdcs < 1)
+	max_kdcs = 1;
+
+    pids = calloc(max_kdcs, sizeof(*pids));
+    if (!pids)
+	krb5_err(context, 1, errno, "malloc");
+
+    /*
+     * We open a socketpair of which we hand one end to each of our kids.
+     * When we exit, for whatever reason, the children will notice an EOF
+     * on their end and be able to cleanly exit.
+     */
+
+    if (socketpair(PF_LOCAL, SOCK_STREAM, 0, islive) == -1)
+	krb5_errx(context, 1, "socketpair");
+    socket_set_nonblocking(islive[1], 1);
+#endif
+
+    ndescr = init_sockets(context, config, &d);
+    if(ndescr <= 0)
+	krb5_errx(context, 1, "No sockets!");
+
+#ifdef HAVE_FORK
+
+# ifdef __APPLE__
+    if (do_bonjour < 0)
+        bonjour_kid(context, config, argv0, islive);
+# endif
+
+    kdc_log(context, config, 0, "KDC started master process pid=%d", getpid());
+#else
+    kdc_log(context, config, 0, "KDC started pid=%d", getpid());
+#endif
+
+    roken_detach_finish(NULL, daemon_child);
+
+    tv1.tv_sec  = 0;
+    tv1.tv_usec = 0;
+
+#ifdef HAVE_FORK
+    if (!testing_flag) {
+        /* Note that we might never execute the body of this loop */
+        while (exit_flag == 0) {
+
+            /* Slow down the creation of KDCs... */
+
+            gettimeofday(&tv2, NULL);
+            if (tv1.tv_sec == tv2.tv_sec && tv2.tv_usec - tv1.tv_usec < 25000) {
+#if 0	/* XXXrcd: should print a message... */
+                kdc_log(context, config, 0, "Spawning KDCs too quickly, "
+                    "pausing for 50ms");
+#endif
+                select_sleep(12500);
+                continue;
+            }
+
+            if (num_kdcs >= max_kdcs) {
+                num_kdcs -= reap_kid(context, config, pids, max_kdcs, 0);
+                continue;
+            }
+
+            if (num_kdcs > 0)
+                num_kdcs -= reap_kids(context, config, pids, max_kdcs);
+
+            pid = fork();
+            switch (pid) {
+            case 0:
+                close(islive[0]);
+                loop(context, config, d, ndescr, islive[1]);
+                exit(0);
+            case -1:
+                /* XXXrcd: hmmm, do something useful?? */
+                kdc_log(context, config, 0,
+                        "KDC master process could not fork worker process");
+                sleep(10);
+                break;
+            default:
+                for (i=0; i < max_kdcs; i++) {
+                    if (pids[i] < 1) {
+                        pids[i] = pid;
+                        break;
+                    }
+                }
+                kdc_log(context, config, 0, "KDC worker process started: %d",
+                        pid);
+                num_kdcs++;
+                gettimeofday(&tv1, NULL);
+                break;
+            }
+        }
+
+        /* Closing these sockets should cause the kids to die... */
+
+        close(islive[0]);
+        close(islive[1]);
+
+        /* Close our listener sockets before terminating workers */
+        for (i = 0; i < ndescr; ++i)
+            clear_descr(&d[i]);
+
+        gettimeofday(&tv1, NULL);
+        tv2 = tv1;
+
+        /* Reap every 10ms, terminate stragglers once a second, give up after 10 */
+        for (;;) {
+            struct timeval tv3;
+            num_kdcs -= reap_kids(context, config, pids, max_kdcs);
+            if (num_kdcs == 0 && bonjour_pid <= 0)
+                goto end;
+            /*
+             * Using select to sleep will fail with EINTR if we receive a
+             * SIGCHLD.  This is desirable.
+             */
+            select_sleep(10000);
+            gettimeofday(&tv3, NULL);
+            if (tv3.tv_sec - tv1.tv_sec > 10 ||
+                (tv3.tv_sec - tv1.tv_sec == 10 && tv3.tv_usec >= tv1.tv_usec))
+                break;
+            if (tv3.tv_sec - tv2.tv_sec > 1 ||
+                (tv3.tv_sec - tv2.tv_sec == 1 && tv3.tv_usec >= tv2.tv_usec)) {
+                kill_kids(pids, max_kdcs, SIGTERM);
+                tv2 = tv3;
+            }
+        }
+
+        /* Kill stragglers and reap every 200ms, give up after 15s */
+        for (;;) {
+            kill_kids(pids, max_kdcs, SIGKILL);
+            num_kdcs -= reap_kids(context, config, pids, max_kdcs);
+            if (num_kdcs == 0 && bonjour_pid <= 0)
+                break;
+            select_sleep(200000);
+            gettimeofday(&tv2, NULL);
+            if (tv2.tv_sec - tv1.tv_sec > 15 ||
+                (tv2.tv_sec - tv1.tv_sec == 15 && tv2.tv_usec >= tv1.tv_usec))
+                break;
+        }
+
+     end:
+        kdc_log(context, config, 0, "KDC master process exiting", pid);
+        free(pids);
+    } else {
+        loop(context, config, d, ndescr, -1);
+        kdc_log(context, config, 0, "KDC exiting", pid);
+    }
+#else
+    loop(context, config, d, ndescr, -1);
+    kdc_log(context, config, 0, "KDC exiting", pid);
+#endif
+
+    free(d);
 }
diff --git a/crypto/external/bsd/heimdal/dist/kdc/default_config.c b/crypto/external/bsd/heimdal/dist/kdc/default_config.c
index 45ccf21c1..24c666f89 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/default_config.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/default_config.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: default_config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: default_config.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -50,6 +50,7 @@ krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
 	return ENOMEM;
     }
 
+    c->num_kdc_processes = -1;
     c->require_preauth = TRUE;
     c->kdc_warn_pwexpire = 0;
     c->encode_as_rep_as_tgs_rep = FALSE;
@@ -60,6 +61,7 @@ krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
     c->check_ticket_addresses = TRUE;
     c->allow_null_ticket_addresses = TRUE;
     c->allow_anonymous = FALSE;
+    c->strict_nametypes = FALSE;
     c->trpolicy = TRPOLICY_ALWAYS_CHECK;
     c->enable_pkinit = FALSE;
     c->pkinit_princ_in_cert = TRUE;
@@ -68,6 +70,10 @@ krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
     c->num_db = 0;
     c->logf = NULL;
 
+    c->num_kdc_processes =
+        krb5_config_get_int_default(context, NULL, c->num_kdc_processes,
+				    "kdc", "num-kdc-processes", NULL);
+
     c->require_preauth =
 	krb5_config_get_bool_default(context, NULL,
 				     c->require_preauth,
@@ -160,6 +166,12 @@ krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
 				     "kdc",
 				     "allow-anonymous", NULL);
 
+    c->strict_nametypes =
+	krb5_config_get_bool_default(context, NULL,
+				     c->strict_nametypes,
+				     "kdc",
+				     "strict-nametypes", NULL);
+
     c->max_datagram_reply_length =
 	krb5_config_get_int_default(context,
 				    NULL,
diff --git a/crypto/external/bsd/heimdal/dist/kdc/digest-service.c b/crypto/external/bsd/heimdal/dist/kdc/digest-service.c
index 8fe771a80..7a9f1ab39 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/digest-service.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/digest-service.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: digest-service.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: digest-service.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -46,6 +46,8 @@
 typedef struct pk_client_params pk_client_params;
 struct DigestREQ;
 struct Kx509Request;
+typedef struct kdc_request_desc *kdc_request_t;
+
 #include <kdc-private.h>
 
 krb5_kdc_configuration *config;
@@ -118,7 +120,7 @@ ntlm_service(void *ctx, const heim_idata *req,
 	if (ret)
 	    goto failed;
 
-	ret = hdb_enctype2key(context, &user->entry,
+	ret = hdb_enctype2key(context, &user->entry, NULL,
 			      ETYPE_ARCFOUR_HMAC_MD5, &key);
 	if (ret) {
 	    krb5_set_error_message(context, ret, "NTLM missing arcfour key");
diff --git a/crypto/external/bsd/heimdal/dist/kdc/digest.c b/crypto/external/bsd/heimdal/dist/kdc/digest.c
index 31eed38dc..749dec30e 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/digest.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/digest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: digest.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: digest.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -240,7 +240,7 @@ _kdc_do_digest(krb5_context context,
 
     kdc_log(context, config, 0, "Digest request from %s", from);
 
-    ret = krb5_kt_resolve(context, "HDB:", &id);
+    ret = krb5_kt_resolve(context, "HDBGET:", &id);
     if (ret) {
 	kdc_log(context, config, 0, "Can't open database for digest");
 	goto out;
@@ -408,11 +408,12 @@ _kdc_do_digest(krb5_context context,
 
 	if (ireq.u.init.channel) {
 	    char *s;
+	    int aret;
 
-	    asprintf(&s, "%s-%s:%s", r.u.initReply.nonce,
-		     ireq.u.init.channel->cb_type,
-		     ireq.u.init.channel->cb_binding);
-	    if (s == NULL) {
+	    aret = asprintf(&s, "%s-%s:%s", r.u.initReply.nonce,
+			    ireq.u.init.channel->cb_type,
+			    ireq.u.init.channel->cb_binding);
+	    if (aret == -1 || s == NULL) {
 		ret = ENOMEM;
 		krb5_set_error_message(context, ret,
 				       "Failed to allocate channel binding");
@@ -429,6 +430,8 @@ _kdc_do_digest(krb5_context context,
 	}
 
 	if (strcasecmp(ireq.u.init.type, "CHAP") == 0) {
+	    int aret;
+
 	    r.u.initReply.identifier =
 		malloc(sizeof(*r.u.initReply.identifier));
 	    if (r.u.initReply.identifier == NULL) {
@@ -437,8 +440,8 @@ _kdc_do_digest(krb5_context context,
 		goto out;
 	    }
 
-	    asprintf(r.u.initReply.identifier, "%02X", identifier & 0xff);
-	    if (*r.u.initReply.identifier == NULL) {
+	    aret = asprintf(r.u.initReply.identifier, "%02X", identifier&0xff);
+	    if (aret == -1 || *r.u.initReply.identifier == NULL) {
 		ret = ENOMEM;
 		krb5_set_error_message(context, ret, "malloc: out of memory");
 		goto out;
@@ -607,7 +610,7 @@ _kdc_do_digest(krb5_context context,
 	    }
 	    t = p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 
-	    if (abs((kdc_time & 0xffffffff) - t) > context->max_skew) {
+	    if (labs((kdc_time & 0xffffffff) - t) > context->max_skew) {
 		ret = EINVAL;
 		krb5_set_error_message(context, ret, "time screw in server nonce ");
 		goto out;
@@ -800,7 +803,7 @@ _kdc_do_digest(krb5_context context,
 	    }
 
 	} else if (strcasecmp(ireq.u.digestRequest.type, "MS-CHAP-V2") == 0) {
-	    unsigned char md[SHA_DIGEST_LENGTH], challange[SHA_DIGEST_LENGTH];
+	    unsigned char md[SHA_DIGEST_LENGTH], challenge[SHA_DIGEST_LENGTH];
 	    krb5_principal clientprincipal = NULL;
 	    char *mdx;
 	    const char *username;
@@ -835,7 +838,7 @@ _kdc_do_digest(krb5_context context,
 
 	    ctp = EVP_MD_CTX_create();
 
-	    /* ChallangeHash */
+	    /* ChallengeHash */
 	    EVP_DigestInit_ex(ctp, EVP_sha1(), NULL);
 	    {
 		ssize_t ssize;
@@ -866,7 +869,7 @@ _kdc_do_digest(krb5_context context,
 	    EVP_DigestUpdate(ctp, serverNonce.data, serverNonce.length);
 	    EVP_DigestUpdate(ctp, username, strlen(username));
 
-	    EVP_DigestFinal_ex(ctp, challange, NULL);
+	    EVP_DigestFinal_ex(ctp, challenge, NULL);
 
 	    EVP_MD_CTX_destroy(ctp);
 
@@ -885,7 +888,7 @@ _kdc_do_digest(krb5_context context,
 		goto failed;
 	    }
 
-	    ret = hdb_enctype2key(context, &user->entry,
+	    ret = hdb_enctype2key(context, &user->entry, NULL,
 				  ETYPE_ARCFOUR_HMAC_MD5, &key);
 	    if (ret) {
 		krb5_set_error_message(context, ret,
@@ -897,7 +900,7 @@ _kdc_do_digest(krb5_context context,
 	    /* ChallengeResponse */
 	    ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
 					    key->key.keyvalue.length,
-					    challange, &answer);
+					    challenge, &answer);
 	    if (ret) {
 		krb5_set_error_message(context, ret, "NTLM missing arcfour key");
 		goto failed;
@@ -948,7 +951,7 @@ _kdc_do_digest(krb5_context context,
 
 		EVP_DigestInit_ex(ctxp, EVP_sha1(), NULL);
 		EVP_DigestUpdate(ctxp, md, sizeof(md));
-		EVP_DigestUpdate(ctxp, challange, 8);
+		EVP_DigestUpdate(ctxp, challenge, 8);
 		EVP_DigestUpdate(ctxp, ms_chap_v2_magic2,
 				 sizeof(ms_chap_v2_magic2));
 		EVP_DigestFinal_ex(ctxp, md, NULL);
@@ -999,10 +1002,12 @@ _kdc_do_digest(krb5_context context,
 	    }
 
 	} else {
+	    int aret;
+
 	    r.element = choice_DigestRepInner_error;
-	    asprintf(&r.u.error.reason, "Unsupported digest type %s",
-		     ireq.u.digestRequest.type);
-	    if (r.u.error.reason == NULL) {
+	    aret = asprintf(&r.u.error.reason, "Unsupported digest type %s",
+			    ireq.u.digestRequest.type);
+	    if (aret == -1 || r.u.error.reason == NULL) {
 		ret = ENOMEM;
 		krb5_set_error_message(context, ret, "malloc: out of memory");
 		goto out;
@@ -1061,15 +1066,15 @@ _kdc_do_digest(krb5_context context,
 	    krb5_set_error_message(context, ret, "malloc: out of memory");
 	    goto out;
 	}
-	r.u.ntlmInitReply.challange.data = malloc(8);
-	if (r.u.ntlmInitReply.challange.data == NULL) {
+	r.u.ntlmInitReply.challenge.data = malloc(8);
+	if (r.u.ntlmInitReply.challenge.data == NULL) {
 	    ret = ENOMEM;
 	    krb5_set_error_message(context, ret, "malloc: out of memory");
 	    goto out;
 	}
-	r.u.ntlmInitReply.challange.length = 8;
-	if (RAND_bytes(r.u.ntlmInitReply.challange.data,
-		       r.u.ntlmInitReply.challange.length) != 1)
+	r.u.ntlmInitReply.challenge.length = 8;
+	if (RAND_bytes(r.u.ntlmInitReply.challenge.data,
+		       r.u.ntlmInitReply.challenge.length) != 1)
 	    {
 		ret = ENOMEM;
 		krb5_set_error_message(context, ret, "out of random error");
@@ -1104,10 +1109,10 @@ _kdc_do_digest(krb5_context context,
 	    goto out;
 	}
 
-	ret = krb5_storage_write(sp, r.u.ntlmInitReply.challange.data, 8);
+	ret = krb5_storage_write(sp, r.u.ntlmInitReply.challenge.data, 8);
 	if (ret != 8) {
 	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, "storage write challange");
+	    krb5_set_error_message(context, ret, "storage write challenge");
 	    goto out;
 	}
 	ret = krb5_store_uint32(sp, r.u.ntlmInitReply.flags);
@@ -1141,7 +1146,7 @@ _kdc_do_digest(krb5_context context,
     case choice_DigestReqInner_ntlmRequest: {
 	krb5_principal clientprincipal;
 	unsigned char sessionkey[16];
-	unsigned char challange[8];
+	unsigned char challenge[8];
 	uint32_t flags;
 	Key *key = NULL;
 	int version;
@@ -1190,10 +1195,10 @@ _kdc_do_digest(krb5_context context,
 	    goto out;
 	}
 
-	ret = krb5_storage_read(sp, challange, sizeof(challange));
-	if (ret != sizeof(challange)) {
+	ret = krb5_storage_read(sp, challenge, sizeof(challenge));
+	if (ret != sizeof(challenge)) {
 	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, "NTLM storage read challange");
+	    krb5_set_error_message(context, ret, "NTLM storage read challenge");
 	    goto out;
 	}
 	ret = krb5_ret_uint32(sp, &flags);
@@ -1211,7 +1216,7 @@ _kdc_do_digest(krb5_context context,
 	    goto out;
 	}
 
-	ret = hdb_enctype2key(context, &user->entry,
+	ret = hdb_enctype2key(context, &user->entry, NULL,
 			      ETYPE_ARCFOUR_HMAC_MD5, &key);
 	if (ret) {
 	    krb5_set_error_message(context, ret, "NTLM missing arcfour key");
@@ -1245,7 +1250,7 @@ _kdc_do_digest(krb5_context context,
 					 ireq.u.ntlmRequest.username,
 					 targetname,
 					 0,
-					 challange,
+					 challenge,
 					 &answer,
 					 &infotarget,
 					 sessionkey);
@@ -1286,10 +1291,10 @@ _kdc_do_digest(krb5_context context,
 
 		EVP_DigestInit_ex(ctx, EVP_md5(), NULL);
 
-		EVP_DigestUpdate(ctx, challange, sizeof(challange));
+		EVP_DigestUpdate(ctx, challenge, sizeof(challenge));
 		EVP_DigestUpdate(ctx, ireq.u.ntlmRequest.lm.data, 8);
 		EVP_DigestFinal_ex(ctx, sessionhash, NULL);
-		memcpy(challange, sessionhash, sizeof(challange));
+		memcpy(challenge, sessionhash, sizeof(challenge));
 
 		EVP_MD_CTX_destroy(ctx);
 
@@ -1302,7 +1307,7 @@ _kdc_do_digest(krb5_context context,
 
 	    ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
 					    key->key.keyvalue.length,
-					    challange, &answer);
+					    challenge, &answer);
 	    if (ret) {
 		krb5_set_error_message(context, ret, "NTLM missing arcfour key");
 		goto failed;
diff --git a/crypto/external/bsd/heimdal/dist/kdc/fast.c b/crypto/external/bsd/heimdal/dist/kdc/fast.c
new file mode 100644
index 000000000..ede361dd1
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/kdc/fast.c
@@ -0,0 +1,562 @@
+/*	$NetBSD: fast.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997-2011 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 - 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kdc_locl.h"
+
+static krb5_error_code
+get_fastuser_crypto(kdc_request_t r, krb5_enctype enctype, krb5_crypto *crypto)
+{
+    krb5_principal fast_princ;
+    hdb_entry_ex *fast_user = NULL;
+    Key *cookie_key = NULL;
+    krb5_error_code ret;
+
+    *crypto = NULL;
+
+    ret = krb5_make_principal(r->context, &fast_princ,
+			      KRB5_WELLKNOWN_ORG_H5L_REALM,
+			      KRB5_WELLKNOWN_NAME, "org.h5l.fast-cookie", NULL);
+    if (ret)
+	goto out;
+
+    ret = _kdc_db_fetch(r->context, r->config, fast_princ,
+			HDB_F_GET_CLIENT, NULL, NULL, &fast_user);
+    krb5_free_principal(r->context, fast_princ);
+    if (ret)
+	goto out;
+
+    if (enctype == KRB5_ENCTYPE_NULL)
+	ret = _kdc_get_preferred_key(r->context, r->config, fast_user,
+				     "fast-cookie", &enctype, &cookie_key);
+    else
+	ret = hdb_enctype2key(r->context, &fast_user->entry, NULL,
+			      enctype, &cookie_key);
+    if (ret)
+	goto out;
+
+    ret = krb5_crypto_init(r->context, &cookie_key->key, 0, crypto);
+    if (ret)
+	goto out;
+
+ out:
+    if (fast_user)
+	_kdc_free_ent(r->context, fast_user);
+
+    return ret;
+}
+
+
+static krb5_error_code
+fast_parse_cookie(kdc_request_t r, const PA_DATA *pa)
+{
+    krb5_crypto crypto = NULL;
+    krb5_error_code ret;
+    KDCFastCookie data;
+    krb5_data d1;
+    size_t len;
+
+    ret = decode_KDCFastCookie(pa->padata_value.data,
+			       pa->padata_value.length,
+			       &data, &len);
+    if (ret)
+	return ret;
+
+    if (len != pa->padata_value.length || strcmp("H5L1", data.version) != 0) {
+	free_KDCFastCookie(&data);
+	return KRB5KDC_ERR_POLICY;
+    }
+
+    ret = get_fastuser_crypto(r, data.cookie.etype, &crypto);
+    if (ret)
+	goto out;
+
+    ret = krb5_decrypt_EncryptedData(r->context, crypto,
+				     KRB5_KU_H5L_COOKIE,
+				     &data.cookie, &d1);
+    krb5_crypto_destroy(r->context, crypto);
+    if (ret)
+	goto out;
+
+    ret = decode_KDCFastState(d1.data, d1.length, &r->fast, &len);
+    krb5_data_free(&d1);
+    if (ret)
+	goto out;
+
+    if (r->fast.expiration < kdc_time) {
+	kdc_log(r->context, r->config, 0, "fast cookie expired");
+	ret = KRB5KDC_ERR_POLICY;
+	goto out;
+    }
+
+ out:
+    free_KDCFastCookie(&data);
+
+    return ret;
+}
+
+static krb5_error_code
+fast_add_cookie(kdc_request_t r, METHOD_DATA *method_data)
+{
+    krb5_crypto crypto = NULL;
+    KDCFastCookie shell;
+    krb5_error_code ret;
+    krb5_data data;
+    size_t size;
+
+    memset(&shell, 0, sizeof(shell));
+
+    r->fast.expiration = kdc_time + FAST_EXPIRATION_TIME;
+
+    ASN1_MALLOC_ENCODE(KDCFastState, data.data, data.length, 
+		       &r->fast, &size, ret);
+    if (ret)
+	return ret;
+    heim_assert(size == data.length, "internal asn1 encoder error");
+
+    ret = get_fastuser_crypto(r, KRB5_ENCTYPE_NULL, &crypto);
+    if (ret)
+	goto out;
+
+    ret = krb5_encrypt_EncryptedData(r->context, crypto,
+				     KRB5_KU_H5L_COOKIE,
+				     data.data, data.length, 0,
+				     &shell.cookie);
+    krb5_crypto_destroy(r->context, crypto);
+    if (ret)
+	goto out;
+    
+    free(data.data);
+
+    shell.version = "H5L1";
+
+    ASN1_MALLOC_ENCODE(KDCFastCookie, data.data, data.length, 
+		       &shell, &size, ret);
+    free_EncryptedData(&shell.cookie);
+    if (ret)
+	goto out;
+    heim_assert(size == data.length, "internal asn1 encoder error");
+    
+    ret = krb5_padata_add(r->context, method_data,
+			  KRB5_PADATA_FX_COOKIE,
+			  data.data, data.length);
+ out:
+    if (ret)
+	free(data.data);
+    return ret;
+}
+
+krb5_error_code
+_kdc_fast_mk_response(krb5_context context,
+		      krb5_crypto armor_crypto,
+		      METHOD_DATA *pa_data,
+		      krb5_keyblock *strengthen_key,
+		      KrbFastFinished *finished,
+		      krb5uint32 nonce,
+		      krb5_data *data)
+{
+    PA_FX_FAST_REPLY fxfastrep;
+    KrbFastResponse fastrep;
+    krb5_error_code ret;
+    krb5_data buf;
+    size_t size;
+
+    memset(&fxfastrep, 0, sizeof(fxfastrep));
+    memset(&fastrep, 0, sizeof(fastrep));
+    krb5_data_zero(data);
+
+    if (pa_data) {
+	fastrep.padata.val = pa_data->val;
+	fastrep.padata.len = pa_data->len;
+    }
+    fastrep.strengthen_key = strengthen_key;
+    fastrep.finished = finished;
+    fastrep.nonce = nonce;
+
+    ASN1_MALLOC_ENCODE(KrbFastResponse, buf.data, buf.length,
+		       &fastrep, &size, ret);
+    if (ret)
+	return ret;
+    if (buf.length != size)
+	krb5_abortx(context, "internal asn.1 error");
+    
+    fxfastrep.element = choice_PA_FX_FAST_REPLY_armored_data;
+
+    ret = krb5_encrypt_EncryptedData(context,
+				     armor_crypto,
+				     KRB5_KU_FAST_REP,
+				     buf.data,
+				     buf.length,
+				     0,
+				     &fxfastrep.u.armored_data.enc_fast_rep);
+    krb5_data_free(&buf);
+    if (ret)
+	return ret;
+
+    ASN1_MALLOC_ENCODE(PA_FX_FAST_REPLY, data->data, data->length,
+		       &fxfastrep, &size, ret);
+    free_PA_FX_FAST_REPLY(&fxfastrep);
+    if (ret)
+	return ret;
+    if (data->length != size)
+	krb5_abortx(context, "internal asn.1 error");
+    
+    return 0;
+}
+
+
+krb5_error_code
+_kdc_fast_mk_error(krb5_context context,
+		   kdc_request_t r,
+		   METHOD_DATA *error_method,
+		   krb5_crypto armor_crypto,
+		   const KDC_REQ_BODY *req_body,
+		   krb5_error_code outer_error,
+		   const char *e_text,
+		   krb5_principal error_server,
+		   const PrincipalName *error_client_name,
+		   const Realm *error_client_realm,
+		   time_t *csec, int *cusec,
+		   krb5_data *error_msg)
+{
+    krb5_error_code ret;
+    krb5_data e_data;
+    size_t size;
+
+    krb5_data_zero(&e_data);
+
+    if (armor_crypto) {
+	PA_FX_FAST_REPLY fxfastrep;
+	KrbFastResponse fastrep;
+
+	memset(&fxfastrep, 0, sizeof(fxfastrep));
+	memset(&fastrep, 0, sizeof(fastrep));
+	    
+	/* first add the KRB-ERROR to the fast errors */
+
+	ret = krb5_mk_error_ext(context,
+				outer_error,
+				e_text,
+				NULL,
+				error_server,
+				error_client_name,
+				error_client_realm,
+				NULL,
+				NULL,
+				&e_data);
+	if (ret)
+	    return ret;
+
+	ret = krb5_padata_add(context, error_method,
+			      KRB5_PADATA_FX_ERROR,
+			      e_data.data, e_data.length);
+	if (ret) {
+	    krb5_data_free(&e_data);
+	    return ret;
+	}
+
+	if (/* hide_principal */ 0) {
+	    error_client_name = NULL;
+	    error_client_realm = NULL;
+	    error_server = NULL;
+	    e_text = NULL;
+	}
+
+	if (r)
+	    ret = fast_add_cookie(r, error_method);
+	else
+	    ret = krb5_padata_add(context, error_method,
+				  KRB5_PADATA_FX_COOKIE,
+				  NULL, 0);
+	if (ret) {
+	    kdc_log(r->context, r->config, 0, "failed to add fast cookie with: %d", ret);
+	    free_METHOD_DATA(error_method);
+	    return ret;
+	}
+	
+	ret = _kdc_fast_mk_response(context, armor_crypto,
+				    error_method, NULL, NULL, 
+				    req_body->nonce, &e_data);
+	free_METHOD_DATA(error_method);
+	if (ret)
+	    return ret;
+	
+	ret = krb5_padata_add(context, error_method,
+			      KRB5_PADATA_FX_FAST,
+			      e_data.data, e_data.length);
+	if (ret)
+	    return ret;
+    }
+
+    if (error_method && error_method->len) {
+	ASN1_MALLOC_ENCODE(METHOD_DATA, e_data.data, e_data.length, 
+			   error_method, &size, ret);
+	if (ret)
+	    return ret;
+	if (e_data.length != size)
+	    krb5_abortx(context, "internal asn.1 error");
+    }
+    
+    ret = krb5_mk_error_ext(context,
+			    outer_error,
+			    e_text,
+			    (e_data.length ? &e_data : NULL),
+			    error_server,
+			    error_client_name,
+			    error_client_realm,
+			    csec,
+			    cusec,
+			    error_msg);
+    krb5_data_free(&e_data);
+
+    return ret;
+}
+
+krb5_error_code
+_kdc_fast_unwrap_request(kdc_request_t r)
+{
+    krb5_principal armor_server = NULL;
+    hdb_entry_ex *armor_user = NULL;
+    PA_FX_FAST_REQUEST fxreq;
+    krb5_auth_context ac = NULL;
+    krb5_ticket *ticket = NULL;
+    krb5_flags ap_req_options;
+    Key *armor_key = NULL;
+    krb5_keyblock armorkey;
+    krb5_error_code ret;
+    krb5_ap_req ap_req;
+    unsigned char *buf = NULL;
+    KrbFastReq fastreq;
+    size_t len, size;
+    krb5_data data;
+    const PA_DATA *pa;
+    int i = 0;
+
+    /*
+     * First look for FX_COOKIE and and process it
+     */
+    pa = _kdc_find_padata(&r->req, &i, KRB5_PADATA_FX_COOKIE);
+    if (pa) {
+	ret = fast_parse_cookie(r, pa);
+	if (ret)
+	    goto out;
+    }
+			  
+    i = 0;
+    pa = _kdc_find_padata(&r->req, &i, KRB5_PADATA_FX_FAST);
+    if (pa == NULL)
+	return 0;
+
+    ret = decode_PA_FX_FAST_REQUEST(pa->padata_value.data,
+				    pa->padata_value.length,
+				    &fxreq,
+				    &len);
+    if (ret)
+	goto out;
+    if (len != pa->padata_value.length) {
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    if (fxreq.element != choice_PA_FX_FAST_REQUEST_armored_data) {
+	kdc_log(r->context, r->config, 0,
+		"AS-REQ FAST contain unknown type: %d", (int)fxreq.element);
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    /* pull out armor key */
+    if (fxreq.u.armored_data.armor == NULL) {
+	kdc_log(r->context, r->config, 0,
+		"AS-REQ armor missing");
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    if (fxreq.u.armored_data.armor->armor_type != 1) {
+	kdc_log(r->context, r->config, 0,
+		"AS-REQ armor type not ap-req");
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+	    
+    ret = krb5_decode_ap_req(r->context,
+			     &fxreq.u.armored_data.armor->armor_value,
+			     &ap_req);
+    if(ret) {
+	kdc_log(r->context, r->config, 0, "AP-REQ decode failed");
+	goto out;
+    }
+
+    /* Save that principal that was in the request */
+    ret = _krb5_principalname2krb5_principal(r->context,
+					     &armor_server,
+					     ap_req.ticket.sname,
+					     ap_req.ticket.realm);
+    if (ret) {
+	free_AP_REQ(&ap_req);
+	goto out;
+    }
+
+    ret = _kdc_db_fetch(r->context, r->config, armor_server,
+			HDB_F_GET_SERVER, NULL, NULL, &armor_user);
+    if(ret == HDB_ERR_NOT_FOUND_HERE) {
+	kdc_log(r->context, r->config, 5,
+		"armor key does not have secrets at this KDC, "
+		"need to proxy");
+	goto out;
+    } else if (ret) {
+	free_AP_REQ(&ap_req);
+	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	goto out;
+    }
+
+    ret = hdb_enctype2key(r->context, &armor_user->entry, NULL,
+			  ap_req.ticket.enc_part.etype,
+			  &armor_key);
+    if (ret) {
+	free_AP_REQ(&ap_req);
+	goto out;
+    }
+
+    ret = krb5_verify_ap_req2(r->context, &ac, 
+			      &ap_req,
+			      armor_server,
+			      &armor_key->key,
+			      0,
+			      &ap_req_options,
+			      &ticket, 
+			      KRB5_KU_AP_REQ_AUTH);
+    free_AP_REQ(&ap_req);
+    if (ret)
+	goto out;
+
+    if (ac->remote_subkey == NULL) {
+	krb5_auth_con_free(r->context, ac);
+	kdc_log(r->context, r->config, 0,
+		"FAST AP-REQ remote subkey missing");
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }		
+
+    ret = _krb5_fast_armor_key(r->context,
+			       ac->remote_subkey,
+			       &ticket->ticket.key,
+			       &armorkey,
+			       &r->armor_crypto);
+    krb5_auth_con_free(r->context, ac);
+    krb5_free_ticket(r->context, ticket);
+    if (ret)
+	goto out;
+
+    krb5_free_keyblock_contents(r->context, &armorkey);
+
+    /* verify req-checksum of the outer body */
+
+    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, len, &r->req.req_body, &size, ret);
+    if (ret)
+	goto out;
+    if (size != len) {
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    ret = krb5_verify_checksum(r->context, r->armor_crypto,
+			       KRB5_KU_FAST_REQ_CHKSUM,
+			       buf, len, 
+			       &fxreq.u.armored_data.req_checksum);
+    if (ret) {
+	kdc_log(r->context, r->config, 0,
+		"FAST request have a bad checksum");
+	goto out;
+    }
+
+    ret = krb5_decrypt_EncryptedData(r->context, r->armor_crypto,
+				     KRB5_KU_FAST_ENC,
+				     &fxreq.u.armored_data.enc_fast_req,
+				     &data);
+    if (ret) {
+	kdc_log(r->context, r->config, 0,
+		"Failed to decrypt FAST request");
+	goto out;
+    }
+
+    ret = decode_KrbFastReq(data.data, data.length, &fastreq, &size);
+    if (ret) {
+	krb5_data_free(&data);
+	goto out;
+    }
+    if (data.length != size) {
+	krb5_data_free(&data);
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }		
+    krb5_data_free(&data);
+
+    free_KDC_REQ_BODY(&r->req.req_body);
+    ret = copy_KDC_REQ_BODY(&fastreq.req_body, &r->req.req_body);
+    if (ret)
+	goto out;
+	    
+    /* check for unsupported mandatory options */
+    if (FastOptions2int(fastreq.fast_options) & 0xfffc) {
+	kdc_log(r->context, r->config, 0,
+		"FAST unsupported mandatory option set");
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    /* KDC MUST ignore outer pa data preauth-14 - 6.5.5 */
+    if (r->req.padata)
+	free_METHOD_DATA(r->req.padata);
+    else
+	ALLOC(r->req.padata);
+
+    ret = copy_METHOD_DATA(&fastreq.padata, r->req.padata);
+    if (ret)
+	goto out;
+
+    free_KrbFastReq(&fastreq);
+    free_PA_FX_FAST_REQUEST(&fxreq);
+
+ out:
+    if (armor_server)
+	krb5_free_principal(r->context, armor_server);
+    if(armor_user)
+	_kdc_free_ent(r->context, armor_user);
+
+    return ret;
+}
diff --git a/crypto/external/bsd/heimdal/dist/kdc/headers.h b/crypto/external/bsd/heimdal/dist/kdc/headers.h
index 9f3cde777..1154b487b 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/headers.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/headers.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: headers.h,v 1.1.1.2 2011/04/14 14:08:12 elric Exp $	*/
+/*	$NetBSD: headers.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -49,6 +49,9 @@
 #include <errno.h>
 #include <signal.h>
 #include <stdarg.h>
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
@@ -108,6 +111,8 @@
 #include <krb5/kdc.h>
 #include <windc_plugin.h>
 
+#include <krb5/heimbase.h>
+
 #undef ALLOC
 #define ALLOC(X) ((X) = calloc(1, sizeof(*(X))))
 #undef ALLOC_SEQ
diff --git a/crypto/external/bsd/heimdal/dist/kdc/hprop.8 b/crypto/external/bsd/heimdal/dist/kdc/hprop.8
index 46cc140c2..0b77c1df3 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/hprop.8
+++ b/crypto/external/bsd/heimdal/dist/kdc/hprop.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: hprop.8,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: hprop.8,v 1.5 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kdc/hprop.c b/crypto/external/bsd/heimdal/dist/kdc/hprop.c
index 39da51123..df09b387d 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/hprop.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/hprop.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hprop.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: hprop.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -163,7 +163,7 @@ get_creds(krb5_context context, krb5_ccache *cache)
     krb5_preauthtype preauth = KRB5_PADATA_ENC_TIMESTAMP;
     krb5_creds creds;
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
     if(ret) krb5_err(context, 1, ret, "krb5_kt_register");
 
     ret = krb5_kt_resolve(context, ktname, &keytab);
@@ -343,7 +343,6 @@ propagate_database (krb5_context context, int type,
 	if(ret) {
 	    failed++;
 	    krb5_warn(context, ret, "krb5_sendauth (%s)", host);
-	    close(fd);
 	    goto next_host;
 	}
 
diff --git a/crypto/external/bsd/heimdal/dist/kdc/hprop.h b/crypto/external/bsd/heimdal/dist/kdc/hprop.h
index 640e2e7f5..f513de828 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/hprop.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/hprop.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hprop.h,v 1.1.1.2 2011/04/14 14:08:12 elric Exp $	*/
+/*	$NetBSD: hprop.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -48,7 +48,7 @@ struct prop_data{
 
 #define HPROP_VERSION "hprop-0.0"
 #define HPROP_NAME "hprop"
-#define HPROP_KEYTAB "HDB:"
+#define HPROP_KEYTAB "HDBGET:"
 #define HPROP_PORT 754
 
 #ifndef NEVERDATE
diff --git a/crypto/external/bsd/heimdal/dist/kdc/hpropd.8 b/crypto/external/bsd/heimdal/dist/kdc/hpropd.8
index 4f26010f2..66ec1e82e 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/hpropd.8
+++ b/crypto/external/bsd/heimdal/dist/kdc/hpropd.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: hpropd.8,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: hpropd.8,v 1.4 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 1997, 2000 - 2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kdc/hpropd.c b/crypto/external/bsd/heimdal/dist/kdc/hpropd.c
index dffcd6f8f..941dfab92 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/hpropd.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/hpropd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hpropd.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: hpropd.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
@@ -87,23 +87,23 @@ main(int argc, char **argv)
     setprogname(argv[0]);
 
     ret = krb5_init_context(&context);
-    if(ret)
+    if (ret)
 	exit(1);
 
     ret = krb5_openlog(context, "hpropd", &fac);
-    if(ret)
+    if (ret)
 	errx(1, "krb5_openlog");
     krb5_set_warn_dest(context, fac);
 
-    if(getarg(args, num_args, argc, argv, &optidx))
+    if (getarg(args, num_args, argc, argv, &optidx))
 	usage(1);
 
-    if(local_realm != NULL)
+    if (local_realm != NULL)
 	krb5_set_default_realm(context, local_realm);
 
-    if(help_flag)
+    if (help_flag)
 	usage(0);
-    if(version_flag) {
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
@@ -117,7 +117,7 @@ main(int argc, char **argv)
     if (database == NULL)
 	database = hdb_default_db(context);
 
-    if(from_stdin) {
+    if (from_stdin) {
 	sock = STDIN_FILENO;
     } else {
 	struct sockaddr_storage ss;
@@ -144,10 +144,10 @@ main(int argc, char **argv)
 					    HPROP_PORT), &sock);
 	}
 	sin_len = sizeof(ss);
-	if(getpeername(sock, sa, &sin_len) < 0)
+	if (getpeername(sock, sa, &sin_len) < 0)
 	    krb5_err(context, 1, errno, "getpeername");
 
-	if (inet_ntop(sa->sa_family,
+	if (inet_ntop(ss.ss_family,
 		      socket_get_address (sa),
 		      addr_name,
 		      sizeof(addr_name)) == NULL)
@@ -156,8 +156,8 @@ main(int argc, char **argv)
 
 	krb5_log(context, fac, 0, "Connection from %s", addr_name);
 
-	ret = krb5_kt_register(context, &hdb_kt_ops);
-	if(ret)
+	ret = krb5_kt_register(context, &hdb_get_kt_ops);
+	if (ret)
 	    krb5_err(context, 1, ret, "krb5_kt_register");
 
 	if (ktname != NULL) {
@@ -172,7 +172,7 @@ main(int argc, char **argv)
 
 	ret = krb5_recvauth(context, &ac, &sock, HPROP_VERSION, NULL,
 			    0, keytab, &ticket);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "krb5_recvauth");
 
 	ret = krb5_unparse_name(context, ticket->server, &server);
@@ -185,15 +185,15 @@ main(int argc, char **argv)
 	krb5_free_ticket (context, ticket);
 
 	ret = krb5_auth_con_getauthenticator(context, ac, &authent);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "krb5_auth_con_getauthenticator");
 
 	ret = krb5_make_principal(context, &c1, NULL, "kadmin", "hprop", NULL);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "krb5_make_principal");
 	_krb5_principalname2krb5_principal(context, &c2,
 					   authent->cname, authent->crealm);
-	if(!krb5_principal_compare(context, c1, c2)) {
+	if (!krb5_principal_compare(context, c1, c2)) {
 	    char *s;
 	    ret = krb5_unparse_name(context, c2, &s);
 	    if (ret)
@@ -204,48 +204,52 @@ main(int argc, char **argv)
 	krb5_free_principal(context, c2);
 
 	ret = krb5_kt_close(context, keytab);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "krb5_kt_close");
     }
 
-    if(!print_dump) {
-	asprintf(&tmp_db, "%s~", database);
+    if (!print_dump) {
+	int aret;
+
+	aret = asprintf(&tmp_db, "%s~", database);
+	if (aret == -1)
+	    krb5_errx(context, 1, "hdb_create: out of memory");
 
 	ret = hdb_create(context, &db, tmp_db);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "hdb_create(%s)", tmp_db);
 	ret = db->hdb_open(context, db, O_RDWR | O_CREAT | O_TRUNC, 0600);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "hdb_open(%s)", tmp_db);
     }
 
     nprincs = 0;
-    while(1){
+    while (1){
 	krb5_data data;
 	hdb_entry_ex entry;
 
-	if(from_stdin) {
+	if (from_stdin) {
 	    ret = krb5_read_message(context, &sock, &data);
-	    if(ret != 0 && ret != HEIM_ERR_EOF)
+	    if (ret != 0 && ret != HEIM_ERR_EOF)
 		krb5_err(context, 1, ret, "krb5_read_message");
 	} else {
 	    ret = krb5_read_priv_message(context, ac, &sock, &data);
-	    if(ret)
+	    if (ret)
 		krb5_err(context, 1, ret, "krb5_read_priv_message");
 	}
 
-	if(ret == HEIM_ERR_EOF || data.length == 0) {
-	    if(!from_stdin) {
+	if (ret == HEIM_ERR_EOF || data.length == 0) {
+	    if (!from_stdin) {
 		data.data = NULL;
 		data.length = 0;
 		krb5_write_priv_message(context, ac, &sock, &data);
 	    }
-	    if(!print_dump) {
+	    if (!print_dump) {
 		ret = db->hdb_close(context, db);
-		if(ret)
+		if (ret)
 		    krb5_err(context, 1, ret, "db_close");
 		ret = db->hdb_rename(context, db, database);
-		if(ret)
+		if (ret)
 		    krb5_err(context, 1, ret, "db_rename");
 	    }
 	    break;
@@ -253,20 +257,24 @@ main(int argc, char **argv)
 	memset(&entry, 0, sizeof(entry));
 	ret = hdb_value2entry(context, &data, &entry.entry);
 	krb5_data_free(&data);
-	if(ret)
+	if (ret)
 	    krb5_err(context, 1, ret, "hdb_value2entry");
-	if(print_dump)
-	    hdb_print_entry(context, db, &entry, stdout);
-	else {
+	if (print_dump) {
+            struct hdb_print_entry_arg parg;
+
+            parg.out = stdout;
+            parg.fmt = HDB_DUMP_HEIMDAL;
+	    hdb_print_entry(context, db, &entry, &parg);
+        } else {
 	    ret = db->hdb_store(context, db, 0, &entry);
-	    if(ret == HDB_ERR_EXISTS) {
+	    if (ret == HDB_ERR_EXISTS) {
 		char *s;
 		ret = krb5_unparse_name(context, entry.entry.principal, &s);
 		if (ret)
 		    s = strdup(unparseable_name);
 		krb5_warnx(context, "Entry exists: %s", s);
 		free(s);
-	    } else if(ret)
+	    } else if (ret)
 		krb5_err(context, 1, ret, "db_store");
 	    else
 		nprincs++;
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kdc-replay.c b/crypto/external/bsd/heimdal/dist/kdc/kdc-replay.c
index 67ae88eea..ecac82790 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kdc-replay.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/kdc-replay.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdc-replay.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kdc-replay.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -39,11 +39,11 @@ static int version_flag;
 static int help_flag;
 
 struct getargs args[] = {
-    { "version",   0,	arg_flag, &version_flag },
-    { "help",     'h',	arg_flag, &help_flag }
+    { "version",   0,	arg_flag, &version_flag, NULL, NULL },
+    { "help",     'h',	arg_flag, &help_flag,    NULL, NULL }
 };
 
-const static int num_args = sizeof(args) / sizeof(args[0]);
+static const int num_args = sizeof(args) / sizeof(args[0]);
 
 static void
 usage(int ret)
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kdc-tester.c b/crypto/external/bsd/heimdal/dist/kdc/kdc-tester.c
new file mode 100644
index 000000000..628a04558
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/kdc/kdc-tester.c
@@ -0,0 +1,510 @@
+/*	$NetBSD: kdc-tester.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kdc_locl.h"
+#include "send_to_kdc_plugin.h"
+
+struct perf {
+    unsigned long as_req;
+    unsigned long tgs_req;
+    struct timeval start;
+    struct timeval stop;
+    struct perf *next;
+} *ptop;
+
+int detach_from_console = -1;
+int daemon_child = -1;
+int do_bonjour = -1;
+
+static krb5_kdc_configuration *kdc_config;
+static krb5_context kdc_context;
+
+static struct sockaddr_storage sa;
+static const char *astr = "0.0.0.0";
+
+static void eval_object(heim_object_t);
+
+
+/*
+ *
+ */
+
+static krb5_error_code
+plugin_init(krb5_context context, void **pctx)
+{
+    *pctx = NULL;
+    return 0;
+}
+
+static void
+plugin_fini(void *ctx)
+{
+}
+
+static krb5_error_code
+plugin_send_to_kdc(krb5_context context,
+		   void *ctx,
+		   krb5_krbhst_info *ho,
+		   time_t timeout,
+		   const krb5_data *in,
+		   krb5_data *out)
+{
+    return KRB5_PLUGIN_NO_HANDLE;
+}
+
+static krb5_error_code
+plugin_send_to_realm(krb5_context context,
+		     void *ctx,
+		     krb5_const_realm realm,
+		     time_t timeout,
+		     const krb5_data *in,
+		     krb5_data *out)
+{
+    int ret;
+
+    krb5_kdc_update_time(NULL);
+
+    ret = krb5_kdc_process_request(kdc_context, kdc_config,
+				   in->data, in->length,
+				   out, NULL, astr,
+				   (struct sockaddr *)&sa, 0);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_kdc_process_request");
+
+    return 0;
+}
+
+static krb5plugin_send_to_kdc_ftable send_to_kdc = {
+    KRB5_PLUGIN_SEND_TO_KDC_VERSION_2,
+    plugin_init,
+    plugin_fini,
+    plugin_send_to_kdc,
+    plugin_send_to_realm
+};
+
+static void
+perf_start(struct perf *perf)
+{
+    memset(perf, 0, sizeof(*perf));
+
+    gettimeofday(&perf->start, NULL);
+    perf->next = ptop;
+    ptop = perf;
+}
+
+static void
+perf_stop(struct perf *perf)
+{
+    gettimeofday(&perf->stop, NULL);
+    ptop = perf->next;
+
+    if (ptop) {
+	ptop->as_req += perf->as_req;
+	ptop->tgs_req += perf->tgs_req;
+    }
+
+    timevalsub(&perf->stop, &perf->start);
+    printf("time: %lu.%06lu\n",
+	   (unsigned long)perf->stop.tv_sec,
+	   (unsigned long)perf->stop.tv_usec);
+
+#define USEC_PER_SEC 1000000
+
+    if (perf->as_req) {
+	double as_ps = 0.0;
+	as_ps = (perf->as_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
+	printf("as-req/s %.2lf  (total %lu requests)\n", as_ps, perf->as_req);
+    }
+	    
+    if (perf->tgs_req) {
+	double tgs_ps = 0.0;
+	tgs_ps = (perf->tgs_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
+	printf("tgs-req/s %.2lf (total %lu requests)\n", tgs_ps, perf->tgs_req);
+    }
+}
+
+/*
+ *
+ */
+
+static void
+eval_repeat(heim_dict_t o)
+{
+    heim_object_t or = heim_dict_get_value(o, HSTR("value"));
+    heim_number_t n = heim_dict_get_value(o, HSTR("num"));
+    int i, num;
+    struct perf perf;
+
+    perf_start(&perf);
+
+    heim_assert(or != NULL, "value missing");
+    heim_assert(n != NULL, "num missing");
+
+    num = heim_number_get_int(n);
+    heim_assert(num >= 0, "num >= 0");
+
+    for (i = 0; i < num; i++)
+	eval_object(or);
+
+    perf_stop(&perf);
+}
+
+/*
+ *
+ */
+
+static krb5_error_code
+copy_keytab(krb5_context context, krb5_keytab from, krb5_keytab to)
+{
+    krb5_keytab_entry entry;
+    krb5_kt_cursor cursor;
+    krb5_error_code ret;
+
+    ret = krb5_kt_start_seq_get(context, from, &cursor);
+    if (ret)
+	return ret;
+    while((ret = krb5_kt_next_entry(context, from, &entry, &cursor)) == 0){
+	krb5_kt_add_entry(context, to, &entry);
+	krb5_kt_free_entry(context, &entry);
+    }
+    return krb5_kt_end_seq_get(context, from, &cursor);
+}	    
+
+/*
+ *
+ */
+
+static void
+eval_kinit(heim_dict_t o)
+{
+    heim_string_t user, password, keytab, fast_armor_cc, pk_user_id, ccache;
+    krb5_get_init_creds_opt *opt;
+    krb5_init_creds_context ctx;
+    krb5_principal client;
+    krb5_keytab ktmem = NULL;
+    krb5_ccache fast_cc = NULL;
+    krb5_error_code ret;
+
+    if (ptop)
+	ptop->as_req++;
+
+    user = heim_dict_get_value(o, HSTR("client"));
+    if (user == NULL)
+	krb5_errx(kdc_context, 1, "no client");
+
+    password = heim_dict_get_value(o, HSTR("password"));
+    keytab = heim_dict_get_value(o, HSTR("keytab"));
+    pk_user_id = heim_dict_get_value(o, HSTR("pkinit-user-cert-id"));
+    if (password == NULL && keytab == NULL && pk_user_id == NULL)
+	krb5_errx(kdc_context, 1, "password, keytab, nor PKINIT user cert ID");
+
+    ccache = heim_dict_get_value(o, HSTR("ccache"));
+
+    ret = krb5_parse_name(kdc_context, heim_string_get_utf8(user), &client);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_unparse_name");
+
+    /* PKINIT parts */
+    ret = krb5_get_init_creds_opt_alloc (kdc_context, &opt);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_alloc");
+
+    if (pk_user_id) {
+	heim_bool_t rsaobj = heim_dict_get_value(o, HSTR("pkinit-use-rsa"));
+	int use_rsa = rsaobj ? heim_bool_val(rsaobj) : 0;
+
+	ret = krb5_get_init_creds_opt_set_pkinit(kdc_context, opt,
+						 client,
+						 heim_string_get_utf8(pk_user_id),
+						 NULL, NULL, NULL,
+						 use_rsa ? 2 : 0,
+						 NULL, NULL, NULL);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
+    }
+
+    ret = krb5_init_creds_init(kdc_context, client, NULL, NULL, 0, opt, &ctx);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_init_creds_init");
+
+    fast_armor_cc = heim_dict_get_value(o, HSTR("fast-armor-cc"));
+    if (fast_armor_cc) {
+
+	ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(fast_armor_cc), &fast_cc);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
+
+	ret = krb5_init_creds_set_fast_ccache(kdc_context, ctx, fast_cc);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_fast_ccache");
+    }
+    
+    if (password) {
+	ret = krb5_init_creds_set_password(kdc_context, ctx, 
+					   heim_string_get_utf8(password));
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_password");
+    }
+    if (keytab) {
+	krb5_keytab kt = NULL;
+
+	ret = krb5_kt_resolve(kdc_context, heim_string_get_utf8(keytab), &kt);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_kt_resolve");
+
+	ret = krb5_kt_resolve(kdc_context, "MEMORY:keytab", &ktmem);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_kt_resolve(MEMORY)");
+
+	ret = copy_keytab(kdc_context, kt, ktmem);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "copy_keytab");
+
+	krb5_kt_close(kdc_context, kt);
+
+	ret = krb5_init_creds_set_keytab(kdc_context, ctx, ktmem);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_keytab");
+    }
+
+    ret = krb5_init_creds_get(kdc_context, ctx);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_init_creds_get");
+
+    if (ccache) {
+	const char *name = heim_string_get_utf8(ccache);
+	krb5_creds cred;
+	krb5_ccache cc;
+
+	ret = krb5_init_creds_get_creds(kdc_context, ctx, &cred);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_init_creds_get_creds");
+
+	ret = krb5_cc_resolve(kdc_context, name, &cc);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
+
+	krb5_init_creds_store(kdc_context, ctx, cc);
+
+	ret = krb5_cc_close(kdc_context, cc);
+	if (ret)
+	    krb5_err(kdc_context, 1, ret, "krb5_cc_close");
+
+	krb5_free_cred_contents(kdc_context, &cred);
+    }
+
+    krb5_init_creds_free(kdc_context, ctx);
+
+    if (ktmem)
+	krb5_kt_close(kdc_context, ktmem);
+    if (fast_cc)
+	krb5_cc_close(kdc_context, fast_cc);
+}
+
+/*
+ *
+ */
+
+static void
+eval_kgetcred(heim_dict_t o)
+{
+    heim_string_t server, ccache;
+    krb5_get_creds_opt opt;
+    heim_bool_t nostore;
+    krb5_error_code ret;
+    krb5_ccache cc = NULL;
+    krb5_principal s;
+    krb5_creds *out = NULL;
+
+    if (ptop)
+	ptop->tgs_req++;
+
+    server = heim_dict_get_value(o, HSTR("server"));
+    if (server == NULL)
+	krb5_errx(kdc_context, 1, "no server");
+
+    ccache = heim_dict_get_value(o, HSTR("ccache"));
+    if (ccache == NULL)
+	krb5_errx(kdc_context, 1, "no ccache");
+
+    nostore = heim_dict_get_value(o, HSTR("nostore"));
+    if (nostore == NULL)
+	nostore = heim_bool_create(1);
+
+    ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(ccache), &cc);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
+
+    ret = krb5_parse_name(kdc_context, heim_string_get_utf8(server), &s);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_parse_name");
+
+    ret = krb5_get_creds_opt_alloc(kdc_context, &opt);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_get_creds_opt_alloc");
+
+    if (heim_bool_val(nostore))
+	krb5_get_creds_opt_add_options(kdc_context, opt, KRB5_GC_NO_STORE);
+
+    ret = krb5_get_creds(kdc_context, opt, cc, s, &out);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_get_creds");
+    
+    krb5_free_creds(kdc_context, out);
+    krb5_free_principal(kdc_context, s);
+    krb5_get_creds_opt_free(kdc_context, opt);
+    krb5_cc_close(kdc_context, cc);
+}
+
+
+/*
+ *
+ */
+
+static void
+eval_kdestroy(heim_dict_t o)
+{
+    heim_string_t ccache = heim_dict_get_value(o, HSTR("ccache"));;
+    krb5_error_code ret;
+    const char *name;
+    krb5_ccache cc;
+
+    heim_assert(ccache != NULL, "ccache_missing");
+	
+    name = heim_string_get_utf8(ccache);
+
+    ret = krb5_cc_resolve(kdc_context, name, &cc);
+    if (ret)
+	krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
+
+    krb5_cc_destroy(kdc_context, cc);
+}
+
+
+/*
+ *
+ */
+
+static void
+eval_array_element(heim_object_t o, void *ptr, int *stop)
+{
+    eval_object(o);
+}
+
+static void
+eval_object(heim_object_t o)
+{
+    heim_tid_t t = heim_get_tid(o);
+
+    if (t == heim_array_get_type_id()) {
+	heim_array_iterate_f(o, NULL, eval_array_element);
+    } else if (t == heim_dict_get_type_id()) {
+	const char *op = heim_dict_get_value(o, HSTR("op"));
+
+	heim_assert(op != NULL, "op missing");
+
+	if (strcmp(op, "repeat") == 0) {
+	    eval_repeat(o);
+	} else if (strcmp(op, "kinit") == 0) {
+	    eval_kinit(o);
+	} else if (strcmp(op, "kgetcred") == 0) {
+	    eval_kgetcred(o);
+	} else if (strcmp(op, "kdestroy") == 0) {
+	    eval_kdestroy(o);
+	} else {
+	    errx(1, "unsupported ops %s", op);
+	}
+
+    } else
+	errx(1, "unsupported");
+}
+
+
+int
+main(int argc, char **argv)
+{
+    krb5_error_code ret;
+    int optidx = 0;
+
+    setprogname(argv[0]);
+
+    ret = krb5_init_context(&kdc_context);
+    if (ret == KRB5_CONFIG_BADFORMAT)
+	errx (1, "krb5_init_context failed to parse configuration file");
+    else if (ret)
+	errx (1, "krb5_init_context failed: %d", ret);
+
+    ret = krb5_kt_register(kdc_context, &hdb_get_kt_ops);
+    if (ret)
+	errx (1, "krb5_kt_register(HDB) failed: %d", ret);
+
+    kdc_config = configure(kdc_context, argc, argv, &optidx);
+
+    argc -= optidx;
+    argv += optidx;
+
+    if (argc == 0)
+	errx(1, "missing operations");
+
+    krb5_plugin_register(kdc_context, PLUGIN_TYPE_DATA,
+			 KRB5_PLUGIN_SEND_TO_KDC, &send_to_kdc);
+
+    {
+	void *buf;
+	size_t size;
+	heim_object_t o;
+
+	if (rk_undumpdata(argv[0], &buf, &size))
+	    errx(1, "undumpdata: %s", argv[0]);
+	
+	o = heim_json_create_with_bytes(buf, size, 10, 0, NULL);
+	free(buf);
+	if (o == NULL)
+	    errx(1, "heim_json");
+	
+	/*
+	 * do the work here
+	 */
+	
+	eval_object(o);
+
+	heim_release(o);
+    }
+
+    krb5_free_context(kdc_context);
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kdc.8 b/crypto/external/bsd/heimdal/dist/kdc/kdc.8
index c4ca1e692..9a7166b1b 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kdc.8
+++ b/crypto/external/bsd/heimdal/dist/kdc/kdc.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kdc.8,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kdc.8,v 1.5 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -49,9 +49,6 @@
 .Op Fl p | Fl Fl no-require-preauth
 .Op Fl Fl max-request= Ns Ar size
 .Op Fl H | Fl Fl enable-http
-.Op Fl Fl no-524
-.Op Fl Fl kerberos4
-.Op Fl Fl kerberos4-cross-realm
 .Oo Fl r Ar string \*(Ba Xo
 .Fl Fl v4-realm= Ns Ar string
 .Xc
@@ -95,14 +92,6 @@ Gives an upper limit on the size of the requests that the kdc is
 willing to handle.
 .It Fl H , Fl Fl enable-http
 Makes the kdc listen on port 80 and handle requests encapsulated in HTTP.
-.It Fl Fl no-524
-don't respond to 524 requests
-.It Fl Fl kerberos4
-respond to Kerberos 4 requests
-.It Fl Fl kerberos4-cross-realm
-respond to Kerberos 4 requests from foreign realms.
-This is a known security hole and should not be enabled unless you
-understand the consequences and are willing to live with them.
 .It Fl r Ar string , Fl Fl v4-realm= Ns Ar string
 What realm this server should act as when dealing with version 4
 requests.
@@ -126,7 +115,7 @@ option might be used.
 .It Fl Fl detach
 detach from pty and run as a daemon.
 .It Fl Fl disable-des
-disable add des encryption types, makes the kdc not use them.
+disable all des encryption types, makes the kdc not use them.
 .El
 .Pp
 All activities are logged to one or more destinations, see
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kdc.h b/crypto/external/bsd/heimdal/dist/kdc/kdc.h
index 7d6d208f2..5dbd055a8 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kdc.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/kdc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdc.h,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kdc.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
@@ -59,6 +59,8 @@ typedef struct krb5_kdc_configuration {
     struct HDB **db;
     int num_db;
 
+    int num_kdc_processes;
+
     krb5_boolean encode_as_rep_as_tgs_rep; /* bug compatibility */
 
     krb5_boolean tgt_use_strongest_session_key;
@@ -69,6 +71,7 @@ typedef struct krb5_kdc_configuration {
     krb5_boolean check_ticket_addresses;
     krb5_boolean allow_null_ticket_addresses;
     krb5_boolean allow_anonymous;
+    krb5_boolean strict_nametypes;
     enum krb5_kdc_trpolicy trpolicy;
 
     krb5_boolean enable_pkinit;
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kdc_locl.h b/crypto/external/bsd/heimdal/dist/kdc/kdc_locl.h
index b0d60daa3..5e28fc9d1 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kdc_locl.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/kdc_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdc_locl.h,v 1.1.1.2 2011/04/14 14:08:12 elric Exp $	*/
+/*	$NetBSD: kdc_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -45,8 +45,53 @@
 typedef struct pk_client_params pk_client_params;
 struct DigestREQ;
 struct Kx509Request;
+typedef struct kdc_request_desc *kdc_request_t;
+
 #include <kdc-private.h>
 
+#define FAST_EXPIRATION_TIME (3 * 60)
+
+struct kdc_request_desc {
+    krb5_context context;
+    krb5_kdc_configuration *config;
+
+    /* */
+
+    krb5_data request;
+    KDC_REQ req;
+    METHOD_DATA *padata;
+
+    /* out */
+
+    METHOD_DATA outpadata;
+    
+    KDC_REP rep;
+    EncTicketPart et;
+    EncKDCRepPart ek;
+
+    /* PA methods can affect both the reply key and the session key (pkinit) */
+    krb5_enctype sessionetype;
+    krb5_keyblock reply_key;
+    krb5_keyblock session_key;
+
+    const char *e_text;
+
+    /* state */
+    krb5_principal client_princ;
+    char *client_name;
+    hdb_entry_ex *client;
+    HDB *clientdb;
+
+    krb5_principal server_princ;
+    char *server_name;
+    hdb_entry_ex *server;
+
+    krb5_crypto armor_crypto;
+
+    KDCFastState fast;
+};
+
+
 extern sig_atomic_t exit_flag;
 extern size_t max_request_udp;
 extern size_t max_request_tcp;
@@ -56,12 +101,11 @@ extern krb5_addresses explicit_addresses;
 
 extern int enable_http;
 
-#ifdef SUPPORT_DETACH
-
-#define DETACH_IS_DEFAULT FALSE
-
 extern int detach_from_console;
-#endif
+extern int daemon_child;
+extern int do_bonjour;
+
+extern int testing_flag;
 
 extern const struct units _kdc_digestunits[];
 
@@ -74,10 +118,10 @@ extern char *runas_string;
 extern char *chroot_string;
 
 void
-loop(krb5_context context, krb5_kdc_configuration *config);
+start_kdc(krb5_context context, krb5_kdc_configuration *config, const char *argv0);
 
 krb5_kdc_configuration *
-configure(krb5_context context, int argc, char **argv);
+configure(krb5_context context, int argc, char **argv, int *optidx);
 
 #ifdef __APPLE__
 void bonjour_announce(krb5_context, krb5_kdc_configuration *);
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kerberos5.c b/crypto/external/bsd/heimdal/dist/kdc/kerberos5.c
index 7eafc5955..4db3de48c 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kerberos5.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/kerberos5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kerberos5.c,v 1.5 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: kerberos5.c,v 1.7 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -94,9 +94,9 @@ _kdc_is_weak_exception(krb5_principal principal, krb5_enctype etype)
 {
     if (principal->name.name_string.len > 0 &&
 	strcmp(principal->name.name_string.val[0], "afs") == 0 &&
-	(etype == ETYPE_DES_CBC_CRC
-	 || etype == ETYPE_DES_CBC_MD4
-	 || etype == ETYPE_DES_CBC_MD5))
+	(etype == (krb5_enctype)ETYPE_DES_CBC_CRC
+	 || etype == (krb5_enctype)ETYPE_DES_CBC_MD4
+	 || etype == (krb5_enctype)ETYPE_DES_CBC_MD5))
 	return TRUE;
     return FALSE;
 }
@@ -145,6 +145,7 @@ _kdc_find_etype(krb5_context context, krb5_boolean use_strongest_session_key,
     ret = KRB5KDC_ERR_ETYPE_NOSUPP;
 
     if (use_strongest_session_key) {
+
 	/*
 	 * Pick the strongest key that the KDC, target service, and
 	 * client all support, using the local cryptosystem enctype
@@ -162,7 +163,7 @@ _kdc_find_etype(krb5_context context, krb5_boolean use_strongest_session_key,
 	    p[i] != (krb5_enctype)ETYPE_NULL && enctype == (krb5_enctype)ETYPE_NULL;
 	    i++) {
 	    if (krb5_enctype_valid(context, p[i]) != 0 &&
-		!_kdc_is_weak_exception(princ->entry.principal, p[i]))
+                !_kdc_is_weak_exception(princ->entry.principal, p[i]))
 		continue;
 
 	    /* check that the client supports it too */
@@ -171,9 +172,9 @@ _kdc_find_etype(krb5_context context, krb5_boolean use_strongest_session_key,
 		if (p[i] != etypes[k])
 		    continue;
 
-		/* check target princ support */
+                /* check target princ support */
 		key = NULL;
-		while (hdb_next_enctype2key(context, &princ->entry,
+		while (hdb_next_enctype2key(context, &princ->entry, NULL,
 					     p[i], &key) == 0) {
 		    if (key->key.keyvalue.length == 0) {
 			ret = KRB5KDC_ERR_NULL_KEY;
@@ -205,13 +206,13 @@ _kdc_find_etype(krb5_context context, krb5_boolean use_strongest_session_key,
 
 	    key = NULL;
 	    while (ret != 0 &&
-		   hdb_next_enctype2key(context, &princ->entry,
+                   hdb_next_enctype2key(context, &princ->entry, NULL,
 					etypes[i], &key) == 0) {
 		if (key->key.keyvalue.length == 0) {
 		    ret = KRB5KDC_ERR_NULL_KEY;
 		    continue;
 		}
-		enctype = etypes[i];
+                enctype = etypes[i];
 		ret = 0;
 		if (is_preauth && ret_key != NULL &&
 		    !is_default_salt_p(&def_salt, key))
@@ -221,18 +222,18 @@ _kdc_find_etype(krb5_context context, krb5_boolean use_strongest_session_key,
     }
 
     if (enctype == (krb5_enctype)ETYPE_NULL) {
-	/*
-	 * if the service principal is one for which there is a known 1DES
-	 * exception and no other enctype matches both the client request and
-	 * the service key list, provide a DES-CBC-CRC key.
-	 */
+        /*
+         * if the service principal is one for which there is a known 1DES
+         * exception and no other enctype matches both the client request and
+         * the service key list, provide a DES-CBC-CRC key.
+         */
 	if (ret_key == NULL &&
 	    _kdc_is_weak_exception(princ->entry.principal, ETYPE_DES_CBC_CRC)) {
-	    ret = 0;
-	    enctype = ETYPE_DES_CBC_CRC;
-	} else {
-	    ret = KRB5KDC_ERR_ETYPE_NOSUPP;
-	}
+            ret = 0;
+            enctype = ETYPE_DES_CBC_CRC;
+        } else {
+            ret = KRB5KDC_ERR_ETYPE_NOSUPP;
+        }
     }
 
     if (ret == 0) {
@@ -263,6 +264,24 @@ _kdc_make_anonymous_principalname (PrincipalName *pn)
     return 0;
 }
 
+static void
+_kdc_r_log(kdc_request_t r, int level, const char *fmt, ...)
+{
+    va_list ap;
+    char *s;
+    va_start(ap, fmt);
+    s = kdc_log_msg_va(r->context, r->config, level, fmt, ap);
+    if(s) free(s);
+    va_end(ap);
+}
+
+static void
+_kdc_set_e_text(kdc_request_t r, const char *e_text)
+{
+    r->e_text = e_text;
+    kdc_log(r->context, r->config, 0, "%s", e_text);
+}
+
 void
 _kdc_log_timestamp(krb5_context context,
 		   krb5_kdc_configuration *config,
@@ -293,6 +312,466 @@ _kdc_log_timestamp(krb5_context context,
 	    type, authtime_str, starttime_str, endtime_str, renewtime_str);
 }
 
+/*
+ *
+ */
+
+#ifdef PKINIT
+
+static krb5_error_code
+pa_pkinit_validate(kdc_request_t r, const PA_DATA *pa)
+{
+    pk_client_params *pkp = NULL;
+    char *client_cert = NULL;
+    krb5_error_code ret;
+
+    ret = _kdc_pk_rd_padata(r->context, r->config, &r->req, pa, r->client, &pkp);
+    if (ret || pkp == NULL) {
+	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	_kdc_r_log(r, 5, "Failed to decode PKINIT PA-DATA -- %s",
+		   r->client_name);
+	goto out;
+    }
+    
+    ret = _kdc_pk_check_client(r->context,
+			       r->config,
+			       r->clientdb, 
+			       r->client,
+			       pkp,
+			       &client_cert);
+    if (ret) {
+	_kdc_set_e_text(r, "PKINIT certificate not allowed to "
+			"impersonate principal");
+	goto out;
+    }
+
+    _kdc_r_log(r, 0, "PKINIT pre-authentication succeeded -- %s using %s",
+	       r->client_name, client_cert);
+    free(client_cert);
+
+    ret = _kdc_pk_mk_pa_reply(r->context, r->config, pkp, r->client,
+			      r->sessionetype, &r->req, &r->request,
+			      &r->reply_key, &r->session_key, &r->outpadata);
+    if (ret) {
+	_kdc_set_e_text(r, "Failed to build PK-INIT reply");
+	goto out;
+    }
+#if 0
+    ret = _kdc_add_inital_verified_cas(r->context, r->config,
+				       pkp, &r->et);
+#endif
+ out:
+    if (pkp)
+	_kdc_pk_free_client_param(r->context, pkp);
+
+    return ret;
+}
+
+#endif /* PKINIT */
+
+/*
+ *
+ */
+
+static krb5_error_code
+make_pa_enc_challange(krb5_context context, METHOD_DATA *md,
+		      krb5_crypto crypto)
+{
+    PA_ENC_TS_ENC p;
+    unsigned char *buf;
+    size_t buf_size;
+    size_t len;
+    EncryptedData encdata;
+    krb5_error_code ret;
+    int32_t usec;
+    int usec2;
+
+    krb5_us_timeofday (context, &p.patimestamp, &usec);
+    usec2         = usec;
+    p.pausec      = &usec2;
+
+    ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret);
+    if (ret)
+	return ret;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
+
+    ret = krb5_encrypt_EncryptedData(context,
+				     crypto,
+				     KRB5_KU_ENC_CHALLENGE_KDC,
+				     buf,
+				     len,
+				     0,
+				     &encdata);
+    free(buf);
+    if (ret)
+	return ret;
+
+    ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret);
+    free_EncryptedData(&encdata);
+    if (ret)
+	return ret;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
+
+    ret = krb5_padata_add(context, md, KRB5_PADATA_ENCRYPTED_CHALLENGE, buf, len);
+    if (ret)
+	free(buf);
+    return ret;
+}
+
+static krb5_error_code
+pa_enc_chal_validate(kdc_request_t r, const PA_DATA *pa)
+{
+    krb5_data pepper1, pepper2, ts_data;
+    KDC_REQ_BODY *b = &r->req.req_body;
+    int invalidPassword = 0;
+    EncryptedData enc_data;
+    krb5_enctype aenctype;
+    krb5_error_code ret;
+    struct Key *k;
+    size_t size;
+    int i;
+
+    heim_assert(r->armor_crypto != NULL, "ENC-CHAL called for non FAST");
+    
+    if (_kdc_is_anon_request(b)) {
+	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	kdc_log(r->context, r->config, 0, "ENC-CHALL doesn't support anon");
+	return ret;
+    }
+
+    ret = decode_EncryptedData(pa->padata_value.data,
+			       pa->padata_value.length,
+			       &enc_data,
+			       &size);
+    if (ret) {
+	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	_kdc_r_log(r, 5, "Failed to decode PA-DATA -- %s",
+		   r->client_name);
+	return ret;
+    }
+
+    pepper1.data = "clientchallengearmor";
+    pepper1.length = strlen(pepper1.data);
+    pepper2.data = "challengelongterm";
+    pepper2.length = strlen(pepper2.data);
+
+    krb5_crypto_getenctype(r->context, r->armor_crypto, &aenctype);
+
+    for (i = 0; i < r->client->entry.keys.len; i++) {
+	krb5_crypto challangecrypto, longtermcrypto;
+	krb5_keyblock challangekey;
+	PA_ENC_TS_ENC p;
+
+	k = &r->client->entry.keys.val[i];
+	
+	ret = krb5_crypto_init(r->context, &k->key, 0, &longtermcrypto);
+	if (ret)
+	    continue;			
+	
+	ret = krb5_crypto_fx_cf2(r->context, r->armor_crypto, longtermcrypto,
+				 &pepper1, &pepper2, aenctype,
+				 &challangekey);
+	krb5_crypto_destroy(r->context, longtermcrypto);
+	if (ret)
+	    continue;
+	
+	ret = krb5_crypto_init(r->context, &challangekey, 0,
+			       &challangecrypto);
+	if (ret)
+	    continue;
+	
+	ret = krb5_decrypt_EncryptedData(r->context, challangecrypto,
+					 KRB5_KU_ENC_CHALLENGE_CLIENT,
+					 &enc_data,
+					 &ts_data);
+	if (ret) {
+	    const char *msg = krb5_get_error_message(r->context, ret);
+	    krb5_error_code ret2;
+	    char *str = NULL;
+
+	    invalidPassword = 1;
+
+	    ret2 = krb5_enctype_to_string(r->context, k->key.keytype, &str);
+	    if (ret2)
+		str = NULL;
+	    _kdc_r_log(r, 5, "Failed to decrypt ENC-CHAL -- %s "
+		       "(enctype %s) error %s",
+		       r->client_name, str ? str : "unknown enctype", msg);
+	    krb5_free_error_message(r->context, msg);
+	    free(str);
+
+	    continue;
+	}
+	
+	ret = decode_PA_ENC_TS_ENC(ts_data.data,
+				   ts_data.length,
+				   &p,
+				   &size);
+	krb5_data_free(&ts_data);
+	if(ret){
+	    krb5_crypto_destroy(r->context, challangecrypto);
+	    ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	    _kdc_r_log(r, 5, "Failed to decode PA-ENC-TS_ENC -- %s",
+		       r->client_name);
+	    continue;
+	}
+
+	if (labs(kdc_time - p.patimestamp) > r->context->max_skew) {
+	    char client_time[100];
+
+	    krb5_crypto_destroy(r->context, challangecrypto);
+
+	    krb5_format_time(r->context, p.patimestamp,
+			     client_time, sizeof(client_time), TRUE);
+
+	    ret = KRB5KRB_AP_ERR_SKEW;
+	    _kdc_r_log(r, 0, "Too large time skew, "
+		       "client time %s is out by %u > %u seconds -- %s",
+		       client_time,
+		       (unsigned)labs(kdc_time - p.patimestamp),
+		       r->context->max_skew,
+		       r->client_name);
+
+	    free_PA_ENC_TS_ENC(&p);
+	    goto out;
+	}
+
+	free_PA_ENC_TS_ENC(&p);
+
+	ret = make_pa_enc_challange(r->context, &r->outpadata,
+				    challangecrypto);
+	krb5_crypto_destroy(r->context, challangecrypto);
+	if (ret)
+	    goto out;
+					    
+	set_salt_padata(&r->outpadata, k->salt);
+	krb5_free_keyblock_contents(r->context,  &r->reply_key);
+	ret = krb5_copy_keyblock_contents(r->context, &k->key, &r->reply_key);
+	if (ret)
+	    goto out;
+
+	/*
+	 * Success
+	 */
+	if (r->clientdb->hdb_auth_status)
+	    r->clientdb->hdb_auth_status(r->context, r->clientdb, r->client,
+					 HDB_AUTH_SUCCESS);
+	goto out;
+    }
+
+    if (invalidPassword && r->clientdb->hdb_auth_status) {
+	r->clientdb->hdb_auth_status(r->context, r->clientdb, r->client,
+				     HDB_AUTH_WRONG_PASSWORD);
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+    }
+ out:
+    free_EncryptedData(&enc_data);
+
+    return ret;
+}
+
+static krb5_error_code
+pa_enc_ts_validate(kdc_request_t r, const PA_DATA *pa)
+{
+    EncryptedData enc_data;
+    krb5_error_code ret;
+    krb5_crypto crypto;
+    krb5_data ts_data;
+    PA_ENC_TS_ENC p;
+    size_t len;
+    Key *pa_key;
+    char *str;
+	
+    if (_kdc_is_anon_request(&r->req.req_body)) {
+	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	_kdc_set_e_text(r, "ENC-TS doesn't support anon");
+	goto out;
+    }
+
+    ret = decode_EncryptedData(pa->padata_value.data,
+			       pa->padata_value.length,
+			       &enc_data,
+			       &len);
+    if (ret) {
+	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	_kdc_r_log(r, 5, "Failed to decode PA-DATA -- %s",
+		   r->client_name);
+	goto out;
+    }
+	
+    ret = hdb_enctype2key(r->context, &r->client->entry, NULL,
+			  enc_data.etype, &pa_key);
+    if(ret){
+	char *estr;
+	_kdc_set_e_text(r, "No key matching entype");
+	ret = KRB5KDC_ERR_ETYPE_NOSUPP;
+	if(krb5_enctype_to_string(r->context, enc_data.etype, &estr))
+	    estr = NULL;
+	if(estr == NULL)
+	    _kdc_r_log(r, 5,
+		       "No client key matching pa-data (%d) -- %s",
+		       enc_data.etype, r->client_name);
+	else
+	    _kdc_r_log(r, 5,
+		       "No client key matching pa-data (%s) -- %s",
+		       estr, r->client_name);
+	free(estr);
+	free_EncryptedData(&enc_data);
+	goto out;
+    }
+
+ try_next_key:
+    ret = krb5_crypto_init(r->context, &pa_key->key, 0, &crypto);
+    if (ret) {
+	const char *msg = krb5_get_error_message(r->context, ret);
+	_kdc_r_log(r, 0, "krb5_crypto_init failed: %s", msg);
+	krb5_free_error_message(r->context, msg);
+	free_EncryptedData(&enc_data);
+	goto out;
+    }
+
+    ret = krb5_decrypt_EncryptedData (r->context,
+				      crypto,
+				      KRB5_KU_PA_ENC_TIMESTAMP,
+				      &enc_data,
+				      &ts_data);
+    krb5_crypto_destroy(r->context, crypto);
+    /*
+     * Since the user might have several keys with the same
+     * enctype but with diffrent salting, we need to try all
+     * the keys with the same enctype.
+     */
+    if(ret){
+	krb5_error_code ret2;
+	const char *msg = krb5_get_error_message(r->context, ret);
+
+	ret2 = krb5_enctype_to_string(r->context,
+				      pa_key->key.keytype, &str);
+	if (ret2)
+	    str = NULL;
+	_kdc_r_log(r, 5, "Failed to decrypt PA-DATA -- %s "
+		   "(enctype %s) error %s",
+		   r->client_name, str ? str : "unknown enctype", msg);
+	krb5_free_error_message(r->context, msg);
+	free(str);
+
+	if(hdb_next_enctype2key(r->context, &r->client->entry, NULL,
+				enc_data.etype, &pa_key) == 0)
+	    goto try_next_key;
+
+	free_EncryptedData(&enc_data);
+
+	if (r->clientdb->hdb_auth_status)
+	    r->clientdb->hdb_auth_status(r->context, r->clientdb, r->client,
+					 HDB_AUTH_WRONG_PASSWORD);
+
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+    free_EncryptedData(&enc_data);
+    ret = decode_PA_ENC_TS_ENC(ts_data.data,
+			       ts_data.length,
+			       &p,
+			       &len);
+    krb5_data_free(&ts_data);
+    if(ret){
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	_kdc_r_log(r, 5, "Failed to decode PA-ENC-TS_ENC -- %s",
+		   r->client_name);
+	goto out;
+    }
+    if (labs(kdc_time - p.patimestamp) > r->context->max_skew) {
+	char client_time[100];
+		
+	krb5_format_time(r->context, p.patimestamp,
+			 client_time, sizeof(client_time), TRUE);
+
+	ret = KRB5KRB_AP_ERR_SKEW;
+	_kdc_r_log(r, 0, "Too large time skew, "
+		   "client time %s is out by %u > %u seconds -- %s",
+		   client_time,
+		   (unsigned)labs(kdc_time - p.patimestamp),
+		   r->context->max_skew,
+		   r->client_name);
+
+	/*
+	 * The following is needed to make windows clients to
+	 * retry using the timestamp in the error message, if
+	 * there is a e_text, they become unhappy.
+	 */
+	r->e_text = NULL;
+	free_PA_ENC_TS_ENC(&p);
+	goto out;
+    }
+    free_PA_ENC_TS_ENC(&p);
+
+    set_salt_padata(&r->outpadata, pa_key->salt);
+
+    ret = krb5_copy_keyblock_contents(r->context, &pa_key->key, &r->reply_key);
+    if (ret)
+	return ret;
+
+    ret = krb5_enctype_to_string(r->context, pa_key->key.keytype, &str);
+    if (ret)
+	str = NULL;
+    _kdc_r_log(r, 2, "ENC-TS Pre-authentication succeeded -- %s using %s",
+	       r->client_name, str ? str : "unknown enctype");
+    free(str);
+
+    ret = 0;
+
+ out:
+
+    return ret;
+}
+
+struct kdc_patypes {
+    int type;
+    char *name;
+    unsigned int flags;
+#define PA_ANNOUNCE	1
+#define PA_REQ_FAST	2 /* only use inside fast */
+    krb5_error_code (*validate)(kdc_request_t, const PA_DATA *pa);
+};
+
+static const struct kdc_patypes pat[] = {
+#ifdef PKINIT
+    {
+	KRB5_PADATA_PK_AS_REQ, "PK-INIT(ietf)", PA_ANNOUNCE,
+	pa_pkinit_validate
+    },
+    {
+	KRB5_PADATA_PK_AS_REQ_WIN, "PK-INIT(win2k)", PA_ANNOUNCE,
+	pa_pkinit_validate
+    },
+    {
+	KRB5_PADATA_PKINIT_KX, "Anonymous PK-INIT", PA_ANNOUNCE,
+	NULL
+    },
+#else
+    { KRB5_PADATA_PK_AS_REQ, "PK-INIT(ietf)", 0, NULL },
+    { KRB5_PADATA_PK_AS_REQ_WIN, "PK-INIT(win2k)", 0, NULL },
+    { KRB5_PADATA_PKINIT_KX, "Anonymous PK-INIT", 0, NULL },
+#endif
+    { KRB5_PADATA_PA_PK_OCSP_RESPONSE , "OCSP", 0, NULL },
+    { 
+	KRB5_PADATA_ENC_TIMESTAMP , "ENC-TS",
+	PA_ANNOUNCE,
+	pa_enc_ts_validate
+    },
+    {
+	KRB5_PADATA_ENCRYPTED_CHALLENGE , "ENC-CHAL",
+	PA_ANNOUNCE | PA_REQ_FAST,
+	pa_enc_chal_validate
+    },
+    { KRB5_PADATA_REQ_ENC_PA_REP , "REQ-ENC-PA-REP", 0, NULL },
+    { KRB5_PADATA_FX_FAST, "FX-FAST", PA_ANNOUNCE, NULL },
+    { KRB5_PADATA_FX_ERROR, "FX-ERROR", 0, NULL },
+    { KRB5_PADATA_FX_COOKIE, "FX-COOKIE", 0, NULL }
+};
+
 static void
 log_patypes(krb5_context context,
 	    krb5_kdc_configuration *config,
@@ -300,27 +779,18 @@ log_patypes(krb5_context context,
 {
     struct rk_strpool *p = NULL;
     char *str;
-    size_t i;
-
-    for (i = 0; i < padata->len; i++) {
-	switch(padata->val[i].padata_type) {
-	case KRB5_PADATA_PK_AS_REQ:
-	    p = rk_strpoolprintf(p, "PK-INIT(ietf)");
-	    break;
-	case KRB5_PADATA_PK_AS_REQ_WIN:
-	    p = rk_strpoolprintf(p, "PK-INIT(win2k)");
-	    break;
-	case KRB5_PADATA_PA_PK_OCSP_RESPONSE:
-	    p = rk_strpoolprintf(p, "OCSP");
-	    break;
-	case KRB5_PADATA_ENC_TIMESTAMP:
-	    p = rk_strpoolprintf(p, "encrypted-timestamp");
-	    break;
-	default:
-	    p = rk_strpoolprintf(p, "%d", padata->val[i].padata_type);
-	    break;
+    size_t n, m;
+	
+    for (n = 0; n < padata->len; n++) {
+	for (m = 0; m < sizeof(pat) / sizeof(pat[0]); m++) {
+	    if (padata->val[n].padata_type == pat[m].type) {
+		p = rk_strpoolprintf(p, "%s", pat[m].name);
+		break;
+	    }
 	}
-	if (p && i + 1 < padata->len)
+	if (m == sizeof(pat) / sizeof(pat[0]))
+	    p = rk_strpoolprintf(p, "%d", padata->val[n].padata_type);
+	if (p && n + 1 < padata->len)
 	    p = rk_strpoolprintf(p, ", ");
 	if (p == NULL) {
 	    kdc_log(context, config, 0, "out of memory");
@@ -339,11 +809,11 @@ log_patypes(krb5_context context,
  *
  */
 
-
 krb5_error_code
 _kdc_encode_reply(krb5_context context,
 		  krb5_kdc_configuration *config,
-		  KDC_REP *rep, const EncTicketPart *et, EncKDCRepPart *ek,
+		  krb5_crypto armor_crypto, uint32_t nonce,
+		  KDC_REP *rep, EncTicketPart *et, EncKDCRepPart *ek,
 		  krb5_enctype etype,
 		  int skvno, const EncryptionKey *skey,
 		  int ckvno, const EncryptionKey *reply_key,
@@ -364,20 +834,15 @@ _kdc_encode_reply(krb5_context context,
 	krb5_free_error_message(context, msg);
 	return ret;
     }
-    if(buf_size != len) {
-	free(buf);
-	kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
-	*e_text = "KDC internal error";
-	return KRB5KRB_ERR_GENERIC;
-    }
+    if(buf_size != len)
+	krb5_abortx(context, "Internal error in ASN.1 encoder");
 
     ret = krb5_crypto_init(context, skey, etype, &crypto);
     if (ret) {
-        const char *msg;
-	free(buf);
-	msg = krb5_get_error_message(context, ret);
+        const char *msg = krb5_get_error_message(context, ret);
 	kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
 	krb5_free_error_message(context, msg);
+	free(buf);
 	return ret;
     }
 
@@ -397,6 +862,69 @@ _kdc_encode_reply(krb5_context context,
 	return ret;
     }
 
+    if (armor_crypto) {
+	krb5_data data;
+	krb5_keyblock *strengthen_key = NULL;
+	KrbFastFinished finished;
+
+	kdc_log(context, config, 0, "FAST armor protection");
+
+	memset(&finished, 0, sizeof(finished));
+	krb5_data_zero(&data);
+
+	finished.timestamp = kdc_time;
+	finished.usec = 0;
+	finished.crealm = et->crealm;
+	finished.cname = et->cname;
+
+	ASN1_MALLOC_ENCODE(Ticket, data.data, data.length,
+			   &rep->ticket, &len, ret);
+	if (ret)
+	    return ret;
+	if (data.length != len)
+	    krb5_abortx(context, "internal asn.1 error");
+
+	ret = krb5_create_checksum(context, armor_crypto,
+				   KRB5_KU_FAST_FINISHED, 0,
+				   data.data, data.length,
+				   &finished.ticket_checksum);
+	krb5_data_free(&data);
+	if (ret)
+	    return ret;
+
+	ret = _kdc_fast_mk_response(context, armor_crypto,
+				    rep->padata, strengthen_key, &finished,
+				    nonce, &data);
+	free_Checksum(&finished.ticket_checksum);
+	if (ret)
+	    return ret;
+
+	if (rep->padata) {
+	    free_METHOD_DATA(rep->padata);
+	} else {
+	    rep->padata = calloc(1, sizeof(*(rep->padata)));
+	    if (rep->padata == NULL) {
+		krb5_data_free(&data);
+		return ENOMEM;
+	    }
+	}
+
+	ret = krb5_padata_add(context, rep->padata,
+			      KRB5_PADATA_FX_FAST,
+			      data.data, data.length);
+	if (ret)
+	    return ret;
+
+	/*
+	 * Hide client name of privacy reasons
+	 */
+	if (1 /* r->fast_options.hide_client_names */) {
+	    rep->crealm[0] = '\0';
+	    free_PrincipalName(&rep->cname);
+	    rep->cname.name_type = 0;
+	}
+    }
+
     if(rep->msg_type == krb_as_rep && !config->encode_as_rep_as_tgs_rep)
 	ASN1_MALLOC_ENCODE(EncASRepPart, buf, buf_size, ek, &len, ret);
     else
@@ -581,11 +1109,33 @@ get_pa_etype_info(krb5_context context,
  *
  */
 
-extern int _krb5_AES_string_to_default_iterator;
+extern int _krb5_AES_SHA1_string_to_default_iterator;
+extern int _krb5_AES_SHA2_string_to_default_iterator;
+
+static krb5_error_code
+make_s2kparams(int value, size_t len, krb5_data **ps2kparams)
+{
+    krb5_data *s2kparams;
+    krb5_error_code ret;
+
+    ALLOC(s2kparams);
+    if (s2kparams == NULL)
+	return ENOMEM;
+    ret = krb5_data_alloc(s2kparams, len);
+    if (ret) {
+	free(s2kparams);
+	return ret;
+    }
+    _krb5_put_int(s2kparams->data, value, len);
+    *ps2kparams = s2kparams;
+    return 0;
+}
 
 static krb5_error_code
 make_etype_info2_entry(ETYPE_INFO2_ENTRY *ent, Key *key)
 {
+    krb5_error_code ret;
+
     ent->etype = key->key.keytype;
     if(key->salt) {
 	ALLOC(ent->salt);
@@ -607,44 +1157,28 @@ make_etype_info2_entry(ETYPE_INFO2_ENTRY *ent, Key *key)
     switch (key->key.keytype) {
     case ETYPE_AES128_CTS_HMAC_SHA1_96:
     case ETYPE_AES256_CTS_HMAC_SHA1_96:
-	ALLOC(ent->s2kparams);
-	if (ent->s2kparams == NULL)
-	    return ENOMEM;
-	ent->s2kparams->length = 4;
-	ent->s2kparams->data = malloc(ent->s2kparams->length);
-	if (ent->s2kparams->data == NULL) {
-	    free(ent->s2kparams);
-	    ent->s2kparams = NULL;
-	    return ENOMEM;
-	}
-	_krb5_put_int(ent->s2kparams->data,
-		      _krb5_AES_string_to_default_iterator,
-		      ent->s2kparams->length);
+	ret = make_s2kparams(_krb5_AES_SHA1_string_to_default_iterator,
+			     4, &ent->s2kparams);
+	break;
+    case KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128:
+    case KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192:
+	ret = make_s2kparams(_krb5_AES_SHA2_string_to_default_iterator,
+			     4, &ent->s2kparams);
 	break;
     case ETYPE_DES_CBC_CRC:
     case ETYPE_DES_CBC_MD4:
     case ETYPE_DES_CBC_MD5:
 	/* Check if this was a AFS3 salted key */
-	if(key->salt && key->salt->type == hdb_afs3_salt){
-	    ALLOC(ent->s2kparams);
-	    if (ent->s2kparams == NULL)
-		return ENOMEM;
-	    ent->s2kparams->length = 1;
-	    ent->s2kparams->data = malloc(ent->s2kparams->length);
-	    if (ent->s2kparams->data == NULL) {
-		free(ent->s2kparams);
-		ent->s2kparams = NULL;
-		return ENOMEM;
-	    }
-	    _krb5_put_int(ent->s2kparams->data,
-			  1,
-			  ent->s2kparams->length);
-	}
+	if(key->salt && key->salt->type == hdb_afs3_salt)
+	    ret = make_s2kparams(1, 1, &ent->s2kparams);
+	else
+	    ret = 0;
 	break;
     default:
+	ret = 0;
 	break;
     }
-    return 0;
+    return ret;
 }
 
 /*
@@ -810,6 +1344,13 @@ kdc_check_flags(krb5_context context,
 	    return KRB5KDC_ERR_NAME_EXP;
 	}
 
+	if (client->flags.require_pwchange &&
+	    (server_ex == NULL || !server_ex->entry.flags.change_pw)) {
+	    kdc_log(context, config, 0,
+		    "Client's key must be changed -- %s", client_name);
+	    return KRB5KDC_ERR_KEY_EXPIRED;
+	}
+
 	if (client->pw_end && *client->pw_end < kdc_time
 	    && (server_ex == NULL || !server_ex->entry.flags.change_pw)) {
 	    char pwend_str[100];
@@ -959,10 +1500,55 @@ send_pac_p(krb5_context context, KDC_REQ *req)
     return TRUE;
 }
 
+/*
+ *
+ */
+
+static krb5_error_code
+generate_pac(kdc_request_t r, Key *skey)
+{
+    krb5_error_code ret;
+    krb5_pac p = NULL;
+    krb5_data data;
+
+    ret = _kdc_pac_generate(r->context, r->client, &p);
+    if (ret) {
+	_kdc_r_log(r, 0, "PAC generation failed for -- %s",
+		   r->client_name);
+	return ret;
+    }
+    if (p == NULL)
+	return 0;
+
+    ret = _krb5_pac_sign(r->context, p, r->et.authtime,
+			 r->client->entry.principal,
+			 &skey->key, /* Server key */
+			 &skey->key, /* FIXME: should be krbtgt key */
+			 &data);
+    krb5_pac_free(r->context, p);
+    if (ret) {
+	_kdc_r_log(r, 0, "PAC signing failed for -- %s",
+		   r->client_name);
+	return ret;
+    }
+    
+    ret = _kdc_tkt_add_if_relevant_ad(r->context, &r->et,
+				      KRB5_AUTHDATA_WIN2K_PAC,
+				      &data);
+    krb5_data_free(&data);
+
+    return ret;
+}
+
+/*
+ *
+ */
+
 krb5_boolean
 _kdc_is_anonymous(krb5_context context, krb5_principal principal)
 {
-    if (principal->name.name_type != KRB5_NT_WELLKNOWN ||
+    if ((principal->name.name_type != KRB5_NT_WELLKNOWN &&
+	 principal->name.name_type != KRB5_NT_UNKNOWN) ||
 	principal->name.name_string.len != 2 ||
 	strcmp(principal->name.name_string.val[0], KRB5_WELLKNOWN_NAME) != 0 ||
 	strcmp(principal->name.name_string.val[1], KRB5_ANON_NAME) != 0)
@@ -970,62 +1556,115 @@ _kdc_is_anonymous(krb5_context context, krb5_principal principal)
     return 1;
 }
 
+static int
+require_preauth_p(kdc_request_t r)
+{
+    return r->config->require_preauth
+	|| r->client->entry.flags.require_preauth
+	|| r->server->entry.flags.require_preauth;
+}
+
+
+/*
+ *
+ */
+
+static krb5_error_code
+add_enc_pa_rep(kdc_request_t r)
+{
+    krb5_error_code ret;
+    krb5_crypto crypto;
+    Checksum checksum;
+    krb5_data cdata;
+    size_t len;
+
+    ret = krb5_crypto_init(r->context, &r->reply_key, 0, &crypto);
+    if (ret)
+	return ret;
+
+    ret = krb5_create_checksum(r->context, crypto,
+			       KRB5_KU_AS_REQ, 0,
+			       r->request.data, r->request.length,
+			       &checksum);
+    krb5_crypto_destroy(r->context, crypto);
+    if (ret)
+	return ret;
+
+    ASN1_MALLOC_ENCODE(Checksum, cdata.data, cdata.length,
+		       &checksum, &len, ret);
+    free_Checksum(&checksum);
+    if (ret)
+	return ret;
+    heim_assert(cdata.length == len, "ASN.1 internal error");
+
+    if (r->ek.encrypted_pa_data == NULL) {
+	ALLOC(r->ek.encrypted_pa_data);
+	if (r->ek.encrypted_pa_data == NULL)
+	    return ENOMEM;
+    }
+    ret = krb5_padata_add(r->context, r->ek.encrypted_pa_data,
+			  KRB5_PADATA_REQ_ENC_PA_REP, cdata.data, cdata.length);
+    if (ret)
+	return ret;
+    
+    return krb5_padata_add(r->context, r->ek.encrypted_pa_data,
+			   KRB5_PADATA_FX_FAST, NULL, 0);
+}
+
 /*
  *
  */
 
 krb5_error_code
-_kdc_as_rep(krb5_context context,
-	    krb5_kdc_configuration *config,
-	    KDC_REQ *req,
-	    const krb5_data *req_buffer,
+_kdc_as_rep(kdc_request_t r,
 	    krb5_data *reply,
 	    const char *from,
 	    struct sockaddr *from_addr,
 	    int datagram_reply)
 {
-    KDC_REQ_BODY *b = &req->req_body;
+    krb5_context context = r->context;
+    krb5_kdc_configuration *config = r->config;
+    KDC_REQ *req = &r->req;
+    KDC_REQ_BODY *b = NULL;
     AS_REP rep;
-    KDCOptions f = b->kdc_options;
-    hdb_entry_ex *client = NULL, *server = NULL;
-    HDB *clientdb;
-    krb5_enctype setype, sessionetype;
-    krb5_data e_data;
-    EncTicketPart et;
-    EncKDCRepPart ek;
-    krb5_principal client_princ = NULL, server_princ = NULL;
-    char *client_name = NULL, *server_name = NULL;
+    KDCOptions f;
+    krb5_enctype setype;
     krb5_error_code ret = 0;
-    const char *e_text = NULL;
-    krb5_crypto crypto;
-    Key *ckey, *skey;
-    EncryptionKey *reply_key = NULL, session_key;
-    int flags = HDB_F_FOR_AS_REQ;
-#ifdef PKINIT
-    pk_client_params *pkp = NULL;
-#endif
+    Key *skey;
+    int found_pa = 0;
+    int i, flags = HDB_F_FOR_AS_REQ;
+    METHOD_DATA error_method;
+    const PA_DATA *pa;
 
     memset(&rep, 0, sizeof(rep));
-    memset(&session_key, 0, sizeof(session_key));
-    krb5_data_zero(&e_data);
+    error_method.len = 0;
+    error_method.val = NULL;
 
-    ALLOC(rep.padata);
-    rep.padata->len = 0;
-    rep.padata->val = NULL;
+    /*
+     * Look for FAST armor and unwrap
+     */
+    ret = _kdc_fast_unwrap_request(r);
+    if (ret) {
+	_kdc_r_log(r, 0, "FAST unwrap request from %s failed: %d", from, ret);
+	goto out;
+    }
+
+    b = &req->req_body;
+    f = b->kdc_options;
 
     if (f.canonicalize)
 	flags |= HDB_F_CANON;
 
     if(b->sname == NULL){
 	ret = KRB5KRB_ERR_GENERIC;
-	e_text = "No server in request";
+	_kdc_set_e_text(r, "No server in request");
     } else{
 	ret = _krb5_principalname2krb5_principal (context,
-						  &server_princ,
+						  &r->server_princ,
 						  *(b->sname),
 						  b->realm);
 	if (ret == 0)
-	    ret = krb5_unparse_name(context, server_princ, &server_name);
+	    ret = krb5_unparse_name(context, r->server_princ, &r->server_name);
     }
     if (ret) {
 	kdc_log(context, config, 0,
@@ -1034,16 +1673,16 @@ _kdc_as_rep(krb5_context context,
     }
     if(b->cname == NULL){
 	ret = KRB5KRB_ERR_GENERIC;
-	e_text = "No client in request";
+	_kdc_set_e_text(r, "No client in request");
     } else {
 	ret = _krb5_principalname2krb5_principal (context,
-						  &client_princ,
+						  &r->client_princ,
 						  *(b->cname),
 						  b->realm);
 	if (ret)
 	    goto out;
 
-	ret = krb5_unparse_name(context, client_princ, &client_name);
+	ret = krb5_unparse_name(context, r->client_princ, &r->client_name);
     }
     if (ret) {
 	kdc_log(context, config, 0,
@@ -1052,22 +1691,22 @@ _kdc_as_rep(krb5_context context,
     }
 
     kdc_log(context, config, 0, "AS-REQ %s from %s for %s",
-	    client_name, from, server_name);
+	    r->client_name, from, r->server_name);
 
     /*
      *
      */
 
-    if (_kdc_is_anonymous(context, client_princ)) {
-	if (!b->kdc_options.request_anonymous) {
+    if (_kdc_is_anonymous(context, r->client_princ)) {
+	if (!_kdc_is_anon_request(b)) {
 	    kdc_log(context, config, 0, "Anonymous ticket w/o anonymous flag");
 	    ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 	    goto out;
 	}
-    } else if (b->kdc_options.request_anonymous) {
+    } else if (_kdc_is_anon_request(b)) {
 	kdc_log(context, config, 0,
 		"Request for a anonymous ticket with non "
-		"anonymous client name: %s", client_name);
+		"anonymous client name: %s", r->client_name);
 	ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 	goto out;
     }
@@ -1076,36 +1715,60 @@ _kdc_as_rep(krb5_context context,
      *
      */
 
-    ret = _kdc_db_fetch(context, config, client_princ,
+    ret = _kdc_db_fetch(context, config, r->client_princ,
 			HDB_F_GET_CLIENT | flags, NULL,
-			&clientdb, &client);
+			&r->clientdb, &r->client);
     if(ret == HDB_ERR_NOT_FOUND_HERE) {
-	kdc_log(context, config, 5, "client %s does not have secrets at this KDC, need to proxy", client_name);
+	kdc_log(context, config, 5, "client %s does not have secrets at this KDC, need to proxy",
+		r->client_name);
+	goto out;
+    } else if (ret == HDB_ERR_WRONG_REALM) {
+	char *fixed_client_name = NULL;
+
+	ret = krb5_unparse_name(context, r->client->entry.principal,
+				&fixed_client_name);
+	if (ret) {
+	    goto out;
+	}
+
+	kdc_log(context, config, 0, "WRONG_REALM - %s -> %s",
+		r->client_name, fixed_client_name);
+	free(fixed_client_name);
+
+	ret = _kdc_fast_mk_error(context, r,
+				 &error_method,
+				 r->armor_crypto,
+				 &req->req_body,
+				 KRB5_KDC_ERR_WRONG_REALM,
+				 NULL,
+				 r->server_princ,
+				 NULL,
+				 &r->client->entry.principal->realm,
+				 NULL, NULL,
+				 reply);
 	goto out;
     } else if(ret){
 	const char *msg = krb5_get_error_message(context, ret);
-	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", client_name, msg);
+	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", r->client_name, msg);
 	krb5_free_error_message(context, msg);
 	ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 	goto out;
     }
-    ret = _kdc_db_fetch(context, config, server_princ,
+    ret = _kdc_db_fetch(context, config, r->server_princ,
 			HDB_F_GET_SERVER|HDB_F_GET_KRBTGT | flags,
-			NULL, NULL, &server);
+			NULL, NULL, &r->server);
     if(ret == HDB_ERR_NOT_FOUND_HERE) {
-	kdc_log(context, config, 5, "target %s does not have secrets at this KDC, need to proxy", server_name);
+	kdc_log(context, config, 5, "target %s does not have secrets at this KDC, need to proxy",
+		r->server_name);
 	goto out;
     } else if(ret){
 	const char *msg = krb5_get_error_message(context, ret);
-	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", server_name, msg);
+	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", r->server_name, msg);
 	krb5_free_error_message(context, msg);
 	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
 	goto out;
     }
 
-    memset(&et, 0, sizeof(et));
-    memset(&ek, 0, sizeof(ek));
-
     /*
      * Select a session enctype from the list of the crypto system
      * supported enctypes that is supported by the client and is one of
@@ -1116,310 +1779,75 @@ _kdc_as_rep(krb5_context context,
      * enctype that an older version of a KDC in the same realm can't
      * decrypt.
      */
+
     ret = _kdc_find_etype(context,
-			  krb5_principal_is_krbtgt(context, server_princ) ?
+			  krb5_principal_is_krbtgt(context, r->server_princ) ?
 			  config->tgt_use_strongest_session_key :
 			  config->svc_use_strongest_session_key, FALSE,
-			  client, b->etype.val, b->etype.len, &sessionetype,
+			  r->client, b->etype.val, b->etype.len, &r->sessionetype,
 			  NULL);
     if (ret) {
 	kdc_log(context, config, 0,
 		"Client (%s) from %s has no common enctypes with KDC "
 		"to use for the session key",
-		client_name, from);
+		r->client_name, from);
 	goto out;
     }
-    /*
-     * But if the KDC admin is paranoid and doesn't want to have "not
-     * the best" enctypes on the krbtgt, lets save the best pick from
-     * the client list and hope that that will work for any other
-     * KDCs.
-     */
 
     /*
      * Pre-auth processing
      */
 
     if(req->padata){
-	int i;
-	const PA_DATA *pa;
-	int found_pa = 0;
+	unsigned int n;
 
 	log_patypes(context, config, req->padata);
 
-#ifdef PKINIT
-	kdc_log(context, config, 5,
-		"Looking for PKINIT pa-data -- %s", client_name);
+	/* Check if preauth matching */
 
-	e_text = "No PKINIT PA found";
+	for (n = 0; !found_pa && n < sizeof(pat) / sizeof(pat[0]); n++) {
+	    if (pat[n].validate == NULL)
+		continue;
+	    if (r->armor_crypto == NULL && (pat[n].flags & PA_REQ_FAST))
+		continue;
 
-	i = 0;
-	pa = _kdc_find_padata(req, &i, KRB5_PADATA_PK_AS_REQ);
-	if (pa == NULL) {
+	    kdc_log(context, config, 5,
+		    "Looking for %s pa-data -- %s", pat[n].name, r->client_name);
 	    i = 0;
-	    pa = _kdc_find_padata(req, &i, KRB5_PADATA_PK_AS_REQ_WIN);
+	    pa = _kdc_find_padata(req, &i, pat[n].type);
+	    if (pa) {
+		ret = pat[n].validate(r, pa);
+		if (ret != 0) {
+		    goto out;
+		}
+		kdc_log(context, config, 0,
+			"%s pre-authentication succeeded -- %s",
+			pat[n].name, r->client_name);
+		found_pa = 1;
+		r->et.flags.pre_authent = 1;
+	    }
 	}
-	if (pa) {
-	    char *client_cert = NULL;
+    }
 
-	    ret = _kdc_pk_rd_padata(context, config, req, pa, client, &pkp);
-	    if (ret) {
-		ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
-		kdc_log(context, config, 5,
-			"Failed to decode PKINIT PA-DATA -- %s",
-			client_name);
-		goto ts_enc;
-	    }
-	    if (ret == 0 && pkp == NULL)
-		goto ts_enc;
-
-	    ret = _kdc_pk_check_client(context,
-				       config,
-				       clientdb,
-				       client,
-				       pkp,
-				       &client_cert);
-	    if (ret) {
-		e_text = "PKINIT certificate not allowed to "
-		    "impersonate principal";
-		_kdc_pk_free_client_param(context, pkp);
-
-		kdc_log(context, config, 0, "%s", e_text);
-		pkp = NULL;
-		goto out;
-	    }
-
-	    found_pa = 1;
-	    et.flags.pre_authent = 1;
-	    kdc_log(context, config, 0,
-		    "PKINIT pre-authentication succeeded -- %s using %s",
-		    client_name, client_cert);
-	    free(client_cert);
-	    if (pkp)
-		goto preauth_done;
-	}
-    ts_enc:
-#endif
-	kdc_log(context, config, 5, "Looking for ENC-TS pa-data -- %s",
-		client_name);
-
-	i = 0;
-	e_text = "No ENC-TS found";
-	while((pa = _kdc_find_padata(req, &i, KRB5_PADATA_ENC_TIMESTAMP))){
-	    krb5_data ts_data;
-	    PA_ENC_TS_ENC p;
-	    size_t len;
-	    EncryptedData enc_data;
-	    Key *pa_key;
-	    char *str;
-
-	    found_pa = 1;
-
-	    if (b->kdc_options.request_anonymous) {
-		ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
-		kdc_log(context, config, 0, "ENC-TS doesn't support anon");
-		goto out;
-	    }
-
-	    ret = decode_EncryptedData(pa->padata_value.data,
-				       pa->padata_value.length,
-				       &enc_data,
-				       &len);
-	    if (ret) {
-		ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
-		kdc_log(context, config, 5, "Failed to decode PA-DATA -- %s",
-			client_name);
-		goto out;
-	    }
-
-	    ret = hdb_enctype2key(context, &client->entry,
-				  enc_data.etype, &pa_key);
-	    if(ret){
-		char *estr;
-		e_text = "No key matches pa-data";
-		ret = KRB5KDC_ERR_ETYPE_NOSUPP;
-		if(krb5_enctype_to_string(context, enc_data.etype, &estr))
-		    estr = NULL;
-		if(estr == NULL)
-		    kdc_log(context, config, 5,
-			    "No client key matching pa-data (%d) -- %s",
-			    enc_data.etype, client_name);
-		else
-		    kdc_log(context, config, 5,
-			    "No client key matching pa-data (%s) -- %s",
-			    estr, client_name);
-		free(estr);
-		free_EncryptedData(&enc_data);
+    if (found_pa == 0) {
+	Key *ckey = NULL;
+	size_t n;
 
+	for (n = 0; n < sizeof(pat) / sizeof(pat[0]); n++) {
+	    if ((pat[n].flags & PA_ANNOUNCE) == 0)
 		continue;
-	    }
-
-	try_next_key:
-	    ret = krb5_crypto_init(context, &pa_key->key, 0, &crypto);
-	    if (ret) {
-		const char *msg = krb5_get_error_message(context, ret);
-		kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
-		krb5_free_error_message(context, msg);
-		free_EncryptedData(&enc_data);
-		continue;
-	    }
-
-	    ret = krb5_decrypt_EncryptedData (context,
-					      crypto,
-					      KRB5_KU_PA_ENC_TIMESTAMP,
-					      &enc_data,
-					      &ts_data);
-	    krb5_crypto_destroy(context, crypto);
-	    /*
-	     * Since the user might have several keys with the same
-	     * enctype but with diffrent salting, we need to try all
-	     * the keys with the same enctype.
-	     */
-	    if(ret){
-		krb5_error_code ret2;
-		const char *msg = krb5_get_error_message(context, ret);
-
-		ret2 = krb5_enctype_to_string(context,
-					      pa_key->key.keytype, &str);
-		if (ret2)
-		    str = NULL;
-		kdc_log(context, config, 5,
-			"Failed to decrypt PA-DATA -- %s "
-			"(enctype %s) error %s",
-			client_name, str ? str : "unknown enctype", msg);
-		krb5_free_error_message(context, msg);
-		free(str);
-
-		if(hdb_next_enctype2key(context, &client->entry,
-					enc_data.etype, &pa_key) == 0)
-		    goto try_next_key;
-		e_text = "Failed to decrypt PA-DATA";
-
-		free_EncryptedData(&enc_data);
-
-		if (clientdb->hdb_auth_status)
-		    (clientdb->hdb_auth_status)(context, clientdb, client, HDB_AUTH_WRONG_PASSWORD);
-
-		ret = KRB5KDC_ERR_PREAUTH_FAILED;
-		continue;
-	    }
-	    free_EncryptedData(&enc_data);
-	    ret = decode_PA_ENC_TS_ENC(ts_data.data,
-				       ts_data.length,
-				       &p,
-				       &len);
-	    krb5_data_free(&ts_data);
-	    if(ret){
-		e_text = "Failed to decode PA-ENC-TS-ENC";
-		ret = KRB5KDC_ERR_PREAUTH_FAILED;
-		kdc_log(context, config,
-			5, "Failed to decode PA-ENC-TS_ENC -- %s",
-			client_name);
-		continue;
-	    }
-	    free_PA_ENC_TS_ENC(&p);
-	    if (abs(kdc_time - p.patimestamp) > context->max_skew) {
-		char client_time[100];
-
-		krb5_format_time(context, p.patimestamp,
-				 client_time, sizeof(client_time), TRUE);
-
- 		ret = KRB5KRB_AP_ERR_SKEW;
- 		kdc_log(context, config, 0,
-			"Too large time skew, "
-			"client time %s is out by %jd > %jd seconds -- %s",
-			client_time,
-			imaxabs(kdc_time - p.patimestamp),
-			(intmax_t)context->max_skew,
-			client_name);
-
-		/*
-		 * The following is needed to make windows clients to
-		 * retry using the timestamp in the error message, if
-		 * there is a e_text, they become unhappy.
-		 */
-		e_text = NULL;
-		goto out;
-	    }
-	    et.flags.pre_authent = 1;
-
-	    set_salt_padata(rep.padata, pa_key->salt);
-
-	    reply_key = &pa_key->key;
-
-	    ret = krb5_enctype_to_string(context, pa_key->key.keytype, &str);
+	    ret = krb5_padata_add(context, &error_method,
+				  pat[n].type, NULL, 0);
 	    if (ret)
-		str = NULL;
-
-	    kdc_log(context, config, 2,
-		    "ENC-TS Pre-authentication succeeded -- %s using %s",
-		    client_name, str ? str : "unknown enctype");
-	    free(str);
-	    break;
+		goto out;
 	}
-#ifdef PKINIT
-    preauth_done:
-#endif
-	if(found_pa == 0 && config->require_preauth)
-	    goto use_pa;
-	/* We come here if we found a pa-enc-timestamp, but if there
-           was some problem with it, other than too large skew */
-	if(found_pa && et.flags.pre_authent == 0){
-	    kdc_log(context, config, 0, "%s -- %s", e_text, client_name);
-	    e_text = NULL;
-	    goto out;
-	}
-    }else if (config->require_preauth
-	      || b->kdc_options.request_anonymous /* hack to force anon */
-	      || client->entry.flags.require_preauth
-	      || server->entry.flags.require_preauth) {
-	METHOD_DATA method_data;
-	PA_DATA *pa;
-	unsigned char *buf;
-	size_t len;
-
-    use_pa:
-	method_data.len = 0;
-	method_data.val = NULL;
-
-	ret = realloc_method_data(&method_data);
-	if (ret) {
-	    free_METHOD_DATA(&method_data);
-	    goto out;
-	}
-	pa = &method_data.val[method_data.len-1];
-	pa->padata_type		= KRB5_PADATA_ENC_TIMESTAMP;
-	pa->padata_value.length	= 0;
-	pa->padata_value.data	= NULL;
-
-#ifdef PKINIT
-	ret = realloc_method_data(&method_data);
-	if (ret) {
-	    free_METHOD_DATA(&method_data);
-	    goto out;
-	}
-	pa = &method_data.val[method_data.len-1];
-	pa->padata_type		= KRB5_PADATA_PK_AS_REQ;
-	pa->padata_value.length	= 0;
-	pa->padata_value.data	= NULL;
-
-	ret = realloc_method_data(&method_data);
-	if (ret) {
-	    free_METHOD_DATA(&method_data);
-	    goto out;
-	}
-	pa = &method_data.val[method_data.len-1];
-	pa->padata_type		= KRB5_PADATA_PK_AS_REQ_WIN;
-	pa->padata_value.length	= 0;
-	pa->padata_value.data	= NULL;
-#endif
 
 	/*
 	 * If there is a client key, send ETYPE_INFO{,2}
 	 */
 	ret = _kdc_find_etype(context,
 			      config->preauth_use_strongest_session_key, TRUE,
-			      client, b->etype.val, b->etype.len, NULL, &ckey);
+			      r->client, b->etype.val, b->etype.len, NULL, &ckey);
 	if (ret == 0) {
 
 	    /*
@@ -1436,83 +1864,93 @@ _kdc_as_rep(krb5_context context,
 
 	    if (older_enctype(ckey->key.keytype)) {
 		ret = get_pa_etype_info(context, config,
-					&method_data, ckey);
-		if (ret) {
-		    free_METHOD_DATA(&method_data);
+					&error_method, ckey);
+		if (ret)
 		    goto out;
-		}
 	    }
 	    ret = get_pa_etype_info2(context, config,
-				     &method_data, ckey);
-	    if (ret) {
-		free_METHOD_DATA(&method_data);
+				     &error_method, ckey);
+	    if (ret)
 		goto out;
-	    }
 	}
 
-	ASN1_MALLOC_ENCODE(METHOD_DATA, buf, len, &method_data, &len, ret);
-	free_METHOD_DATA(&method_data);
+	/* 
+	 * send requre preauth is its required or anon is requested,
+	 * anon is today only allowed via preauth mechanisms.
+	 */
+	if (require_preauth_p(r) || _kdc_is_anon_request(b)) {
+	    ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
+	    _kdc_set_e_text(r, "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ");
+	    goto out;
+	}
 
-	e_data.data   = buf;
-	e_data.length = len;
-	e_text ="Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ",
-
-	ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
-
-	kdc_log(context, config, 0,
-		"No preauth found, returning PREAUTH-REQUIRED -- %s",
-		client_name);
-	goto out;
+	if (ckey == NULL) {
+	    ret = KRB5KDC_ERR_CLIENT_NOTYET;
+	    _kdc_set_e_text(r, "Doesn't have a client key available");
+	    goto out;
+	}
+	krb5_free_keyblock_contents(r->context,  &r->reply_key);
+	ret = krb5_copy_keyblock_contents(r->context, &ckey->key, &r->reply_key);
+	if (ret)
+	    goto out;
     }
 
-    if (clientdb->hdb_auth_status)
-	(clientdb->hdb_auth_status)(context, clientdb, client,
-				    HDB_AUTH_SUCCESS);
+    if (r->clientdb->hdb_auth_status) {
+	r->clientdb->hdb_auth_status(context, r->clientdb, r->client, 
+				     HDB_AUTH_SUCCESS);
+    }
 
     /*
      * Verify flags after the user been required to prove its identity
      * with in a preauth mech.
      */
 
-    ret = _kdc_check_access(context, config, client, client_name,
-			    server, server_name,
-			    req, &e_data);
+    ret = _kdc_check_access(context, config, r->client, r->client_name,
+			    r->server, r->server_name,
+			    req, &error_method);
     if(ret)
 	goto out;
 
     /*
-     * Selelct the best encryption type for the KDC with out regard to
+     * Select the best encryption type for the KDC with out regard to
      * the client since the client never needs to read that data.
      */
 
     ret = _kdc_get_preferred_key(context, config,
-				 server, server_name,
+				 r->server, r->server_name,
 				 &setype, &skey);
     if(ret)
 	goto out;
 
     if(f.renew || f.validate || f.proxy || f.forwarded || f.enc_tkt_in_skey
-       || (f.request_anonymous && !config->allow_anonymous)) {
+       || (_kdc_is_anon_request(b) && !config->allow_anonymous)) {
 	ret = KRB5KDC_ERR_BADOPTION;
-	e_text = "Bad KDC options";
-	kdc_log(context, config, 0, "Bad KDC options -- %s", client_name);
+	_kdc_set_e_text(r, "Bad KDC options");
 	goto out;
     }
 
+    /*
+     * Build reply
+     */
+
     rep.pvno = 5;
     rep.msg_type = krb_as_rep;
 
-    ret = copy_Realm(&client->entry.principal->realm, &rep.crealm);
+    if (_kdc_is_anonymous(context, r->client_princ)) {
+	Realm anon_realm=KRB5_ANON_REALM;
+	ret = copy_Realm(&anon_realm, &rep.crealm);
+    } else
+	ret = copy_Realm(&r->client->entry.principal->realm, &rep.crealm);
     if (ret)
 	goto out;
-    ret = _krb5_principal2principalname(&rep.cname, client->entry.principal);
+    ret = _krb5_principal2principalname(&rep.cname, r->client->entry.principal);
     if (ret)
 	goto out;
 
     rep.ticket.tkt_vno = 5;
-    copy_Realm(&server->entry.principal->realm, &rep.ticket.realm);
+    copy_Realm(&r->server->entry.principal->realm, &rep.ticket.realm);
     _krb5_principal2principalname(&rep.ticket.sname,
-				  server->entry.principal);
+				  r->server->entry.principal);
     /* java 1.6 expects the name to be the same type, lets allow that
      * uncomplicated name-types. */
 #define CNT(sp,t) (((sp)->sname->name_type) == KRB5_NT_##t)
@@ -1520,77 +1958,69 @@ _kdc_as_rep(krb5_context context,
 	rep.ticket.sname.name_type = b->sname->name_type;
 #undef CNT
 
-    et.flags.initial = 1;
-    if(client->entry.flags.forwardable && server->entry.flags.forwardable)
-	et.flags.forwardable = f.forwardable;
+    r->et.flags.initial = 1;
+    if(r->client->entry.flags.forwardable && r->server->entry.flags.forwardable)
+	r->et.flags.forwardable = f.forwardable;
     else if (f.forwardable) {
-	e_text = "Ticket may not be forwardable";
+	_kdc_set_e_text(r, "Ticket may not be forwardable");
 	ret = KRB5KDC_ERR_POLICY;
-	kdc_log(context, config, 0,
-		"Ticket may not be forwardable -- %s", client_name);
 	goto out;
     }
-    if(client->entry.flags.proxiable && server->entry.flags.proxiable)
-	et.flags.proxiable = f.proxiable;
+    if(r->client->entry.flags.proxiable && r->server->entry.flags.proxiable)
+	r->et.flags.proxiable = f.proxiable;
     else if (f.proxiable) {
-	e_text = "Ticket may not be proxiable";
+	_kdc_set_e_text(r, "Ticket may not be proxiable");
 	ret = KRB5KDC_ERR_POLICY;
-	kdc_log(context, config, 0,
-		"Ticket may not be proxiable -- %s", client_name);
 	goto out;
     }
-    if(client->entry.flags.postdate && server->entry.flags.postdate)
-	et.flags.may_postdate = f.allow_postdate;
+    if(r->client->entry.flags.postdate && r->server->entry.flags.postdate)
+	r->et.flags.may_postdate = f.allow_postdate;
     else if (f.allow_postdate){
-	e_text = "Ticket may not be postdate";
+	_kdc_set_e_text(r, "Ticket may not be postdate");
 	ret = KRB5KDC_ERR_POLICY;
-	kdc_log(context, config, 0,
-		"Ticket may not be postdatable -- %s", client_name);
 	goto out;
     }
 
     /* check for valid set of addresses */
     if(!_kdc_check_addresses(context, config, b->addresses, from_addr)) {
-	e_text = "Bad address list in requested";
+	_kdc_set_e_text(r, "Bad address list in requested");
 	ret = KRB5KRB_AP_ERR_BADADDR;
-	kdc_log(context, config, 0,
-		"Bad address list requested -- %s", client_name);
 	goto out;
     }
 
-    ret = copy_PrincipalName(&rep.cname, &et.cname);
+    ret = copy_PrincipalName(&rep.cname, &r->et.cname);
     if (ret)
 	goto out;
-    ret = copy_Realm(&rep.crealm, &et.crealm);
+    ret = copy_Realm(&rep.crealm, &r->et.crealm);
     if (ret)
 	goto out;
 
     {
 	time_t start;
 	time_t t;
-
-	start = et.authtime = kdc_time;
+	
+	start = r->et.authtime = kdc_time;
 
 	if(f.postdated && req->req_body.from){
-	    ALLOC(et.starttime);
-	    start = *et.starttime = *req->req_body.from;
-	    et.flags.invalid = 1;
-	    et.flags.postdated = 1; /* XXX ??? */
+	    ALLOC(r->et.starttime);
+	    start = *r->et.starttime = *req->req_body.from;
+	    r->et.flags.invalid = 1;
+	    r->et.flags.postdated = 1; /* XXX ??? */
 	}
 	_kdc_fix_time(&b->till);
 	t = *b->till;
 
 	/* be careful not overflowing */
 
-	if(client->entry.max_life)
-	    t = start + min(t - start, *client->entry.max_life);
-	if(server->entry.max_life)
-	    t = start + min(t - start, *server->entry.max_life);
+	if(r->client->entry.max_life)
+	    t = start + min(t - start, *r->client->entry.max_life);
+	if(r->server->entry.max_life)
+	    t = start + min(t - start, *r->server->entry.max_life);
 #if 0
 	t = min(t, start + realm->max_life);
 #endif
-	et.endtime = t;
-	if(f.renewable_ok && et.endtime < *b->till){
+	r->et.endtime = t;
+	if(f.renewable_ok && r->et.endtime < *b->till){
 	    f.renewable = 1;
 	    if(b->rtime == NULL){
 		ALLOC(b->rtime);
@@ -1603,29 +2033,29 @@ _kdc_as_rep(krb5_context context,
 	    t = *b->rtime;
 	    if(t == 0)
 		t = MAX_TIME;
-	    if(client->entry.max_renew)
-		t = start + min(t - start, *client->entry.max_renew);
-	    if(server->entry.max_renew)
-		t = start + min(t - start, *server->entry.max_renew);
+	    if(r->client->entry.max_renew)
+		t = start + min(t - start, *r->client->entry.max_renew);
+	    if(r->server->entry.max_renew)
+		t = start + min(t - start, *r->server->entry.max_renew);
 #if 0
 	    t = min(t, start + realm->max_renew);
 #endif
-	    ALLOC(et.renew_till);
-	    *et.renew_till = t;
-	    et.flags.renewable = 1;
+	    ALLOC(r->et.renew_till);
+	    *r->et.renew_till = t;
+	    r->et.flags.renewable = 1;
 	}
     }
 
-    if (f.request_anonymous)
-	et.flags.anonymous = 1;
+    if (_kdc_is_anon_request(b))
+	r->et.flags.anonymous = 1;
 
     if(b->addresses){
-	ALLOC(et.caddr);
-	copy_HostAddresses(b->addresses, et.caddr);
+	ALLOC(r->et.caddr);
+	copy_HostAddresses(b->addresses, r->et.caddr);
     }
 
-    et.transited.tr_type = DOMAIN_X500_COMPRESS;
-    krb5_data_zero(&et.transited.contents);
+    r->et.transited.tr_type = DOMAIN_X500_COMPRESS;
+    krb5_data_zero(&r->et.transited.contents);
 
     /* The MIT ASN.1 library (obviously) doesn't tell lengths encoded
      * as 0 and as 0x80 (meaning indefinite length) apart, and is thus
@@ -1636,246 +2066,217 @@ _kdc_as_rep(krb5_context context,
      * If there's a pw_end or valid_end we will use that,
      * otherwise just a dummy lr.
      */
-    ek.last_req.val = malloc(2 * sizeof(*ek.last_req.val));
-    if (ek.last_req.val == NULL) {
+    r->ek.last_req.val = malloc(2 * sizeof(*r->ek.last_req.val));
+    if (r->ek.last_req.val == NULL) {
 	ret = ENOMEM;
 	goto out;
     }
-    ek.last_req.len = 0;
-    if (client->entry.pw_end
+    r->ek.last_req.len = 0;
+    if (r->client->entry.pw_end
 	&& (config->kdc_warn_pwexpire == 0
-	    || kdc_time + config->kdc_warn_pwexpire >= *client->entry.pw_end)) {
-	ek.last_req.val[ek.last_req.len].lr_type  = LR_PW_EXPTIME;
-	ek.last_req.val[ek.last_req.len].lr_value = *client->entry.pw_end;
-	++ek.last_req.len;
+	    || kdc_time + config->kdc_warn_pwexpire >= *r->client->entry.pw_end)) {
+	r->ek.last_req.val[r->ek.last_req.len].lr_type  = LR_PW_EXPTIME;
+	r->ek.last_req.val[r->ek.last_req.len].lr_value = *r->client->entry.pw_end;
+	++r->ek.last_req.len;
     }
-    if (client->entry.valid_end) {
-	ek.last_req.val[ek.last_req.len].lr_type  = LR_ACCT_EXPTIME;
-	ek.last_req.val[ek.last_req.len].lr_value = *client->entry.valid_end;
-	++ek.last_req.len;
+    if (r->client->entry.valid_end) {
+	r->ek.last_req.val[r->ek.last_req.len].lr_type  = LR_ACCT_EXPTIME;
+	r->ek.last_req.val[r->ek.last_req.len].lr_value = *r->client->entry.valid_end;
+	++r->ek.last_req.len;
     }
-    if (ek.last_req.len == 0) {
-	ek.last_req.val[ek.last_req.len].lr_type  = LR_NONE;
-	ek.last_req.val[ek.last_req.len].lr_value = 0;
-	++ek.last_req.len;
+    if (r->ek.last_req.len == 0) {
+	r->ek.last_req.val[r->ek.last_req.len].lr_type  = LR_NONE;
+	r->ek.last_req.val[r->ek.last_req.len].lr_value = 0;
+	++r->ek.last_req.len;
     }
-    ek.nonce = b->nonce;
-    if (client->entry.valid_end || client->entry.pw_end) {
-	ALLOC(ek.key_expiration);
-	if (client->entry.valid_end) {
-	    if (client->entry.pw_end)
-		*ek.key_expiration = min(*client->entry.valid_end,
-					 *client->entry.pw_end);
+    r->ek.nonce = b->nonce;
+    if (r->client->entry.valid_end || r->client->entry.pw_end) {
+	ALLOC(r->ek.key_expiration);
+	if (r->client->entry.valid_end) {
+	    if (r->client->entry.pw_end)
+		*r->ek.key_expiration = min(*r->client->entry.valid_end,
+					 *r->client->entry.pw_end);
 	    else
-		*ek.key_expiration = *client->entry.valid_end;
+		*r->ek.key_expiration = *r->client->entry.valid_end;
 	} else
-	    *ek.key_expiration = *client->entry.pw_end;
+	    *r->ek.key_expiration = *r->client->entry.pw_end;
     } else
-	ek.key_expiration = NULL;
-    ek.flags = et.flags;
-    ek.authtime = et.authtime;
-    if (et.starttime) {
-	ALLOC(ek.starttime);
-	*ek.starttime = *et.starttime;
+	r->ek.key_expiration = NULL;
+    r->ek.flags = r->et.flags;
+    r->ek.authtime = r->et.authtime;
+    if (r->et.starttime) {
+	ALLOC(r->ek.starttime);
+	*r->ek.starttime = *r->et.starttime;
     }
-    ek.endtime = et.endtime;
-    if (et.renew_till) {
-	ALLOC(ek.renew_till);
-	*ek.renew_till = *et.renew_till;
+    r->ek.endtime = r->et.endtime;
+    if (r->et.renew_till) {
+	ALLOC(r->ek.renew_till);
+	*r->ek.renew_till = *r->et.renew_till;
     }
-    copy_Realm(&rep.ticket.realm, &ek.srealm);
-    copy_PrincipalName(&rep.ticket.sname, &ek.sname);
-    if(et.caddr){
-	ALLOC(ek.caddr);
-	copy_HostAddresses(et.caddr, ek.caddr);
+    copy_Realm(&rep.ticket.realm, &r->ek.srealm);
+    copy_PrincipalName(&rep.ticket.sname, &r->ek.sname);
+    if(r->et.caddr){
+	ALLOC(r->ek.caddr);
+	copy_HostAddresses(r->et.caddr, r->ek.caddr);
     }
 
-#if PKINIT
-    if (pkp) {
-        e_text = "Failed to build PK-INIT reply";
-	ret = _kdc_pk_mk_pa_reply(context, config, pkp, client,
-				  sessionetype, req, req_buffer,
-				  &reply_key, &et.key, rep.padata);
-	if (ret)
-	    goto out;
-	ret = _kdc_add_inital_verified_cas(context,
-					   config,
-					   pkp,
-					   &et);
-	if (ret)
-	    goto out;
+    /*
+     * Check and session and reply keys
+     */
 
-    } else
-#endif
-    {
-	ret = krb5_generate_random_keyblock(context, sessionetype, &et.key);
+    if (r->session_key.keytype == ETYPE_NULL) {
+	ret = krb5_generate_random_keyblock(context, r->sessionetype, &r->session_key);
 	if (ret)
 	    goto out;
     }
 
-    if (reply_key == NULL) {
-	e_text = "Client have no reply key";
+    if (r->reply_key.keytype == ETYPE_NULL) {
+	_kdc_set_e_text(r, "Client have no reply key");
 	ret = KRB5KDC_ERR_CLIENT_NOTYET;
 	goto out;
     }
 
-    ret = copy_EncryptionKey(&et.key, &ek.key);
+    ret = copy_EncryptionKey(&r->session_key, &r->et.key);
     if (ret)
 	goto out;
 
-    /* Add signing of alias referral */
-    if (f.canonicalize) {
-	PA_ClientCanonicalized canon;
-	krb5_data data;
-	PA_DATA pa;
-	krb5_crypto cryptox;
-	size_t len = 0;
+    ret = copy_EncryptionKey(&r->session_key, &r->ek.key);
+    if (ret)
+	goto out;
 
-	memset(&canon, 0, sizeof(canon));
+    if (r->outpadata.len) {
 
-	canon.names.requested_name = *b->cname;
-	canon.names.mapped_name = client->entry.principal->name;
-
-	ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
-			   &canon.names, &len, ret);
-	if (ret)
-	    goto out;
-	if (data.length != len)
-	    krb5_abortx(context, "internal asn.1 error");
-
-	/* sign using "returned session key" */
-	ret = krb5_crypto_init(context, &et.key, 0, &cryptox);
-	if (ret) {
-	    free(data.data);
+	ALLOC(rep.padata);
+	if (rep.padata == NULL) {
+	    ret = ENOMEM;
 	    goto out;
 	}
-
-	ret = krb5_create_checksum(context, cryptox,
-				   KRB5_KU_CANONICALIZED_NAMES, 0,
-				   data.data, data.length,
-				   &canon.canon_checksum);
-	free(data.data);
-	krb5_crypto_destroy(context, cryptox);
+	ret = copy_METHOD_DATA(&r->outpadata, rep.padata);
 	if (ret)
 	    goto out;
-
-	ASN1_MALLOC_ENCODE(PA_ClientCanonicalized, data.data, data.length,
-			   &canon, &len, ret);
-	free_Checksum(&canon.canon_checksum);
-	if (ret)
-	    goto out;
-	if (data.length != len)
-	    krb5_abortx(context, "internal asn.1 error");
-
-	pa.padata_type = KRB5_PADATA_CLIENT_CANONICALIZED;
-	pa.padata_value = data;
-	ret = add_METHOD_DATA(rep.padata, &pa);
-	free(data.data);
-	if (ret)
-	    goto out;
-    }
-
-    if (rep.padata->len == 0) {
-	free(rep.padata);
-	rep.padata = NULL;
     }
 
     /* Add the PAC */
     if (send_pac_p(context, req)) {
-	krb5_pac p = NULL;
-	krb5_data data;
-
-	ret = _kdc_pac_generate(context, client, &p);
-	if (ret) {
-	    kdc_log(context, config, 0, "PAC generation failed for -- %s",
-		    client_name);
-	    goto out;
-	}
-	if (p != NULL) {
-	    ret = _krb5_pac_sign(context, p, et.authtime,
-				 client->entry.principal,
-				 &skey->key, /* Server key */
-				 &skey->key, /* FIXME: should be krbtgt key */
-				 &data);
-	    krb5_pac_free(context, p);
-	    if (ret) {
-		kdc_log(context, config, 0, "PAC signing failed for -- %s",
-			client_name);
-		goto out;
-	    }
-
-	    ret = _kdc_tkt_add_if_relevant_ad(context, &et,
-					      KRB5_AUTHDATA_WIN2K_PAC,
-					      &data);
-	    krb5_data_free(&data);
-	    if (ret)
-		goto out;
-	}
+	generate_pac(r, skey);
     }
 
-    _kdc_log_timestamp(context, config, "AS-REQ", et.authtime, et.starttime,
-		       et.endtime, et.renew_till);
+    _kdc_log_timestamp(context, config, "AS-REQ", r->et.authtime, r->et.starttime,
+		       r->et.endtime, r->et.renew_till);
 
     /* do this as the last thing since this signs the EncTicketPart */
     ret = _kdc_add_KRB5SignedPath(context,
 				  config,
-				  server,
+				  r->server,
 				  setype,
-				  client->entry.principal,
+				  r->client->entry.principal,
 				  NULL,
 				  NULL,
-				  &et);
+				  &r->et);
     if (ret)
 	goto out;
 
-    log_as_req(context, config, reply_key->keytype, setype, b);
+    log_as_req(context, config, r->reply_key.keytype, setype, b);
+
+    /*
+     * We always say we support FAST/enc-pa-rep
+     */
+
+    r->et.flags.enc_pa_rep = r->ek.flags.enc_pa_rep = 1;
+
+    /*
+     * Add REQ_ENC_PA_REP if client supports it
+     */
+
+    i = 0;
+    pa = _kdc_find_padata(req, &i, KRB5_PADATA_REQ_ENC_PA_REP);
+    if (pa) {
+
+	ret = add_enc_pa_rep(r);
+	if (ret) {
+	    const char *msg = krb5_get_error_message(r->context, ret);
+	    _kdc_r_log(r, 0, "add_enc_pa_rep failed: %s: %d", msg, ret);
+	    krb5_free_error_message(r->context, msg);
+	    goto out;
+	}
+    }
+
+    /*
+     *
+     */
 
     ret = _kdc_encode_reply(context, config,
-			    &rep, &et, &ek, setype, server->entry.kvno,
-			    &skey->key, client->entry.kvno,
-			    reply_key, 0, &e_text, reply);
-    free_EncTicketPart(&et);
-    free_EncKDCRepPart(&ek);
+			    r->armor_crypto, req->req_body.nonce,
+			    &rep, &r->et, &r->ek, setype, r->server->entry.kvno,
+			    &skey->key, r->client->entry.kvno,
+			    &r->reply_key, 0, &r->e_text, reply);
     if (ret)
 	goto out;
 
-    /* */
+    /*
+     * Check if message too large
+     */
     if (datagram_reply && reply->length > config->max_datagram_reply_length) {
 	krb5_data_free(reply);
 	ret = KRB5KRB_ERR_RESPONSE_TOO_BIG;
-	e_text = "Reply packet too large";
+	_kdc_set_e_text(r, "Reply packet too large");
     }
 
 out:
     free_AS_REP(&rep);
-    if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE){
-	krb5_mk_error(context,
-		      ret,
-		      e_text,
-		      (e_data.data ? &e_data : NULL),
-		      client_princ,
-		      server_princ,
-		      NULL,
-		      NULL,
-		      reply);
-	ret = 0;
+
+    /*
+     * In case of a non proxy error, build an error message.
+     */
+    if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
+	ret = _kdc_fast_mk_error(context, r,
+				 &error_method,
+				 r->armor_crypto,
+				 &req->req_body,
+				 ret, r->e_text,
+				 r->server_princ,
+				 &r->client_princ->name,
+				 &r->client_princ->realm,
+				 NULL, NULL,
+				 reply);
+	if (ret)
+	    goto out2;
     }
-#ifdef PKINIT
-    if (pkp)
-	_kdc_pk_free_client_param(context, pkp);
-#endif
-    if (e_data.data)
-        free(e_data.data);
-    if (client_princ)
-	krb5_free_principal(context, client_princ);
-    free(client_name);
-    if (server_princ)
-	krb5_free_principal(context, server_princ);
-    free(server_name);
-    if(client)
-	_kdc_free_ent(context, client);
-    if(server)
-	_kdc_free_ent(context, server);
+out2:
+    free_EncTicketPart(&r->et);
+    free_EncKDCRepPart(&r->ek);
+    free_KDCFastState(&r->fast);
+
+    if (error_method.len)
+	free_METHOD_DATA(&error_method);
+    if (r->outpadata.len)
+	free_METHOD_DATA(&r->outpadata);
+    if (r->client_princ) {
+	krb5_free_principal(context, r->client_princ);
+	r->client_princ = NULL;
+    }
+    if (r->client_name) {
+	free(r->client_name);
+	r->client_name = NULL;
+    }
+    if (r->server_princ){
+	krb5_free_principal(context, r->server_princ);
+	r->server_princ = NULL;
+    }
+    if (r->server_name) {
+	free(r->server_name);
+	r->server_name = NULL;
+    }
+    if (r->client)
+	_kdc_free_ent(context, r->client);
+    if (r->server)
+	_kdc_free_ent(context, r->server);
+    if (r->armor_crypto) {
+	krb5_crypto_destroy(r->context, r->armor_crypto);
+	r->armor_crypto = NULL;
+    }
+    krb5_free_keyblock_contents(r->context, &r->reply_key);
+    krb5_free_keyblock_contents(r->context, &r->session_key);
     return ret;
 }
 
@@ -1939,3 +2340,14 @@ _kdc_tkt_add_if_relevant_ad(krb5_context context,
 
     return 0;
 }
+
+krb5_boolean
+_kdc_is_anon_request(const KDC_REQ_BODY *b)
+{
+	/* some versions of heimdal use bit 14 instead of 16 for
+	   request_anonymous, as indicated in the anonymous draft prior to
+	   version 11. Bit 14 is assigned to S4U2Proxy, but all S4U2Proxy
+	   requests will have a second ticket; don't consider those anonymous */
+	return (b->kdc_options.request_anonymous ||
+		(b->kdc_options.constrained_delegation && !b->additional_tickets));
+}
diff --git a/crypto/external/bsd/heimdal/dist/kdc/krb5tgs.c b/crypto/external/bsd/heimdal/dist/kdc/krb5tgs.c
index 71a04f1be..49c31cad9 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/krb5tgs.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/krb5tgs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: krb5tgs.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: krb5tgs.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
@@ -141,7 +141,7 @@ _kdc_add_KRB5SignedPath(krb5_context context,
 
     {
 	Key *key;
-	ret = hdb_enctype2key(context, &krbtgt->entry, enctype, &key);
+	ret = hdb_enctype2key(context, &krbtgt->entry, NULL, enctype, &key);
 	if (ret == 0)
 	    ret = krb5_crypto_init(context, &key->key, 0, &crypto);
 	if (ret) {
@@ -228,7 +228,8 @@ check_KRB5SignedPath(krb5_context context,
 
 	{
 	    Key *key;
-	    ret = hdb_enctype2key(context, &krbtgt->entry, sp.etype, &key);
+	    ret = hdb_enctype2key(context, &krbtgt->entry, NULL, /* XXX use correct kvno! */
+				  sp.etype, &key);
 	    if (ret == 0)
 		ret = krb5_crypto_init(context, &key->key, 0, &crypto);
 	    if (ret) {
@@ -286,7 +287,6 @@ check_PAC(krb5_context context,
 	  hdb_entry_ex *server,
 	  hdb_entry_ex *krbtgt,
 	  const EncryptionKey *server_check_key,
-	  const EncryptionKey *krbtgt_check_key,
 	  const EncryptionKey *server_sign_key,
 	  const EncryptionKey *krbtgt_sign_key,
 	  EncTicketPart *tkt,
@@ -332,7 +332,7 @@ check_PAC(krb5_context context,
 
 		ret = krb5_pac_verify(context, pac, tkt->authtime,
 				      client_principal,
-				      server_check_key, krbtgt_check_key);
+				      server_check_key, NULL);
 		if (ret) {
 		    krb5_pac_free(context, pac);
 		    return ret;
@@ -816,8 +816,6 @@ tgs_make_reply(krb5_context context,
     rep.ticket.tkt_vno = 5;
 
     ek.caddr = et.caddr;
-    if(et.caddr == NULL)
-	et.caddr = tgt->caddr;
 
     {
 	time_t life;
@@ -924,12 +922,12 @@ tgs_make_reply(krb5_context context,
 
     ek.key = et.key;
     /* MIT must have at least one last_req */
-    ek.last_req.len = 1;
     ek.last_req.val = calloc(1, sizeof(*ek.last_req.val));
     if (ek.last_req.val == NULL) {
 	ret = ENOMEM;
 	goto out;
     }
+    ek.last_req.len = 1; /* set after alloc to avoid null deref on cleanup */
     ek.nonce = b->nonce;
     ek.flags = et.flags;
     ek.authtime = et.authtime;
@@ -989,7 +987,7 @@ tgs_make_reply(krb5_context context,
        CAST session key. Should the DES3 etype be added to the
        etype list, even if we don't want a session key with
        DES3? */
-    ret = _kdc_encode_reply(context, config,
+    ret = _kdc_encode_reply(context, config, NULL, 0,
 			    &rep, &et, &ek, serverkey->keytype,
 			    kvno,
 			    serverkey, 0, replykey, rk_is_subkey,
@@ -1094,23 +1092,6 @@ out:
     return ret;
 }
 
-/*
- *
- */
-
-static const char *
-find_rpath(krb5_context context, Realm crealm, Realm srealm)
-{
-    const char *new_realm = krb5_config_get_string(context,
-						   NULL,
-						   "capaths",
-						   crealm,
-						   srealm,
-						   NULL);
-    return new_realm;
-}
-
-
 static krb5_boolean
 need_referral(krb5_context context, krb5_kdc_configuration *config,
 	      const KDCOptions * const options, krb5_principal server,
@@ -1123,7 +1104,23 @@ need_referral(krb5_context context, krb5_kdc_configuration *config,
 
     if (server->name.name_string.len == 1)
 	name = server->name.name_string.val[0];
-    else if (server->name.name_string.len > 1)
+    else if (server->name.name_string.len == 3) {
+	/*
+	  This is used to give referrals for the
+	  E3514235-4B06-11D1-AB04-00C04FC2DCD2/NTDSGUID/DNSDOMAIN
+	  SPN form, which is used for inter-domain communication in AD
+	 */
+	name = server->name.name_string.val[2];
+	kdc_log(context, config, 0, "Giving 3 part referral for %s", name);
+	*realms = malloc(sizeof(char *)*2);
+	if (*realms == NULL) {
+	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
+	    return FALSE;
+	}
+	(*realms)[0] = strdup(name);
+	(*realms)[1] = NULL;
+	return TRUE;
+    } else if (server->name.name_string.len > 1)
 	name = server->name.name_string.val[1];
     else
 	return FALSE;
@@ -1158,6 +1155,10 @@ tgs_parse_request(krb5_context context,
     krb5_flags ap_req_options;
     krb5_flags verify_ap_req_flags;
     krb5_crypto crypto;
+    krb5uint32 krbtgt_kvno;     /* kvno used for the PA-TGS-REQ AP-REQ Ticket */
+    krb5uint32 krbtgt_kvno_try;
+    int kvno_search_tries = 4;  /* number of kvnos to try when tkt_vno == 0 */
+    const Keys *krbtgt_keys;/* keyset for TGT tkt_vno */
     Key *tkey;
     krb5_keyblock *subkey = NULL;
     unsigned usage;
@@ -1188,20 +1189,51 @@ tgs_parse_request(krb5_context context,
 				       ap_req.ticket.sname,
 				       ap_req.ticket.realm);
 
-    ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, ap_req.ticket.enc_part.kvno, NULL, krbtgt);
+    krbtgt_kvno = ap_req.ticket.enc_part.kvno ? *ap_req.ticket.enc_part.kvno : 0;
+    ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT,
+			&krbtgt_kvno, NULL, krbtgt);
 
-    if(ret == HDB_ERR_NOT_FOUND_HERE) {
+    if (ret == HDB_ERR_NOT_FOUND_HERE) {
+	/* XXX Factor out this unparsing of the same princ all over */
 	char *p;
 	ret = krb5_unparse_name(context, princ, &p);
 	if (ret != 0)
 	    p = failed;
 	krb5_free_principal(context, princ);
-	kdc_log(context, config, 5, "Ticket-granting ticket account %s does not have secrets at this KDC, need to proxy", p);
+	kdc_log(context, config, 5,
+		"Ticket-granting ticket account %s does not have secrets at "
+		"this KDC, need to proxy", p);
 	if (ret == 0)
 	    free(p);
 	ret = HDB_ERR_NOT_FOUND_HERE;
 	goto out;
-    } else if(ret){
+    } else if (ret == HDB_ERR_KVNO_NOT_FOUND) {
+	char *p;
+	ret = krb5_unparse_name(context, princ, &p);
+	if (ret != 0)
+	    p = failed;
+	krb5_free_principal(context, princ);
+	kdc_log(context, config, 5,
+		"Ticket-granting ticket account %s does not have keys for "
+		"kvno %d at this KDC", p, krbtgt_kvno);
+	if (ret == 0)
+	    free(p);
+	ret = HDB_ERR_KVNO_NOT_FOUND;
+	goto out;
+    } else if (ret == HDB_ERR_NO_MKEY) {
+	char *p;
+	ret = krb5_unparse_name(context, princ, &p);
+	if (ret != 0)
+	    p = failed;
+	krb5_free_principal(context, princ);
+	kdc_log(context, config, 5,
+		"Missing master key for decrypting keys for ticket-granting "
+		"ticket account %s with kvno %d at this KDC", p, krbtgt_kvno);
+	if (ret == 0)
+	    free(p);
+	ret = HDB_ERR_KVNO_NOT_FOUND;
+	goto out;
+    } else if (ret) {
 	const char *msg = krb5_get_error_message(context, ret);
 	char *p;
 	ret = krb5_unparse_name(context, princ, &p);
@@ -1217,30 +1249,18 @@ tgs_parse_request(krb5_context context,
 	goto out;
     }
 
-    if(ap_req.ticket.enc_part.kvno &&
-       *ap_req.ticket.enc_part.kvno != (*krbtgt)->entry.kvno){
-	char *p;
-
-	ret = krb5_unparse_name (context, princ, &p);
-	krb5_free_principal(context, princ);
-	if (ret != 0)
-	    p = failed;
-	kdc_log(context, config, 0,
-		"Ticket kvno = %d, DB kvno = %d (%s)",
-		*ap_req.ticket.enc_part.kvno,
-		(*krbtgt)->entry.kvno,
-		p);
-	if (ret == 0)
-	    free (p);
-	ret = KRB5KRB_AP_ERR_BADKEYVER;
-	goto out;
-    }
-
+    krbtgt_kvno_try = krbtgt_kvno ? krbtgt_kvno : (*krbtgt)->entry.kvno;
     *krbtgt_etype = ap_req.ticket.enc_part.etype;
 
-    ret = hdb_enctype2key(context, &(*krbtgt)->entry,
+next_kvno:
+    krbtgt_keys = hdb_kvno2keys(context, &(*krbtgt)->entry, krbtgt_kvno_try);
+    ret = hdb_enctype2key(context, &(*krbtgt)->entry, krbtgt_keys,
 			  ap_req.ticket.enc_part.etype, &tkey);
-    if(ret){
+    if (ret && krbtgt_kvno == 0 && kvno_search_tries > 0) {
+	kvno_search_tries--;
+	krbtgt_kvno_try--;
+	goto next_kvno;
+    } else if (ret) {
 	char *str = NULL, *p = NULL;
 
 	krb5_enctype_to_string(context, ap_req.ticket.enc_part.etype, &str);
@@ -1269,6 +1289,11 @@ tgs_parse_request(krb5_context context,
 			      &ap_req_options,
 			      ticket,
 			      KRB5_KU_TGS_REQ_AUTH);
+    if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY && kvno_search_tries > 0) {
+	kvno_search_tries--;
+	krbtgt_kvno_try--;
+	goto next_kvno;
+    }
 
     krb5_free_principal(context, princ);
     if(ret) {
@@ -1485,8 +1510,8 @@ tgs_build_reply(krb5_context context,
 {
     krb5_error_code ret;
     krb5_principal cp = NULL, sp = NULL, rsp = NULL, tp = NULL, dp = NULL;
-    krb5_principal krbtgt_principal = NULL;
-    char *spn = NULL, *cpn = NULL, *tpn = NULL, *dpn = NULL;
+    krb5_principal krbtgt_out_principal = NULL;
+    char *spn = NULL, *cpn = NULL, *tpn = NULL, *dpn = NULL, *krbtgt_out_n = NULL;
     hdb_entry_ex *server = NULL, *client = NULL, *s4u2self_impersonated_client = NULL;
     HDB *clientdb, *s4u2self_impersonated_clientdb;
     krb5_realm ref_realm = NULL;
@@ -1496,6 +1521,10 @@ tgs_build_reply(krb5_context context,
     krb5_keyblock sessionkey;
     krb5_kvno kvno;
     krb5_data rspac;
+    const char *our_realm = /* Realm of this KDC */
+        krb5_principal_get_comp_string(context, krbtgt->entry.principal, 1);
+    char **capath = NULL;
+    size_t num_capath = 0;
 
     hdb_entry_ex *krbtgt_out = NULL;
 
@@ -1503,7 +1532,6 @@ tgs_build_reply(krb5_context context,
 
     PrincipalName *s;
     Realm r;
-    int nloop = 0;
     EncTicketPart adtkt;
     char opt_str[128];
     int signedpath = 0;
@@ -1530,6 +1558,8 @@ tgs_build_reply(krb5_context context,
 	hdb_entry_ex *uu;
 	krb5_principal p;
 	Key *uukey;
+	krb5uint32 second_kvno = 0;
+	krb5uint32 *kvno_ptr = NULL;
 
 	if(b->additional_tickets == NULL ||
 	   b->additional_tickets->len == 0){
@@ -1546,8 +1576,12 @@ tgs_build_reply(krb5_context context,
 	    goto out;
 	}
 	_krb5_principalname2krb5_principal(context, &p, t->sname, t->realm);
+	if(t->enc_part.kvno){
+	    second_kvno = *t->enc_part.kvno;
+	    kvno_ptr = &second_kvno;
+	}
 	ret = _kdc_db_fetch(context, config, p,
-			    HDB_F_GET_KRBTGT, t->enc_part.kvno,
+			    HDB_F_GET_KRBTGT, kvno_ptr,
 			    NULL, &uu);
 	krb5_free_principal(context, p);
 	if(ret){
@@ -1555,7 +1589,7 @@ tgs_build_reply(krb5_context context,
 		ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
 	    goto out;
 	}
-	ret = hdb_enctype2key(context, &uu->entry,
+	ret = hdb_enctype2key(context, &uu->entry, NULL,
 			      t->enc_part.etype, &uukey);
 	if(ret){
 	    _kdc_free_ent(context, uu);
@@ -1602,51 +1636,90 @@ server_lookup:
     ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER | flags,
 			NULL, NULL, &server);
 
-    if(ret == HDB_ERR_NOT_FOUND_HERE) {
+    if (ret == HDB_ERR_NOT_FOUND_HERE) {
 	kdc_log(context, config, 5, "target %s does not have secrets at this KDC, need to proxy", sp);
 	goto out;
-    } else if(ret){
+    } else if (ret == HDB_ERR_WRONG_REALM) {
+        free(ref_realm);
+	ref_realm = strdup(server->entry.principal->realm);
+	if (ref_realm == NULL) {
+            ret = krb5_enomem(context);
+	    goto out;
+	}
+
+	kdc_log(context, config, 5,
+		"Returning a referral to realm %s for "
+		"server %s.",
+		ref_realm, spn);
+	krb5_free_principal(context, sp);
+	sp = NULL;
+	ret = krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
+				  ref_realm, NULL);
+	if (ret)
+	    goto out;
+	free(spn);
+        spn = NULL;
+	ret = krb5_unparse_name(context, sp, &spn);
+	if (ret)
+	    goto out;
+
+	goto server_lookup;
+    } else if (ret) {
 	const char *new_rlm, *msg;
 	Realm req_rlm;
 	krb5_realm *realms;
 
 	if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
-	    if(nloop++ < 2) {
-		new_rlm = find_rpath(context, tgt->crealm, req_rlm);
-		if(new_rlm) {
-		    kdc_log(context, config, 5, "krbtgt for realm %s "
-			    "not found, trying %s",
-			    req_rlm, new_rlm);
-		    krb5_free_principal(context, sp);
-		    free(spn);
-		    krb5_make_principal(context, &sp, r,
-					KRB5_TGS_NAME, new_rlm, NULL);
-		    ret = krb5_unparse_name(context, sp, &spn);
-		    if (ret)
-			goto out;
+            if (capath == NULL) {
+                /* With referalls, hierarchical capaths are always enabled */
+                ret = _krb5_find_capath(context, tgt->crealm, our_realm,
+                                        req_rlm, TRUE, &capath, &num_capath);
+                if (ret)
+                    goto out;
+            }
+            new_rlm = num_capath > 0 ? capath[--num_capath] : NULL;
+            if (new_rlm) {
+                kdc_log(context, config, 5, "krbtgt from %s via %s for "
+                        "realm %s not found, trying %s", tgt->crealm,
+                        our_realm, req_rlm, new_rlm);
 
-		    if (ref_realm)
-			free(ref_realm);
-		    ref_realm = strdup(new_rlm);
-		    goto server_lookup;
-		}
-	    }
-	} else if(need_referral(context, config, &b->kdc_options, sp, &realms)) {
+                free(ref_realm);
+                ref_realm = strdup(new_rlm);
+                if (ref_realm == NULL) {
+                    ret = krb5_enomem(context);
+                    goto out;
+                }
+
+                krb5_free_principal(context, sp);
+                sp = NULL;
+                krb5_make_principal(context, &sp, r,
+                                    KRB5_TGS_NAME, ref_realm, NULL);
+                free(spn);
+                spn = NULL;
+                ret = krb5_unparse_name(context, sp, &spn);
+                if (ret)
+                    goto out;
+                goto server_lookup;
+            }
+	} else if (need_referral(context, config, &b->kdc_options, sp, &realms)) {
 	    if (strcmp(realms[0], sp->realm) != 0) {
 		kdc_log(context, config, 5,
 			"Returning a referral to realm %s for "
 			"server %s that was not found",
 			realms[0], spn);
 		krb5_free_principal(context, sp);
-		free(spn);
+                sp = NULL;
 		krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
 				    realms[0], NULL);
+		free(spn);
+                spn = NULL;
 		ret = krb5_unparse_name(context, sp, &spn);
-		if (ret)
+		if (ret) {
+		    krb5_free_host_realm(context, realms);
 		    goto out;
+		}
 
-		if (ref_realm)
-		    free(ref_realm);
+                free(ref_realm);
 		ref_realm = strdup(realms[0]);
 
 		krb5_free_host_realm(context, realms);
@@ -1737,7 +1810,7 @@ server_lookup:
      * Validate authoriation data
      */
 
-    ret = hdb_enctype2key(context, &krbtgt->entry,
+    ret = hdb_enctype2key(context, &krbtgt->entry, NULL, /* XXX use the right kvno! */
 			  krbtgt_etype, &tkey_check);
     if(ret) {
 	kdc_log(context, config, 0,
@@ -1745,46 +1818,53 @@ server_lookup:
 	goto out;
     }
 
-    /* Now refetch the primary krbtgt, and get the current kvno (the
+    /* 
+     * Now refetch the primary krbtgt, and get the current kvno (the
      * sign check may have been on an old kvno, and the server may
-     * have been an incoming trust) */
-    ret = krb5_make_principal(context, &krbtgt_principal,
-			      krb5_principal_get_comp_string(context,
-							     krbtgt->entry.principal,
-							     1),
-			      KRB5_TGS_NAME,
-			      krb5_principal_get_comp_string(context,
-							     krbtgt->entry.principal,
-							     1), NULL);
-    if(ret) {
-	kdc_log(context, config, 0,
-		    "Failed to generate krbtgt principal");
-	goto out;
+     * have been an incoming trust)
+     */
+    
+    ret = krb5_make_principal(context,
+                              &krbtgt_out_principal,
+                              our_realm,
+                              KRB5_TGS_NAME,
+                              our_realm,
+                              NULL);
+    if (ret) {
+        kdc_log(context, config, 0,
+                "Failed to make krbtgt principal name object for "
+                "authz-data signatures");
+        goto out;
+    }
+    ret = krb5_unparse_name(context, krbtgt_out_principal, &krbtgt_out_n);
+    if (ret) {
+        kdc_log(context, config, 0,
+                "Failed to make krbtgt principal name object for "
+                "authz-data signatures");
+        goto out;
     }
 
-    ret = _kdc_db_fetch(context, config, krbtgt_principal, HDB_F_GET_KRBTGT, NULL, NULL, &krbtgt_out);
-    krb5_free_principal(context, krbtgt_principal);
+    ret = _kdc_db_fetch(context, config, krbtgt_out_principal,
+			HDB_F_GET_KRBTGT, NULL, NULL, &krbtgt_out);
     if (ret) {
-	krb5_error_code ret2;
-	char *ktpn, *ktpn2;
+	char *ktpn = NULL;
 	ret = krb5_unparse_name(context, krbtgt->entry.principal, &ktpn);
-	ret2 = krb5_unparse_name(context, krbtgt_principal, &ktpn2);
 	kdc_log(context, config, 0,
-		"Request with wrong krbtgt: %s, %s not found in our database",
-		(ret == 0) ? ktpn : "<unknown>", (ret2 == 0) ? ktpn2 : "<unknown>");
-	if(ret == 0)
-	    free(ktpn);
-	if(ret2 == 0)
-	    free(ktpn2);
+		"No such principal %s (needed for authz-data signature keys) "
+		"while processing TGS-REQ for service %s with krbtg %s",
+		krbtgt_out_n, spn, (ret == 0) ? ktpn : "<unknown>");
+	free(ktpn);
 	ret = KRB5KRB_AP_ERR_NOT_US;
 	goto out;
     }
 
-    /* The first realm is the realm of the service, the second is
+    /* 
+     * The first realm is the realm of the service, the second is
      * krbtgt/<this>/@REALM component of the krbtgt DN the request was
      * encrypted to.  The redirection via the krbtgt_out entry allows
      * the DB to possibly correct the case of the realm (Samba4 does
-     * this) before the strcmp() */
+     * this) before the strcmp() 
+     */
     if (strcmp(krb5_principal_get_realm(context, server->entry.principal),
 	       krb5_principal_get_realm(context, krbtgt_out->entry.principal)) != 0) {
 	char *ktpn;
@@ -1795,10 +1875,18 @@ server_lookup:
 	if(ret == 0)
 	    free(ktpn);
 	ret = KRB5KRB_AP_ERR_NOT_US;
+	goto out;
     }
 
-    ret = hdb_enctype2key(context, &krbtgt_out->entry,
-			  krbtgt_etype, &tkey_sign);
+    ret = _kdc_get_preferred_key(context, config, krbtgt_out, krbtgt_out_n,
+				 NULL, &tkey_sign);
+    if (ret) {
+	kdc_log(context, config, 0,
+		    "Failed to find key for krbtgt PAC signature");
+	goto out;
+    }
+    ret = hdb_enctype2key(context, &krbtgt_out->entry, NULL,
+			  tkey_sign->key.keytype, &tkey_sign);
     if(ret) {
 	kdc_log(context, config, 0,
 		    "Failed to find key for krbtgt PAC signature");
@@ -1837,7 +1925,7 @@ server_lookup:
 
     ret = check_PAC(context, config, cp, NULL,
 		    client, server, krbtgt,
-		    &tkey_check->key, &tkey_check->key,
+		    &tkey_check->key,
 		    ekey, &tkey_sign->key,
 		    tgt, &rspac, &signedpath);
     if (ret) {
@@ -2037,6 +2125,8 @@ server_lookup:
 	t = &b->additional_tickets->val[0];
 
 	ret = hdb_enctype2key(context, &client->entry,
+			      hdb_kvno2keys(context, &client->entry,
+					    t->enc_part.kvno ? * t->enc_part.kvno : 0),
 			      t->enc_part.etype, &clientkey);
 	if(ret){
 	    ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
@@ -2107,7 +2197,7 @@ server_lookup:
 	 */
 	ret = check_PAC(context, config, tp, dp,
 			client, server, krbtgt,
-			&clientkey->key, &tkey_check->key,
+			&clientkey->key,
 			ekey, &tkey_sign->key,
 			&adtkt, &rspac, &ad_signedpath);
 	if (ret) {
@@ -2237,7 +2327,7 @@ server_lookup:
 			 client,
 			 cp,
 			 krbtgt_out,
-			 krbtgt_etype,
+			 tkey_sign->key.keytype,
 			 spp,
 			 &rspac,
 			 &enc_pa_data,
@@ -2249,8 +2339,9 @@ out:
 	    free(tpn);
     free(spn);
     free(cpn);
-    if (dpn)
-	free(dpn);
+    free(dpn);
+    free(krbtgt_out_n);
+    _krb5_free_capath(context, capath);
 
     krb5_data_free(&rspac);
     krb5_free_keyblock_contents(context, &sessionkey);
@@ -2265,14 +2356,11 @@ out:
 
     if (tp && tp != cp)
 	krb5_free_principal(context, tp);
-    if (cp)
-	krb5_free_principal(context, cp);
-    if (dp)
-	krb5_free_principal(context, dp);
-    if (sp)
-	krb5_free_principal(context, sp);
-    if (ref_realm)
-	free(ref_realm);
+    krb5_free_principal(context, cp);
+    krb5_free_principal(context, dp);
+    krb5_free_principal(context, sp);
+    krb5_free_principal(context, krbtgt_out_principal);
+    free(ref_realm);
     free_METHOD_DATA(&enc_pa_data);
 
     free_EncTicketPart(&adtkt);
@@ -2345,6 +2433,13 @@ _kdc_tgs_rep(krb5_context context,
 	goto out;
     }
 
+    {
+	const PA_DATA *pa = _kdc_find_padata(req, &i, KRB5_PADATA_FX_FAST);
+	if (pa)
+	    kdc_log(context, config, 10, "Got TGS FAST request"); 
+    }
+
+
     ret = tgs_build_reply(context,
 			  config,
 			  req,
@@ -2375,17 +2470,23 @@ _kdc_tgs_rep(krb5_context context,
 out:
     if (replykey)
 	krb5_free_keyblock(context, replykey);
+
     if(ret && ret != HDB_ERR_NOT_FOUND_HERE && data->data == NULL){
-	krb5_mk_error(context,
-		      ret,
-		      NULL,
-		      NULL,
-		      NULL,
-		      NULL,
-		      csec,
-		      cusec,
-		      data);
-	ret = 0;
+	/* XXX add fast wrapping on the error */
+	METHOD_DATA error_method = { 0, NULL };
+	
+
+	kdc_log(context, config, 10, "tgs-req: sending error: %d to client", ret);
+	ret = _kdc_fast_mk_error(context, NULL,
+				 &error_method,
+				 NULL,
+				 NULL,
+				 ret, NULL,
+				 NULL,
+				 NULL, NULL,
+				 csec, cusec,
+				 data);
+	free_METHOD_DATA(&error_method);
     }
     free(csec);
     free(cusec);
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kstash.8 b/crypto/external/bsd/heimdal/dist/kdc/kstash.8
index 503446cef..c64fa4435 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kstash.8
+++ b/crypto/external/bsd/heimdal/dist/kdc/kstash.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kstash.8,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kstash.8,v 1.4 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kstash.c b/crypto/external/bsd/heimdal/dist/kdc/kstash.c
index b6d4c73a0..af36b4a9f 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kstash.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/kstash.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kstash.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kstash.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -66,8 +66,9 @@ int num_args = sizeof(args) / sizeof(args[0]);
 int
 main(int argc, char **argv)
 {
-    char buf[1024];
+    char buf[1024+1];
     krb5_error_code ret;
+    int aret;
 
     krb5_enctype enctype;
 
@@ -86,8 +87,11 @@ main(int argc, char **argv)
 	krb5_errx(context, 1, "random-key and master-key-fd "
 		  "is mutual exclusive");
 
-    if (keyfile == NULL)
-	asprintf(&keyfile, "%s/m-key", hdb_db_dir(context));
+    if (keyfile == NULL) {
+	aret = asprintf(&keyfile, "%s/m-key", hdb_db_dir(context));
+	if (aret == -1)
+	    krb5_errx(context, 1, "out of memory");
+    }
 
     ret = krb5_string_to_enctype(context, enctype_str, &enctype);
     if(ret)
@@ -115,7 +119,7 @@ main(int argc, char **argv)
 	} else {
 	    if(master_key_fd != -1) {
 		ssize_t n;
-		n = read(master_key_fd, buf, sizeof(buf));
+		n = read(master_key_fd, buf, sizeof(buf)-1);
 		if(n <= 0)
 		    krb5_err(context, 1, errno, "failed to read passphrase");
 		buf[n] = '\0';
@@ -134,9 +138,20 @@ main(int argc, char **argv)
     }
 
     {
-	char *new, *old;
-	asprintf(&old, "%s.old", keyfile);
-	asprintf(&new, "%s.new", keyfile);
+	char *new = NULL, *old = NULL;
+
+	aret = asprintf(&old, "%s.old", keyfile);
+	if (aret == -1) {
+	    old = NULL;
+	    ret = ENOMEM;
+	    goto out;
+	}
+	aret = asprintf(&new, "%s.new", keyfile);
+	if (aret == -1) {
+	    new = NULL;
+	    ret = ENOMEM;
+	    goto out;
+	}
 	if(unlink(new) < 0 && errno != ENOENT) {
 	    ret = errno;
 	    goto out;
diff --git a/crypto/external/bsd/heimdal/dist/kdc/kx509.c b/crypto/external/bsd/heimdal/dist/kdc/kx509.c
index ecd58a502..dbdb63e44 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/kx509.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/kx509.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kx509.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kx509.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -145,22 +145,54 @@ build_certificate(krb5_context context,
 		  krb5_principal principal,
 		  krb5_data *certificate)
 {
+    char *name = NULL;
+    const char *kx509_ca;
     hx509_ca_tbs tbs = NULL;
     hx509_env env = NULL;
     hx509_cert cert = NULL;
     hx509_cert signer = NULL;
+    krb5_boolean def_bool;
     int ret;
 
-    if (krb5_principal_get_comp_string(context, principal, 1) != NULL) {
-	kdc_log(context, config, 0, "Principal is not a user");
-	return EINVAL;
-    }
-
-    ret = hx509_env_add(context->hx509ctx, &env, "principal-name",
-			krb5_principal_get_comp_string(context, principal, 0));
+    ret = krb5_unparse_name_flags(context, principal,
+				  KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+				  &name);
     if (ret)
 	goto out;
 
+    ret = hx509_env_add(context->hx509ctx, &env, "principal-name-without-realm",
+			name);
+    krb5_xfree(name);
+    name = NULL;
+    if (ret)
+	goto out;
+
+    /*
+     * Include the realm in the principal-name env var; the template
+     * might not use $principal-name-realm after all.
+     */
+    ret = krb5_unparse_name(context, principal, &name);
+    if (ret)
+	goto out;
+
+    ret = hx509_env_add(context->hx509ctx, &env, "principal-name",
+			name);
+    if (ret)
+	goto out;
+
+    ret = hx509_env_add(context->hx509ctx, &env, "principal-name-realm",
+			krb5_principal_get_realm(context, principal));
+    if (ret)
+	goto out;
+
+    /* Pick an issuer based on the crealm if we can */
+    kx509_ca = krb5_config_get_string(context, NULL, "kdc",
+                                      krb5_principal_get_realm(context,
+                                                               principal),
+                                      "kx509_ca", NULL);
+    if (kx509_ca == NULL)
+        kx509_ca = config->kx509_ca;
+
     {
 	hx509_certs certs;
 	hx509_query *q;
@@ -245,6 +277,19 @@ build_certificate(krb5_context context,
 	    goto out;
     }
 
+    def_bool = krb5_config_get_bool_default(context, NULL, TRUE, "kdc",
+                                            "kx509_include_pkinit_san",
+                                            NULL);
+    if (krb5_config_get_bool_default(context, NULL, def_bool, "kdc",
+                                     krb5_principal_get_realm(context,
+                                                              principal),
+                                     "kx509_include_pkinit_san",
+                                     NULL)) {
+        ret = hx509_ca_tbs_add_san_pkinit(context->hx509ctx, tbs, name);
+        if (ret)
+            goto out;
+    }
+
     hx509_ca_tbs_set_notAfter(context->hx509ctx, tbs, endtime);
 
     hx509_ca_tbs_subject_expand(context->hx509ctx, tbs, env);
@@ -262,8 +307,13 @@ build_certificate(krb5_context context,
     if (ret)
 	goto out;
 
+    /* cleanup on success */
+    krb5_xfree(name);
+
     return 0;
 out:
+    if (name)
+	krb5_xfree(name);
     if (env)
 	hx509_env_free(&env);
     if (tbs)
@@ -274,6 +324,53 @@ out:
     return ret;
 }
 
+krb5_error_code
+kdc_kx509_verify_service_principal(krb5_context context,
+				   const char *cname,
+				   krb5_principal sprincipal)
+{
+    krb5_error_code ret, aret;
+    krb5_boolean bret;
+    krb5_principal principal = NULL;
+    char *expected = NULL;
+    char localhost[MAXHOSTNAMELEN];
+
+    ret = gethostname(localhost, sizeof(localhost) - 1);
+    if (ret != 0) {
+	ret = errno;
+	krb5_set_error_message(context, ret,
+			       N_("Failed to get local hostname", ""));
+	return ret;
+    }
+    localhost[sizeof(localhost) - 1] = '\0';
+
+    ret = krb5_make_principal(context, &principal, "", "kca_service",
+			      localhost, NULL);
+    if (ret)
+	goto out;
+
+    bret = krb5_principal_compare_any_realm(context, sprincipal, principal);
+    if (bret == TRUE)
+	goto out;	/* found a match */
+
+    ret = KRB5KDC_ERR_SERVER_NOMATCH;
+
+    aret = krb5_unparse_name(context, sprincipal, &expected);
+    if (aret)
+	goto out;
+
+    krb5_set_error_message(context, ret,
+			   "User %s used wrong Kx509 service "
+			   "principal, expected: %s",
+			   cname, expected);
+
+  out:
+    krb5_xfree(expected);
+    krb5_free_principal(context, principal);
+
+    return ret;
+}
+
 /*
  *
  */
@@ -294,6 +391,7 @@ _kdc_do_kx509(krb5_context context,
     Kx509Response rep;
     size_t size;
     krb5_keyblock *key = NULL;
+    krb5_boolean def_bool;
 
     krb5_data_zero(reply);
     memset(&rep, 0, sizeof(rep));
@@ -306,7 +404,7 @@ _kdc_do_kx509(krb5_context context,
 
     kdc_log(context, config, 0, "Kx509 request from %s", from);
 
-    ret = krb5_kt_resolve(context, "HDB:", &id);
+    ret = krb5_kt_resolve(context, "HDBGET:", &id);
     if (ret) {
 	kdc_log(context, config, 0, "Can't open database for digest");
 	goto out;
@@ -326,48 +424,29 @@ _kdc_do_kx509(krb5_context context,
     if (ret)
 	goto out;
 
+    def_bool = krb5_config_get_bool_default(context, NULL, TRUE, "kdc",
+                                            "require_initial_kca_tickets",
+                                            NULL);
+    if (!ticket->ticket.flags.initial &&
+        krb5_config_get_bool_default(context, NULL, def_bool, "kdc",
+                                      krb5_principal_get_realm(context,
+                                                               cprincipal),
+                                      "require_initial_kca_tickets", NULL)) {
+        ret = KRB5KDC_ERR_POLICY;
+        goto out;
+    }
+
     ret = krb5_unparse_name(context, cprincipal, &cname);
     if (ret)
 	goto out;
 
-    /* verify server principal */
-
-    ret = krb5_sname_to_principal(context, NULL, "kca_service",
-				  KRB5_NT_UNKNOWN, &sprincipal);
+    ret = krb5_ticket_get_server(context, ticket, &sprincipal);
     if (ret)
 	goto out;
 
-    {
-	krb5_principal principal = NULL;
-
-	ret = krb5_ticket_get_server(context, ticket, &principal);
-	if (ret)
-	    goto out;
-
-	ret = krb5_principal_compare(context, sprincipal, principal);
-	krb5_free_principal(context, principal);
-	if (ret != TRUE) {
-	    char *expected, *used;
-
-	    ret = krb5_unparse_name(context, sprincipal, &expected);
-	    if (ret)
-		goto out;
-	    ret = krb5_unparse_name(context, principal, &used);
-	    if (ret) {
-		krb5_xfree(expected);
-		goto out;
-	    }
-
-	    ret = KRB5KDC_ERR_SERVER_NOMATCH;
-	    krb5_set_error_message(context, ret,
-				   "User %s used wrong Kx509 service "
-				   "principal, expected: %s, used %s",
-				   cname, expected, used);
-	    krb5_xfree(expected);
-	    krb5_xfree(used);
-	    goto out;
-	}
-    }
+    ret = kdc_kx509_verify_service_principal(context, cname, sprincipal);
+    if (ret)
+	goto out;
 
     ret = krb5_auth_con_getkey(context, ac, &key);
     if (ret == 0 && key == NULL)
@@ -383,15 +462,15 @@ _kdc_do_kx509(krb5_context context,
 
     /* Verify that the key is encoded RSA key */
     {
-	RSAPublicKey key;
-	size_t size;
+	RSAPublicKey rsapkey;
+	size_t rsapkeysize;
 
 	ret = decode_RSAPublicKey(req->pk_key.data, req->pk_key.length,
-				  &key, &size);
+				  &rsapkey, &rsapkeysize);
 	if (ret)
 	    goto out;
-	free_RSAPublicKey(&key);
-	if (size != req->pk_key.length) {
+	free_RSAPublicKey(&rsapkey);
+	if (rsapkeysize != req->pk_key.length) {
 	    ret = ASN1_EXTRA_DATA;
 	    goto out;
 	}
diff --git a/crypto/external/bsd/heimdal/dist/kdc/log.c b/crypto/external/bsd/heimdal/dist/kdc/log.c
index 6c0ed7cee..465b8eb71 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/log.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/log.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: log.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: log.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 2002 Kungliga Tekniska Högskolan
@@ -55,7 +55,7 @@ kdc_openlog(krb5_context context,
 	char *ss;
 	if (asprintf(&ss, "0-1/FILE:%s/%s", hdb_db_dir(context),
 	    KDC_LOG_FILE) < 0)
-	    err(1, NULL);
+	    err(1, "out of memory");
 	krb5_addlog_dest(context, config->logf, ss);
 	free(ss);
     }
diff --git a/crypto/external/bsd/heimdal/dist/kdc/main.c b/crypto/external/bsd/heimdal/dist/kdc/main.c
index 60682c977..2bed7be63 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/main.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/main.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: main.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: main.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -46,9 +46,14 @@
 
 sig_atomic_t exit_flag = 0;
 
-#ifdef SUPPORT_DETACH
 int detach_from_console = -1;
-#endif
+int daemon_child = -1;
+int do_bonjour = -1;
+
+static RETSIGTYPE
+sigchld(int sig)
+{
+}
 
 static RETSIGTYPE
 sigterm(int sig)
@@ -107,13 +112,13 @@ switch_environment(void)
 #endif
 }
 
-
 int
 main(int argc, char **argv)
 {
     krb5_error_code ret;
     krb5_context context;
     krb5_kdc_configuration *config;
+    int optidx = 0;
 
     setprogname(argv[0]);
 
@@ -123,11 +128,11 @@ main(int argc, char **argv)
     else if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
     if (ret)
 	errx (1, "krb5_kt_register(HDB) failed: %d", ret);
 
-    config = configure(context, argc, argv);
+    config = configure(context, argc, argv, &optidx);
 
 #ifdef HAVE_SIGACTION
     {
@@ -143,6 +148,11 @@ main(int argc, char **argv)
 	sigaction(SIGXCPU, &sa, NULL);
 #endif
 
+#ifdef SIGCHLD
+	sa.sa_handler = sigchld;
+	sigaction(SIGCHLD, &sa, NULL);
+#endif
+
 	sa.sa_handler = SIG_IGN;
 #ifdef SIGPIPE
 	sigaction(SIGPIPE, &sa, NULL);
@@ -151,6 +161,9 @@ main(int argc, char **argv)
 #else
     signal(SIGINT, sigterm);
     signal(SIGTERM, sigterm);
+#ifdef SIGCHLD
+    signal(SIGCHLD, sigchld);
+#endif
 #ifdef SIGXCPU
     signal(SIGXCPU, sigterm);
 #endif
@@ -158,18 +171,11 @@ main(int argc, char **argv)
     signal(SIGPIPE, SIG_IGN);
 #endif
 #endif
-#ifdef SUPPORT_DETACH
-    if (detach_from_console)
-	daemon(0, 0);
-#endif
-#ifdef __APPLE__
-    bonjour_announce(context, config);
-#endif
-    pidfile(NULL);
+    rk_pidfile(NULL);
 
     switch_environment();
 
-    loop(context, config);
+    start_kdc(context, config, argv[0]);
     krb5_free_context(context);
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kdc/misc.c b/crypto/external/bsd/heimdal/dist/kdc/misc.c
index b03c72bb7..795554853 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/misc.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/misc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: misc.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: misc.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -35,6 +35,22 @@
 
 #include "kdc_locl.h"
 
+static int
+name_type_ok(krb5_context context,
+             krb5_kdc_configuration *config,
+             krb5_const_principal principal)
+{
+    int nt = krb5_principal_get_type(context, principal);
+
+    if (!krb5_principal_is_krbtgt(context, principal))
+        return 1;
+    if (nt == KRB5_NT_SRV_INST || nt == KRB5_NT_UNKNOWN)
+        return 1;
+    if (config->strict_nametypes == 0)
+        return 1;
+    return 0;
+}
+
 struct timeval _kdc_now;
 
 krb5_error_code
@@ -46,45 +62,45 @@ _kdc_db_fetch(krb5_context context,
 	      HDB **db,
 	      hdb_entry_ex **h)
 {
-    hdb_entry_ex *ent;
+    hdb_entry_ex *ent = NULL;
     krb5_error_code ret = HDB_ERR_NOENTRY;
     int i;
     unsigned kvno = 0;
+    krb5_principal enterprise_principal = NULL;
+    krb5_const_principal princ;
 
-    if (kvno_ptr) {
-	    kvno = *kvno_ptr;
-	    flags |= HDB_F_KVNO_SPECIFIED;
+    *h = NULL;
+
+    if (!name_type_ok(context, config, principal))
+        goto out2;
+
+    if (kvno_ptr != NULL && *kvno_ptr != 0) {
+	kvno = *kvno_ptr;
+	flags |= HDB_F_KVNO_SPECIFIED;
+    } else {
+	flags |= HDB_F_ALL_KVNOS;
     }
 
-    ent = calloc (1, sizeof (*ent));
-    if (ent == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
+    ent = calloc(1, sizeof (*ent));
+    if (ent == NULL)
+        return krb5_enomem(context);
+
+    if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
+        if (principal->name.name_string.len != 1) {
+            ret = KRB5_PARSE_MALFORMED;
+            krb5_set_error_message(context, ret,
+                                   "malformed request: "
+                                   "enterprise name with %d name components",
+                                   principal->name.name_string.len);
+            goto out;
+        }
+        ret = krb5_parse_name(context, principal->name.name_string.val[0],
+                              &enterprise_principal);
+        if (ret)
+            goto out;
     }
 
-    for(i = 0; i < config->num_db; i++) {
-	krb5_principal enterprise_principal = NULL;
-	if (!(config->db[i]->hdb_capability_flags & HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL)
-	    && principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
-	    if (principal->name.name_string.len != 1) {
-		ret = KRB5_PARSE_MALFORMED;
-		krb5_set_error_message(context, ret,
-				       "malformed request: "
-				       "enterprise name with %d name components",
-				       principal->name.name_string.len);
-		free(ent);
-		return ret;
-	    }
-	    ret = krb5_parse_name(context, principal->name.name_string.val[0],
-				  &enterprise_principal);
-	    if (ret) {
-		free(ent);
-		return ret;
-	    }
-
-	    principal = enterprise_principal;
-	}
-
+    for (i = 0; i < config->num_db; i++) {
 	ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0);
 	if (ret) {
 	    const char *msg = krb5_get_error_message(context, ret);
@@ -93,26 +109,56 @@ _kdc_db_fetch(krb5_context context,
 	    continue;
 	}
 
+        princ = principal;
+        if (!(config->db[i]->hdb_capability_flags & HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL) && enterprise_principal)
+            princ = enterprise_principal;
+
 	ret = config->db[i]->hdb_fetch_kvno(context,
 					    config->db[i],
-					    principal,
+					    princ,
 					    flags | HDB_F_DECRYPT,
 					    kvno,
 					    ent);
-
-	krb5_free_principal(context, enterprise_principal);
-
 	config->db[i]->hdb_close(context, config->db[i]);
-	if(ret == 0) {
+
+	switch (ret) {
+	case HDB_ERR_WRONG_REALM:
+	    /*
+	     * the ent->entry.principal just contains hints for the client
+	     * to retry. This is important for enterprise principal routing
+	     * between trusts.
+	     */
+	    /* fall through */
+	case 0:
 	    if (db)
 		*db = config->db[i];
 	    *h = ent;
-	    return 0;
+            ent = NULL;
+            goto out;
+
+	case HDB_ERR_NOENTRY:
+	    /* Check the other databases */
+	    continue;
+
+	default:
+	    /* 
+	     * This is really important, because errors like
+	     * HDB_ERR_NOT_FOUND_HERE (used to indicate to Samba that
+	     * the RODC on which this code is running does not have
+	     * the key we need, and so a proxy to the KDC is required)
+	     * have specific meaning, and need to be propogated up.
+	     */
+	    goto out;
 	}
     }
+
+out2:
+    if (ret == HDB_ERR_NOENTRY) {
+	krb5_set_error_message(context, ret, "no such entry found in hdb");
+    }
+out:
+    krb5_free_principal(context, enterprise_principal);
     free(ent);
-    krb5_set_error_message(context, ret,
-			   "no such entry found in hdb");
     return ret;
 }
 
@@ -146,7 +192,7 @@ _kdc_get_preferred_key(krb5_context context,
 	    if (krb5_enctype_valid(context, p[i]) != 0 &&
 		!_kdc_is_weak_exception(h->entry.principal, p[i]))
 		continue;
-	    ret = hdb_enctype2key(context, &h->entry, p[i], key);
+	    ret = hdb_enctype2key(context, &h->entry, NULL, p[i], key);
 	    if (ret != 0)
 		continue;
 	    if (enctype != NULL)
@@ -160,8 +206,8 @@ _kdc_get_preferred_key(krb5_context context,
 	    if (krb5_enctype_valid(context, h->entry.keys.val[i].key.keytype) != 0 &&
 		!_kdc_is_weak_exception(h->entry.principal, h->entry.keys.val[i].key.keytype))
 		continue;
-	    ret = hdb_enctype2key(context, &h->entry,
-		h->entry.keys.val[i].key.keytype, key);
+	    ret = hdb_enctype2key(context, &h->entry, NULL,
+				  h->entry.keys.val[i].key.keytype, key);
 	    if (ret != 0)
 		continue;
 	    if (enctype != NULL)
diff --git a/crypto/external/bsd/heimdal/dist/kdc/mit_dump.c b/crypto/external/bsd/heimdal/dist/kdc/mit_dump.c
index 6046f16ba..ccb61de4a 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/mit_dump.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/mit_dump.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mit_dump.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: mit_dump.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 Kungliga Tekniska Högskolan
@@ -35,6 +35,17 @@
 
 #include "hprop.h"
 
+extern krb5_error_code _hdb_mdb_value2entry(krb5_context context,
+                                            krb5_data *data,
+                                            krb5_kvno target_kvno,
+                                            hdb_entry *entry);
+
+extern int _hdb_mit_dump2mitdb_entry(krb5_context context,
+                                     char *line,
+                                     krb5_storage *sp);
+
+
+
 /*
 can have any number of princ stanzas.
 format is as follows (only \n indicates newlines)
@@ -76,19 +87,6 @@ unless no extra data
 
 */
 
-static int
-hex_to_octet_string(const char *ptr, krb5_data *data)
-{
-    size_t i;
-    unsigned int v;
-    for(i = 0; i < data->length; i++) {
-	if(sscanf(ptr + 2 * i, "%02x", &v) != 1)
-	    return -1;
-	((unsigned char*)data->data)[i] = v;
-    }
-    return 2 * i;
-}
-
 static char *
 nexttoken(char **p)
 {
@@ -99,321 +97,127 @@ nexttoken(char **p)
     return q;
 }
 
-static size_t
-getdata(char **p, unsigned char *buf, size_t len)
-{
-    size_t i;
-    int v;
-    char *q = nexttoken(p);
-    i = 0;
-    while(*q && i < len) {
-	if(sscanf(q, "%02x", &v) != 1)
-	    break;
-	buf[i++] = v;
-	q += 2;
-    }
-    return i;
-}
-
-static int
-getint(char **p)
-{
-    int val;
-    char *q = nexttoken(p);
-    sscanf(q, "%d", &val);
-    return val;
-}
-
 #include <kadm5/admin.h>
 
-static void
-attr_to_flags(unsigned attr, HDBFlags *flags)
+/* XXX This is broken: what if the princ name has a \n?! */
+static int
+my_fgetln(FILE *f, char **buf, size_t *sz, size_t *len)
 {
-    flags->postdate =		!(attr & KRB5_KDB_DISALLOW_POSTDATED);
-    flags->forwardable =	!(attr & KRB5_KDB_DISALLOW_FORWARDABLE);
-    flags->initial =	       !!(attr & KRB5_KDB_DISALLOW_TGT_BASED);
-    flags->renewable =		!(attr & KRB5_KDB_DISALLOW_RENEWABLE);
-    flags->proxiable =		!(attr & KRB5_KDB_DISALLOW_PROXIABLE);
-    /* DUP_SKEY */
-    flags->invalid =	       !!(attr & KRB5_KDB_DISALLOW_ALL_TIX);
-    flags->require_preauth =   !!(attr & KRB5_KDB_REQUIRES_PRE_AUTH);
-    flags->require_hwauth =    !!(attr & KRB5_KDB_REQUIRES_HW_AUTH);
-    flags->server =		!(attr & KRB5_KDB_DISALLOW_SVR);
-    flags->change_pw = 	       !!(attr & KRB5_KDB_PWCHANGE_SERVICE);
-    flags->client =	        1; /* XXX */
-}
+    char *p, *n;
 
-#define KRB5_KDB_SALTTYPE_NORMAL	0
-#define KRB5_KDB_SALTTYPE_V4		1
-#define KRB5_KDB_SALTTYPE_NOREALM	2
-#define KRB5_KDB_SALTTYPE_ONLYREALM	3
-#define KRB5_KDB_SALTTYPE_SPECIAL	4
-#define KRB5_KDB_SALTTYPE_AFS3		5
-
-static krb5_error_code
-fix_salt(krb5_context context, hdb_entry *ent, int key_num)
-{
-    krb5_error_code ret;
-    Salt *salt = ent->keys.val[key_num].salt;
-    /* fix salt type */
-    switch((int)salt->type) {
-    case KRB5_KDB_SALTTYPE_NORMAL:
-	salt->type = KRB5_PADATA_PW_SALT;
-	break;
-    case KRB5_KDB_SALTTYPE_V4:
-	krb5_data_free(&salt->salt);
-	salt->type = KRB5_PADATA_PW_SALT;
-	break;
-    case KRB5_KDB_SALTTYPE_NOREALM:
-    {
-	size_t len;
-	size_t i;
-	char *p;
-
-	len = 0;
-	for (i = 0; i < ent->principal->name.name_string.len; ++i)
-	    len += strlen(ent->principal->name.name_string.val[i]);
-	ret = krb5_data_alloc (&salt->salt, len);
-	if (ret)
-	    return ret;
-	p = salt->salt.data;
-	for (i = 0; i < ent->principal->name.name_string.len; ++i) {
-	    memcpy (p,
-		    ent->principal->name.name_string.val[i],
-		    strlen(ent->principal->name.name_string.val[i]));
-	    p += strlen(ent->principal->name.name_string.val[i]);
-	}
-
-	salt->type = KRB5_PADATA_PW_SALT;
-	break;
+    if (!*buf) {
+        *buf = malloc(*sz ? *sz : 2048);
+        if (!*buf)
+            return ENOMEM;
+        if (!*sz)
+            *sz = 2048;
     }
-    case KRB5_KDB_SALTTYPE_ONLYREALM:
-	krb5_data_free(&salt->salt);
-	ret = krb5_data_copy(&salt->salt,
-			     ent->principal->realm,
-			     strlen(ent->principal->realm));
-	if(ret)
-	    return ret;
-	salt->type = KRB5_PADATA_PW_SALT;
-	break;
-    case KRB5_KDB_SALTTYPE_SPECIAL:
-	salt->type = KRB5_PADATA_PW_SALT;
-	break;
-    case KRB5_KDB_SALTTYPE_AFS3:
-	krb5_data_free(&salt->salt);
-	ret = krb5_data_copy(&salt->salt,
-		       ent->principal->realm,
-		       strlen(ent->principal->realm));
-	if(ret)
-	    return ret;
-	salt->type = KRB5_PADATA_AFS3_SALT;
-	break;
-    default:
-	abort();
+    *len = 0;
+    while ((p = fgets(&(*buf)[*len], *sz - *len, f))) {
+        *len = strlen(*buf);
+        if (feof(f))
+            return 0;
+        if (strchr(*buf, '\n'))
+            return 0;
+        n = realloc(*buf, *sz + (*sz >> 1));
+        if (!n) {
+            free(*buf);
+            *buf = NULL;
+            *sz = 0;
+            *len = 0;
+            return ENOMEM;
+        }
+        *buf = n;
+        *sz += *sz >> 1;
     }
-    return 0;
+    return 0; /* *len == 0 || no EOL -> EOF */
 }
 
 int
 mit_prop_dump(void *arg, const char *file)
 {
     krb5_error_code ret;
-    char line [2048];
-    FILE *f;
+    size_t line_bufsz = 0;
+    size_t line_len = 0;
+    char *line = NULL;
     int lineno = 0;
+    FILE *f;
     struct hdb_entry_ex ent;
-
     struct prop_data *pd = arg;
+    krb5_storage *sp = NULL;
+    krb5_data kdb_ent;
 
+    memset(&ent, 0, sizeof (ent));
     f = fopen(file, "r");
-    if(f == NULL)
+    if (f == NULL)
 	return errno;
 
-    while(fgets(line, sizeof(line), f)) {
-	char *p = line, *q;
+    ret = ENOMEM;
+    sp = krb5_storage_emem();
+    if (!sp)
+        goto out;
+    while ((ret = my_fgetln(f, &line, &line_bufsz, &line_len)) == 0 &&
+           !feof(f)) {
+        char *p = line;
+        char *q;
+        lineno++;
 
-	int i;
-
-	int num_tl_data;
-	int num_key_data;
-	int high_kvno;
-	int attributes;
-
-	int tmp;
-
-	lineno++;
-
-	memset(&ent, 0, sizeof(ent));
-
-	q = nexttoken(&p);
-	if(strcmp(q, "kdb5_util") == 0) {
+	if(strncmp(line, "kdb5_util", strlen("kdb5_util")) == 0) {
 	    int major;
+            q = nexttoken(&p);
+            if (strcmp(q, "kdb5_util"))
+                errx(1, "line %d: unknown version", lineno);
 	    q = nexttoken(&p); /* load_dump */
-	    if(strcmp(q, "load_dump"))
+	    if (strcmp(q, "load_dump"))
 		errx(1, "line %d: unknown version", lineno);
 	    q = nexttoken(&p); /* load_dump */
-	    if(strcmp(q, "version"))
+	    if (strcmp(q, "version"))
 		errx(1, "line %d: unknown version", lineno);
 	    q = nexttoken(&p); /* x.0 */
-	    if(sscanf(q, "%d", &major) != 1)
+	    if (sscanf(q, "%d", &major) != 1)
 		errx(1, "line %d: unknown version", lineno);
-	    if(major != 4 && major != 5 && major != 6)
+	    if (major != 4 && major != 5 && major != 6)
 		errx(1, "unknown dump file format, got %d, expected 4-6",
 		     major);
 	    continue;
-	} else if(strcmp(q, "policy") == 0) {
+	} else if(strncmp(p, "policy", strlen("policy")) == 0) {
+            warnx("line: %d: ignoring policy (not supported)", lineno);
 	    continue;
-	} else if(strcmp(q, "princ") != 0) {
+	} else if(strncmp(p, "princ", strlen("princ")) != 0) {
 	    warnx("line %d: not a principal", lineno);
 	    continue;
 	}
-	tmp = getint(&p);
-	if(tmp != 38) {
-	    warnx("line %d: bad base length %d != 38", lineno, tmp);
-	    continue;
-	}
-	nexttoken(&p); /* length of principal */
-	num_tl_data = getint(&p); /* number of tl-data */
-	num_key_data = getint(&p); /* number of key-data */
-	getint(&p);  /* length of extra data */
-	q = nexttoken(&p); /* principal name */
-	krb5_parse_name(pd->context, q, &ent.entry.principal);
-	attributes = getint(&p); /* attributes */
-	attr_to_flags(attributes, &ent.entry.flags);
-	tmp = getint(&p); /* max life */
-	if(tmp != 0) {
-	    ALLOC(ent.entry.max_life);
-	    *ent.entry.max_life = tmp;
-	}
-	tmp = getint(&p); /* max renewable life */
-	if(tmp != 0) {
-	    ALLOC(ent.entry.max_renew);
-	    *ent.entry.max_renew = tmp;
-	}
-	tmp = getint(&p); /* expiration */
-	if(tmp != 0 && tmp != 2145830400) {
-	    ALLOC(ent.entry.valid_end);
-	    *ent.entry.valid_end = tmp;
-	}
-	tmp = getint(&p); /* pw expiration */
-	if(tmp != 0) {
-	    ALLOC(ent.entry.pw_end);
-	    *ent.entry.pw_end = tmp;
-	}
-	nexttoken(&p); /* last auth */
-	nexttoken(&p); /* last failed auth */
-	nexttoken(&p); /* fail auth count */
-	for(i = 0; i < num_tl_data; i++) {
-	    unsigned long val;
-	    int tl_type, tl_length;
-	    unsigned char *buf;
-	    krb5_principal princ;
-
-	    tl_type = getint(&p); /* data type */
-	    tl_length = getint(&p); /* data length */
-
-#define mit_KRB5_TL_LAST_PWD_CHANGE	1
-#define mit_KRB5_TL_MOD_PRINC		2
-	    switch(tl_type) {
-	    case mit_KRB5_TL_LAST_PWD_CHANGE:
-		buf = malloc(tl_length);
-		if (buf == NULL)
-		    errx(ENOMEM, "malloc");
-		getdata(&p, buf, tl_length); /* data itself */
-		val = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24);
-		free(buf);
-		ALLOC(ent.entry.extensions);
-		ALLOC_SEQ(ent.entry.extensions, 1);
-		ent.entry.extensions->val[0].mandatory = 0;
-		ent.entry.extensions->val[0].data.element
-		    = choice_HDB_extension_data_last_pw_change;
-		ent.entry.extensions->val[0].data.u.last_pw_change = val;
-		break;
-	    case mit_KRB5_TL_MOD_PRINC:
-		buf = malloc(tl_length);
-		if (buf == NULL)
-		    errx(ENOMEM, "malloc");
-		getdata(&p, buf, tl_length); /* data itself */
-		val = buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24);
-		ret = krb5_parse_name(pd->context, (char *)buf + 4, &princ);
-		if (ret)
-		    krb5_err(pd->context, 1, ret,
-			     "parse_name: %s", (char *)buf + 4);
-		free(buf);
-		ALLOC(ent.entry.modified_by);
-		ent.entry.modified_by->time = val;
-		ent.entry.modified_by->principal = princ;
-		break;
-	    default:
-		nexttoken(&p);
-		break;
-	    }
-	}
-	ALLOC_SEQ(&ent.entry.keys, num_key_data);
-	high_kvno = -1;
-	for(i = 0; i < num_key_data; i++) {
-	    int key_versions;
-	    int kvno;
-	    key_versions = getint(&p); /* key data version */
-	    kvno = getint(&p);
-
-	    /*
-	     * An MIT dump file may contain multiple sets of keys with
-	     * different kvnos.  Since the Heimdal database can only represent
-	     * one kvno per principal, we only want the highest set.  Assume
-	     * that set will be given first, and discard all keys with lower
-	     * kvnos.
-	     */
-	    if (kvno > high_kvno && high_kvno != -1)
-		errx(1, "line %d: high kvno keys given after low kvno keys",
-		     lineno);
-	    else if (kvno < high_kvno) {
-		nexttoken(&p); /* key type */
-		nexttoken(&p); /* key length */
-		nexttoken(&p); /* key */
-		if (key_versions > 1) {
-		    nexttoken(&p); /* salt type */
-		    nexttoken(&p); /* salt length */
-		    nexttoken(&p); /* salt */
-		}
-		ent.entry.keys.len--;
-		continue;
-	    }
-	    ent.entry.kvno = kvno;
-	    high_kvno = kvno;
-	    ALLOC(ent.entry.keys.val[i].mkvno);
-	    *ent.entry.keys.val[i].mkvno = 1;
-
-	    /* key version 0 -- actual key */
-	    ent.entry.keys.val[i].key.keytype = getint(&p); /* key type */
-	    tmp = getint(&p); /* key length */
-	    /* the first two bytes of the key is the key length --
-	       skip it */
-	    krb5_data_alloc(&ent.entry.keys.val[i].key.keyvalue, tmp - 2);
-	    q = nexttoken(&p); /* key itself */
-	    hex_to_octet_string(q + 4, &ent.entry.keys.val[i].key.keyvalue);
-
-	    if(key_versions > 1) {
-		/* key version 1 -- optional salt */
-		ALLOC(ent.entry.keys.val[i].salt);
-		ent.entry.keys.val[i].salt->type = getint(&p); /* salt type */
-		tmp = getint(&p); /* salt length */
-		if(tmp > 0) {
-		    krb5_data_alloc(&ent.entry.keys.val[i].salt->salt, tmp - 2);
-		    q = nexttoken(&p); /* salt itself */
-		    hex_to_octet_string(q + 4,
-					&ent.entry.keys.val[i].salt->salt);
-		} else {
-		    ent.entry.keys.val[i].salt->salt.length = 0;
-		    ent.entry.keys.val[i].salt->salt.data = NULL;
-		    getint(&p);	/* -1, if no data. */
-		}
-		fix_salt(pd->context, &ent.entry, i);
-	    }
-	}
-	nexttoken(&p); /* extra data */
-	v5_prop(pd->context, NULL, &ent, arg);
+        krb5_storage_truncate(sp, 0);
+        ret = _hdb_mit_dump2mitdb_entry(pd->context, line, sp);
+        if (ret) {
+            if (ret > 0)
+                warn("line: %d: failed to parse; ignoring", lineno);
+            else
+                warnx("line: %d: failed to parse; ignoring", lineno);
+            continue;
+        }
+        ret = krb5_storage_to_data(sp, &kdb_ent);
+        if (ret) break;
+        ret = _hdb_mdb_value2entry(pd->context, &kdb_ent, 0, &ent.entry);
+        krb5_data_free(&kdb_ent);
+        if (ret) {
+            warnx("line: %d: failed to store; ignoring", lineno);
+            continue;
+        }
+	ret = v5_prop(pd->context, NULL, &ent, arg);
+        hdb_free_entry(pd->context, &ent);
+        if (ret) break;
     }
+
+out:
     fclose(f);
-    return 0;
+    free(line);
+    if (sp)
+        krb5_storage_free(sp);
+    if (ret && ret == ENOMEM)
+        errx(1, "out of memory");
+    if (ret)
+        errx(1, "line %d: problem parsing dump line", lineno);
+    return ret;
 }
+
diff --git a/crypto/external/bsd/heimdal/dist/kdc/pkinit-ec.c b/crypto/external/bsd/heimdal/dist/kdc/pkinit-ec.c
new file mode 100644
index 000000000..4eb8cd10e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/kdc/pkinit-ec.c
@@ -0,0 +1,321 @@
+/*	$NetBSD: pkinit-ec.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
+
+/*
+ * Copyright (c) 2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+#include <krb5/roken.h>
+
+#ifdef PKINIT
+
+/*
+ * As with the other *-ec.c files in Heimdal, this is a bit of a hack.
+ *
+ * The idea is to use OpenSSL for EC because hcrypto doesn't have the
+ * required functionality at this time.  To do this we segregate
+ * EC-using code into separate source files and then we arrange for them
+ * to get the OpenSSL headers and not the conflicting hcrypto ones.
+ *
+ * Because of auto-generated *-private.h headers, we end up needing to
+ * make sure various types are defined before we include them, thus the
+ * strange header include order here.
+ */
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/evp.h>
+#include <openssl/bn.h>
+#define HEIM_NO_CRYPTO_HDRS
+#else
+#include <hcrypto/des.h>
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+#define NO_HCRYPTO_POLLUTION
+
+#include "kdc_locl.h"
+#include <krb5/heim_asn1.h>
+#include <krb5/rfc2459_asn1.h>
+#include <krb5/cms_asn1.h>
+#include <krb5/pkinit_asn1.h>
+
+#include <krb5/hx509.h>
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+static void
+free_client_ec_param(krb5_context context,
+                     EC_KEY *ec_key_pk,
+                     EC_KEY *ec_key_key)
+{
+    if (ec_key_pk != NULL)
+        EC_KEY_free(ec_key_pk);
+    if (ec_key_key != NULL)
+        EC_KEY_free(ec_key_key);
+}
+#endif
+
+void
+_kdc_pk_free_client_ec_param(krb5_context context,
+                             void *ec_key_pk,
+                             void *ec_key_key)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    free_client_ec_param(context, ec_key_pk, ec_key_key);
+#endif
+}
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+static krb5_error_code
+generate_ecdh_keyblock(krb5_context context,
+                       EC_KEY *ec_key_pk,    /* the client's public key */
+                       EC_KEY **ec_key_key,  /* the KDC's ephemeral private */
+                       unsigned char **dh_gen_key, /* shared secret */
+                       size_t *dh_gen_keylen)
+{
+    const EC_GROUP *group;
+    EC_KEY *ephemeral;
+    krb5_keyblock key;
+    krb5_error_code ret;
+    unsigned char *p;
+    size_t size;
+    int len;
+
+    *dh_gen_key = NULL;
+    *dh_gen_keylen = 0;
+    *ec_key_key = NULL;
+
+    memset(&key, 0, sizeof(key));
+
+    if (ec_key_pk == NULL) {
+        ret = KRB5KRB_ERR_GENERIC;
+        krb5_set_error_message(context, ret, "public_key");
+        return ret;
+    }
+
+    group = EC_KEY_get0_group(ec_key_pk);
+    if (group == NULL) {
+        ret = KRB5KRB_ERR_GENERIC;
+        krb5_set_error_message(context, ret, "failed to get the group of "
+                               "the client's public key");
+        return ret;
+    }
+
+    ephemeral = EC_KEY_new();
+    if (ephemeral == NULL)
+        return krb5_enomem(context);
+
+    EC_KEY_set_group(ephemeral, group);
+
+    if (EC_KEY_generate_key(ephemeral) != 1) {
+	EC_KEY_free(ephemeral);
+        return krb5_enomem(context);
+    }
+
+    size = (EC_GROUP_get_degree(group) + 7) / 8;
+    p = malloc(size);
+    if (p == NULL) {
+        EC_KEY_free(ephemeral);
+        return krb5_enomem(context);
+    }
+
+    len = ECDH_compute_key(p, size,
+                           EC_KEY_get0_public_key(ec_key_pk),
+                           ephemeral, NULL);
+    if (len <= 0) {
+        free(p);
+        EC_KEY_free(ephemeral);
+        ret = KRB5KRB_ERR_GENERIC;
+        krb5_set_error_message(context, ret, "Failed to compute ECDH "
+                               "public shared secret");
+        return ret;
+    }
+
+    *ec_key_key = ephemeral;
+    *dh_gen_key = p;
+    *dh_gen_keylen = len;
+
+    return 0;
+}
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+krb5_error_code
+_kdc_generate_ecdh_keyblock(krb5_context context,
+                            void *ec_key_pk,    /* the client's public key */
+                            void **ec_key_key,  /* the KDC's ephemeral private */
+                            unsigned char **dh_gen_key, /* shared secret */
+                            size_t *dh_gen_keylen)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    return generate_ecdh_keyblock(context, ec_key_pk,
+                                  (EC_KEY **)ec_key_key,
+                                  dh_gen_key, dh_gen_keylen);
+#else
+    return ENOTSUP;
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+}
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+static krb5_error_code
+get_ecdh_param(krb5_context context,
+               krb5_kdc_configuration *config,
+               SubjectPublicKeyInfo *dh_key_info,
+               EC_KEY **out)
+{
+    ECParameters ecp;
+    EC_KEY *public = NULL;
+    krb5_error_code ret;
+    const unsigned char *p;
+    size_t len;
+    int nid;
+
+    if (dh_key_info->algorithm.parameters == NULL) {
+	krb5_set_error_message(context, KRB5_BADMSGTYPE,
+			       "PKINIT missing algorithm parameter "
+			       "in clientPublicValue");
+	return KRB5_BADMSGTYPE;
+    }
+
+    memset(&ecp, 0, sizeof(ecp));
+
+    ret = decode_ECParameters(dh_key_info->algorithm.parameters->data,
+			      dh_key_info->algorithm.parameters->length, &ecp, &len);
+    if (ret)
+	goto out;
+
+    if (ecp.element != choice_ECParameters_namedCurve) {
+	ret = KRB5_BADMSGTYPE;
+	goto out;
+    }
+
+    if (der_heim_oid_cmp(&ecp.u.namedCurve, &asn1_oid_id_ec_group_secp256r1) == 0)
+	nid = NID_X9_62_prime256v1;
+    else {
+	ret = KRB5_BADMSGTYPE;
+	goto out;
+    }
+
+    /* XXX verify group is ok */
+
+    public = EC_KEY_new_by_curve_name(nid);
+
+    p = dh_key_info->subjectPublicKey.data;
+    len = dh_key_info->subjectPublicKey.length / 8;
+    if (o2i_ECPublicKey(&public, &p, len) == NULL) {
+	ret = KRB5_BADMSGTYPE;
+	krb5_set_error_message(context, ret,
+			       "PKINIT failed to decode ECDH key");
+	goto out;
+    }
+    *out = public;
+    public = NULL;
+
+ out:
+    if (public)
+	EC_KEY_free(public);
+    free_ECParameters(&ecp);
+    return ret;
+}
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+krb5_error_code
+_kdc_get_ecdh_param(krb5_context context,
+                    krb5_kdc_configuration *config,
+                    SubjectPublicKeyInfo *dh_key_info,
+                    void **out)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    return get_ecdh_param(context, config, dh_key_info, (EC_KEY **)out);
+#else
+    return ENOTSUP;
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+}
+
+
+/*
+ *
+ */
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+static krb5_error_code
+serialize_ecdh_key(krb5_context context,
+                   EC_KEY *key,
+                   unsigned char **out,
+                   size_t *out_len)
+{
+    krb5_error_code ret = 0;
+    unsigned char *p;
+    int len;
+
+    *out = NULL;
+    *out_len = 0;
+
+    len = i2o_ECPublicKey(key, NULL);
+    if (len <= 0)
+        return EOVERFLOW;
+
+    *out = malloc(len);
+    if (*out == NULL)
+        return krb5_enomem(context);
+
+    p = *out;
+    len = i2o_ECPublicKey(key, &p);
+    if (len <= 0) {
+        free(*out);
+        *out = NULL;
+        ret = EINVAL; /* XXX Better error please */
+	krb5_set_error_message(context, ret,
+			       "PKINIT failed to encode ECDH key");
+        return ret;
+    }
+
+    *out_len = len * 8;
+    return ret;
+}
+#endif
+
+krb5_error_code
+_kdc_serialize_ecdh_key(krb5_context context,
+                        void *key,
+                        unsigned char **out,
+                        size_t *out_len)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    return serialize_ecdh_key(context, key, out, out_len);
+#else
+    return ENOTSUP;
+#endif
+}
+
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/kdc/pkinit.c b/crypto/external/bsd/heimdal/dist/kdc/pkinit.c
index 348909ec0..5a55b1c5f 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/pkinit.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/pkinit.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: pkinit.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: pkinit.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
- * Copyright (c) 2003 - 2008 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -49,18 +49,16 @@
 
 struct pk_client_params {
     enum krb5_pk_type type;
-    enum { USE_RSA, USE_DH, USE_ECDH } keyex;
+    enum keyex_enum keyex;
     union {
 	struct {
 	    BIGNUM *public_key;
 	    DH *key;
 	} dh;
-#ifdef HAVE_OPENSSL
 	struct {
-	    EC_KEY *public_key;
-	    EC_KEY *key;
+	    void *public_key;
+	    void *key;
 	} ecdh;
-#endif
     } u;
     hx509_cert cert;
     unsigned nonce;
@@ -103,7 +101,7 @@ pk_check_pkauthenticator_win2k(krb5_context context,
     krb5_timeofday (context, &now);
 
     /* XXX cusec */
-    if (a->ctime == 0 || abs(a->ctime - now) > context->max_skew) {
+    if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
 	krb5_clear_error_message(context);
 	return KRB5KRB_AP_ERR_SKEW;
     }
@@ -125,7 +123,7 @@ pk_check_pkauthenticator(krb5_context context,
     krb5_timeofday (context, &now);
 
     /* XXX cusec */
-    if (a->ctime == 0 || abs(a->ctime - now) > context->max_skew) {
+    if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
 	krb5_clear_error_message(context);
 	return KRB5KRB_AP_ERR_SKEW;
     }
@@ -183,14 +181,9 @@ _kdc_pk_free_client_param(krb5_context context, pk_client_params *cp)
 	if (cp->u.dh.public_key)
 	    BN_free(cp->u.dh.public_key);
     }
-#ifdef HAVE_OPENSSL
-    if (cp->keyex == USE_ECDH) {
-	if (cp->u.ecdh.key)
-	    EC_KEY_free(cp->u.ecdh.key);
-	if (cp->u.ecdh.public_key)
-	    EC_KEY_free(cp->u.ecdh.public_key);
-    }
-#endif
+    if (cp->keyex == USE_ECDH)
+        _kdc_pk_free_client_ec_param(context, cp->u.ecdh.key,
+                                     cp->u.ecdh.public_key);
     krb5_free_keyblock_contents(context, &cp->reply_key);
     if (cp->dh_group_name)
 	free(cp->dh_group_name);
@@ -218,7 +211,7 @@ generate_dh_keyblock(krb5_context context,
 
 	if (client_params->u.dh.public_key == NULL) {
 	    ret = KRB5KRB_ERR_GENERIC;
-	    krb5_set_error_message(context, ret, "public_key");
+	    krb5_set_error_message(context, ret, "missing DH public_key");
 	    goto out;
 	}
 
@@ -252,42 +245,18 @@ generate_dh_keyblock(krb5_context context,
 	}
 
 	ret = 0;
-#ifdef HAVE_OPENSSL
     } else if (client_params->keyex == USE_ECDH) {
-
 	if (client_params->u.ecdh.public_key == NULL) {
 	    ret = KRB5KRB_ERR_GENERIC;
-	    krb5_set_error_message(context, ret, "public_key");
+	    krb5_set_error_message(context, ret, "missing ECDH public_key");
 	    goto out;
 	}
-
-	client_params->u.ecdh.key = EC_KEY_new();
-	if (client_params->u.ecdh.key == NULL) {
-	    ret = ENOMEM;
-	    goto out;
-	}
-	EC_KEY_set_group(client_params->u.ecdh.key,
-			 EC_KEY_get0_group(client_params->u.ecdh.public_key));
-
-	if (EC_KEY_generate_key(client_params->u.ecdh.key) != 1) {
-	    ret = ENOMEM;
-	    goto out;
-	}
-
-	size = (EC_GROUP_get_degree(EC_KEY_get0_group(client_params->u.ecdh.key)) + 7) / 8;
-	dh_gen_key = malloc(size);
-	if (dh_gen_key == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
-	    goto out;
-	}
-
-	dh_gen_keylen = ECDH_compute_key(dh_gen_key, size,
-					 EC_KEY_get0_public_key(client_params->u.ecdh.public_key),
-					 client_params->u.ecdh.key, NULL);
-
-#endif /* HAVE_OPENSSL */
+        ret = _kdc_generate_ecdh_keyblock(context,
+                                          client_params->u.ecdh.public_key,
+                                          &client_params->u.ecdh.key,
+                                          &dh_gen_key, &dh_gen_keylen);
+        if (ret)
+            goto out;
     } else {
 	ret = KRB5KRB_ERR_GENERIC;
 	krb5_set_error_message(context, ret,
@@ -424,71 +393,6 @@ get_dh_param(krb5_context context,
     return ret;
 }
 
-#ifdef HAVE_OPENSSL
-
-static krb5_error_code
-get_ecdh_param(krb5_context context,
-	       krb5_kdc_configuration *config,
-	       SubjectPublicKeyInfo *dh_key_info,
-	       pk_client_params *client_params)
-{
-    ECParameters ecp;
-    EC_KEY *public = NULL;
-    krb5_error_code ret;
-    const unsigned char *p;
-    size_t len;
-    int nid;
-
-    if (dh_key_info->algorithm.parameters == NULL) {
-	krb5_set_error_message(context, KRB5_BADMSGTYPE,
-			       "PKINIT missing algorithm parameter "
-			       "in clientPublicValue");
-	return KRB5_BADMSGTYPE;
-    }
-
-    memset(&ecp, 0, sizeof(ecp));
-
-    ret = decode_ECParameters(dh_key_info->algorithm.parameters->data,
-			      dh_key_info->algorithm.parameters->length, &ecp, &len);
-    if (ret)
-	goto out;
-
-    if (ecp.element != choice_ECParameters_namedCurve) {
-	ret = KRB5_BADMSGTYPE;
-	goto out;
-    }
-
-    if (der_heim_oid_cmp(&ecp.u.namedCurve, &asn1_oid_id_ec_group_secp256r1) == 0)
-	nid = NID_X9_62_prime256v1;
-    else {
-	ret = KRB5_BADMSGTYPE;
-	goto out;
-    }
-
-    /* XXX verify group is ok */
-
-    public = EC_KEY_new_by_curve_name(nid);
-
-    p = dh_key_info->subjectPublicKey.data;
-    len = dh_key_info->subjectPublicKey.length / 8;
-    if (o2i_ECPublicKey(&public, &p, len) == NULL) {
-	ret = KRB5_BADMSGTYPE;
-	krb5_set_error_message(context, ret,
-			       "PKINIT failed to decode ECDH key");
-	goto out;
-    }
-    client_params->u.ecdh.public_key = public;
-    public = NULL;
-
- out:
-    if (public)
-	EC_KEY_free(public);
-    free_ECParameters(&ecp);
-    return ret;
-}
-
-#endif /* HAVE_OPENSSL */
-
 krb5_error_code
 _kdc_pk_rd_padata(krb5_context context,
 		  krb5_kdc_configuration *config,
@@ -545,11 +449,11 @@ _kdc_pk_rd_padata(krb5_context context,
 	unsigned int i;
 
 	for (i = 0; i < pc->len; i++) {
-	    ret = hx509_cert_init_data(context->hx509ctx,
-				       pc->val[i].cert.data,
-				       pc->val[i].cert.length,
-				       &cert);
-	    if (ret)
+	    cert = hx509_cert_init_data(context->hx509ctx,
+					pc->val[i].cert.data,
+					pc->val[i].cert.length,
+					NULL);
+	    if (cert == NULL)
 		continue;
 	    hx509_certs_add(context->hx509ctx, trust_anchors, cert);
 	    hx509_cert_free(cert);
@@ -575,7 +479,7 @@ _kdc_pk_rd_padata(krb5_context context,
 
 	type = "PK-INIT-Win2k";
 
-	if (req->req_body.kdc_options.request_anonymous) {
+	if (_kdc_is_anon_request(&req->req_body)) {
 	    ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED;
 	    krb5_set_error_message(context, ret,
 				   "Anon not supported in RSA mode");
@@ -721,7 +625,7 @@ _kdc_pk_rd_padata(krb5_context context,
 	hx509_certs signer_certs;
 	int flags = HX509_CMS_VS_ALLOW_DATA_OID_MISMATCH; /* BTMM */
 
-	if (req->req_body.kdc_options.request_anonymous)
+	if (_kdc_is_anon_request(&req->req_body))
 	    flags |= HX509_CMS_VS_ALLOW_ZERO_SIGNER;
 
 	ret = hx509_cms_verify_signed(context->hx509ctx,
@@ -806,7 +710,7 @@ _kdc_pk_rd_padata(krb5_context context,
 	    goto out;
 	}
 
-	if (req->req_body.kdc_options.request_anonymous &&
+	if (_kdc_is_anon_request(&req->req_body) &&
 	    ap.clientPublicValue == NULL) {
 	    free_AuthPack(&ap);
 	    ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED;
@@ -831,12 +735,11 @@ _kdc_pk_rd_padata(krb5_context context,
 		cp->keyex = USE_DH;
 		ret = get_dh_param(context, config,
 				   ap.clientPublicValue, cp);
-#ifdef HAVE_OPENSSL
 	    } else if (der_heim_oid_cmp(&ap.clientPublicValue->algorithm.algorithm, &asn1_oid_id_ecPublicKey) == 0) {
 		cp->keyex = USE_ECDH;
-		ret = get_ecdh_param(context, config,
-				     ap.clientPublicValue, cp);
-#endif /* HAVE_OPENSSL */
+                ret = _kdc_get_ecdh_param(context, config,
+                                          ap.clientPublicValue,
+                                          &cp->u.ecdh.public_key);
 	    } else {
 		ret = KRB5_BADMSGTYPE;
 		krb5_set_error_message(context, ret, "PKINIT unknown DH mechanism");
@@ -1136,26 +1039,13 @@ pk_mk_pa_reply_dh(krb5_context context,
 	dh_info.subjectPublicKey.length = buf.length * 8;
 	dh_info.subjectPublicKey.data = buf.data;
 	krb5_data_zero(&buf);
-#ifdef HAVE_OPENSSL
     } else if (cp->keyex == USE_ECDH) {
-	unsigned char *p;
-	int len;
-
-	len = i2o_ECPublicKey(cp->u.ecdh.key, NULL);
-	if (len <= 0)
-	    abort();
-
-	p = malloc(len);
-	if (p == NULL)
-	    abort();
-
-	dh_info.subjectPublicKey.length = len * 8;
-	dh_info.subjectPublicKey.data = p;
-
-	len = i2o_ECPublicKey(cp->u.ecdh.key, &p);
-	if (len <= 0)
-	    abort();
-#endif
+        unsigned char *p;
+        ret = _kdc_serialize_ecdh_key(context, cp->u.ecdh.key, &p,
+                                      &dh_info.subjectPublicKey.length);
+        dh_info.subjectPublicKey.data = p;
+        if (ret)
+            goto out;
     } else
 	krb5_abortx(context, "no keyex selected ?");
 
@@ -1242,7 +1132,7 @@ _kdc_pk_mk_pa_reply(krb5_context context,
 		    krb5_enctype sessionetype,
 		    const KDC_REQ *req,
 		    const krb5_data *req_buffer,
-		    krb5_keyblock **reply_key,
+		    krb5_keyblock *reply_key,
 		    krb5_keyblock *sessionkey,
 		    METHOD_DATA *md)
 {
@@ -1331,9 +1221,7 @@ _kdc_pk_mk_pa_reply(krb5_context context,
 
 	    switch (cp->keyex) {
 	    case USE_DH: type = "dh"; break;
-#ifdef HAVE_OPENSSL
 	    case USE_ECDH: type = "ecdh"; break;
-#endif
 	    default: krb5_abortx(context, "unknown keyex"); break;
 	    }
 
@@ -1372,16 +1260,86 @@ _kdc_pk_mk_pa_reply(krb5_context context,
 	    if (rep.u.encKeyPack.length != size)
 		krb5_abortx(context, "Internal ASN.1 encoder error");
 
-	    /* XXX KRB-FX-CF2 */
-	    ret = krb5_generate_random_keyblock(context, sessionetype,
-						sessionkey);
-	    if (ret) {
-		free_PA_PK_AS_REP(&rep);
-		goto out;
+	    /* generate the session key using the method from RFC6112 */
+	    {
+		krb5_keyblock kdc_contribution_key;
+		krb5_crypto reply_crypto;
+		krb5_crypto kdccont_crypto;
+		krb5_data p1 = { strlen("PKINIT"), "PKINIT"};
+		krb5_data p2 = { strlen("KEYEXCHANGE"), "KEYEXCHANGE"};
+		void *kckdata;
+		size_t kcklen;
+		EncryptedData kx;
+		void *kxdata;
+		size_t kxlen;
+
+		ret = krb5_generate_random_keyblock(context, sessionetype,
+						&kdc_contribution_key);
+		if (ret) {
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		ret = krb5_crypto_init(context, &cp->reply_key, enctype, &reply_crypto);
+		if (ret) {
+		    krb5_free_keyblock_contents(context, &kdc_contribution_key);
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		ret = krb5_crypto_init(context, &kdc_contribution_key, sessionetype, &kdccont_crypto);
+		if (ret) {
+		    krb5_crypto_destroy(context, reply_crypto);
+		    krb5_free_keyblock_contents(context, &kdc_contribution_key);
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		/* KRB-FX-CF2 */
+		ret = krb5_crypto_fx_cf2(context, kdccont_crypto, reply_crypto,
+					 &p1, &p2, sessionetype, sessionkey);
+		krb5_crypto_destroy(context, kdccont_crypto);
+		if (ret) {
+		    krb5_crypto_destroy(context, reply_crypto);
+		    krb5_free_keyblock_contents(context, &kdc_contribution_key);
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		ASN1_MALLOC_ENCODE(EncryptionKey, kckdata, kcklen,
+				   &kdc_contribution_key, &size, ret);
+		krb5_free_keyblock_contents(context, &kdc_contribution_key);
+		if (ret) {
+		    krb5_set_error_message(context, ret, "encoding of PKINIT-KX Key failed %d", ret);
+		    krb5_crypto_destroy(context, reply_crypto);
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		if (kcklen != size)
+		    krb5_abortx(context, "Internal ASN.1 encoder error");
+		ret = krb5_encrypt_EncryptedData(context, reply_crypto, KRB5_KU_PA_PKINIT_KX,
+					kckdata, kcklen, 0, &kx);
+		krb5_crypto_destroy(context, reply_crypto);
+		free(kckdata);
+		if (ret) {
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		ASN1_MALLOC_ENCODE(EncryptedData, kxdata, kxlen,
+				   &kx, &size, ret);
+		free_EncryptedData(&kx);
+		if (ret) {
+		    krb5_set_error_message(context, ret, "encoding of PKINIT-KX failed %d", ret);
+		    free_PA_PK_AS_REP(&rep);
+		    goto out;
+		}
+		if (kxlen != size)
+		    krb5_abortx(context, "Internal ASN.1 encoder error");
+		/* Add PA-PKINIT-KX */
+		ret = krb5_padata_add(context, md, KRB5_PADATA_PKINIT_KX, kxdata, kxlen);
+		if (ret) {
+		    krb5_set_error_message(context, ret,
+					   "Failed adding PKINIT-KX %d", ret);
+		    free(buf);
+		    goto out;
+		}
 	    }
-
-	    /* XXX Add PA-PKINIT-KX */
-
 	}
 
 #define use_btmm_with_enckey 0
@@ -1568,7 +1526,7 @@ out:
 	hx509_cert_free(kdc_cert);
 
     if (ret == 0)
-	*reply_key = &cp->reply_key;
+	ret = krb5_copy_keyblock_contents(context, &cp->reply_key, reply_key);
     return ret;
 }
 
@@ -1613,6 +1571,7 @@ match_rfc_san(krb5_context context,
 	    return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 	}
 
+	memset(&principal, 0, sizeof (principal));
 	principal.name = kn.principalName;
 	principal.realm = kn.realm;
 
@@ -1747,11 +1706,11 @@ _kdc_pk_check_client(krb5_context context,
 	size_t j;
 
 	for (j = 0; j < pc->len; j++) {
-	    ret = hx509_cert_init_data(context->hx509ctx,
-				       pc->val[j].cert.data,
-				       pc->val[j].cert.length,
-				       &cert);
-	    if (ret)
+	    cert = hx509_cert_init_data(context->hx509ctx,
+					pc->val[j].cert.data,
+					pc->val[j].cert.length,
+					NULL);
+	    if (cert == NULL)
 		continue;
 	    ret = hx509_cert_cmp(cert, cp->cert);
 	    hx509_cert_free(cert);
@@ -2040,7 +1999,14 @@ krb5_kdc_pk_initialize(krb5_context context,
 				  "pkinit_mappings_file",
 				  NULL);
     if (file == NULL) {
-	asprintf(&fn, "%s/pki-mapping", hdb_db_dir(context));
+	int aret;
+
+	aret = asprintf(&fn, "%s/pki-mapping", hdb_db_dir(context));
+	if (aret == -1) {
+	    krb5_warnx(context, "PKINIT: out of memory");
+	    return ENOMEM;
+	}
+
 	file = fn;
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/kdc/process.c b/crypto/external/bsd/heimdal/dist/kdc/process.c
index 14a4e6608..f499e9e89 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/process.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/process.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: process.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: process.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -59,19 +59,25 @@ kdc_as_req(krb5_context context,
 	   int datagram_reply,
 	   int *claim)
 {
+    struct kdc_request_desc r;
     krb5_error_code ret;
-    KDC_REQ req;
     size_t len;
 
-    ret = decode_AS_REQ(req_buffer->data, req_buffer->length, &req, &len);
+    memset(&r, 0, sizeof(r));
+
+    ret = decode_AS_REQ(req_buffer->data, req_buffer->length, &r.req, &len);
     if (ret)
 	return ret;
 
+    r.context = context;
+    r.config = config;
+    r.request.data = req_buffer->data;
+    r.request.length = req_buffer->length;
+
     *claim = 1;
 
-    ret = _kdc_as_rep(context, config, &req, req_buffer,
-		      reply, from, addr, datagram_reply);
-    free_AS_REQ(&req);
+    ret = _kdc_as_rep(&r, reply, from, addr, datagram_reply);
+    free_AS_REQ(&r.req);
     return ret;
 }
 
@@ -195,6 +201,7 @@ krb5_kdc_process_request(krb5_context context,
     unsigned int i;
     krb5_data req_buffer;
     int claim = 0;
+    heim_auto_release_t pool = heim_auto_release_create();
 
     req_buffer.data = buf;
     req_buffer.length = len;
@@ -206,10 +213,14 @@ krb5_kdc_process_request(krb5_context context,
 	if (claim) {
 	    if (services[i].flags & KS_NO_LENGTH)
 		*prependlength = 0;
+
+	    heim_release(pool);
 	    return ret;
 	}
     }
 
+    heim_release(pool);
+
     return -1;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/kdc/rx.h b/crypto/external/bsd/heimdal/dist/kdc/rx.h
index 8916d16d9..b13100387 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/rx.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/rx.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rx.h,v 1.1.1.2 2011/04/14 14:08:18 elric Exp $	*/
+/*	$NetBSD: rx.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kdc/set_dbinfo.c b/crypto/external/bsd/heimdal/dist/kdc/set_dbinfo.c
index 2e32802b0..642f3d862 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/set_dbinfo.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/set_dbinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_dbinfo.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: set_dbinfo.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kdc/string2key.8 b/crypto/external/bsd/heimdal/dist/kdc/string2key.8
index 912ddd8a1..ccddb486c 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/string2key.8
+++ b/crypto/external/bsd/heimdal/dist/kdc/string2key.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: string2key.8,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: string2key.8,v 1.4 2017/01/28 21:31:44 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2002 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kdc/string2key.c b/crypto/external/bsd/heimdal/dist/kdc/string2key.c
index 7330a6fd8..9ad0ed6a3 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/string2key.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/string2key.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: string2key.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: string2key.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
@@ -130,9 +130,9 @@ main(int argc, char **argv)
     if(ret)
 	krb5_err(context, 1, ret, "krb5_string_to_enctype");
 
-    if((etype != ETYPE_DES_CBC_CRC &&
-	etype != ETYPE_DES_CBC_MD4 &&
-	etype != ETYPE_DES_CBC_MD5) &&
+    if((etype != (krb5_enctype)ETYPE_DES_CBC_CRC &&
+	etype != (krb5_enctype)ETYPE_DES_CBC_MD4 &&
+	etype != (krb5_enctype)ETYPE_DES_CBC_MD5) &&
        (afs || version4)) {
 	if(!version5) {
 	    etype = ETYPE_DES_CBC_CRC;
@@ -165,8 +165,13 @@ main(int argc, char **argv)
     }
 
     if(version5){
-	krb5_parse_name(context, principal, &princ);
-	krb5_get_pw_salt(context, princ, &salt);
+	ret = krb5_parse_name(context, principal, &princ);
+	if (ret)
+	    krb5_err(context, 1, ret, "failed to unparse name: %s", principal);
+	ret = krb5_get_pw_salt(context, princ, &salt);
+	if (ret)
+	    krb5_err(context, 1, ret, "failed to get salt for %s", principal);
+
 	tokey(context, etype, password, salt, "Kerberos 5 (%s)");
 	krb5_free_salt(context, salt);
     }
diff --git a/crypto/external/bsd/heimdal/dist/kdc/windc.c b/crypto/external/bsd/heimdal/dist/kdc/windc.c
index daabf8d38..de257d3f1 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/windc.c
+++ b/crypto/external/bsd/heimdal/dist/kdc/windc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: windc.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: windc.c,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -35,52 +35,89 @@
 
 #include "kdc_locl.h"
 
-static krb5plugin_windc_ftable *windcft;
-static void *windcctx;
+static int have_plugin = 0;
 
 /*
  * Pick the first WINDC module that we find.
  */
 
+static krb5_error_code KRB5_LIB_CALL
+load(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    have_plugin = 1;
+    return KRB5_PLUGIN_NO_HANDLE;
+}
+
 krb5_error_code
 krb5_kdc_windc_init(krb5_context context)
 {
-    struct krb5_plugin *list = NULL, *e;
-    krb5_error_code ret;
-
-    ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "windc", &list);
-    if(ret != 0 || list == NULL)
-	return 0;
-
-    for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
-
-	windcft = _krb5_plugin_get_symbol(e);
-	if (windcft->minor_version < KRB5_WINDC_PLUGIN_MINOR)
-	    continue;
-
-	(*windcft->init)(context, &windcctx);
-	break;
-    }
-    _krb5_plugin_free(list);
-    if (e == NULL) {
-	krb5_set_error_message(context, ENOENT, "Did not find any WINDC plugin");
-	windcft = NULL;
-	return ENOENT;
-    }
-
+    (void)_krb5_plugin_run_f(context, "krb5", "windc",
+			     KRB5_WINDC_PLUGIN_MINOR, 0, NULL, load);
     return 0;
 }
 
+struct generate_uc {
+    hdb_entry_ex *client;
+    krb5_pac *pac;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
+    struct generate_uc *uc = (struct generate_uc *)userctx;    
+
+    if (ft->pac_generate == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+    return ft->pac_generate((void *)plug, context, uc->client, uc->pac);
+}
+
 
 krb5_error_code
 _kdc_pac_generate(krb5_context context,
 		  hdb_entry_ex *client,
 		  krb5_pac *pac)
 {
-    *pac = NULL;
-    if (windcft == NULL)
+    struct generate_uc uc;
+
+    if (!have_plugin)
 	return 0;
-    return (windcft->pac_generate)(windcctx, context, client, pac);
+
+    uc.client = client;
+    uc.pac = pac;
+
+    (void)_krb5_plugin_run_f(context, "krb5", "windc",
+			     KRB5_WINDC_PLUGIN_MINOR, 0, &uc, generate);
+    return 0;
+}
+
+struct verify_uc {
+    krb5_principal client_principal;
+    krb5_principal delegated_proxy_principal;
+    hdb_entry_ex *client;
+    hdb_entry_ex *server;
+    hdb_entry_ex *krbtgt;
+    krb5_pac *pac;
+    int *verified;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
+    struct verify_uc *uc = (struct verify_uc *)userctx;    
+    krb5_error_code ret;
+
+    if (ft->pac_verify == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+    ret = ft->pac_verify((void *)plug, context,
+			 uc->client_principal,
+			 uc->delegated_proxy_principal,
+			 uc->client, uc->server, uc->krbtgt, uc->pac);
+    if (ret == 0)
+	(*uc->verified) = 1;
+
+    return 0;
 }
 
 krb5_error_code
@@ -93,37 +130,77 @@ _kdc_pac_verify(krb5_context context,
 		krb5_pac *pac,
 		int *verified)
 {
-    krb5_error_code ret;
+    struct verify_uc uc;
 
-    if (windcft == NULL)
+    if (!have_plugin)
 	return 0;
 
-    ret = windcft->pac_verify(windcctx, context,
-			      client_principal,
-			      delegated_proxy_principal,
-			      client, server, krbtgt, pac);
-    if (ret == 0)
-	*verified = 1;
-    return ret;
+    uc.client_principal = client_principal;
+    uc.delegated_proxy_principal = delegated_proxy_principal;
+    uc.client = client;
+    uc.server = server;
+    uc.krbtgt = krbtgt;
+    uc.pac = pac;
+    uc.verified = verified;
+
+    (void)_krb5_plugin_run_f(context, "krb5", "windc",
+			     KRB5_WINDC_PLUGIN_MINOR, 0, &uc, verify);
+    return 0;
 }
 
+struct check_uc {
+    krb5_kdc_configuration *config;
+    hdb_entry_ex *client_ex;
+    const char *client_name;
+    hdb_entry_ex *server_ex;
+    const char *server_name;
+    KDC_REQ *req;
+    METHOD_DATA *method_data;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+check(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
+    struct check_uc *uc = (struct check_uc *)userctx;    
+
+    if (ft->client_access == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+    return ft->client_access((void *)plug, context, uc->config, 
+			     uc->client_ex, uc->client_name, 
+			     uc->server_ex, uc->server_name, 
+			     uc->req, uc->method_data);
+}
+
+
 krb5_error_code
 _kdc_check_access(krb5_context context,
 		  krb5_kdc_configuration *config,
 		  hdb_entry_ex *client_ex, const char *client_name,
 		  hdb_entry_ex *server_ex, const char *server_name,
 		  KDC_REQ *req,
-		  krb5_data *e_data)
+		  METHOD_DATA *method_data)
 {
-    if (windcft == NULL)
-	    return kdc_check_flags(context, config,
-				   client_ex, client_name,
-				   server_ex, server_name,
-				   req->msg_type == krb_as_req);
+    krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
+    struct check_uc uc;
 
-    return (windcft->client_access)(windcctx,
-				    context, config,
-				    client_ex, client_name,
-				    server_ex, server_name,
-				    req, e_data);
+    if (have_plugin) {
+        uc.config = config;
+        uc.client_ex = client_ex;
+        uc.client_name = client_name;
+        uc.server_ex = server_ex;
+        uc.server_name = server_name;
+        uc.req = req;
+        uc.method_data = method_data;
+
+        ret = _krb5_plugin_run_f(context, "krb5", "windc",
+                                 KRB5_WINDC_PLUGIN_MINOR, 0, &uc, check);
+    }
+
+    if (ret == KRB5_PLUGIN_NO_HANDLE)
+	return kdc_check_flags(context, config,
+			       client_ex, client_name,
+			       server_ex, server_name,
+			       req->msg_type == krb_as_req);
+    return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kdc/windc_plugin.h b/crypto/external/bsd/heimdal/dist/kdc/windc_plugin.h
index 7738c1495..afbcd1aa5 100644
--- a/crypto/external/bsd/heimdal/dist/kdc/windc_plugin.h
+++ b/crypto/external/bsd/heimdal/dist/kdc/windc_plugin.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: windc_plugin.h,v 1.1.1.3 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: windc_plugin.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -70,9 +70,9 @@ typedef krb5_error_code
 (*krb5plugin_windc_client_access)(
 	void *, krb5_context,
 	krb5_kdc_configuration *config,
-	hdb_entry_ex *, const char *,
-	hdb_entry_ex *, const char *,
-	KDC_REQ *, krb5_data *);
+	hdb_entry_ex *, const char *, 
+	hdb_entry_ex *, const char *, 
+	KDC_REQ *, METHOD_DATA *);
 
 
 #define KRB5_WINDC_PLUGIN_MINOR			6
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/Makefile.am b/crypto/external/bsd/heimdal/dist/kpasswd/Makefile.am
index 4fe656b88..d5f1073fb 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/Makefile.am
@@ -2,8 +2,6 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_hcrypto)
-
 man_MANS = kpasswd.1 kpasswdd.8
 
 bin_PROGRAMS = kpasswd
@@ -22,7 +20,7 @@ kpasswdd_LDADD = \
 	$(LDADD) \
 	$(LIB_pidfile) \
 	$(LIB_dlopen) \
-	$(DBLIB)
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
 
 LDADD = $(top_builddir)/lib/krb5/libkrb5.la \
 	$(LIB_hcrypto) \
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd-generator.c b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd-generator.c
index 038cd8d2b..cb5f7c259 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd-generator.c
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd-generator.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kpasswd-generator.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $	*/
+/*	$NetBSD: kpasswd-generator.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
@@ -35,27 +35,27 @@
 
 #include "kpasswd_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: kpasswd-generator.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static unsigned
-read_words (const char *filename, char ***ret_w)
+read_words(const char *filename, char ***ret_w)
 {
     unsigned n, alloc;
     FILE *f;
     char buf[256];
     char **w = NULL;
 
-    f = fopen (filename, "r");
+    f = fopen(filename, "r");
     if (f == NULL)
-	err (1, "cannot open %s", filename);
+	err(1, "cannot open %s", filename);
     alloc = n = 0;
-    while (fgets (buf, sizeof(buf), f) != NULL) {
+    while (fgets(buf, sizeof(buf), f) != NULL) {
 	buf[strcspn(buf, "\r\n")] = '\0';
 	if (n >= alloc) {
 	    alloc += 16;
-	    w = erealloc (w, alloc * sizeof(char **));
+	    w = erealloc(w, alloc * sizeof(char *));
 	}
-	w[n++] = estrdup (buf);
+	w[n++] = estrdup(buf);
     }
     *ret_w = w;
     if (n == 0)
@@ -65,30 +65,30 @@ read_words (const char *filename, char ***ret_w)
 }
 
 static int
-nop_prompter (krb5_context context,
-	      void *data,
-	      const char *name,
-	      const char *banner,
-	      int num_prompts,
-	      krb5_prompt prompts[])
+nop_prompter(krb5_context context,
+	     void *data,
+	     const char *name,
+	     const char *banner,
+	     int num_prompts,
+	     krb5_prompt prompts[])
 {
     return 0;
 }
 
 static void
-generate_requests (const char *filename, unsigned nreq)
+generate_requests(const char *filename, unsigned nreq)
 {
     krb5_context context;
     krb5_error_code ret;
     int i;
     char **words;
-    unsigned nwords;
+    unsigned nwords, k;
 
-    ret = krb5_init_context (&context);
+    ret = krb5_init_context(&context);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
 
-    nwords = read_words (filename, &words);
+    nwords = read_words(filename, &words);
 
     for (i = 0; i < nreq; ++i) {
 	char *name = words[rand() % nwords];
@@ -98,29 +98,34 @@ generate_requests (const char *filename, unsigned nreq)
 	int result_code;
 	krb5_data result_code_string, result_string;
 	char *old_pwd, *new_pwd;
+	int aret;
 
-	krb5_get_init_creds_opt_alloc (context, &opt);
+	krb5_get_init_creds_opt_alloc(context, &opt);
 	krb5_get_init_creds_opt_set_tkt_life (opt, 300);
 	krb5_get_init_creds_opt_set_forwardable (opt, FALSE);
 	krb5_get_init_creds_opt_set_proxiable (opt, FALSE);
 
-	ret = krb5_parse_name (context, name, &principal);
+	ret = krb5_parse_name(context, name, &principal);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_parse_name %s", name);
+	    krb5_err(context, 1, ret, "krb5_parse_name %s", name);
 
-	asprintf (&old_pwd, "%s", name);
-	asprintf (&new_pwd, "%s2", name);
+	aret = asprintf(&old_pwd, "%s", name);
+	if (aret == -1)
+	    krb5_errx(context, 1, "out of memory");
+	aret = asprintf(&new_pwd, "%s2", name);
+	if (aret == -1)
+	    krb5_errx(context, 1, "out of memory");
 
-	ret = krb5_get_init_creds_password (context,
-					    &cred,
-					    principal,
-					    old_pwd,
-					    nop_prompter,
-					    NULL,
-					    0,
-					    "kadmin/changepw",
-					    opt);
-	if( ret == KRB5KRB_AP_ERR_BAD_INTEGRITY
+	ret = krb5_get_init_creds_password(context,
+					   &cred,
+					   principal,
+					   old_pwd,
+					   nop_prompter,
+					   NULL,
+					   0,
+					   "kadmin/changepw",
+					   opt);
+	if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY
 	    || ret == KRB5KRB_AP_ERR_MODIFIED) {
 	    char *tmp;
 
@@ -128,66 +133,70 @@ generate_requests (const char *filename, unsigned nreq)
 	    new_pwd = old_pwd;
 	    old_pwd = tmp;
 
-	    ret = krb5_get_init_creds_password (context,
-						&cred,
-						principal,
-						old_pwd,
-						nop_prompter,
-						NULL,
-						0,
-						"kadmin/changepw",
-						opt);
+            ret = krb5_get_init_creds_password(context,
+                                               &cred,
+                                               principal,
+                                               old_pwd,
+                                               nop_prompter,
+                                               NULL,
+                                               0,
+                                               "kadmin/changepw",
+                                               opt);
 	}
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_get_init_creds_password");
+	    krb5_err(context, 1, ret, "krb5_get_init_creds_password");
 
-	krb5_free_principal (context, principal);
+	krb5_free_principal(context, principal);
 
 
-	ret = krb5_set_password (context,
-				 &cred,
-				 new_pwd,
-				 NULL,
-				 &result_code,
-				 &result_code_string,
-				 &result_string);
+        ret = krb5_set_password(context,
+                                &cred,
+                                new_pwd,
+                                NULL,
+                                &result_code,
+                                &result_code_string,
+                                &result_string);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_change_password");
+	    krb5_err(context, 1, ret, "krb5_change_password");
 
-	free (old_pwd);
-	free (new_pwd);
-	krb5_free_cred_contents (context, &cred);
+	free(old_pwd);
+	free(new_pwd);
+	krb5_free_cred_contents(context, &cred);
 	krb5_get_init_creds_opt_free(context, opt);
     }
+
+    for (k = 0; k < nwords; k++)
+        free(words[k]);
+    free(words);
 }
 
 static int version_flag	= 0;
 static int help_flag	= 0;
 
 static struct getargs args[] = {
-    { "version", 	0,   arg_flag, &version_flag },
-    { "help",		0,   arg_flag, &help_flag }
+    { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
+    { "help",		0,   arg_flag, &help_flag,    NULL, NULL }
 };
 
 static void
-usage (int ret)
+usage(int ret)
 {
-    arg_printusage (args,
-		    sizeof(args)/sizeof(*args),
-		    NULL,
-		    "file [number]");
+    arg_printusage(args,
+		   sizeof(args)/sizeof(*args),
+		   NULL,
+		   "file [number]");
     exit (ret);
 }
 
 int
 main(int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     int nreq;
     char *end;
 
     setprogname(argv[0]);
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
     if (help_flag)
 	usage (0);
@@ -195,15 +204,15 @@ main(int argc, char **argv)
 	print_version(NULL);
 	return 0;
     }
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 2)
 	usage (1);
     srand (0);
-    nreq = strtol (argv[1], &end, 0);
+    nreq = strtol(argv[1], &end, 0);
     if (argv[1] == end || *end != '\0')
 	usage (1);
-    generate_requests (argv[0], nreq);
+    generate_requests(argv[0], nreq);
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.1 b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.1
index 11fc76728..385d7117e 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.1
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kpasswd.1,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $
+.\"	$NetBSD: kpasswd.1,v 1.2 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 1997, 2000 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.c b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.c
index 8baffff12..92322aaf5 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.c
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kpasswd.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kpasswd.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
  */
 
 #include "kpasswd_locl.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: kpasswd.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static int version_flag;
 static int help_flag;
@@ -66,22 +66,23 @@ change_password(krb5_context context,
     krb5_error_code ret;
     char pwbuf[BUFSIZ];
     char *msg, *name;
+    int aret;
 
     krb5_data_zero (&result_code_string);
     krb5_data_zero (&result_string);
 
     name = msg = NULL;
     if (principal == NULL)
-	asprintf(&msg, "New password: ");
+	aret = asprintf(&msg, "New password: ");
     else {
 	ret = krb5_unparse_name(context, principal, &name);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_unparse_name");
 
-	asprintf(&msg, "New password for %s: ", name);
+	aret = asprintf(&msg, "New password for %s: ", name);
     }
 
-    if (msg == NULL)
+    if (aret == -1 || msg == NULL)
 	krb5_errx (context, 1, "out of memory");
 
     ret = UI_UTIL_read_pw_string (pwbuf, sizeof(pwbuf), msg, 1);
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd_locl.h b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd_locl.h
index 9a6277606..f183a02ff 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd_locl.h
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswd_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kpasswd_locl.h,v 1.1.1.2 2011/04/14 14:08:18 elric Exp $	*/
+/*	$NetBSD: kpasswd_locl.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -42,6 +42,8 @@
 #include <config.h>
 #endif
 
+#include <krb5/roken.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -98,7 +100,6 @@
 #include <libutil.h>
 #endif
 #include <err.h>
-#include <krb5/roken.h>
 #include <krb5/getarg.h>
 #include <krb5/krb5.h>
 #include "crypto-headers.h" /* for des_read_pw_string */
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.8 b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.8
index ab7f4be6d..ed4f5b465 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.8
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kpasswdd.8,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kpasswdd.8,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 1997, 2000 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c
index 048d36a0d..2e340c150 100644
--- a/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c
+++ b/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kpasswdd.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: kpasswdd.c,v 1.4 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
  */
 
 #include "kpasswd_locl.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: kpasswdd.c,v 1.4 2017/01/28 21:31:45 christos Exp $");
 
 #include <kadm5/admin.h>
 #ifdef HAVE_SYS_UN_H
@@ -300,6 +300,7 @@ change (krb5_auth_context auth_context,
 	if (chpw.targname) {
 	    krb5_principal_data princ;
 
+	    memset(&princ, 0, sizeof (princ));
 	    princ.name = *chpw.targname;
 	    princ.realm = *chpw.targrealm;
 	    if (princ.realm == NULL) {
@@ -408,7 +409,7 @@ change (krb5_auth_context auth_context,
     tmp = pwd_data->data;
     tmp[pwd_data->length - 1] = '\0';
 
-    ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, tmp);
+    ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, 1, tmp);
     krb5_free_data (context, pwd_data);
     pwd_data = NULL;
     if (ret) {
@@ -437,7 +438,6 @@ out:
 
 static int
 verify (krb5_auth_context *auth_context,
-	krb5_realm *realms,
 	krb5_keytab keytab,
 	krb5_ticket **ticket,
 	krb5_data *out_data,
@@ -453,7 +453,9 @@ verify (krb5_auth_context *auth_context,
     uint16_t pkt_len, pkt_ver, ap_req_len;
     krb5_data ap_req_data;
     krb5_data krb_priv_data;
-    krb5_realm *r;
+    krb5_const_realm client_realm;
+    krb5_principal sprinc;
+    int same;
 
     /*
      * Only send an error reply if the request passes basic length
@@ -502,47 +504,40 @@ verify (krb5_auth_context *auth_context,
 	return 1;
     }
 
-    /* verify realm and principal */
-    for (r = realms; *r != NULL; r++) {
-	krb5_principal principal;
-	krb5_boolean same;
-
-	ret = krb5_make_principal (context,
-				   &principal,
-				   *r,
-				   "kadmin",
-				   "changepw",
-				   NULL);
-	if (ret)
-	    krb5_err (context, 1, ret, "krb5_make_principal");
-
-	same = krb5_principal_compare(context, principal, (*ticket)->server);
-	krb5_free_principal(context, principal);
-	if (same == TRUE)
-	    break;
-    }
-    if (*r == NULL) {
-	char *str;
-	krb5_unparse_name(context, (*ticket)->server, &str);
-	krb5_warnx (context, "client used not valid principal %s", str);
-	free(str);
-	reply_error (NULL, s, sa, sa_size, ret, 1,
-		     "Bad request");
-	goto out;
-    }
-
-    if (strcmp((*ticket)->server->realm, (*ticket)->client->realm) != 0) {
-	krb5_warnx (context, "server realm (%s) not same a client realm (%s)",
-		    (*ticket)->server->realm, (*ticket)->client->realm);
-	reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
-		     "Bad request");
-	goto out;
-    }
-
     if (!(*ticket)->ticket.flags.initial) {
-	krb5_warnx (context, "initial flag not set");
-	reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
-		     "Bad request");
+	krb5_warnx(context, "initial flag not set");
+	reply_error((*ticket)->server->realm, s, sa, sa_size, ret, 1,
+		    "Bad request");
+	goto out;
+    }
+
+    /*
+     * The service principal must be kadmin/changepw@CLIENT-REALM, there
+     * is no reason to require the KDC's default realm(s) to be the same
+     * as the realm(s) it serves. The only potential issue is when a KDC
+     * is a master for realm A and a slave for realm B, in which case it
+     * should not accept requests to change passwords for realm B, these
+     * should be sent to realm B's master. This same issue is present in
+     * the checks that only accepted local realms, there is no new risk.
+     */
+
+    client_realm = krb5_principal_get_realm(context, (*ticket)->client);
+    ret = krb5_make_principal(context, &sprinc, client_realm,
+			      "kadmin", "changepw", NULL);
+    if (ret)
+	goto out;
+    same = krb5_principal_compare(context, sprinc, (*ticket)->server);
+    krb5_free_principal(context, sprinc);
+
+    if (!same) {
+	char *sname;
+
+	if (krb5_unparse_name(context, (*ticket)->server, &sname) != 0)
+	    sname = NULL;
+	krb5_warnx(context, "Invalid kpasswd service principal %s",
+		   sname ? sname : "<enomem>");
+	free(sname);
+	reply_error(NULL, s, sa, sa_size, ret, 1, "Bad request");
 	goto out;
     }
     krb_priv_data.data   = msg + 6 + ap_req_len;
@@ -583,8 +578,7 @@ out:
 }
 
 static void
-process (krb5_realm *realms,
-	 krb5_keytab keytab,
+process (krb5_keytab keytab,
 	 int s,
 	 krb5_address *this_addr,
 	 struct sockaddr *sa,
@@ -623,7 +617,7 @@ process (krb5_realm *realms,
 	goto out;
     }
 
-    if (verify (&auth_context, realms, keytab, &ticket, &out_data,
+    if (verify (&auth_context, keytab, &ticket, &out_data,
 		&version, s, sa, sa_size, msg, len, &other_addr) == 0)
     {
 	/*
@@ -682,13 +676,50 @@ get_local_addr(struct sockaddr *remote, int remlen,
 }
 #endif
 
+static const char *check_library  = NULL;
+static const char *check_function = NULL;
+static getarg_strings policy_libraries = { 0, NULL };
+static char sHDB[] = "HDBGET:";
+static char *keytab_str = sHDB;
+static char *realm_str;
+static int version_flag;
+static int help_flag;
+static int detach_from_console;
+static int daemon_child = -1;
+static char *port_str;
+static char *config_file;
+
+struct getargs args[] = {
+#ifdef HAVE_DLOPEN
+    { "check-library", 0, arg_string, &check_library,
+      "library to load password check function from", "library" },
+    { "check-function", 0, arg_string, &check_function,
+      "password check function to load", "function" },
+    { "policy-libraries", 0, arg_strings, &policy_libraries,
+      "password check function to load", "function" },
+#endif
+    { "addresses", 0, arg_strings, &addresses_str,
+      "addresses to listen on", "list of addresses" },
+    { "detach", 0, arg_flag, &detach_from_console,
+      "detach from console", NULL },
+    { "daemon-child",       0 ,      arg_integer, &daemon_child,
+      "private argument, do not use", NULL },
+    { "keytab", 'k', arg_string, &keytab_str,
+      "keytab to get authentication key from", "kspec" },
+    { "config-file", 'c', arg_string, &config_file, NULL, NULL },
+    { "realm", 'r', arg_string, &realm_str, "default realm", "realm" },
+    { "port",  'p', arg_string, &port_str, "port", NULL },
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
+};
+int num_args = sizeof(args) / sizeof(args[0]);
+
 static int
-doit (krb5_keytab keytab, int port)
+doit(krb5_keytab keytab, int port)
 {
     krb5_error_code ret;
     int *sockets;
     int maxfd;
-    krb5_realm *realms;
     krb5_addresses addrs;
     krb5_address *my_addrp;
     unsigned n, i;
@@ -704,10 +735,6 @@ doit (krb5_keytab keytab, int port)
     struct sockaddr *localsa = (struct sockaddr *)&__local;
 #endif
 
-    ret = krb5_get_default_realms(context, &realms);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_get_default_realms");
-
 #ifdef INETD_SUPPORT
     fromlen = sizeof __ss;
     from_inetd = (getsockname(0, sa, &fromlen) == 0);
@@ -717,39 +744,39 @@ doit (krb5_keytab keytab, int port)
     if (explicit_addresses.len) {
 	addrs = explicit_addresses;
     } else {
-	ret = krb5_get_all_server_addrs (context, &addrs);
+	ret = krb5_get_all_server_addrs(context, &addrs);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_get_all_server_addrs");
+	    krb5_err(context, 1, ret, "krb5_get_all_server_addrs");
     }
     n = addrs.len;
 
-    sockets = malloc (n * sizeof(*sockets));
+    sockets = malloc(n * sizeof(*sockets));
     if (sockets == NULL)
-	krb5_errx (context, 1, "out of memory");
+	krb5_errx(context, 1, "out of memory");
     maxfd = -1;
     FD_ZERO(&real_fdset);
     for (i = 0; i < n; ++i) {
 	krb5_socklen_t sa_size = sizeof(__ss);
 
-	krb5_addr2sockaddr (context, &addrs.val[i], sa, &sa_size, port);
+	krb5_addr2sockaddr(context, &addrs.val[i], sa, &sa_size, port);
 
-	sockets[i] = socket (sa->sa_family, SOCK_DGRAM, 0);
+	sockets[i] = socket(__ss.ss_family, SOCK_DGRAM, 0);
 	if (sockets[i] < 0)
-	    krb5_err (context, 1, errno, "socket");
-	if (bind (sockets[i], sa, sa_size) < 0) {
+	    krb5_err(context, 1, errno, "socket");
+	if (bind(sockets[i], sa, sa_size) < 0) {
 	    char str[128];
 	    size_t len;
 	    int save_errno = errno;
 
-	    ret = krb5_print_address (&addrs.val[i], str, sizeof(str), &len);
+	    ret = krb5_print_address(&addrs.val[i], str, sizeof(str), &len);
 	    if (ret)
 		strlcpy(str, "unknown address", sizeof(str));
-	    krb5_warn (context, save_errno, "bind(%s)", str);
+	    krb5_warn(context, save_errno, "bind(%s)", str);
 	    continue;
 	}
-	maxfd = max (maxfd, sockets[i]);
+	maxfd = max(maxfd, sockets[i]);
 	if (maxfd >= FD_SETSIZE)
-	    krb5_errx (context, 1, "fd too large");
+	    krb5_errx(context, 1, "fd too large");
 	FD_SET(sockets[i], &real_fdset);
     }
 #ifdef INETD_SUPPORT
@@ -763,18 +790,20 @@ doit (krb5_keytab keytab, int port)
     }
 #endif
     if (maxfd == -1)
-	krb5_errx (context, 1, "No sockets!");
+	krb5_errx(context, 1, "No sockets!");
 
-    while(exit_flag == 0) {
+    roken_detach_finish(NULL, daemon_child);
+
+    while (exit_flag == 0) {
 	krb5_ssize_t retx;
 	fd_set fdset = real_fdset;
 
-	retx = select (maxfd + 1, &fdset, NULL, NULL, NULL);
+	retx = select(maxfd + 1, &fdset, NULL, NULL, NULL);
 	if (retx < 0) {
 	    if (errno == EINTR)
 		continue;
 	    else
-		krb5_err (context, 1, errno, "select");
+		krb5_err(context, 1, errno, "select");
 	}
 	for (i = 0; i < n; ++i)
 	    if (FD_ISSET(sockets[i], &fdset)) {
@@ -784,10 +813,10 @@ doit (krb5_keytab keytab, int port)
 		retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
 				sa, &addrlen);
 		if (retx < 0) {
-		    if(errno == EINTR)
+		    if (errno == EINTR)
 			break;
 		    else
-			krb5_err (context, 1, errno, "recvfrom");
+			krb5_err(context, 1, errno, "recvfrom");
 		}
 #ifdef INETD_SUPPORT
 		if (from_inetd) {
@@ -807,7 +836,7 @@ doit (krb5_keytab keytab, int port)
 #endif
 		my_addrp = &addrs.val[i];
 
-		process (realms, keytab, sockets[i],
+		process(keytab, sockets[i],
 			 my_addrp,
 			 sa, addrlen,
 			 buf, retx);
@@ -830,8 +859,7 @@ doit (krb5_keytab keytab, int port)
 #ifdef INETD_SUPPORT
     if (!from_inetd)
 #endif
-	krb5_free_addresses (context, &addrs);
-    krb5_free_host_realm (context, realms);
+    krb5_free_addresses (context, &addrs);
     krb5_free_context (context);
     return 0;
 }
@@ -842,58 +870,31 @@ sigterm(int sig)
     exit_flag = 1;
 }
 
-static const char *check_library  = NULL;
-static const char *check_function = NULL;
-static getarg_strings policy_libraries = { 0, NULL };
-static char sHDB[] = "HDB:";
-static char *keytab_str = sHDB;
-static char *realm_str;
-static int version_flag;
-static int help_flag;
-static char *port_str;
-static char *config_file;
-
-struct getargs args[] = {
-#ifdef HAVE_DLOPEN
-    { "check-library", 0, arg_string, &check_library,
-      "library to load password check function from", "library" },
-    { "check-function", 0, arg_string, &check_function,
-      "password check function to load", "function" },
-    { "policy-libraries", 0, arg_strings, &policy_libraries,
-      "password check function to load", "function" },
-#endif
-    { "addresses",	0,	arg_strings, &addresses_str,
-      "addresses to listen on", "list of addresses" },
-    { "keytab", 'k', arg_string, &keytab_str,
-      "keytab to get authentication key from", "kspec" },
-    { "config-file", 'c', arg_string, &config_file, NULL, NULL },
-    { "realm", 'r', arg_string, &realm_str, "default realm", "realm" },
-    { "port",  'p', arg_string, &port_str, "port", NULL },
-    { "version", 0, arg_flag, &version_flag, NULL, NULL },
-    { "help", 0, arg_flag, &help_flag, NULL, NULL }
-};
-int num_args = sizeof(args) / sizeof(args[0]);
-
 int
-main (int argc, char **argv)
+main(int argc, char **argv)
 {
     krb5_keytab keytab;
     krb5_error_code ret;
     char **files;
     int port, i;
+    int aret;
 
     krb5_program_setup(&context, argc, argv, args, num_args, NULL);
 
-    if(help_flag)
+    if (help_flag)
 	krb5_std_usage(0, args, num_args);
-    if(version_flag) {
+
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
 
+    if (detach_from_console > 0 && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
+
     if (config_file == NULL) {
-	asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
-	if (config_file == NULL)
+	aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
+	if (aret == -1)
 	    errx(1, "out of memory");
     }
 
@@ -906,37 +907,37 @@ main (int argc, char **argv)
     if (ret)
 	krb5_err(context, 1, ret, "reading configuration files");
 
-    if(realm_str)
+    if (realm_str)
 	krb5_set_default_realm(context, realm_str);
 
-    krb5_openlog (context, "kpasswdd", &log_facility);
+    krb5_openlog(context, "kpasswdd", &log_facility);
     krb5_set_warn_dest(context, log_facility);
 
     if (port_str != NULL) {
-	struct servent *s = roken_getservbyname (port_str, "udp");
+	struct servent *s = roken_getservbyname(port_str, "udp");
 
 	if (s != NULL)
 	    port = s->s_port;
 	else {
 	    char *ptr;
 
-	    port = strtol (port_str, &ptr, 10);
+	    port = strtol(port_str, &ptr, 10);
 	    if (port == 0 && ptr == port_str)
-		krb5_errx (context, 1, "bad port `%s'", port_str);
+		krb5_errx(context, 1, "bad port `%s'", port_str);
 	    port = htons(port);
 	}
     } else
-	port = krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT);
+	port = krb5_getportbyname(context, "kpasswd", "udp", KPASSWD_PORT);
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
-    if(ret)
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
+    if (ret)
 	krb5_err(context, 1, ret, "krb5_kt_register");
 
     ret = krb5_kt_resolve(context, keytab_str, &keytab);
-    if(ret)
+    if (ret)
 	krb5_err(context, 1, ret, "%s", keytab_str);
 
-    kadm5_setup_passwd_quality_check (context, check_library, check_function);
+    kadm5_setup_passwd_quality_check(context, check_library, check_function);
 
     for (i = 0; i < policy_libraries.num_strings; i++) {
 	ret = kadm5_add_passwd_quality_verifier(context,
@@ -955,16 +956,16 @@ main (int argc, char **argv)
 	int j;
 
 	for (j = 0; j < addresses_str.num_strings; ++j)
-	    add_one_address (addresses_str.strings[j], j == 0);
-	free_getarg_strings (&addresses_str);
+	    add_one_address(addresses_str.strings[j], j == 0);
+	free_getarg_strings(&addresses_str);
     } else {
-	char **foo = krb5_config_get_strings (context, NULL,
+	char **foo = krb5_config_get_strings(context, NULL,
 					      "kdc", "addresses", NULL);
 
 	if (foo != NULL) {
-	    add_one_address (*foo++, TRUE);
+	    add_one_address(*foo++, TRUE);
 	    while (*foo)
-		add_one_address (*foo++, FALSE);
+		add_one_address(*foo++, FALSE);
 	}
     }
 
@@ -984,7 +985,7 @@ main (int argc, char **argv)
     signal(SIGTERM, sigterm);
 #endif
 
-    pidfile(NULL);
+    rk_pidfile(NULL);
 
-    return doit (keytab, port);
+    return doit(keytab, port);
 }
diff --git a/crypto/external/bsd/heimdal/dist/krb5.conf b/crypto/external/bsd/heimdal/dist/krb5.conf
index c9f4c44a5..103ea8c22 100644
--- a/crypto/external/bsd/heimdal/dist/krb5.conf
+++ b/crypto/external/bsd/heimdal/dist/krb5.conf
@@ -1,16 +1,6 @@
 [libdefaults]
-        default_realm = MY.REALM
+	default_realm = MY.REALM
 	clockskew = 300
-	v4_instance_resolve = false
-	v4_name_convert = {
-		host = {
-			rcmd = host
-			ftp = ftp
-		}
-		plain = {
-			something = something-else
-		}
-	}
 	
 [realms]
 	MY.REALM = {
diff --git a/crypto/external/bsd/heimdal/dist/kuser/Makefile.am b/crypto/external/bsd/heimdal/dist/kuser/Makefile.am
index 3de5dff41..2aeb95382 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/kuser/Makefile.am
@@ -2,7 +2,11 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_hcrypto) -I$(srcdir)/../lib/krb5 \
+if !NO_AFS
+afs_lib = $(LIB_kafs)
+endif
+
+AM_CPPFLAGS += -I$(srcdir)/../lib/krb5 \
 	$(INCLUDE_libintl) \
 	-DHEIMDAL_LOCALEDIR='"$(localedir)"'
 
@@ -15,13 +19,13 @@ man_MANS = \
 	kgetcred.1 \
 	kimpersonate.8
 
-bin_PROGRAMS = kinit kdestroy kgetcred kcc
+bin_PROGRAMS = kinit kdestroy kgetcred heimtools
 libexec_PROGRAMS = kdigest kimpersonate
 
 noinst_PROGRAMS = kverify kdecode_ticket generate-requests
 
 kinit_LDADD = \
-	$(LIB_kafs) \
+	$(afs_lib) \
 	$(top_builddir)/lib/krb5/libkrb5.la \
 	$(top_builddir)/lib/ntlm/libheimntlm.la \
 	$(LIB_hcrypto) \
@@ -33,15 +37,15 @@ kdestroy_LDADD	= $(kinit_LDADD)
 
 kimpersonate_LDADD = $(kinit_LDADD)
 
-kcc_LDADD = \
+heimtools_LDADD = \
 	$(top_builddir)/lib/sl/libsl.la \
 	$(kinit_LDADD) \
 	$(LIB_readline)
 
-dist_kcc_SOURCES = kcc.c klist.c kswitch.c copy_cred_cache.c
-nodist_kcc_SOURCES = kcc-commands.c
+dist_heimtools_SOURCES = heimtools.c klist.c kswitch.c copy_cred_cache.c
+nodist_heimtools_SOURCES = heimtools-commands.c
 
-$(kcc_OBJECTS): kcc-commands.h
+$(heimtools_OBJECTS): heimtools-commands.h
 
 dist_kdigest_SOURCES = kdigest.c
 nodist_kdigest_SOURCES = kdigest-commands.c
@@ -58,13 +62,13 @@ $(kdigest_OBJECTS): kdigest-commands.h
 
 CLEANFILES = \
 	kdigest-commands.h kdigest-commands.c \
-	kcc-commands.h kcc-commands.c
+	heimtools-commands.h heimtools-commands.c
 
 kdigest-commands.c kdigest-commands.h: kdigest-commands.in
 	$(SLC) $(srcdir)/kdigest-commands.in
 
-kcc-commands.c kcc-commands.h: kcc-commands.in
-	$(SLC) $(srcdir)/kcc-commands.in
+heimtools-commands.c heimtools-commands.h: heimtools-commands.in
+	$(SLC) $(srcdir)/heimtools-commands.in
 
 LDADD = \
 	$(top_builddir)/lib/krb5/libkrb5.la \
@@ -73,16 +77,19 @@ LDADD = \
 	$(LIB_roken)
 
 EXTRA_DIST = NTMakefile $(man_MANS) \
-	kcc-version.rc \
+	heimtools-version.rc \
+	kcpytkt.c \
+	kdeltkt.c \
+	kvno.c \
 	kdestroy-version.rc \
 	kdigest-version.rc \
 	kgetcred-version.rc \
 	kimpersonate-version.rc \
 	kinit-version.rc \
-	kuser_locl.h kcc-commands.in kdigest-commands.in copy_cred_cache.1
+	kuser_locl.h heimtools-commands.in kdigest-commands.in copy_cred_cache.1
 
 # make sure install-exec-hook doesn't have any commands in Makefile.am.common
 install-exec-hook:
-	(cd $(DESTDIR)$(bindir) && rm -f klist && $(LN_S) kcc klist)
-	(cd $(DESTDIR)$(bindir) && rm -f kswitch && $(LN_S) kcc kswitch)
+	(cd $(DESTDIR)$(bindir) && rm -f klist && $(LN_S) heimtools klist)
+	(cd $(DESTDIR)$(bindir) && rm -f kswitch && $(LN_S) heimtools kswitch)
 
diff --git a/crypto/external/bsd/heimdal/dist/kuser/NTMakefile b/crypto/external/bsd/heimdal/dist/kuser/NTMakefile
index bc12ad2cf..f9106c391 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/kuser/NTMakefile
@@ -37,7 +37,7 @@ intcflags=-I$(OBJ)
 
 BINPROGRAMS=\
 	$(BINDIR)\kinit.exe	\
-	$(BINDIR)\kcc.exe	\
+	$(BINDIR)\heimtools.exe	\
 	$(BINDIR)\kdestroy.exe	\
 	$(BINDIR)\kgetcred.exe	\
 	$(BINDIR)\kvno.exe	\
@@ -57,6 +57,9 @@ NOINSTPROGRAMS=\
 BINLIBS=\
 	$(LIBHEIMDAL)	\
 	$(LIBHEIMNTLM)	\
+!if !defined(NO_AFS)
+        $(LIBKAFS)      \
+!endif
 	$(LIBROKEN)	\
 	$(LIBVERS)
 
@@ -70,18 +73,18 @@ $(BINDIR)\kinit.exe: $(OBJ)\kinit.obj $(BINLIBS) $(OBJ)\kinit-version.res
 	$(EXECONLINK)
 	$(EXEPREP)
 
-KCC_OBJS =				\
-	$(OBJ)\kcc-commands.obj		\
-	$(OBJ)\kcc.obj			\
+HEIMTOOLS_OBJS =				\
+	$(OBJ)\heimtools-commands.obj		\
+	$(OBJ)\heimtools.obj			\
 	$(OBJ)\kswitch.obj		\
 	$(OBJ)\klist.obj		\
 	$(OBJ)\copy_cred_cache.obj
 
-KCCLIBS=\
+HEIMTOOLSLIBS=\
 	$(BINLIBS)	\
 	$(LIBSL)
 
-$(BINDIR)\kcc.exe: $(KCC_OBJS) $(KCCLIBS) $(OBJ)\kcc-version.res
+$(BINDIR)\heimtools.exe: $(HEIMTOOLS_OBJS) $(HEIMTOOLSLIBS) $(OBJ)\heimtools-version.res
 	$(EXECONLINK)
 	$(EXEPREP)
 
@@ -109,10 +112,10 @@ $(OBJ)\kdigest-commands.c $(OBJ)\kdigest-commands.h: kdigest-commands.in
 	$(BINDIR)\slc.exe kdigest-commands.in
 	cd $(SRCDIR)
 
-$(OBJ)\kcc-commands.c $(OBJ)\kcc-commands.h: kcc-commands.in
+$(OBJ)\heimtools-commands.c $(OBJ)\heimtools-commands.h: heimtools-commands.in
 	cd $(OBJ)
-	$(CP) $(SRCDIR)\kcc-commands.in $(OBJ)
-	$(BINDIR)\slc.exe kcc-commands.in
+	$(CP) $(SRCDIR)\heimtools-commands.in $(OBJ)
+	$(BINDIR)\slc.exe heimtools-commands.in
 	cd $(SRCDIR)
 
 $(LIBEXECDIR)\kimpersonate.exe: $(OBJ)\kimpersonate.obj $(BINLIBS) $(OBJ)\kimpersonate-version.res
@@ -129,4 +132,4 @@ $(BINDIR)\kcpytkt.exe: $(OBJ)\kcpytkt.obj $(BINLIBS)
 
 $(BINDIR)\kdeltkt.exe: $(OBJ)\kdeltkt.obj $(BINLIBS)
 	$(EXECONLINK)
-	$(EXEPREP)
\ No newline at end of file
+	$(EXEPREP)
diff --git a/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.1 b/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.1
index c1ce0f43a..66350467e 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: copy_cred_cache.1,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: copy_cred_cache.1,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.c b/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.c
index 8b7e6f789..415f1576c 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/copy_cred_cache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: copy_cred_cache.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: copy_cred_cache.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 #include <config.h>
 #include <krb5/parse_units.h>
 #include <krb5/parse_time.h>
-#include "kcc-commands.h"
+#include "heimtools-commands.h"
 
 static int32_t
 bitswap32(int32_t b)
@@ -94,72 +94,73 @@ copy_cred_cache(struct copy_cred_cache_options *opt, int argc, char **argv)
     memset(&ctx, 0, sizeof(ctx));
 
     if (opt->service_string) {
-	ret = krb5_parse_name(kcc_context, opt->service_string, &ctx.mcreds.server);
+	ret = krb5_parse_name(heimtools_context, opt->service_string, &ctx.mcreds.server);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "%s", opt->service_string);
+	    krb5_err(heimtools_context, 1, ret, "%s", opt->service_string);
     }
     if (opt->enctype_string) {
 	krb5_enctype enctype;
-	ret = krb5_string_to_enctype(kcc_context, opt->enctype_string, &enctype);
+	ret = krb5_string_to_enctype(heimtools_context, opt->enctype_string, &enctype);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "%s", opt->enctype_string);
+	    krb5_err(heimtools_context, 1, ret, "%s", opt->enctype_string);
 	ctx.whichfields |= KRB5_TC_MATCH_KEYTYPE;
 	ctx.mcreds.session.keytype = enctype;
     }
     if (opt->flags_string) {
-	parse_ticket_flags(kcc_context, opt->flags_string, &ctx.mcreds.flags);
+	parse_ticket_flags(heimtools_context, opt->flags_string, &ctx.mcreds.flags);
 	ctx.whichfields |= KRB5_TC_MATCH_FLAGS;
     }
     if (opt->valid_for_string) {
 	time_t t = parse_time(opt->valid_for_string, "s");
 	if(t < 0)
 	    errx(1, "unknown time \"%s\"", opt->valid_for_string);
-	ctx.mcreds.times.endtime = time(NULL) + t;
+	krb5_timeofday(heimtools_context, &ctx.mcreds.times.endtime);
+	ctx.mcreds.times.endtime += t;
 	ctx.whichfields |= KRB5_TC_MATCH_TIMES;
     }
     if (opt->fcache_version_integer)
-	krb5_set_fcache_version(kcc_context, opt->fcache_version_integer);
+	krb5_set_fcache_version(heimtools_context, opt->fcache_version_integer);
 
     if (argc == 1) {
-	from_name = krb5_cc_default_name(kcc_context);
+	from_name = krb5_cc_default_name(heimtools_context);
 	to_name = argv[0];
     } else {
 	from_name = argv[0];
 	to_name = argv[1];
     }
 
-    ret = krb5_cc_resolve(kcc_context, from_name, &from_ccache);
+    ret = krb5_cc_resolve(heimtools_context, from_name, &from_ccache);
     if (ret)
-	krb5_err(kcc_context, 1, ret, "%s", from_name);
+	krb5_err(heimtools_context, 1, ret, "%s", from_name);
 
     if (opt->krbtgt_only_flag) {
 	krb5_principal client;
-	ret = krb5_cc_get_principal(kcc_context, from_ccache, &client);
+	ret = krb5_cc_get_principal(heimtools_context, from_ccache, &client);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "getting default principal");
-	ret = krb5_make_principal(kcc_context, &ctx.mcreds.server,
-				  krb5_principal_get_realm(kcc_context, client),
+	    krb5_err(heimtools_context, 1, ret, "getting default principal");
+	ret = krb5_make_principal(heimtools_context, &ctx.mcreds.server,
+				  krb5_principal_get_realm(heimtools_context, client),
 				  KRB5_TGS_NAME,
-				  krb5_principal_get_realm(kcc_context, client),
+				  krb5_principal_get_realm(heimtools_context, client),
 				  NULL);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "constructing krbtgt principal");
-	krb5_free_principal(kcc_context, client);
+	    krb5_err(heimtools_context, 1, ret, "constructing krbtgt principal");
+	krb5_free_principal(heimtools_context, client);
     }
-    ret = krb5_cc_resolve(kcc_context, to_name, &to_ccache);
+    ret = krb5_cc_resolve(heimtools_context, to_name, &to_ccache);
     if (ret)
-	krb5_err(kcc_context, 1, ret, "%s", to_name);
+	krb5_err(heimtools_context, 1, ret, "%s", to_name);
 
-    ret = krb5_cc_copy_match_f(kcc_context, from_ccache, to_ccache,
+    ret = krb5_cc_copy_match_f(heimtools_context, from_ccache, to_ccache,
 			       matchfunc, &ctx, &matched);
     if (ret)
-	krb5_err(kcc_context, 1, ret, "copying cred cache");
+	krb5_err(heimtools_context, 1, ret, "copying cred cache");
 
-    krb5_cc_close(kcc_context, from_ccache);
+    krb5_cc_close(heimtools_context, from_ccache);
     if(matched == 0)
-	krb5_cc_destroy(kcc_context, to_ccache);
+	krb5_cc_destroy(heimtools_context, to_ccache);
     else
-	krb5_cc_close(kcc_context, to_ccache);
+	krb5_cc_close(heimtools_context, to_ccache);
 
     return matched == 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kuser/generate-requests.c b/crypto/external/bsd/heimdal/dist/kuser/generate-requests.c
index a072c0bb8..dd0b11b63 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/generate-requests.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/generate-requests.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: generate-requests.c,v 1.1.1.1 2011/04/13 18:14:38 elric Exp $	*/
+/*	$NetBSD: generate-requests.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
@@ -94,14 +94,15 @@ generate_requests (const char *filename, unsigned nreq)
 	    krb5_free_cred_contents (context, &cred);
 	krb5_free_principal(context, client);
     }
+    free(words);
 }
 
 static int version_flag	= 0;
 static int help_flag	= 0;
 
 static struct getargs args[] = {
-    { "version", 	0,   arg_flag, &version_flag },
-    { "help",		0,   arg_flag, &help_flag }
+    { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
+    { "help",		0,   arg_flag, &help_flag,    NULL, NULL }
 };
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kcc-commands.in b/crypto/external/bsd/heimdal/dist/kuser/heimtools-commands.in
similarity index 96%
rename from crypto/external/bsd/heimdal/dist/kuser/kcc-commands.in
rename to crypto/external/bsd/heimdal/dist/kuser/heimtools-commands.in
index 70967d448..b22a8c58d 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kcc-commands.in
+++ b/crypto/external/bsd/heimdal/dist/kuser/heimtools-commands.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -83,12 +83,22 @@ command = {
 		type = "flag"
 		help = "List all caches"
 	}
+	option = {
+		long = "json"
+		type = "flag"
+		help = "JSON formated output"
+	}
 	option = {
 		long = "verbose"
 		short = "v"
 		type = "flag"
 		help = "Verbose output"
 	}
+	option = {
+		long = "version"
+		type = "flag"
+		help = "version"
+	}
 	option = {
 		name = "a"
 		short = "a"
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kcc-version.rc b/crypto/external/bsd/heimdal/dist/kuser/heimtools-version.rc
similarity index 97%
rename from crypto/external/bsd/heimdal/dist/kuser/kcc-version.rc
rename to crypto/external/bsd/heimdal/dist/kuser/heimtools-version.rc
index 6c47c500d..a57f9e2d4 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kcc-version.rc
+++ b/crypto/external/bsd/heimdal/dist/kuser/heimtools-version.rc
@@ -31,6 +31,6 @@
 
 #define RC_FILE_TYPE VFT_APP
 #define RC_FILE_DESC_0409 "Ticket tool"
-#define RC_FILE_ORIG_0409 "kcc.exe"
+#define RC_FILE_ORIG_0409 "heimtools.exe"
 
 #include "../windows/version.rc"
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kcc.c b/crypto/external/bsd/heimdal/dist/kuser/heimtools.c
similarity index 92%
rename from crypto/external/bsd/heimdal/dist/kuser/kcc.c
rename to crypto/external/bsd/heimdal/dist/kuser/heimtools.c
index 548808394..2c6ad2d2f 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kcc.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/heimtools.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kcc.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: heimtools.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -35,9 +35,9 @@
 
 #include "kuser_locl.h"
 #include <krb5/sl.h>
-#include "kcc-commands.h"
+#include "heimtools-commands.h"
 
-krb5_context kcc_context;
+krb5_context heimtools_context;
 static int version_flag;
 static int help_flag;
 
@@ -114,14 +114,14 @@ main(int argc, char **argv)
     bindtextdomain ("heimdal_kuser", HEIMDAL_LOCALEDIR);
     textdomain("heimdal_kuser");
 
-    ret = krb5_init_context(&kcc_context);
+    ret = krb5_init_context(&heimtools_context);
     if (ret == KRB5_CONFIG_BADFORMAT)
 	errx (1, "krb5_init_context failed to parse configuration file");
     else if (ret)
 	errx(1, "krb5_init_context failed: %d", ret);
 
     /*
-     * Support linking of kcc to commands
+     * Support linking of heimtools to commands
      */
 
     if (!command_alias(getprogname())) {
@@ -152,7 +152,7 @@ main(int argc, char **argv)
     if (argc != 0) {
 	ret = sl_command(commands, argc, argv);
 	if(ret == -1)
-	    krb5_warnx(kcc_context, "unrecognized command: %s", argv[0]);
+	    sl_did_you_mean(commands, argv[0]);
 	else if (ret == -2)
 	    ret = 0;
 	if(ret != 0)
@@ -162,6 +162,6 @@ main(int argc, char **argv)
 	exit_status = 1;
     }
 
-    krb5_free_context(kcc_context);
+    krb5_free_context(heimtools_context);
     return exit_status;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kcpytkt.c b/crypto/external/bsd/heimdal/dist/kuser/kcpytkt.c
index 942df6292..5b2a2d103 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kcpytkt.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kcpytkt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kcpytkt.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kcpytkt.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 
 #include "kuser_locl.h"
@@ -6,6 +6,7 @@
 static char *etypestr = 0;
 static char *fromccachestr = 0;
 static char *flagstr = 0;
+static int  exp_ok = 0;
 static int  quiet_flag = 0;
 static int  version_flag = 0;
 static int  help_flag = 0;
@@ -17,6 +18,8 @@ struct getargs args[] = {
       "Encryption type", "enctype" },
     { "flags", 'f', arg_string, &flagstr,
       "Flags", "flags" },
+    { "expired-ok", 'E', arg_flag, &exp_ok,
+	"Keep expired tickets" },
     { "quiet", 'q', arg_flag, &quiet_flag, "Quiet" },
     { "version",        0, arg_flag, &version_flag },
     { "help",           0, arg_flag, &help_flag }
@@ -131,6 +134,11 @@ static void do_kcpytkt (int count, char *names[],
 
 	in_creds.session.keytype = etype;
 
+	if (!exp_ok) {
+	    krb5_timeofday(context, &in_creds.times.endtime);
+	    retflags |= KRB5_TC_MATCH_TIMES;
+	}
+
         ret = krb5_cc_retrieve_cred(context, fromccache, retflags,
                                     &in_creds, &out_creds);
 	if (ret) {
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdecode_ticket.c b/crypto/external/bsd/heimdal/dist/kuser/kdecode_ticket.c
index 7e1e1d850..9e14ba8ad 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdecode_ticket.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdecode_ticket.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdecode_ticket.c,v 1.1.1.1 2011/04/13 18:14:38 elric Exp $	*/
+/*	$NetBSD: kdecode_ticket.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -81,8 +81,8 @@ print_and_decode_tkt (krb5_context context,
 struct getargs args[] = {
     { "enctype",	'e', arg_string, &etype_str,
       "encryption type to use", "enctype"},
-    { "version", 	0,   arg_flag, &version_flag },
-    { "help",		0,   arg_flag, &help_flag }
+    { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
+    { "help",		0,   arg_flag, &help_flag, NULL, NULL }
 };
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdeltkt.c b/crypto/external/bsd/heimdal/dist/kuser/kdeltkt.c
index 6ace53a31..4800dcb2e 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdeltkt.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdeltkt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdeltkt.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kdeltkt.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 
 #include "kuser_locl.h"
@@ -6,6 +6,7 @@
 static char *etypestr = 0;
 static char *ccachestr = 0;
 static char *flagstr = 0;
+static int   exp_only = 0;
 static int   quiet_flag = 0;
 static int   help_flag = 0;
 static int   version_flag = 0;
@@ -17,6 +18,8 @@ struct getargs args[] = {
       "Encryption type", "enctype" },
     { "flags", 'f', arg_string, &flagstr,
       "Flags", "flags" },
+    { "expired-only", 'E', arg_flag, &exp_only,
+	"Delete only expired tickets" },
     { "quiet", 'q', arg_flag, &quiet_flag, "Quiet" },
     { "version",        0, arg_flag, &version_flag },
     { "help",           0, arg_flag, &help_flag }
@@ -126,6 +129,11 @@ static void do_kdeltkt (int count, char *names[],
 
 	in_creds.session.keytype = etype;
 
+	if (exp_only) {
+	    krb5_timeofday(context, &in_creds.times.endtime);
+	    retflags |= KRB5_TC_MATCH_TIMES;
+	}
+
         ret = krb5_cc_retrieve_cred(context, ccache, retflags,
                                     &in_creds, &out_creds);
 	if (ret) {
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdestroy.1 b/crypto/external/bsd/heimdal/dist/kuser/kdestroy.1
index 9f6f0fb42..f328983b0 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdestroy.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdestroy.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kdestroy.1,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kdestroy.1,v 1.5 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 1997, 1999, 2001, 2004, 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdestroy.c b/crypto/external/bsd/heimdal/dist/kuser/kdestroy.c
index 6ffb39549..ea2d00e1c 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdestroy.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdestroy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdestroy.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kdestroy.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdigest.8 b/crypto/external/bsd/heimdal/dist/kuser/kdigest.8
index b8dddf757..c975f1c58 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdigest.8
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdigest.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kdigest.8,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $
+.\"	$NetBSD: kdigest.8,v 1.2 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2008 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -247,6 +247,7 @@ ntlm version
 .Xc
 Kerberos realm to communicate with
 .El
+.El
 .\".Sh ENVIRONMENT
 .\".Sh FILES
 .\".Sh EXAMPLES
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kdigest.c b/crypto/external/bsd/heimdal/dist/kuser/kdigest.c
index 552eecf8e..c96e2b038 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kdigest.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kdigest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdigest.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kdigest.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -460,9 +460,9 @@ ntlm_server_init(struct ntlm_server_init_options *opt,
      *
      */
 
-    ret = krb5_ntlm_init_get_challange(context, ntlm, &challenge);
+    ret = krb5_ntlm_init_get_challenge(context, ntlm, &challenge);
     if (ret)
-	krb5_err(context, 1, ret, "krb5_ntlm_init_get_challange");
+	krb5_err(context, 1, ret, "krb5_ntlm_init_get_challenge");
 
     if (challenge.length != sizeof(type2.challenge))
 	krb5_errx(context, 1, "ntlm challenge have wrong length");
@@ -487,7 +487,7 @@ ntlm_server_init(struct ntlm_server_init_options *opt,
      *
      */
 
-    base64_encode(data.data, data.length, &s);
+    rk_base64_encode(data.data, data.length, &s);
     free(data.data);
     printf("type2=%s\n", s);
     free(s);
@@ -500,7 +500,7 @@ ntlm_server_init(struct ntlm_server_init_options *opt,
     if (ret)
 	krb5_err(context, 1, ret, "krb5_ntlm_init_get_opaque");
 
-    base64_encode(opaque.data, opaque.length, &s);
+    rk_base64_encode(opaque.data, opaque.length, &s);
     krb5_data_free(&opaque);
     printf("opaque=%s\n", s);
     free(s);
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kgetcred.1 b/crypto/external/bsd/heimdal/dist/kuser/kgetcred.1
index 330439738..e38960f46 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kgetcred.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/kgetcred.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kgetcred.1,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kgetcred.1,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 1999, 2001 - 2002 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -42,6 +42,7 @@
 .Sh SYNOPSIS
 .Nm
 .Op Fl Fl canonicalize
+.Op Fl Fl canonical
 .Oo Fl c cache \*(Ba Xo
 .Fl Fl cache= Ns Ar cache
 .Xc
@@ -50,30 +51,123 @@
 .Fl Fl enctype= Ns Ar enctype
 .Xc
 .Oc
+.Op Fl Fl debug
+.Oo Fl H \*(Ba Xo
+.Fl Fl hostbased
+.Xc
+.Oc
+.Op Fl Fl name-type= Ns Ar name-type
 .Op Fl Fl no-transit-check
+.Op Fl Fl no-store
+.Op Fl Fl cached-only
 .Op Fl Fl version
 .Op Fl Fl help
+.Ar principal
+.Nm
+.Op options
+.Fl Fl hostbased
+.Ar principal
+.Nm
+.Op options
+.Fl Fl hostbased
 .Ar service
+.Ar hostname
+.Ar [extra-components]
 .Sh DESCRIPTION
 .Nm
-obtains a ticket for a service.
+obtains a ticket for the given service principal.
 Usually tickets for services are obtained automatically when needed
 but sometimes for some odd reason you want to obtain a particular
 ticket or of a special type.
 .Pp
+If
+.Fl Fl hostbased
+is given then the given service principal name will be canonicalized
+(see below).
+.Pp
+The third form constructs a host-based principal from the given service
+name and hostname.  The service name "host" is used if the given
+.Ar service
+name in the third usage is the empty string.
+.Pp
+For host-based names, the local host's hostname is used if the given
+.Ar hostname
+is the empty string or if the
+.Ar principal
+has a single component.
+.Pp
+Any additional components will be included, even for host-based service
+principal names, but there are no defaults nor local canonicalization
+rules for additional components.
+.Pp
+Local name canonicalization rules are applied unless the
+.Fl Fl canonical
+option is given.  Currently local name canonicalization rules are
+supported only for host-based principal names' hostname component.
+.Pp
+The principal's realm name may be canonicalized by following Kerberos
+referrals from the client principal's home realm if the
+.Fl Fl canonicalize
+option is given or if the local name canonicalization rules are
+configured to use referrals.
+.Pp
 Supported options:
 .Bl -tag -width Ds
 .It Fl Fl canonicalize
-requests that the KDC canonicalize the principal.
+requests that the KDC canonicalize the principal.  Currently this only
+canonicalizes the realm by chasing referrals from the user's start
+realm, but in the future this may also enable the KDC to canonicalize
+the complete principal name.
+.It Fl Fl canonical
+turns off local canonicalization of the principal name.
+.It Fl Fl name-type= Ns Ar name-type
+the name-type to use when parsing the principal name.
+.It Fl Fl hostbased
+is short for
+.Fl Fl name-type=srv_hst .
 .It Fl c Ar cache , Fl Fl cache= Ns Ar cache
 the credential cache to use.
+.It Fl Fl delegation-credential-cache= Ns Ar cache
+the credential cache to use for delegation.
 .It Fl e Ar enctype , Fl Fl enctype= Ns Ar enctype
 encryption type to use.
 .It Fl Fl no-transit-check
 requests that the KDC doesn't do transit checking.
+.It Fl Fl no-store
+do not store tickets in the ccache.
+.It Fl Fl cached-only
+do not talk the TGS, search only the ccache.
+.It Fl Fl forwardable
+.It Fl Fl debug
+enables debug output to stderr.
 .It Fl Fl version
 .It Fl Fl help
 .El
+.Pp
+If the
+.Fl Fl canonical
+option is used, then no further canonicalization should be done locally
+by the client (for example, DNS), but if
+.Fl Fl canonicalize
+is used, then the client will ask that the KDC canonicalize the name.
+.Pp
+If the
+.Fl Fl canonicalize
+option is used with
+.Fl Fl hostbased
+a host-based name-type, and
+.Fl Fl canonical
+is not used, then the hostname will be canonicalized according to the
+name canonicalization rules in
+.Va krb5.conf .
+.Pp
+GSS-API initiator applications with host-based services will get the
+same behavior as using the
+.Fl Fl canonicalize
+.Fl Fl hostbased
+options here.
 .Sh SEE ALSO
 .Xr kinit 1 ,
-.Xr klist 1
+.Xr klist 1 ,
+.Xr krb5.conf 5 ,
+.Xr krb5_openlog 3
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kgetcred.c b/crypto/external/bsd/heimdal/dist/kuser/kgetcred.c
index e515f9aaf..9e268566e 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kgetcred.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kgetcred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kgetcred.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kgetcred.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -42,8 +42,13 @@ static char *etype_str;
 static int transit_flag = 1;
 static int forwardable_flag;
 static int canonicalize_flag;
+static int is_hostbased_flag;
+static int is_canonical_flag;
 static char *impersonate_str;
 static char *nametype_str;
+static int store_flag = 1;
+static int cached_only_flag;
+static int debug_flag;
 static int version_flag;
 static int help_flag;
 
@@ -55,26 +60,36 @@ struct getargs args[] = {
     { "delegation-credential-cache",0,arg_string, &delegation_cred_str,
       NP_("where to find the ticket use for delegation", ""), "cache"},
     { "canonicalize",	0, arg_flag, &canonicalize_flag,
-      NP_("canonicalize the principal", ""), NULL },
-    { "forwardable",	0, arg_flag, &forwardable_flag,
+      NP_("canonicalize the principal (chase referrals)", ""), NULL },
+    { "canonical",	0,   arg_flag, &is_canonical_flag,
+      NP_("the name components are canonical", ""), NULL },
+    { "forwardable",	0,   arg_flag, &forwardable_flag,
       NP_("forwardable ticket requested", ""), NULL},
     { "transit-check",	0,   arg_negative_flag, &transit_flag, NULL, NULL },
     { "enctype",	'e', arg_string, &etype_str,
       NP_("encryption type to use", ""), "enctype"},
     { "impersonate",	0,   arg_string, &impersonate_str,
       NP_("client to impersonate", ""), "principal"},
-    { "name-type",		0,   arg_string, &nametype_str, NULL, NULL },
+    { "name-type",	0,   arg_string, &nametype_str,
+      NP_("Kerberos name type", ""), NULL },
+    { "hostbased",	'H', arg_flag, &is_hostbased_flag,
+      NP_("indicate that the name is a host-based service name", ""), NULL },
+    { "store", 	        0,   arg_negative_flag, &store_flag,
+      NP_("don't store the tickets obtained in the cache", ""), NULL },
+    { "cached-only", 	        0,   arg_flag, &cached_only_flag,
+      NP_("don't talk to the KDC, just search the cache", ""), NULL },
+    { "debug", 	        0,   arg_flag, &debug_flag, NULL, NULL },
     { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
     { "help",		0,   arg_flag, &help_flag, NULL, NULL }
 };
 
 static void
-usage (int ret)
+usage(int ret)
 {
-    arg_printusage (args,
-		    sizeof(args)/sizeof(*args),
-		    NULL,
-		    "service");
+    arg_printusage(args,
+		   sizeof(args)/sizeof(*args),
+		   NULL,
+		   "service");
     exit (ret);
 }
 
@@ -86,23 +101,24 @@ main(int argc, char **argv)
     krb5_ccache cache;
     krb5_creds *out;
     int optidx = 0;
+    int32_t nametype = KRB5_NT_UNKNOWN;
     krb5_get_creds_opt opt;
-    krb5_principal server;
-    krb5_principal impersonate = NULL;
+    krb5_principal server = NULL;
+    krb5_principal impersonate;
 
-    setprogname (argv[0]);
+    setprogname(argv[0]);
 
-    ret = krb5_init_context (&context);
+    ret = krb5_init_context(&context);
     if (ret)
 	errx(1, "krb5_init_context failed: %d", ret);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
+    if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
 	usage (0);
 
-    if(version_flag) {
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
@@ -110,39 +126,43 @@ main(int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
-    if (argc != 1)
-	usage (1);
+    if (debug_flag) {
+        ret = krb5_set_debug_dest(context, getprogname(), "STDERR");
+        if (ret)
+            krb5_warn(context, ret, "krb5_set_debug_dest");
+    }
 
-    if(cache_str) {
+    if (cache_str) {
 	ret = krb5_cc_resolve(context, cache_str, &cache);
 	if (ret)
-	    krb5_err (context, 1, ret, "%s", cache_str);
+	    krb5_err(context, 1, ret, "%s", cache_str);
     } else {
 	ret = krb5_cc_default (context, &cache);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_cc_resolve");
+	    krb5_err(context, 1, ret, "krb5_cc_resolve");
     }
 
     ret = krb5_get_creds_opt_alloc(context, &opt);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_get_creds_opt_alloc");
+	krb5_err(context, 1, ret, "krb5_get_creds_opt_alloc");
 
     if (etype_str) {
 	krb5_enctype enctype;
 
 	ret = krb5_string_to_enctype(context, etype_str, &enctype);
 	if (ret)
-	    krb5_errx (context, 1, N_("unrecognized enctype: %s", ""),
-		       etype_str);
+	    krb5_errx(context, 1, N_("unrecognized enctype: %s", ""),
+		      etype_str);
 	krb5_get_creds_opt_set_enctype(context, opt, enctype);
     }
 
     if (impersonate_str) {
 	ret = krb5_parse_name(context, impersonate_str, &impersonate);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_parse_name %s", impersonate_str);
+	    krb5_err(context, 1, ret, "krb5_parse_name %s", impersonate_str);
 	krb5_get_creds_opt_set_impersonate(context, opt, impersonate);
 	krb5_get_creds_opt_add_options(context, opt, KRB5_GC_NO_STORE);
+        krb5_free_principal(context, impersonate);
     }
 
     if (out_cache_str)
@@ -154,6 +174,10 @@ main(int argc, char **argv)
 	krb5_get_creds_opt_add_options(context, opt, KRB5_GC_NO_TRANSIT_CHECK);
     if (canonicalize_flag)
 	krb5_get_creds_opt_add_options(context, opt, KRB5_GC_CANONICALIZE);
+    if (!store_flag)
+	krb5_get_creds_opt_add_options(context, opt, KRB5_GC_NO_STORE);
+    if (cached_only_flag)
+	krb5_get_creds_opt_add_options(context, opt, KRB5_GC_CACHED);
 
     if (delegation_cred_str) {
 	krb5_ccache id;
@@ -163,68 +187,172 @@ main(int argc, char **argv)
 	krb5_cc_clear_mcred(&mc);
 	ret = krb5_cc_get_principal(context, cache, &mc.server);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_cc_get_principal");
+	    krb5_err(context, 1, ret, "krb5_cc_get_principal");
 
 	ret = krb5_cc_resolve(context, delegation_cred_str, &id);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_cc_resolve");
+	    krb5_err(context, 1, ret, "krb5_cc_resolve");
 
 	ret = krb5_cc_retrieve_cred(context, id, 0, &mc, &c);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_cc_retrieve_cred");
+	    krb5_err(context, 1, ret, "krb5_cc_retrieve_cred");
 
 	ret = decode_Ticket(c.ticket.data, c.ticket.length, &ticket, NULL);
 	if (ret) {
 	    krb5_clear_error_message(context);
-	    krb5_err (context, 1, ret, "decode_Ticket");
+	    krb5_err(context, 1, ret, "decode_Ticket");
 	}
 	krb5_free_cred_contents(context, &c);
 
 	ret = krb5_get_creds_opt_set_ticket(context, opt, &ticket);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_get_creds_opt_set_ticket");
+	    krb5_err(context, 1, ret, "krb5_get_creds_opt_set_ticket");
 	free_Ticket(&ticket);
 
-	krb5_cc_close (context, id);
+	krb5_cc_close(context, id);
 	krb5_free_principal(context, mc.server);
 
 	krb5_get_creds_opt_add_options(context, opt,
 				       KRB5_GC_CONSTRAINED_DELEGATION);
     }
 
-    ret = krb5_parse_name(context, argv[0], &server);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_parse_name %s", argv[0]);
-
-    if (nametype_str) {
-	int32_t nametype;
-
-	ret = krb5_parse_nametype(context, nametype_str, &nametype);
-	if (ret)
-	    krb5_err(context, 1, ret, "krb5_parse_nametype");
-
-	server->name.name_type = (NAME_TYPE)nametype;
+    if (nametype_str != NULL) {
+        ret = krb5_parse_nametype(context, nametype_str, &nametype);
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_parse_nametype");
     }
 
+    if (nametype == KRB5_NT_SRV_HST ||
+        nametype == KRB5_NT_SRV_HST_NEEDS_CANON)
+        is_hostbased_flag = 1;
+
+    if (is_hostbased_flag) {
+	const char *sname = NULL;
+	const char *hname = NULL;
+
+        if (nametype_str != NULL &&
+            nametype != KRB5_NT_SRV_HST &&
+            nametype != KRB5_NT_SRV_HST_NEEDS_CANON)
+            krb5_errx(context, 1, "--hostbased not compatible with "
+                      "non-hostbased --name-type");
+
+        if (is_canonical_flag)
+            nametype = KRB5_NT_SRV_HST;
+        else
+            nametype = KRB5_NT_SRV_HST_NEEDS_CANON;
+
+        /*
+         * Host-based service names can have more than one component.
+         *
+         * RFC5179 did not, but should have, assign a Kerberos name-type
+         * corresponding to GSS_C_NT_DOMAINBASED.  But it's basically a
+         * host-based service name type with one additional component.
+         *
+         * So that's how we're treating host-based service names here:
+         * two or more components.
+         */
+
+        if (argc == 0) {
+            usage(1);
+        } else if (argc == 1) {
+            krb5_principal server2;
+
+            /*
+             * In this case the one argument is a principal name, not the
+             * service name.
+             *
+             * We parse the argument as a principal name, extract the service
+             * and hostname components, use krb5_sname_to_principal(), then
+             * extract the service and hostname components from that.
+             */
+
+            ret = krb5_parse_name(context, argv[0], &server);
+            if (ret)
+                krb5_err(context, 1, ret, "krb5_parse_name %s", argv[0]);
+            sname = krb5_principal_get_comp_string(context, server, 0);
+
+            /*
+             * If a single-component principal name is given, then we'll
+             * default the hostname, as krb5_principal_get_comp_string()
+             * returns NULL in this case.
+             */
+            hname = krb5_principal_get_comp_string(context, server, 1);
+
+	    ret = krb5_sname_to_principal(context, hname, sname,
+					   KRB5_NT_SRV_HST, &server2);
+            sname = krb5_principal_get_comp_string(context, server2, 0);
+            hname = krb5_principal_get_comp_string(context, server2, 1);
+
+            /*
+             * Modify the original with the new sname/hname.  This way we
+             * retain any additional principal name components from the given
+             * principal name.
+             *
+             * The name-type is set further below.
+             */
+            ret = krb5_principal_set_comp_string(context, server, 0, sname);
+            if (ret)
+                krb5_err(context, 1, ret, "krb5_principal_set_comp_string %s", argv[0]);
+            ret = krb5_principal_set_comp_string(context, server, 1, hname);
+            if (ret)
+                krb5_err(context, 1, ret, "krb5_principal_set_comp_string %s", argv[0]);
+            krb5_free_principal(context, server2);
+        } else {
+            size_t i;
+
+            /*
+             * In this case the arguments are principal name components.
+             *
+             * The service and hostname components can be defaulted by passing
+             * empty strings.
+             */
+	    sname = argv[0];
+            if (*sname == '\0')
+                sname = NULL;
+	    hname = argv[1];
+            if (hname == NULL || *hname == '\0')
+                hname = NULL;
+	    ret = krb5_sname_to_principal(context, hname, sname,
+                                          KRB5_NT_SRV_HST, &server);
+	    if (ret)
+		krb5_err(context, 1, ret, "krb5_sname_to_principal");
+
+            for (i = 2; i < argc; i++) {
+                ret = krb5_principal_set_comp_string(context, server, i, argv[i]);
+                if (ret)
+                    krb5_err(context, 1, ret, "krb5_principal_set_comp_string");
+            }
+	}
+    } else if (argc == 1) {
+	ret = krb5_parse_name(context, argv[0], &server);
+	if (ret)
+	    krb5_err(context, 1, ret, "krb5_parse_name %s", argv[0]);
+    } else {
+	usage(1);
+    }
+
+    if (nametype != KRB5_NT_UNKNOWN)
+        server->name.name_type = (NAME_TYPE)nametype;
+
     ret = krb5_get_creds(context, opt, cache, server, &out);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_get_creds");
+	krb5_err(context, 1, ret, "krb5_get_creds");
 
     if (out_cache_str) {
 	krb5_ccache id;
 
 	ret = krb5_cc_resolve(context, out_cache_str, &id);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_cc_resolve");
+	    krb5_err(context, 1, ret, "krb5_cc_resolve");
 
 	ret = krb5_cc_initialize(context, id, out->client);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_cc_initialize");
+	    krb5_err(context, 1, ret, "krb5_cc_initialize");
 
 	ret = krb5_cc_store_cred(context, id, out);
 	if(ret)
-	    krb5_err (context, 1, ret, "krb5_cc_store_cred");
-	krb5_cc_close (context, id);
+	    krb5_err(context, 1, ret, "krb5_cc_store_cred");
+	krb5_cc_close(context, id);
     }
 
     krb5_free_creds(context, out);
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.8 b/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.8
index 7f2d2c65d..8c97a4f88 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.8
+++ b/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kimpersonate.8,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kimpersonate.8,v 1.5 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2002 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -38,13 +38,16 @@
 .Os
 .Sh NAME
 .Nm kimpersonate
-.Nd impersonate a user when there exist a srvtab, keyfile or KeyFile
+.Nd impersonate a user when there exist a keyfile or KeyFile
 .Sh SYNOPSIS
 .Nm
+.Op Fl s Ar string \*(Ba Fl Fl ccache= Ns Ar string
 .Op Fl s Ar string \*(Ba Fl Fl server= Ns Ar string
 .Op Fl c Ar string \*(Ba Fl Fl client= Ns Ar string
 .Op Fl k Ar string \*(Ba Fl Fl keytab= Ns Ar string
 .Op Fl 5 | Fl Fl krb5
+.Op Fl A | Fl Fl add
+.Op Fl R | Fl Fl referral
 .Op Fl e Ar integer \*(Ba Fl Fl expire-time= Ns Ar integer
 .Op Fl a Ar string \*(Ba Fl Fl client-address= Ns Ar string
 .Op Fl t Ar string \*(Ba Fl Fl enc-type= Ns Ar string
@@ -56,11 +59,13 @@
 .Sh DESCRIPTION
 The
 .Nm
-program creates a "fake" ticket using the service-key of the service.
-The service key can be read from a Kerberos 5 keytab, AFS KeyFile or
-(if compiled with support for Kerberos 4) a Kerberos 4 srvtab.
+program creates a "fake" ticket using the service-key of the service and
+stores it in the given (or default) ccache.  This is useful for testing.
+The service key can be read from a Kerberos 5 keytab or AFS KeyFile.
 Supported options:
 .Bl -tag -width Ds
+.It Fl Fl ccache= Ns Ar string
+ccache into which to store the ticket
 .It Fl s Ar string Ns , Fl Fl server= Ns Ar string
 name of server principal
 .It Fl c Ar string Ns , Fl Fl client= Ns Ar string
@@ -69,6 +74,12 @@ name of client principal
 name of keytab file
 .It Fl 5 Ns , Fl Fl krb5
 create a Kerberos 5 ticket
+.It Fl A Ns , Fl Fl add
+don't re-initialize the ccache, instead add the ticket to an existing
+ccache.
+.It Fl R Ns , Fl Fl referral
+simulate a referrals-based KDC client by storing two entries, one with
+the empty realm for the service principal name.
 .It Fl e Ar integer Ns , Fl Fl expire-time= Ns Ar integer
 lifetime of ticket in seconds
 .It Fl a Ar string Ns , Fl Fl client-address= Ns Ar string
@@ -88,7 +99,6 @@ Print version
 .Sh FILES
 Uses
 .Pa /etc/krb5.keytab,
-.Pa /etc/srvtab
 and
 .Pa /usr/afs/etc/KeyFile
 when available and the
@@ -105,6 +115,16 @@ or for debugging.
 will create a Kerberos 5 ticket for lha@E.KTH.SE for the host
 hummel.e.kth.se if there exists a keytab entry for it in
 .Pa /etc/krb5.keytab .
+.Pp
+In combination with the
+.Nm ktutil
+command, this is useful for testing.  For example, 
+.Pp
+.Nm ktutil
+-k tkt add -p host/foo.test@TEST -V2 -e aes256-cts-hmac-sha1-96 -r
+.Pp
+.Nm
+--cache=tcc -s host/foo.test@TEST -c jdoe@TEST -k tkt --referral
 .Sh SEE ALSO
 .Xr kinit 1 ,
 .Xr klist 1
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.c b/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.c
index 8711c42b0..60b5fc417 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kimpersonate.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kimpersonate.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kimpersonate.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan
@@ -53,16 +53,18 @@ static struct getarg_strings client_addresses;
 static int   version_flag = 0;
 static int   help_flag = 0;
 static int   use_krb5 = 1;
+static int   add_to_ccache = 0;
+static int   use_referral_realm = 0;
 
 static const char *enc_type = "aes256-cts-hmac-sha1-96";
 static const char *session_enc_type = NULL;
 
 static void
-encode_ticket (krb5_context context,
-	       EncryptionKey *skey,
-	       krb5_enctype etype,
-	       int skvno,
-	       krb5_creds *cred)
+encode_ticket(krb5_context context,
+	      EncryptionKey *skey,
+	      krb5_enctype etype,
+	      int skvno,
+	      krb5_creds *cred)
 {
     size_t len, size;
     char *buf;
@@ -72,8 +74,8 @@ encode_ticket (krb5_context context,
     EncTicketPart et;
     Ticket ticket;
 
-    memset (&enc_part, 0, sizeof(enc_part));
-    memset (&ticket, 0, sizeof(ticket));
+    memset(&enc_part, 0, sizeof(enc_part));
+    memset(&ticket, 0, sizeof(ticket));
 
     /*
      * Set up `enc_part'
@@ -108,7 +110,7 @@ encode_ticket (krb5_context context,
     ret = krb5_crypto_init(context, skey, etype, &crypto);
     if (ret)
 	krb5_err(context, 1, ret, "krb5_crypto_init");
-    ret = krb5_encrypt_EncryptedData (context,
+    ret = krb5_encrypt_EncryptedData(context,
 				      crypto,
 				      KRB5_KU_TICKET,
 				      buf,
@@ -131,7 +133,7 @@ encode_ticket (krb5_context context,
 
     ASN1_MALLOC_ENCODE(Ticket, buf, len, &ticket, &size, ret);
     if(ret)
-	krb5_err (context, 1, ret, "encode_Ticket");
+	krb5_err(context, 1, ret, "encode_Ticket");
 
     krb5_data_copy(&cred->ticket, buf, len);
     free(buf);
@@ -142,7 +144,7 @@ encode_ticket (krb5_context context,
  */
 
 static int
-create_krb5_tickets (krb5_context context, krb5_keytab kt)
+create_krb5_tickets(krb5_context context, krb5_keytab kt)
 {
     krb5_error_code ret;
     krb5_keytab_entry entry;
@@ -151,30 +153,29 @@ create_krb5_tickets (krb5_context context, krb5_keytab kt)
     krb5_enctype session_etype;
     krb5_ccache ccache;
 
-    memset (&cred, 0, sizeof(cred));
+    memset(&cred, 0, sizeof(cred));
 
-    ret = krb5_string_to_enctype (context, enc_type, &etype);
+    ret = krb5_string_to_enctype(context, enc_type, &etype);
     if (ret)
 	krb5_err (context, 1, ret, "krb5_string_to_enctype (enc-type)");
-    ret = krb5_string_to_enctype (context, session_enc_type, &session_etype);
+    ret = krb5_string_to_enctype(context, session_enc_type, &session_etype);
     if (ret)
 	krb5_err (context, 1, ret, "krb5_string_to_enctype (session-enc-type)");
-    ret = krb5_kt_get_entry (context, kt, server_principal,
-			     0, etype, &entry);
+    ret = krb5_kt_get_entry(context, kt, server_principal, 0, etype, &entry);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_kt_get_entry");
+	krb5_err(context, 1, ret, "krb5_kt_get_entry (perhaps use different --enc-type)");
 
     /*
      * setup cred
      */
 
 
-    ret = krb5_copy_principal (context, client_principal, &cred.client);
+    ret = krb5_copy_principal(context, client_principal, &cred.client);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_copy_principal");
-    ret = krb5_copy_principal (context, server_principal, &cred.server);
+	krb5_err(context, 1, ret, "krb5_copy_principal");
+    ret = krb5_copy_principal(context, server_principal, &cred.server);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_copy_principal");
+	krb5_err(context, 1, ret, "krb5_copy_principal");
     krb5_generate_random_keyblock(context, session_etype, &cred.session);
 
     cred.times.authtime = time(NULL);
@@ -183,9 +184,9 @@ create_krb5_tickets (krb5_context context, krb5_keytab kt)
     cred.times.renew_till = 0;
     krb5_data_zero(&cred.second_ticket);
 
-    ret = krb5_get_all_client_addrs (context, &cred.addresses);
+    ret = krb5_get_all_client_addrs(context, &cred.addresses);
     if (ret)
-	krb5_err (context, 1, ret, "krb5_get_all_client_addrs");
+	krb5_err(context, 1, ret, "krb5_get_all_client_addrs");
     cred.flags.b = ticket_flags;
 
 
@@ -193,7 +194,8 @@ create_krb5_tickets (krb5_context context, krb5_keytab kt)
      * Encode encrypted part of ticket
      */
 
-    encode_ticket (context, &entry.keyblock, etype, entry.vno, &cred);
+    encode_ticket(context, &entry.keyblock, etype, entry.vno, &cred);
+    krb5_kt_free_entry(context, &entry);
 
     /*
      * Write to cc
@@ -202,23 +204,59 @@ create_krb5_tickets (krb5_context context, krb5_keytab kt)
     if (ccache_str) {
 	ret = krb5_cc_resolve(context, ccache_str, &ccache);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_cc_resolve");
+	    krb5_err(context, 1, ret, "krb5_cc_resolve");
     } else {
-	ret = krb5_cc_default (context, &ccache);
+	ret = krb5_cc_default(context, &ccache);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_cc_default");
+	    krb5_err(context, 1, ret, "krb5_cc_default");
     }
 
-    ret = krb5_cc_initialize (context, ccache, cred.client);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_initialize");
+    if (add_to_ccache) {
+        krb5_principal def_princ;
 
-    ret = krb5_cc_store_cred (context, ccache, &cred);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_store_cred");
+        /*
+         * Force fcache to read the ccache header, otherwise the store
+         * will fail.
+         */
+        ret = krb5_cc_get_principal(context, ccache, &def_princ);
+        if (ret) {
+            krb5_warn(context, ret,
+                      "Given ccache appears not to exist; initializing it");
+            ret = krb5_cc_initialize(context, ccache, cred.client);
+            if (ret)
+                krb5_err(context, 1, ret, "krb5_cc_initialize");
+        }
+        krb5_free_principal(context, def_princ);
+    } else {
+        ret = krb5_cc_initialize(context, ccache, cred.client);
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_cc_initialize");
+    }
 
-    krb5_free_cred_contents (context, &cred);
-    krb5_cc_close (context, ccache);
+    if (use_referral_realm &&
+        strcmp(krb5_principal_get_realm(context, cred.server), "") != 0) {
+        krb5_free_principal(context, cred.server);
+        ret = krb5_copy_principal(context, server_principal, &cred.server);
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_copy_principal");
+        ret = krb5_principal_set_realm(context, cred.server, "");
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_principal_set_realm");
+        ret = krb5_cc_store_cred(context, ccache, &cred);
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_cc_store_cred");
+
+        krb5_free_principal(context, cred.server);
+        ret = krb5_copy_principal(context, server_principal, &cred.server);
+        if (ret)
+            krb5_err(context, 1, ret, "krb5_copy_principal");
+    }
+    ret = krb5_cc_store_cred(context, ccache, &cred);
+    if (ret)
+	krb5_err(context, 1, ret, "krb5_cc_store_cred");
+
+    krb5_free_cred_contents(context, &cred);
+    krb5_cc_close(context, ccache);
 
     return 0;
 }
@@ -228,28 +266,28 @@ create_krb5_tickets (krb5_context context, krb5_keytab kt)
  */
 
 static void
-setup_env (krb5_context context, krb5_keytab *kt)
+setup_env(krb5_context context, krb5_keytab *kt)
 {
     krb5_error_code ret;
 
     if (keytab_file)
-	ret = krb5_kt_resolve (context, keytab_file, kt);
+	ret = krb5_kt_resolve(context, keytab_file, kt);
     else
-	ret = krb5_kt_default (context, kt);
+	ret = krb5_kt_default(context, kt);
     if (ret)
-	krb5_err (context, 1, ret, "resolving keytab");
+	krb5_err(context, 1, ret, "resolving keytab");
 
     if (client_principal_str == NULL)
-	krb5_errx (context, 1, "missing client principal");
-    ret = krb5_parse_name (context, client_principal_str, &client_principal);
+	krb5_errx(context, 1, "missing client principal");
+    ret = krb5_parse_name(context, client_principal_str, &client_principal);
     if (ret)
-	krb5_err (context, 1, ret, "resolvning client name");
+	krb5_err(context, 1, ret, "resolvning client name");
 
     if (server_principal_str == NULL)
-	krb5_errx (context, 1, "missing server principal");
-    ret = krb5_parse_name (context, server_principal_str, &server_principal);
+	krb5_errx(context, 1, "missing server principal");
+    ret = krb5_parse_name(context, server_principal_str, &server_principal);
     if (ret)
-	krb5_err (context, 1, ret, "resolvning server name");
+	krb5_err(context, 1, ret, "resolvning server name");
 
     /* If no session-enc-type specified on command line and this is an afs */
     /* service ticket, change default of session_enc_type to DES.       */
@@ -263,12 +301,12 @@ setup_env (krb5_context context, krb5_keytab *kt)
 	ticket_flags_int = parse_flags(ticket_flags_str,
 				       asn1_TicketFlags_units(), 0);
 	if (ticket_flags_int <= 0) {
-	    krb5_warnx (context, "bad ticket flags: `%s'", ticket_flags_str);
-	    print_flags_table (asn1_TicketFlags_units(), stderr);
-	    exit (1);
+	    krb5_warnx(context, "bad ticket flags: `%s'", ticket_flags_str);
+	    print_flags_table(asn1_TicketFlags_units(), stderr);
+	    exit(1);
 	}
 	if (ticket_flags_int)
-	    ticket_flags = int2TicketFlags (ticket_flags_int);
+	    ticket_flags = int2TicketFlags(ticket_flags_int);
     }
 }
 
@@ -287,6 +325,10 @@ struct getargs args[] = {
       "name of keytab file", NULL },
     { "krb5", '5', arg_flag,	 &use_krb5,
       "create a kerberos 5 ticket", NULL },
+    { "add", 'A', arg_flag,	 &add_to_ccache,
+      "add to ccache without re-initializing it", NULL },
+    { "referral", 'R', arg_flag,	 &use_referral_realm,
+      "store an additional entry for the service with the empty realm", NULL },
     { "expire-time", 'e', arg_integer, &expiration_time,
       "lifetime of ticket in seconds", NULL },
     { "client-addresses", 'a', arg_strings, &client_addresses,
@@ -304,26 +346,26 @@ struct getargs args[] = {
 };
 
 static void
-usage (int ret)
+usage(int ret)
 {
-    arg_printusage (args,
-		    sizeof(args) / sizeof(args[0]),
-		    NULL,
-		    "");
-    exit (ret);
+    arg_printusage(args,
+		   sizeof(args) / sizeof(args[0]),
+		   NULL,
+		   "");
+    exit(ret);
 }
 
 int
-main (int argc, char **argv)
+main(int argc, char **argv)
 {
     int optidx = 0;
     krb5_error_code ret;
     krb5_context context;
     krb5_keytab kt;
 
-    setprogname (argv[0]);
+    setprogname(argv[0]);
 
-    ret = krb5_init_context (&context);
+    ret = krb5_init_context(&context);
     if (ret)
 	errx(1, "krb5_init_context failed: %u", ret);
 
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kinit.1 b/crypto/external/bsd/heimdal/dist/kuser/kinit.1
index ff3af8feb..b86775362 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kinit.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/kinit.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kinit.1,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: kinit.1,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -46,7 +46,8 @@
 .Fl Fl cache= Ns Ar cachename
 .Xc
 .Oc
-.Op Fl f | Fl Fl no-forwardable
+.Op Fl f | Fl Fl forwardable
+.Op Fl F | Fl Fl no-forwardable
 .Oo Fl t Ar keytabname \*(Ba Xo
 .Fl Fl keytab= Ns Ar keytabname
 .Xc
@@ -101,9 +102,10 @@ Supported options:
 .It Fl c Ar cachename Fl Fl cache= Ns Ar cachename
 The credentials cache to put the acquired ticket in, if other than
 default.
-.It Fl f Fl Fl no-forwardable
-Get ticket that can be forwarded to another host, or if the negative
-flags use, don't get a forwardable flag.
+.It Fl f Fl Fl forwardable
+Obtain a ticket than can be forwarded to another host.
+.It Fl F Fl Fl no-forwardable
+Do not obtain a forwardable ticket.
 .It Fl t Ar keytabname , Fl Fl keytab= Ns Ar keytabname
 Don't ask for a password, but instead get the key from the specified
 keytab.
@@ -212,8 +214,6 @@ The file name of
 .Pa krb5.conf ,
 the default being
 .Pa /etc/krb5.conf .
-.It Ev KRBTKFILE
-Specifies the Kerberos 4 ticket file to store version 4 tickets in.
 .El
 .\".Sh FILES
 .\".Sh EXAMPLES
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kinit.c b/crypto/external/bsd/heimdal/dist/kuser/kinit.c
index 814e08d5d..b0e31df36 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kinit.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kinit.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kinit.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kinit.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -45,6 +45,10 @@
 #include <krb5/heimntlm.h>
 #endif
 
+#ifndef SIGINFO
+#define SIGINFO SIGUSR1
+#endif
+
 int forwardable_flag	= -1;
 int proxiable_flag	= -1;
 int renewable_flag	= -1;
@@ -65,6 +69,7 @@ static int switch_cache_flags = 1;
 struct getarg_strings etype_str;
 int use_keytab		= 0;
 char *keytab_str	= NULL;
+static krb5_keytab kt	= NULL;
 int do_afslog		= -1;
 int fcache_version;
 char *password_file	= NULL;
@@ -76,6 +81,7 @@ int pk_use_enckey	= 0;
 static int canonicalize_flag = 0;
 static int enterprise_flag = 0;
 static int ok_as_delegate_flag = 0;
+static char *fast_armor_cache_string = NULL;
 static int use_referrals_flag = 0;
 static int windows_flag = 0;
 #ifndef NO_NTLM
@@ -103,7 +109,7 @@ static struct getargs args[] = {
     { "cache", 		'c', arg_string, &cred_cache,
       NP_("credentials cache", ""), "cachename" },
 
-    { "forwardable",	0, arg_negative_flag, &forwardable_flag,
+    { "forwardable",	'F', arg_negative_flag, &forwardable_flag,
       NP_("get tickets not forwardable", ""), NULL },
 
     { NULL,		'f', arg_flag, &forwardable_flag,
@@ -189,6 +195,9 @@ static struct getargs args[] = {
     { "ok-as-delegate",	0,  arg_flag, &ok_as_delegate_flag,
       NP_("honor ok-as-delegate on tickets", ""), NULL },
 
+    { "fast-armor-cache",	0,  arg_string, &fast_armor_cache_string,
+      NP_("use this credential cache as FAST armor cache", ""), "cache" },
+
     { "use-referrals",	0,  arg_flag, &use_referrals_flag,
       NP_("only use referrals, no dns canalisation", ""), NULL },
 
@@ -200,15 +209,11 @@ static struct getargs args[] = {
 };
 
 static void
-usage (int ret)
+usage(int ret)
 {
-    arg_printusage_i18n (args,
-			 sizeof(args)/sizeof(*args),
-			 N_("Usage: ", ""),
-			 NULL,
-			 "[principal [command]]",
-			 getarg_i18n);
-    exit (ret);
+    arg_printusage_i18n(args, sizeof(args)/sizeof(*args), N_("Usage: ", ""),
+			NULL, "[principal [command]]", getarg_i18n);
+    exit(ret);
 }
 
 static krb5_error_code
@@ -218,7 +223,7 @@ get_server(krb5_context context,
 	   krb5_principal *princ)
 {
     krb5_const_realm realm;
-    if(server)
+    if (server)
 	return krb5_parse_name(context, server, princ);
 
     realm = krb5_principal_get_realm(context, client);
@@ -226,7 +231,54 @@ get_server(krb5_context context,
 			       KRB5_TGS_NAME, realm, NULL);
 }
 
-static int
+static krb5_error_code
+copy_configs(krb5_context context,
+	     krb5_ccache dst,
+	     krb5_ccache src,
+	     krb5_principal start_ticket_server)
+{
+    krb5_error_code ret;
+    const char *cfg_names[] = {"realm-config", "FriendlyName", NULL};
+    const char *cfg_names_w_pname[] = {"fast_avail", NULL};
+    krb5_data cfg_data;
+    size_t i;
+
+    for (i = 0; cfg_names[i]; i++) {
+	ret = krb5_cc_get_config(context, src, NULL, cfg_names[i], &cfg_data);
+	if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
+	    continue;
+	} else if (ret) {
+	    krb5_warn(context, ret, "krb5_cc_get_config");
+	    return ret;
+	}
+	ret = krb5_cc_set_config(context, dst, NULL, cfg_names[i], &cfg_data);
+	if (ret)
+	    krb5_warn(context, ret, "krb5_cc_set_config");
+    }
+    for (i = 0; start_ticket_server && cfg_names_w_pname[i]; i++) {
+	ret = krb5_cc_get_config(context, src, start_ticket_server,
+				 cfg_names_w_pname[i], &cfg_data);
+	if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
+	    continue;
+	} else if (ret) {
+	    krb5_warn(context, ret, "krb5_cc_get_config");
+	    return ret;
+	}
+	ret = krb5_cc_set_config(context, dst, start_ticket_server,
+				 cfg_names_w_pname[i], &cfg_data);
+	if (ret && ret != KRB5_CC_NOTFOUND)
+	    krb5_warn(context, ret, "krb5_cc_set_config");
+    }
+    /*
+     * We don't copy cc configs for any other principals though (mostly
+     * those are per-target time offsets and the like, so it's bad to
+     * lose them, but hardly the end of the world, and as they may not
+     * expire anyways, it's good to let them go).
+     */
+    return 0;
+}
+
+static krb5_error_code
 renew_validate(krb5_context context,
 	       int renew,
 	       int validate,
@@ -235,18 +287,19 @@ renew_validate(krb5_context context,
 	       krb5_deltat life)
 {
     krb5_error_code ret;
+    krb5_ccache tempccache = NULL;
     krb5_creds in, *out = NULL;
     krb5_kdc_flags flags;
 
     memset(&in, 0, sizeof(in));
 
     ret = krb5_cc_get_principal(context, cache, &in.client);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "krb5_cc_get_principal");
 	return ret;
     }
     ret = get_server(context, in.client, server, &in.server);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "get_server");
 	goto out;
     }
@@ -275,11 +328,11 @@ renew_validate(krb5_context context,
 
     if (anonymous_flag)
 	flags.b.request_anonymous = anonymous_flag;
-    if(life)
+    if (life)
 	in.times.endtime = time(NULL) + life;
 
     if (out) {
-	krb5_free_creds (context, out);
+	krb5_free_creds(context, out);
 	out = NULL;
     }
 
@@ -291,32 +344,50 @@ renew_validate(krb5_context context,
 			    NULL,
 			    &in,
 			    &out);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "krb5_get_kdc_cred");
 	goto out;
     }
-    ret = krb5_cc_initialize(context, cache, in.client);
-    if(ret) {
-	krb5_free_creds (context, out);
+
+    ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, cache),
+			     NULL, &tempccache);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_cc_new_unique");
+	goto out;
+    }
+
+    ret = krb5_cc_initialize(context, tempccache, in.client);
+    if (ret) {
 	krb5_warn(context, ret, "krb5_cc_initialize");
 	goto out;
     }
-    ret = krb5_cc_store_cred(context, cache, out);
 
-    if(ret == 0 && server == NULL) {
-	/* only do this if it's a general renew-my-tgt request */
-#ifndef NO_AFS
-	if(do_afslog && k_hasafs())
-	    krb5_afslog(context, cache, NULL, NULL);
-#endif
-    }
-
-    krb5_free_creds (context, out);
-    if(ret) {
+    ret = krb5_cc_store_cred(context, tempccache, out);
+    if (ret) {
 	krb5_warn(context, ret, "krb5_cc_store_cred");
 	goto out;
     }
+
+    /*
+     * We want to preserve cc configs as some are security-relevant, and
+     * anyways it's the friendly thing to do.
+     */
+    ret = copy_configs(context, tempccache, cache, out->server);
+    if (ret)
+	goto out;
+
+    ret = krb5_cc_move(context, tempccache, cache);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_cc_move");
+	goto out;
+    }
+    tempccache = NULL;
+
 out:
+    if (tempccache)
+	krb5_cc_close(context, tempccache);
+    if (out)
+	krb5_free_creds(context, out);
     krb5_free_cred_contents(context, &in);
     return ret;
 }
@@ -330,13 +401,23 @@ store_ntlmkey(krb5_context context, krb5_ccache id,
     krb5_error_code ret;
     krb5_data data;
     char *name;
+    int aret;
 
-    asprintf(&name, "ntlm-key-%s", domain);
-    if (name == NULL) {
-	krb5_clear_error_message(context);
-	return ENOMEM;
+    ret = krb5_cc_get_config(context, id, NULL, "default-ntlm-domain", &data);
+    if (ret == 0) {
+        krb5_data_free(&data);
+    } else {
+        data.length = strlen(domain);
+        data.data = rk_UNCONST(domain);
+        ret = krb5_cc_set_config(context, id, NULL, "default-ntlm-domain", &data);
+        if (ret != 0)
+            return ret;
     }
 
+    aret = asprintf(&name, "ntlm-key-%s", domain);
+    if (aret == -1 || name == NULL)
+	return krb5_enomem(context);
+
     data.length = buf->length;
     data.data = buf->data;
 
@@ -354,20 +435,25 @@ get_new_tickets(krb5_context context,
 		int interactive)
 {
     krb5_error_code ret;
-    krb5_get_init_creds_opt *opt;
     krb5_creds cred;
     char passwd[256];
     krb5_deltat start_time = 0;
     krb5_deltat renew = 0;
     const char *renewstr = NULL;
     krb5_enctype *enctype = NULL;
-    krb5_ccache tempccache;
+    krb5_ccache tempccache = NULL;
+    krb5_init_creds_context ctx = NULL;
+    krb5_get_init_creds_opt *opt = NULL;
+    krb5_prompter_fct prompter = krb5_prompter_posix;
 #ifndef NO_NTLM
     struct ntlm_buf ntlmkey;
     memset(&ntlmkey, 0, sizeof(ntlmkey));
 #endif
     passwd[0] = '\0';
 
+    if (!interactive)
+	prompter = NULL;
+
     if (password_file) {
 	FILE *f;
 
@@ -375,14 +461,18 @@ get_new_tickets(krb5_context context,
 	    f = stdin;
 	else
 	    f = fopen(password_file, "r");
-	if (f == NULL)
-	    krb5_errx(context, 1, "Failed to open the password file %s",
-		      password_file);
+	if (f == NULL) {
+	    krb5_warnx(context, "Failed to open the password file %s",
+		       password_file);
+	    return errno;
+	}
 
-	if (fgets(passwd, sizeof(passwd), f) == NULL)
-	    krb5_errx(context, 1,
-		      N_("Failed to read password from file %s", ""),
-		      password_file);
+	if (fgets(passwd, sizeof(passwd), f) == NULL) {
+	    krb5_warnx(context, N_("Failed to read password from file %s", ""),
+		       password_file);
+	    fclose(f);
+	    return EINVAL; /* XXX Need a better error */
+	}
 	if (f != stdin)
 	    fclose(f);
 	passwd[strcspn(passwd, "\n")] = '\0';
@@ -418,19 +508,21 @@ get_new_tickets(krb5_context context,
 
     memset(&cred, 0, sizeof(cred));
 
-    ret = krb5_get_init_creds_opt_alloc (context, &opt);
-    if (ret)
-	krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
+    ret = krb5_get_init_creds_opt_alloc(context, &opt);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_get_init_creds_opt_alloc");
+	goto out;
+    }
 
     krb5_get_init_creds_opt_set_default_flags(context, "kinit",
 	krb5_principal_get_realm(context, principal), opt);
 
-    if(forwardable_flag != -1)
-	krb5_get_init_creds_opt_set_forwardable (opt, forwardable_flag);
-    if(proxiable_flag != -1)
-	krb5_get_init_creds_opt_set_proxiable (opt, proxiable_flag);
-    if(anonymous_flag)
-	krb5_get_init_creds_opt_set_anonymous (opt, anonymous_flag);
+    if (forwardable_flag != -1)
+	krb5_get_init_creds_opt_set_forwardable(opt, forwardable_flag);
+    if (proxiable_flag != -1)
+	krb5_get_init_creds_opt_set_proxiable(opt, proxiable_flag);
+    if (anonymous_flag)
+	krb5_get_init_creds_opt_set_anonymous(opt, anonymous_flag);
     if (pac_flag != -1)
 	krb5_get_init_creds_opt_set_pac_request(context, opt,
 						pac_flag ? TRUE : FALSE);
@@ -447,11 +539,13 @@ get_new_tickets(krb5_context context,
 						 NULL,
 						 pk_use_enckey ? 2 : 0 |
 						 anonymous_flag ? 4 : 0,
-						 krb5_prompter_posix,
+						 prompter,
 						 NULL,
 						 passwd);
-	if (ret)
-	    krb5_err(context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_get_init_creds_opt_set_pkinit");
+	    goto out;
+	}
 	if (ent_user_id)
 	    krb5_get_init_creds_opt_set_pkinit_user_certs(context, opt, ent_user_id);
     }
@@ -461,103 +555,125 @@ get_new_tickets(krb5_context context,
 						addrs_flag ? FALSE : TRUE);
 
     if (renew_life == NULL && renewable_flag)
-	renewstr = "1 month";
+	renewstr = "6 months";
     if (renew_life)
 	renewstr = renew_life;
     if (renewstr) {
-	renew = parse_time (renewstr, "s");
+	renew = parse_time(renewstr, "s");
 	if (renew < 0)
-	    errx (1, "unparsable time: %s", renewstr);
+	    errx(1, "unparsable time: %s", renewstr);
 
-	krb5_get_init_creds_opt_set_renew_life (opt, renew);
+	krb5_get_init_creds_opt_set_renew_life(opt, renew);
     }
 
-    if(ticket_life != 0)
-	krb5_get_init_creds_opt_set_tkt_life (opt, ticket_life);
+    if (ticket_life != 0)
+	krb5_get_init_creds_opt_set_tkt_life(opt, ticket_life);
 
-    if(start_str) {
-	int tmp = parse_time (start_str, "s");
+    if (start_str) {
+	int tmp = parse_time(start_str, "s");
 	if (tmp < 0)
-	    errx (1, N_("unparsable time: %s", ""), start_str);
+	    errx(1, N_("unparsable time: %s", ""), start_str);
 
 	start_time = tmp;
     }
 
-    if(etype_str.num_strings) {
+    if (etype_str.num_strings) {
 	int i;
 
 	enctype = malloc(etype_str.num_strings * sizeof(*enctype));
-	if(enctype == NULL)
+	if (enctype == NULL)
 	    errx(1, "out of memory");
 	for(i = 0; i < etype_str.num_strings; i++) {
 	    ret = krb5_string_to_enctype(context,
 					 etype_str.strings[i],
 					 &enctype[i]);
-	    if(ret)
+	    if (ret)
 		errx(1, "unrecognized enctype: %s", etype_str.strings[i]);
 	}
 	krb5_get_init_creds_opt_set_etype_list(opt, enctype,
 					       etype_str.num_strings);
     }
 
-    if(use_keytab || keytab_str) {
-	krb5_keytab kt;
-	if(keytab_str)
-	    ret = krb5_kt_resolve(context, keytab_str, &kt);
-	else
-	    ret = krb5_kt_default(context, &kt);
-	if (ret)
-	    krb5_err (context, 1, ret, "resolving keytab");
-	ret = krb5_get_init_creds_keytab (context,
-					  &cred,
-					  principal,
-					  kt,
-					  start_time,
-					  server_str,
-					  opt);
-	krb5_kt_close(context, kt);
+    ret = krb5_init_creds_init(context, principal, prompter, NULL, start_time, opt, &ctx);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_init_creds_init");
+	goto out;
+    }
+
+    if (server_str) {
+	ret = krb5_init_creds_set_service(context, ctx, server_str);
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_init_creds_set_service");
+	    goto out;
+	}
+    }
+
+    if (fast_armor_cache_string) {
+	krb5_ccache fastid;
+	
+	ret = krb5_cc_resolve(context, fast_armor_cache_string, &fastid);
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_cc_resolve(FAST cache)");
+	    goto out;
+	}
+	
+	ret = krb5_init_creds_set_fast_ccache(context, ctx, fastid);
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_init_creds_set_fast_ccache");
+	    goto out;
+	}
+    }
+
+    if (use_keytab || keytab_str) {
+	ret = krb5_init_creds_set_keytab(context, ctx, kt);
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_init_creds_set_keytab");
+	    goto out;
+	}
     } else if (pk_user_id || ent_user_id || anonymous_flag) {
-	ret = krb5_get_init_creds_password (context,
-					    &cred,
-					    principal,
-					    passwd,
-					    krb5_prompter_posix,
-					    NULL,
-					    start_time,
-					    server_str,
-					    opt);
-    } else if (!interactive) {
-	krb5_warnx(context, "Not interactive, failed to get initial ticket");
+
+    } else if (!interactive && passwd[0] == '\0') {
+	static int already_warned = 0;
+
+	if (!already_warned)
+	    krb5_warnx(context, "Not interactive, failed to get "
+	      "initial ticket");
 	krb5_get_init_creds_opt_free(context, opt);
+	already_warned = 1;
 	return 0;
     } else {
 
 	if (passwd[0] == '\0') {
 	    char *p, *prompt;
+	    int aret = 0;
 
-	    krb5_unparse_name (context, principal, &p);
-	    asprintf (&prompt, N_("%s's Password: ", ""), p);
-	    free (p);
+	    ret = krb5_unparse_name(context, principal, &p);
+	    if (ret)
+		errx(1, "failed to generate passwd prompt: not enough memory");
+
+	    aret = asprintf(&prompt, N_("%s's Password: ", ""), p);
+	    free(p);
+	    if (aret == -1)
+		errx(1, "failed to generate passwd prompt: not enough memory");
 
 	    if (UI_UTIL_read_pw_string(passwd, sizeof(passwd)-1, prompt, 0)){
 		memset(passwd, 0, sizeof(passwd));
-		exit(1);
+		errx(1, "failed to read password");
 	    }
-	    free (prompt);
+	    free(prompt);
 	}
 
-
-	ret = krb5_get_init_creds_password (context,
-					    &cred,
-					    principal,
-					    passwd,
-					    krb5_prompter_posix,
-					    NULL,
-					    start_time,
-					    server_str,
-					    opt);
+	if (passwd[0]) {
+	    ret = krb5_init_creds_set_password(context, ctx, passwd);
+	    if (ret) {
+		krb5_warn(context, ret, "krb5_init_creds_set_password");
+		goto out;
+	    }
+	}
     }
-    krb5_get_init_creds_opt_free(context, opt);
+
+    ret = krb5_init_creds_get(context, ctx);
+
 #ifndef NO_NTLM
     if (ntlm_domain && passwd[0])
 	heim_ntlm_nt_key(passwd, &ntlmkey);
@@ -572,25 +688,38 @@ get_new_tickets(krb5_context context,
     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
     case KRB5KRB_AP_ERR_MODIFIED:
     case KRB5KDC_ERR_PREAUTH_FAILED:
-	krb5_errx(context, 1, N_("Password incorrect", ""));
-	break;
+    case KRB5_GET_IN_TKT_LOOP:
+	krb5_warnx(context, N_("Password incorrect", ""));
+	goto out;
     case KRB5KRB_AP_ERR_V4_REPLY:
-	krb5_errx(context, 1, N_("Looks like a Kerberos 4 reply", ""));
-	break;
+	krb5_warnx(context, N_("Looks like a Kerberos 4 reply", ""));
+	goto out;
+    case KRB5KDC_ERR_KEY_EXPIRED:
+	krb5_warnx(context, N_("Password expired", ""));
+	goto out;
     default:
-	krb5_err(context, 1, ret, "krb5_get_init_creds");
+	krb5_warn(context, ret, "krb5_get_init_creds");
+	goto out;
     }
 
-    if(ticket_life != 0) {
-	if(abs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
+    krb5_process_last_request(context, opt, ctx);
+
+    ret = krb5_init_creds_get_creds(context, ctx, &cred);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_init_creds_get_creds");
+	goto out;
+    }
+
+    if (ticket_life != 0) {
+	if (labs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
 	    char life[64];
 	    unparse_time_approx(cred.times.endtime - cred.times.starttime,
 				life, sizeof(life));
 	    krb5_warnx(context, N_("NOTICE: ticket lifetime is %s", ""), life);
 	}
     }
-    if(renew_life) {
-	if(abs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
+    if (renew_life) {
+	if (labs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
 	    char life[64];
 	    unparse_time_approx(cred.times.renew_till - cred.times.starttime,
 				life, sizeof(life));
@@ -599,25 +728,30 @@ get_new_tickets(krb5_context context,
 		       life);
 	}
     }
+    krb5_free_cred_contents(context, &cred);
 
     ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, ccache),
 			     NULL, &tempccache);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_new_unique");
+    if (ret) {
+	krb5_warn(context, ret, "krb5_cc_new_unique");
+	goto out;
+    }
 
-    ret = krb5_cc_initialize (context, tempccache, cred.client);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_initialize");
+    ret = krb5_init_creds_store(context, ctx, tempccache);
+    if (ret) {
+	krb5_warn(context, ret, "krb5_init_creds_store");
+	goto out;
+    }
 
-    ret = krb5_cc_store_cred (context, tempccache, &cred);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_store_cred");
-
-    krb5_free_cred_contents (context, &cred);
+    krb5_init_creds_free(context, ctx);
+    ctx = NULL;
 
     ret = krb5_cc_move(context, tempccache, ccache);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_cc_move");
+    if (ret) {
+	krb5_warn(context, ret, "krb5_cc_move");
+	goto out;
+    }
+    tempccache = NULL;
 
     if (switch_cache_flags)
 	krb5_cc_switch(context, ccache);
@@ -642,30 +776,40 @@ get_new_tickets(krb5_context context,
 	krb5_cc_set_config(context, ccache, NULL, "realm-config", &data);
     }
 
+out:
+    krb5_get_init_creds_opt_free(context, opt);
+    if (ctx)
+	krb5_init_creds_free(context, ctx);
+    if (tempccache)
+	krb5_cc_close(context, tempccache);
 
     if (enctype)
 	free(enctype);
 
-    return 0;
+    return ret;
 }
 
 static time_t
-ticket_lifetime(krb5_context context, krb5_ccache cache,
-		krb5_principal client, const char *server)
+ticket_lifetime(krb5_context context, krb5_ccache cache, krb5_principal client,
+		const char *server, time_t *renew)
 {
     krb5_creds in_cred, *cred;
     krb5_error_code ret;
     time_t timeout;
+    time_t curtime;
 
     memset(&in_cred, 0, sizeof(in_cred));
 
+    if (renew != NULL)
+        *renew = 0;
+
     ret = krb5_cc_get_principal(context, cache, &in_cred.client);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "krb5_cc_get_principal");
 	return 0;
     }
     ret = get_server(context, in_cred.client, server, &in_cred.server);
-    if(ret) {
+    if (ret) {
 	krb5_free_principal(context, in_cred.client);
 	krb5_warn(context, ret, "get_server");
 	return 0;
@@ -675,84 +819,431 @@ ticket_lifetime(krb5_context context, krb5_ccache cache,
 			       cache, &in_cred, &cred);
     krb5_free_principal(context, in_cred.client);
     krb5_free_principal(context, in_cred.server);
-    if(ret) {
+    if (ret) {
 	krb5_warn(context, ret, "krb5_get_credentials");
 	return 0;
     }
-    timeout = cred->times.endtime - cred->times.starttime;
+    curtime = time(NULL);
+    timeout = cred->times.endtime - curtime;
     if (timeout < 0)
 	timeout = 0;
+    if (renew) {
+	*renew = cred->times.renew_till - curtime;
+	if (*renew < 0)
+	    *renew = 0;
+    }
     krb5_free_creds(context, cred);
     return timeout;
 }
 
+static time_t expire;
+
+static char siginfo_msg[1024] = "No credentials\n";
+
+static void
+update_siginfo_msg(time_t exp, const char *srv)
+{
+    /* Note that exp is relative time */
+    memset(siginfo_msg, 0, sizeof(siginfo_msg));
+    memcpy(&siginfo_msg, "Updating...\n", sizeof("Updating...\n"));
+    if (exp) {
+	if (srv == NULL) {
+	    snprintf(siginfo_msg, sizeof(siginfo_msg),
+		     N_("kinit: TGT expires in %llu seconds\n", ""),
+		     (unsigned long long)expire);
+	} else {
+	    snprintf(siginfo_msg, sizeof(siginfo_msg),
+		     N_("kinit: Ticket for %s expired\n", ""), srv);
+	}
+	return;
+    }
+
+    /* Expired creds */
+    if (srv == NULL) {
+	snprintf(siginfo_msg, sizeof(siginfo_msg),
+		 N_("kinit: TGT expired\n", ""));
+    } else {
+	snprintf(siginfo_msg, sizeof(siginfo_msg),
+		 N_("kinit: Ticket for %s expired\n", ""), srv);
+    }
+}
+
+#ifdef HAVE_SIGACTION
+static void
+handle_siginfo(int sig)
+{
+    struct iovec iov[2];
+
+    iov[0].iov_base = rk_UNCONST(siginfo_msg);
+    iov[0].iov_len = strlen(siginfo_msg);
+    iov[1].iov_base = "\n";
+    iov[1].iov_len = 1;
+
+    writev(STDERR_FILENO, iov, sizeof(iov)/sizeof(iov[0]));
+}
+#endif
+
 struct renew_ctx {
     krb5_context context;
     krb5_ccache  ccache;
     krb5_principal principal;
     krb5_deltat ticket_life;
+    krb5_deltat timeout;
 };
 
 static time_t
 renew_func(void *ptr)
 {
-    struct renew_ctx *ctx = ptr;
     krb5_error_code ret;
-    time_t expire;
-    int new_tickets = 0;
+    struct renew_ctx *ctx = ptr;
+    time_t renew_expire;
+    static time_t exp_delay = 1;
 
-    if (renewable_flag) {
-	ret = renew_validate(ctx->context, renewable_flag, validate_flag,
-			     ctx->ccache, server_str, ctx->ticket_life);
-	if (ret)
-	    new_tickets = 1;
-    } else
-	new_tickets = 1;
+    /*
+     * NOTE: We count on the ccache implementation to notice changes to the
+     * actual ccache filesystem/whatever objects.  There should be no ccache
+     * types for which this is not the case, but it might not hurt to
+     * re-krb5_cc_resolve() after each successful renew_validate()/
+     * get_new_tickets() call.
+     */
 
-    if (new_tickets)
-	get_new_tickets(ctx->context, ctx->principal,
-			ctx->ccache, ctx->ticket_life, 0);
+    expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
+			     server_str, &renew_expire);
+
+    /*
+     * When a keytab is available to obtain new tickets, if we are within
+     * half of the original ticket lifetime of the renew limit, get a new
+     * TGT instead of renewing the existing TGT.  Note, ctx->ticket_life
+     * is zero by default (without a '-l' option) and cannot be used to
+     * set the time scale on which we decide whether we're "close to the
+     * renew limit".
+     */
+    if (use_keytab || keytab_str)
+	expire += ctx->timeout;
+    if (renew_expire > expire) {
+	ret = renew_validate(ctx->context, 1, validate_flag, ctx->ccache,
+		       server_str, ctx->ticket_life);
+    } else {
+	ret = get_new_tickets(ctx->context, ctx->principal, ctx->ccache,
+			      ctx->ticket_life, 0);
+    }
+    expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
+			     server_str, &renew_expire);
 
 #ifndef NO_AFS
-    if(do_afslog && k_hasafs())
+    if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
 	krb5_afslog(ctx->context, ctx->ccache, NULL, NULL);
 #endif
 
-    expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
-			     server_str) / 2;
-    return expire + 1;
+    update_siginfo_msg(expire, server_str);
+
+    /*
+     * If our tickets have expired and we been able to either renew them
+     * or obtain new tickets, then we still call this function but we use
+     * an exponential backoff.  This should take care of the case where
+     * we are using stored credentials but the KDC has been unavailable
+     * for some reason...
+     */
+
+    if (expire < 1) {
+	/*
+	 * We can't ask to keep spamming stderr but not syslog, so we warn
+	 * only once.
+	 */
+	if (exp_delay == 1) {
+	    krb5_warnx(ctx->context, N_("NOTICE: Could not renew/refresh "
+					"tickets", ""));
+	}
+        if (exp_delay < 7200)
+	    exp_delay += exp_delay / 2 + 1;
+	return exp_delay;
+    }
+    exp_delay = 1;
+
+    return expire / 2 + 1;
+}
+
+static void
+set_princ_realm(krb5_context context,
+		krb5_principal principal,
+		const char *realm)
+{
+    krb5_error_code ret;
+
+    if ((ret = krb5_principal_set_realm(context, principal, realm)) != 0)
+	krb5_err(context, 1, ret, "krb5_principal_set_realm");
+}
+
+static void
+parse_name_realm(krb5_context context,
+		 const char *name,
+		 int flags,
+		 const char *realm,
+		 krb5_principal *princ)
+{
+    krb5_error_code ret;
+    
+    if (realm)
+	flags |= KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
+    if ((ret = krb5_parse_name_flags(context, name, flags, princ)) != 0)
+	krb5_err(context, 1, ret, "krb5_parse_name_flags");
+    if (realm && krb5_principal_get_realm(context, *princ) == NULL)
+	set_princ_realm(context, *princ, realm);
+}
+
+static char *
+get_default_realm(krb5_context context)
+{
+    char *realm;
+    krb5_error_code ret;
+
+    if ((ret = krb5_get_default_realm(context, &realm)) != 0)
+        krb5_err(context, 1, ret, "krb5_get_default_realm");
+    return realm;
+}
+
+static void
+get_default_principal(krb5_context context, krb5_principal *princ)
+{
+    krb5_error_code ret;
+
+    if ((ret = krb5_get_default_principal(context, princ)) != 0)
+	krb5_err(context, 1, ret, "krb5_get_default_principal");
+}
+
+static char *
+get_user_realm(krb5_context context)
+{
+    krb5_error_code ret;
+    char *user_realm = NULL;
+
+    /*
+     * If memory allocation fails, we don't try to use the wrong realm,
+     * that will trigger misleading error messages complicate support.
+     */
+    krb5_appdefault_string(context, "kinit", NULL, "user_realm", "",
+			   &user_realm);
+    if (user_realm == NULL) {
+	ret = krb5_enomem(context);
+	krb5_err(context, 1, ret, "krb5_appdefault_string");
+    }
+
+    if (*user_realm == 0) {
+	free(user_realm);
+	user_realm = NULL;
+    }
+
+    return user_realm;
+}
+
+static void
+get_princ(krb5_context context, krb5_principal *principal, const char *name)
+{
+    krb5_error_code ret;
+    krb5_principal tmp;
+    int parseflags = 0;
+    char *user_realm;
+
+    if (name == NULL) {
+	krb5_ccache ccache;
+
+	/* If credential cache provides a client principal, use that. */
+	if (krb5_cc_default(context, &ccache) == 0) {
+	    ret = krb5_cc_get_principal(context, ccache, principal);
+	    krb5_cc_close(context, ccache);
+	    if (ret == 0)
+		return;
+	}
+    }
+
+    user_realm = get_user_realm(context);
+
+    if (name) {
+	if (canonicalize_flag || enterprise_flag)
+	    parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+
+	parse_name_realm(context, name, parseflags, user_realm, &tmp);
+
+	if (user_realm && krb5_principal_get_num_comp(context, tmp) > 1) {
+	    /* Principal is instance qualified, reparse with default realm. */
+	    krb5_free_principal(context, tmp);
+	    parse_name_realm(context, name, parseflags, NULL, principal);
+	} else {
+	    *principal = tmp;
+	}
+    } else {
+	get_default_principal(context, principal);
+	if (user_realm)
+	    set_princ_realm(context, *principal, user_realm);
+    }
+
+    if (user_realm)
+	free(user_realm);
+}
+
+static void
+get_princ_kt(krb5_context context,
+	     krb5_principal *principal,
+	     char *name)
+{
+    krb5_error_code ret;
+    krb5_principal tmp;
+    krb5_ccache ccache;
+    krb5_kt_cursor cursor;
+    krb5_keytab_entry entry;
+    char *def_realm;
+
+    if (name == NULL) {
+	/*
+	 * If the credential cache exists and specifies a client principal,
+	 * use that.
+	 */
+	if (krb5_cc_default(context, &ccache) == 0) {
+	    ret = krb5_cc_get_principal(context, ccache, principal);
+	    krb5_cc_close(context, ccache);
+	    if (ret == 0)
+		return;
+	}
+    }
+
+    if (name) {
+	/* If the principal specifies an explicit realm, just use that. */
+	int parseflags = KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
+
+	parse_name_realm(context, name, parseflags, NULL, &tmp);
+	if (krb5_principal_get_realm(context, tmp) != NULL) {
+	    *principal = tmp;
+	    return;
+	}
+    } else {
+	/* Otherwise, search keytab for bare name of the default principal. */
+	get_default_principal(context, &tmp);
+	set_princ_realm(context, tmp, NULL);
+    }
+
+    def_realm = get_default_realm(context);
+
+    ret = krb5_kt_start_seq_get(context, kt, &cursor);
+    if (ret)
+	krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
+
+    while (ret == 0 &&
+           krb5_kt_next_entry(context, kt, &entry, &cursor) == 0) {
+        const char *realm;
+
+        if (!krb5_principal_compare_any_realm(context, tmp, entry.principal))
+            continue;
+        if (*principal &&
+	    krb5_principal_compare(context, *principal, entry.principal))
+            continue;
+        /* The default realm takes precedence */
+        realm = krb5_principal_get_realm(context, entry.principal);
+        if (*principal && strcmp(def_realm, realm) == 0) {
+            krb5_free_principal(context, *principal);
+            ret = krb5_copy_principal(context, entry.principal, principal);
+            break;
+        }
+        if (!*principal)
+            ret = krb5_copy_principal(context, entry.principal, principal);
+    }
+    if (ret != 0 || (ret = krb5_kt_end_seq_get(context, kt, &cursor)) != 0)
+	krb5_err(context, 1, ret, "get_princ_kt");
+    if (!*principal) {
+	if (name)
+	    parse_name_realm(context, name, 0, NULL, principal);
+	else
+	    krb5_err(context, 1, KRB5_CC_NOTFOUND, "get_princ_kt");
+    }
+
+    krb5_free_principal(context, tmp);
+    free(def_realm);
+}
+
+static krb5_error_code
+get_switched_ccache(krb5_context context,
+		    const char * type,
+		    krb5_principal principal,
+		    krb5_ccache *ccache)
+{
+    krb5_error_code ret;
+
+#ifdef _WIN32
+    if (strcmp(type, "API") == 0) {
+	/*
+	 * Windows stores the default ccache name in the
+	 * registry which is shared across multiple logon
+	 * sessions for the same user.  The API credential
+	 * cache provides a unique name space per logon
+	 * session.  Therefore there is no need to generate
+	 * a unique ccache name.  Instead use the principal
+	 * name.  This provides a friendlier user experience.
+	 */
+	char * unparsed_name;
+	char * cred_cache;
+
+	ret = krb5_unparse_name(context, principal,
+				&unparsed_name);
+	if (ret)
+	    krb5_err(context, 1, ret,
+		     N_("unparsing principal name", ""));
+
+	ret = asprintf(&cred_cache, "API:%s", unparsed_name);
+	krb5_free_unparsed_name(context, unparsed_name);
+	if (ret == -1 || cred_cache == NULL)
+	    krb5_err(context, 1, ret,
+		      N_("building credential cache name", ""));
+
+	ret = krb5_cc_resolve(context, cred_cache, ccache);
+	free(cred_cache);
+    } else if (strcmp(type, "MSLSA") == 0) {
+	/*
+	 * The Windows MSLSA cache when it is writeable
+	 * stores tickets for multiple client principals
+	 * in a single credential cache.
+	 */
+	ret = krb5_cc_resolve(context, "MSLSA:", ccache);
+    } else {
+	ret = krb5_cc_new_unique(context, type, NULL, ccache);
+    }
+#else /* !_WIN32 */
+    ret = krb5_cc_new_unique(context, type, NULL, ccache);
+#endif /* _WIN32 */
+
+    return ret;
 }
 
 int
-main (int argc, char **argv)
+main(int argc, char **argv)
 {
     krb5_error_code ret;
     krb5_context context;
     krb5_ccache  ccache;
-    krb5_principal principal;
+    krb5_principal principal = NULL;
     int optidx = 0;
     krb5_deltat ticket_life = 0;
-    int parseflags = 0;
+#ifdef HAVE_SIGACTION
+    struct sigaction sa;
+#endif
 
-    setprogname (argv[0]);
+    setprogname(argv[0]);
 
-    setlocale (LC_ALL, "");
-    bindtextdomain ("heimdal_kuser", HEIMDAL_LOCALEDIR);
+    setlocale(LC_ALL, "");
+    bindtextdomain("heimdal_kuser", HEIMDAL_LOCALEDIR);
     textdomain("heimdal_kuser");
 
-    ret = krb5_init_context (&context);
+    ret = krb5_init_context(&context);
     if (ret == KRB5_CONFIG_BADFORMAT)
-	errx (1, "krb5_init_context failed to parse configuration file");
+	errx(1, "krb5_init_context failed to parse configuration file");
     else if (ret)
 	errx(1, "krb5_init_context failed: %d", ret);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
+    if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
-	usage (0);
+	usage(0);
 
-    if(version_flag) {
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
@@ -760,8 +1251,18 @@ main (int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
-    if (canonicalize_flag || enterprise_flag)
-	parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+    /*
+     * Open the keytab now, we use the keytab to determine the principal's
+     * realm when the requested principal has no realm.
+     */
+    if (use_keytab || keytab_str) {
+	if (keytab_str)
+	    ret = krb5_kt_resolve(context, keytab_str, &kt);
+	else
+	    ret = krb5_kt_default(context, &kt);
+	if (ret)
+	    krb5_err(context, 1, ret, "resolving keytab");
+    }
 
     if (pk_enterprise_flag) {
 	ret = krb5_pk_enterprise_cert(context, pk_user_id,
@@ -781,39 +1282,32 @@ main (int argc, char **argv)
 	    krb5_err(context, 1, ret, "krb5_make_principal");
 	krb5_principal_set_type(context, principal, KRB5_NT_WELLKNOWN);
 
+    } else if (use_keytab || keytab_str) {
+	get_princ_kt(context, &principal, argv[0]);
     } else {
-	if (argv[0]) {
-	    ret = krb5_parse_name_flags (context, argv[0], parseflags,
-					 &principal);
-	    if (ret)
-		krb5_err (context, 1, ret, "krb5_parse_name");
-	} else {
-	    ret = krb5_get_default_principal (context, &principal);
-	    if (ret)
-		krb5_err (context, 1, ret, "krb5_get_default_principal");
-	}
+	get_princ(context, &principal, argv[0]);
     }
 
-    if(fcache_version)
+    if (fcache_version)
 	krb5_set_fcache_version(context, fcache_version);
 
-    if(renewable_flag == -1)
+    if (renewable_flag == -1)
 	/* this seems somewhat pointless, but whatever */
 	krb5_appdefault_boolean(context, "kinit",
 				krb5_principal_get_realm(context, principal),
 				"renewable", FALSE, &renewable_flag);
-    if(do_afslog == -1)
+    if (do_afslog == -1)
 	krb5_appdefault_boolean(context, "kinit",
 				krb5_principal_get_realm(context, principal),
 				"afslog", TRUE, &do_afslog);
 
-    if(cred_cache)
+    if (cred_cache)
 	ret = krb5_cc_resolve(context, cred_cache, &ccache);
     else {
-	if(argc > 1) {
+	if (argc > 1) {
 	    char s[1024];
 	    ret = krb5_cc_new_unique(context, NULL, NULL, &ccache);
-	    if(ret)
+	    if (ret)
 		krb5_err(context, 1, ret, "creating cred cache");
 	    snprintf(s, sizeof(s), "%s:%s",
 		     krb5_cc_get_type(context, ccache),
@@ -823,9 +1317,10 @@ main (int argc, char **argv)
 	    ret = krb5_cc_cache_match(context, principal, &ccache);
 	    if (ret) {
 		const char *type;
-		ret = krb5_cc_default (context, &ccache);
+		ret = krb5_cc_default(context, &ccache);
 		if (ret)
-		    krb5_err (context, 1, ret, N_("resolving credentials cache", ""));
+		    krb5_err(context, 1, ret,
+			     N_("resolving credentials cache", ""));
 
 		/*
 		 * Check if the type support switching, and we do,
@@ -835,28 +1330,29 @@ main (int argc, char **argv)
 		type = krb5_cc_get_type(context, ccache);
 		if (krb5_cc_support_switch(context, type)) {
 		    krb5_cc_close(context, ccache);
-		    ret = krb5_cc_new_unique(context, type, NULL, &ccache);
+		    ret = get_switched_ccache(context, type, principal,
+					      &ccache);
 		}
 	    }
 	}
     }
     if (ret)
-	krb5_err (context, 1, ret, N_("resolving credentials cache", ""));
+	krb5_err(context, 1, ret, N_("resolving credentials cache", ""));
 
 #ifndef NO_AFS
-    if(argc > 1 && k_hasafs ())
+    if (argc > 1 && k_hasafs())
 	k_setpag();
 #endif
 
     if (lifetime) {
-	int tmp = parse_time (lifetime, "s");
+	int tmp = parse_time(lifetime, "s");
 	if (tmp < 0)
-	    errx (1, N_("unparsable time: %s", ""), lifetime);
+	    errx(1, N_("unparsable time: %s", ""), lifetime);
 
 	ticket_life = tmp;
     }
 
-    if(addrs_flag == 0 && extra_addresses.num_strings > 0)
+    if (addrs_flag == 0 && extra_addresses.num_strings > 0)
 	krb5_errx(context, 1,
 		  N_("specifying both extra addresses and "
 		     "no addresses makes no sense", ""));
@@ -875,48 +1371,69 @@ main (int argc, char **argv)
 	free_getarg_strings(&extra_addresses);
     }
 
-    if(renew_flag || validate_flag) {
+    if (renew_flag || validate_flag) {
 	ret = renew_validate(context, renew_flag, validate_flag,
 			     ccache, server_str, ticket_life);
+
+#ifndef NO_AFS
+	if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
+	    krb5_afslog(context, ccache, NULL, NULL);
+#endif
+
 	exit(ret != 0);
     }
 
-    get_new_tickets(context, principal, ccache, ticket_life, 1);
+    ret = get_new_tickets(context, principal, ccache, ticket_life, 1);
+    if (ret)
+	exit(1);
 
 #ifndef NO_AFS
-    if(do_afslog && k_hasafs())
+    if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
 	krb5_afslog(context, ccache, NULL, NULL);
 #endif
-    if(argc > 1) {
+
+    if (argc > 1) {
 	struct renew_ctx ctx;
 	time_t timeout;
 
-	timeout = ticket_lifetime(context, ccache, principal, server_str) / 2;
+	timeout = ticket_lifetime(context, ccache, principal,
+				  server_str, NULL) / 2;
 
 	ctx.context = context;
 	ctx.ccache = ccache;
 	ctx.principal = principal;
 	ctx.ticket_life = ticket_life;
+	ctx.timeout = timeout;
+
+#ifdef HAVE_SIGACTION
+	memset(&sa, 0, sizeof(sa));
+	sigemptyset(&sa.sa_mask);
+	sa.sa_handler = handle_siginfo;
+
+	sigaction(SIGINFO, &sa, NULL);
+#endif
 
 	ret = simple_execvp_timed(argv[1], argv+1,
 				  renew_func, &ctx, timeout);
 #define EX_NOEXEC	126
 #define EX_NOTFOUND	127
-	if(ret == EX_NOEXEC)
+	if (ret == EX_NOEXEC)
 	    krb5_warnx(context, N_("permission denied: %s", ""), argv[1]);
-	else if(ret == EX_NOTFOUND)
+	else if (ret == EX_NOTFOUND)
 	    krb5_warnx(context, N_("command not found: %s", ""), argv[1]);
 
 	krb5_cc_destroy(context, ccache);
 #ifndef NO_AFS
-	if(k_hasafs())
+	if (k_hasafs())
 	    k_unlog();
 #endif
     } else {
-	krb5_cc_close (context, ccache);
+	krb5_cc_close(context, ccache);
 	ret = 0;
     }
     krb5_free_principal(context, principal);
-    krb5_free_context (context);
+    if (kt)
+	krb5_kt_close(context, kt);
+    krb5_free_context(context);
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kuser/klist.1 b/crypto/external/bsd/heimdal/dist/kuser/klist.1
index ae5305878..0211b1c79 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/klist.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/klist.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: klist.1,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: klist.1,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/kuser/klist.c b/crypto/external/bsd/heimdal/dist/kuser/klist.c
index 28687de5d..94138d8c3 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/klist.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/klist.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: klist.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: klist.c,v 1.4 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
@@ -36,9 +36,8 @@
  */
 
 #include "kuser_locl.h"
-#include <krb5/rtbl.h>
 #include <krb5/parse_units.h>
-#include "kcc-commands.h"
+#include "heimtools-commands.h"
 
 static char*
 printable_time_internal(time_t t, int x)
@@ -132,13 +131,18 @@ print_cred(krb5_context context, krb5_creds *cred, rtbl_t ct, int do_flags)
 }
 
 static void
-print_cred_verbose(krb5_context context, krb5_creds *cred)
+print_cred_verbose(krb5_context context, krb5_creds *cred, int do_json)
 {
     size_t j;
     char *str;
     krb5_error_code ret;
     krb5_timestamp sec;
 
+    if (do_json) { /* XXX support more json formating later */
+	printf("{ \"verbose-supported\" : false }");
+	return;
+    }
+
     krb5_timeofday (context, &sec);
 
     ret = krb5_unparse_name(context, cred->server, &str);
@@ -152,8 +156,8 @@ print_cred_verbose(krb5_context context, krb5_creds *cred)
 	exit(1);
     printf(N_("Client: %s\n", ""), str);
     free (str);
-
-    {
+    
+    if (!krb5_is_config_principal(context, cred->client)) {
 	Ticket t;
 	size_t len;
 	char *s;
@@ -222,7 +226,7 @@ print_cred_verbose(krb5_context context, krb5_creds *cred)
 }
 
 /*
- * Print all tickets in `ccache' on stdout, verbosily iff do_verbose.
+ * Print all tickets in `ccache' on stdout, verbosely if do_verbose.
  */
 
 static void
@@ -231,10 +235,11 @@ print_tickets (krb5_context context,
 	       krb5_principal principal,
 	       int do_verbose,
 	       int do_flags,
-	       int do_hidden)
+	       int do_hidden,
+	       int do_json)
 {
+    char *str, *name, *fullname;
     krb5_error_code ret;
-    char *str, *name;
     krb5_cc_cursor cursor;
     krb5_creds creds;
     krb5_deltat sec;
@@ -245,48 +250,52 @@ print_tickets (krb5_context context,
     if (ret)
 	krb5_err (context, 1, ret, "krb5_unparse_name");
 
-    printf ("%17s: %s:%s\n",
-	    N_("Credentials cache", ""),
-	    krb5_cc_get_type(context, ccache),
-	    krb5_cc_get_name(context, ccache));
-    printf ("%17s: %s\n", N_("Principal", ""), str);
+    ret = krb5_cc_get_full_name(context, ccache, &fullname);
+    if (ret)
+	krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 
-    ret = krb5_cc_get_friendly_name(context, ccache, &name);
-    if (ret == 0) {
-	if (strcmp(name, str) != 0)
-	    printf ("%17s: %s\n", N_("Friendly name", ""), name);
-	free(name);
-    }
-    free (str);
-
-    if(do_verbose) {
-	printf ("%17s: %d\n", N_("Cache version", ""),
-		krb5_cc_get_version(context, ccache));
-    } else {
-        krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
-    }
-
-    ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
-
-    if (ret == 0 && do_verbose && sec != 0) {
-	char buf[BUFSIZ];
-	int val;
-	int sig;
-
-	val = sec;
-	sig = 1;
-	if (val < 0) {
-	    sig = -1;
-	    val = -val;
+    if (!do_json) {
+	printf ("%17s: %s\n", N_("Credentials cache", ""), fullname);
+	printf ("%17s: %s\n", N_("Principal", ""), str);
+	
+	ret = krb5_cc_get_friendly_name(context, ccache, &name);
+	if (ret == 0) {
+	    if (strcmp(name, str) != 0)
+		printf ("%17s: %s\n", N_("Friendly name", ""), name);
+	    free(name);
 	}
+	
+	if(do_verbose) {
+	    printf ("%17s: %d\n", N_("Cache version", ""),
+		    krb5_cc_get_version(context, ccache));
+	} else {
+	    krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
+	}
+	
+	ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
+	
+	if (ret == 0 && do_verbose && sec != 0) {
+	    char buf[BUFSIZ];
+	    int val;
+	    int sig;
+	    
+	    val = (int)sec;
+	    sig = 1;
+	    if (val < 0) {
+		sig = -1;
+		val = -val;
+	    }
+	    
+	    unparse_time (val, buf, sizeof(buf));
 
-	unparse_time (val, buf, sizeof(buf));
-
-	printf ("%17s: %s%s\n", N_("KDC time offset", ""),
-		sig == -1 ? "-" : "", buf);
+	    printf ("%17s: %s%s\n", N_("KDC time offset", ""),
+		    sig == -1 ? "-" : "", buf);
+	}
+	printf("\n");
+    } else {
+	printf ("{ \"cache\" : \"%s\", \"principal\" : \"%s\", ", fullname, str);
     }
-
-    printf("\n");
+    free(str);
 
     ret = krb5_cc_start_seq_get (context, ccache, &cursor);
     if (ret)
@@ -300,7 +309,13 @@ print_tickets (krb5_context context,
 	    rtbl_add_column(ct, COL_FLAGS, 0);
 	rtbl_add_column(ct, COL_PRINCIPAL, 0);
 	rtbl_set_separator(ct, "  ");
+	if (do_json) {
+	    rtbl_set_flags(ct, RTBL_JSON);
+	    printf("\"tickets\" : ");
+	}
     }
+    if (do_verbose && do_json)
+	printf("\"tickets\" : [");
     while ((ret = krb5_cc_next_cred (context,
 				     ccache,
 				     &cursor,
@@ -308,7 +323,7 @@ print_tickets (krb5_context context,
 	if (!do_hidden && krb5_is_config_principal(context, creds.server)) {
 	    ;
 	}else if(do_verbose){
-	    print_cred_verbose(context, &creds);
+	    print_cred_verbose(context, &creds, do_json);
 	}else{
 	    print_cred(context, &creds, ct, do_flags);
 	}
@@ -323,6 +338,11 @@ print_tickets (krb5_context context,
 	rtbl_format(ct, stdout);
 	rtbl_destroy(ct);
     }
+    if (do_json) {
+	if (do_verbose)
+	    printf("]");
+	printf("}");
+    }
 }
 
 /*
@@ -331,43 +351,21 @@ print_tickets (krb5_context context,
  */
 
 static int
-check_for_tgt (krb5_context context,
-	       krb5_ccache ccache,
-	       krb5_principal principal,
-	       time_t *expiration)
+check_expiration(krb5_context context,
+		 krb5_ccache ccache,
+		 time_t *expiration)
 {
     krb5_error_code ret;
-    krb5_creds pattern;
-    krb5_creds creds;
-    krb5_const_realm client_realm;
-    int expired;
+    time_t t;
 
-    krb5_cc_clear_mcred(&pattern);
-
-    client_realm = krb5_principal_get_realm(context, principal);
-
-    ret = krb5_make_principal (context, &pattern.server,
-			       client_realm, KRB5_TGS_NAME, client_realm, NULL);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_make_principal");
-    pattern.client = principal;
-
-    ret = krb5_cc_retrieve_cred (context, ccache, 0, &pattern, &creds);
-    krb5_free_principal (context, pattern.server);
-    if (ret) {
-	if (ret == KRB5_CC_END)
-	    return 1;
-	krb5_err (context, 1, ret, "krb5_cc_retrieve_cred");
-    }
-
-    expired = time(NULL) > creds.times.endtime;
+    ret = krb5_cc_get_lifetime(context, ccache, &t);
+    if (ret || t == 0)
+	return 1;
 
     if (expiration)
-	*expiration = creds.times.endtime;
+	*expiration = time(NULL) + t;
 
-    krb5_free_cred_contents (context, &creds);
-
-    return expired;
+    return 0;
 }
 
 /*
@@ -450,7 +448,8 @@ display_tokens(int do_verbose)
 static int
 display_v5_ccache (krb5_context context, krb5_ccache ccache,
 		   int do_test, int do_verbose,
-		   int do_flags, int do_hidden)
+		   int do_flags, int do_hidden,
+		   int do_json)
 {
     krb5_error_code ret;
     krb5_principal principal;
@@ -459,6 +458,10 @@ display_v5_ccache (krb5_context context, krb5_ccache ccache,
 
     ret = krb5_cc_get_principal (context, ccache, &principal);
     if (ret) {
+	if (do_json) {
+	    printf("{}");
+	    return 0;
+	}
 	if(ret == ENOENT) {
 	    if (!do_test)
 		krb5_warnx(context, N_("No ticket file: %s", ""),
@@ -468,10 +471,10 @@ display_v5_ccache (krb5_context context, krb5_ccache ccache,
 	    krb5_err (context, 1, ret, "krb5_cc_get_principal");
     }
     if (do_test)
-	exit_status = check_for_tgt (context, ccache, principal, NULL);
+	exit_status = check_expiration(context, ccache, NULL);
     else
 	print_tickets (context, ccache, principal, do_verbose,
-		       do_flags, do_hidden);
+		       do_flags, do_hidden, do_json);
 
     ret = krb5_cc_close (context, ccache);
     if (ret)
@@ -487,9 +490,9 @@ display_v5_ccache (krb5_context context, krb5_ccache ccache,
  */
 
 static int
-list_caches(krb5_context context)
+list_caches(krb5_context context, struct klist_options *opt)
 {
-    krb5_cc_cache_cursor cursor;
+    krb5_cccol_cursor cursor;
     const char *cdef_name;
     char *def_name;
     krb5_error_code ret;
@@ -501,51 +504,55 @@ list_caches(krb5_context context)
 	krb5_errx(context, 1, "krb5_cc_default_name");
     def_name = strdup(cdef_name);
 
-    ret = krb5_cc_cache_get_first (context, NULL, &cursor);
-    if (ret == KRB5_CC_NOSUPP)
+    ret = krb5_cccol_cursor_new(context, &cursor);
+    if (ret == KRB5_CC_NOSUPP) {
+        free(def_name);
 	return 0;
+    }
     else if (ret)
 	krb5_err (context, 1, ret, "krb5_cc_cache_get_first");
 
     ct = rtbl_create();
+    rtbl_add_column(ct, COL_DEFCACHE, 0);
     rtbl_add_column(ct, COL_NAME, 0);
     rtbl_add_column(ct, COL_CACHENAME, 0);
     rtbl_add_column(ct, COL_EXPIRES, 0);
     rtbl_add_column(ct, COL_DEFCACHE, 0);
     rtbl_set_prefix(ct, "   ");
-    rtbl_set_column_prefix(ct, COL_NAME, "");
+    rtbl_set_column_prefix(ct, COL_DEFCACHE, "");
+    rtbl_set_column_prefix(ct, COL_NAME, " ");
+    if (opt->json_flag)
+	rtbl_set_flags(ct, RTBL_JSON);
 
-    while (krb5_cc_cache_next (context, cursor, &id) == 0) {
-	krb5_principal principal = NULL;
+    while (krb5_cccol_cursor_next(context, cursor, &id) == 0) {
 	int expired = 0;
 	char *name;
 	time_t t;
 
-	ret = krb5_cc_get_principal(context, id, &principal);
-	if (ret)
-	    continue;
-
-	expired = check_for_tgt (context, id, principal, &t);
+	expired = check_expiration(context, id, &t);
 
 	ret = krb5_cc_get_friendly_name(context, id, &name);
 	if (ret == 0) {
 	    const char *str;
 	    char *fname;
+
 	    rtbl_add_column_entry(ct, COL_NAME, name);
-	    rtbl_add_column_entry(ct, COL_CACHENAME,
-				  krb5_cc_get_name(context, id));
+	    free(name);
+
 	    if (expired)
 		str = N_(">>> Expired <<<", "");
 	    else
 		str = printable_time(t);
 	    rtbl_add_column_entry(ct, COL_EXPIRES, str);
-	    free(name);
 
 	    ret = krb5_cc_get_full_name(context, id, &fname);
 	    if (ret)
 		krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 
-	    if (strcmp(fname, def_name) == 0)
+	    rtbl_add_column_entry(ct, COL_CACHENAME, fname);
+	    if (opt->json_flag)
+		;
+	    else if (strcmp(fname, def_name) == 0)
 		rtbl_add_column_entry(ct, COL_DEFCACHE, "*");
 	    else
 		rtbl_add_column_entry(ct, COL_DEFCACHE, "");
@@ -553,16 +560,17 @@ list_caches(krb5_context context)
 	    krb5_xfree(fname);
 	}
 	krb5_cc_close(context, id);
-
-	krb5_free_principal(context, principal);
     }
 
-    krb5_cc_cache_end_seq_get(context, cursor);
+    krb5_cccol_cursor_free(context, &cursor);
 
     free(def_name);
     rtbl_format(ct, stdout);
     rtbl_destroy(ct);
 
+    if (opt->json_flag)
+	printf("\n");
+
     return 0;
 }
 
@@ -584,8 +592,13 @@ klist(struct klist_options *opt, int argc, char **argv)
 	opt->test_flag ||
 	opt->s_flag;
 
+    if(opt->version_flag) {
+	print_version(NULL);
+	exit(0);
+    }
+
     if (opt->list_all_flag) {
-	exit_status = list_caches(kcc_context);
+	exit_status = list_caches(heimtools_context, opt);
 	return exit_status;
     }
 
@@ -594,33 +607,42 @@ klist(struct klist_options *opt, int argc, char **argv)
 
 	if (opt->all_content_flag) {
 	    krb5_cc_cache_cursor cursor;
+	    int first = 1;
 
-	    ret = krb5_cc_cache_get_first(kcc_context, NULL, &cursor);
+	    ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 	    if (ret)
-		krb5_err(kcc_context, 1, ret, "krb5_cc_cache_get_first");
+		krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 
+	    if (opt->json_flag)
+		printf("[");
+	    while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
+		if (opt->json_flag && !first)
+		    printf(",");
 
-	    while (krb5_cc_cache_next(kcc_context, cursor, &id) == 0) {
-		exit_status |= display_v5_ccache(kcc_context, id, do_test,
+		exit_status |= display_v5_ccache(heimtools_context, id, do_test,
 						 do_verbose, opt->flags_flag,
-						 opt->hidden_flag);
-		printf("\n\n");
-	    }
-	    krb5_cc_cache_end_seq_get(kcc_context, cursor);
+						 opt->hidden_flag, opt->json_flag);
+		if (!opt->json_flag)
+		    printf("\n\n");
 
+		first = 0;
+	    }
+	    krb5_cc_cache_end_seq_get(heimtools_context, cursor);
+	    if (opt->json_flag)
+		printf("]");
 	} else {
 	    if(opt->cache_string) {
-		ret = krb5_cc_resolve(kcc_context, opt->cache_string, &id);
+		ret = krb5_cc_resolve(heimtools_context, opt->cache_string, &id);
 		if (ret)
-		    krb5_err(kcc_context, 1, ret, "%s", opt->cache_string);
+		    krb5_err(heimtools_context, 1, ret, "%s", opt->cache_string);
 	    } else {
-		ret = krb5_cc_default(kcc_context, &id);
+		ret = krb5_cc_default(heimtools_context, &id);
 		if (ret)
-		    krb5_err(kcc_context, 1, ret, "krb5_cc_resolve");
+		    krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve");
 	    }
-	    exit_status = display_v5_ccache(kcc_context, id, do_test,
+	    exit_status = display_v5_ccache(heimtools_context, id, do_test,
 					    do_verbose, opt->flags_flag,
-					    opt->hidden_flag);
+					    opt->hidden_flag, opt->json_flag);
 	}
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kswitch.1 b/crypto/external/bsd/heimdal/dist/kuser/kswitch.1
index 81b808c94..517e7b62d 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kswitch.1
+++ b/crypto/external/bsd/heimdal/dist/kuser/kswitch.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kswitch.1,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $
+.\"	$NetBSD: kswitch.1,v 1.2 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2009 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd Augusti 25, 2009
-.Dt KSWITCH SECTION
-.Os OPERATING_SYSTEM
+.Dd August 25, 2009
+.Dt KSWITCH 1
+.Os
 .Sh NAME
 .Nm kswitch
 .Nd switch between default credential caches
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kswitch.c b/crypto/external/bsd/heimdal/dist/kuser/kswitch.c
index 636b72c45..1cd2802cf 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kswitch.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kswitch.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kswitch.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kswitch.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 - 2010 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
  */
 
 #include "kuser_locl.h"
-#include "kcc-commands.h"
+#include "heimtools-commands.h"
 
 #ifdef HAVE_READLINE
 char *readline(const char *prompt);
@@ -65,7 +65,7 @@ kswitch(struct kswitch_options *opt, int argc, char **argv)
     krb5_ccache id = NULL;
 
     if (opt->cache_string && opt->principal_string)
-	krb5_errx(kcc_context, 1,
+	krb5_errx(heimtools_context, 1,
 		  N_("Both --cache and --principal given, choose one", ""));
 
     if (opt->interactive_flag) {
@@ -83,32 +83,34 @@ kswitch(struct kswitch_options *opt, int argc, char **argv)
         rtbl_add_column_by_id(ct, 2, "Type", 0);
         rtbl_set_column_affix_by_id(ct, 2, "  ", "");
 
-	ret = krb5_cc_cache_get_first(kcc_context, NULL, &cursor);
+	ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "krb5_cc_cache_get_first");
+	    krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 
-	while (krb5_cc_cache_next(kcc_context, cursor, &id) == 0) {
+	while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
 	    krb5_principal p;
 	    char num[10];
 
-	    ret = krb5_cc_get_principal(kcc_context, id, &p);
-	    if (ret)
+	    ret = krb5_cc_get_principal(heimtools_context, id, &p);
+	    if (ret) {
+                krb5_cc_close(heimtools_context, id);
 		continue;
+            }
 
-	    ret = krb5_unparse_name(kcc_context, p, &name);
-	    krb5_free_principal(kcc_context, p);
+	    ret = krb5_unparse_name(heimtools_context, p, &name);
+	    krb5_free_principal(heimtools_context, p);
 
 	    snprintf(num, sizeof(num), "%d", (int)(len + 1));
 	    rtbl_add_column_entry_by_id(ct, 0, num);
 	    rtbl_add_column_entry_by_id(ct, 1, name);
-            rtbl_add_column_entry_by_id(ct, 2, krb5_cc_get_type(kcc_context, id));
+            rtbl_add_column_entry_by_id(ct, 2, krb5_cc_get_type(heimtools_context, id));
 	    free(name);
 
 	    ids = erealloc(ids, (len + 1) * sizeof(ids[0]));
 	    ids[len] = id;
 	    len++;
 	}
-	krb5_cc_cache_end_seq_get(kcc_context, cursor);
+	krb5_cc_cache_end_seq_get(heimtools_context, cursor);
 
 	rtbl_format(ct, stdout);
 	rtbl_destroy(ct);
@@ -117,58 +119,62 @@ kswitch(struct kswitch_options *opt, int argc, char **argv)
 	if (name) {
 	    i = atoi(name);
 	    if (i == 0)
-		krb5_errx(kcc_context, 1, "Cache number '%s' is invalid", name);
+		krb5_errx(heimtools_context, 1, "Cache number '%s' is invalid", name);
 	    if (i > len)
-		krb5_errx(kcc_context, 1, "Cache number '%s' is too large", name);
+		krb5_errx(heimtools_context, 1, "Cache number '%s' is too large", name);
 
 	    id = ids[i - 1];
 	    ids[i - 1] = NULL;
+	    free(name);
 	} else
-	    krb5_errx(kcc_context, 1, "No cache selected");
+	    krb5_errx(heimtools_context, 1, "No cache selected");
 	for (i = 0; i < len; i++)
 	    if (ids[i])
-		krb5_cc_close(kcc_context, ids[i]);
-
+		krb5_cc_close(heimtools_context, ids[i]);
+	free(ids);
     } else if (opt->principal_string) {
 	krb5_principal p;
 
-	ret = krb5_parse_name(kcc_context, opt->principal_string, &p);
+	ret = krb5_parse_name(heimtools_context, opt->principal_string, &p);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "krb5_parse_name: %s",
+	    krb5_err(heimtools_context, 1, ret, "krb5_parse_name: %s",
 		     opt->principal_string);
 
-	ret = krb5_cc_cache_match(kcc_context, p, &id);
+	ret = krb5_cc_cache_match(heimtools_context, p, &id);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret,
+	    krb5_err(heimtools_context, 1, ret,
 		     N_("Did not find principal: %s", ""),
 		     opt->principal_string);
 
-	krb5_free_principal(kcc_context, p);
+	krb5_free_principal(heimtools_context, p);
 
     } else if (opt->cache_string) {
 	const krb5_cc_ops *ops;
 	char *str;
+	int aret;
 
-	ops = krb5_cc_get_prefix_ops(kcc_context, opt->type_string);
+	ops = krb5_cc_get_prefix_ops(heimtools_context, opt->type_string);
 	if (ops == NULL)
-	    krb5_err(kcc_context, 1, 0, "krb5_cc_get_prefix_ops");
+	    krb5_err(heimtools_context, 1, 0, "krb5_cc_get_prefix_ops");
 
-	asprintf(&str, "%s:%s", ops->prefix, opt->cache_string);
-	if (str == NULL)
-	    krb5_errx(kcc_context, 1, N_("out of memory", ""));
+	aret = asprintf(&str, "%s:%s", ops->prefix, opt->cache_string);
+	if (aret == -1)
+	    krb5_errx(heimtools_context, 1, N_("out of memory", ""));
 
-	ret = krb5_cc_resolve(kcc_context, str, &id);
+	ret = krb5_cc_resolve(heimtools_context, str, &id);
 	if (ret)
-	    krb5_err(kcc_context, 1, ret, "krb5_cc_resolve: %s", str);
+	    krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve: %s", str);
 
 	free(str);
     } else {
-	krb5_errx(kcc_context, 1, "missing option for kswitch");
+	krb5_errx(heimtools_context, 1, "missing option for kswitch");
     }
 
-    ret = krb5_cc_switch(kcc_context, id);
+    ret = krb5_cc_switch(heimtools_context, id);
     if (ret)
-	krb5_err(kcc_context, 1, ret, "krb5_cc_switch");
+	krb5_err(heimtools_context, 1, ret, "krb5_cc_switch");
+
+    krb5_cc_close(heimtools_context, id);
 
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kuser_locl.h b/crypto/external/bsd/heimdal/dist/kuser/kuser_locl.h
index 1b1a89f57..76fa91d47 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kuser_locl.h
+++ b/crypto/external/bsd/heimdal/dist/kuser/kuser_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kuser_locl.h,v 1.1.1.2 2011/04/14 14:08:19 elric Exp $	*/
+/*	$NetBSD: kuser_locl.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -105,6 +105,6 @@
 #define textdomain(package)
 #endif
 
-extern krb5_context kcc_context;
+extern krb5_context heimtools_context;
 
 #endif /* __KUSER_LOCL_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kverify.c b/crypto/external/bsd/heimdal/dist/kuser/kverify.c
index 460adc75f..2be2de8be 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kverify.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kverify.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kverify.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kverify.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005, 2007 Kungliga Tekniska Högskolan
@@ -39,8 +39,8 @@ static int help_flag = 0;
 static int version_flag = 0;
 
 static struct getargs args[] = {
-    { "version", 	0,   arg_flag, &version_flag },
-    { "help",		0,   arg_flag, &help_flag }
+    { "version", 	0,   arg_flag, &version_flag, NULL, NULL },
+    { "help",		0,   arg_flag, &help_flag,    NULL, NULL }
 };
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/kuser/kvno.c b/crypto/external/bsd/heimdal/dist/kuser/kvno.c
index c0b04de64..ac6a4000c 100644
--- a/crypto/external/bsd/heimdal/dist/kuser/kvno.c
+++ b/crypto/external/bsd/heimdal/dist/kuser/kvno.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kvno.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: kvno.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (C) 1998 by the FundsXpress, INC.
diff --git a/crypto/external/bsd/heimdal/dist/lib/45/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/45/NTMakefile
deleted file mode 100644
index 1844f93b5..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/45/NTMakefile
+++ /dev/null
@@ -1,35 +0,0 @@
-########################################################################
-#
-# Copyright (c) 2009, Secure Endpoints Inc.
-# All rights reserved.
-# 
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 
-# - Redistributions of source code must retain the above copyright
-#   notice, this list of conditions and the following disclaimer.
-# 
-# - Redistributions in binary form must reproduce the above copyright
-#   notice, this list of conditions and the following disclaimer in
-#   the documentation and/or other materials provided with the
-#   distribution.
-# 
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
-# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
-# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
-# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-# POSSIBILITY OF SUCH DAMAGE.
-# 
-
-RELDIR=.\lib\45 
-
-!include ../../windows/NTMakefile.w32 
-
diff --git a/crypto/external/bsd/heimdal/dist/lib/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/Makefile.am
index 53b004a22..8178c5f7d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/Makefile.am
@@ -14,15 +14,19 @@ endif
 if COM_ERR
 dir_com_err = com_err
 endif
-if !HAVE_OPENSSL
-dir_hcrypto = hcrypto
-endif
 if !SQLITE3
 dir_sqlite = sqlite
 endif
+if MAINTAINER_MODE
+dir_sqlite = sqlite
+endif
+if !NO_AFS
+dir_afs = kafs
+endif
 
 SUBDIRS = \
 	roken \
+	base \
 	vers \
 	$(dir_editline) \
 	$(dir_com_err) \
@@ -30,16 +34,16 @@ SUBDIRS = \
 	wind \
 	asn1 \
 	$(dir_sqlite) \
-	$(dir_hcrypto) \
+	hcrypto \
 	ipc \
 	hx509 \
 	krb5 \
 	ntlm \
-	kafs \
+	$(dir_afs) \
 	gssapi \
 	hdb \
 	kadm5 \
 	$(dir_otp) \
 	$(dir_dce)
 
-EXTRA_DIST = NTMakefile heimdal
\ No newline at end of file
+EXTRA_DIST = NTMakefile heimdal
diff --git a/crypto/external/bsd/heimdal/dist/lib/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/NTMakefile
index 62d9754ab..d5150b0b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2009,2011, Secure Endpoints Inc.
+# Copyright (c) 2009-2016, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -30,22 +30,29 @@
 # 
 
 
-!ifdef KRB4
-dir_45 = 45
-!endif
 !ifdef OTP
 dir_otp = otp
 !endif
 !ifdef DCE
 dir_dce = kdfs
 !endif
-!ifndef HAVE_OPENSSL
-dir_hcrypto = hcrypto
+
+# Third party plugins must be added to the assembly
+# Permit third party assembly scripts
+
+!if exist(..\thirdparty\plugin\NTMakefile)
+plugin=..\thirdparty\plugin
 !endif
 
-SUBDIRS = vers com_err sl wind asn1 sqlite \
-	$(dir_hcrypto) hx509 krb5 heimdal ntlm kafs gssapi hdb \
-	kadm5 $(dir_45) $(dir_otp) $(dir_dce) ..\packages\windows\assembly
+!if exist(..\thirdparty\assembly\NTMakefile)
+assembly=..\thirdparty\assembly
+!else
+assembly=..\packages\windows\assembly
+!endif
+
+SUBDIRS = roken base vers com_err sl wind asn1 sqlite \
+	hcrypto hx509 krb5 heimdal ntlm kafs gssapi hdb \
+	kadm5 $(dir_otp) $(dir_dce) $(plugin) $(assembly)
 
 !include ../windows/NTMakefile.w32
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/asn1/Makefile.am
index 459ef015b..dab5082d3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/Makefile.am
@@ -4,6 +4,8 @@ include $(top_srcdir)/Makefile.am.common
 
 YFLAGS = -d -t
 
+AM_CPPFLAGS += $(ROKEN_RENAME)
+
 lib_LTLIBRARIES = libasn1.la
 libasn1_la_LDFLAGS = -version-info 8:0:0
 
@@ -37,6 +39,7 @@ gen_files_pkinit = asn1_pkinit_asn1.x
 gen_files_pkcs12 = asn1_pkcs12_asn1.x
 gen_files_pkcs8 = asn1_pkcs8_asn1.x
 gen_files_pkcs9 = asn1_pkcs9_asn1.x
+gen_files_test_template = test_template_asn1-template.x
 gen_files_test = asn1_test_asn1.x
 gen_files_digest = asn1_digest_asn1.x
 gen_files_kx509 = asn1_kx509_asn1.x
@@ -53,7 +56,7 @@ asn1_print_SOURCES = asn1_print.c
 check_der_SOURCES = check-der.c check-common.c check-common.h
 
 check_template_SOURCES = check-template.c check-common.c check-common.h
-nodist_check_template_SOURCES = $(gen_files_test:.x=.c)
+nodist_check_template_SOURCES = $(gen_files_test_template)
 
 dist_check_gen_SOURCES = check-gen.c check-common.c check-common.h
 nodist_check_gen_SOURCES = $(gen_files_test:.x=.c)
@@ -94,8 +97,10 @@ dist_libasn1base_la_SOURCES =			\
 	der_copy.c				\
 	der_cmp.c				\
 	der_format.c				\
+	fuzzer.c				\
 	heim_asn1.h				\
 	extra.c					\
+	roken_rename.h				\
 	template.c				\
 	timegm.c
 
@@ -134,7 +139,9 @@ CLEANFILES = \
 	$(gen_files_pkcs12) \
 	$(gen_files_digest) \
 	$(gen_files_kx509) \
-	$(gen_files_test) $(nodist_check_gen_SOURCES) \
+	$(gen_files_test) \
+	$(gen_files_test_template) \
+	$(nodist_check_gen_SOURCES) \
 	asn1_err.c asn1_err.h \
 	rfc2459_asn1_files rfc2459_asn1*.h* \
 	cms_asn1_files cms_asn1*.h* \
@@ -145,9 +152,12 @@ CLEANFILES = \
 	pkcs12_asn1_files pkcs12_asn1*.h* \
 	digest_asn1_files digest_asn1*.h* \
 	kx509_asn1_files kx509_asn1*.h* \
-	test_asn1_files test_asn1*.h*
+	test_asn1_files test_asn1*.h* \
+	test_template_asn1* \
+	asn1_*.x
 
-dist_include_HEADERS = der.h heim_asn1.h der-protos.h der-private.h
+dist_include_HEADERS = der.h heim_asn1.h
+dist_include_HEADERS += $(srcdir)/der-protos.h $(srcdir)/der-private.h
 dist_include_HEADERS += asn1-common.h
 
 nodist_include_HEADERS = asn1_err.h
@@ -170,6 +180,7 @@ priv_headers += pkcs9_asn1-priv.h
 priv_headers += pkcs12_asn1-priv.h
 priv_headers += digest_asn1-priv.h
 priv_headers += kx509_asn1-priv.h
+priv_headers += test_template_asn1.h test_template_asn1-priv.h
 priv_headers += test_asn1.h test_asn1-priv.h
 
 
@@ -193,6 +204,7 @@ $(gen_files_kx509) kx509_asn1.hx kx509_asn1-priv.hx: kx509_asn1_files
 $(gen_files_rfc2459) rfc2459_asn1.hx rfc2459_asn1-priv.hx: rfc2459_asn1_files
 $(gen_files_cms) cms_asn1.hx cms_asn1-priv.hx: cms_asn1_files
 $(gen_files_test) test_asn1.hx test_asn1-priv.hx: test_asn1_files
+$(gen_files_test_template) test_template_asn1.hx test_template_asn1-priv.hx: test_template_asn1_files
 
 rfc2459_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/rfc2459.asn1
 	$(ASN1_COMPILE) --one-code-file --preserve-binary=TBSCertificate --preserve-binary=TBSCRLCertList --preserve-binary=Name --sequence=GeneralNames --sequence=Extensions --sequence=CRLDistributionPoints $(srcdir)/rfc2459.asn1 rfc2459_asn1 || (rm -f rfc2459_asn1_files ; exit 1)
@@ -221,12 +233,16 @@ digest_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/digest.asn1
 kx509_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/kx509.asn1
 	$(ASN1_COMPILE) --one-code-file $(srcdir)/kx509.asn1 kx509_asn1 || (rm -f kx509_asn1_files ; exit 1)
 
+test_template_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/test.asn1
+	$(ASN1_COMPILE) --template --sequence=TESTSeqOf $(srcdir)/test.asn1 test_template_asn1 || (rm -f test_template_asn1_files ; exit 1)
+
 test_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/test.asn1
 	$(ASN1_COMPILE) --one-code-file --sequence=TESTSeqOf $(srcdir)/test.asn1 test_asn1 || (rm -f test_asn1_files ; exit 1)
 
 
 EXTRA_DIST =		\
 	NTMakefile	\
+	README.template \
 	asn1_compile-version.rc \
 	libasn1-exports.def \
 	cms.asn1	\
@@ -247,8 +263,19 @@ EXTRA_DIST =		\
 	test.gen	\
 	version-script.map
 
-$(srcdir)/der-protos.h:
+DER_PROTOS = $(srcdir)/der-protos.h $(srcdir)/der-private.h
+
+ALL_OBJECTS  = $(libasn1_la_OBJECTS)
+ALL_OBJECTS += $(libasn1base_la_OBJECTS)
+ALL_OBJECTS += $(asn1_print_OBJECTS)
+ALL_OBJECTS += $(asn1_compile_OBJECTS)
+ALL_OBJECTS += $(asn1_gen_OBJECTS)
+ALL_OBJECTS += $(check_template_OBJECTS)
+
+$(ALL_OBJECTS): $(DER_PROTOS) asn1_err.h
+
+$(srcdir)/der-protos.h: $(dist_libasn1base_la_SOURCES)
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -o der-protos.h $(dist_libasn1base_la_SOURCES) || rm -f der-protos.h
 
-$(srcdir)/der-private.h:
+$(srcdir)/der-private.h: $(dist_libasn1base_la_SOURCES)
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p der-private.h $(dist_libasn1base_la_SOURCES) || rm -f der-private.h
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/asn1/NTMakefile
index 1ee62b198..01dc9971b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/NTMakefile
@@ -31,7 +31,7 @@
 
 RELDIR=lib\asn1
 
-intcflags=-I$(SRCDIR) -I$(OBJ)
+intcflags=-I$(SRCDIR) -I$(OBJ) -DROKEN_RENAME
 
 !include ../../windows/NTMakefile.w32
 
@@ -318,11 +318,11 @@ test-binaries: $(TEST_BINARIES)
 
 test-run:
 	cd $(OBJ)
-	check-der.exe
-	check-gen.exe
-	check-timegm.exe
-	check-ber.exe
-	check-template.exe
+	-check-der.exe
+	-check-gen.exe
+	-check-timegm.exe
+	-check-ber.exe
+	-check-template.exe
 	cd $(SRC)
 
 test:: test-binaries test-run
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-common.h b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-common.h
index b8ac37f82..9d71a94a9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-common.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-common.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1-common.h,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: asn1-common.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /* Id */
 
@@ -9,21 +9,26 @@
 #ifndef __asn1_common_definitions__
 #define __asn1_common_definitions__
 
+#ifndef __HEIM_BASE_DATA__
+#define __HEIM_BASE_DATA__ 1
+struct heim_base_data {
+	size_t length;
+	void *data;
+};
+#endif
+
 typedef struct heim_integer {
     size_t length;
     void *data;
     int negative;
 } heim_integer;
 
-typedef struct heim_octet_string {
-    size_t length;
-    void *data;
-} heim_octet_string;
+typedef struct heim_base_data heim_octet_string;
 
 typedef char *heim_general_string;
 typedef char *heim_utf8_string;
-typedef struct heim_octet_string heim_printable_string;
-typedef struct heim_octet_string heim_ia5_string;
+typedef struct heim_base_data heim_printable_string;
+typedef struct heim_base_data heim_ia5_string;
 
 typedef struct heim_bmp_string {
     size_t length;
@@ -47,8 +52,8 @@ typedef struct heim_bit_string {
     void *data;
 } heim_bit_string;
 
-typedef struct heim_octet_string heim_any;
-typedef struct heim_octet_string heim_any_set;
+typedef struct heim_base_data heim_any;
+typedef struct heim_base_data heim_any_set;
 
 #define ASN1_MALLOC_ENCODE(T, B, BL, S, L, R)                  \
   do {                                                         \
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-template.h b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-template.h
index 860b74e05..40fe1579c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-template.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1-template.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1-template.h,v 1.1.1.1 2011/04/13 18:14:39 elric Exp $	*/
+/*	$NetBSD: asn1-template.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -92,7 +92,7 @@
 
 struct asn1_template {
     uint32_t tt;
-    size_t offset;
+    uint32_t offset;
     const void *ptr;
 };
 
@@ -120,7 +120,9 @@ enum template_types {
     A1T_IMEMBER = 0,
     A1T_HEIM_INTEGER,
     A1T_INTEGER,
+    A1T_INTEGER64,
     A1T_UNSIGNED,
+    A1T_UNSIGNED64,
     A1T_GENERAL_STRING,
     A1T_OCTET_STRING,
     A1T_OCTET_STRING_BER,
@@ -136,8 +138,72 @@ enum template_types {
     A1T_BOOLEAN,
     A1T_OID,
     A1T_TELETEX_STRING,
-    A1T_NULL
+    A1T_NUM_ENTRY
 };
 
+extern struct asn1_type_func asn1_template_prim[A1T_NUM_ENTRY];
+
+#define ABORT_ON_ERROR() abort()
+
+#define DPOC(data,offset) ((const void *)(((const unsigned char *)data)  + offset))
+#define DPO(data,offset) ((void *)(((unsigned char *)data)  + offset))
+
+/*
+ * These functions are needed by the generated template stubs and are
+ * really internal functions. Since they are part of der-private.h
+ * that contains extra prototypes that really a private we included a
+ * copy here.
+ */
+
+int
+_asn1_copy_top (
+	const struct asn1_template * /*t*/,
+	const void * /*from*/,
+	void * /*to*/);
+
+void
+_asn1_free_top(const struct asn1_template *t,
+	       void *data);
+
+int
+_asn1_decode_top (
+	const struct asn1_template * /*t*/,
+	unsigned /*flags*/,
+	const unsigned char * /*p*/,
+	size_t /*len*/,
+	void * /*data*/,
+	size_t * /*size*/);
+
+int
+_asn1_encode (
+	const struct asn1_template * /*t*/,
+	unsigned char * /*p*/,
+	size_t /*len*/,
+	const void * /*data*/,
+	size_t * /*size*/);
+
+int
+_asn1_encode_fuzzer (
+	const struct asn1_template * /*t*/,
+	unsigned char * /*p*/,
+	size_t /*len*/,
+	const void * /*data*/,
+	size_t * /*size*/);
+
+void
+_asn1_free (
+	const struct asn1_template * /*t*/,
+	void * /*data*/);
+
+size_t
+_asn1_length (
+	const struct asn1_template * /*t*/,
+	const void * /*data*/);
+
+size_t
+_asn1_length_fuzzer (
+	const struct asn1_template * /*t*/,
+	const void * /*data*/);
+
 
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_gen.c b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_gen.c
index 5140a0eb4..a0bb42b27 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_gen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_gen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1_gen.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: asn1_gen.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -42,7 +42,7 @@
 #include <krb5/hex.h>
 #include <err.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: asn1_gen.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static int
 doit(const char *fn)
@@ -152,8 +152,8 @@ doit(const char *fn)
 static int version_flag;
 static int help_flag;
 struct getargs args[] = {
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_print.c b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_print.c
index 668b4b693..ab47cd831 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_print.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_print.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1_print.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: asn1_print.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -176,14 +176,14 @@ loop (unsigned char *buf, size_t len, int indent)
 		printf ("(length %lu), ", (unsigned long)length);
 
 		if (inner_flag) {
-		    Der_class class;
-		    Der_type type;
-		    unsigned int tag;
+		    Der_class class2;
+		    Der_type type2;
+		    unsigned int tag2;
 
 		    ret = der_get_tag(str.data, str.length,
-				      &class, &type, &tag, &sz);
+				      &class2, &type2, &tag2, &sz);
 		    if (ret || sz > str.length ||
-			type != CONS || tag != UT_Sequence)
+			type2 != CONS || tag2 != UT_Sequence)
 			goto just_an_octet_string;
 
 		    printf("{\n");
@@ -317,10 +317,11 @@ doit (const char *filename)
 static int version_flag;
 static int help_flag;
 struct getargs args[] = {
-    { "indent", 0, arg_negative_flag, &indent_flag },
-    { "inner", 0, arg_flag, &inner_flag, "try to parse inner structures of OCTET STRING" },
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "indent", 0, arg_negative_flag, &indent_flag, NULL, NULL },
+    { "inner", 0, arg_flag, &inner_flag,
+      "try to parse inner structures of OCTET STRING", NULL },
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_queue.h b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_queue.h
index 03603ac39..70cc85a64 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_queue.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1_queue.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1_queue.h,v 1.1.1.2 2011/04/14 14:08:19 elric Exp $	*/
+/*	$NetBSD: asn1_queue.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*	NetBSD: queue.h,v 1.38 2004/04/18 14:12:05 lukem Exp	*/
 /*	Id */
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1parse.y b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1parse.y
index 051440655..e295be350 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/asn1parse.y
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/asn1parse.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1parse.y,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: asn1parse.y,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -43,14 +43,13 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdint.h>
 #include <string.h>
 #include "symbol.h"
 #include "lex.h"
 #include "gen_locl.h"
 #include "der.h"
 
-__RCSID("NetBSD");
-
 static Type *new_type (Typetype t);
 static struct constraint_spec *new_constraint_spec(enum ctype);
 static Type *new_tag(int tagclass, int tagvalue, int tagenv, Type *oldtype);
@@ -64,6 +63,8 @@ struct string_list {
     struct string_list *next;
 };
 
+static int default_tag_env = TE_EXPLICIT;
+
 /* Declarations for Bison */
 #define YYMALLOC malloc
 #define YYFREE   free
@@ -71,7 +72,7 @@ struct string_list {
 %}
 
 %union {
-    int constant;
+    int64_t constant;
     struct value *value;
     struct range *range;
     char *name;
@@ -245,9 +246,10 @@ ModuleDefinition: IDENTIFIER objid_opt kw_DEFINITIONS TagDefault ExtensionDefaul
 		}
 		;
 
-TagDefault	: kw_EXPLICIT kw_TAGS
+TagDefault	: kw_EXPLICIT kw_TAGS 
+			{ default_tag_env = TE_EXPLICIT; }
 		| kw_IMPLICIT kw_TAGS
-		      { lex_error_message("implicit tagging is not supported"); }
+			{ default_tag_env = TE_IMPLICIT; }
 		| kw_AUTOMATIC kw_TAGS
 		      { lex_error_message("automatic tagging is not supported"); }
 		| /* empty */
@@ -372,14 +374,14 @@ range		: '(' Value RANGE Value ')'
 			lex_error_message("Non-integer in first part of range");
 		    $$ = ecalloc(1, sizeof(*$$));
 		    $$->min = $2->u.integervalue;
-		    $$->max = $2->u.integervalue - 1;
+		    $$->max = INT_MAX;
 		}
 		| '(' kw_MIN RANGE Value ')'
 		{
 		    if($4->type != integervalue)
 			lex_error_message("Non-integer in second part of range");
 		    $$ = ecalloc(1, sizeof(*$$));
-		    $$->min = $4->u.integervalue + 2;
+		    $$->min = INT_MIN;
 		    $$->max = $4->u.integervalue;
 		}
 		| '(' Value ')'
@@ -476,6 +478,11 @@ OctetStringType	: kw_OCTET kw_STRING size
 		{
 		    Type *t = new_type(TOctetString);
 		    t->range = $3;
+		    if (t->range) {
+			if (t->range->min < 0)
+			    lex_error_message("can't use a negative SIZE range "
+					      "length for OCTET STRING");
+		    }
 		    $$ = new_tag(ASN1_C_UNIV, UT_OctetString,
 				 TE_EXPLICIT, t);
 		}
@@ -499,13 +506,13 @@ SequenceType	: kw_SEQUENCE '{' /* ComponentTypeLists */ ComponentTypeList '}'
 		{
 		  $$ = new_type(TSequence);
 		  $$->members = $3;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, default_tag_env, $$);
 		}
 		| kw_SEQUENCE '{' '}'
 		{
 		  $$ = new_type(TSequence);
 		  $$->members = NULL;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, default_tag_env, $$);
 		}
 		;
 
@@ -513,8 +520,14 @@ SequenceOfType	: kw_SEQUENCE size kw_OF Type
 		{
 		  $$ = new_type(TSequenceOf);
 		  $$->range = $2;
+		  if ($$->range) {
+		      if ($$->range->min < 0)
+			  lex_error_message("can't use a negative SIZE range "
+					    "length for SEQUENCE OF");
+		    }
+
 		  $$->subtype = $4;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Sequence, default_tag_env, $$);
 		}
 		;
 
@@ -522,13 +535,13 @@ SetType		: kw_SET '{' /* ComponentTypeLists */ ComponentTypeList '}'
 		{
 		  $$ = new_type(TSet);
 		  $$->members = $3;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Set, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Set, default_tag_env, $$);
 		}
 		| kw_SET '{' '}'
 		{
 		  $$ = new_type(TSet);
 		  $$->members = NULL;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Set, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Set, default_tag_env, $$);
 		}
 		;
 
@@ -536,7 +549,7 @@ SetOfType	: kw_SET kw_OF Type
 		{
 		  $$ = new_type(TSetOf);
 		  $$->subtype = $3;
-		  $$ = new_tag(ASN1_C_UNIV, UT_Set, TE_EXPLICIT, $$);
+		  $$ = new_tag(ASN1_C_UNIV, UT_Set, default_tag_env, $$);
 		}
 		;
 
@@ -638,11 +651,16 @@ TaggedType	: Tag tagenv Type
 			$$ = new_type(TTag);
 			$$->tag = $1;
 			$$->tag.tagenv = $2;
-			if($3->type == TTag && $2 == TE_IMPLICIT) {
+			if (template_flag) {
+			    $$->subtype = $3;
+			} else {
+			    if($3->type == TTag && $2 == TE_IMPLICIT) {
 				$$->subtype = $3->subtype;
 				free($3);
-			} else
+			    } else {
 				$$->subtype = $3;
+			    }
+			}
 		}
 		;
 
@@ -650,7 +668,7 @@ Tag		: '[' Class NUMBER ']'
 		{
 			$$.tagclass = $2;
 			$$.tagvalue = $3;
-			$$.tagenv = TE_EXPLICIT;
+			$$.tagenv = default_tag_env;
 		}
 		;
 
@@ -674,11 +692,11 @@ Class		: /* */
 
 tagenv		: /* */
 		{
-			$$ = TE_EXPLICIT;
+			$$ = default_tag_env;
 		}
 		| kw_EXPLICIT
 		{
-			$$ = TE_EXPLICIT;
+			$$ = default_tag_env;
 		}
 		| kw_IMPLICIT
 		{
@@ -989,11 +1007,14 @@ add_oid_to_tail(struct objid *head, struct objid *tail)
     o->next = tail;
 }
 
+static unsigned long idcounter;
+
 static Type *
 new_type (Typetype tt)
 {
     Type *t = ecalloc(1, sizeof(*t));
     t->type = tt;
+    t->id = idcounter++;
     return t;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-ber.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-ber.c
index d869e7cbb..ba87f0499 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-ber.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-ber.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-ber.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: check-ber.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 #include <krb5/cms_asn1.h>
 
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: check-ber.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static const unsigned char *contentdata = (unsigned char *)
     "\x30\x80\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x07\x02\xa0\x80\x30"
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.c
index 1ae730481..bb56e06f0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-common.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: check-common.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2006 Kungliga Tekniska Högskolan
@@ -35,9 +35,7 @@
  * SUCH DAMAGE.
  */
 
-#ifdef HAVE_CONFIG_H
 #include <config.h>
-#endif
 #ifdef HAVE_SYS_MMAN_H
 #include <sys/mman.h>
 #endif
@@ -49,8 +47,6 @@
 #include <krb5/asn1-common.h>
 #include "check-common.h"
 
-__RCSID("NetBSD");
-
 struct map_page {
     void *start;
     size_t size;
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.h b/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.h
index 54351ee42..0f112bc66 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-common.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-common.h,v 1.1.1.1 2011/04/13 18:14:39 elric Exp $	*/
+/*	$NetBSD: check-common.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
@@ -35,9 +35,26 @@
  * SUCH DAMAGE.
  */
 
+#define IF_OPT_COMPARE(ac,bc,e) \
+	if (((ac)->e == NULL && (bc)->e != NULL) || (((ac)->e != NULL && (bc)->e == NULL))) return 1; if ((ac)->e)
+#define COMPARE_OPT_STRING(ac,bc,e) \
+	do { if (strcmp(*(ac)->e, *(bc)->e) != 0) return 1; } while(0)
+#define COMPARE_OPT_OCTET_STRING(ac,bc,e) \
+	do { if ((ac)->e->length != (bc)->e->length || memcmp((ac)->e->data, (bc)->e->data, (ac)->e->length) != 0) return 1; } while(0)
+#define COMPARE_STRING(ac,bc,e) \
+	do { if (strcmp((ac)->e, (bc)->e) != 0) return 1; } while(0)
+#define COMPARE_INTEGER(ac,bc,e) \
+	do { if ((ac)->e != (bc)->e) return 1; } while(0)
+#define COMPARE_OPT_INTEGER(ac,bc,e) \
+	do { if (*(ac)->e != *(bc)->e) return 1; } while(0)
+#define COMPARE_MEM(ac,bc,e,len) \
+	do { if (memcmp((ac)->e, (bc)->e,len) != 0) return 1; } while(0)
+#define COMPARE_OCTET_STRING(ac,bc,e) \
+	do { if ((ac)->e.length != (bc)->e.length || memcmp((ac)->e.data, (bc)->e.data, (ac)->e.length) != 0) return 1; } while(0)
+
 struct test_case {
     void *val;
-    int byte_len;
+    ssize_t byte_len;
     const char *bytes;
     char *name;
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-der.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-der.c
index 83646e852..5ee8b563e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-der.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-der.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-der.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: check-der.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2007 Kungliga Tekniska Högskolan
@@ -45,7 +45,7 @@
 
 #include "check-common.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: check-der.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static int
 cmp_integer (void *a, void *b)
@@ -60,16 +60,16 @@ static int
 test_integer (void)
 {
     struct test_case tests[] = {
-	{NULL, 1, "\x00"},
-	{NULL, 1, "\x7f"},
-	{NULL, 2, "\x00\x80"},
-	{NULL, 2, "\x01\x00"},
-	{NULL, 1, "\x80"},
-	{NULL, 2, "\xff\x7f"},
-	{NULL, 1, "\xff"},
-	{NULL, 2, "\xff\x01"},
-	{NULL, 2, "\x00\xff"},
-	{NULL, 4, "\x7f\xff\xff\xff"}
+	{NULL, 1, "\x00", 		NULL },
+	{NULL, 1, "\x7f", 		NULL },
+	{NULL, 2, "\x00\x80", 		NULL },
+	{NULL, 2, "\x01\x00", 		NULL },
+	{NULL, 1, "\x80", 		NULL },
+	{NULL, 2, "\xff\x7f", 		NULL },
+	{NULL, 1, "\xff", 		NULL },
+	{NULL, 2, "\xff\x01", 		NULL },
+	{NULL, 2, "\x00\xff", 		NULL },
+	{NULL, 4, "\x7f\xff\xff\xff", 	NULL }
     };
 
     int values[] = {0, 127, 128, 256, -128, -129, -1, -255, 255,
@@ -186,14 +186,14 @@ static int
 test_unsigned (void)
 {
     struct test_case tests[] = {
-	{NULL, 1, "\x00"},
-	{NULL, 1, "\x7f"},
-	{NULL, 2, "\x00\x80"},
-	{NULL, 2, "\x01\x00"},
-	{NULL, 2, "\x02\x00"},
-	{NULL, 3, "\x00\x80\x00"},
-	{NULL, 5, "\x00\x80\x00\x00\x00"},
-	{NULL, 4, "\x7f\xff\xff\xff"}
+	{NULL, 1, "\x00", 			NULL },
+	{NULL, 1, "\x7f", 			NULL },
+	{NULL, 2, "\x00\x80", 			NULL },
+	{NULL, 2, "\x01\x00", 			NULL },
+	{NULL, 2, "\x02\x00", 			NULL },
+	{NULL, 3, "\x00\x80\x00", 		NULL },
+	{NULL, 5, "\x00\x80\x00\x00\x00",	NULL },
+	{NULL, 4, "\x7f\xff\xff\xff", 		NULL }
     };
 
     unsigned int values[] = {0, 127, 128, 256, 512, 32768,
@@ -224,13 +224,7 @@ test_unsigned (void)
 static int
 cmp_octet_string (void *a, void *b)
 {
-    heim_octet_string *oa = (heim_octet_string *)a;
-    heim_octet_string *ob = (heim_octet_string *)b;
-
-    if (oa->length != ob->length)
-	return ob->length - oa->length;
-
-    return (memcmp (oa->data, ob->data, oa->length));
+    return der_heim_octet_string_cmp(a, b);
 }
 
 static int
@@ -239,7 +233,7 @@ test_octet_string (void)
     heim_octet_string s1 = {8, "\x01\x23\x45\x67\x89\xab\xcd\xef"};
 
     struct test_case tests[] = {
-	{NULL, 8, "\x01\x23\x45\x67\x89\xab\xcd\xef"}
+	{NULL, 8, "\x01\x23\x45\x67\x89\xab\xcd\xef", NULL }
     };
     int ntests = sizeof(tests) / sizeof(*tests);
     int ret;
@@ -280,8 +274,8 @@ test_bmp_string (void)
     heim_bmp_string s2 = { 2, bmp_d2 };
 
     struct test_case tests[] = {
-	{NULL, 2, "\x00\x20"},
-	{NULL, 4, "\x00\x20\x00\x20"}
+	{NULL, 2, "\x00\x20", 		NULL },
+	{NULL, 4, "\x00\x20\x00\x20", 	NULL }
     };
     int ntests = sizeof(tests) / sizeof(*tests);
     int ret;
@@ -328,8 +322,8 @@ test_universal_string (void)
     heim_universal_string s2 = { 2, universal_d2 };
 
     struct test_case tests[] = {
-	{NULL, 4, "\x00\x00\x00\x20"},
-	{NULL, 8, "\x00\x00\x00\x20\x00\x00\x00\x20"}
+	{NULL, 4, "\x00\x00\x00\x20", 			NULL },
+	{NULL, 8, "\x00\x00\x00\x20\x00\x00\x00\x20", 	NULL }
     };
     int ntests = sizeof(tests) / sizeof(*tests);
     int ret;
@@ -372,7 +366,7 @@ test_general_string (void)
     char *s1 = "Test User 1";
 
     struct test_case tests[] = {
-	{NULL, 11, "\x54\x65\x73\x74\x20\x55\x73\x65\x72\x20\x31"}
+	{NULL, 11, "\x54\x65\x73\x74\x20\x55\x73\x65\x72\x20\x31", NULL }
     };
     int ret, ntests = sizeof(tests) / sizeof(*tests);
 
@@ -399,15 +393,15 @@ cmp_generalized_time (void *a, void *b)
     time_t *ta = (time_t *)a;
     time_t *tb = (time_t *)b;
 
-    return *tb - *ta;
+    return (int)(*tb - *ta);
 }
 
 static int
 test_generalized_time (void)
 {
     struct test_case tests[] = {
-	{NULL, 15, "19700101000000Z"},
-	{NULL, 15, "19851106210627Z"}
+	{NULL, 15, "19700101000000Z", 		NULL },
+	{NULL, 15, "19851106210627Z", 		NULL }
     };
     time_t values[] = {0, 500159187};
     int i, ret;
@@ -448,10 +442,10 @@ static int
 test_oid (void)
 {
     struct test_case tests[] = {
-	{NULL, 2, "\x29\x01"},
-	{NULL, 1, "\x29"},
-	{NULL, 2, "\xff\x01"},
-	{NULL, 1, "\xff"}
+	{NULL, 2, "\x29\x01", 		NULL },
+	{NULL, 1, "\x29", 		NULL },
+	{NULL, 2, "\xff\x01", 		NULL },
+	{NULL, 1, "\xff", 		NULL }
     };
     heim_oid values[] = {
 	{ 3, oid_comp1 },
@@ -492,7 +486,7 @@ static int
 test_bit_string (void)
 {
     struct test_case tests[] = {
-	{NULL, 1, "\x00"}
+	{NULL, 1, "\x00", 		NULL }
     };
     heim_bit_string values[] = {
 	{ 0, "" }
@@ -530,13 +524,13 @@ static int
 test_heim_integer (void)
 {
     struct test_case tests[] = {
-	{NULL, 2, "\xfe\x01"},
-	{NULL, 2, "\xef\x01"},
-	{NULL, 3, "\xff\x00\xff"},
-	{NULL, 3, "\xff\x01\x00"},
-	{NULL, 1, "\x00"},
-	{NULL, 1, "\x01"},
-	{NULL, 2, "\x00\x80"}
+	{NULL, 2, "\xfe\x01", 		NULL },
+	{NULL, 2, "\xef\x01", 		NULL },
+	{NULL, 3, "\xff\x00\xff", 	NULL },
+	{NULL, 3, "\xff\x01\x00", 	NULL },
+	{NULL, 1, "\x00", 		NULL },
+	{NULL, 1, "\x01", 		NULL },
+	{NULL, 2, "\x00\x80", 		NULL }
     };
 
     heim_integer values[] = {
@@ -594,8 +588,8 @@ static int
 test_boolean (void)
 {
     struct test_case tests[] = {
-	{NULL, 1, "\xff"},
-	{NULL, 1, "\x00"}
+	{NULL, 1, "\xff", 		NULL },
+	{NULL, 1, "\x00", 		NULL }
     };
 
     int values[] = { 1, 0 };
@@ -1077,6 +1071,104 @@ corner_tag(void)
     return 0;
 }
 
+struct randomcheck {
+    asn1_type_decode decoder;
+    asn1_type_release release;
+    size_t typesize;
+    size_t inputsize;
+} randomcheck[] = {
+#define el(name, type, maxlen) {			\
+	(asn1_type_decode)der_get_##name,		\
+	(asn1_type_release)der_free_##name,		\
+	sizeof(type), 					\
+	maxlen						\
+    }
+    el(integer, int, 6),
+    el(heim_integer, heim_integer, 12),
+    el(integer, int, 6),
+    el(unsigned, unsigned, 6),
+    el(general_string, heim_general_string, 12),
+    el(octet_string, heim_octet_string, 12),
+    { (asn1_type_decode)der_get_octet_string_ber,
+      (asn1_type_release)der_free_octet_string,
+      sizeof(heim_octet_string), 20 },
+    el(generalized_time, time_t, 20),
+    el(utctime, time_t, 20),
+    el(bit_string, heim_bit_string, 10),
+    el(oid, heim_oid, 10),
+    { NULL, NULL, 0, 0 }
+#undef el
+};
+
+static void
+asn1rand(uint8_t *randbytes, size_t len)
+{
+    while (len) {
+	*randbytes++ = rk_random();
+	len--;
+    }
+}
+
+static int
+check_random(void)
+{
+    struct randomcheck *r = randomcheck;
+    uint8_t *input;
+    void *type;
+    size_t size, insize;
+    int ret;
+
+    while (r->decoder) {
+	type = emalloc(r->typesize);
+	memset(type, 0, r->typesize);
+
+	input = emalloc(r->inputsize);
+
+	/* try all zero first */
+	memset(input, 0, r->inputsize);
+
+	ret = r->decoder(input, r->inputsize, type, &size);
+	if (ret)
+	    r->release(type);
+	
+	/* try all one first */
+	memset(input, 0xff, r->inputsize);
+	ret = r->decoder(input, r->inputsize, type, &size);
+	if (ret)
+	    r->release(type);
+
+	/* try 0x41 too */
+	memset(input, 0x41, r->inputsize);
+	ret = r->decoder(input, r->inputsize, type, &size);
+	if (ret)
+	    r->release(type);
+
+	/* random */
+	asn1rand(input, r->inputsize);
+	ret = r->decoder(input, r->inputsize, type, &size);
+	if (ret)
+	    r->release(type);
+
+	/* let make buffer smaller */
+	insize = r->inputsize;
+	do {
+	    insize--;
+	    asn1rand(input, insize);
+
+	    ret = r->decoder(input, insize, type, &size);
+	    if (ret == 0)
+		r->release(type);
+	} while(insize > 0);
+
+	free(type);
+
+	r++;
+    }
+    return 0;
+}
+
+
+
 int
 main(int argc, char **argv)
 {
@@ -1112,6 +1204,7 @@ main(int argc, char **argv)
     ret += test_misc_cmp();
     ret += corner_generalized_time();
     ret += corner_tag();
+    ret += check_random();
 
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-gen.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-gen.c
index e4b71dc6e..8dddaa744 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-gen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-gen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-gen.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: check-gen.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
@@ -35,9 +35,7 @@
  * SUCH DAMAGE.
  */
 
-#ifdef HAVE_CONFIG_H
 #include <config.h>
-#endif
 #include <stdio.h>
 #include <string.h>
 #include <err.h>
@@ -50,32 +48,15 @@
 #include <krb5/heim_asn1.h>
 #include <krb5/rfc2459_asn1.h>
 #include <test_asn1.h>
+#include <krb5/cms_asn1.h>
 
 #include "check-common.h"
 
-__RCSID("NetBSD");
-
 static char *lha_principal[] = { "lha" };
 static char *lharoot_princ[] = { "lha", "root" };
 static char *datan_princ[] = { "host", "nutcracker.e.kth.se" };
 static char *nada_tgt_principal[] = { "krbtgt", "NADA.KTH.SE" };
 
-
-#define IF_OPT_COMPARE(ac,bc,e) \
-	if (((ac)->e == NULL && (bc)->e != NULL) || (((ac)->e != NULL && (bc)->e == NULL))) return 1; if ((ab)->e)
-#define COMPARE_OPT_STRING(ac,bc,e) \
-	do { if (strcmp(*(ac)->e, *(bc)->e) != 0) return 1; } while(0)
-#define COMPARE_OPT_OCTECT_STRING(ac,bc,e) \
-	do { if ((ac)->e->length != (bc)->e->length || memcmp((ac)->e->data, (bc)->e->data, (ac)->e->length) != 0) return 1; } while(0)
-#define COMPARE_STRING(ac,bc,e) \
-	do { if (strcmp((ac)->e, (bc)->e) != 0) return 1; } while(0)
-#define COMPARE_INTEGER(ac,bc,e) \
-	do { if ((ac)->e != (bc)->e) return 1; } while(0)
-#define COMPARE_OPT_INTEGER(ac,bc,e) \
-	do { if (*(ac)->e != *(bc)->e) return 1; } while(0)
-#define COMPARE_MEM(ac,bc,e,len) \
-	do { if (memcmp((ac)->e, (bc)->e,len) != 0) return 1; } while(0)
-
 static int
 cmp_principal (void *a, void *b)
 {
@@ -100,18 +81,21 @@ test_principal (void)
     struct test_case tests[] = {
 	{ NULL, 29,
 	  "\x30\x1b\xa0\x10\x30\x0e\xa0\x03\x02\x01\x01\xa1\x07\x30\x05\x1b"
-	  "\x03\x6c\x68\x61\xa1\x07\x1b\x05\x53\x55\x2e\x53\x45"
+	  "\x03\x6c\x68\x61\xa1\x07\x1b\x05\x53\x55\x2e\x53\x45",
+	  NULL
 	},
 	{ NULL, 35,
 	  "\x30\x21\xa0\x16\x30\x14\xa0\x03\x02\x01\x01\xa1\x0d\x30\x0b\x1b"
 	  "\x03\x6c\x68\x61\x1b\x04\x72\x6f\x6f\x74\xa1\x07\x1b\x05\x53\x55"
-	  "\x2e\x53\x45"
+	  "\x2e\x53\x45",
+	  NULL
 	},
 	{ NULL, 54,
 	  "\x30\x34\xa0\x26\x30\x24\xa0\x03\x02\x01\x03\xa1\x1d\x30\x1b\x1b"
 	  "\x04\x68\x6f\x73\x74\x1b\x13\x6e\x75\x74\x63\x72\x61\x63\x6b\x65"
 	  "\x72\x2e\x65\x2e\x6b\x74\x68\x2e\x73\x65\xa1\x0a\x1b\x08\x45\x2e"
-	  "\x4b\x54\x48\x2e\x53\x45"
+	  "\x4b\x54\x48\x2e\x53\x45",
+	  NULL
 	}
     };
 
@@ -173,7 +157,8 @@ test_authenticator (void)
 	  "\x45\x2e\x4b\x54\x48\x2e\x53\x45\xa2\x10\x30\x0e\xa0"
 	  "\x03\x02\x01\x01\xa1\x07\x30\x05\x1b\x03\x6c\x68\x61"
 	  "\xa4\x03\x02\x01\x0a\xa5\x11\x18\x0f\x31\x39\x37\x30"
-	  "\x30\x31\x30\x31\x30\x30\x30\x31\x33\x39\x5a"
+	  "\x30\x31\x30\x31\x30\x30\x30\x31\x33\x39\x5a",
+	  NULL
 	},
 	{ NULL, 67,
 	  "\x62\x41\x30\x3f\xa0\x03\x02\x01\x05\xa1\x07\x1b\x05"
@@ -181,7 +166,8 @@ test_authenticator (void)
 	  "\x01\xa1\x0d\x30\x0b\x1b\x03\x6c\x68\x61\x1b\x04\x72"
 	  "\x6f\x6f\x74\xa4\x04\x02\x02\x01\x24\xa5\x11\x18\x0f"
 	  "\x31\x39\x37\x30\x30\x31\x30\x31\x30\x30\x31\x36\x33"
-	  "\x39\x5a"
+	  "\x39\x5a",
+	  NULL
 	}
     };
 
@@ -253,7 +239,7 @@ cmp_KRB_ERROR (void *a, void *b)
 	COMPARE_OPT_STRING(aa,ab,e_text);
     }
     IF_OPT_COMPARE(aa,ab,e_data) {
-	/* COMPARE_OPT_OCTECT_STRING(aa,ab,e_data); */
+	/* COMPARE_OPT_OCTET_STRING(aa,ab,e_data); */
     }
 
     return 0;
@@ -534,7 +520,7 @@ test_time (void)
 	  "time 1" },
 	{ NULL,  17,
 	  "\x18\x0f\x32\x30\x30\x39\x30\x35\x32\x34\x30\x32\x30\x32\x34\x30"
-	  "\x5a"
+	  "\x5a",
 	  "time 2" }
     };
 
@@ -670,6 +656,91 @@ test_cert(void)
     return 0;
 }
 
+struct {
+    const char *sd;
+    size_t len;
+} signeddata[] = {
+    {
+	"\x30\x80\x02\x01\x03\x31\x0b\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a"
+	"\x05\x00\x30\x80\x06\x07\x2b\x06\x01\x05\x02\x03\x03\xa0\x80\x24"
+	"\x80\x04\x50\x30\x4e\xa0\x2b\x30\x29\xa0\x03\x02\x01\x12\xa1\x22"
+	"\x04\x20\x78\xf4\x86\x31\xc6\xc2\xc9\xcb\xef\x0c\xd7\x3a\x2a\xcd"
+	"\x8c\x13\x34\x83\xb1\x5c\xa8\xbe\xbf\x2f\xea\xd2\xbb\xd8\x8c\x18"
+	"\x47\x01\xa1\x1f\x30\x1d\xa0\x03\x02\x01\x0c\xa1\x16\x04\x14\xa6"
+	"\x2c\x52\xb2\x80\x98\x30\x40\xbc\x5f\xb0\x77\x2d\x8a\xd7\xa1\xda"
+	"\x3c\xc5\x62\x00\x00\x00\x00\x00\x00\xa0\x82\x02\x09\x30\x82\x02"
+	"\x05\x30\x82\x01\x6e\xa0\x03\x02\x01\x02\x02\x04\x49\x75\x57\xbf"
+	"\x30\x0b\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x05\x30\x3b\x31"
+	"\x1f\x30\x1d\x06\x03\x55\x04\x03\x0c\x16\x63\x6f\x6d\x2e\x61\x70"
+	"\x70\x6c\x65\x2e\x6b\x65\x72\x62\x65\x72\x6f\x73\x2e\x6b\x64\x63"
+	"\x31\x18\x30\x16\x06\x03\x55\x04\x0a\x0c\x0f\x53\x79\x73\x74\x65"
+	"\x6d\x20\x49\x64\x65\x6e\x74\x69\x74\x79\x30\x1e\x17\x0d\x30\x39"
+	"\x31\x32\x30\x34\x30\x30\x32\x30\x32\x34\x5a\x17\x0d\x32\x39\x31"
+	"\x31\x32\x39\x30\x30\x32\x30\x32\x34\x5a\x30\x3b\x31\x1f\x30\x1d"
+	"\x06\x03\x55\x04\x03\x0c\x16\x63\x6f\x6d\x2e\x61\x70\x70\x6c\x65"
+	"\x2e\x6b\x65\x72\x62\x65\x72\x6f\x73\x2e\x6b\x64\x63\x31\x18\x30"
+	"\x16\x06\x03\x55\x04\x0a\x0c\x0f\x53\x79\x73\x74\x65\x6d\x20\x49"
+	"\x64\x65\x6e\x74\x69\x74\x79\x30\x81\x9f\x30\x0d\x06\x09\x2a\x86"
+	"\x48\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x81\x8d\x00\x30\x81\x89"
+	"\x02\x81\x81\x00\xb2\xc5\x4b\x34\xe3\x93\x99\xbb\xaa\xd1\x70\x62"
+	"\x6c\x9c\xcc\xa6\xbc\x47\xc3\x23\xff\x15\xb9\x11\x27\x0a\xf8\x55"
+	"\x4c\xb2\x43\x34\x75\xad\x55\xbb\xb9\x8a\xd0\x25\x64\xa4\x8c\x82"
+	"\x74\x5d\x89\x52\xe2\x76\x75\x08\x67\xb5\x9c\x9c\x69\x86\x0c\x6d"
+	"\x79\xf7\xa0\xbe\x42\x8f\x90\x46\x0c\x18\xf4\x7a\x56\x17\xa4\x65"
+	"\x00\x3a\x5e\x3e\xbf\xbc\xf5\xe2\x2c\x26\x03\x52\xdd\xd4\x85\x3f"
+	"\x03\xd7\x0c\x45\x7f\xff\xdd\x1e\x70\x6c\x9f\xb0\x8c\xd0\x33\xad"
+	"\x92\x54\x17\x9d\x88\x89\x1a\xee\xef\xf7\x96\x3e\x68\xc3\xd1\x60"
+	"\x47\x86\x80\x5d\x02\x03\x01\x00\x01\xa3\x18\x30\x16\x30\x14\x06"
+	"\x03\x55\x1d\x25\x04\x0d\x30\x0b\x06\x09\x2a\x86\x48\x86\xf7\x63"
+	"\x64\x04\x04\x30\x0d\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x05"
+	"\x05\x00\x03\x81\x81\x00\x9b\xbb\xaa\x63\x66\xd8\x70\x84\x3e\xf6"
+	"\xa1\x3b\xf3\xe6\xd7\x3d\xfc\x4f\xc9\x45\xaa\x31\x43\x8d\xb5\x72"
+	"\xe4\x34\x95\x7b\x6e\x5f\xe5\xc8\x5e\xaf\x12\x08\x6d\xd7\x25\x76"
+	"\x40\xd5\xdc\x83\x7f\x2f\x74\xd1\x63\xc0\x7c\x26\x4d\x53\x10\xe7"
+	"\xfa\xcc\xf2\x60\x41\x63\xdf\x56\xd6\xd9\xc0\xb4\xd0\x73\x99\x54"
+	"\x40\xad\x90\x79\x2d\xd2\x5e\xcb\x13\x22\x2b\xd0\x76\xef\x8a\x48"
+	"\xfd\xb2\x6e\xca\x04\x4e\x91\x3f\xb4\x63\xad\x22\x3a\xf7\x20\x9c"
+	"\x4c\x0e\x47\x78\xe5\x2a\x85\x0e\x90\x7a\xce\x46\xe6\x15\x02\xb0"
+	"\x83\xe7\xac\xfa\x92\xf8\x31\x81\xe8\x30\x81\xe5\x02\x01\x01\x30"
+	"\x43\x30\x3b\x31\x1f\x30\x1d\x06\x03\x55\x04\x03\x0c\x16\x63\x6f"
+	"\x6d\x2e\x61\x70\x70\x6c\x65\x2e\x6b\x65\x72\x62\x65\x72\x6f\x73"
+	"\x2e\x6b\x64\x63\x31\x18\x30\x16\x06\x03\x55\x04\x0a\x0c\x0f\x53"
+	"\x79\x73\x74\x65\x6d\x20\x49\x64\x65\x6e\x74\x69\x74\x79\x02\x04"
+	"\x49\x75\x57\xbf\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x30"
+	"\x0d\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x01\x05\x00\x04\x81"
+	"\x80\x50\x2c\x69\xe1\xd2\xc4\xd1\xcc\xdc\xe0\xe9\x8a\x6b\x6a\x97"
+	"\x1b\xb4\xe0\xa8\x20\xbe\x09\x6d\xe1\x55\x5f\x07\x70\x94\x2e\x14"
+	"\xed\x4e\xb1\x69\x75\x40\xbb\x99\x87\xed\x23\x50\x27\x5f\xaa\xc4"
+	"\x84\x60\x06\xfe\x45\xfd\x7e\x1b\x18\xe0\x0b\x77\x35\x2a\xb2\xf2"
+	"\xe0\x88\x31\xad\x82\x31\x4a\xbc\x6d\x71\x62\xe6\x4d\x33\xb4\x09"
+	"\x6e\x3f\x14\x12\xf2\x89\x29\x31\x84\x60\x2b\xa8\x2d\xe6\xca\x2f"
+	"\x03\x3d\xd4\x69\x89\xb3\x98\xfd\xac\x63\x14\xaf\x6a\x52\x2a\xac"
+	"\xe3\x8e\xfa\x21\x41\x8f\xcc\x04\x2d\x52\xee\x49\x54\x0d\x58\x51"
+	"\x77\x00\x00",
+	883
+    }
+};
+
+static int
+test_SignedData(void)
+{
+    SignedData sd;
+    size_t size, i;
+    int ret;
+
+    for (i = 0; i < sizeof(signeddata) / sizeof(signeddata[0]); i++) {
+
+	ret = decode_SignedData((unsigned char *)signeddata[i].sd,
+				signeddata[i].len, &sd, &size);
+	if (ret)
+	    return ret;
+
+	free_SignedData(&sd);
+    }
+
+    return 0;
+}
+
 
 static int
 cmp_TESTLargeTag (void *a, void *b)
@@ -766,6 +837,132 @@ check_tag_length(void)
     return failed;
 }
 
+static int
+check_tag_length64(void)
+{
+    struct test_data td[] = {
+	{ 1, 3, 3, "\x02\x01\x00"},
+	{ 1, 7, 7, "\x02\x05\x01\xff\xff\xff\xff"},
+	{ 1, 7, 7, "\x02\x05\x02\x00\x00\x00\x00"},
+	{ 1, 9, 9, "\x02\x07\x7f\xff\xff\xff\xff\xff\xff"},
+	{ 1, 10, 10, "\x02\x08\x00\x80\x00\x00\x00\x00\x00\x00"},
+	{ 1, 10, 10, "\x02\x08\x7f\xff\xff\xff\xff\xff\xff\xff"},
+	{ 1, 11, 11, "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"},
+	{ 0, 3, 0, "\x02\x02\x00"},
+	{ 0, 3, 0, "\x02\x7f\x7f"},
+	{ 0, 4, 0, "\x02\x03\x00\x80"},
+	{ 0, 4, 0, "\x02\x7f\x01\x00"},
+	{ 0, 5, 0, "\x02\xff\x7f\x02\x00"}
+    };
+    size_t sz;
+    TESTuint64 values[] = {0, 8589934591LL, 8589934592LL,
+			   36028797018963967LL, 36028797018963968LL,
+			   9223372036854775807LL, 18446744073709551615ULL,
+			   0, 127, 128, 256, 512 };
+    TESTuint64 u;
+    int i, ret, failed = 0;
+    void *buf;
+
+    if (sizeof(TESTuint64) != sizeof(uint64_t)) {
+	ret += 1;
+	printf("sizeof(TESTuint64) %d != sizeof(uint64_t) %d\n",
+	       (int)sizeof(TESTuint64), (int)sizeof(uint64_t));
+    }
+
+    for (i = 0; i < sizeof(td)/sizeof(td[0]); i++) {
+	struct map_page *page;
+
+	buf = map_alloc(OVERRUN, td[i].data, td[i].len, &page);
+
+	ret = decode_TESTuint64(buf, td[i].len, &u, &sz);
+	if (ret) {
+	    if (td[i].ok) {
+		printf("failed with tag len test %d\n", i);
+		printf("ret = %d\n", ret);
+		failed = 1;
+	    }
+	} else {
+	    if (td[i].ok == 0) {
+		printf("failed with success for tag len test %d\n", i);
+		failed = 1;
+	    }
+	    if (td[i].expected_len != sz) {
+		printf("wrong expected size for tag test %d\n", i);
+		printf("sz = %lu\n", (unsigned long)sz);
+		failed = 1;
+	    }
+	    if (values[i] != u) {
+		printf("wrong value for tag test %d\n", i);
+		printf("Expected value: %llu\nActual value: %llu\n",
+		       (unsigned long long)values[i], (unsigned long long)u);
+		failed = 1;
+	    }
+	}
+	map_free(page, "test", "decode");
+    }
+    return failed;
+}
+
+static int
+check_tag_length64s(void)
+{
+    struct test_data td[] = {
+	{ 1, 3, 3, "\x02\x01\x00"},
+	{ 1, 7, 7, "\x02\x05\xfe\x00\x00\x00\x01"},
+	{ 1, 7, 7, "\x02\x05\xfe\x00\x00\x00\x00"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x01"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x00"},
+	{ 1, 10, 10, "\x02\x08\x80\x00\x00\x00\x00\x00\x00\x01"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x01"},
+	{ 0, 3, 0, "\x02\x02\x00"},
+	{ 0, 3, 0, "\x02\x7f\x7f"},
+	{ 0, 4, 0, "\x02\x03\x00\x80"},
+	{ 0, 4, 0, "\x02\x7f\x01\x00"},
+	{ 0, 5, 0, "\x02\xff\x7f\x02\x00"}
+    };
+    size_t sz;
+    TESTint64 values[] = {0, -8589934591LL, -8589934592LL,
+			   -36028797018963967LL, -36028797018963968LL,
+			   -9223372036854775807LL, -36028797018963967LL,
+			   0, 127, 128, 256, 512 };
+    TESTint64 u;
+    int i, ret, failed = 0;
+    void *buf;
+
+    for (i = 0; i < sizeof(td)/sizeof(td[0]); i++) {
+	struct map_page *page;
+
+	buf = map_alloc(OVERRUN, td[i].data, td[i].len, &page);
+
+	ret = decode_TESTint64(buf, td[i].len, &u, &sz);
+	if (ret) {
+	    if (td[i].ok) {
+		printf("failed with tag len test %d\n", i);
+		printf("ret = %d\n", ret);
+		failed = 1;
+	    }
+	} else {
+	    if (td[i].ok == 0) {
+		printf("failed with success for tag len test %d\n", i);
+		failed = 1;
+	    }
+	    if (td[i].expected_len != sz) {
+		printf("wrong expected size for tag test %d\n", i);
+		printf("sz = %lu\n", (unsigned long)sz);
+		failed = 1;
+	    }
+	    if (values[i] != u) {
+		printf("wrong value for tag test %d\n", i);
+		printf("Expected value: %lld\nActual value: %lld\n",
+		       (long long)values[i], (long long)u);
+		failed = 1;
+	    }
+	}
+	map_free(page, "test", "decode");
+    }
+    return failed;
+}
+
 static int
 cmp_TESTChoice (void *a, void *b)
 {
@@ -820,6 +1017,7 @@ test_choice (void)
     return ret;
 }
 
+#ifdef IMPLICIT_TAGGING_WORKS
 static int
 cmp_TESTImplicit (void *a, void *b)
 {
@@ -831,27 +1029,30 @@ cmp_TESTImplicit (void *a, void *b)
     COMPARE_INTEGER(aa,ab,ti3);
     return 0;
 }
+#endif
 
 /*
 UNIV CONS Sequence 14
   CONTEXT PRIM 0 1 00
   CONTEXT CONS 1 6
-   CONTEXT CONS 127 3
-     UNIV PRIM Integer 1 02
+    CONTEXT CONS 127 3
+      UNIV PRIM Integer 1 02
   CONTEXT PRIM 2 1 03
 */
 
 static int
 test_implicit (void)
 {
+    int ret = 0;
+#ifdef IMPLICIT_TAGGING_WORKS
     struct test_case tests[] = {
-	{ NULL,  16,
-	  "\x30\x0e\x80\x01\x00\xa1\x06\xbf"
-	  "\x7f\x03\x02\x01\x02\x82\x01\x03",
+	{ NULL,  18,
+	  "\x30\x10\x80\x01\x00\xa1\x06\xbf"
+	  "\x7f\x03\x02\x01\x02\xa2\x03\x84\x01\x03",
 	  "implicit 1" }
     };
 
-    int ret = 0, ntests = sizeof(tests) / sizeof(*tests);
+    int ntests = sizeof(tests) / sizeof(*tests);
     TESTImplicit c0;
 
     memset(&c0, 0, sizeof(c0));
@@ -868,7 +1069,6 @@ test_implicit (void)
 			 cmp_TESTImplicit,
 			 (generic_copy)copy_TESTImplicit);
 
-#ifdef IMPLICIT_TAGGING_WORKS
     ret += generic_test (tests, ntests, sizeof(TESTImplicit2),
 			 (generic_encode)encode_TESTImplicit2,
 			 (generic_length)length_TESTImplicit2,
@@ -894,7 +1094,7 @@ cmp_TESTAlloc (void *a, void *b)
     COMPARE_INTEGER(aa,ab,three);
 
     IF_OPT_COMPARE(aa,ab,tagless2) {
-	COMPARE_OPT_OCTECT_STRING(aa, ab, tagless2);
+	COMPARE_OPT_OCTET_STRING(aa, ab, tagless2);
     }
 
     return 0;
@@ -1061,7 +1261,7 @@ check_fail_largetag(void)
 	{NULL, 0, "", "empty buffer"},
 	{NULL, 7, "\x30\x05\xa1\x03\x02\x02\x01",
 	 "one too short" },
-	{NULL, 7, "\x30\x04\xa1\x03\x02\x02\x01"
+	{NULL, 7, "\x30\x04\xa1\x03\x02\x02\x01",
 	 "two too short" },
 	{NULL, 7, "\x30\x03\xa1\x03\x02\x02\x01",
 	 "three too short" },
@@ -1096,7 +1296,7 @@ check_fail_sequence(void)
 	{NULL, 0, "", "empty buffer"},
 	{NULL, 24,
 	 "\x30\x16\xa0\x03\x02\x01\x01\xa1\x08\x30\x06\xbf\x7f\x03\x02\x01\x01"
-	 "\x02\x01\x01\xa2\x03\x02\x01\x01"
+	 "\x02\x01\x01\xa2\x03\x02\x01\x01",
 	 "missing one byte from the end, internal length ok"},
 	{NULL, 25,
 	 "\x30\x18\xa0\x03\x02\x01\x01\xa1\x08\x30\x06\xbf\x7f\x03\x02\x01\x01"
@@ -1130,6 +1330,30 @@ check_fail_choice(void)
 			       (generic_decode)decode_TESTChoice1);
 }
 
+static int
+check_fail_Ticket(void)
+{
+    char buf[100];
+    size_t i;
+    int ret;
+    struct test_case test;
+    Ticket ticket;
+
+    for (i = 0; i < sizeof(buf); i++) {
+	memset(buf, 0, sizeof(buf));
+	memset(&ticket, 0, sizeof(ticket));
+	test.val = &ticket;
+	test.byte_len = i;
+	test.bytes = buf;
+	test.name = "zero life";
+	ret = generic_decode_fail(&test, 1, sizeof(Ticket),
+				  (generic_decode)decode_Ticket);
+	if (ret)
+	    return ret;
+    }
+    return 0;
+}
+
 static int
 check_seq(void)
 {
@@ -1278,6 +1502,276 @@ check_TESTMechTypeList(void)
     return 0;
 }
 
+#ifdef IMPLICIT_TAGGING_WORKS
+static int
+cmp_TESTSeqOf4(void *a, void *b)
+{
+    TESTSeqOf4 *aa = a;
+    TESTSeqOf4 *ab = b;
+    int i;
+
+    IF_OPT_COMPARE(aa, ab, b1) {
+	COMPARE_INTEGER(aa->b1, ab->b1, len);
+	for (i = 0; i < aa->b1->len; ++i) {
+	    COMPARE_INTEGER(aa->b1->val+i, ab->b1->val+i, u1);
+	    COMPARE_INTEGER(aa->b1->val+i, ab->b1->val+i, u2);
+	    COMPARE_OCTET_STRING(aa->b1->val+i, ab->b1->val+i, s1);
+	    COMPARE_OCTET_STRING(aa->b1->val+i, ab->b1->val+i, s2);
+	}
+    }
+    IF_OPT_COMPARE(aa, ab, b2) {
+	COMPARE_INTEGER(aa->b2, ab->b2, len);
+	for (i = 0; i < aa->b2->len; ++i) {
+	    COMPARE_INTEGER(aa->b2->val+i, ab->b2->val+i, u1);
+	    COMPARE_INTEGER(aa->b2->val+i, ab->b2->val+i, u2);
+	    COMPARE_INTEGER(aa->b2->val+i, ab->b2->val+i, u3);
+	    COMPARE_OCTET_STRING(aa->b2->val+i, ab->b2->val+i, s1);
+	    COMPARE_OCTET_STRING(aa->b2->val+i, ab->b2->val+i, s2);
+	    COMPARE_OCTET_STRING(aa->b2->val+i, ab->b2->val+i, s3);
+	}
+    }
+    IF_OPT_COMPARE(aa, ab, b3) {
+	COMPARE_INTEGER(aa->b3, ab->b3, len);
+	for (i = 0; i < aa->b3->len; ++i) {
+	    COMPARE_INTEGER(aa->b3->val+i, ab->b3->val+i, u1);
+	    COMPARE_INTEGER(aa->b3->val+i, ab->b3->val+i, u2);
+	    COMPARE_INTEGER(aa->b3->val+i, ab->b3->val+i, u3);
+	    COMPARE_INTEGER(aa->b3->val+i, ab->b3->val+i, u4);
+	    COMPARE_OCTET_STRING(aa->b3->val+i, ab->b3->val+i, s1);
+	    COMPARE_OCTET_STRING(aa->b3->val+i, ab->b3->val+i, s2);
+	    COMPARE_OCTET_STRING(aa->b3->val+i, ab->b3->val+i, s3);
+	    COMPARE_OCTET_STRING(aa->b3->val+i, ab->b3->val+i, s4);
+	}
+    }
+    return 0;
+}
+#endif  /* IMPLICIT_TAGGING_WORKS */
+
+static int
+test_seq4 (void)
+{
+    int ret = 0;
+#ifdef IMPLICIT_TAGGING_WORKS
+    struct test_case tests[] = {
+	{ NULL,  2,
+	  "\x30\x00",
+	  "seq4 0" },
+	{ NULL,  4,
+	  "\x30\x02" "\xa1\x00",
+	  "seq4 1" },
+	{ NULL,  8,
+	  "\x30\x06" "\xa0\x02\x30\x00" "\xa1\x00",
+	  "seq4 2" },
+	{ NULL,  2 + (2 + 0x18) + (2 + 0x27) + (2 + 0x31),
+	  "\x30\x76"					/* 2 SEQ */
+	   "\xa0\x18\x30\x16"				/* 4 [0] SEQ */
+	    "\x30\x14"					/* 2 SEQ */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+	     "\x02\x01\x01"				/* 3 INT */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+	   "\xa1\x27"					/* 2 [1] IMPL SEQ */
+	    "\x30\x25"					/* 2 SEQ */
+	     "\x02\x01\x01"				/* 3 INT */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+	     "\x02\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00"
+							/* 11 INT */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+             "\x04\x04\x00\x01\x02\x03"			/* 6 OCTET-STRING */
+	   "\xa2\x31"					/* 2 [2] IMPL SEQ */
+	    "\x30\x2f"					/* 2 SEQ */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+	     "\x02\x01\x01"				/* 3 INT */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+             "\x04\x04\x00\x01\x02\x03"			/* 6 OCTET-STRING */
+	     "\x02\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00"
+							/* 11 INT */
+	     "\x04\x01\x00"				/* 3 OCTET-STRING */
+	     "\x02\x05\x01\x00\x00\x00\x00",		/* 7 INT */
+	  "seq4 3" },
+    };
+
+    int ntests = sizeof(tests) / sizeof(*tests);
+    TESTSeqOf4 c[4];
+    struct TESTSeqOf4_b1 b1[4];
+    struct TESTSeqOf4_b2 b2[4];
+    struct TESTSeqOf4_b3 b3[4];
+    struct TESTSeqOf4_b1_val b1val[4];
+    struct TESTSeqOf4_b2_val b2val[4];
+    struct TESTSeqOf4_b3_val b3val[4];
+
+    c[0].b1 = NULL;
+    c[0].b2 = NULL;
+    c[0].b3 = NULL;
+    tests[0].val = &c[0];
+
+    b2[1].len = 0;
+    b2[1].val = NULL;
+    c[1].b1 = NULL;
+    c[1].b2 = &b2[1];
+    c[1].b3 = NULL;
+    tests[1].val = &c[1];
+
+    b1[2].len = 0;
+    b1[2].val = NULL;
+    b2[2].len = 0;
+    b2[2].val = NULL;
+    c[2].b1 = &b1[2];
+    c[2].b2 = &b2[2];
+    c[2].b3 = NULL;
+    tests[2].val = &c[2];
+
+    b1val[3].s1.data = "";
+    b1val[3].s1.length = 0;
+    b1val[3].u1 = 1LL;
+    b1val[3].s2.data = "\x01\x02";
+    b1val[3].s2.length = 2;
+    b1val[3].u2 = -1LL;
+
+    b2val[3].s1.data = "";
+    b2val[3].s1.length = 0;
+    b2val[3].u1 = 1LL;
+    b2val[3].s2.data = "\x01\x02";
+    b2val[3].s2.length = 2;
+    b2val[3].u2 = -1LL;
+    b2val[3].s3.data = "\x00\x01\x02\x03";
+    b2val[3].s3.length = 4;
+    b2val[3].u3 = 1LL<<63;
+
+    b3val[3].s1.data = "";
+    b3val[3].s1.length = 0;
+    b3val[3].u1 = 1LL;
+    b3val[3].s2.data = "\x01\x02";
+    b3val[3].s2.length = 2;
+    b3val[3].u2 = -1LL;
+    b3val[3].s3.data = "\x00\x01\x02\x03";
+    b3val[3].s3.length = 4;
+    b3val[3].u3 = 1LL<<63;
+    b3val[3].s4.data = "\x00";
+    b3val[3].s4.length = 1;
+    b3val[3].u4 = 1LL<<32;
+
+    b1[3].len = 1;
+    b1[3].val = &b1val[3];
+    b2[3].len = 1;
+    b2[3].val = &b2val[3];
+    b3[3].len = 1;
+    b3[3].val = &b3val[3];
+    c[3].b1 = &b1[3];
+    c[3].b2 = &b2[3];
+    c[3].b3 = &b3[3];
+    tests[3].val = &c[3];
+
+    ret += generic_test (tests, ntests, sizeof(TESTSeqOf4),
+			 (generic_encode)encode_TESTSeqOf4,
+			 (generic_length)length_TESTSeqOf4,
+			 (generic_decode)decode_TESTSeqOf4,
+			 (generic_free)free_TESTSeqOf4,
+			 cmp_TESTSeqOf4,
+			 (generic_copy)copy_TESTSeqOf4);
+#endif  /* IMPLICIT_TAGGING_WORKS */
+    return ret;
+}
+
+static int
+cmp_test_seqof5 (void *a, void *b)
+{
+    TESTSeqOf5 *aval = a;
+    TESTSeqOf5 *bval = b;
+
+    IF_OPT_COMPARE(aval, bval, outer) {
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u0);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s0);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u1);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s1);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u2);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s2);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u3);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s3);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u4);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s4);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u5);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s5);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u6);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s6);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u7);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s7);
+    }
+    return 0;
+}
+
+static int
+test_seqof5(void)
+{
+    struct test_case tests[] = {
+	{ NULL,  2, "\x30\x00", "seq5 0" },
+	{ NULL,  126,
+          "\x30\x7c"                                            /* SEQ */
+            "\x30\x7a"                                          /* SEQ */
+              "\x30\x78"                                        /* SEQ */
+                "\x02\x01\x01"                                  /* INT 1 */
+                "\x04\x06\x01\x01\x01\x01\x01\x01"              /* "\0x1"x6 */
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfe"  /* INT ~1 */
+                "\x04\x06\x02\x02\x02\x02\x02\x02"              /* "\x02"x6 */
+                "\x02\x01\x02"                                  /* INT 2 */
+                "\x04\x06\x03\x03\x03\x03\x03\x03"              /* "\x03"x6 */
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfd"  /* INT ~2 */
+                "\x04\x06\x04\x04\x04\x04\x04\x04"              /* ... */
+                "\x02\x01\x03"
+                "\x04\x06\x05\x05\x05\x05\x05\x05"
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfc"
+                "\x04\x06\x06\x06\x06\x06\x06\x06"
+                "\x02\x01\x04"
+                "\x04\x06\x07\x07\x07\x07\x07\x07"
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfb"
+                "\x04\x06\x08\x08\x08\x08\x08\x08",
+          "seq5 1" },
+    };
+
+    int ret = 0, ntests = sizeof(tests) / sizeof(*tests);
+    TESTSeqOf5 c[2];
+    struct TESTSeqOf5_outer outer;
+    struct TESTSeqOf5_outer_inner inner;
+    TESTuint64 u[8];
+    heim_octet_string s[8];
+    int i;
+
+    c[0].outer = NULL;
+    tests[0].val = &c[0];
+
+    for (i = 0; i < 8; ++i) {
+        u[i] = (i&1) == 0 ? i/2+1 : ~(i/2+1);
+        s[i].data = memset(malloc(s[i].length = 6), i+1, 6);
+    }
+
+    inner.u0 = u[0]; inner.u1 = u[1]; inner.u2 = u[2]; inner.u3 = u[3];
+    inner.u4 = u[4]; inner.u5 = u[5]; inner.u6 = u[6]; inner.u7 = u[7];
+    inner.s0 = s[0]; inner.s1 = s[1]; inner.s2 = s[2]; inner.s3 = s[3];
+    inner.s4 = s[4]; inner.s5 = s[5]; inner.s6 = s[6]; inner.s7 = s[7];
+
+    outer.inner = inner;
+    c[1].outer = &outer;
+    tests[1].val = &c[1];
+
+    ret += generic_test (tests, ntests, sizeof(TESTSeqOf5),
+			 (generic_encode)encode_TESTSeqOf5,
+			 (generic_length)length_TESTSeqOf5,
+			 (generic_decode)decode_TESTSeqOf5,
+			 (generic_free)free_TESTSeqOf5,
+			 cmp_test_seqof5,
+			 NULL);
+
+    for (i = 0; i < 8; ++i)
+        free(s[i].data);
+
+    return ret;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -1293,21 +1787,28 @@ main(int argc, char **argv)
     ret += test_cert();
 
     ret += check_tag_length();
+    ret += check_tag_length64();
+    ret += check_tag_length64s();
     ret += test_large_tag();
     ret += test_choice();
 
     ret += test_implicit();
+
     ret += test_taglessalloc();
     ret += test_optional();
 
     ret += check_fail_largetag();
     ret += check_fail_sequence();
     ret += check_fail_choice();
+    ret += check_fail_Ticket();
 
     ret += check_seq();
     ret += check_seq_of_size();
+    ret += test_SignedData();
 
     ret += check_TESTMechTypeList();
+    ret += test_seq4();
+    ret += test_seqof5();
 
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-template.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-template.c
index ce1484ba2..5a239b0b7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-template.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-template.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-template.c,v 1.1.1.1 2011/04/13 18:14:40 elric Exp $	*/
+/*	$NetBSD: check-template.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
@@ -48,6 +48,7 @@
 #include <test_asn1.h>
 
 #include "check-common.h"
+#include "der_locl.h"
 
 static int
 cmp_dummy (void *a, void *b)
@@ -55,6 +56,44 @@ cmp_dummy (void *a, void *b)
     return 0;
 }
 
+static int
+test_uint64(void)
+{
+    struct test_case tests[] = {
+        { NULL, 3, "\x02\x01\x00", "uint64 0" },
+        { NULL, 7, "\x02\x05\x01\xff\xff\xff\xff", "uint64 1" },
+        { NULL, 7, "\x02\x05\x02\x00\x00\x00\x00", "uint64 2" },
+        { NULL, 9, "\x02\x07\x7f\xff\xff\xff\xff\xff\xff", "uint64 3" },
+        { NULL, 10, "\x02\x08\x00\x80\x00\x00\x00\x00\x00\x00", "uint64 4" },
+        { NULL, 10, "\x02\x08\x7f\xff\xff\xff\xff\xff\xff\xff", "uint64 5" },
+        { NULL, 11, "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff", "uint64 6" }
+    };
+
+    size_t i;
+    int ret = 0, ntests = sizeof(tests) / sizeof(*tests);
+    TESTuint64 values[] = { 0, 8589934591LL, 8589934592LL,
+                           36028797018963967LL, 36028797018963968LL,
+                           9223372036854775807LL, 18446744073709551615ULL };
+
+    for (i = 0; i < ntests; i++)
+       tests[i].val = &values[i];
+
+    if (sizeof(TESTuint64) != sizeof(uint64_t)) {
+       ret += 1;
+       printf("sizeof(TESTuint64) %d != sizeof(uint64_t) %d\n",
+              (int)sizeof(TESTuint64), (int)sizeof(uint64_t));
+    }
+
+    ret += generic_test (tests, ntests, sizeof(TESTuint64),
+                        (generic_encode)encode_TESTuint64,
+                        (generic_length)length_TESTuint64,
+                        (generic_decode)decode_TESTuint64,
+                        (generic_free)free_TESTuint64,
+                        cmp_dummy,
+                        NULL);
+    return ret;
+}
+
 static int
 test_seqofseq(void)
 {
@@ -243,15 +282,240 @@ test_seqof3(void)
 }
 
 
+static int
+test_seqof4(void)
+{
+    struct test_case tests[] = {
+	{ NULL,  2,
+	  "\x30\x00",
+	  "seq4 0" },
+	{ NULL,  4,
+	  "\x30\x02" "\xa1\x00",
+	  "seq4 1" },
+	{ NULL,  8,
+	  "\x30\x06" "\xa0\x02\x30\x00" "\xa1\x00",
+	  "seq4 2" },
+	{ NULL,  2 + (2 + 0x18) + (2 + 0x27) + (2 + 0x31),
+	  "\x30\x76"					/* 2 SEQ */
+	   "\xa0\x18\x30\x16"				/* 4 [0] SEQ */
+	    "\x30\x14"					/* 2 SEQ */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+	     "\x02\x01\x01"				/* 3 INT */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+	   "\xa1\x27"					/* 2 [1] IMPL SEQ */
+	    "\x30\x25"					/* 2 SEQ */
+	     "\x02\x01\x01"				/* 3 INT */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+	     "\x02\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00"
+							/* 11 INT */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+             "\x04\x04\x00\x01\x02\x03"			/* 6 OCTET-STRING */
+	   "\xa2\x31"					/* 2 [2] IMPL SEQ */
+	    "\x30\x2f"					/* 2 SEQ */
+	     "\x04\x00"					/* 2 OCTET-STRING */
+	     "\x02\x01\x01"				/* 3 INT */
+             "\x04\x02\x01\x02"				/* 4 OCTET-STRING */
+	     "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"
+							/* 11 INT */
+             "\x04\x04\x00\x01\x02\x03"			/* 6 OCTET-STRING */
+	     "\x02\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00"
+							/* 11 INT */
+	     "\x04\x01\x00"				/* 3 OCTET-STRING */
+	     "\x02\x05\x01\x00\x00\x00\x00",		/* 7 INT */
+	  "seq4 3" },
+    };
+
+    int ret = 0, ntests = sizeof(tests) / sizeof(*tests);
+    TESTSeqOf4 c[4];
+    struct TESTSeqOf4_b1 b1[4];
+    struct TESTSeqOf4_b2 b2[4];
+    struct TESTSeqOf4_b3 b3[4];
+    struct TESTSeqOf4_b1_val b1val[4];
+    struct TESTSeqOf4_b2_val b2val[4];
+    struct TESTSeqOf4_b3_val b3val[4];
+
+    c[0].b1 = NULL;
+    c[0].b2 = NULL;
+    c[0].b3 = NULL;
+    tests[0].val = &c[0];
+
+    b2[1].len = 0;
+    b2[1].val = NULL;
+    c[1].b1 = NULL;
+    c[1].b2 = &b2[1];
+    c[1].b3 = NULL;
+    tests[1].val = &c[1];
+
+    b1[2].len = 0;
+    b1[2].val = NULL;
+    b2[2].len = 0;
+    b2[2].val = NULL;
+    c[2].b1 = &b1[2];
+    c[2].b2 = &b2[2];
+    c[2].b3 = NULL;
+    tests[2].val = &c[2];
+
+    b1val[3].s1.data = "";
+    b1val[3].s1.length = 0;
+    b1val[3].u1 = 1LL;
+    b1val[3].s2.data = "\x01\x02";
+    b1val[3].s2.length = 2;
+    b1val[3].u2 = -1LL;
+
+    b2val[3].s1.data = "";
+    b2val[3].s1.length = 0;
+    b2val[3].u1 = 1LL;
+    b2val[3].s2.data = "\x01\x02";
+    b2val[3].s2.length = 2;
+    b2val[3].u2 = -1LL;
+    b2val[3].s3.data = "\x00\x01\x02\x03";
+    b2val[3].s3.length = 4;
+    b2val[3].u3 = 1LL<<63;
+
+    b3val[3].s1.data = "";
+    b3val[3].s1.length = 0;
+    b3val[3].u1 = 1LL;
+    b3val[3].s2.data = "\x01\x02";
+    b3val[3].s2.length = 2;
+    b3val[3].u2 = -1LL;
+    b3val[3].s3.data = "\x00\x01\x02\x03";
+    b3val[3].s3.length = 4;
+    b3val[3].u3 = 1LL<<63;
+    b3val[3].s4.data = "\x00";
+    b3val[3].s4.length = 1;
+    b3val[3].u4 = 1LL<<32;
+
+    b1[3].len = 1;
+    b1[3].val = &b1val[3];
+    b2[3].len = 1;
+    b2[3].val = &b2val[3];
+    b3[3].len = 1;
+    b3[3].val = &b3val[3];
+    c[3].b1 = &b1[3];
+    c[3].b2 = &b2[3];
+    c[3].b3 = &b3[3];
+    tests[3].val = &c[3];
+
+    ret += generic_test (tests, ntests, sizeof(TESTSeqOf4),
+			 (generic_encode)encode_TESTSeqOf4,
+			 (generic_length)length_TESTSeqOf4,
+			 (generic_decode)decode_TESTSeqOf4,
+			 (generic_free)free_TESTSeqOf4,
+			 cmp_dummy,
+			 NULL);
+    return ret;
+}
+
+static int
+cmp_test_seqof5 (void *a, void *b)
+{
+    TESTSeqOf5 *aval = a;
+    TESTSeqOf5 *bval = b;
+
+    IF_OPT_COMPARE(aval, bval, outer) {
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u0);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s0);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u1);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s1);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u2);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s2);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u3);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s3);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u4);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s4);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u5);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s5);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u6);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s6);
+            COMPARE_INTEGER(&aval->outer->inner, &bval->outer->inner, u7);
+            COMPARE_OCTET_STRING(&aval->outer->inner, &bval->outer->inner, s7);
+    }
+    return 0;
+}
+
+static int
+test_seqof5(void)
+{
+    struct test_case tests[] = {
+	{ NULL,  2, "\x30\x00", "seq5 0" },
+	{ NULL,  126,
+          "\x30\x7c"                                            /* SEQ */
+            "\x30\x7a"                                          /* SEQ */
+              "\x30\x78"                                        /* SEQ */
+                "\x02\x01\x01"                                  /* INT 1 */
+                "\x04\x06\x01\x01\x01\x01\x01\x01"              /* "\0x1"x6 */
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfe"  /* INT ~1 */
+                "\x04\x06\x02\x02\x02\x02\x02\x02"              /* "\x02"x6 */
+                "\x02\x01\x02"                                  /* INT 2 */
+                "\x04\x06\x03\x03\x03\x03\x03\x03"              /* "\x03"x6 */
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfd"  /* INT ~2 */
+                "\x04\x06\x04\x04\x04\x04\x04\x04"              /* ... */
+                "\x02\x01\x03"
+                "\x04\x06\x05\x05\x05\x05\x05\x05"
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfc"
+                "\x04\x06\x06\x06\x06\x06\x06\x06"
+                "\x02\x01\x04"
+                "\x04\x06\x07\x07\x07\x07\x07\x07"
+                "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xfb"
+                "\x04\x06\x08\x08\x08\x08\x08\x08",
+          "seq5 1" },
+    };
+
+    int ret = 0, ntests = sizeof(tests) / sizeof(*tests);
+    TESTSeqOf5 c[2];
+    struct TESTSeqOf5_outer outer;
+    struct TESTSeqOf5_outer_inner inner;
+    TESTuint64 u[8];
+    heim_octet_string s[8];
+    int i;
+
+    c[0].outer = NULL;
+    tests[0].val = &c[0];
+
+    for (i = 0; i < 8; ++i) {
+        u[i] = (i&1) == 0 ? i/2+1 : ~(i/2+1);
+        s[i].data = memset(malloc(s[i].length = 6), i+1, 6);
+    }
+
+    inner.u0 = u[0]; inner.u1 = u[1]; inner.u2 = u[2]; inner.u3 = u[3];
+    inner.u4 = u[4]; inner.u5 = u[5]; inner.u6 = u[6]; inner.u7 = u[7];
+    inner.s0 = s[0]; inner.s1 = s[1]; inner.s2 = s[2]; inner.s3 = s[3];
+    inner.s4 = s[4]; inner.s5 = s[5]; inner.s6 = s[6]; inner.s7 = s[7];
+
+    outer.inner = inner;
+    c[1].outer = &outer;
+    tests[1].val = &c[1];
+
+    ret += generic_test (tests, ntests, sizeof(TESTSeqOf5),
+			 (generic_encode)encode_TESTSeqOf5,
+			 (generic_length)length_TESTSeqOf5,
+			 (generic_decode)decode_TESTSeqOf5,
+			 (generic_free)free_TESTSeqOf5,
+			 cmp_test_seqof5,
+			 NULL);
+
+    for (i = 0; i < 8; ++i)
+        free(s[i].data);
+
+    return ret;
+}
+
 int
 main(int argc, char **argv)
 {
     int ret = 0;
 
+    ret += test_uint64();
     ret += test_seqofseq();
     ret += test_seqofseq2();
     ret += test_seqof2();
     ret += test_seqof3();
+    ret += test_seqof4();
+    ret += test_seqof5();
 
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/check-timegm.c b/crypto/external/bsd/heimdal/dist/lib/asn1/check-timegm.c
index 1a7eb872e..84d6f04dd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/check-timegm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/check-timegm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: check-timegm.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: check-timegm.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include <der_locl.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: check-timegm.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static int
 test_timegm(void)
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der.c
index 5aacee253..2fc31b1f9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 #include <krb5/getarg.h>
 #include <err.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 
 static const char *class_names[] = {
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der.h b/crypto/external/bsd/heimdal/dist/lib/asn1/der.h
index a84b76c22..d29d3a099 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: der.h,v 1.1.1.2 2011/04/14 14:08:20 elric Exp $	*/
+/*	$NetBSD: der.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -38,6 +38,8 @@
 #ifndef __DER_H__
 #define __DER_H__
 
+#include <stdint.h>
+
 typedef enum {
     ASN1_C_UNIV = 0,
     ASN1_C_APPL = 1,
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_cmp.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_cmp.c
index 63c85d95e..906cffbe0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_cmp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_cmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_cmp.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_cmp.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@ int
 der_heim_oid_cmp(const heim_oid *p, const heim_oid *q)
 {
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     return memcmp(p->components,
 		  q->components,
 		  p->length * sizeof(*p->components));
@@ -50,7 +50,7 @@ der_heim_octet_string_cmp(const heim_octet_string *p,
 			  const heim_octet_string *q)
 {
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     return memcmp(p->data, q->data, p->length);
 }
 
@@ -72,12 +72,13 @@ int
 der_heim_bit_string_cmp(const heim_bit_string *p,
 			const heim_bit_string *q)
 {
-    int i, r1, r2;
+    int r1, r2;
+    size_t i;
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     i = memcmp(p->data, q->data, p->length / 8);
     if (i)
-	return i;
+	return (int)i;
     if ((p->length % 8) == 0)
 	return 0;
     i = (p->length / 8);
@@ -96,7 +97,7 @@ der_heim_integer_cmp(const heim_integer *p,
     if (p->negative != q->negative)
 	return q->negative - p->negative;
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     return memcmp(p->data, q->data, p->length);
 }
 
@@ -104,7 +105,7 @@ int
 der_heim_bmp_string_cmp(const heim_bmp_string *p, const heim_bmp_string *q)
 {
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     return memcmp(p->data, q->data, q->length * sizeof(q->data[0]));
 }
 
@@ -113,6 +114,6 @@ der_heim_universal_string_cmp(const heim_universal_string *p,
 			      const heim_universal_string *q)
 {
     if (p->length != q->length)
-	return p->length - q->length;
+	return (int)(p->length - q->length);
     return memcmp(p->data, q->data, q->length * sizeof(q->data[0]));
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_copy.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_copy.c
index 5ee010dff..aaa6f1861 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_copy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_copy.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_copy.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include "der_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der_copy.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 int
 der_copy_general_string (const heim_general_string *from,
@@ -56,6 +56,13 @@ der_copy_integer (const int *from, int *to)
     return 0;
 }
 
+int
+der_copy_integer64 (const int64_t *from, int64_t *to)
+{
+    *to = *from;
+    return 0;
+}
+
 int
 der_copy_unsigned (const unsigned *from, unsigned *to)
 {
@@ -63,6 +70,13 @@ der_copy_unsigned (const unsigned *from, unsigned *to)
     return 0;
 }
 
+int
+der_copy_unsigned64 (const uint64_t *from, uint64_t *to)
+{
+    *to = *from;
+    return 0;
+}
+
 int
 der_copy_generalized_time (const time_t *from, time_t *to)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_format.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_format.c
index f4f4354c8..85fe17478 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_format.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_format.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_format.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_format.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "der_locl.h"
 #include <krb5/hex.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der_format.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 int
 der_parse_hex_heim_integer (const char *p, heim_integer *data)
@@ -165,7 +165,7 @@ der_parse_heim_oid (const char *str, const char *sep, heim_oid *data)
 	    free(s);
 	    return EINVAL;
 	}
-	data->components[data->length++] = l;
+	data->components[data->length++] = (unsigned int)l;
     }
     free(s);
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_free.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_free.c
index 4f2ded07f..78341c202 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_free.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_free.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_free.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_free.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include "der_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der_free.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 void
 der_free_general_string (heim_general_string *str)
@@ -52,12 +52,24 @@ der_free_integer (int *i)
     *i = 0;
 }
 
+void
+der_free_integer64 (int64_t *i)
+{
+    *i = 0;
+}
+
 void
 der_free_unsigned (unsigned *u)
 {
     *u = 0;
 }
 
+void
+der_free_unsigned64 (uint64_t *u)
+{
+    *u = 0;
+}
+
 void
 der_free_generalized_time(time_t *t)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_get.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_get.c
index 26cfe62f9..259fbb34c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_get.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_get.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_get.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_get.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -50,9 +50,28 @@ der_get_unsigned (const unsigned char *p, size_t len,
     unsigned val = 0;
     size_t oldlen = len;
 
-    if (len == sizeof(unsigned) + 1 && p[0] == 0)
+    if (len == sizeof(val) + 1 && p[0] == 0)
 	;
-    else if (len > sizeof(unsigned))
+    else if (len > sizeof(val))
+	return ASN1_OVERRUN;
+
+    while (len--)
+	val = val * 256 + *p++;
+    *ret = val;
+    if(size) *size = oldlen;
+    return 0;
+}
+
+int
+der_get_unsigned64 (const unsigned char *p, size_t len,
+                   uint64_t *ret, size_t *size)
+{
+    uint64_t val = 0;
+    size_t oldlen = len;
+
+    if (len == sizeof(val) + 1 && p[0] == 0)
+       ;
+    else if (len > sizeof(val))
 	return ASN1_OVERRUN;
 
     while (len--)
@@ -69,7 +88,7 @@ der_get_integer (const unsigned char *p, size_t len,
     int val = 0;
     size_t oldlen = len;
 
-    if (len > sizeof(int))
+    if (len > sizeof(val))
 	return ASN1_OVERRUN;
 
     if (len > 0) {
@@ -82,6 +101,27 @@ der_get_integer (const unsigned char *p, size_t len,
     return 0;
 }
 
+int
+der_get_integer64 (const unsigned char *p, size_t len,
+		   int64_t *ret, size_t *size)
+{
+    int64_t val = 0;
+    size_t oldlen = len;
+
+    if (len > sizeof(val))
+        return ASN1_OVERRUN;
+
+    if (len > 0) {
+       val = (signed char)*p++;
+       while (--len)
+           val = val * 256 + *p++;
+    }
+    *ret = val;
+    if(size) *size = oldlen;
+    return 0;
+}
+
+
 int
 der_get_length (const unsigned char *p, size_t len,
 		size_t *val, size_t *size)
@@ -145,18 +185,22 @@ der_get_general_string (const unsigned char *p, size_t len,
 	 */
 	while ((size_t)(p1 - p) < len && *p1 == '\0')
 	    p1++;
-       if ((size_t)(p1 - p) != len)
+	if ((size_t)(p1 - p) != len) {
+	    *str = NULL;
 	    return ASN1_BAD_CHARACTER;
+	}
     }
-    if (len > len + 1)
+    if (len == SIZE_MAX) {
+	*str = NULL;
 	return ASN1_BAD_LENGTH;
+    }
 
-    s = malloc (len + 1);
+    *str = s = malloc (len + 1);
     if (s == NULL)
 	return ENOMEM;
     memcpy (s, p, len);
     s[len] = '\0';
-    *str = s;
+
     if(size) *size = len;
     return 0;
 }
@@ -168,14 +212,23 @@ der_get_utf8string (const unsigned char *p, size_t len,
     return der_get_general_string(p, len, str, size);
 }
 
+#define gen_data_zero(_data) \
+	do { (_data)->length = 0; (_data)->data = NULL; } while(0)
+
 int
 der_get_printable_string(const unsigned char *p, size_t len,
 			 heim_printable_string *str, size_t *size)
 {
+    if (len == SIZE_MAX) {
+	gen_data_zero(str);
+	return ASN1_BAD_LENGTH;
+    }
     str->length = len;
     str->data = malloc(len + 1);
-    if (str->data == NULL)
+    if (str->data == NULL) {
+	gen_data_zero(str);
 	return ENOMEM;
+    }
     memcpy(str->data, p, len);
     ((char *)str->data)[len] = '\0';
     if(size) *size = len;
@@ -195,14 +248,20 @@ der_get_bmp_string (const unsigned char *p, size_t len,
 {
     size_t i;
 
-    if (len & 1)
+    if (len & 1) {
+	gen_data_zero(data);
 	return ASN1_BAD_FORMAT;
+    }
     data->length = len / 2;
-    if (data->length > UINT_MAX/sizeof(data->data[0]))
+    if (data->length > UINT_MAX/sizeof(data->data[0])) {
+	gen_data_zero(data);
 	return ERANGE;
+    }
     data->data = malloc(data->length * sizeof(data->data[0]));
-    if (data->data == NULL && data->length != 0)
+    if (data->data == NULL && data->length != 0) {
+	gen_data_zero(data);
 	return ENOMEM;
+    }
 
     for (i = 0; i < data->length; i++) {
 	data->data[i] = (p[0] << 8) | p[1];
@@ -210,8 +269,7 @@ der_get_bmp_string (const unsigned char *p, size_t len,
 	/* check for NUL in the middle of the string */
 	if (data->data[i] == 0 && i != (data->length - 1)) {
 	    free(data->data);
-	    data->data = NULL;
-	    data->length = 0;
+	    gen_data_zero(data);
 	    return ASN1_BAD_CHARACTER;
 	}
     }
@@ -226,14 +284,20 @@ der_get_universal_string (const unsigned char *p, size_t len,
 {
     size_t i;
 
-    if (len & 3)
+    if (len & 3) {
+	gen_data_zero(data);
 	return ASN1_BAD_FORMAT;
+    }
     data->length = len / 4;
-    if (data->length > UINT_MAX/sizeof(data->data[0]))
+    if (data->length > UINT_MAX/sizeof(data->data[0])) {
+	gen_data_zero(data);
 	return ERANGE;
+    }
     data->data = malloc(data->length * sizeof(data->data[0]));
-    if (data->data == NULL && data->length != 0)
+    if (data->data == NULL && data->length != 0) {
+	gen_data_zero(data);
 	return ENOMEM;
+    }
 
     for (i = 0; i < data->length; i++) {
 	data->data[i] = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
@@ -241,8 +305,7 @@ der_get_universal_string (const unsigned char *p, size_t len,
 	/* check for NUL in the middle of the string */
 	if (data->data[i] == 0 && i != (data->length - 1)) {
 	    free(data->data);
-	    data->data = NULL;
-	    data->length = 0;
+	    gen_data_zero(data);
 	    return ASN1_BAD_CHARACTER;
 	}
     }
@@ -276,7 +339,7 @@ der_get_octet_string_ber (const unsigned char *p, size_t len,
 {
     int e;
     Der_type type;
-    Der_class class;
+    Der_class cls;
     unsigned int tag, depth = 0;
     size_t l, datalen, oldlen = len;
 
@@ -284,9 +347,9 @@ der_get_octet_string_ber (const unsigned char *p, size_t len,
     data->data = NULL;
 
     while (len) {
-	e = der_get_tag (p, len, &class, &type, &tag, &l);
+	e = der_get_tag (p, len, &cls, &type, &tag, &l);
 	if (e) goto out;
-	if (class != ASN1_C_UNIV) {
+	if (cls != ASN1_C_UNIV) {
 	    e = ASN1_BAD_ID;
 	    goto out;
 	}
@@ -432,7 +495,7 @@ der_get_time (const unsigned char *p, size_t len,
     char *times;
     int e;
 
-    if (len > len + 1 || len == 0)
+    if (len == SIZE_MAX || len == 0)
 	return ASN1_BAD_LENGTH;
 
     times = malloc(len + 1);
@@ -470,7 +533,7 @@ der_get_oid (const unsigned char *p, size_t len,
     if (len < 1)
 	return ASN1_OVERRUN;
 
-    if (len > len + 1)
+    if (len == SIZE_MAX)
 	return ASN1_BAD_LENGTH;
 
     if (len + 1 > UINT_MAX/sizeof(data->components[0]))
@@ -510,13 +573,13 @@ der_get_oid (const unsigned char *p, size_t len,
 
 int
 der_get_tag (const unsigned char *p, size_t len,
-	     Der_class *class, Der_type *type,
+	     Der_class *cls, Der_type *type,
 	     unsigned int *tag, size_t *size)
 {
     size_t ret = 0;
     if (len < 1)
 	return ASN1_OVERRUN;
-    *class = (Der_class)(((*p) >> 6) & 0x03);
+    *cls = (Der_class)(((*p) >> 6) & 0x03);
     *type = (Der_type)(((*p) >> 5) & 0x01);
     *tag = (*p) & 0x1f;
     p++; len--; ret++;
@@ -542,13 +605,13 @@ der_get_tag (const unsigned char *p, size_t len,
 
 int
 der_match_tag (const unsigned char *p, size_t len,
-	       Der_class class, Der_type type,
+	       Der_class cls, Der_type type,
 	       unsigned int tag, size_t *size)
 {
     Der_type thistype;
     int e;
 
-    e = der_match_tag2(p, len, class, &thistype, tag, size);
+    e = der_match_tag2(p, len, cls, &thistype, tag, size);
     if (e) return e;
     if (thistype != type) return ASN1_BAD_ID;
     return 0;
@@ -556,7 +619,7 @@ der_match_tag (const unsigned char *p, size_t len,
 
 int
 der_match_tag2 (const unsigned char *p, size_t len,
-		Der_class class, Der_type *type,
+		Der_class cls, Der_type *type,
 		unsigned int tag, size_t *size)
 {
     size_t l;
@@ -566,7 +629,7 @@ der_match_tag2 (const unsigned char *p, size_t len,
 
     e = der_get_tag (p, len, &thisclass, type, &thistag, &l);
     if (e) return e;
-    if (class != thisclass)
+    if (cls != thisclass)
 	return ASN1_BAD_ID;
     if(tag > thistag)
 	return ASN1_MISPLACED_FIELD;
@@ -578,13 +641,13 @@ der_match_tag2 (const unsigned char *p, size_t len,
 
 int
 der_match_tag_and_length (const unsigned char *p, size_t len,
-			  Der_class class, Der_type *type, unsigned int tag,
+			  Der_class cls, Der_type *type, unsigned int tag,
 			  size_t *length_ret, size_t *size)
 {
     size_t l, ret = 0;
     int e;
 
-    e = der_match_tag2 (p, len, class, type, tag, &l);
+    e = der_match_tag2 (p, len, cls, type, tag, &l);
     if (e) return e;
     p += l;
     len -= l;
@@ -635,14 +698,19 @@ der_get_bit_string (const unsigned char *p, size_t len,
      * any of them will cause a interger overrun */
     if ((len - 1) >> (sizeof(len) * 8 - 3))
 	return ASN1_OVERRUN;
-    data->length = (len - 1) * 8;
-    data->data = malloc(len - 1);
-    if (data->data == NULL && (len - 1) != 0)
-	return ENOMEM;
-    /* copy data is there is data to copy */
-    if (len - 1 != 0) {
-      memcpy (data->data, p + 1, len - 1);
-      data->length -= p[0];
+    /*
+     * If there is data to copy, do that now.
+     */
+    if (len - 1 > 0) {
+	data->length = (len - 1) * 8;
+	data->data = malloc(len - 1);
+	if (data->data == NULL)
+	    return ENOMEM;
+	memcpy (data->data, p + 1, len - 1);
+	data->length -= p[0];
+    } else {
+	data->data = NULL;
+	data->length = 0;
     }
     if(size) *size = len;
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_length.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_length.c
index e17714b61..1a2d09728 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_length.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_length.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_length.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_length.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include "der_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der_length.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 size_t
 _heim_len_unsigned (unsigned val)
@@ -57,6 +57,24 @@ _heim_len_unsigned (unsigned val)
     return ret;
 }
 
+size_t
+_heim_len_unsigned64 (uint64_t val)
+{
+    size_t ret = 0;
+    int last_val_gt_128;
+
+    do {
+	++ret;
+	last_val_gt_128 = (val >= 128);
+	val /= 256;
+    } while (val);
+
+    if(last_val_gt_128)
+	ret++;
+
+    return ret;
+}
+
 size_t
 _heim_len_int (int val)
 {
@@ -84,6 +102,33 @@ _heim_len_int (int val)
     return ret;
 }
 
+size_t
+_heim_len_int64 (int64_t val)
+{
+    unsigned char q;
+    size_t ret = 0;
+
+    if (val >= 0) {
+	do {
+	    q = val % 256;
+	    ret++;
+	    val /= 256;
+	} while(val);
+	if(q >= 128)
+	    ret++;
+    } else {
+	val = ~val;
+	do {
+	    q = ~(val % 256);
+	    ret++;
+	    val /= 256;
+	} while(val);
+	if(q < 128)
+	    ret++;
+    }
+    return ret;
+}
+
 static size_t
 len_oid (const heim_oid *oid)
 {
@@ -136,12 +181,24 @@ der_length_integer (const int *data)
     return _heim_len_int (*data);
 }
 
+size_t
+der_length_integer64 (const int64_t *data)
+{
+    return _heim_len_int64 (*data);
+}
+
 size_t
 der_length_unsigned (const unsigned *data)
 {
     return _heim_len_unsigned(*data);
 }
 
+size_t
+der_length_unsigned64 (const uint64_t *data)
+{
+    return _heim_len_unsigned64(*data);
+}
+
 size_t
 der_length_enumerated (const unsigned *data)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_locl.h b/crypto/external/bsd/heimdal/dist/lib/asn1/der_locl.h
index b84a882ee..47e83d736 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_locl.h,v 1.1.1.2 2011/04/14 14:08:21 elric Exp $	*/
+/*	$NetBSD: der_locl.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002, 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/der_put.c b/crypto/external/bsd/heimdal/dist/lib/asn1/der_put.c
index 54ac1c043..e85434b91 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/der_put.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/der_put.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: der_put.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: der_put.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "der_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: der_put.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 /*
  * All encoding functions take a pointer `p' to first position in
@@ -77,6 +77,38 @@ der_put_unsigned (unsigned char *p, size_t len, const unsigned *v, size_t *size)
     }
 }
 
+int
+der_put_unsigned64 (unsigned char *p, size_t len, const uint64_t *v, size_t *size)
+{
+    unsigned char *base = p;
+    uint64_t val = *v;
+
+    if (val) {
+       while (len > 0 && val) {
+           *p-- = val % 256;
+           val /= 256;
+           --len;
+       }
+       if (val != 0)
+           return ASN1_OVERFLOW;
+       else {
+           if(p[1] >= 128) {
+               if(len < 1)
+                   return ASN1_OVERFLOW;
+               *p-- = 0;
+           }
+           *size = base - p;
+           return 0;
+       }
+    } else if (len < 1)
+       return ASN1_OVERFLOW;
+    else {
+       *p    = 0;
+       *size = 1;
+       return 0;
+    }
+}
+
 int
 der_put_integer (unsigned char *p, size_t len, const int *v, size_t *size)
 {
@@ -117,6 +149,46 @@ der_put_integer (unsigned char *p, size_t len, const int *v, size_t *size)
     return 0;
 }
 
+int
+der_put_integer64 (unsigned char *p, size_t len, const int64_t *v, size_t *size)
+{
+    unsigned char *base = p;
+    int64_t val = *v;
+
+    if(val >= 0) {
+       do {
+           if(len < 1)
+               return ASN1_OVERFLOW;
+           *p-- = val % 256;
+           len--;
+           val /= 256;
+       } while(val);
+       if(p[1] >= 128) {
+           if(len < 1)
+               return ASN1_OVERFLOW;
+           *p-- = 0;
+           len--;
+       }
+    } else {
+       val = ~val;
+       do {
+           if(len < 1)
+               return ASN1_OVERFLOW;
+           *p-- = ~(val % 256);
+           len--;
+           val /= 256;
+       } while(val);
+       if(p[1] < 128) {
+           if(len < 1)
+               return ASN1_OVERFLOW;
+           *p-- = 0xff;
+           len--;
+       }
+    }
+    *size = base - p;
+    return 0;
+}
+
 
 int
 der_put_length (unsigned char *p, size_t len, size_t val, size_t *size)
@@ -269,7 +341,8 @@ der_put_heim_integer (unsigned char *p, size_t len,
     len -= data->length;
 
     if (data->negative) {
-	int i, carry;
+	ssize_t i;
+	int carry;
 	for (i = data->length - 1, carry = 1; i >= 0; i--) {
 	    *p = buf[i] ^ 0xff;
 	    if (carry)
@@ -345,7 +418,7 @@ der_put_oid (unsigned char *p, size_t len,
 	     const heim_oid *data, size_t *size)
 {
     unsigned char *base = p;
-    int n;
+    size_t n;
 
     for (n = data->length - 1; n >= 2; --n) {
 	unsigned u = data->components[n];
@@ -431,12 +504,14 @@ _heim_time2generalizedtime (time_t t, heim_octet_string *s, int gtimep)
      struct tm tm;
      const size_t len = gtimep ? 15 : 13;
 
+     s->data = NULL;
+     s->length = 0;
+     if (_der_gmtime(t, &tm) == NULL)
+	 return ASN1_BAD_TIMEFORMAT;
      s->data = malloc(len + 1);
      if (s->data == NULL)
 	 return ENOMEM;
      s->length = len;
-     if (_der_gmtime(t, &tm) == NULL)
-	 return ASN1_BAD_TIMEFORMAT;
      if (gtimep)
 	 snprintf (s->data, len + 1, "%04d%02d%02d%02d%02d%02dZ",
 		   tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
@@ -470,12 +545,12 @@ der_put_bit_string (unsigned char *p, size_t len,
 int
 _heim_der_set_sort(const void *a1, const void *a2)
 {
-    const struct heim_octet_string *s1 = a1, *s2 = a2;
+    const heim_octet_string *s1 = a1, *s2 = a2;
     int ret;
 
     ret = memcmp(s1->data, s2->data,
 		 s1->length < s2->length ? s1->length : s2->length);
     if(ret)
 	return ret;
-    return s1->length - s2->length;
+    return (int)(s1->length - s2->length);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/digest.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/digest.asn1
index bea2343a2..e7071dffd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/digest.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/digest.asn1
@@ -24,7 +24,7 @@ DigestInit ::= SEQUENCE {
 }
 
 DigestInitReply ::= SEQUENCE {
-    nonce		UTF8String,	-- service nonce/challange
+    nonce		UTF8String,	-- service nonce/challenge
     opaque		UTF8String,	-- server state
     identifier		[0] UTF8String OPTIONAL
 }
@@ -78,7 +78,7 @@ NTLMInitReply ::= SEQUENCE {
     flags		[0] INTEGER (0..4294967295),
     opaque		[1] OCTET STRING,
     targetname		[2] UTF8String,
-    challange		[3] OCTET STRING,
+    challenge		[3] OCTET STRING,
     targetinfo		[4] OCTET STRING OPTIONAL
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/extra.c b/crypto/external/bsd/heimdal/dist/lib/asn1/extra.c
index b93b48a0a..2b2defe42 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/extra.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/extra.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: extra.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: extra.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 #include "der_locl.h"
 #include <krb5/heim_asn1.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: extra.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 int
 encode_heim_any(unsigned char *p, size_t len,
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/fuzzer.c b/crypto/external/bsd/heimdal/dist/lib/asn1/fuzzer.c
new file mode 100644
index 000000000..e7c40c4ba
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/fuzzer.c
@@ -0,0 +1,744 @@
+/*	$NetBSD: fuzzer.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2009 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 - 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "der_locl.h"
+#include <krb5/com_err.h>
+
+enum trigger_method { FOFF, FRANDOM, FLINEAR, FLINEAR_SIZE };
+
+#ifdef ASN1_FUZZER
+static enum trigger_method method = FOFF;
+
+/* FLINEAR */
+static unsigned long fnum, fcur, fsize;
+#endif
+
+int
+asn1_fuzzer_method(const char *mode)
+{
+#ifdef ASN1_FUZZER
+    if (mode == NULL || strcasecmp(mode, "off") == 0) {
+	method = FOFF;
+    } else if (strcasecmp(mode, "random") == 0) {
+	method = FRANDOM;
+    } else if (strcasecmp(mode, "linear") == 0) {
+	method = FLINEAR;
+    } else if (strcasecmp(mode, "linear-size") == 0) {
+	method = FLINEAR_SIZE;
+    } else
+	return 1;
+    return 0;
+#else
+    return 1;
+#endif
+}
+
+void
+asn1_fuzzer_reset(void)
+{
+#ifdef ASN1_FUZZER
+    fcur = 0;
+    fsize = 0;
+    fnum = 0;
+#endif
+}
+
+void
+asn1_fuzzer_next(void)
+{
+#ifdef ASN1_FUZZER
+    fcur = 0;
+    fsize = 0;
+    fnum++;
+#endif
+}
+
+int
+asn1_fuzzer_done(void)
+{
+#ifndef ASN1_FUZZER
+    abort();
+#else
+    /* since code paths */
+    return (fnum > 10000);
+#endif
+}
+
+#ifdef ASN1_FUZZER
+
+static int
+fuzzer_trigger(unsigned int chance)
+{
+    switch(method) {
+    case FOFF:
+	return 0;
+    case FRANDOM:
+	if ((rk_random() % chance) != 1)
+	    return 0;
+	return 1;
+    case FLINEAR:
+	if (fnum == fcur++)
+	    return 1;
+	return 0;
+    case FLINEAR_SIZE:
+	return 0;
+    }
+    return 0;
+}
+
+static int
+fuzzer_size_trigger(unsigned long *cur)
+{
+    if (method != FLINEAR_SIZE)
+	return 0;
+    if (fnum == (*cur)++)
+	return 1;
+    return 0;
+}
+
+static size_t
+fuzzer_length_len (size_t len)
+{
+    if (fuzzer_size_trigger(&fsize)) {
+	len = 0;
+    } else if (fuzzer_size_trigger(&fsize)) {
+	len = 129;
+    } else if (fuzzer_size_trigger(&fsize)) {
+	len = 0xffff;
+    }
+
+    if (len < 128)
+	return 1;
+    else {
+	int ret = 0;
+	do {
+	    ++ret;
+	    len /= 256;
+	} while (len);
+	return ret + 1;
+    }
+}
+
+static int
+fuzzer_put_length (unsigned char *p, size_t len, size_t val, size_t *size)
+{
+    if (len < 1)
+	return ASN1_OVERFLOW;
+
+    if (fuzzer_size_trigger(&fcur)) {
+	val = 0;
+    } else if (fuzzer_size_trigger(&fcur)) {
+	val = 129;
+    } else if (fuzzer_size_trigger(&fcur)) {
+	val = 0xffff;
+    }
+
+    if (val < 128) {
+	*p = val;
+	*size = 1;
+    } else {
+	size_t l = 0;
+
+	while(val > 0) {
+	    if(len < 2)
+		return ASN1_OVERFLOW;
+	    *p-- = val % 256;
+	    val /= 256;
+	    len--;
+	    l++;
+	}
+	*p = 0x80 | l;
+	if(size)
+	    *size = l + 1;
+    }
+    return 0;
+}
+
+static int
+fuzzer_put_tag (unsigned char *p, size_t len, Der_class class, Der_type type,
+		unsigned int tag, size_t *size)
+{
+    unsigned fcont = 0;
+
+    if (tag <= 30) {
+	if (len < 1)
+	    return ASN1_OVERFLOW;
+	if (fuzzer_trigger(100))
+	    *p = MAKE_TAG(class, type, 0x1f);
+	else
+	    *p = MAKE_TAG(class, type, tag);
+	*size = 1;
+    } else {
+	size_t ret = 0;
+	unsigned int continuation = 0;
+
+	do {
+	    if (len < 1)
+		return ASN1_OVERFLOW;
+	    *p-- = tag % 128 | continuation;
+	    len--;
+	    ret++;
+	    tag /= 128;
+	    continuation = 0x80;
+	} while(tag > 0);
+	if (len < 1)
+	    return ASN1_OVERFLOW;
+	if (fuzzer_trigger(100))
+	    *p-- = MAKE_TAG(class, type, 0);
+	else
+	    *p-- = MAKE_TAG(class, type, 0x1f);
+	ret++;
+	*size = ret;
+    }
+    return 0;
+}
+
+static int
+fuzzer_put_length_and_tag (unsigned char *p, size_t len, size_t len_val,
+			   Der_class class, Der_type type,
+			   unsigned int tag, size_t *size)
+{
+    size_t ret = 0;
+    size_t l;
+    int e;
+
+    e = fuzzer_put_length (p, len, len_val, &l);
+    if(e)
+	return e;
+    p -= l;
+    len -= l;
+    ret += l;
+    e = fuzzer_put_tag (p, len, class, type, tag, &l);
+    if(e)
+	return e;
+
+    ret += l;
+    *size = ret;
+    return 0;
+}
+
+static int
+fuzzer_put_general_string (unsigned char *p, size_t len,
+			   const heim_general_string *str, size_t *size)
+{
+    size_t slen = strlen(*str);
+
+    if (len < slen)
+	return ASN1_OVERFLOW;
+    p -= slen;
+    if (slen >= 2 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%s", 2);
+    } else if (slen >= 2 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%n", 2);
+    } else if (slen >= 4 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%10n", 4);
+    } else if (slen >= 10 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%n%n%n%n%n", 10);
+    } else if (slen >= 10 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%n%p%s%d%x", 10);
+    } else if (slen >= 7 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%.1024d", 7);
+    } else if (slen >= 7 && fuzzer_trigger(100)) {
+	memcpy(p+1, *str, slen);
+	memcpy(p+1, "%.2049d", 7);
+    } else if (fuzzer_trigger(100)) {
+	memset(p+1, 0, slen);
+    } else if (fuzzer_trigger(100)) {
+	memset(p+1, 0xff, slen);
+    } else if (fuzzer_trigger(100)) {
+	memset(p+1, 'A', slen);
+    } else {
+	memcpy(p+1, *str, slen);
+    }
+    *size = slen;
+    return 0;
+}
+
+
+struct asn1_type_func fuzzerprim[A1T_NUM_ENTRY] = {
+#define fuzel(name, type) {				\
+	(asn1_type_encode)fuzzer_put_##name,		\
+	(asn1_type_decode)der_get_##name,		\
+	(asn1_type_length)der_length_##name,		\
+	(asn1_type_copy)der_copy_##name,		\
+	(asn1_type_release)der_free_##name,		\
+	sizeof(type)					\
+    }
+#define el(name, type) {				\
+	(asn1_type_encode)der_put_##name,		\
+	(asn1_type_decode)der_get_##name,		\
+	(asn1_type_length)der_length_##name,		\
+	(asn1_type_copy)der_copy_##name,		\
+	(asn1_type_release)der_free_##name,		\
+	sizeof(type)					\
+    }
+#define elber(name, type) {				\
+	(asn1_type_encode)der_put_##name,		\
+	(asn1_type_decode)der_get_##name##_ber,		\
+	(asn1_type_length)der_length_##name,		\
+	(asn1_type_copy)der_copy_##name,		\
+	(asn1_type_release)der_free_##name,		\
+	sizeof(type)					\
+    }
+    el(integer, int),
+    el(integer64, int64_t),
+    el(heim_integer, heim_integer),
+    el(integer, int),
+    el(unsigned, unsigned),
+    el(uninteger64, uint64_t),
+    fuzel(general_string, heim_general_string),
+    el(octet_string, heim_octet_string),
+    elber(octet_string, heim_octet_string),
+    el(ia5_string, heim_ia5_string),
+    el(bmp_string, heim_bmp_string),
+    el(universal_string, heim_universal_string),
+    el(printable_string, heim_printable_string),
+    el(visible_string, heim_visible_string),
+    el(utf8string, heim_utf8_string),
+    el(generalized_time, time_t),
+    el(utctime, time_t),
+    el(bit_string, heim_bit_string),
+    { (asn1_type_encode)der_put_boolean, (asn1_type_decode)der_get_boolean,
+      (asn1_type_length)der_length_boolean, (asn1_type_copy)der_copy_integer,
+      (asn1_type_release)der_free_integer, sizeof(int)
+    },
+    el(oid, heim_oid),
+    el(general_string, heim_general_string),
+#undef fuzel
+#undef el
+#undef elber
+};
+
+
+
+int
+_asn1_encode_fuzzer(const struct asn1_template *t,
+		    unsigned char *p, size_t len,
+		    const void *data, size_t *size)
+{
+    size_t elements = A1_HEADER_LEN(t);
+    int ret = 0;
+    size_t oldlen = len;
+
+    t += A1_HEADER_LEN(t);
+
+    while (elements) {
+	switch (t->tt & A1_OP_MASK) {
+	case A1_OP_TYPE:
+	case A1_OP_TYPE_EXTERN: {
+	    size_t newsize;
+	    const void *el = DPOC(data, t->offset);
+
+	    if (t->tt & A1_FLAG_OPTIONAL) {
+		void **pel = (void **)el;
+		if (*pel == NULL)
+		    break;
+		el = *pel;
+	    }
+
+	    if ((t->tt & A1_OP_MASK) == A1_OP_TYPE) {
+		ret = _asn1_encode_fuzzer(t->ptr, p, len, el, &newsize);
+	    } else {
+		const struct asn1_type_func *f = t->ptr;
+		ret = (f->encode)(p, len, el, &newsize);
+	    }
+
+	    if (ret)
+		return ret;
+	    p -= newsize; len -= newsize;
+
+	    break;
+	}
+	case A1_OP_TAG: {
+	    const void *olddata = data;
+	    size_t l, datalen;
+
+	    data = DPOC(data, t->offset);
+
+	    if (t->tt & A1_FLAG_OPTIONAL) {
+		void **el = (void **)data;
+		if (*el == NULL) {
+		    data = olddata;
+		    break;
+		}
+		data = *el;
+	    }
+
+	    ret = _asn1_encode_fuzzer(t->ptr, p, len, data, &datalen);
+	    if (ret)
+		return ret;
+
+	    len -= datalen; p -= datalen;
+
+	    ret = fuzzer_put_length_and_tag(p, len, datalen,
+					    A1_TAG_CLASS(t->tt),
+					    A1_TAG_TYPE(t->tt),
+					    A1_TAG_TAG(t->tt), &l);
+	    if (ret)
+		return ret;
+
+	    p -= l; len -= l;
+
+	    data = olddata;
+
+	    break;
+	}
+	case A1_OP_PARSE: {
+	    unsigned int type = A1_PARSE_TYPE(t->tt);
+	    size_t newsize;
+	    const void *el = DPOC(data, t->offset);
+
+	    if (type > sizeof(fuzzerprim)/sizeof(fuzzerprim[0])) {
+		ABORT_ON_ERROR();
+		return ASN1_PARSE_ERROR;
+	    }
+
+	    ret = (fuzzerprim[type].encode)(p, len, el, &newsize);
+	    if (ret)
+		return ret;
+	    p -= newsize; len -= newsize;
+
+	    break;
+	}
+	case A1_OP_SETOF: {
+	    const struct template_of *el = DPOC(data, t->offset);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
+	    heim_octet_string *val;
+	    unsigned char *elptr = el->val;
+	    size_t i, totallen;
+
+	    if (el->len == 0)
+		break;
+
+	    if (el->len > UINT_MAX/sizeof(val[0]))
+		return ERANGE;
+
+	    val = malloc(sizeof(val[0]) * el->len);
+	    if (val == NULL)
+		return ENOMEM;
+
+	    for(totallen = 0, i = 0; i < el->len; i++) {
+		unsigned char *next;
+		size_t l;
+
+		val[i].length = _asn1_length(t->ptr, elptr);
+		val[i].data = malloc(val[i].length);
+
+		ret = _asn1_encode_fuzzer(t->ptr, DPO(val[i].data, val[i].length - 1),
+					  val[i].length, elptr, &l);
+		if (ret)
+		    break;
+
+		next = elptr + ellen;
+		if (next < elptr) {
+		    ret = ASN1_OVERFLOW;
+		    break;
+		}
+		elptr = next;
+		totallen += val[i].length;
+	    }
+	    if (ret == 0 && totallen > len)
+		ret = ASN1_OVERFLOW;
+	    if (ret) {
+		do {
+		    free(val[i].data);
+		} while(i-- > 0);
+		free(val);
+		return ret;
+	    }
+
+	    len -= totallen;
+
+	    qsort(val, el->len, sizeof(val[0]), _heim_der_set_sort);
+
+	    i = el->len - 1;
+	    do {
+		p -= val[i].length;
+		memcpy(p + 1, val[i].data, val[i].length);
+		free(val[i].data);
+	    } while(i-- > 0);
+	    free(val);
+
+	    break;
+
+	}
+	case A1_OP_SEQOF: {
+	    struct template_of *el = DPO(data, t->offset);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
+	    size_t newsize;
+	    unsigned int i;
+	    unsigned char *elptr = el->val;
+
+	    if (el->len == 0)
+		break;
+
+	    elptr += ellen * (el->len - 1);
+	   
+	    for (i = 0; i < el->len; i++) {
+		ret = _asn1_encode_fuzzer(t->ptr, p, len,
+				   elptr,
+				   &newsize);
+		if (ret)
+		    return ret;
+		p -= newsize; len -= newsize;
+		elptr -= ellen;
+	    }
+
+	    break;
+	}
+	case A1_OP_BMEMBER: {
+	    const struct asn1_template *bmember = t->ptr;
+	    size_t size = bmember->offset;
+	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t pos;
+	    unsigned char c = 0;
+	    unsigned int bitset = 0;
+	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
+
+	    bmember += elements;
+
+	    if (rfc1510)
+		pos = 31;
+	    else
+		pos = bmember->offset;
+
+	    while (elements && len) {
+		while (bmember->offset / 8 < pos / 8) {
+		    if (rfc1510 || bitset || c) {
+			if (len < 1)
+			    return ASN1_OVERFLOW;
+			*p-- = c; len--;
+		    }
+		    c = 0;
+		    pos -= 8;
+		}
+		_asn1_bmember_put_bit(&c, data, bmember->offset, size, &bitset);
+		elements--; bmember--;
+	    }
+	    if (rfc1510 || bitset) {
+		if (len < 1)
+		    return ASN1_OVERFLOW;
+		*p-- = c; len--;
+	    }
+	   
+	    if (len < 1)
+		return ASN1_OVERFLOW;
+	    if (rfc1510 || bitset == 0)
+		*p-- = 0;
+	    else
+		*p-- = bitset - 1;
+
+	    len--;
+
+	    break;
+	}
+	case A1_OP_CHOICE: {
+	    const struct asn1_template *choice = t->ptr;
+	    const unsigned int *element = DPOC(data, choice->offset);
+	    size_t datalen;
+	    const void *el;
+
+	    if (*element > A1_HEADER_LEN(choice)) {
+		printf("element: %d\n", *element);
+		return ASN1_PARSE_ERROR;
+	    }
+
+	    if (*element == 0) {
+		ret += der_put_octet_string(p, len,
+					    DPOC(data, choice->tt), &datalen);
+	    } else {
+		choice += *element;
+		el = DPOC(data, choice->offset);
+		ret = _asn1_encode_fuzzer(choice->ptr, p, len, el, &datalen);
+		if (ret)
+		    return ret;
+	    }	   
+	    len -= datalen; p -= datalen;
+
+	    break;
+	}
+	default:
+	    ABORT_ON_ERROR();
+	}
+	t--;
+	elements--;
+    }
+
+    if (fuzzer_trigger(1000)) {
+	memset(p + 1, 0, oldlen - len);
+    } else if (fuzzer_trigger(1000)) {
+	memset(p + 1, 0x41, oldlen - len);
+    } else if (fuzzer_trigger(1000)) {
+	memset(p + 1, 0xff, oldlen - len);
+    }
+
+    if (size)
+	*size = oldlen - len;
+
+    return 0;
+}
+
+size_t
+_asn1_length_fuzzer(const struct asn1_template *t, const void *data)
+{
+    size_t elements = A1_HEADER_LEN(t);
+    size_t ret = 0;
+
+    t += A1_HEADER_LEN(t);
+
+    while (elements) {
+	switch (t->tt & A1_OP_MASK) {
+	case A1_OP_TYPE:
+	case A1_OP_TYPE_EXTERN: {
+	    const void *el = DPOC(data, t->offset);
+
+	    if (t->tt & A1_FLAG_OPTIONAL) {
+		void **pel = (void **)el;
+		if (*pel == NULL)
+		    break;
+		el = *pel;
+	    }
+
+	    if ((t->tt & A1_OP_MASK) == A1_OP_TYPE) {
+		ret += _asn1_length(t->ptr, el);
+	    } else {
+		const struct asn1_type_func *f = t->ptr;
+		ret += (f->length)(el);
+	    }
+	    break;
+	}
+	case A1_OP_TAG: {
+	    size_t datalen;
+	    const void *olddata = data;
+
+	    data = DPO(data, t->offset);
+
+	    if (t->tt & A1_FLAG_OPTIONAL) {
+		void **el = (void **)data;
+		if (*el == NULL) {
+		    data = olddata;
+		    break;
+		}
+		data = *el;
+	    }
+	    datalen = _asn1_length(t->ptr, data);
+	    ret += der_length_tag(A1_TAG_TAG(t->tt)) + fuzzer_length_len(datalen);
+	    ret += datalen;
+	    data = olddata;
+	    break;
+	}
+	case A1_OP_PARSE: {
+	    unsigned int type = A1_PARSE_TYPE(t->tt);
+	    const void *el = DPOC(data, t->offset);
+
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
+		ABORT_ON_ERROR();
+		break;
+	    }
+	    ret += (asn1_template_prim[type].length)(el);
+	    break;
+	}
+	case A1_OP_SETOF:
+	case A1_OP_SEQOF: {
+	    const struct template_of *el = DPOC(data, t->offset);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
+	    const unsigned char *element = el->val;
+	    unsigned int i;
+
+	    for (i = 0; i < el->len; i++) {
+		ret += _asn1_length(t->ptr, element);
+		element += ellen;
+	    }
+
+	    break;
+	}
+	case A1_OP_BMEMBER: {
+	    const struct asn1_template *bmember = t->ptr;
+	    size_t size = bmember->offset;
+	    size_t elements = A1_HEADER_LEN(bmember);
+	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
+
+	    if (rfc1510) {
+		ret += 5;
+	    } else {
+
+		ret += 1;
+
+		bmember += elements;
+
+		while (elements) {
+		    if (_asn1_bmember_isset_bit(data, bmember->offset, size)) {
+			ret += (bmember->offset / 8) + 1;
+			break;
+		    }
+		    elements--; bmember--;
+		}
+	    }
+	    break;
+	}
+	case A1_OP_CHOICE: {
+	    const struct asn1_template *choice = t->ptr;
+	    const unsigned int *element = DPOC(data, choice->offset);
+
+	    if (*element > A1_HEADER_LEN(choice))
+		break;
+
+	    if (*element == 0) {
+		ret += der_length_octet_string(DPOC(data, choice->tt));
+	    } else {
+		choice += *element;
+		ret += _asn1_length(choice->ptr, DPOC(data, choice->offset));
+	    }
+	    break;
+	}
+	default:
+	    ABORT_ON_ERROR();
+	    break;
+	}
+	elements--;
+	t--;
+    }
+    return ret;
+}
+
+#endif /* ASN1_FUZZER */
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen.c
index 62195df35..b16aaa49f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: gen.c,v 1.5 2017/01/29 01:46:37 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 #include "gen_locl.h"
 #include <libgen.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen.c,v 1.5 2017/01/29 01:46:37 christos Exp $");
 
 FILE *privheaderfile, *headerfile, *codefile, *logfile, *templatefile;
 
@@ -151,12 +151,14 @@ init_generate (const char *filename, const char *base)
     fn = NULL;
 
     /* template file */
-    if (asprintf(&template, "%s-template.c", headerbase) < 0 || template == NULL)
+    if (asprintf(&template, "%s-template.x", headerbase) < 0 || template == NULL)
 	errx(1, "malloc");
+    char *copy = estrdup(filename);
+    char *bn = basename(copy);
     fprintf (headerfile,
 	     "/* Generated from %s */\n"
 	     "/* Do not edit */\n\n",
-	     basename(filename));
+	     bn);
     fprintf (headerfile,
 	     "#ifndef __%s_h__\n"
 	     "#define __%s_h__\n\n", headerbase, headerbase);
@@ -166,17 +168,21 @@ init_generate (const char *filename, const char *base)
     fprintf (headerfile,
 	     "#ifndef __asn1_common_definitions__\n"
 	     "#define __asn1_common_definitions__\n\n");
+	fprintf (headerfile,
+		 "#ifndef __HEIM_BASE_DATA__\n"
+		 "#define __HEIM_BASE_DATA__ 1\n"
+		 "struct heim_base_data {\n"
+		 "    size_t length;\n"
+		 "    void *data;\n"
+		 "};\n"
+		 "typedef struct heim_base_data heim_octet_string;\n"
+		 "#endif\n\n");
     fprintf (headerfile,
 	     "typedef struct heim_integer {\n"
 	     "  size_t length;\n"
 	     "  void *data;\n"
 	     "  int negative;\n"
 	     "} heim_integer;\n\n");
-    fprintf (headerfile,
-	     "typedef struct heim_octet_string {\n"
-	     "  size_t length;\n"
-	     "  void *data;\n"
-	     "} heim_octet_string;\n\n");
     fprintf (headerfile,
 	     "typedef char *heim_general_string;\n\n"
 	     );
@@ -184,10 +190,10 @@ init_generate (const char *filename, const char *base)
 	     "typedef char *heim_utf8_string;\n\n"
 	     );
     fprintf (headerfile,
-	     "typedef struct heim_octet_string heim_printable_string;\n\n"
+	     "typedef struct heim_base_data heim_printable_string;\n\n"
 	     );
     fprintf (headerfile,
-	     "typedef struct heim_octet_string heim_ia5_string;\n\n"
+	     "typedef struct heim_base_data heim_ia5_string;\n\n"
 	     );
     fprintf (headerfile,
 	     "typedef struct heim_bmp_string {\n"
@@ -213,8 +219,8 @@ init_generate (const char *filename, const char *base)
 	     "  void *data;\n"
 	     "} heim_bit_string;\n\n");
     fprintf (headerfile,
-	     "typedef struct heim_octet_string heim_any;\n"
-	     "typedef struct heim_octet_string heim_any_set;\n\n");
+	     "typedef struct heim_base_data heim_any;\n"
+	     "typedef struct heim_base_data heim_any_set;\n\n");
     fputs("#define ASN1_MALLOC_ENCODE(T, B, BL, S, L, R)                  \\\n"
 	  "  do {                                                         \\\n"
 	  "    (BL) = length_##T((S));                                    \\\n"
@@ -268,14 +274,15 @@ init_generate (const char *filename, const char *base)
 	     "#include <string.h>\n"
 	     "#include <errno.h>\n"
 	     "#include <limits.h>\n"
-	     "#include <krb5/krb5-types.h>\n",
-	     basename(filename));
+	     "#include <krb5/%s.h>\n",
+	     bn,
+	     type_file_string);
+    free(copy);
 
     fprintf (templatefile,
 	     "#include <%s>\n"
 	     "#include <%s>\n"
 	     "#include <krb5/der.h>\n"
-	     "#include <der-private.h>\n"
 	     "#include <asn1-template.h>\n",
 	     header, privheader);
 
@@ -293,9 +300,10 @@ close_generate (void)
         fclose (privheaderfile);
     if (templatefile)
         fclose (templatefile);
-    if (logfile)
+    if (logfile) {
         fprintf (logfile, "\n");
         fclose (logfile);
+    }
 }
 
 void
@@ -306,7 +314,8 @@ gen_assign_defval(const char *var, struct value *val)
 	fprintf(codefile, "if((%s = strdup(\"%s\")) == NULL)\nreturn ENOMEM;\n", var, val->u.stringvalue);
 	break;
     case integervalue:
-	fprintf(codefile, "%s = %d;\n", var, val->u.integervalue);
+	fprintf(codefile, "%s = %lld;\n",
+		var, (long long)val->u.integervalue);
 	break;
     case booleanvalue:
 	if(val->u.booleanvalue)
@@ -327,7 +336,8 @@ gen_compare_defval(const char *var, struct value *val)
 	fprintf(codefile, "if(strcmp(%s, \"%s\") != 0)\n", var, val->u.stringvalue);
 	break;
     case integervalue:
-	fprintf(codefile, "if(%s != %d)\n", var, val->u.integervalue);
+	fprintf(codefile, "if(%s != %lld)\n",
+		var, (long long)val->u.integervalue);
 	break;
     case booleanvalue:
 	if(val->u.booleanvalue)
@@ -353,9 +363,12 @@ generate_header_of_codefile(const char *name)
     codefile = fopen (filename, "w");
     if (codefile == NULL)
 	err (1, "fopen %s", filename);
-    fprintf(logfile, "%s ", filename);
+    if (logfile)
+        fprintf(logfile, "%s ", filename);
     free(filename);
     filename = NULL;
+    char *copy = estrdup(orig_filename);
+    char *bn = basename(copy);
     fprintf (codefile,
 	     "/* Generated from %s */\n"
 	     "/* Do not edit */\n\n"
@@ -366,19 +379,23 @@ generate_header_of_codefile(const char *name)
 	     "#include <string.h>\n"
 	     "#include <errno.h>\n"
 	     "#include <limits.h>\n"
-	     "#include <krb5/krb5-types.h>\n",
-	     basename(orig_filename));
+	     "#include <krb5/%s>\n",
+	     bn,
+	     type_file_string);
+    free(copy);
 
     fprintf (codefile,
-	     "#include <%s>\n"
-	     "#include <%s>\n",
+	     "#include \"%s\"\n"
+	     "#include \"%s\"\n",
 	     header, privheader);
     fprintf (codefile,
 	     "#include <krb5/asn1_err.h>\n"
 	     "#include <krb5/der.h>\n"
-	     "#include <der-private.h>\n"
-	     "#include <asn1-template.h>\n"
-	     "#include <krb5/parse_units.h>\n\n");
+	     "#include <asn1-template.h>\n\n");
+
+    if (parse_units_flag)
+	fprintf (codefile,
+		 "#include <krb5/parse_units.h>\n\n");
 
 }
 
@@ -400,8 +417,9 @@ generate_constant (const Symbol *s)
     case booleanvalue:
 	break;
     case integervalue:
-	fprintf (headerfile, "enum { %s = %d };\n\n",
-		 s->gen_name, s->value->u.integervalue);
+	fprintf (headerfile, "enum { %s = %lld };\n\n",
+		 s->gen_name,
+		 (long long)s->value->u.integervalue);
 	break;
     case nullvalue:
 	break;
@@ -409,7 +427,7 @@ generate_constant (const Symbol *s)
 	break;
     case objectidentifiervalue: {
 	struct objid *o, **list;
-	unsigned int i, len;
+	size_t i, len;
 	char *gen_upper;
 
 	if (!one_code_file)
@@ -436,16 +454,16 @@ generate_constant (const Symbol *s)
 		    o->label ? o->label : "label-less", o->value);
 	}
 
-	fprintf (codefile, "static unsigned oid_%s_variable_num[%d] =  {",
-		 s->gen_name, len);
+	fprintf (codefile, "static unsigned oid_%s_variable_num[%lu] =  {",
+		 s->gen_name, (unsigned long)len);
 	for (i = len ; i > 0; i--) {
 	    fprintf(codefile, "%d%s ", list[i - 1]->value, i > 1 ? "," : "");
 	}
 	fprintf(codefile, "};\n");
 
 	fprintf (codefile, "const heim_oid asn1_oid_%s = "
-		 "{ %d, oid_%s_variable_num };\n\n",
-		 s->gen_name, len, s->gen_name);
+		 "{ %lu, oid_%s_variable_num };\n\n",
+		 s->gen_name, (unsigned long)len, s->gen_name);
 
 	free(list);
 
@@ -543,8 +561,9 @@ define_asn1 (int level, Type *t)
 	if(t->members == NULL) {
             fprintf (headerfile, "INTEGER");
 	    if (t->range)
-		fprintf (headerfile, " (%d..%d)",
-			 t->range->min, t->range->max);
+		fprintf (headerfile, " (%lld..%lld)",
+			 (long long)t->range->min,
+			 (long long)t->range->max);
         } else {
 	    Member *m;
             fprintf (headerfile, "INTEGER {\n");
@@ -585,7 +604,7 @@ define_asn1 (int level, Type *t)
     case TSet:
     case TSequence: {
 	Member *m;
-	int max_width = 0;
+	size_t max_width = 0;
 
 	if(t->type == TChoice)
 	    fprintf(headerfile, "CHOICE {\n");
@@ -600,13 +619,13 @@ define_asn1 (int level, Type *t)
 	max_width += 3;
 	if(max_width < 16) max_width = 16;
 	ASN1_TAILQ_FOREACH(m, t->members, members) {
-	    int width = max_width;
+	    size_t width = max_width;
 	    space(level + 1);
 	    if (m->ellipsis) {
 		fprintf (headerfile, "...");
 	    } else {
 		width -= fprintf(headerfile, "%s", m->name);
-		fprintf(headerfile, "%*s", width, "");
+		fprintf(headerfile, "%*s", (int)width, "");
 		define_asn1(level + 1, m->type);
 		if(m->optional)
 		    fprintf(headerfile, " OPTIONAL");
@@ -726,15 +745,17 @@ define_type (int level, const char *name, const char *basename, Type *t, int typ
             fprintf (headerfile, "} %s;\n", name);
 	} else if (t->range == NULL) {
 	    fprintf (headerfile, "heim_integer %s;\n", name);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    fprintf (headerfile, "int64_t %s;\n", name);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    fprintf (headerfile, "uint64_t %s;\n", name);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    fprintf (headerfile, "int %s;\n", name);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    fprintf (headerfile, "unsigned int %s;\n", name);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    fprintf (headerfile, "unsigned int %s;\n", name);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
-		 name, t->range->min, t->range->max);
+	    errx(1, "%s: unsupported range %lld -> %lld",
+		 name, (long long)t->range->min, (long long)t->range->max);
 	break;
     case TBoolean:
 	space(level);
@@ -747,7 +768,7 @@ define_type (int level, const char *name, const char *basename, Type *t, int typ
     case TBitString: {
 	Member *m;
 	Type i;
-	struct range range = { 0, INT_MAX };
+	struct range range = { 0, UINT_MAX };
 
 	i.type = TInteger;
 	i.range = &range;
@@ -846,7 +867,7 @@ define_type (int level, const char *name, const char *basename, Type *t, int typ
     case TSetOf:
     case TSequenceOf: {
 	Type i;
-	struct range range = { 0, INT_MAX };
+	struct range range = { 0, UINT_MAX };
 
 	getnewbasename(&newbasename, typedefp, basename, name);
 
@@ -891,7 +912,7 @@ define_type (int level, const char *name, const char *basename, Type *t, int typ
 	    fprintf(headerfile, "heim_octet_string _save;\n");
 	}
 	space(level + 1);
-	fprintf (headerfile, "enum {\n");
+	fprintf (headerfile, "enum %s_enum {\n", newbasename);
 	m = have_ellipsis(t);
 	if (m) {
 	    space(level + 2);
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_copy.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_copy.c
index 10ba2b7a6..8562e0362 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_copy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_copy.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_copy.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_copy.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static int used_fail;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_decode.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_decode.c
index 6539e0659..32415b361 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_decode.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_decode.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_decode.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_decode.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "gen_locl.h"
 #include "lex.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_decode.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static void
 decode_primitive (const char *typename, const char *name, const char *forwstr)
@@ -191,22 +191,22 @@ range_check(const char *name,
 {
     if (r->min == r->max + 2 || r->min < r->max)
 	fprintf (codefile,
-		 "if ((%s)->%s > %d) {\n"
+		 "if ((%s)->%s > %lld) {\n"
 		 "e = ASN1_MAX_CONSTRAINT; %s;\n"
 		 "}\n",
-		 name, length, r->max, forwstr);
-    if (r->min - 1 == r->max || r->min < r->max)
+		 name, length, (long long)r->max, forwstr);
+    if ((r->min - 1 == r->max || r->min < r->max) && r->min > 0)
 	fprintf (codefile,
-		 "if ((%s)->%s < %d) {\n"
+		 "if ((%s)->%s < %lld) {\n"
 		 "e = ASN1_MIN_CONSTRAINT; %s;\n"
 		 "}\n",
-		 name, length, r->min, forwstr);
+		 name, length, (long long)r->min, forwstr);
     if (r->max == r->min)
 	fprintf (codefile,
-		 "if ((%s)->%s != %d) {\n"
+		 "if ((%s)->%s != %lld) {\n"
 		 "e = ASN1_EXACT_CONSTRAINT; %s;\n"
 		 "}\n",
-		 name, length, r->min, forwstr);
+		 name, length, (long long)r->min, forwstr);
 }
 
 static int
@@ -244,6 +244,14 @@ decode_type (const char *name, const Type *t, int optional,
     }
     case TInteger:
 	if(t->members) {
+	    /*
+	     * This will produce a worning, how its hard to fix since:
+	     * if its enum to an NameType, we can add appriate
+	     * type-cast. If its not though, we have to figure out if
+	     * there is negative enum enum and use appropriate
+	     * signness and size on the intertype we cast the result
+	     * too.
+	     */
 	    fprintf(codefile,
 		    "{\n"
 		    "int enumint;\n");
@@ -254,15 +262,17 @@ decode_type (const char *name, const Type *t, int optional,
 		    name);
 	} else if (t->range == NULL) {
 	    decode_primitive ("heim_integer", name, forwstr);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    decode_primitive ("integer64", name, forwstr);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    decode_primitive ("unsigned64", name, forwstr);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    decode_primitive ("integer", name, forwstr);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    decode_primitive ("unsigned", name, forwstr);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    decode_primitive ("unsigned", name, forwstr);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
-		 name, t->range->min, t->range->max);
+	    errx(1, "%s: unsupported range %lld -> %lld",
+		 name, (long long)t->range->min, (long long)t->range->max);
 	break;
     case TBoolean:
       decode_primitive ("boolean", name, forwstr);
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_encode.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_encode.c
index 6b0d5a081..58ebb27d9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_encode.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_encode.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_encode.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_encode.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -35,8 +35,6 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
-
 static void
 encode_primitive (const char *typename, const char *name)
 {
@@ -52,7 +50,7 @@ classname(Der_class class)
 {
     const char *cn[] = { "ASN1_C_UNIV", "ASN1_C_APPL",
 			 "ASN1_C_CONTEXT", "ASN1_C_PRIV" };
-    if(class < ASN1_C_UNIV || class > ASN1_C_PRIVATE)
+    if ((int)class >= sizeof(cn) / sizeof(cn[0]))
 	return "???";
     return cn[class];
 }
@@ -131,15 +129,18 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 	    fprintf(codefile, "}\n;");
 	} else if (t->range == NULL) {
 	    encode_primitive ("heim_integer", name);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    encode_primitive ("integer64", name);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    encode_primitive ("unsigned64", name);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    encode_primitive ("integer", name);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    encode_primitive ("unsigned", name);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    encode_primitive ("unsigned", name);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
-		 name, t->range->min, t->range->max);
+	    errx(1, "%s: unsupported range %lld -> %lld",
+		 name, (long long)t->range->min, (long long)t->range->max);
+
 	constructed = 0;
 	break;
     case TBoolean:
@@ -289,7 +290,7 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 
 	fprintf(codefile,
 		"{\n"
-		"struct heim_octet_string *val;\n"
+		"heim_octet_string *val;\n"
 		"size_t elen = 0, totallen = 0;\n"
 		"int eret = 0;\n");
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_free.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_free.c
index 0717a1d77..e6e10786a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_free.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_free.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_free.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_free.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_free.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static void
 free_primitive (const char *typename, const char *name)
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_glue.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_glue.c
index 4baa93e57..0e8a911fd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_glue.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_glue.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1999, 2000, 2003 - 2005 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_glue.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static void
 generate_2int (const Type *t, const char *gen_name)
@@ -149,7 +149,8 @@ generate_glue (const Type *t, const char *gen_name)
 	if (!ASN1_TAILQ_EMPTY(t->members)) {
 	    generate_2int (t, gen_name);
 	    generate_int2 (t, gen_name);
-	    generate_units (t, gen_name);
+	    if (parse_units_flag)
+		generate_units (t, gen_name);
 	}
 	break;
     default :
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_length.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_length.c
index 048a19483..46c9ad162 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_length.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_length.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_length.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_length.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_length.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static void
 length_primitive (const char *typename,
@@ -82,16 +82,17 @@ length_type (const char *name, const Type *t,
 	    fprintf(codefile, "}\n");
 	} else if (t->range == NULL) {
 	    length_primitive ("heim_integer", name, variable);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    length_primitive ("integer64", name, variable);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    length_primitive ("unsigned64", name, variable);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    length_primitive ("integer", name, variable);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    length_primitive ("unsigned", name, variable);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    length_primitive ("unsigned", name, variable);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
-		 name, t->range->min, t->range->max);
-
+	    errx(1, "%s: unsupported range %lld -> %lld",
+		 name, (long long)t->range->min, (long long)t->range->max);
 	break;
     case TBoolean:
 	fprintf (codefile, "%s += 1;\n", variable);
@@ -190,14 +191,15 @@ length_type (const char *name, const Type *t,
 	fprintf (codefile,
 		 "{\n"
 		 "size_t %s_oldret = %s;\n"
-		 "int i;\n"
+		 "unsigned int n_%s;\n"
 		 "%s = 0;\n",
-		 tmpstr, variable, variable);
+		 tmpstr, variable, tmpstr, variable);
 
-	fprintf (codefile, "for(i = (%s)->len - 1; i >= 0; --i){\n", name);
+	fprintf (codefile, "for(n_%s = (%s)->len; n_%s > 0; --n_%s){\n",
+		 tmpstr, name, tmpstr, tmpstr);
 	fprintf (codefile, "size_t %s_for_oldret = %s;\n"
 		 "%s = 0;\n", tmpstr, variable, variable);
-	if (asprintf (&n, "&(%s)->val[i]", name) < 0  || n == NULL)
+	if (asprintf (&n, "&(%s)->val[n_%s - 1]", name, tmpstr) < 0  || n == NULL)
 	    errx(1, "malloc");
 	if (asprintf (&sname, "%s_S_Of", tmpstr) < 0 || sname == NULL)
 	    errx(1, "malloc");
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_locl.h b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_locl.h
index a23562ad1..c509b6c94 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_locl.h,v 1.1.1.2 2011/04/14 14:08:21 elric Exp $	*/
+/*	$NetBSD: gen_locl.h,v 1.3 2017/01/29 19:23:28 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -52,8 +52,8 @@
 #include <krb5/roken.h>
 #include "hash.h"
 #include "symbol.h"
-#include <krb5/asn1-common.h>
-#include <krb5/der.h>
+#include "asn1-common.h"
+#include "der.h"
 #include "der-private.h"
 
 void generate_type (const Symbol *);
@@ -94,10 +94,13 @@ void gen_template_import(const Symbol *);
 
 
 extern FILE *privheaderfile, *headerfile, *codefile, *logfile, *templatefile;
+extern const char *fuzzer_string;
 extern int support_ber;
 extern int template_flag;
 extern int rfc1510_bitstring;
 extern int one_code_file;
+extern int parse_units_flag;
+extern char *type_file_string;
 
 extern int error_flag;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_seq.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_seq.c
index f9d5c0d61..14b891849 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_seq.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_seq.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gen_seq.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_seq.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: gen_seq.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 void
 generate_type_seq (const Symbol *s)
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_template.c b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_template.c
index fb6a8943a..e6544bb30 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/gen_template.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/gen_template.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: gen_template.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gen_template.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
- * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ * Portions Copyright (c) 2009 - 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,11 +54,13 @@ integer_symbol(const char *basename, const Type *t)
 	return "int"; /* XXX enum foo */
     else if (t->range == NULL)
 	return "heim_integer";
-    else if (t->range->min == INT_MIN && t->range->max == INT_MAX)
+    else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX)
+	return "int64_t";
+    else if (t->range->min >= 0 && t->range->max > UINT_MAX)
+	return "uint64_t";
+    else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX)
 	return "int";
-    else if (t->range->min == 0 && t->range->max == UINT_MAX)
-	return "unsigned";
-    else if (t->range->min == 0 && t->range->max == INT_MAX)
+    else if (t->range->min >= 0 && t->range->max <= UINT_MAX)
 	return "unsigned";
     else {
 	abort();
@@ -115,6 +117,12 @@ ia5string_symbol(const char *basename, const Type *t)
     return "heim_ia5_string";
 }
 
+static const char *
+teletexstring_symbol(const char *basename, const Type *t)
+{
+    return "heim_teletex_string";
+}
+
 static const char *
 visiblestring_symbol(const char *basename, const Type *t)
 {
@@ -166,6 +174,7 @@ struct {
     { TGeneralString, generalstring_symbol, 0 },
     { TGeneralizedTime, time_symbol, 0 },
     { TIA5String, ia5string_symbol, 0 },
+    { TTeletexString, generalstring_symbol, 0 },
     { TInteger, integer_symbol, 0 },
     { TOID, oid_symbol, 0 },
     { TOctetString, octetstring_symbol, 0 },
@@ -177,6 +186,7 @@ struct {
     { TType, ttype_symbol, 1 },
     { TUTCTime, time_symbol, 0 },
     { TUniversalString, universalstring_symbol, 0 },
+    { TTeletexString, teletexstring_symbol, 0 },
     { TVisibleString,  visiblestring_symbol, 0 },
     { TUTF8String, utf8string_symbol, 0 },
     { TChoice, sequence_symbol, 1 },
@@ -223,12 +233,12 @@ symbol_name(const char *basename, const Type *t)
 
 
 static char *
-partial_offset(const char *basetype, const char *name, int need_offset)
+partial_offset(const char *basetype, const char *name, int need_offset, int isstruct)
 {
     char *str;
     if (name == NULL || need_offset == 0)
 	return strdup("0");
-    if (asprintf(&str, "offsetof(struct %s, %s)", basetype, name) < 0 || str == NULL)
+    if (asprintf(&str, "offsetof(%s%s, %s)", isstruct ? "struct " : "", basetype, name) < 0 || str == NULL)
 	errx(1, "malloc");
     return str;
 }
@@ -252,13 +262,13 @@ struct tlist {
 
 ASN1_TAILQ_HEAD(tlisthead, tlist);
 
-static void tlist_header(struct tlist *, const char *, ...) __attribute__((__format__(__printf__, 2, 3)));
+static void tlist_header(struct tlist *, const char *, ...) __attribute__ ((__format__ (__printf__, 2, 3)));
 static struct template *
-    add_line(struct templatehead *, const char *, ...) __attribute__((__format__(__printf__, 2, 3)));
+    add_line(struct templatehead *, const char *, ...) __attribute__ ((__format__ (__printf__, 2, 3)));
 static int tlist_cmp(const struct tlist *, const struct tlist *);
 
 static void add_line_pointer(struct templatehead *, const char *, const char *, const char *, ...)
-    __attribute__((__format__(__printf__, 4, 5)));
+    __attribute__ ((__format__ (__printf__, 4, 5)));
 
 
 static struct tlisthead tlistmaster = ASN1_TAILQ_HEAD_INITIALIZER(tlistmaster);
@@ -308,7 +318,7 @@ tlist_print(struct tlist *tl)
     unsigned int i = 1;
     FILE *f = get_code_file();
 
-    fprintf(f, "static const struct asn1_template asn1_%s[] = {\n", tl->name);
+    fprintf(f, "const struct asn1_template asn1_%s[] = {\n", tl->name);
     fprintf(f, "/* 0 */ %s,\n", tl->header);
     ASN1_TAILQ_FOREACH(q, &tl->template, members) {
 	int last = (ASN1_TAILQ_LAST(&tl->template, templatehead) == q);
@@ -333,6 +343,10 @@ tlist_cmp_name(const char *tname, const char *qname)
 {
     struct tlist *tl = tlist_find_by_name(tname);
     struct tlist *ql = tlist_find_by_name(qname);
+    if (tl == NULL)
+	return 1;
+    if (ql == NULL)
+	return -1;
     return tlist_cmp(tl, ql);
 }
 
@@ -433,7 +447,7 @@ use_extern(const Symbol *s)
 }
 
 static int
-is_struct(Type *t, int isstruct)
+is_struct(const Type *t, int isstruct)
 {
     size_t i;
 
@@ -465,24 +479,28 @@ compact_tag(const Type *t)
 }
 
 static void
-template_members(struct templatehead *temp, const char *basetype, const char *name, const Type *t, int optional, int isstruct, int need_offset)
+template_members(struct templatehead *temp, const char *basetype, const char *name, const Type *t, int optional, int implicit, int isstruct, int need_offset)
 {
     char *poffset = NULL;
 
     if (optional && t->type != TTag && t->type != TType)
 	errx(1, "%s...%s is optional and not a (TTag or TType)", basetype, name);
 
-    poffset = partial_offset(basetype, name, need_offset);
+    poffset = partial_offset(basetype, name, need_offset, isstruct);
 
     switch (t->type) {
     case TType:
 	if (use_extern(t->symbol)) {
-	    add_line(temp, "{ A1_OP_TYPE_EXTERN %s, %s, &asn1_extern_%s}",
+	    add_line(temp, "{ A1_OP_TYPE_EXTERN %s%s, %s, &asn1_extern_%s}",
 		     optional ? "|A1_FLAG_OPTIONAL" : "",
+		     implicit ? "|A1_FLAG_IMPLICIT" : "",
 		     poffset, t->symbol->gen_name);
 	} else {
 	    add_line_pointer(temp, t->symbol->gen_name, poffset,
-			     "A1_OP_TYPE %s", optional ? "|A1_FLAG_OPTIONAL" : "");
+			     "A1_OP_TYPE %s%s",
+			     optional ? "|A1_FLAG_OPTIONAL" : "",
+			     implicit ? "|A1_FLAG_IMPLICIT" : "");
+
 	}
 	break;
     case TInteger: {
@@ -492,15 +510,17 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	    itype = "IMEMBER";
 	else if (t->range == NULL)
 	    itype = "HEIM_INTEGER";
-	else if (t->range->min == INT_MIN && t->range->max == INT_MAX)
+	else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX)
+	    itype = "INTEGER64";
+	else if (t->range->min >= 0 && t->range->max > UINT_MAX)
+	    itype = "UNSIGNED64";
+	else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX)
 	    itype = "INTEGER";
-	else if (t->range->min == 0 && t->range->max == UINT_MAX)
-	    itype = "UNSIGNED";
-	else if (t->range->min == 0 && t->range->max == INT_MAX)
+	else if (t->range->min >= 0 && t->range->max <= UINT_MAX)
 	    itype = "UNSIGNED";
 	else
-	    errx(1, "%s: unsupported range %d -> %d",
-		 name, t->range->min, t->range->max);
+	    errx(1, "%s: unsupported range %lld -> %lld",
+		 name, (long long)t->range->min, (long long)t->range->max);
 
 	add_line(temp, "{ A1_PARSE_T(A1T_%s), %s, NULL }", itype, poffset);
 	break;
@@ -547,19 +567,22 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
     case TNull:
 	break;
     case TBitString: {
-	struct templatehead template = ASN1_TAILQ_HEAD_INITIALIZER(template);
+	struct templatehead template;
 	struct template *q;
 	Member *m;
 	size_t count = 0, i;
 	char *bname = NULL;
 	FILE *f = get_code_file();
+	static unsigned long bmember_counter = 0;
+
+	ASN1_TAILQ_INIT(&template);
 
 	if (ASN1_TAILQ_EMPTY(t->members)) {
 	    add_line(temp, "{ A1_PARSE_T(A1T_HEIM_BIT_STRING), %s, NULL }", poffset);
 	    break;
 	}
 
-	if (asprintf(&bname, "bmember_%s_%p", name ? name : "", t) < 0 || bname == NULL)
+	if (asprintf(&bname, "bmember_%s_%lu", name ? name : "", bmember_counter++) < 0 || bname == NULL)
 	    errx(1, "malloc");
 	output_name(bname);
 
@@ -591,6 +614,8 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
     case TSequence: {
 	Member *m;
 
+	fprintf(get_code_file(), "/* tsequence: members isstruct: %d */\n", isstruct);
+
 	ASN1_TAILQ_FOREACH(m, t->members, members) {
 	    char *newbasename = NULL;
 
@@ -605,7 +630,7 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	    if (newbasename == NULL)
 		errx(1, "malloc");
 
-	    template_members(temp, newbasename, m->gen_name, m->type, m->optional, isstruct, 1);
+	    template_members(temp, newbasename, m->gen_name, m->type, m->optional, 0, isstruct, 1);
 
 	    free(newbasename);
 	}
@@ -616,13 +641,47 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	char *tname = NULL, *elname = NULL;
 	const char *sename, *dupname;
 	int subtype_is_struct = is_struct(t->subtype, isstruct);
+	static unsigned long tag_counter = 0;
+	int tagimplicit = (t->tag.tagenv == TE_IMPLICIT);
+	struct type *subtype;
+
+	fprintf(get_code_file(), "/* template_members: %s %s %s */\n", basetype, implicit ? "imp" : "exp", tagimplicit ? "imp" : "exp");
+
+	if (tagimplicit) {
+
+	    struct type *type = t->subtype;
+	    int have_tag = 0;
+
+	    while (!have_tag) {
+		if (type->type == TTag) {
+		    fprintf(get_code_file(), "/* template_members: imp skip tag */\n");
+		    type = type->subtype;
+		    have_tag = 1;
+		} else if(type->type == TType && type->symbol && type->symbol->type) {
+		    /* XXX really, we should stop here and find a
+		     * pointer to where this is encoded instead of
+		     * generated an new structure and hope that the
+		     * optimizer catch it later.
+		     */
+		    subtype_is_struct = is_struct(type, isstruct);
+		    fprintf(get_code_file(), "/* template_members: imp skip type %s isstruct: %d */\n",
+			    type->symbol->name, subtype_is_struct);
+		    type = type->symbol->type;
+		} else {
+		    have_tag = 1;
+		}
+	    }
+	    subtype = type;
+	} else {
+	    subtype = t->subtype;
+	}
 
 	if (subtype_is_struct)
 	    sename = basetype;
 	else
-	    sename = symbol_name(basetype, t->subtype);
+	    sename = symbol_name(basetype, subtype);
 
-	if (asprintf(&tname, "tag_%s_%p", name ? name : "", t) < 0 || tname == NULL)
+	if (asprintf(&tname, "tag_%s_%lu", name ? name : "", tag_counter++) < 0 || tname == NULL)
 	    errx(1, "malloc");
 	output_name(tname);
 
@@ -630,14 +689,15 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	    errx(1, "malloc");
 
 	generate_template_type(elname, &dupname, NULL, sename, name,
-			       t->subtype, 0, subtype_is_struct, 0);
+			       subtype, 0, subtype_is_struct, 0);
 
 	add_line_pointer(temp, dupname, poffset,
-			 "A1_TAG_T(%s,%s,%s)%s",
+			 "A1_TAG_T(%s,%s,%s)%s%s",
 			 classname(t->tag.tagclass),
-			 is_primitive_type(t->subtype->type)  ? "PRIM" : "CONS",
+			 is_primitive_type(subtype->type)  ? "PRIM" : "CONS",
 			 valuename(t->tag.tagclass, t->tag.tagvalue),
-			 optional ? "|A1_FLAG_OPTIONAL" : "");
+			 optional ? "|A1_FLAG_OPTIONAL" : "",
+			 tagimplicit ? "|A1_FLAG_IMPLICIT" : "");
 
 	free(tname);
 	free(elname);
@@ -649,6 +709,7 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	const char *type = NULL, *tname, *dupname;
 	char *sename = NULL, *elname = NULL;
 	int subtype_is_struct = is_struct(t->subtype, 0);
+	static unsigned long seof_counter = 0;
 
 	if (name && subtype_is_struct) {
 	    tname = "seofTstruct";
@@ -672,7 +733,7 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	else if (t->type == TSequenceOf) type = "A1_OP_SEQOF";
 	else abort();
 
-	if (asprintf(&elname, "%s_%s_%p", basetype, tname, t) < 0 || elname == NULL)
+	if (asprintf(&elname, "%s_%s_%lu", basetype, tname, seof_counter++) < 0 || elname == NULL)
 	    errx(1, "malloc");
 
 	generate_template_type(elname, &dupname, NULL, sename, NULL, t->subtype,
@@ -683,7 +744,7 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	break;
     }
     case TChoice: {
-	struct templatehead template = ASN1_TAILQ_HEAD_INITIALIZER(template);
+	struct templatehead template;
 	struct template *q;
 	size_t count = 0, i;
 	char *tname = NULL;
@@ -691,9 +752,12 @@ template_members(struct templatehead *temp, const char *basetype, const char *na
 	Member *m;
 	int ellipsis = 0;
 	char *e;
+	static unsigned long choice_counter = 0;
 
-	if (asprintf(&tname, "asn1_choice_%s_%s%x",
-		     basetype, name ? name : "", (unsigned int)(uintptr_t)t) < 0 || tname == NULL)
+	ASN1_TAILQ_INIT(&template);
+
+	if (asprintf(&tname, "asn1_choice_%s_%s%lu",
+		     basetype, name ? name : "", choice_counter++) < 0 || tname == NULL)
 	    errx(1, "malloc");
 
 	ASN1_TAILQ_FOREACH(m, t->members, members) {
@@ -805,12 +869,20 @@ generate_template_type(const char *varname,
 		       int optional, int isstruct, int need_offset)
 {
     struct tlist *tl;
-    const char *dup;
+    const char *d;
+    char *szt = NULL;
     int have_ellipsis = 0;
+    int implicit = 0;
+    int n;
 
     tl = tlist_new(varname);
 
-    template_members(&tl->template, basetype, name, type, optional, isstruct, need_offset);
+    if (type->type == TTag)
+	implicit = (type->tag.tagenv == TE_IMPLICIT);
+
+    fprintf(get_code_file(), "extern const struct asn1_template asn1_%s[];\n", tl->name);
+
+    template_members(&tl->template, basetype, name, type, optional, implicit, isstruct, need_offset);
 
     /* if its a sequence or set type, check if there is a ellipsis */
     if (type->type == TSequence || type->type == TSet) {
@@ -821,19 +893,34 @@ generate_template_type(const char *varname,
 	}
     }
 
+    if (isstruct)
+	if (name)
+	    n = asprintf(&szt, "struct %s_%s", basetype, name);
+	else
+	    n = asprintf(&szt, "struct %s", basetype);
+    else
+	n = asprintf(&szt, "%s", basetype);
+    if (n < 0 || szt == NULL)
+	errx(1, "malloc");
+
     if (ASN1_TAILQ_EMPTY(&tl->template) && compact_tag(type)->type != TNull)
 	errx(1, "Tag %s...%s with no content ?", basetype, name ? name : "");
 
-    tlist_header(tl, "{ 0%s%s, sizeof(%s%s), ((void *)%lu) }",
-		 (symname && preserve_type(symname)) ? "|A1_HF_PRESERVE" : "",
-		 have_ellipsis ? "|A1_HF_ELLIPSIS" : "",
-		 isstruct ? "struct " : "", basetype, tlist_count(tl));
+    fprintf(get_code_file(), "/* generate_template_type: %s */\n", tl->name);
 
-    dup = tlist_find_dup(tl);
-    if (dup) {
-	if (strcmp(dup, tl->name) == 0)
-	    errx(1, "found dup of ourself");
-	*dupname = dup;
+    tlist_header(tl, "{ 0%s%s, sizeof(%s), ((void *)%lu) }",
+		 (symname && preserve_type(symname)) ? "|A1_HF_PRESERVE" : "",
+		 have_ellipsis ? "|A1_HF_ELLIPSIS" : "", szt, tlist_count(tl));
+
+    free(szt);
+
+    d = tlist_find_dup(tl);
+    if (d) {
+#if 0
+	if (strcmp(d, tl->name) == 0)
+	    errx(1, "found dup of ourself: %s", d);
+#endif
+	*dupname = d;
     } else {
 	*dupname = tl->name;
 	tlist_print(tl);
@@ -873,11 +960,12 @@ generate_template(const Symbol *s)
 	    "int\n"
 	    "encode_%s(unsigned char *p, size_t len, const %s *data, size_t *size)\n"
 	    "{\n"
-	    "    return _asn1_encode(asn1_%s, p, len, data, size);\n"
+	    "    return _asn1_encode%s(asn1_%s, p, len, data, size);\n"
 	    "}\n"
 	    "\n",
 	    s->gen_name,
 	    s->gen_name,
+	    fuzzer_string,
 	    dupname);
 
     fprintf(f,
@@ -885,11 +973,12 @@ generate_template(const Symbol *s)
 	    "size_t\n"
 	    "length_%s(const %s *data)\n"
 	    "{\n"
-	    "    return _asn1_length(asn1_%s, data);\n"
+	    "    return _asn1_length%s(asn1_%s, data);\n"
 	    "}\n"
 	    "\n",
 	    s->gen_name,
 	    s->gen_name,
+	    fuzzer_string,
 	    dupname);
 
 
@@ -898,7 +987,7 @@ generate_template(const Symbol *s)
 	    "void\n"
 	    "free_%s(%s *data)\n"
 	    "{\n"
-	    "    _asn1_free(asn1_%s, data);\n"
+	    "    _asn1_free_top(asn1_%s, data);\n"
 	    "}\n"
 	    "\n",
 	    s->gen_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/hash.c b/crypto/external/bsd/heimdal/dist/lib/asn1/hash.c
index 6727db777..b2ba00824 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/hash.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/hash.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hash.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hash.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 #include "gen_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: hash.c,v 1.2 2017/01/28 21:31:45 christos Exp $");
 
 static Hashentry *_search(Hashtab * htab,	/* The hash table */
 			  void *ptr);	/* And key */
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/hash.h b/crypto/external/bsd/heimdal/dist/lib/asn1/hash.h
index 64e8e233b..a5d69fcf7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/hash.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/hash.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hash.h,v 1.1.1.2 2011/04/14 14:08:21 elric Exp $	*/
+/*	$NetBSD: hash.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/heim_asn1.h b/crypto/external/bsd/heimdal/dist/lib/asn1/heim_asn1.h
index 2871c0960..17377d06c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/heim_asn1.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/heim_asn1.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heim_asn1.h,v 1.1.1.1 2011/04/13 18:14:41 elric Exp $	*/
+/*	$NetBSD: heim_asn1.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/krb5.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/krb5.asn1
index a7227cac6..0752bb157 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/krb5.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/krb5.asn1
@@ -63,6 +63,8 @@ EXPORTS
 	PA-ServerReferralData,
 	PA-SvrReferralData,
 	PADATA-TYPE,
+	PA-FX-FAST-REQUEST,
+	PA-FX-FAST-REPLY,
 	Principal,
 	PrincipalName,
 	Principals,
@@ -72,7 +74,19 @@ EXPORTS
 	Ticket,
 	TicketFlags,
 	TransitedEncoding,
-	TypedData
+	TypedData,
+	KrbFastResponse,
+	KrbFastFinished,
+	KrbFastReq,
+	KrbFastArmor,
+	KDCFastState,
+	KDCFastCookie,
+	KDC-PROXY-MESSAGE,
+	KERB-TIMES,
+	KERB-CRED,
+	KERB-TGS-REQ-IN,
+	KERB-TGS-REQ-OUT,
+	KERB-ARMOR-SERVICE-REPLY
 	;
 
 NAME-TYPE ::= INTEGER {
@@ -86,10 +100,15 @@ NAME-TYPE ::= INTEGER {
 	KRB5_NT_SMTP_NAME(7),	-- Name in form of SMTP email name
 	KRB5_NT_ENTERPRISE_PRINCIPAL(10), -- Windows 2000 UPN
 	KRB5_NT_WELLKNOWN(11),	-- Wellknown
+	KRB5_NT_SRV_HST_DOMAIN(12), -- Domain based service with host name as instance (RFC5179)
 	KRB5_NT_ENT_PRINCIPAL_AND_ID(-130), -- Windows 2000 UPN and SID
 	KRB5_NT_MS_PRINCIPAL(-128), -- NT 4 style name
 	KRB5_NT_MS_PRINCIPAL_AND_ID(-129), -- NT style name and SID
-	KRB5_NT_NTLM(-1200) -- NTLM name, realm is domain
+	KRB5_NT_NTLM(-1200), -- NTLM name, realm is domain
+	KRB5_NT_X509_GENERAL_NAME(-1201), -- x509 general name (base64 encoded)
+	KRB5_NT_GSS_HOSTBASED_SERVICE(-1202), -- not used; remove
+	KRB5_NT_CACHE_UUID(-1203), -- name is actually a uuid pointing to ccache, use client name in cache
+	KRB5_NT_SRV_HST_NEEDS_CANON (-195894762) -- Internal: indicates that name canonicalization is needed
 }
 
 -- message types
@@ -142,6 +161,7 @@ PADATA-TYPE ::= INTEGER {
 	KRB5-PADATA-SAM-CHALLENGE2(30),		-- (kenh@pobox.com)
 	KRB5-PADATA-SAM-RESPONSE2(31),		-- (kenh@pobox.com)
 	KRB5-PA-EXTRA-TGT(41),			-- Reserved extra TGT
+	KRB5-PADATA-FX-FAST-ARMOR(71),		-- fast armor
 	KRB5-PADATA-TD-KRB-PRINCIPAL(102),	-- PrincipalName
 	KRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS(104), -- PKINIT
 	KRB5-PADATA-PK-TD-CERTIFICATE-INDEX(105), -- PKINIT
@@ -157,7 +177,6 @@ PADATA-TYPE ::= INTEGER {
 						-- tell KDC that is supports
 						-- the asCheckSum in the
 						--  PK-AS-REP
-	KRB5-PADATA-CLIENT-CANONICALIZED(133),	-- referals
 	KRB5-PADATA-FX-COOKIE(133),		-- krb-wg-preauth-framework
 	KRB5-PADATA-AUTHENTICATION-SET(134),	-- krb-wg-preauth-framework
 	KRB5-PADATA-AUTH-SET-SELECTED(135),	-- krb-wg-preauth-framework
@@ -214,6 +233,8 @@ CKSUMTYPE ::= INTEGER {
 	CKSUMTYPE_SHA1(14),
 	CKSUMTYPE_HMAC_SHA1_96_AES_128(15),
 	CKSUMTYPE_HMAC_SHA1_96_AES_256(16),
+	CKSUMTYPE_HMAC_SHA256_128_AES128(19),
+	CKSUMTYPE_HMAC_SHA384_192_AES256(20),
 	CKSUMTYPE_GSSAPI(0x8003),
 	CKSUMTYPE_HMAC_MD5(-138),	-- unofficial microsoft number
 	CKSUMTYPE_HMAC_MD5_ENC(-1138)	-- even more unofficial
@@ -233,6 +254,8 @@ ENCTYPE ::= INTEGER {
 	KRB5_ENCTYPE_DES3_CBC_SHA1(16),	-- with key derivation
 	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96(17),
 	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96(18),
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128(19),
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192(20),
 	KRB5_ENCTYPE_ARCFOUR_HMAC_MD5(23),
 	KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56(24),
 	KRB5_ENCTYPE_ENCTYPE_PK_CROSS(48),
@@ -319,8 +342,8 @@ TicketFlags ::= BIT STRING {
 	hw-authent(11),
 	transited-policy-checked(12),
 	ok-as-delegate(13),
-	anonymous(14),
-	enc-pa-rep(15)
+	enc-pa-rep(15),
+	anonymous(16)
 }
 
 KDCOptions ::= BIT STRING {
@@ -332,9 +355,9 @@ KDCOptions ::= BIT STRING {
 	allow-postdate(5),
 	postdated(6),
 	renewable(8),
-	request-anonymous(14),
+	constrained-delegation(14), -- ms extension (aka cname-in-addl-tkt)
 	canonicalize(15),
-	constrained-delegation(16), -- ms extension
+	request-anonymous(16),
 	disable-transited-check(26),
 	renewable-ok(27),
 	enc-tkt-in-skey(28),
@@ -361,7 +384,7 @@ LastReq ::= SEQUENCE OF SEQUENCE {
 
 EncryptedData ::= SEQUENCE {
 	etype[0] 		ENCTYPE, -- EncryptionType
-	kvno[1]			krb5uint32 OPTIONAL,
+	kvno[1]			krb5int32 OPTIONAL,
 	cipher[2]		OCTET STRING -- ciphertext
 }
 
@@ -732,16 +755,6 @@ KRB5SignedPath ::= SEQUENCE {
 	method_data[3]  METHOD-DATA OPTIONAL
 }
 
-PA-ClientCanonicalizedNames ::= SEQUENCE{
-	requested-name	[0] PrincipalName,
-	mapped-name	[1] PrincipalName
-}
-
-PA-ClientCanonicalized ::= SEQUENCE {
-	names		[0] PA-ClientCanonicalizedNames,
-	canon-checksum	[1] Checksum
-}
-
 AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD --
 	login-alias	[0] PrincipalName,
 	checksum	[1] Checksum
@@ -766,12 +779,12 @@ PA-ServerReferralData ::= SEQUENCE {
 FastOptions ::= BIT STRING {
 	    reserved(0),
 	    hide-client-names(1),
-	    kdc-follow--referrals(16)
+	    kdc-follow-referrals(16)
 }
 
 KrbFastReq ::= SEQUENCE {
 	fast-options [0] FastOptions,
-	padata       [1] SEQUENCE OF PA-DATA,
+	padata       [1] METHOD-DATA,
 	req-body     [2] KDC-REQ-BODY,
 	...
 }
@@ -798,15 +811,15 @@ KrbFastFinished ::= SEQUENCE {
 	usec        [1] krb5int32,
 	crealm      [2] Realm,
 	cname       [3] PrincipalName,
-	checksum    [4] Checksum,
-	ticket-checksum [5] Checksum,
+	ticket-checksum [4] Checksum,
 	...
 }
 
 KrbFastResponse ::= SEQUENCE {
-	padata      [0] SEQUENCE OF PA-DATA,
-	rep-key     [1] EncryptionKey OPTIONAL,
-	finished    [2] KrbFastFinished OPTIONAL,
+	padata      	[0] METHOD-DATA,
+        strengthen-key	[1] EncryptionKey OPTIONAL,
+	finished	[2] KrbFastFinished OPTIONAL,
+        nonce		[3] krb5uint32,
 	...
 }
 
@@ -820,6 +833,89 @@ PA-FX-FAST-REPLY ::= CHOICE {
 	...
 }
 
+KDCFastFlags ::= BIT STRING {
+	use_reply_key(0),
+	reply_key_used(1),
+	reply_key_replaced(2),
+	kdc_verfied(3)
+}
+
+-- KDCFastState is stored in FX_COOKIE
+KDCFastState ::= SEQUENCE {
+	flags [0] KDCFastFlags,
+	expiration [1] GeneralizedTime,
+	fast-state [2] METHOD-DATA,
+	expected-pa-types [3] SEQUENCE OF PADATA-TYPE OPTIONAL
+}
+
+KDCFastCookie ::= SEQUENCE {
+	version [0] UTF8String,
+	cookie [1] EncryptedData
+}
+
+KDC-PROXY-MESSAGE ::= SEQUENCE {
+	kerb-message	[0] OCTET STRING,
+	target-domain	[1] Realm OPTIONAL,
+	dclocator-hint	[2] INTEGER OPTIONAL
+}
+
+-- these messages are used in the GSSCred communication and is not part of Kerberos propper
+
+KERB-TIMES ::= SEQUENCE {
+	authtime	[0] KerberosTime,
+	starttime	[1] KerberosTime,
+	endtime		[2] KerberosTime,
+	renew_till	[3] KerberosTime
+}
+
+KERB-CRED ::= SEQUENCE {
+	client		[0] Principal,
+	server		[1] Principal,
+	keyblock	[2] EncryptionKey,
+	times		[3] KERB-TIMES,
+	ticket		[4] OCTET STRING,
+	authdata	[5] OCTET STRING,
+	addresses	[6] HostAddresses,
+	flags		[7] TicketFlags
+}
+
+KERB-TGS-REQ-IN ::= SEQUENCE {
+	cache		[0] OCTET STRING SIZE (16),
+	addrs		[1] HostAddresses,
+	flags		[2] krb5uint32,
+	imp		[3] Principal OPTIONAL,
+	ticket		[4] OCTET STRING OPTIONAL,
+	in_cred		[5] KERB-CRED,
+	krbtgt		[6] KERB-CRED,
+	padata		[7] METHOD-DATA
+}
+
+KERB-TGS-REQ-OUT ::= SEQUENCE {
+	subkey		[0] EncryptionKey OPTIONAL,
+	t		[1] TGS-REQ
+}
+
+
+
+KERB-TGS-REP-IN ::= SEQUENCE {
+	cache		[0] OCTET STRING SIZE (16),
+	subkey		[1] EncryptionKey OPTIONAL,
+	in_cred		[2] KERB-CRED,
+	t		[3] TGS-REP
+}
+
+KERB-TGS-REP-OUT ::= SEQUENCE {
+	cache		[0] OCTET STRING SIZE (16),
+	cred		[1] KERB-CRED,
+	subkey		[2] EncryptionKey
+}
+
+KERB-ARMOR-SERVICE-REPLY ::= SEQUENCE {
+	armor		[0] KrbFastArmor,
+	armor-key	[1] EncryptionKey
+}
+
+
 END
 
 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/lex.h b/crypto/external/bsd/heimdal/dist/lib/asn1/lex.h
index a9b1a6b47..39cf0db1f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/lex.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/lex.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: lex.h,v 1.1.1.2 2011/04/14 14:08:21 elric Exp $	*/
+/*	$NetBSD: lex.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 #include <krb5/roken.h>
 
 void lex_error_message (const char *, ...)
-__attribute__ ((format (printf, 1, 2)));
+__attribute__ ((__format__ (__printf__, 1, 2)));
 extern int error_flag;
 
 int yylex(void);
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/lex.l b/crypto/external/bsd/heimdal/dist/lib/asn1/lex.l
index b691c2428..bc1ec1151 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/lex.l
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/lex.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: lex.l,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: lex.l,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 %{
 /*
@@ -42,6 +42,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
+#include <stdint.h>
 #include <string.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
@@ -257,7 +258,7 @@ WITH			{ return kw_WITH; }
 			}
 
 -?0x[0-9A-Fa-f]+|-?[0-9]+ { char *e, *y = yytext;
-			  yylval.constant = strtol((const char *)yytext,
+			  yylval.constant = strtoll((const char *)yytext,
 						   &e, 0);
 			  if(e == y)
 			    lex_error_message("malformed constant (%s)", yytext);
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/libasn1-exports.def b/crypto/external/bsd/heimdal/dist/lib/asn1/libasn1-exports.def
index 6dfb93ea0..62f4337ad 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/libasn1-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/libasn1-exports.def
@@ -58,9 +58,15 @@ EXPORTS
 	asn1_oid_id_ecPublicKey	DATA
 	asn1_oid_id_ec_group_secp160r1	DATA
 	asn1_oid_id_ec_group_secp160r2	DATA
+	asn1_oid_id_ec_group_secp224r1	DATA
 	asn1_oid_id_ec_group_secp256r1	DATA
+	asn1_oid_id_ec_group_secp384r1	DATA
+	asn1_oid_id_ec_group_secp521r1	DATA
 	asn1_oid_id_ecdsa_with_SHA1	DATA
+	asn1_oid_id_ecdsa_with_SHA224   DATA
 	asn1_oid_id_ecdsa_with_SHA256	DATA
+	asn1_oid_id_ecdsa_with_SHA384   DATA
+	asn1_oid_id_ecdsa_with_SHA512   DATA
 	asn1_oid_id_heim_rsa_pkcs1_x509	DATA
 	asn1_oid_id_ms_cert_enroll_domaincontroller	DATA
 	asn1_oid_id_ms_client_authentication	DATA
@@ -299,6 +305,8 @@ EXPORTS
 	copy_IssuerAndSerialNumber
 	copy_KDCDHKeyInfo
 	copy_KDCDHKeyInfo_Win2k
+	copy_KDCFastCookie
+	copy_KDCFastState
 	copy_KDCOptions
 	copy_KDC_REP
 	copy_KDC_REQ
@@ -346,8 +354,6 @@ EXPORTS
 	copy_OriginatorInfo
 	copy_OtherName
 	copy_PADATA_TYPE
-	copy_PA_ClientCanonicalized
-	copy_PA_ClientCanonicalizedNames
 	copy_PA_DATA
 	copy_PA_ENC_SAM_RESPONSE_ENC
 	copy_PA_ENC_TS_ENC
@@ -551,6 +557,8 @@ EXPORTS
 	decode_IssuerAndSerialNumber
 	decode_KDCDHKeyInfo
 	decode_KDCDHKeyInfo_Win2k
+	decode_KDCFastCookie
+	decode_KDCFastState
 	decode_KDCOptions
 	decode_KDC_REP
 	decode_KDC_REQ
@@ -598,8 +606,6 @@ EXPORTS
 	decode_OriginatorInfo
 	decode_OtherName
 	decode_PADATA_TYPE
-	decode_PA_ClientCanonicalized
-	decode_PA_ClientCanonicalizedNames
 	decode_PA_DATA
 	decode_PA_ENC_SAM_RESPONSE_ENC
 	decode_PA_ENC_TS_ENC
@@ -699,11 +705,13 @@ EXPORTS
 	der_copy_heim_integer
 	der_copy_ia5_string
 	der_copy_integer
+	der_copy_integer64
 	der_copy_octet_string
 	der_copy_oid
 	der_copy_printable_string
 	der_copy_universal_string
 	der_copy_unsigned
+	der_copy_unsigned64
 	der_copy_utctime
 	der_copy_utf8string
 	der_copy_visible_string
@@ -714,11 +722,13 @@ EXPORTS
 	der_free_heim_integer
 	der_free_ia5_string
 	der_free_integer
+	der_free_integer64
 	der_free_octet_string
 	der_free_oid
 	der_free_printable_string
 	der_free_universal_string
 	der_free_unsigned
+	der_free_unsigned64
 	der_free_utctime
 	der_free_utf8string
 	der_free_visible_string
@@ -732,6 +742,7 @@ EXPORTS
 	der_get_heim_integer
 	der_get_ia5_string
 	der_get_integer
+	der_get_integer64
 	der_get_length
 	der_get_octet_string
 	der_get_octet_string_ber
@@ -744,6 +755,7 @@ EXPORTS
 	der_get_type_num
 	der_get_universal_string
 	der_get_unsigned
+	der_get_unsigned64
 	der_get_utctime
 	der_get_utf8string
 	der_get_visible_string
@@ -763,6 +775,7 @@ EXPORTS
 	der_length_heim_integer
 	der_length_ia5_string
 	der_length_integer
+	der_length_integer64
 	der_length_len
 	der_length_octet_string
 	der_length_oid
@@ -770,6 +783,7 @@ EXPORTS
 	der_length_tag
 	der_length_universal_string
 	der_length_unsigned
+	der_length_unsigned64
 	der_length_utctime
 	der_length_utf8string
 	der_length_visible_string
@@ -789,6 +803,7 @@ EXPORTS
 	der_put_heim_integer
 	der_put_ia5_string
 	der_put_integer
+	der_put_integer64
 	der_put_length
 	der_put_length_and_tag
 	der_put_octet_string
@@ -797,6 +812,7 @@ EXPORTS
 	der_put_tag
 	der_put_universal_string
 	der_put_unsigned
+	der_put_unsigned64
 	der_put_utctime
 	der_put_utf8string
 	der_put_visible_string
@@ -911,6 +927,8 @@ EXPORTS
 	encode_IssuerAndSerialNumber
 	encode_KDCDHKeyInfo
 	encode_KDCDHKeyInfo_Win2k
+	encode_KDCFastCookie
+	encode_KDCFastState
 	encode_KDCOptions
 	encode_KDC_REP
 	encode_KDC_REQ
@@ -958,8 +976,6 @@ EXPORTS
 	encode_OriginatorInfo
 	encode_OtherName
 	encode_PADATA_TYPE
-	encode_PA_ClientCanonicalized
-	encode_PA_ClientCanonicalizedNames
 	encode_PA_DATA
 	encode_PA_ENC_SAM_RESPONSE_ENC
 	encode_PA_ENC_TS_ENC
@@ -1163,6 +1179,8 @@ EXPORTS
 	free_IssuerAndSerialNumber
 	free_KDCDHKeyInfo
 	free_KDCDHKeyInfo_Win2k
+	free_KDCFastCookie
+	free_KDCFastState
 	free_KDCOptions
 	free_KDC_REP
 	free_KDC_REQ
@@ -1210,8 +1228,6 @@ EXPORTS
 	free_OriginatorInfo
 	free_OtherName
 	free_PADATA_TYPE
-	free_PA_ClientCanonicalized
-	free_PA_ClientCanonicalizedNames
 	free_PA_DATA
 	free_PA_ENC_SAM_RESPONSE_ENC
 	free_PA_ENC_TS_ENC
@@ -1426,6 +1442,8 @@ EXPORTS
 	length_IssuerAndSerialNumber
 	length_KDCDHKeyInfo
 	length_KDCDHKeyInfo_Win2k
+	length_KDCFastCookie
+	length_KDCFastState
 	length_KDCOptions
 	length_KDC_REP
 	length_KDC_REQ
@@ -1473,8 +1491,6 @@ EXPORTS
 	length_OriginatorInfo
 	length_OtherName
 	length_PADATA_TYPE
-	length_PA_ClientCanonicalized
-	length_PA_ClientCanonicalizedNames
 	length_PA_DATA
 	length_PA_ENC_SAM_RESPONSE_ENC
 	length_PA_ENC_TS_ENC
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/main.c b/crypto/external/bsd/heimdal/dist/lib/asn1/main.c
index c3163d415..06f79dae0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/main.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/main.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: main.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: main.c,v 1.3 2017/01/29 19:23:28 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
@@ -34,11 +34,9 @@
  */
 
 #include "gen_locl.h"
-#include <krb5/getarg.h>
+#include "getarg.h"
 #include "lex.h"
 
-__RCSID("NetBSD");
-
 extern FILE *yyin;
 
 static getarg_strings preserve;
@@ -64,24 +62,31 @@ seq_type(const char *p)
     return 0;
 }
 
+const char *fuzzer_string = "";
+int fuzzer_flag;
 int support_ber;
 int template_flag;
 int rfc1510_bitstring;
 int one_code_file;
 char *option_file;
+int parse_units_flag = 1;
+char *type_file_string = "krb5-types.h";
 int version_flag;
 int help_flag;
 struct getargs args[] = {
-    { "template", 0, arg_flag, &template_flag },
-    { "encode-rfc1510-bit-string", 0, arg_flag, &rfc1510_bitstring },
-    { "decode-dce-ber", 0, arg_flag, &support_ber },
-    { "support-ber", 0, arg_flag, &support_ber },
-    { "preserve-binary", 0, arg_strings, &preserve },
-    { "sequence", 0, arg_strings, &seq },
-    { "one-code-file", 0, arg_flag, &one_code_file },
-    { "option-file", 0, arg_string, &option_file },
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "fuzzer", 0, arg_flag, &fuzzer_flag, NULL, NULL },
+    { "template", 0, arg_flag, &template_flag, NULL, NULL },
+    { "encode-rfc1510-bit-string", 0, arg_flag, &rfc1510_bitstring, NULL, NULL },
+    { "decode-dce-ber", 0, arg_flag, &support_ber, NULL, NULL },
+    { "support-ber", 0, arg_flag, &support_ber, NULL, NULL },
+    { "preserve-binary", 0, arg_strings, &preserve, NULL, NULL },
+    { "sequence", 0, arg_strings, &seq, NULL, NULL },
+    { "one-code-file", 0, arg_flag, &one_code_file, NULL, NULL },
+    { "option-file", 0, arg_string, &option_file, NULL, NULL },
+    { "parse-units", 0, arg_negative_flag, &parse_units_flag, NULL, NULL },
+    { "type-file", 0, arg_string, &type_file_string, NULL, NULL },
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
@@ -102,7 +107,7 @@ main(int argc, char **argv)
     const char *name = NULL;
     int optidx = 0;
     char **arg = NULL;
-    size_t len = 0, i;
+    int len = 0, i;
 
     setprogname(argv[0]);
     if(getarg(args, num_args, argc, argv, &optidx))
@@ -182,6 +187,16 @@ main(int argc, char **argv)
 	}
     }
 
+    if (fuzzer_flag) {
+	if (!template_flag) {
+	    printf("can't do fuzzer w/o --template");
+	    exit(1);
+	}
+#ifdef ASN1_FUZZER
+	fuzzer_string = "_fuzzer";
+#endif
+    }
+
 
     init_generate (file, name);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/pkinit.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/pkinit.asn1
index 878ede4a9..04e4111a3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/pkinit.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/pkinit.asn1
@@ -17,6 +17,8 @@ id-pkrkeydata  OBJECT IDENTIFIER  ::= { id-pkinit 3 }
 id-pkekuoid    OBJECT IDENTIFIER  ::= { id-pkinit 4 }
 id-pkkdcekuoid OBJECT IDENTIFIER  ::= { id-pkinit 5 }
 
+id-apple-system-id OBJECT IDENTIFIER ::= { 1 2 840 113635 100 4 4 }
+
 id-pkinit-kdf OBJECT IDENTIFIER           ::= { id-pkinit 6 }
 id-pkinit-kdf-ah-sha1 OBJECT IDENTIFIER   ::= { id-pkinit-kdf 1 }
 id-pkinit-kdf-ah-sha256 OBJECT IDENTIFIER ::= { id-pkinit-kdf 2 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/pku2u.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/pku2u.asn1
new file mode 100644
index 000000000..1a912feb5
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/pku2u.asn1
@@ -0,0 +1,32 @@
+-- Id
+
+PKU2U DEFINITIONS ::= BEGIN
+
+IMPORTS heim_any_set FROM heim
+	Checksum FROM krb5
+	GeneralName FROM rfc2459
+	;
+
+GSS_KRB5_FINISHED ::= SEQUENCE {
+	gss-mic [1] Checksum,
+	...
+}
+
+InitiatorName ::= CHOICE {
+	sanIndex INTEGER (-2147483648..2147483647),
+	nameNotInCert [0] GeneralName,
+	...
+}
+
+TargetName ::= CHOICE {
+	exportedTargName OCTET STRING,
+	generalName [0] GeneralName,
+	...
+}
+
+InitiatorNameAssertion ::= SEQUENCE {
+	initiatorName [0] InitiatorName OPTIONAL,
+	targetName [1] TargetName OPTIONAL
+}
+
+END
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/rfc2459.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/rfc2459.asn1
index 7d0fad15d..de6f6d766 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/rfc2459.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/rfc2459.asn1
@@ -88,10 +88,22 @@ id-ecMQV OBJECT IDENTIFIER ::= {
        iso(1) identified-organization(3) certicom(132) schemes(1)
        ecmqv(13) }
 
+id-ecdsa-with-SHA512 OBJECT IDENTIFIER ::= {
+     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
+     ecdsa-with-SHA2(3) 4 }
+
+id-ecdsa-with-SHA384 OBJECT IDENTIFIER ::= {
+     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
+     ecdsa-with-SHA2(3) 3 }
+
 id-ecdsa-with-SHA256 OBJECT IDENTIFIER ::= {
      iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
      ecdsa-with-SHA2(3) 2 }
 
+id-ecdsa-with-SHA224 OBJECT IDENTIFIER ::= {
+     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
+     ecdsa-with-SHA2(3) 1 }
+
 id-ecdsa-with-SHA1 OBJECT IDENTIFIER ::= {
      iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 }
 
@@ -107,6 +119,15 @@ id-ec-group-secp160r1 OBJECT IDENTIFIER ::= {
 id-ec-group-secp160r2 OBJECT IDENTIFIER ::= {
        iso(1) identified-organization(3) certicom(132) 0 30 }
 
+id-ec-group-secp224r1 OBJECT IDENTIFIER ::= {
+       iso(1) identified-organization(3) certicom(132) 0 33 }
+
+id-ec-group-secp384r1 OBJECT IDENTIFIER ::= {
+       iso(1) identified-organization(3) certicom(132) 0 34 }
+
+id-ec-group-secp521r1 OBJECT IDENTIFIER ::= {
+       iso(1) identified-organization(3) certicom(132) 0 35 }
+
 -- DSA
 
 id-x9-57 OBJECT IDENTIFIER ::= {
@@ -128,6 +149,8 @@ id-at-stateOrProvinceName	OBJECT IDENTIFIER ::= { id-x520-at 8 }
 id-at-streetAddress		OBJECT IDENTIFIER ::= { id-x520-at 9 }
 id-at-organizationName		OBJECT IDENTIFIER ::= { id-x520-at 10 }
 id-at-organizationalUnitName	OBJECT IDENTIFIER ::= { id-x520-at 11 }
+id-at-title			OBJECT IDENTIFIER ::= { id-x520-at 12 }
+id-at-description		OBJECT IDENTIFIER ::= { id-x520-at 13 }
 id-at-name			OBJECT IDENTIFIER ::= { id-x520-at 41 }
 id-at-givenName			OBJECT IDENTIFIER ::= { id-x520-at 42 }
 id-at-initials			OBJECT IDENTIFIER ::= { id-x520-at 43 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/asn1/roken_rename.h
new file mode 100644
index 000000000..71bf78cdc
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/roken_rename.h
@@ -0,0 +1,48 @@
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef __roken_rename_h__
+#define __roken_rename_h__
+
+#ifndef HAVE_STRTOLL
+#define strtoll rk_strtoll
+#endif
+#ifndef HAVE_STRTOULL
+#define strtoull rk_strtoull
+#endif
+
+#endif /* __roken_rename_h__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.c b/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.c
index d08e9e2c1..f036a89c6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: symbol.c,v 1.1.1.1 2011/04/13 18:14:41 elric Exp $	*/
+/*	$NetBSD: symbol.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -80,7 +80,7 @@ addsym(char *name)
     key.name = name;
     s = (Symbol *) hashtabsearch(htab, (void *) &key);
     if (s == NULL) {
-	s = (Symbol *) emalloc(sizeof(*s));
+	s = (Symbol *) ecalloc(1, sizeof(*s));
 	s->name = name;
 	s->gen_name = estrdup(name);
 	output_name(s->gen_name);
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.h b/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.h
index dc1b64a7c..cc31ffdf2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.h
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/symbol.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: symbol.h,v 1.1.1.2 2011/04/14 14:08:22 elric Exp $	*/
+/*	$NetBSD: symbol.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -80,7 +80,7 @@ struct value {
     } type;
     union {
 	int booleanvalue;
-	int integervalue;
+	int64_t integervalue;
 	char *stringvalue;
 	struct objid *objectidentifiervalue;
     } u;
@@ -111,8 +111,12 @@ struct tagtype {
 };
 
 struct range {
-    int min;
-    int max;
+    /*
+     * We can't represent unsigned 64-bit ranges because max might be
+     * negative...
+     */
+    int64_t min;
+    int64_t max;
 };
 
 enum ctype { CT_CONTENTS, CT_USER } ;
@@ -127,6 +131,7 @@ struct type {
     struct tagtype tag;
     struct range *range;
     struct constraint_spec *constraint;
+    unsigned long id;
 };
 
 typedef struct type Type;
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/template.c b/crypto/external/bsd/heimdal/dist/lib/asn1/template.c
index 3922b092a..9f508e1dd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/template.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/template.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: template.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: template.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
- * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ * Portions Copyright (c) 2009 - 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,17 +38,7 @@
 #include "der_locl.h"
 #include <krb5/com_err.h>
 
-#if 0
-#define ABORT_ON_ERROR() abort()
-#else
-#define ABORT_ON_ERROR() do { } while(0)
-#endif
-
-#define DPOC(data,offset) ((const void *)(((const unsigned char *)data)  + offset))
-#define DPO(data,offset) ((void *)(((unsigned char *)data)  + offset))
-
-
-static struct asn1_type_func prim[] = {
+struct asn1_type_func asn1_template_prim[A1T_NUM_ENTRY] = {
 #define el(name, type) {				\
 	(asn1_type_encode)der_put_##name,		\
 	(asn1_type_decode)der_get_##name,		\
@@ -68,7 +58,9 @@ static struct asn1_type_func prim[] = {
     el(integer, int),
     el(heim_integer, heim_integer),
     el(integer, int),
+    el(integer64, int64_t),
     el(unsigned, unsigned),
+    el(unsigned64, uint64_t),
     el(general_string, heim_general_string),
     el(octet_string, heim_octet_string),
     elber(octet_string, heim_octet_string),
@@ -91,8 +83,8 @@ static struct asn1_type_func prim[] = {
 #undef elber
 };
 
-static size_t
-sizeofType(const struct asn1_template *t)
+size_t
+_asn1_sizeofType(const struct asn1_template *t)
 {
     return t->offset;
 }
@@ -108,8 +100,8 @@ sizeofType(const struct asn1_template *t)
  */
 
 static void
-bmember_get_bit(const unsigned char *p, void *data,
-		unsigned int bit, size_t size)
+_asn1_bmember_get_bit(const unsigned char *p, void *data,
+		      unsigned int bit, size_t size)
 {
     unsigned int localbit = bit % 8;
     if ((*p >> (7 - localbit)) & 1) {
@@ -121,8 +113,8 @@ bmember_get_bit(const unsigned char *p, void *data,
     }
 }
 
-static int
-bmember_isset_bit(const void *data, unsigned int bit, size_t size)
+int
+_asn1_bmember_isset_bit(const void *data, unsigned int bit, size_t size)
 {
 #ifdef WORDS_BIGENDIAN
     if ((*(unsigned int *)data) & (1 << ((size * 8) - bit - 1)))
@@ -135,13 +127,13 @@ bmember_isset_bit(const void *data, unsigned int bit, size_t size)
 #endif
 }
 
-static void
-bmember_put_bit(unsigned char *p, const void *data, unsigned int bit,
-		size_t size, unsigned int *bitset)
+void
+_asn1_bmember_put_bit(unsigned char *p, const void *data, unsigned int bit,
+		      size_t size, unsigned int *bitset)
 {
     unsigned int localbit = bit % 8;
 
-    if (bmember_isset_bit(data, bit, size)) {
+    if (_asn1_bmember_isset_bit(data, bit, size)) {
 	*p |= (1 << (7 - localbit));
 	if (*bitset == 0)
 	    *bitset = (7 - localbit) + 1;
@@ -168,19 +160,19 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	switch (t->tt & A1_OP_MASK) {
 	case A1_OP_TYPE:
 	case A1_OP_TYPE_EXTERN: {
-	    size_t newsize, size;
+	    size_t newsize, elsize;
 	    void *el = DPO(data, t->offset);
 	    void **pel = (void **)el;
 
 	    if ((t->tt & A1_OP_MASK) == A1_OP_TYPE) {
-		size = sizeofType(t->ptr);
+		elsize = _asn1_sizeofType(t->ptr);
 	    } else {
 		const struct asn1_type_func *f = t->ptr;
-		size = f->size;
+		elsize = f->size;
 	    }
 
 	    if (t->tt & A1_FLAG_OPTIONAL) {
-		*pel = calloc(1, size);
+		*pel = calloc(1, elsize);
 		if (*pel == NULL)
 		    return ENOMEM;
 		el = *pel;
@@ -252,7 +244,7 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 
 	    if (t->tt & A1_FLAG_OPTIONAL) {
 		void **el = (void **)data;
-		size_t ellen = sizeofType(t->ptr);
+		size_t ellen = _asn1_sizeofType(t->ptr);
 
 		*el = calloc(1, ellen);
 		if (*el == NULL)
@@ -264,8 +256,13 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	    if (ret)
 		return ret;
 
-	    if (newsize != datalen)
+	    if (is_indefinite) {
+		/* If we use indefinite encoding, the newsize is the datasize. */
+		datalen = newsize;
+	    } else if (newsize != datalen) {
+		/* Check for hidden data that might be after the real tag */
 		return ASN1_EXTRA_DATA;
+	    }
 
 	    len -= datalen;
 	    p += datalen;
@@ -302,12 +299,12 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	    if (flags & A1_PF_INDEFINTE)
 		type++;
 
-	    if (type >= sizeof(prim)/sizeof(prim[0])) {
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
 		ABORT_ON_ERROR();
 		return ASN1_PARSE_ERROR;
 	    }
 
-	    ret = (prim[type].decode)(p, len, el, &newsize);
+	    ret = (asn1_template_prim[type].decode)(p, len, el, &newsize);
 	    if (ret)
 		return ret;
 	    p += newsize; len -= newsize;
@@ -318,7 +315,7 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	case A1_OP_SEQOF: {
 	    struct template_of *el = DPO(data, t->offset);
 	    size_t newsize;
-	    size_t ellen = sizeofType(t->ptr);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
 	    size_t vallength = 0;
 
 	    while (len > 0) {
@@ -347,19 +344,19 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	}
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
-	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t bsize = bmember->offset;
+	    size_t belements = A1_HEADER_LEN(bmember);
 	    size_t pos = 0;
 
 	    bmember++;
 
-	    memset(data, 0, size);
+	    memset(data, 0, bsize);
 
 	    if (len < 1)
 		return ASN1_OVERRUN;
 	    p++; len--;
 
-	    while (elements && len) {
+	    while (belements && len) {
 		while (bmember->offset / 8 > pos / 8) {
 		    if (len < 1)
 			break;
@@ -367,8 +364,8 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 		    pos += 8;
 		}
 		if (len) {
-		    bmember_get_bit(p, data, bmember->offset, size);
-		    elements--; bmember++;
+		    _asn1_bmember_get_bit(p, data, bmember->offset, bsize);
+		    belements--; bmember++;
 		}
 	    }
 	    len = 0;
@@ -380,6 +377,9 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	    size_t datalen;
 	    unsigned int i;
 
+	    /* provide a saner value as default, we should have a NO element value */
+	    *element = 1;
+	   
 	    for (i = 1; i < A1_HEADER_LEN(choice) + 1; i++) {
 		/* should match first tag instead, store it in choice.tt */
 		ret = _asn1_decode(choice[i].ptr, 0, p, len,
@@ -515,12 +515,12 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	    size_t newsize;
 	    const void *el = DPOC(data, t->offset);
 
-	    if (type > sizeof(prim)/sizeof(prim[0])) {
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
 		ABORT_ON_ERROR();
 		return ASN1_PARSE_ERROR;
 	    }
 
-	    ret = (prim[type].encode)(p, len, el, &newsize);
+	    ret = (asn1_template_prim[type].encode)(p, len, el, &newsize);
 	    if (ret)
 		return ret;
 	    p -= newsize; len -= newsize;
@@ -529,8 +529,8 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	}
 	case A1_OP_SETOF: {
 	    const struct template_of *el = DPOC(data, t->offset);
-	    size_t ellen = sizeofType(t->ptr);
-	    struct heim_octet_string *val;
+	    size_t ellen = _asn1_sizeofType(t->ptr);
+	    heim_octet_string *val;
 	    unsigned char *elptr = el->val;
 	    size_t i, totallen;
 
@@ -540,7 +540,7 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	    if (el->len > UINT_MAX/sizeof(val[0]))
 		return ERANGE;
 
-	    val = malloc(sizeof(val[0]) * el->len);
+	    val = calloc(el->len, sizeof(val[0]));
 	    if (val == NULL)
 		return ENOMEM;
 
@@ -549,7 +549,13 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 		size_t l;
 
 		val[i].length = _asn1_length(t->ptr, elptr);
-		val[i].data = malloc(val[i].length);
+		if (val[i].length) {
+		    val[i].data = malloc(val[i].length);
+		    if (val[i].data == NULL) {
+			ret = ENOMEM;
+			break;
+		    }
+		}
 
 		ret = _asn1_encode(t->ptr, DPO(val[i].data, val[i].length - 1),
 				   val[i].length, elptr, &l);
@@ -567,9 +573,8 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	    if (ret == 0 && totallen > len)
 		ret = ASN1_OVERFLOW;
 	    if (ret) {
-		do {
+		for (i = 0; i < el->len; i++)
 		    free(val[i].data);
-		} while(i-- > 0);
 		free(val);
 		return ret;
 	    }
@@ -591,7 +596,7 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	}
 	case A1_OP_SEQOF: {
 	    struct template_of *el = DPO(data, t->offset);
-	    size_t ellen = sizeofType(t->ptr);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
 	    size_t newsize;
 	    unsigned int i;
 	    unsigned char *elptr = el->val;
@@ -615,21 +620,21 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	}
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
-	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t bsize = bmember->offset;
+	    size_t belements = A1_HEADER_LEN(bmember);
 	    size_t pos;
 	    unsigned char c = 0;
 	    unsigned int bitset = 0;
 	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
 
-	    bmember += elements;
+	    bmember += belements;
 
 	    if (rfc1510)
 		pos = 31;
 	    else
 		pos = bmember->offset;
 
-	    while (elements && len) {
+	    while (belements && len) {
 		while (bmember->offset / 8 < pos / 8) {
 		    if (rfc1510 || bitset || c) {
 			if (len < 1)
@@ -639,8 +644,8 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 		    c = 0;
 		    pos -= 8;
 		}
-		bmember_put_bit(&c, data, bmember->offset, size, &bitset);
-		elements--; bmember--;
+		_asn1_bmember_put_bit(&c, data, bmember->offset, bsize, &bitset);
+		belements--; bmember--;
 	    }
 	    if (rfc1510 || bitset) {
 		if (len < 1)
@@ -749,17 +754,17 @@ _asn1_length(const struct asn1_template *t, const void *data)
 	    unsigned int type = A1_PARSE_TYPE(t->tt);
 	    const void *el = DPOC(data, t->offset);
 
-	    if (type > sizeof(prim)/sizeof(prim[0])) {
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
 		ABORT_ON_ERROR();
 		break;
 	    }
-	    ret += (prim[type].length)(el);
+	    ret += (asn1_template_prim[type].length)(el);
 	    break;
 	}
 	case A1_OP_SETOF:
 	case A1_OP_SEQOF: {
 	    const struct template_of *el = DPOC(data, t->offset);
-	    size_t ellen = sizeofType(t->ptr);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
 	    const unsigned char *element = el->val;
 	    unsigned int i;
 
@@ -773,7 +778,7 @@ _asn1_length(const struct asn1_template *t, const void *data)
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
 	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t belements = A1_HEADER_LEN(bmember);
 	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
 
 	    if (rfc1510) {
@@ -782,14 +787,14 @@ _asn1_length(const struct asn1_template *t, const void *data)
 
 		ret += 1;
 
-		bmember += elements;
+		bmember += belements;
 
-		while (elements) {
-		    if (bmember_isset_bit(data, bmember->offset, size)) {
+		while (belements) {
+		    if (_asn1_bmember_isset_bit(data, bmember->offset, size)) {
 			ret += (bmember->offset / 8) + 1;
 			break;
 		    }
-		    elements--; bmember--;
+		    belements--; bmember--;
 		}
 	    }
 	    break;
@@ -857,11 +862,11 @@ _asn1_free(const struct asn1_template *t, void *data)
 	    unsigned int type = A1_PARSE_TYPE(t->tt);
 	    void *el = DPO(data, t->offset);
 
-	    if (type > sizeof(prim)/sizeof(prim[0])) {
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
 		ABORT_ON_ERROR();
 		break;
 	    }
-	    (prim[type].release)(el);
+	    (asn1_template_prim[type].release)(el);
 	    break;
 	}
 	case A1_OP_TAG: {
@@ -884,7 +889,7 @@ _asn1_free(const struct asn1_template *t, void *data)
 	case A1_OP_SETOF:
 	case A1_OP_SEQOF: {
 	    struct template_of *el = DPO(data, t->offset);
-	    size_t ellen = sizeofType(t->ptr);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
 	    unsigned char *element = el->val;
 	    unsigned int i;
 
@@ -949,7 +954,7 @@ _asn1_copy(const struct asn1_template *t, const void *from, void *to)
 	    size_t size;
 
 	    if ((t->tt & A1_OP_MASK) == A1_OP_TYPE) {
-		size = sizeofType(t->ptr);
+		size = _asn1_sizeofType(t->ptr);
 	    } else {
 		const struct asn1_type_func *f = t->ptr;
 		size = f->size;
@@ -987,11 +992,11 @@ _asn1_copy(const struct asn1_template *t, const void *from, void *to)
 	    const void *fel = DPOC(from, t->offset);
 	    void *tel = DPO(to, t->offset);
 
-	    if (type > sizeof(prim)/sizeof(prim[0])) {
+	    if (type >= sizeof(asn1_template_prim)/sizeof(asn1_template_prim[0])) {
 		ABORT_ON_ERROR();
 		return ASN1_PARSE_ERROR;
 	    }
-	    ret = (prim[type].copy)(fel, tel);
+	    ret = (asn1_template_prim[type].copy)(fel, tel);
 	    if (ret)
 		return ret;
 	    break;
@@ -1014,14 +1019,14 @@ _asn1_copy(const struct asn1_template *t, const void *from, void *to)
 		}
 		from = *fel;
 
-		to = *tel = calloc(1, sizeofType(t->ptr));
+		to = *tel = calloc(1, _asn1_sizeofType(t->ptr));
 		if (to == NULL)
 		    return ENOMEM;
 	    }
 
 	    ret = _asn1_copy(t->ptr, from, to);
 	    if (ret) {
-		if (t->tt & A1_FLAG_OPTIONAL) {
+		if (tel) {
 		    free(*tel);
 		    *tel = NULL;
 		}
@@ -1037,7 +1042,7 @@ _asn1_copy(const struct asn1_template *t, const void *from, void *to)
 	case A1_OP_SEQOF: {
 	    const struct template_of *fel = DPOC(from, t->offset);
 	    struct template_of *tel = DPO(to, t->offset);
-	    size_t ellen = sizeofType(t->ptr);
+	    size_t ellen = _asn1_sizeofType(t->ptr);
 	    unsigned int i;
 
 	    tel->val = calloc(fel->len, ellen);
@@ -1099,10 +1104,8 @@ _asn1_decode_top(const struct asn1_template *t, unsigned flags, const unsigned c
     int ret;
     memset(data, 0, t->offset);
     ret = _asn1_decode(t, flags, p, len, data, size);
-    if (ret) {
-	_asn1_free(t, data);
-	memset(data, 0, t->offset);
-    }
+    if (ret)
+	_asn1_free_top(t, data);
 
     return ret;
 }
@@ -1113,9 +1116,15 @@ _asn1_copy_top(const struct asn1_template *t, const void *from, void *to)
     int ret;
     memset(to, 0, t->offset);
     ret = _asn1_copy(t, from, to);
-    if (ret) {
-	_asn1_free(t, to);
-	memset(to, 0, t->offset);
-    }
+    if (ret)
+	_asn1_free_top(t, to);
+
     return ret;
 }
+
+void
+_asn1_free_top(const struct asn1_template *t, void *data)
+{
+    _asn1_free(t, data);
+    memset(data, 0, t->offset);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/test.asn1 b/crypto/external/bsd/heimdal/dist/lib/asn1/test.asn1
index 06274b081..91fb90e0b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/test.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/test.asn1
@@ -7,6 +7,8 @@ BEGIN
 IMPORTS heim_any FROM heim;
 
 TESTuint32 ::= INTEGER (0..4294967295)
+TESTuint64 ::= INTEGER(0..18446744073709551615)
+TESTint64 ::= INTEGER(-9223372036854775808..9223372036854775807)
 
 TESTLargeTag ::= SEQUENCE {
 	foo[127] INTEGER (-2147483648..2147483647),
@@ -46,7 +48,7 @@ TESTImplicit ::= SEQUENCE {
 
 TESTImplicit2 ::= SEQUENCE {
 	ti1[0] IMPLICIT TESTInteger,
-	ti2[1] IMPLICIT TESTLargeTag,
+--	ti2[1] IMPLICIT TESTLargeTag,   this is disabled since the IMPLICT encoder does't get the types right when stepping inside an structure --
 	ti3[2] IMPLICIT TESTInteger3
 }
 
@@ -96,7 +98,7 @@ TESTSeqOf ::= SEQUENCE OF TESTInteger
 TESTSeqSizeOf1 ::= SEQUENCE SIZE (2) OF TESTInteger
 TESTSeqSizeOf2 ::= SEQUENCE SIZE (1..2) OF TESTInteger
 TESTSeqSizeOf3 ::= SEQUENCE SIZE (1..MAX) OF TESTInteger
-TESTSeqSizeOf4 ::= SEQUENCE SIZE (MIN..2) OF TESTInteger
+TESTSeqSizeOf4 ::= SEQUENCE SIZE (0..2) OF TESTInteger
 
 TESTOSSize1 ::= OCTET STRING SIZE (1..2)
 
@@ -121,6 +123,60 @@ TESTSeqOf3 ::= SEQUENCE {
 	strings SEQUENCE OF GeneralString OPTIONAL
 }
 
+-- Larger/more complex to increase odds of out-of-bounds
+-- read/writes if miscoded
+
+TESTSeqOf4 ::= SEQUENCE {
+	b1 [0] SEQUENCE OF SEQUENCE {
+		s1 OCTET STRING,
+		s2 OCTET STRING,
+		u1 TESTuint64,
+		u2 TESTuint64
+	} OPTIONAL,
+	b2 [1] IMPLICIT SEQUENCE OF SEQUENCE {
+		u1 TESTuint64,
+		u2 TESTuint64,
+		u3 TESTuint64,
+		s1 OCTET STRING,
+		s2 OCTET STRING,
+		s3 OCTET STRING
+	} OPTIONAL,
+	b3 [2] IMPLICIT SEQUENCE OF SEQUENCE {
+		s1 OCTET STRING,
+		u1 TESTuint64,
+		s2 OCTET STRING,
+		u2 TESTuint64,
+		s3 OCTET STRING,
+		u3 TESTuint64,
+		s4 OCTET STRING,
+		u4 TESTuint64
+	} OPTIONAL
+}
+
+TESTSeqOf5 ::= SEQUENCE {
+        outer SEQUENCE {
+          inner SEQUENCE {
+                        u0 TESTuint64,
+                        s0 OCTET STRING,
+                        u1 TESTuint64,
+                        s1 OCTET STRING,
+                        u2 TESTuint64,
+                        s2 OCTET STRING,
+                        u3 TESTuint64,
+                        s3 OCTET STRING,
+                        u4 TESTuint64,
+                        s4 OCTET STRING,
+                        u5 TESTuint64,
+                        s5 OCTET STRING,
+                        u6 TESTuint64,
+                        s6 OCTET STRING,
+                        u7 TESTuint64,
+                        s7 OCTET STRING
+                }
+            }
+        OPTIONAL
+}
+
 TESTPreserve ::= SEQUENCE {
 	zero [0] TESTInteger,
 	one [1] TESTInteger
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/test.opt b/crypto/external/bsd/heimdal/dist/lib/asn1/test.opt
new file mode 100644
index 000000000..500ee4ec8
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/test.opt
@@ -0,0 +1 @@
+--sequence=TESTSeqOf
diff --git a/crypto/external/bsd/heimdal/dist/lib/asn1/timegm.c b/crypto/external/bsd/heimdal/dist/lib/asn1/timegm.c
index 2058225e4..5b7bc9405 100644
--- a/crypto/external/bsd/heimdal/dist/lib/asn1/timegm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/asn1/timegm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: timegm.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: timegm.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -104,7 +104,7 @@ _der_gmtime(time_t t, struct tm *tm)
 
     tm->tm_sec = secday % 60;
     tm->tm_min = (secday % 3600) / 60;
-    tm->tm_hour = secday / 3600;
+    tm->tm_hour = (int)(secday / 3600);
 
     /*
      * Refuse to calculate time ~ 2000 years into the future, this is
@@ -132,7 +132,7 @@ _der_gmtime(time_t t, struct tm *tm)
 	days -= daysinmonth;
 	tm->tm_mon++;
     }
-    tm->tm_mday = days + 1;
+    tm->tm_mday = (int)(days + 1);
 
     return tm;
 }
diff --git a/crypto/external/bsd/heimdal/dist/base/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/base/Makefile.am
similarity index 50%
rename from crypto/external/bsd/heimdal/dist/base/Makefile.am
rename to crypto/external/bsd/heimdal/dist/lib/base/Makefile.am
index 639136f79..ee5f120d3 100644
--- a/crypto/external/bsd/heimdal/dist/base/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/base/Makefile.am
@@ -1,31 +1,64 @@
 
 include $(top_srcdir)/Makefile.am.common
 
+if do_roken_rename
+ES = base64.c
+endif
+
+IMPLEMENT_TLS=
+if MAINTAINER_MODE
+IMPLEMENT_TLS += dll.c
+AM_CPPFLAGS += -DHEIM_BASE_MAINTAINER
+endif
+
+AM_CPPFLAGS += $(ROKEN_RENAME)
+
 lib_LTLIBRARIES = libheimbase.la
 check_PROGRAMS = test_base
 
 libheimbase_la_LDFLAGS = -version-info 1:0:0
 
+TESTS = test_base
+
 if versionscript
 libheimbase_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 
+libheimbase_la_LIBADD = $(PTHREAD_LIBADD)
+
 include_HEADERS	= heimbase.h
 
 dist_libheimbase_la_SOURCES =	\
 	array.c			\
 	baselocl.h		\
+	bsearch.c		\
 	bool.c			\
+	data.c			\
+	db.c			\
 	dict.c			\
+	$(IMPLEMENT_TLS)	\
+	error.c			\
 	heimbase.c		\
 	heimbasepriv.h		\
 	heimqueue.h		\
+	json.c			\
 	null.c			\
 	number.c		\
+	roken_rename.h		\
 	string.c
 
+nodist_libheimbase_la_SOURCES = $(ES)
+
+# install these?
+
 libheimbase_la_DEPENDENCIES = version-script.map
 
-test_base_LDADD = $(LIB_heimbase)
+test_base_LDADD = libheimbase.la $(LIB_roken)
+
+CLEANFILES = base64.c test_db.json
 
 EXTRA_DIST = NTMakefile version-script.map
+
+base64.c:
+	rm -f base64.c
+	$(LN_S) $(srcdir)/../roken/base64.c .
diff --git a/crypto/external/bsd/heimdal/dist/base/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/base/NTMakefile
similarity index 74%
rename from crypto/external/bsd/heimdal/dist/base/NTMakefile
rename to crypto/external/bsd/heimdal/dist/lib/base/NTMakefile
index 0668cd699..e5bda31dd 100644
--- a/crypto/external/bsd/heimdal/dist/base/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/base/NTMakefile
@@ -29,25 +29,54 @@
 # POSSIBILITY OF SUCH DAMAGE.
 #
 
-RELDIR=base
+RELDIR=lib\base
 
-!include ../windows/NTMakefile.w32
+intcflags=-I$(SRCDIR) -I$(OBJ)
+
+!include ../../windows/NTMakefile.w32
 
 INCFILES=$(INCDIR)\heimbase.h
 
+test_binaries = $(OBJ)\test_base.exe
+
 libheimbase_OBJS =		\
 	$(OBJ)\array.obj	\
 	$(OBJ)\bool.obj		\
+	$(OBJ)\bsearch.obj	\
+	$(OBJ)\data.obj		\
+	$(OBJ)\db.obj		\
 	$(OBJ)\dict.obj		\
+	$(OBJ)\dll.obj		\
+	$(OBJ)\error.obj	\
 	$(OBJ)\heimbase.obj	\
+	$(OBJ)\json.obj		\
 	$(OBJ)\null.obj		\
 	$(OBJ)\number.obj	\
 	$(OBJ)\string.obj
 
 $(LIBHEIMBASE): $(libheimbase_OBJS)
-	$(LIBCON)
+	$(LIBCON_C) -OUT:$@ $(LIBROKEN) @<<
+$(libheimbase_OBJS: =
+)
+<<
+
+test:: test-binaries test-run
+
+test-run:
+	cd $(OBJ)
+	-test_base.exe
+	cd $(SRCDIR)
 
 all:: $(INCFILES) $(LIBHEIMBASE)
 
 clean::
 	-$(RM) $(INCFILES)
+
+test-binaries: $(test_binaries)
+
+$(test_binaries): $$(@R).obj $(LIBHEIMBASE) $(LIBVERS) $(LIBROKEN)
+	$(EXECONLINK)
+	$(EXEPREP_NODIST)
+
+$(test_binaries:.exe=.obj): $$(@B).c
+	$(C2OBJ_C) -Fo$@ -Fd$(@D)\ $** -DBlah
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/array.c b/crypto/external/bsd/heimdal/dist/lib/base/array.c
new file mode 100644
index 000000000..dfe4ad9cc
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/array.c
@@ -0,0 +1,480 @@
+/*	$NetBSD: array.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+
+/*
+ *
+ */
+
+struct heim_array_data {
+    size_t len;
+    heim_object_t *val;
+    size_t allocated_len;
+    heim_object_t *allocated;
+};
+
+static void
+array_dealloc(heim_object_t ptr)
+{
+    heim_array_t array = ptr;
+    size_t n;
+    for (n = 0; n < array->len; n++)
+	heim_release(array->val[n]);
+    free(array->allocated);
+}
+
+struct heim_type_data array_object = {
+    HEIM_TID_ARRAY,
+    "dict-object",
+    NULL,
+    array_dealloc,
+    NULL,
+    NULL,
+    NULL,
+    NULL
+};
+
+/**
+ * Allocate an array
+ *
+ * @return A new allocated array, free with heim_release()
+ */
+
+heim_array_t
+heim_array_create(void)
+{
+    heim_array_t array;
+
+    array = _heim_alloc_object(&array_object, sizeof(*array));
+    if (array == NULL)
+	return NULL;
+
+    array->allocated = NULL;
+    array->allocated_len = 0;
+    array->val = NULL;
+    array->len = 0;
+
+    return array;
+}
+
+/**
+ * Get type id of an dict
+ *
+ * @return the type id
+ */
+
+heim_tid_t
+heim_array_get_type_id(void)
+{
+    return HEIM_TID_ARRAY;
+}
+
+/**
+ * Append object to array
+ *
+ * @param array array to add too
+ * @param object the object to add
+ *
+ * @return zero if added, errno otherwise
+ */
+
+int
+heim_array_append_value(heim_array_t array, heim_object_t object)
+{
+    heim_object_t *ptr;
+    size_t leading = array->val - array->allocated; /* unused leading slots */
+    size_t trailing = array->allocated_len - array->len - leading;
+    size_t new_len;
+
+    if (trailing > 0) {
+	/* We have pre-allocated space; use it */
+	array->val[array->len++] = heim_retain(object);
+	return 0;
+    }
+
+    if (leading > (array->len + 1)) {
+	/*
+	 * We must have appending to, and deleting at index 0 from this
+	 * array a lot; don't want to grow forever!
+	 */
+	(void) memmove(&array->allocated[0], &array->val[0],
+		       array->len * sizeof(array->val[0]));
+	array->val = array->allocated;
+
+	/* We have pre-allocated space; use it */
+	array->val[array->len++] = heim_retain(object);
+	return 0;
+    }
+
+    /* Pre-allocate extra .5 times number of used slots */
+    new_len = leading + array->len + 1 + (array->len >> 1);
+    ptr = realloc(array->allocated, new_len * sizeof(array->val[0]));
+    if (ptr == NULL)
+	return ENOMEM;
+    array->allocated = ptr;
+    array->allocated_len = new_len;
+    array->val = &ptr[leading];
+    array->val[array->len++] = heim_retain(object);
+
+    return 0;
+}
+
+/*
+ * Internal function to insert at index 0, taking care to optimize the
+ * case where we're always inserting at index 0, particularly the case
+ * where we insert at index 0 and delete from the right end.
+ */
+static int
+heim_array_prepend_value(heim_array_t array, heim_object_t object)
+{
+    heim_object_t *ptr;
+    size_t leading = array->val - array->allocated; /* unused leading slots */
+    size_t trailing = array->allocated_len - array->len - leading;
+    size_t new_len;
+
+    if (leading > 0) {
+	/* We have pre-allocated space; use it */
+	array->val--;
+	array->val[0] = heim_retain(object);
+	array->len++;
+	return 0;
+    }
+    if (trailing > (array->len + 1)) {
+	/*
+	 * We must have prepending to, and deleting at index
+	 * array->len - 1 from this array a lot; don't want to grow
+	 * forever!
+	 */
+	(void) memmove(&array->allocated[array->len], &array->val[0],
+		       array->len * sizeof(array->val[0]));
+	array->val = &array->allocated[array->len];
+
+	/* We have pre-allocated space; use it */
+	array->val--;
+	array->val[0] = heim_retain(object);
+	array->len++;
+	return 0;
+    }
+    /* Pre-allocate extra .5 times number of used slots */
+    new_len = array->len + 1 + trailing + (array->len >> 1);
+    ptr = realloc(array->allocated, new_len * sizeof(array->val[0]));
+    if (ptr == NULL)
+	return ENOMEM;
+    (void) memmove(&ptr[1], &ptr[0], array->len * sizeof (array->val[0]));
+    array->allocated = ptr;
+    array->allocated_len = new_len;
+    array->val = &ptr[0];
+    array->val[0] = heim_retain(object);
+    array->len++;
+
+    return 0;
+}
+
+/**
+ * Insert an object at a given index in an array
+ *
+ * @param array array to add too
+ * @param idx index where to add element (-1 == append, -2 next to last, ...)
+ * @param object the object to add
+ *
+ * @return zero if added, errno otherwise
+ */
+
+int
+heim_array_insert_value(heim_array_t array, size_t idx, heim_object_t object)
+{
+    int ret;
+
+    if (idx == 0)
+	return heim_array_prepend_value(array, object);
+    else if (idx > array->len)
+	heim_abort("index too large");
+
+    /*
+     * We cheat: append this element then rotate elements around so we
+     * have this new element at the desired location, unless we're truly
+     * appending the new element.  This means reusing array growth in
+     * heim_array_append_value() instead of duplicating that here.
+     */
+    ret = heim_array_append_value(array, object);
+    if (ret != 0 || idx == (array->len - 1))
+	return ret;
+    /*
+     * Shift to the right by one all the elements after idx, then set
+     * [idx] to the new object.
+     */
+    (void) memmove(&array->val[idx + 1], &array->val[idx],
+	           (array->len - idx - 1) * sizeof(array->val[0]));
+    array->val[idx] = heim_retain(object);
+
+    return 0;
+}
+
+/**
+ * Iterate over all objects in array
+ *
+ * @param array array to iterate over
+ * @param ctx context passed to fn
+ * @param fn function to call on each object
+ */
+
+void
+heim_array_iterate_f(heim_array_t array, void *ctx, heim_array_iterator_f_t fn)
+{
+    size_t n;
+    int stop = 0;
+    for (n = 0; n < array->len; n++) {
+	fn(array->val[n], ctx, &stop);
+	if (stop)
+	    return;
+    }
+}
+
+#ifdef __BLOCKS__
+/**
+ * Iterate over all objects in array
+ *
+ * @param array array to iterate over
+ * @param fn block to call on each object
+ */
+
+void
+heim_array_iterate(heim_array_t array, void (^fn)(heim_object_t, int *))
+{
+    size_t n;
+    int stop = 0;
+    for (n = 0; n < array->len; n++) {
+	fn(array->val[n], &stop);
+	if (stop)
+	    return;
+    }
+}
+#endif
+
+/**
+ * Iterate over all objects in array, backwards
+ *
+ * @param array array to iterate over
+ * @param ctx context passed to fn
+ * @param fn function to call on each object
+ */
+
+void
+heim_array_iterate_reverse_f(heim_array_t array, void *ctx, heim_array_iterator_f_t fn)
+{
+    size_t n;
+    int stop = 0;
+
+    for (n = array->len; n > 0; n--) {
+	fn(array->val[n - 1], ctx, &stop);
+	if (stop)
+	    return;
+    }
+}
+
+#ifdef __BLOCKS__
+/**
+ * Iterate over all objects in array, backwards
+ *
+ * @param array array to iterate over
+ * @param fn block to call on each object
+ */
+
+void
+heim_array_iterate_reverse(heim_array_t array, void (^fn)(heim_object_t, int *))
+{
+    size_t n;
+    int stop = 0;
+    for (n = array->len; n > 0; n--) {
+	fn(array->val[n - 1], &stop);
+	if (stop)
+	    return;
+    }
+}
+#endif
+
+/**
+ * Get length of array
+ *
+ * @param array array to get length of
+ *
+ * @return length of array
+ */
+
+size_t
+heim_array_get_length(heim_array_t array)
+{
+    return array->len;
+}
+
+/**
+ * Get value of element at array index
+ *
+ * @param array array copy object from
+ * @param idx index of object, 0 based, must be smaller then
+ *        heim_array_get_length()
+ *
+ * @return a not-retained copy of the object
+ */
+
+heim_object_t
+heim_array_get_value(heim_array_t array, size_t idx)
+{
+    if (idx >= array->len)
+	heim_abort("index too large");
+    return array->val[idx];
+}
+
+/**
+ * Get value of element at array index
+ *
+ * @param array array copy object from
+ * @param idx index of object, 0 based, must be smaller then
+ *        heim_array_get_length()
+ *
+ * @return a retained copy of the object
+ */
+
+heim_object_t
+heim_array_copy_value(heim_array_t array, size_t idx)
+{
+    if (idx >= array->len)
+	heim_abort("index too large");
+    return heim_retain(array->val[idx]);
+}
+
+/**
+ * Set value at array index
+ *
+ * @param array array copy object from
+ * @param idx index of object, 0 based, must be smaller then
+ *        heim_array_get_length()
+ * @param value value to set 
+ *
+ */
+
+void
+heim_array_set_value(heim_array_t array, size_t idx, heim_object_t value)
+{
+    if (idx >= array->len)
+	heim_abort("index too large");
+    heim_release(array->val[idx]);
+    array->val[idx] = heim_retain(value);
+}
+
+/**
+ * Delete value at idx
+ *
+ * @param array the array to modify
+ * @param idx the key to delete
+ */
+
+void
+heim_array_delete_value(heim_array_t array, size_t idx)
+{
+    heim_object_t obj;
+    if (idx >= array->len)
+	heim_abort("index too large");
+    obj = array->val[idx];
+
+    array->len--;
+
+    /*
+     * Deleting the first or last elements is cheap, as we leave
+     * allocated space for opportunistic reuse later; no realloc(), no
+     * memmove().  All others require a memmove().
+     *
+     * If we ever need to optimize deletion of non-last/ non-first
+     * element we can use a tagged object type to signify "deleted
+     * value" so we can leave holes in the array, avoid memmove()s on
+     * delete, and opportunistically re-use those holes on insert.
+     */
+    if (idx == 0)
+	array->val++;
+    else if (idx < array->len)
+	(void) memmove(&array->val[idx], &array->val[idx + 1],
+		       (array->len - idx) * sizeof(array->val[0]));
+
+    heim_release(obj);
+}
+
+/**
+ * Filter out entres of array when function return true
+ *
+ * @param array the array to modify
+ * @param fn filter function
+ */
+
+void
+heim_array_filter_f(heim_array_t array, void *ctx, heim_array_filter_f_t fn)
+{
+    size_t n = 0;
+
+    while (n < array->len) {
+	if (fn(array->val[n], ctx)) {
+	    heim_array_delete_value(array, n);
+	} else {
+	    n++;
+	}
+    }
+}
+
+#ifdef __BLOCKS__
+
+/**
+ * Filter out entres of array when block return true
+ *
+ * @param array the array to modify
+ * @param block filter block
+ */
+
+void
+heim_array_filter(heim_array_t array, int (^block)(heim_object_t))
+{
+    size_t n = 0;
+
+    while (n < array->len) {
+	if (block(array->val[n])) {
+	    heim_array_delete_value(array, n);
+	} else {
+	    n++;
+	}
+    }
+}
+
+#endif /* __BLOCKS__ */
diff --git a/crypto/external/bsd/heimdal/dist/base/baselocl.h b/crypto/external/bsd/heimdal/dist/lib/base/baselocl.h
similarity index 73%
rename from crypto/external/bsd/heimdal/dist/base/baselocl.h
rename to crypto/external/bsd/heimdal/dist/lib/base/baselocl.h
index 90b35e72b..bd59ab4b0 100644
--- a/crypto/external/bsd/heimdal/dist/base/baselocl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/base/baselocl.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: baselocl.h,v 1.3 2014/04/24 13:45:33 pettai Exp $	*/
+/*	$NetBSD: baselocl.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * Copyright (c) 2010 - 2011 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -37,21 +37,20 @@
 
 #include "config.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
+#include <krb5/roken.h>
+
 #ifdef HAVE_SYS_SELECT_H
 #include <sys/select.h>
 #endif
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-#include <limits.h>
+#define HEIMDAL_TEXTDOMAIN "heimdal_krb5"
 
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
+#ifdef LIBINTL
+#include <libintl.h>
+#define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x)
+#else
+#define N_(x,y) (x)
+#define bindtextdomain(package, localedir)
 #endif
 
 #include "heimqueue.h"
@@ -63,24 +62,53 @@
 #include <dispatch/dispatch.h>
 #endif
 
-#if defined(USE_ATOMIC_INCDEC)
-
-#include <sys/atomic.h>
-#define heim_base_atomic_inc(x) atomic_inc_32_nv((x))
-#define heim_base_atomic_dec(x) atomic_dec_32_nv((x))
-#define heim_base_atomic_type	uint32_t
-#define heim_base_atomic_max    UINT32_MAX
-
-#define heim_base_exchange_pointer(t,v) atomic_swap_ptr((t), (v))
-
-#elif defined(__GNUC__) && defined(HAVE___SYNC_ADD_AND_FETCH)
+#if defined(__GNUC__) && defined(HAVE___SYNC_ADD_AND_FETCH)
 
 #define heim_base_atomic_inc(x) __sync_add_and_fetch((x), 1)
 #define heim_base_atomic_dec(x) __sync_sub_and_fetch((x), 1)
 #define heim_base_atomic_type	unsigned int
 #define heim_base_atomic_max    UINT_MAX
 
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+#if __has_builtin(__sync_swap)
+#define heim_base_exchange_pointer(t,v) __sync_swap((t), (v))
+#else
 #define heim_base_exchange_pointer(t,v) __sync_lock_test_and_set((t), (v))
+#endif
+
+#elif defined(__sun)
+
+#include <sys/atomic.h>
+
+#define heim_base_atomic_inc(x) atomic_inc_uint_nv((volatile uint_t *)(x))
+#define heim_base_atomic_dec(x) atomic_dec_uint_nv((volatile uint_t *)(x))
+#define heim_base_atomic_type	uint_t
+#define heim_base_atomic_max    UINT_MAX
+
+#define heim_base_exchange_pointer(t,v) atomic_swap_ptr((volatile void *)(t), (void *)(v))
+
+#elif defined(_AIX)
+
+#include <sys/atomic_op.h>
+
+#define heim_base_atomic_inc(x) (fetch_and_add((atomic_p)(x)) + 1)
+#define heim_base_atomic_dec(x) (fetch_and_add((atomic_p)(x)) - 1)
+#define heim_base_atomic_type   unsigned int
+#define heim_base_atomic_max    UINT_MAX
+
+static inline void *
+heim_base_exchange_pointer(void *p, void *newval)
+{
+    void *val = *(void **)p;
+
+    while (!compare_and_swaplp((atomic_l)p, (long *)&val, (long)newval))
+        ;
+
+    return val;
+}
 
 #elif defined(_WIN32)
 
diff --git a/crypto/external/bsd/heimdal/dist/base/bool.c b/crypto/external/bsd/heimdal/dist/lib/base/bool.c
similarity index 96%
rename from crypto/external/bsd/heimdal/dist/base/bool.c
rename to crypto/external/bsd/heimdal/dist/lib/base/bool.c
index fd4cab043..646103851 100644
--- a/crypto/external/bsd/heimdal/dist/base/bool.c
+++ b/crypto/external/bsd/heimdal/dist/lib/base/bool.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bool.c,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: bool.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -44,6 +44,7 @@ struct heim_type_data _heim_bool_object = {
     NULL,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/bsearch.c b/crypto/external/bsd/heimdal/dist/lib/base/bsearch.c
new file mode 100644
index 000000000..412267860
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/bsearch.c
@@ -0,0 +1,888 @@
+/*	$NetBSD: bsearch.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "baselocl.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#ifdef HAVE_IO_H
+#include <io.h>
+#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#include <fcntl.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+#include <errno.h>
+#include <assert.h>
+
+/*
+ * This file contains functions for binary searching flat text in memory
+ * and in text files where each line is a [variable length] record.
+ * Each record has a key and an optional value separated from the key by
+ * unquoted whitespace.  Whitespace in the key, and leading whitespace
+ * for the value, can be quoted with backslashes (but CR and LF must be
+ * quoted in such a way that they don't appear in the quoted result).
+ *
+ * Binary searching a tree are normally a dead simple algorithm.  It
+ * turns out that binary searching flat text with *variable* length
+ * records is... tricky.  There's no indexes to record beginning bytes,
+ * thus any index selected during the search is likely to fall in the
+ * middle of a record.  When deciding to search a left sub-tree one
+ * might fail to find the last record in that sub-tree on account of the
+ * right boundary falling in the middle of it -- the chosen solution to
+ * this makes left sub-tree searches slightly less efficient than right
+ * sub-tree searches.
+ *
+ * If binary searching flat text in memory is tricky, using block-wise
+ * I/O instead is trickier!  But it's necessary in order to support
+ * large files (which we either can't or wouldn't want to read or map
+ * into memory).  Each block we read has to be large enough that the
+ * largest record can fit in it.  And each block might start and/or end
+ * in the middle of a record.  Here it is the right sub-tree searches
+ * that are less efficient than left sub-tree searches.
+ *
+ * bsearch_common() contains the common text block binary search code.
+ *
+ * _bsearch_text() is the interface for searching in-core text.
+ * _bsearch_file() is the interface for block-wise searching files.
+ */
+
+struct bsearch_file_handle {
+    int fd;          /* file descriptor */
+    char *cache;     /* cache bytes */
+    char *page;      /* one double-size page worth of bytes */
+    size_t file_sz;  /* file size */
+    size_t cache_sz; /* cache size */
+    size_t page_sz;  /* page size */
+};
+
+/* Find a new-line */
+static const char *
+find_line(const char *buf, size_t i, size_t right)
+{
+    if (i == 0)
+	return &buf[i];
+    for (; i < right; i++) {
+	if (buf[i] == '\n') {
+	    if ((i + 1) < right)
+		return &buf[i + 1];
+	    return NULL;
+	}
+    }
+    return NULL;
+}
+
+/*
+ * Common routine for binary searching text in core.
+ *
+ * Perform a binary search of a char array containing a block from a
+ * text file where each line is a record (LF and CRLF supported).  Each
+ * record consists of a key followed by an optional value separated from
+ * the key by whitespace.  Whitespace can be quoted with backslashes.
+ * It's the caller's responsibility to encode/decode keys/values if
+ * quoting is desired; newlines should be encoded such that a newline
+ * does not appear in the result.
+ *
+ * All output arguments are optional.
+ *
+ * Returns 0 if key is found, -1 if not found, or an error code such as
+ * ENOMEM in case of error.
+ *
+ * Inputs:
+ *
+ * @buf          String to search
+ * @sz           Size of string to search
+ * @key          Key string to search for
+ * @buf_is_start True if the buffer starts with a record, false if it
+ *               starts in the middle of a record or if the caller
+ *               doesn't know.
+ *
+ * Outputs:
+ *
+ * @value        Location to store a copy of the value (caller must free)
+ * @location     Record location if found else the location where the
+ *               record should be inserted (index into @buf)
+ * @cmp	         Set to less than or greater than 0 to indicate that a
+ *               key not found would have fit in an earlier or later
+ *               part of a file.  Callers should use this to decide
+ *               whether to read a block to the left or to the right and
+ *               search that.
+ * @loops        Location to store a count of bisections required for
+ *               search (useful for confirming logarithmic performance)
+ */
+static int
+bsearch_common(const char *buf, size_t sz, const char *key,
+	       int buf_is_start, char **value, size_t *location,
+	       int *cmp, size_t *loops)
+{
+    const char *linep;
+    size_t key_start, key_len; /* key string in buf */
+    size_t val_start, val_len; /* value string in buf */
+    int key_cmp = -1;
+    size_t k;
+    size_t l;    /* left side of buffer for binary search */
+    size_t r;    /* right side of buffer for binary search */
+    size_t rmax; /* right side of buffer for binary search */
+    size_t i;    /* index into buffer, typically in the middle of l and r */
+    size_t loop_count = 0;
+    int ret = -1;
+
+    if (value)
+	*value = NULL;
+    if (cmp)
+	*cmp = 0;
+    if (loops)
+	*loops = 0;
+
+    /* Binary search; file should be sorted */
+    for (l = 0, r = rmax = sz, i = sz >> 1; i >= l && i < rmax; loop_count++) {
+	heim_assert(i < sz, "invalid aname2lname db index");
+
+	/* buf[i] is likely in the middle of a line; find the next line */
+	linep = find_line(buf, i, rmax);
+	k = linep ? linep - buf : i;
+	if (linep == NULL || k >= rmax) {
+	    /*
+	     * No new line found to the right; search to the left then
+	     * but don't change rmax (this isn't optimal, but it's
+	     * simple).
+	     */
+	    if (i == l)
+		break;
+	    r = i;
+	    i = l + ((r - l) >> 1);
+	    continue;
+	}
+	i = k;
+	heim_assert(i >= l && i < rmax, "invalid aname2lname db index");
+
+	/* Got a line; check it */
+
+	/* Search for and split on unquoted whitespace */
+	val_start = 0;
+	for (key_start = i, key_len = 0, val_len = 0, k = i; k < rmax; k++) {
+	    if (buf[k] == '\\') {
+		k++;
+		continue;
+	    }
+	    if (buf[k] == '\r' || buf[k] == '\n') {
+		/* We now know where the key ends, and there's no value */
+		key_len = k - i;
+		break;
+	    }
+	    if (!isspace((unsigned char)buf[k]))
+		continue;
+
+	    while (k < rmax && isspace((unsigned char)buf[k])) {
+		key_len = k - i;
+		k++;
+	    }
+	    if (k < rmax)
+		val_start = k;
+	    /* Find end of value */
+	    for (; k < rmax && buf[k] != '\0'; k++) {
+		if (buf[k] == '\r' || buf[k] == '\n') {
+		    val_len = k - val_start;
+		    break;
+		}
+	    }
+	    break;
+	}
+
+	/*
+	 * The following logic is for dealing with partial buffers,
+	 * which we use for block-wise binary searches of large files
+	 */
+	if (key_start == 0 && !buf_is_start) {
+	    /*
+	     * We're at the beginning of a block that might have started
+	     * in the middle of a record whose "key" might well compare
+	     * as greater than the key we're looking for, so we don't
+	     * bother comparing -- we know key_cmp must be -1 here.
+	     */
+	    key_cmp = -1;
+	    break;
+	}
+	if ((val_len && buf[val_start + val_len] != '\n') ||
+	    (!val_len && buf[key_start + key_len] != '\n')) {
+	    /*
+	     * We're at the end of a block that ends in the middle of a
+	     * record whose "key" might well compare as less than the
+	     * key we're looking for, so we don't bother comparing -- we
+	     * know key_cmp must be >= 0 but we can't tell.  Our caller
+	     * will end up reading a double-size block to handle this.
+	     */
+	    key_cmp = 1;
+	    break;
+	}
+
+	key_cmp = strncmp(key, &buf[key_start], key_len);
+	if (key_cmp == 0 && strlen(key) != key_len)
+	    key_cmp = 1;
+	if (key_cmp < 0) {
+	    /* search left */
+	    r = rmax = (linep - buf);
+	    i = l + ((r - l) >> 1);
+	    if (location)
+		*location = key_start;
+	} else if (key_cmp > 0) {
+	    /* search right */
+	    if (l == i)
+		break; /* not found */
+	    l = i;
+	    i = l + ((r - l) >> 1);
+	    if (location)
+		*location = val_start + val_len;
+	} else {
+	    /* match! */
+	    if (location)
+		*location = key_start;
+	    ret = 0;
+	    if (val_len && value) {
+		/* Avoid strndup() so we don't need libroken here yet */
+		*value = malloc(val_len + 1);
+		if (!*value)
+		    ret = errno;
+		(void) memcpy(*value, &buf[val_start], val_len);
+		(*value)[val_len] = '\0';
+	    }
+	    break;
+	}
+    }
+
+    if (cmp)
+	*cmp = key_cmp;
+    if (loops)
+	*loops = loop_count;
+
+    return ret;
+}
+
+/*
+ * Binary search a char array containing sorted text records separated
+ * by new-lines (or CRLF).  Each record consists of a key and an
+ * optional value following the key, separated from the key by unquoted
+ * whitespace.
+ *
+ * All output arguments are optional.
+ *
+ * Returns 0 if key is found, -1 if not found, or an error code such as
+ * ENOMEM in case of error.
+ *
+ * Inputs:
+ *
+ * @buf      Char array pointer
+ * @buf_sz   Size of buf
+ * @key      Key to search for
+ *
+ * Outputs:
+ *
+ * @value    Location where to put the value, if any (caller must free)
+ * @location Record location if found else the location where the record
+ *           should be inserted (index into @buf)
+ * @loops    Location where to put a number of loops (or comparisons)
+ *           needed for the search (useful for benchmarking)
+ */
+int
+_bsearch_text(const char *buf, size_t buf_sz, const char *key,
+	       char **value, size_t *location, size_t *loops)
+{
+    return bsearch_common(buf, buf_sz, key, 1, value, location, NULL, loops);
+}
+
+#define MAX_BLOCK_SIZE (1024 * 1024)
+#define DEFAULT_MAX_FILE_SIZE (1024 * 1024)
+/*
+ * Open a file for binary searching.  The file will be read in entirely
+ * if it is smaller than @max_sz, else a cache of @max_sz bytes will be
+ * allocated.
+ *
+ * Returns 0 on success, else an error number or -1 if the file is empty.
+ *
+ * Inputs:
+ *
+ * @fname   Name of file to open
+ * @max_sz  Maximum size of cache to allocate, in bytes (if zero, default)
+ * @page_sz Page size (must be a power of two, larger than 256, smaller
+ *          than 1MB; if zero use default)
+ * 
+ * Outputs:
+ *
+ * @bfh     Handle for use with _bsearch_file() and _bsearch_file_close()
+ * @reads   Number of reads performed
+ */
+int
+_bsearch_file_open(const char *fname, size_t max_sz, size_t page_sz,
+		    bsearch_file_handle *bfh, size_t *reads)
+{
+    bsearch_file_handle new_bfh = NULL;
+    struct stat st;
+    size_t i;
+    int fd;
+    int ret;
+
+    *bfh = NULL;
+
+    if (reads)
+	*reads = 0;
+
+    fd = open(fname, O_RDONLY);
+    if (fd == -1)
+	return errno;
+
+    if (fstat(fd, &st) == -1) {
+	ret = errno;
+	goto err;
+    }
+
+    if (st.st_size == 0) {
+	ret = -1; /* no data -> no binary search */
+	goto err;
+    }
+
+    /* Validate / default arguments */
+    if (max_sz == 0)
+	max_sz = DEFAULT_MAX_FILE_SIZE;
+    for (i = page_sz; i; i >>= 1) {
+	/* Make sure page_sz is a power of two */
+	if ((i % 2) && (i >> 1)) {
+	    page_sz = 0;
+	    break;
+	}
+    }
+    if (page_sz == 0)
+#ifdef HAVE_STRUCT_STAT_ST_BLKSIZE
+	page_sz = st.st_blksize;
+#else
+	page_sz = 4096;
+#endif
+    for (i = page_sz; i; i >>= 1) {
+	/* Make sure page_sz is a power of two */
+	if ((i % 2) && (i >> 1)) {
+	    /* Can't happen! Filesystems always use powers of two! */
+	    page_sz = 4096;
+	    break;
+	}
+    }
+    if (page_sz > MAX_BLOCK_SIZE)
+	page_sz = MAX_BLOCK_SIZE;
+
+    new_bfh = calloc(1, sizeof (*new_bfh));
+    if (new_bfh == NULL) {
+	ret = ENOMEM;
+	goto err;
+    }
+
+    new_bfh->fd = fd;
+    new_bfh->page_sz = page_sz;
+    new_bfh->file_sz = st.st_size;
+
+    if (max_sz >= st.st_size) {
+	/* Whole-file method */
+	new_bfh->cache = malloc(st.st_size + 1);
+	if (new_bfh->cache) {
+	    new_bfh->cache[st.st_size] = '\0';
+	    new_bfh->cache_sz = st.st_size;
+	    ret = read(fd, new_bfh->cache, st.st_size);
+	    if (ret < 0) {
+		ret = errno;
+		goto err;
+	    }
+	    if (ret != st.st_size) {
+		ret = EIO; /* XXX ??? */
+		goto err;
+	    }
+	    if (reads)
+		*reads = 1;
+	    (void) close(fd);
+	    new_bfh->fd = -1;
+	    *bfh = new_bfh;
+	    return 0;
+	}
+    }
+
+    /* Block-size method, or above malloc() failed */
+    new_bfh->page = malloc(new_bfh->page_sz << 1);
+    if (new_bfh->page == NULL) {
+	/* Can't even allocate a single double-size page! */
+	ret = ENOMEM;
+	goto err;
+    }
+
+    new_bfh->cache_sz = max_sz < st.st_size ? max_sz : st.st_size;
+    new_bfh->cache = malloc(new_bfh->cache_sz);
+    *bfh = new_bfh;
+
+    /*
+     * malloc() may have failed because we were asking for a lot of
+     * memory, but we may still be able to operate without a cache,
+     * so let's not fail.
+     */
+    if (new_bfh->cache == NULL) {
+	new_bfh->cache_sz = 0;
+	return 0;
+    }
+
+    /* Initialize cache */
+    for (i = 0; i < new_bfh->cache_sz; i += new_bfh->page_sz)
+	new_bfh->cache[i] = '\0';
+    return 0;
+
+err:
+    (void) close(fd);
+    if (new_bfh) {
+	free(new_bfh->page);
+	free(new_bfh->cache);
+	free(new_bfh);
+    }
+    return ret;
+}
+
+/*
+ * Indicate whether the given binary search file handle will be searched
+ * with block-wise method.
+ */
+void
+_bsearch_file_info(bsearch_file_handle bfh,
+		    size_t *page_sz, size_t *max_sz, int *blockwise)
+{
+    if (page_sz)
+	*page_sz = bfh->page_sz;
+    if (max_sz)
+	*max_sz = bfh->cache_sz;
+    if (blockwise)
+	*blockwise = (bfh->file_sz != bfh->cache_sz);
+}
+
+/*
+ * Close the given binary file search handle.
+ *
+ * Inputs:
+ *
+ * @bfh Pointer to variable containing handle to close.
+ */
+void
+_bsearch_file_close(bsearch_file_handle *bfh)
+{
+    if (!*bfh)
+	return;
+    if ((*bfh)->fd >= 0)
+	(void) close((*bfh)->fd);
+    if ((*bfh)->page)
+	free((*bfh)->page);
+    if ((*bfh)->cache)
+	free((*bfh)->cache);
+    free(*bfh);
+    *bfh = NULL;
+}
+
+/*
+ * Private function to get a page from a cache.  The cache is a char
+ * array of 2^n - 1 double-size page worth of bytes, where n is the
+ * number of tree levels that the cache stores.  The cache can be
+ * smaller than n implies.
+ *
+ * The page may or may not be valid.  If the first byte of it is NUL
+ * then it's not valid, else it is.
+ *
+ * Returns 1 if page is in cache and valid, 0 if the cache is too small
+ * or the page is invalid.  The page address is output in @buf if the
+ * cache is large enough to contain it regardless of whether the page is
+ * valid.
+ *
+ * Inputs:
+ *
+ * @bfh      Binary search file handle
+ * @level    Level in the tree that we want a page for
+ * @page_idx Page number in the given level (0..2^level - 1)
+ *
+ * Outputs:
+ *
+ * @buf      Set to address of page if the cache is large enough
+ */
+static int
+get_page_from_cache(bsearch_file_handle bfh, size_t level, size_t page_idx,
+		    char **buf)
+{
+    size_t idx = 0;
+    size_t page_sz;
+
+    page_sz = bfh->page_sz << 1; /* we use double-size pages in the cache */
+
+    *buf = NULL;
+
+    /*
+     * Compute index into cache.  The cache is basically an array of
+     * double-size pages.  The first (zeroth) double-size page in the
+     * cache will be the middle page of the file -- the root of the
+     * tree.  The next two double-size pages will be the left and right
+     * pages of the second level in the tree.  The next four double-size
+     * pages will be the four pages at the next level.  And so on for as
+     * many pages as fit in the cache.
+     *
+     * The page index is the number of the page at the given level.  We
+     * then compute (2^level - 1 + page index) * 2page size, check that
+     * we have that in the cache, check that the page has been read (it
+     * doesn't start with NUL).
+     */
+    if (level)
+	idx = (1 << level) - 1 + page_idx;
+    if (((idx + 1) * page_sz * 2) > bfh->cache_sz)
+	return 0;
+
+    *buf = &bfh->cache[idx * page_sz * 2];
+    if (bfh->cache[idx * page_sz * 2] == '\0')
+	return 0; /* cache[idx] == NUL -> page not loaded in cache */
+    return 1;
+}
+
+/*
+ * Private function to read a page of @page_sz from @fd at offset @off
+ * into @buf, outputing the number of bytes read, which will be the same
+ * as @page_sz unless the page being read is the last page, in which
+ * case the number of remaining bytes in the file will be output.
+ *
+ * Returns 0 on success or an errno value otherwise (EIO if reads are
+ * short).
+ *
+ * Inputs:
+ *
+ * @bfh        Binary search file handle
+ * @level      Level in the binary search tree that we're at
+ * @page_idx   Page "index" at the @level of the tree that we want
+ * @page       Actual page number that we want
+ * want_double Whether we need a page or double page read
+ *
+ * Outputs:
+ *
+ * @buf        Page read or cached
+ * @bytes      Bytes read (may be less than page or double page size in
+ *             the case of the last page, of course)
+ */
+static int
+read_page(bsearch_file_handle bfh, size_t level, size_t page_idx, size_t page,
+	  int want_double, const char **buf, size_t *bytes)
+{
+    int ret;
+    off_t off;
+    size_t expected;
+    size_t wanted;
+    char *page_buf;
+
+    /* Figure out where we're reading and how much */
+    off = page * bfh->page_sz;
+    if (off < 0)
+	return EOVERFLOW;
+
+    wanted = bfh->page_sz << want_double;
+    expected = ((bfh->file_sz - off) > wanted) ? wanted : bfh->file_sz - off;
+
+    if (get_page_from_cache(bfh, level, page_idx, &page_buf)) {
+	*buf = page_buf;
+	*bytes = expected;
+	return 0; /* found in cache */
+    }
+
+
+    *bytes = 0;
+    *buf = NULL;
+
+    /* OK, we have to read a page or double-size page */
+
+    if (page_buf)
+	want_double = 1; /* we'll be caching; we cache double-size pages */
+    else
+	page_buf = bfh->page; /* we won't cache this page */
+
+    wanted = bfh->page_sz << want_double;
+    expected = ((bfh->file_sz - off) > wanted) ? wanted : bfh->file_sz - off;
+
+#ifdef HAVE_PREAD
+    ret = pread(bfh->fd, page_buf, expected, off);
+#else
+    if (lseek(bfh->fd, off, SEEK_SET) == (off_t)-1)
+	return errno;
+    ret = read(bfh->fd, page_buf, expected);
+#endif
+    if (ret < 0)
+	return errno;
+    
+    if (ret != expected)
+	return EIO; /* XXX ??? */
+
+    *buf = page_buf;
+    *bytes = expected;
+    return 0;
+}
+
+/*
+ * Perform a binary search of a file where each line is a record (LF and
+ * CRLF supported).  Each record consists of a key followed by an
+ * optional value separated from the key by whitespace.  Whitespace can
+ * be quoted with backslashes.  It's the caller's responsibility to
+ * encode/decode keys/values if quoting is desired; newlines should be
+ * encoded such that a newline does not appear in the result.
+ *
+ * The search is done with block-wise I/O (i.e., the whole file is not
+ * read into memory).
+ *
+ * All output arguments are optional.
+ *
+ * Returns 0 if key is found, -1 if not found, or an error code such as
+ * ENOMEM in case of error.
+ *
+ * NOTE: We could improve this by not freeing the buffer, instead
+ *       requiring that the caller provide it.  Further, we could cache
+ *       the top N levels of [double-size] pages (2^N - 1 pages), which
+ *       should speed up most searches by reducing the number of reads
+ *       by N.
+ *
+ * Inputs:
+ *
+ * @fd           File descriptor (file to search)
+ * @page_sz      Page size (if zero then the file's st_blksize will be used)
+ * @key          Key string to search for
+ *
+ * Outputs:
+ *
+ * @value        Location to store a copy of the value (caller must free)
+ * @location     Record location if found else the location where the
+ *               record should be inserted (index into @buf)
+ * @loops        Location to store a count of bisections required for
+ *               search (useful for confirming logarithmic performance)
+ * @reads        Location to store a count of pages read during search
+ *               (useful for confirming logarithmic performance)
+ */
+int
+_bsearch_file(bsearch_file_handle bfh, const char *key,
+	       char **value, size_t *location, size_t *loops, size_t *reads)
+{
+    int ret;
+    const char *buf;
+    size_t buf_sz;
+    size_t page, l, r;
+    size_t my_reads = 0;
+    size_t my_loops_total = 0;
+    size_t my_loops;
+    size_t level;        /* level in the tree */
+    size_t page_idx = 0; /* page number in the tree level */
+    size_t buf_location;
+    int cmp;
+    int buf_ends_in_eol = 0;
+    int buf_is_start = 0;
+
+    if (reads)
+	*reads = 0;
+
+    /* If whole file is in memory then search that and we're done */
+    if (bfh->file_sz == bfh->cache_sz)
+	return _bsearch_text(bfh->cache, bfh->cache_sz, key, value, location, loops);
+
+    /* Else block-wise binary search */
+
+    if (value)
+	*value = NULL;
+    if (loops)
+	*loops = 0;
+
+    l = 0;
+    r = (bfh->file_sz / bfh->page_sz) + 1;
+    for (level = 0, page = r >> 1; page >= l && page < r ; level++) {
+	ret = read_page(bfh, level, page_idx, page, 0, &buf, &buf_sz);
+	if (ret != 0)
+	    return ret;
+	my_reads++;
+	if (buf[buf_sz - 1] == '\r' || buf[buf_sz - 1] == '\n')
+	    buf_ends_in_eol = 1;
+	else
+	    buf_ends_in_eol = 0;
+
+	buf_is_start = page == 0 ? 1 : 0;
+	ret = bsearch_common(buf, (size_t)buf_sz, key, buf_is_start,
+			     value, &buf_location, &cmp, &my_loops);
+	if (ret > 0)
+	    return ret;
+	/* Found or no we update stats */
+	my_loops_total += my_loops;
+	if (loops)
+	    *loops = my_loops_total;
+	if (reads)
+	    *reads = my_reads;
+	if (location)
+	    *location = page * bfh->page_sz + buf_location;
+	if (ret == 0)
+	    return 0; /* found! */
+	/* Not found */
+	if (cmp < 0) {
+	    /* Search left */
+	    page_idx <<= 1;
+	    r = page;
+	    page = l + ((r - l) >> 1);
+	    continue;
+	} else {
+	    /*
+	     * Search right, but first search the current and next
+	     * blocks in case that the record we're looking for either
+	     * straddles the boundary between this and the next record,
+	     * or in case the record starts exactly at the next page.
+	     */
+	    heim_assert(cmp > 0, "cmp > 0");
+
+	    if (!buf_ends_in_eol || page == l || page == (r - 1)) {
+		ret = read_page(bfh, level, page_idx, page, 1, &buf, &buf_sz);
+		if (ret != 0)
+		    return ret;
+		my_reads++;
+
+		buf_is_start = page == l ? 1 : 0;
+
+		ret = bsearch_common(buf, (size_t)buf_sz, key, buf_is_start,
+				     value, &buf_location, &cmp, &my_loops);
+		if (ret > 0)
+		    return ret;
+		my_loops_total += my_loops;
+		if (loops)
+		    *loops = my_loops_total;
+		if (reads)
+		    *reads = my_reads;
+		if (location)
+		    *location = page * bfh->page_sz + buf_location;
+		if (ret == 0)
+		    return 0;
+	    }
+
+	    /* Oh well, search right */
+	    if (l == page && r == (l + 1))
+		break;
+	    page_idx = (page_idx << 1) + 1;
+	    l = page;
+	    page = l + ((r - l) >> 1);
+	    continue;
+	}
+    }
+    return -1;
+}
+
+
+static int
+stdb_open(void *plug, const char *dbtype, const char *dbname,
+	     heim_dict_t options, void **db, heim_error_t *error)
+{
+    bsearch_file_handle bfh;
+    char *p;
+    int ret;
+
+    if (error)
+	*error = NULL;
+    if (dbname == NULL || *dbname == '\0') {
+	if (error)
+	    *error = heim_error_create(EINVAL,
+				       N_("DB name required for sorted-text DB "
+					  "plugin", ""));
+	return EINVAL;
+    }
+    p = strrchr(dbname, '.');
+    if (p == NULL || strcmp(p, ".txt") != 0) {
+	if (error)
+	    *error = heim_error_create(ENOTSUP,
+				       N_("Text file (name ending in .txt) "
+				       "required for sorted-text DB plugin",
+				       ""));
+	return ENOTSUP;
+    }
+
+    ret = _bsearch_file_open(dbname, 0, 0, &bfh, NULL);
+    if (ret)
+	return ret;
+
+    *db = bfh;
+    return 0;
+}
+
+static int
+stdb_close(void *db, heim_error_t *error)
+{
+    bsearch_file_handle bfh = db;
+
+    if (error)
+	*error = NULL;
+    _bsearch_file_close(&bfh);
+    return 0;
+}
+
+static heim_data_t
+stdb_copy_value(void *db, heim_string_t table, heim_data_t key,
+	       heim_error_t *error)
+{
+    bsearch_file_handle bfh = db;
+    const char *k;
+    char *v;
+    heim_data_t value;
+    int ret;
+
+    if (error)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    if (table != HSTR(""))
+	return NULL;
+
+    if (heim_get_tid(key) == HEIM_TID_STRING)
+	k = heim_string_get_utf8((heim_string_t)key);
+    else
+	k = (const char *)heim_data_get_ptr(key);
+    ret = _bsearch_file(bfh, k, &v, NULL, NULL, NULL);
+    if (ret != 0) {
+	if (ret > 0 && error)
+	    *error = heim_error_create(ret, "%s", strerror(ret));
+	return NULL;
+    }
+    value = heim_data_create(v, strlen(v));
+    free(v);
+    /* XXX Handle ENOMEM */
+    return value;
+}
+
+struct heim_db_type heim_sorted_text_file_dbtype = {
+    1, stdb_open, NULL, stdb_close, NULL, NULL, NULL, NULL, NULL, NULL,
+    stdb_copy_value, NULL, NULL, NULL
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/data.c b/crypto/external/bsd/heimdal/dist/lib/base/data.c
new file mode 100644
index 000000000..bc84bdee7
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/data.c
@@ -0,0 +1,167 @@
+/*	$NetBSD: data.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+#include <string.h>
+
+static void
+data_dealloc(void *ptr)
+{
+    heim_data_t d = ptr;
+    heim_octet_string *os = (heim_octet_string *)d;
+    heim_data_free_f_t *deallocp;
+    heim_data_free_f_t dealloc;
+
+    if (os->data == NULL)
+	return;
+
+    /* Possible string ref */
+    deallocp = _heim_get_isaextra(os, 0);
+    dealloc = *deallocp;
+    if (dealloc != NULL)
+	dealloc(os->data);
+}
+
+static int
+data_cmp(void *a, void *b)
+{
+    heim_octet_string *osa = a, *osb = b;
+    if (osa->length != osb->length)
+	return osa->length - osb->length;
+    return memcmp(osa->data, osb->data, osa->length);
+}
+
+static unsigned long
+data_hash(void *ptr)
+{
+    heim_octet_string *os = ptr;
+    const unsigned char *s = os->data;
+
+    if (os->length < 4)
+	return os->length;
+    return s[0] | (s[1] << 8) |
+	(s[os->length - 2] << 16) | (s[os->length - 1] << 24);
+}
+
+struct heim_type_data _heim_data_object = {
+    HEIM_TID_DATA,
+    "data-object",
+    NULL,
+    data_dealloc,
+    NULL,
+    data_cmp,
+    data_hash,
+    NULL
+};
+
+/**
+ * Create a data object
+ *
+ * @param string the string to create, must be an utf8 string
+ *
+ * @return string object
+ */
+
+heim_data_t
+heim_data_create(const void *data, size_t length)
+{
+    heim_octet_string *os;
+
+    os = _heim_alloc_object(&_heim_data_object, sizeof(*os) + length);
+    if (os) {
+	os->data = (uint8_t *)os + sizeof(*os);
+	os->length = length;
+	memcpy(os->data, data, length);
+    }
+    return (heim_data_t)os;
+}
+
+heim_data_t
+heim_data_ref_create(const void *data, size_t length,
+		     heim_data_free_f_t dealloc)
+{
+    heim_octet_string *os;
+    heim_data_free_f_t *deallocp;
+
+    os = _heim_alloc_object(&_heim_data_object, sizeof(*os) + length);
+    if (os) {
+	os->data = (void *)data;
+	os->length = length;
+	deallocp = _heim_get_isaextra(os, 0);
+	*deallocp = dealloc;
+    }
+    return (heim_data_t)os;
+}
+
+
+/**
+ * Return the type ID of data objects
+ *
+ * @return type id of data objects
+ */
+
+heim_tid_t
+heim_data_get_type_id(void)
+{
+    return HEIM_TID_DATA;
+}
+
+/**
+ * Get the data value of the content.
+ *
+ * @param data the data object to get the value from
+ *
+ * @return a heim_octet_string
+ */
+
+const heim_octet_string *
+heim_data_get_data(heim_data_t data)
+{
+    /* Note that this works for data and data_ref objects */
+    return (const heim_octet_string *)data;
+}
+
+const void *
+heim_data_get_ptr(heim_data_t data)
+{
+    /* Note that this works for data and data_ref objects */
+    return ((const heim_octet_string *)data)->data;
+}
+
+size_t	heim_data_get_length(heim_data_t data)
+{
+    /* Note that this works for data and data_ref objects */
+    return ((const heim_octet_string *)data)->length;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/db.c b/crypto/external/bsd/heimdal/dist/lib/base/db.c
new file mode 100644
index 000000000..cee0d46cc
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/db.c
@@ -0,0 +1,1729 @@
+/*	$NetBSD: db.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This is a pluggable simple DB abstraction, with a simple get/set/
+ * delete key/value pair interface.
+ *
+ * Plugins may provide any of the following optional features:
+ *
+ *  - tables -- multiple attribute/value tables in one DB
+ *  - locking
+ *  - transactions (i.e., allow any heim_object_t as key or value)
+ *  - transcoding of values
+ *
+ * Stackable plugins that provide missing optional features are
+ * possible.
+ *
+ * Any plugin that provides locking will also provide transactions, but
+ * those transactions will not be atomic in the face of failures (a
+ * memory-based rollback log is used).
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#ifdef WIN32
+#include <io.h>
+#else
+#include <sys/file.h>
+#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#include <fcntl.h>
+
+#include "baselocl.h"
+#include <krb5/base64.h>
+
+#define HEIM_ENOMEM(ep) \
+    (((ep) && !*(ep)) ? \
+	heim_error_get_code((*(ep) = heim_error_create_enomem())) : ENOMEM)
+
+#define HEIM_ERROR_HELPER(ep, ec, args) \
+    (((ep) && !*(ep)) ? \
+	heim_error_get_code((*(ep) = heim_error_create args)) : (ec))
+
+#define HEIM_ERROR(ep, ec, args) \
+    (ec == ENOMEM) ? HEIM_ENOMEM(ep) : HEIM_ERROR_HELPER(ep, ec, args);
+
+static heim_string_t to_base64(heim_data_t, heim_error_t *);
+static heim_data_t from_base64(heim_string_t, heim_error_t *);
+
+static int open_file(const char *, int , int, int *, heim_error_t *);
+static int read_json(const char *, heim_object_t *, heim_error_t *);
+static struct heim_db_type json_dbt;
+
+static void db_dealloc(void *ptr);
+
+struct heim_type_data db_object = {
+    HEIM_TID_DB,
+    "db-object",
+    NULL,
+    db_dealloc,
+    NULL,
+    NULL,
+    NULL,
+    NULL
+};
+
+
+static heim_base_once_t db_plugin_init_once = HEIM_BASE_ONCE_INIT;
+
+static heim_dict_t db_plugins;
+
+typedef struct db_plugin {
+    heim_string_t               name;
+    heim_db_plug_open_f_t       openf;
+    heim_db_plug_clone_f_t      clonef;
+    heim_db_plug_close_f_t      closef;
+    heim_db_plug_lock_f_t       lockf;
+    heim_db_plug_unlock_f_t     unlockf;
+    heim_db_plug_sync_f_t       syncf;
+    heim_db_plug_begin_f_t      beginf;
+    heim_db_plug_commit_f_t     commitf;
+    heim_db_plug_rollback_f_t   rollbackf;
+    heim_db_plug_copy_value_f_t copyf;
+    heim_db_plug_set_value_f_t  setf;
+    heim_db_plug_del_key_f_t    delf;
+    heim_db_plug_iter_f_t       iterf;
+    void                        *data;
+} db_plugin_desc, *db_plugin;
+
+struct heim_db_data {
+    db_plugin           plug;
+    heim_string_t       dbtype;
+    heim_string_t       dbname;
+    heim_dict_t         options;
+    void                *db_data;
+    heim_data_t		to_release;
+    heim_error_t        error;
+    int                 ret;
+    unsigned int        in_transaction:1;
+    unsigned int	ro:1;
+    unsigned int	ro_tx:1;
+    heim_dict_t         set_keys;
+    heim_dict_t         del_keys;
+    heim_string_t       current_table;
+};
+
+static int
+db_do_log_actions(heim_db_t db, heim_error_t *error);
+static int
+db_replay_log(heim_db_t db, heim_error_t *error);
+
+static HEIMDAL_MUTEX db_type_mutex = HEIMDAL_MUTEX_INITIALIZER;
+
+static void
+db_init_plugins_once(void *arg)
+{
+    db_plugins = heim_retain(arg);
+}
+
+static void
+plugin_dealloc(void *arg)
+{
+    db_plugin plug = arg;
+
+    heim_release(plug->name);
+}
+
+/** heim_db_register
+ * @brief Registers a DB type for use with heim_db_create().
+ *
+ * @param dbtype Name of DB type
+ * @param data   Private data argument to the dbtype's openf method
+ * @param plugin Structure with DB type methods (function pointers)
+ *
+ * Backends that provide begin/commit/rollback methods must provide ACID
+ * semantics.
+ *
+ * The registered DB type will have ACID semantics for backends that do
+ * not provide begin/commit/rollback methods but do provide lock/unlock
+ * and rdjournal/wrjournal methods (using a replay log journalling
+ * scheme).
+ *
+ * If the registered DB type does not natively provide read vs. write
+ * transaction isolation but does provide a lock method then the DB will
+ * provide read/write transaction isolation.
+ *
+ * @return ENOMEM on failure, else 0.
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_register(const char *dbtype,
+		 void *data,
+		 struct heim_db_type *plugin)
+{
+    heim_dict_t plugins;
+    heim_string_t s;
+    db_plugin plug, plug2;
+    int ret = 0;
+
+    if ((plugin->beginf != NULL && plugin->commitf == NULL) ||
+	(plugin->beginf != NULL && plugin->rollbackf == NULL) ||
+	(plugin->lockf != NULL && plugin->unlockf == NULL) ||
+	plugin->copyf == NULL)
+	heim_abort("Invalid DB plugin; make sure methods are paired");
+
+    /* Initialize */
+    plugins = heim_dict_create(11);
+    if (plugins == NULL)
+	return ENOMEM;
+    heim_base_once_f(&db_plugin_init_once, plugins, db_init_plugins_once);
+    heim_release(plugins);
+    heim_assert(db_plugins != NULL, "heim_db plugin table initialized");
+
+    s = heim_string_create(dbtype);
+    if (s == NULL)
+	return ENOMEM;
+
+    plug = heim_alloc(sizeof (*plug), "db_plug", plugin_dealloc);
+    if (plug == NULL) {
+	heim_release(s);
+	return ENOMEM;
+    }
+
+    plug->name = heim_retain(s);
+    plug->openf = plugin->openf;
+    plug->clonef = plugin->clonef;
+    plug->closef = plugin->closef;
+    plug->lockf = plugin->lockf;
+    plug->unlockf = plugin->unlockf;
+    plug->syncf = plugin->syncf;
+    plug->beginf = plugin->beginf;
+    plug->commitf = plugin->commitf;
+    plug->rollbackf = plugin->rollbackf;
+    plug->copyf = plugin->copyf;
+    plug->setf = plugin->setf;
+    plug->delf = plugin->delf;
+    plug->iterf = plugin->iterf;
+    plug->data = data;
+
+    HEIMDAL_MUTEX_lock(&db_type_mutex);
+    plug2 = heim_dict_get_value(db_plugins, s);
+    if (plug2 == NULL)
+	ret = heim_dict_set_value(db_plugins, s, plug);
+    HEIMDAL_MUTEX_unlock(&db_type_mutex);
+    heim_release(plug);
+    heim_release(s);
+
+    return ret;
+}
+
+static void
+db_dealloc(void *arg)
+{
+    heim_db_t db = arg;
+    heim_assert(!db->in_transaction,
+		"rollback or commit heim_db_t before releasing it");
+    if (db->db_data)
+	(void) db->plug->closef(db->db_data, NULL);
+    heim_release(db->to_release);
+    heim_release(db->dbtype);
+    heim_release(db->dbname);
+    heim_release(db->options);
+    heim_release(db->set_keys);
+    heim_release(db->del_keys);
+    heim_release(db->error);
+}
+
+struct dbtype_iter {
+    heim_db_t           db;
+    const char          *dbname;
+    heim_dict_t         options;
+    heim_error_t        *error;
+};
+
+/*
+ * Helper to create a DB handle with the first registered DB type that
+ * can open the given DB.  This is useful when the app doesn't know the
+ * DB type a priori.  This assumes that DB types can "taste" DBs, either
+ * from the filename extension or from the actual file contents.
+ */
+static void
+dbtype_iter2create_f(heim_object_t dbtype, heim_object_t junk, void *arg)
+{
+    struct dbtype_iter *iter_ctx = arg;
+
+    if (iter_ctx->db != NULL)
+	return;
+    iter_ctx->db = heim_db_create(heim_string_get_utf8(dbtype),
+				  iter_ctx->dbname, iter_ctx->options,
+				  iter_ctx->error);
+}
+
+/**
+ * Open a database of the given dbtype.
+ *
+ * Database type names can be composed of one or more pseudo-DB types
+ * and one concrete DB type joined with a '+' between each.  For
+ * example: "transaction+bdb" might be a Berkeley DB with a layer above
+ * that provides transactions.
+ *
+ * Options may be provided via a dict (an associative array).  Existing
+ * options include:
+ *
+ *  - "create", with any value (create if DB doesn't exist)
+ *  - "exclusive", with any value (exclusive create)
+ *  - "truncate", with any value (truncate the DB)
+ *  - "read-only", with any value (disallow writes)
+ *  - "sync", with any value (make transactions durable)
+ *  - "journal-name", with a string value naming a journal file name
+ *
+ * @param dbtype  Name of DB type
+ * @param dbname  Name of DB (likely a file path)
+ * @param options Options dict
+ * @param db      Output open DB handle
+ * @param error   Output error  object
+ *
+ * @return a DB handle
+ *
+ * @addtogroup heimbase
+ */
+heim_db_t
+heim_db_create(const char *dbtype, const char *dbname,
+	       heim_dict_t options, heim_error_t *error)
+{
+    heim_string_t s;
+    char *p;
+    db_plugin plug;
+    heim_db_t db;
+    int ret = 0;
+
+    if (options == NULL) {
+	options = heim_dict_create(11);
+	if (options == NULL) {
+	    if (error)
+		*error = heim_error_create_enomem();
+	    return NULL;
+	}
+    } else {
+	(void) heim_retain(options);
+    }
+
+    if (db_plugins == NULL) {
+	heim_release(options);
+	return NULL;
+    }
+
+    if (dbtype == NULL || *dbtype == '\0') {
+	struct dbtype_iter iter_ctx = { NULL, dbname, options, error};
+
+	/* Try all dbtypes */
+	heim_dict_iterate_f(db_plugins, &iter_ctx, dbtype_iter2create_f);
+	heim_release(options);
+	return iter_ctx.db;
+    } else if (strstr(dbtype, "json")) {
+	(void) heim_db_register(dbtype, NULL, &json_dbt);
+    }
+
+    /*
+     * Allow for dbtypes that are composed from pseudo-dbtypes chained
+     * to a real DB type with '+'.  For example a pseudo-dbtype might
+     * add locking, transactions, transcoding of values, ...
+     */
+    p = strchr(dbtype, '+');
+    if (p != NULL)
+	s = heim_string_create_with_bytes(dbtype, p - dbtype);
+    else
+	s = heim_string_create(dbtype);
+    if (s == NULL) {
+	heim_release(options);
+	return NULL;
+    }
+
+    HEIMDAL_MUTEX_lock(&db_type_mutex);
+    plug = heim_dict_get_value(db_plugins, s);
+    HEIMDAL_MUTEX_unlock(&db_type_mutex);
+    heim_release(s);
+    if (plug == NULL) {
+	if (error)
+	    *error = heim_error_create(ENOENT,
+				       N_("Heimdal DB plugin not found: %s", ""),
+				       dbtype);
+	heim_release(options);
+	return NULL;
+    }
+
+    db = _heim_alloc_object(&db_object, sizeof(*db));
+    if (db == NULL) {
+	heim_release(options);
+	return NULL;
+    }
+
+    db->in_transaction = 0;
+    db->ro_tx = 0;
+    db->set_keys = NULL;
+    db->del_keys = NULL;
+    db->plug = plug;
+    db->options = options;
+
+    ret = plug->openf(plug->data, dbtype, dbname, options, &db->db_data, error);
+    if (ret) {
+	heim_release(db);
+	if (error && *error == NULL)
+	    *error = heim_error_create(ENOENT,
+				       N_("Heimdal DB could not be opened: %s", ""),
+				       dbname);
+	return NULL;
+    }
+
+    ret = db_replay_log(db, error);
+    if (ret) {
+	heim_release(db);
+	return NULL;
+    }
+
+    if (plug->clonef == NULL) {
+	db->dbtype = heim_string_create(dbtype);
+	db->dbname = heim_string_create(dbname);
+
+	if (!db->dbtype || ! db->dbname) {
+	    heim_release(db);
+	    if (error)
+		*error = heim_error_create_enomem();
+	    return NULL;
+	}
+    }
+
+    return db;
+}
+
+/**
+ * Clone (duplicate) an open DB handle.
+ *
+ * This is useful for multi-threaded applications.  Applications must
+ * synchronize access to any given DB handle.
+ *
+ * Returns EBUSY if there is an open transaction for the input db.
+ *
+ * @param db      Open DB handle
+ * @param error   Output error object
+ *
+ * @return a DB handle
+ *
+ * @addtogroup heimbase
+ */
+heim_db_t
+heim_db_clone(heim_db_t db, heim_error_t *error)
+{
+    heim_db_t result;
+    int ret;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	heim_abort("Expected a database");
+    if (db->in_transaction)
+	heim_abort("DB handle is busy");
+
+    if (db->plug->clonef == NULL) {
+	return heim_db_create(heim_string_get_utf8(db->dbtype),
+			      heim_string_get_utf8(db->dbname),
+			      db->options, error);
+    }
+
+    result = _heim_alloc_object(&db_object, sizeof(*result));
+    if (result == NULL) {
+	if (error)
+	    *error = heim_error_create_enomem();
+	return NULL;
+    }
+
+    result->set_keys = NULL;
+    result->del_keys = NULL;
+    ret = db->plug->clonef(db->db_data, &result->db_data, error);
+    if (ret) {
+	heim_release(result);
+	if (error && !*error)
+	    *error = heim_error_create(ENOENT,
+				       N_("Could not re-open DB while cloning", ""));
+	return NULL;
+    }
+    db->db_data = NULL;
+    return result;
+}
+
+/**
+ * Open a transaction on the given db.
+ *
+ * @param db    Open DB handle
+ * @param error Output error object
+ *
+ * @return 0 on success, system error otherwise
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_begin(heim_db_t db, int read_only, heim_error_t *error)
+{
+    int ret;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return EINVAL;
+
+    if (db->in_transaction && (read_only || !db->ro_tx || (!read_only && !db->ro_tx)))
+	heim_abort("DB already in transaction");
+
+    if (db->plug->setf == NULL || db->plug->delf == NULL)
+	return EINVAL;
+
+    if (db->plug->beginf) {
+	ret = db->plug->beginf(db->db_data, read_only, error);
+        if (ret)
+            return ret;
+    } else if (!db->in_transaction) {
+	/* Try to emulate transactions */
+
+	if (db->plug->lockf == NULL)
+	    return EINVAL; /* can't lock? -> no transactions */
+
+	/* Assume unlock provides sync/durability */
+	ret = db->plug->lockf(db->db_data, read_only, error);
+	if (ret)
+	    return ret;
+
+	ret = db_replay_log(db, error);
+	if (ret) {
+	    ret = db->plug->unlockf(db->db_data, error);
+	    return ret;
+	}
+
+	db->set_keys = heim_dict_create(11);
+	if (db->set_keys == NULL)
+	    return ENOMEM;
+	db->del_keys = heim_dict_create(11);
+	if (db->del_keys == NULL) {
+	    heim_release(db->set_keys);
+	    db->set_keys = NULL;
+	    return ENOMEM;
+	}
+    } else {
+	heim_assert(read_only == 0, "Internal error");
+	ret = db->plug->lockf(db->db_data, 0, error);
+	if (ret)
+	    return ret;
+    }
+    db->in_transaction = 1;
+    db->ro_tx = !!read_only;
+    return 0;
+}
+
+/**
+ * Commit an open transaction on the given db.
+ *
+ * @param db    Open DB handle
+ * @param error Output error object
+ *
+ * @return 0 on success, system error otherwise
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_commit(heim_db_t db, heim_error_t *error)
+{
+    int ret, ret2;
+    heim_string_t journal_fname = NULL;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return EINVAL;
+    if (!db->in_transaction)
+	return 0;
+    if (db->plug->commitf == NULL && db->plug->lockf == NULL)
+	return EINVAL;
+
+    if (db->plug->commitf != NULL) {
+	ret = db->plug->commitf(db->db_data, error);
+	if (ret)
+	    (void) db->plug->rollbackf(db->db_data, error);
+
+	db->in_transaction = 0;
+	db->ro_tx = 0;
+	return ret;
+    }
+
+    if (db->ro_tx) {
+	ret = 0;
+	goto done;
+    }
+
+    if (db->options == NULL)
+	journal_fname = heim_dict_get_value(db->options, HSTR("journal-filename"));
+
+    if (journal_fname != NULL) {
+	heim_array_t a;
+	heim_string_t journal_contents;
+	size_t len, bytes;
+	int save_errno;
+
+	/* Create contents for replay log */
+	ret = ENOMEM;
+	a = heim_array_create();
+	if (a == NULL)
+	    goto err;
+	ret = heim_array_append_value(a, db->set_keys);
+	if (ret) {
+	    heim_release(a);
+	    goto err;
+	}
+	ret = heim_array_append_value(a, db->del_keys);
+	if (ret) {
+	    heim_release(a);
+	    goto err;
+	}
+	journal_contents = heim_json_copy_serialize(a, 0, error);
+	heim_release(a);
+
+	/* Write replay log */
+	if (journal_fname != NULL) {
+	    int fd;
+
+	    ret = open_file(heim_string_get_utf8(journal_fname), 1, 0, &fd, error);
+	    if (ret) {
+		heim_release(journal_contents);
+		goto err;
+	    }
+	    len = strlen(heim_string_get_utf8(journal_contents));
+	    bytes = write(fd, heim_string_get_utf8(journal_contents), len);
+	    save_errno = errno;
+	    heim_release(journal_contents);
+	    ret = close(fd);
+	    if (bytes != len) {
+		/* Truncate replay log */
+		(void) open_file(heim_string_get_utf8(journal_fname), 1, 0, NULL, error);
+		ret = save_errno;
+		goto err;
+	    }
+	    if (ret)
+		goto err;
+	}
+    }
+
+    /* Apply logged actions */
+    ret = db_do_log_actions(db, error);
+    if (ret)
+	return ret;
+
+    if (db->plug->syncf != NULL) {
+	/* fsync() or whatever */
+	ret = db->plug->syncf(db->db_data, error);
+	if (ret)
+	    return ret;
+    }
+
+    /* Truncate replay log and we're done */
+    if (journal_fname != NULL) {
+	int fd;
+
+	ret2 = open_file(heim_string_get_utf8(journal_fname), 1, 0, &fd, error);
+	if (ret2 == 0)
+	    (void) close(fd);
+    }
+
+    /*
+     * Clean up; if we failed to remore the replay log that's OK, we'll
+     * handle that again in heim_db_commit()
+     */
+done:
+    heim_release(db->set_keys);
+    heim_release(db->del_keys);
+    db->set_keys = NULL;
+    db->del_keys = NULL;
+    db->in_transaction = 0;
+    db->ro_tx = 0;
+
+    ret2 = db->plug->unlockf(db->db_data, error);
+    if (ret == 0)
+	ret = ret2;
+
+    return ret;
+
+err:
+    return HEIM_ERROR(error, ret,
+		      (ret, N_("Error while committing transaction: %s", ""),
+		       strerror(ret)));
+}
+
+/**
+ * Rollback an open transaction on the given db.
+ *
+ * @param db    Open DB handle
+ * @param error Output error object
+ *
+ * @return 0 on success, system error otherwise
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_rollback(heim_db_t db, heim_error_t *error)
+{
+    int ret = 0;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return EINVAL;
+    if (!db->in_transaction)
+	return 0;
+
+    if (db->plug->rollbackf != NULL)
+	ret = db->plug->rollbackf(db->db_data, error);
+    else if (db->plug->unlockf != NULL)
+	ret = db->plug->unlockf(db->db_data, error);
+
+    heim_release(db->set_keys);
+    heim_release(db->del_keys);
+    db->set_keys = NULL;
+    db->del_keys = NULL;
+    db->in_transaction = 0;
+    db->ro_tx = 0;
+
+    return ret;
+}
+
+/**
+ * Get type ID of heim_db_t objects.
+ *
+ * @addtogroup heimbase
+ */
+heim_tid_t
+heim_db_get_type_id(void)
+{
+    return HEIM_TID_DB;
+}
+
+heim_data_t
+_heim_db_get_value(heim_db_t db, heim_string_t table, heim_data_t key,
+		   heim_error_t *error)
+{
+    heim_release(db->to_release);
+    db->to_release = heim_db_copy_value(db, table, key, error);
+    return db->to_release;
+}
+
+/**
+ * Lookup a key's value in the DB.
+ *
+ * Returns 0 on success, -1 if the key does not exist in the DB, or a
+ * system error number on failure.
+ *
+ * @param db    Open DB handle
+ * @param key   Key
+ * @param error Output error object
+ *
+ * @return the value (retained), if there is one for the given key
+ *
+ * @addtogroup heimbase
+ */
+heim_data_t
+heim_db_copy_value(heim_db_t db, heim_string_t table, heim_data_t key,
+		   heim_error_t *error)
+{
+    heim_object_t v;
+    heim_data_t result;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return NULL;
+
+    if (error != NULL)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    if (db->in_transaction) {
+	heim_string_t key64;
+
+	key64 = to_base64(key, error);
+	if (key64 == NULL) {
+	    if (error)
+		*error = heim_error_create_enomem();
+	    return NULL;
+	}
+
+	v = heim_path_copy(db->set_keys, error, table, key64, NULL);
+	if (v != NULL) {
+	    heim_release(key64);
+	    return v;
+	}
+	v = heim_path_copy(db->del_keys, error, table, key64, NULL); /* can't be NULL */
+	heim_release(key64);
+	if (v != NULL)
+	    return NULL;
+    }
+
+    result = db->plug->copyf(db->db_data, table, key, error);
+
+    return result;
+}
+
+/**
+ * Set a key's value in the DB.
+ *
+ * @param db    Open DB handle
+ * @param key   Key
+ * @param value Value (if NULL the key will be deleted, but empty is OK)
+ * @param error Output error object
+ *
+ * @return 0 on success, system error otherwise
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_set_value(heim_db_t db, heim_string_t table,
+		  heim_data_t key, heim_data_t value, heim_error_t *error)
+{
+    heim_string_t key64 = NULL;
+    int ret;
+
+    if (error != NULL)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    if (value == NULL)
+	/* Use heim_null_t instead of NULL */
+	return heim_db_delete_key(db, table, key, error);
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return EINVAL;
+
+    if (heim_get_tid(key) != HEIM_TID_DATA)
+	return HEIM_ERROR(error, EINVAL,
+			  (EINVAL, N_("DB keys must be data", "")));
+
+    if (db->plug->setf == NULL)
+	return EBADF;
+
+    if (!db->in_transaction) {
+	ret = heim_db_begin(db, 0, error);
+	if (ret)
+	    goto err;
+	heim_assert(db->in_transaction, "Internal error");
+	ret = heim_db_set_value(db, table, key, value, error);
+	if (ret) {
+	    (void) heim_db_rollback(db, NULL);
+	    return ret;
+	}
+	return heim_db_commit(db, error);
+    }
+
+    /* Transaction emulation */
+    heim_assert(db->set_keys != NULL, "Internal error");
+    key64 = to_base64(key, error);
+    if (key64 == NULL)
+	return HEIM_ENOMEM(error);
+
+    if (db->ro_tx) {
+	ret = heim_db_begin(db, 0, error);
+	if (ret)
+	    goto err;
+    }
+    ret = heim_path_create(db->set_keys, 29, value, error, table, key64, NULL);
+    if (ret)
+	goto err;
+    heim_path_delete(db->del_keys, error, table, key64, NULL);
+    heim_release(key64);
+
+    return 0;
+
+err:
+    heim_release(key64);
+    return HEIM_ERROR(error, ret,
+		      (ret, N_("Could not set a dict value while while "
+		       "setting a DB value", "")));
+}
+
+/**
+ * Delete a key and its value from the DB
+ *
+ *
+ * @param db    Open DB handle
+ * @param key   Key
+ * @param error Output error object
+ *
+ * @return 0 on success, system error otherwise
+ *
+ * @addtogroup heimbase
+ */
+int
+heim_db_delete_key(heim_db_t db, heim_string_t table, heim_data_t key,
+		   heim_error_t *error)
+{
+    heim_string_t key64 = NULL;
+    int ret;
+
+    if (error != NULL)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return EINVAL;
+
+    if (db->plug->delf == NULL)
+	return EBADF;
+
+    if (!db->in_transaction) {
+	ret = heim_db_begin(db, 0, error);
+	if (ret)
+	    goto err;
+	heim_assert(db->in_transaction, "Internal error");
+	ret = heim_db_delete_key(db, table, key, error);
+	if (ret) {
+	    (void) heim_db_rollback(db, NULL);
+	    return ret;
+	}
+	return heim_db_commit(db, error);
+    }
+
+    /* Transaction emulation */
+    heim_assert(db->set_keys != NULL, "Internal error");
+    key64 = to_base64(key, error);
+    if (key64 == NULL)
+	return HEIM_ENOMEM(error);
+    if (db->ro_tx) {
+	ret = heim_db_begin(db, 0, error);
+	if (ret)
+	    goto err;
+    }
+    ret = heim_path_create(db->del_keys, 29, heim_number_create(1), error, table, key64, NULL);
+    if (ret)
+	goto err;
+    heim_path_delete(db->set_keys, error, table, key64, NULL);
+    heim_release(key64);
+
+    return 0;
+
+err:
+    heim_release(key64);
+    return HEIM_ERROR(error, ret,
+		      (ret, N_("Could not set a dict value while while "
+		       "deleting a DB value", "")));
+}
+
+/**
+ * Iterate a callback function over keys and values from a DB.
+ *
+ * @param db        Open DB handle
+ * @param iter_data Callback function's private data
+ * @param iter_f    Callback function, called once per-key/value pair
+ * @param error     Output error object
+ *
+ * @addtogroup heimbase
+ */
+void
+heim_db_iterate_f(heim_db_t db, heim_string_t table, void *iter_data,
+		  heim_db_iterator_f_t iter_f, heim_error_t *error)
+{
+    if (error != NULL)
+	*error = NULL;
+
+    if (heim_get_tid(db) != HEIM_TID_DB)
+	return;
+
+    if (!db->in_transaction)
+	db->plug->iterf(db->db_data, table, iter_data, iter_f, error);
+}
+
+static void
+db_replay_log_table_set_keys_iter(heim_object_t key, heim_object_t value,
+				  void *arg)
+{
+    heim_db_t db = arg;
+    heim_data_t k, v;
+
+    if (db->ret)
+	return;
+
+    k = from_base64((heim_string_t)key, &db->error);
+    if (k == NULL) {
+	db->ret = ENOMEM;
+	return;
+    }
+    v = (heim_data_t)value;
+
+    db->ret = db->plug->setf(db->db_data, db->current_table, k, v, &db->error);
+    heim_release(k);
+}
+
+static void
+db_replay_log_table_del_keys_iter(heim_object_t key, heim_object_t value,
+				  void *arg)
+{
+    heim_db_t db = arg;
+    heim_data_t k;
+
+    if (db->ret) {
+	db->ret = ENOMEM;
+	return;
+    }
+
+    k = from_base64((heim_string_t)key, &db->error);
+    if (k == NULL)
+	return;
+
+    db->ret = db->plug->delf(db->db_data, db->current_table, k, &db->error);
+    heim_release(k);
+}
+
+static void
+db_replay_log_set_keys_iter(heim_object_t table, heim_object_t table_dict,
+			    void *arg)
+{
+    heim_db_t db = arg;
+
+    if (db->ret)
+	return;
+
+    db->current_table = table;
+    heim_dict_iterate_f(table_dict, db, db_replay_log_table_set_keys_iter);
+}
+
+static void
+db_replay_log_del_keys_iter(heim_object_t table, heim_object_t table_dict,
+			    void *arg)
+{
+    heim_db_t db = arg;
+
+    if (db->ret)
+	return;
+
+    db->current_table = table;
+    heim_dict_iterate_f(table_dict, db, db_replay_log_table_del_keys_iter);
+}
+
+static int
+db_do_log_actions(heim_db_t db, heim_error_t *error)
+{
+    int ret;
+
+    if (error)
+	*error = NULL;
+
+    db->ret = 0;
+    db->error = NULL;
+    if (db->set_keys != NULL)
+	heim_dict_iterate_f(db->set_keys, db, db_replay_log_set_keys_iter);
+    if (db->del_keys != NULL)
+	heim_dict_iterate_f(db->del_keys, db, db_replay_log_del_keys_iter);
+
+    ret = db->ret;
+    db->ret = 0;
+    if (error && db->error) {
+	*error = db->error;
+	db->error = NULL;
+    } else {
+	heim_release(db->error);
+	db->error = NULL;
+    }
+    return ret;
+}
+
+static int
+db_replay_log(heim_db_t db, heim_error_t *error)
+{
+    int ret;
+    heim_string_t journal_fname = NULL;
+    heim_object_t journal;
+    size_t len;
+
+    heim_assert(!db->in_transaction, "DB transaction not open");
+    heim_assert(db->set_keys == NULL && db->set_keys == NULL, "DB transaction not open");
+
+    if (error)
+	*error = NULL;
+
+    if (db->options == NULL)
+	return 0;
+
+    journal_fname = heim_dict_get_value(db->options, HSTR("journal-filename"));
+    if (journal_fname == NULL)
+	return 0;
+
+    ret = read_json(heim_string_get_utf8(journal_fname), &journal, error);
+    if (ret == ENOENT) {
+        heim_release(journal_fname);
+	return 0;
+    }
+    if (ret == 0 && journal == NULL) {
+        heim_release(journal_fname);
+	return 0;
+    }
+    if (ret != 0) {
+        heim_release(journal_fname);
+	return ret;
+    }
+
+    if (heim_get_tid(journal) != HEIM_TID_ARRAY) {
+        heim_release(journal_fname);
+	return HEIM_ERROR(error, EINVAL,
+			  (ret, N_("Invalid journal contents; delete journal",
+				   "")));
+    }
+
+    len = heim_array_get_length(journal);
+
+    if (len > 0)
+	db->set_keys = heim_array_get_value(journal, 0);
+    if (len > 1)
+	db->del_keys = heim_array_get_value(journal, 1);
+    ret = db_do_log_actions(db, error);
+    if (ret) {
+        heim_release(journal_fname);
+	return ret;
+    }
+
+    /* Truncate replay log and we're done */
+    ret = open_file(heim_string_get_utf8(journal_fname), 1, 0, NULL, error);
+    heim_release(journal_fname);
+    if (ret)
+	return ret;
+    heim_release(db->set_keys);
+    heim_release(db->del_keys);
+    db->set_keys = NULL;
+    db->del_keys = NULL;
+
+    return 0;
+}
+
+static
+heim_string_t to_base64(heim_data_t data, heim_error_t *error)
+{
+    char *b64 = NULL;
+    heim_string_t s = NULL;
+    const heim_octet_string *d;
+    int ret;
+
+    d = heim_data_get_data(data);
+    ret = rk_base64_encode(d->data, d->length, &b64);
+    if (ret < 0 || b64 == NULL)
+	goto enomem;
+    s = heim_string_ref_create(b64, free);
+    if (s == NULL)
+	goto enomem;
+    return s;
+
+enomem:
+    free(b64);
+    if (error)
+	*error = heim_error_create_enomem();
+    return NULL;
+}
+
+static
+heim_data_t from_base64(heim_string_t s, heim_error_t *error)
+{
+    void *buf;
+    size_t len;
+    heim_data_t d;
+
+    buf = malloc(strlen(heim_string_get_utf8(s)));
+    if (buf == NULL)
+	goto enomem;
+
+    len = rk_base64_decode(heim_string_get_utf8(s), buf);
+    d = heim_data_ref_create(buf, len, free);
+    if (d == NULL)
+	goto enomem;
+    return d;
+
+enomem:
+    free(buf);
+    if (error)
+	*error = heim_error_create_enomem();
+    return NULL;
+}
+
+
+static int
+open_file(const char *dbname, int for_write, int excl, int *fd_out, heim_error_t *error)
+{
+#ifdef WIN32
+    HANDLE hFile;
+    int ret = 0;
+
+    if (fd_out)
+	*fd_out = -1;
+
+    if (for_write)
+	hFile = CreateFile(dbname, GENERIC_WRITE | GENERIC_READ, 0,
+			   NULL, /* we'll close as soon as we read */
+			   CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    else
+	hFile = CreateFile(dbname, GENERIC_READ, FILE_SHARE_READ,
+			   NULL, /* we'll close as soon as we read */
+			   OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (hFile == INVALID_HANDLE_VALUE) {
+	ret = GetLastError();
+	_set_errno(ret); /* CreateFile() does not set errno */
+	goto err;
+    }
+    if (fd_out == NULL) {
+	(void) CloseHandle(hFile);
+	return 0;
+    }
+
+    *fd_out = _open_osfhandle((intptr_t) hFile, 0);
+    if (*fd_out < 0) {
+	ret = errno;
+	(void) CloseHandle(hFile);
+	goto err;
+    }
+
+    /* No need to lock given share deny mode */
+    return 0;
+
+err:
+    if (error != NULL) {
+	char *s = NULL;
+	FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER,
+		      0, ret, 0, (LPTSTR) &s, 0, NULL);
+	*error = heim_error_create(ret, N_("Could not open JSON file %s: %s", ""),
+				   dbname, s ? s : "<error formatting error>");
+	LocalFree(s);
+    }
+    return ret;
+#else
+    int ret = 0;
+    int fd;
+
+    if (fd_out)
+	*fd_out = -1;
+
+    if (for_write && excl)
+	fd = open(dbname, O_CREAT | O_EXCL | O_WRONLY, 0600);
+    else if (for_write)
+	fd = open(dbname, O_CREAT | O_TRUNC | O_WRONLY, 0600);
+    else
+	fd = open(dbname, O_RDONLY);
+    if (fd < 0) {
+	if (error != NULL)
+	    *error = heim_error_create(ret, N_("Could not open JSON file %s: %s", ""),
+				       dbname, strerror(errno));
+	return errno;
+    }
+
+    if (fd_out == NULL) {
+	(void) close(fd);
+	return 0;
+    }
+
+    ret = flock(fd, for_write ? LOCK_EX : LOCK_SH);
+    if (ret == -1) {
+	/* Note that we if O_EXCL we're leaving the [lock] file around */
+	(void) close(fd);
+	return HEIM_ERROR(error, errno,
+			  (errno, N_("Could not lock JSON file %s: %s", ""),
+			   dbname, strerror(errno)));
+    }
+
+    *fd_out = fd;
+    
+    return 0;
+#endif
+}
+
+static int
+read_json(const char *dbname, heim_object_t *out, heim_error_t *error)
+{
+    struct stat st;
+    char *str = NULL;
+    int ret;
+    int fd = -1;
+    ssize_t bytes;
+
+    *out = NULL;
+    ret = open_file(dbname, 0, 0, &fd, error);
+    if (ret)
+	return ret;
+
+    ret = fstat(fd, &st);
+    if (ret == -1) {
+	(void) close(fd);
+	return HEIM_ERROR(error, errno,
+			  (ret, N_("Could not stat JSON DB %s: %s", ""),
+			   dbname, strerror(errno)));
+    }
+
+    if (st.st_size == 0) {
+	(void) close(fd);
+	return 0;
+    }
+
+    str = malloc(st.st_size + 1);
+    if (str == NULL) {
+	 (void) close(fd);
+	return HEIM_ENOMEM(error);
+    }
+
+    bytes = read(fd, str, st.st_size);
+     (void) close(fd);
+    if (bytes != st.st_size) {
+	free(str);
+	if (bytes >= 0)
+	    errno = EINVAL; /* ?? */
+	return HEIM_ERROR(error, errno,
+			  (ret, N_("Could not read JSON DB %s: %s", ""),
+			   dbname, strerror(errno)));
+    }
+    str[st.st_size] = '\0';
+    *out = heim_json_create(str, 10, 0, error);
+    free(str);
+    if (*out == NULL)
+	return (error && *error) ? heim_error_get_code(*error) : EINVAL;
+    return 0;
+}
+
+typedef struct json_db {
+    heim_dict_t dict;
+    heim_string_t dbname;
+    heim_string_t bkpname;
+    int fd;
+    time_t last_read_time;
+    unsigned int read_only:1;
+    unsigned int locked:1;
+    unsigned int locked_needs_unlink:1;
+} *json_db_t;
+
+static int
+json_db_open(void *plug, const char *dbtype, const char *dbname,
+	     heim_dict_t options, void **db, heim_error_t *error)
+{
+    json_db_t jsondb;
+    heim_dict_t contents = NULL;
+    heim_string_t dbname_s = NULL;
+    heim_string_t bkpname_s = NULL;
+
+    if (error)
+	*error = NULL;
+    if (dbtype && *dbtype && strcmp(dbtype, "json"))
+	return HEIM_ERROR(error, EINVAL, (EINVAL, N_("Wrong DB type", "")));
+    if (dbname && *dbname && strcmp(dbname, "MEMORY") != 0) {
+	char *ext = strrchr(dbname, '.');
+	char *bkpname;
+	size_t len;
+	int ret;
+
+	if (ext == NULL || strcmp(ext, ".json") != 0)
+	    return HEIM_ERROR(error, EINVAL,
+			      (EINVAL, N_("JSON DB files must end in .json",
+					  "")));
+
+	if (options) {
+	    heim_object_t vc, ve, vt;
+
+	    vc = heim_dict_get_value(options, HSTR("create"));
+	    ve = heim_dict_get_value(options, HSTR("exclusive"));
+	    vt = heim_dict_get_value(options, HSTR("truncate"));
+	    if (vc && vt) {
+		ret = open_file(dbname, 1, ve ? 1 : 0, NULL, error);
+		if (ret)
+		    return ret;
+	    } else if (vc || ve || vt) {
+		return HEIM_ERROR(error, EINVAL,
+				  (EINVAL, N_("Invalid JSON DB open options",
+					      "")));
+	    }
+	    /*
+	     * We don't want cloned handles to truncate the DB, eh?
+	     *
+	     * We should really just create a copy of the options dict
+	     * rather than modify the caller's!  But for that it'd be
+	     * nicer to have copy utilities in heimbase, something like
+	     * this:
+	     *
+	     * heim_object_t heim_copy(heim_object_t src, int depth,
+	     *                         heim_error_t *error);
+	     * 
+	     * so that options = heim_copy(options, 1); means copy the
+	     * dict but nothing else (whereas depth == 0 would mean
+	     * heim_retain(), and depth > 1 would be copy that many
+	     * levels).
+	     */
+	    heim_dict_delete_key(options, HSTR("create"));
+	    heim_dict_delete_key(options, HSTR("exclusive"));
+	    heim_dict_delete_key(options, HSTR("truncate"));
+	}
+	dbname_s = heim_string_create(dbname);
+	if (dbname_s == NULL)
+	    return HEIM_ENOMEM(error);
+	
+	len = snprintf(NULL, 0, "%s~", dbname);
+	bkpname = malloc(len + 2);
+	if (bkpname == NULL) {
+	    heim_release(dbname_s);
+	    return HEIM_ENOMEM(error);
+	}
+	(void) snprintf(bkpname, len + 1, "%s~", dbname);
+	bkpname_s = heim_string_create(bkpname);
+	free(bkpname);
+	if (bkpname_s == NULL) {
+	    heim_release(dbname_s);
+	    return HEIM_ENOMEM(error);
+	}
+
+	ret = read_json(dbname, (heim_object_t *)&contents, error);
+	if (ret) {
+	    heim_release(bkpname_s);
+	    heim_release(dbname_s);
+	    return ret;
+        }
+
+	if (contents != NULL && heim_get_tid(contents) != HEIM_TID_DICT) {
+	    heim_release(bkpname_s);
+	    heim_release(dbname_s);
+	    return HEIM_ERROR(error, EINVAL,
+			      (EINVAL, N_("JSON DB contents not valid JSON",
+					  "")));
+        }
+    }
+
+    jsondb = heim_alloc(sizeof (*jsondb), "json_db", NULL);
+    if (jsondb == NULL) {
+	heim_release(contents);
+	heim_release(dbname_s);
+	heim_release(bkpname_s);
+	return ENOMEM;
+    }
+
+    jsondb->last_read_time = time(NULL);
+    jsondb->fd = -1;
+    jsondb->dbname = dbname_s;
+    jsondb->bkpname = bkpname_s;
+    jsondb->read_only = 0;
+
+    if (contents != NULL)
+	jsondb->dict = contents;
+    else {
+	jsondb->dict = heim_dict_create(29);
+	if (jsondb->dict == NULL) {
+	    heim_release(jsondb);
+	    return ENOMEM;
+	}
+    }
+
+    *db = jsondb;
+    return 0;
+}
+
+static int
+json_db_close(void *db, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+
+    if (error)
+	*error = NULL;
+    if (jsondb->fd > -1)
+	(void) close(jsondb->fd);
+    jsondb->fd = -1;
+    heim_release(jsondb->dbname);
+    heim_release(jsondb->bkpname);
+    heim_release(jsondb->dict);
+    heim_release(jsondb);
+    return 0;
+}
+
+static int
+json_db_lock(void *db, int read_only, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    int ret;
+
+    heim_assert(jsondb->fd == -1 || (jsondb->read_only && !read_only),
+		"DB locks are not recursive");
+
+    jsondb->read_only = read_only ? 1 : 0;
+    if (jsondb->fd > -1)
+	return 0;
+
+    ret = open_file(heim_string_get_utf8(jsondb->bkpname), 1, 1, &jsondb->fd, error);
+    if (ret == 0) {
+	jsondb->locked_needs_unlink = 1;
+	jsondb->locked = 1;
+    }
+    return ret;
+}
+
+static int
+json_db_unlock(void *db, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    int ret = 0;
+
+    heim_assert(jsondb->locked, "DB not locked when unlock attempted");
+    if (jsondb->fd > -1)
+	ret = close(jsondb->fd);
+    jsondb->fd = -1;
+    jsondb->read_only = 0;
+    jsondb->locked = 0;
+    if (jsondb->locked_needs_unlink)
+	unlink(heim_string_get_utf8(jsondb->bkpname));
+    jsondb->locked_needs_unlink = 0;
+    return ret;
+}
+
+static int
+json_db_sync(void *db, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    size_t len, bytes;
+    heim_error_t e;
+    heim_string_t json;
+    const char *json_text = NULL;
+    int ret = 0;
+    int fd = -1;
+#ifdef WIN32
+    int tries = 3;
+#endif
+
+    heim_assert(jsondb->fd > -1, "DB not locked when sync attempted");
+
+    json = heim_json_copy_serialize(jsondb->dict, 0, &e);
+    if (json == NULL) {
+	if (error)
+	    *error = e;
+	else
+	    heim_release(e);
+	return heim_error_get_code(e);
+    }
+
+    json_text = heim_string_get_utf8(json);
+    len = strlen(json_text);
+    errno = 0;
+
+#ifdef WIN32
+    while (tries--) {
+	ret = open_file(heim_string_get_utf8(jsondb->dbname), 1, 0, &fd, error);
+	if (ret == 0)
+	    break;
+	sleep(1);
+    }
+    if (ret) {
+	heim_release(json);
+	return ret;
+    }
+#else
+    fd = jsondb->fd;
+#endif /* WIN32 */
+
+    bytes = write(fd, json_text, len);
+    heim_release(json);
+    if (bytes != len)
+	return errno ? errno : EIO;
+    ret = fsync(fd);
+    if (ret)
+	return ret;
+
+#ifdef WIN32
+    ret = close(fd);
+    if (ret)
+	return GetLastError();
+#else
+    ret = rename(heim_string_get_utf8(jsondb->bkpname), heim_string_get_utf8(jsondb->dbname));
+    if (ret == 0) {
+	jsondb->locked_needs_unlink = 0;
+	return 0;
+    }
+#endif /* WIN32 */
+
+    return errno;
+}
+
+static heim_data_t
+json_db_copy_value(void *db, heim_string_t table, heim_data_t key,
+		  heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    heim_string_t key_string;
+    const heim_octet_string *key_data = heim_data_get_data(key);
+    struct stat st;
+    heim_data_t result;
+
+    if (error)
+	*error = NULL;
+
+    if (strnlen(key_data->data, key_data->length) != key_data->length) {
+	HEIM_ERROR(error, EINVAL,
+		   (EINVAL, N_("JSON DB requires keys that are actually "
+			       "strings", "")));
+	return NULL;
+    }
+
+    if (stat(heim_string_get_utf8(jsondb->dbname), &st) == -1) {
+	HEIM_ERROR(error, errno,
+		   (errno, N_("Could not stat JSON DB file", "")));
+	return NULL;
+    }
+
+    if (st.st_mtime > jsondb->last_read_time ||
+	st.st_ctime > jsondb->last_read_time) {
+	heim_dict_t contents = NULL;
+	int ret;
+
+	/* Ignore file is gone (ENOENT) */
+	ret = read_json(heim_string_get_utf8(jsondb->dbname),
+		(heim_object_t *)&contents, error);
+	if (ret)
+	    return NULL;
+	if (contents == NULL)
+	    contents = heim_dict_create(29);
+	heim_release(jsondb->dict);
+	jsondb->dict = contents;
+	jsondb->last_read_time = time(NULL);
+    }
+
+    key_string = heim_string_create_with_bytes(key_data->data,
+					       key_data->length);
+    if (key_string == NULL) {
+	(void) HEIM_ENOMEM(error);
+	return NULL;
+    }
+
+    result = heim_path_copy(jsondb->dict, error, table, key_string, NULL);
+    heim_release(key_string);
+    return result;
+}
+
+static int
+json_db_set_value(void *db, heim_string_t table,
+		  heim_data_t key, heim_data_t value, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    heim_string_t key_string;
+    const heim_octet_string *key_data = heim_data_get_data(key);
+    int ret;
+
+    if (error)
+	*error = NULL;
+
+    if (strnlen(key_data->data, key_data->length) != key_data->length)
+	return HEIM_ERROR(error, EINVAL,
+			  (EINVAL,
+			   N_("JSON DB requires keys that are actually strings",
+			      "")));
+
+    key_string = heim_string_create_with_bytes(key_data->data,
+					       key_data->length);
+    if (key_string == NULL)
+	return HEIM_ENOMEM(error);
+
+    if (table == NULL)
+	table = HSTR("");
+
+    ret = heim_path_create(jsondb->dict, 29, value, error, table, key_string, NULL);
+    heim_release(key_string);
+    return ret;
+}
+
+static int
+json_db_del_key(void *db, heim_string_t table, heim_data_t key,
+		heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    heim_string_t key_string;
+    const heim_octet_string *key_data = heim_data_get_data(key);
+
+    if (error)
+	*error = NULL;
+
+    if (strnlen(key_data->data, key_data->length) != key_data->length)
+	return HEIM_ERROR(error, EINVAL,
+			  (EINVAL,
+			   N_("JSON DB requires keys that are actually strings",
+			      "")));
+
+    key_string = heim_string_create_with_bytes(key_data->data,
+					       key_data->length);
+    if (key_string == NULL)
+	return HEIM_ENOMEM(error);
+
+    if (table == NULL)
+	table = HSTR("");
+
+    heim_path_delete(jsondb->dict, error, table, key_string, NULL);
+    heim_release(key_string);
+    return 0;
+}
+
+struct json_db_iter_ctx {
+    heim_db_iterator_f_t        iter_f;
+    void                        *iter_ctx;
+};
+
+static void json_db_iter_f(heim_object_t key, heim_object_t value, void *arg)
+{
+    struct json_db_iter_ctx *ctx = arg;
+    const char *key_string;
+    heim_data_t key_data;
+
+    key_string = heim_string_get_utf8((heim_string_t)key);
+    key_data = heim_data_ref_create(key_string, strlen(key_string), NULL);
+    ctx->iter_f(key_data, (heim_object_t)value, ctx->iter_ctx);
+    heim_release(key_data);
+}
+
+static void
+json_db_iter(void *db, heim_string_t table, void *iter_data,
+	     heim_db_iterator_f_t iter_f, heim_error_t *error)
+{
+    json_db_t jsondb = db;
+    struct json_db_iter_ctx ctx;
+    heim_dict_t table_dict;
+
+    if (error)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    table_dict = heim_dict_get_value(jsondb->dict, table);
+    if (table_dict == NULL)
+	return;
+
+    ctx.iter_ctx = iter_data;
+    ctx.iter_f = iter_f;
+
+    heim_dict_iterate_f(table_dict, &ctx, json_db_iter_f);
+}
+
+static struct heim_db_type json_dbt = {
+    1, json_db_open, NULL, json_db_close,
+    json_db_lock, json_db_unlock, json_db_sync,
+    NULL, NULL, NULL,
+    json_db_copy_value, json_db_set_value,
+    json_db_del_key, json_db_iter
+};
+
diff --git a/crypto/external/bsd/heimdal/dist/base/dict.c b/crypto/external/bsd/heimdal/dist/lib/base/dict.c
similarity index 90%
rename from crypto/external/bsd/heimdal/dist/base/dict.c
rename to crypto/external/bsd/heimdal/dist/lib/base/dict.c
index d4c3c0695..e150905e1 100644
--- a/crypto/external/bsd/heimdal/dist/base/dict.c
+++ b/crypto/external/bsd/heimdal/dist/lib/base/dict.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dict.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $	*/
+/*	$NetBSD: dict.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2002, 1997 Kungliga Tekniska Högskolan
@@ -73,6 +73,7 @@ struct heim_type_data dict_object = {
     dict_dealloc,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
@@ -160,6 +161,26 @@ _search(heim_dict_t dict, heim_object_t ptr)
     return NULL;
 }
 
+/**
+ * Search for element in hash table
+ *
+ * @value dict the dict to search in
+ * @value key the key to search for
+ *
+ * @return a not-retained copy of the value for key or NULL if not found
+ */
+
+heim_object_t
+heim_dict_get_value(heim_dict_t dict, heim_object_t key)
+{
+    struct hashentry *p;
+    p = _search(dict, key);
+    if (p == NULL)
+	return NULL;
+
+    return p->value;
+}
+
 /**
  * Search for element in hash table
  *
@@ -191,7 +212,7 @@ heim_dict_copy_value(heim_dict_t dict, heim_object_t key)
  */
 
 int
-heim_dict_add_value(heim_dict_t dict, heim_object_t key, heim_object_t value)
+heim_dict_set_value(heim_dict_t dict, heim_object_t key, heim_object_t value)
 {
     struct hashentry **tabptr, *h;
 
@@ -255,7 +276,7 @@ heim_dict_delete_key(heim_dict_t dict, heim_object_t key)
  */
 
 void
-heim_dict_iterate_f(heim_dict_t dict, heim_dict_iterator_f_t func, void *arg)
+heim_dict_iterate_f(heim_dict_t dict, void *arg, heim_dict_iterator_f_t func)
 {
     struct hashentry **h, *g;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/dll.c b/crypto/external/bsd/heimdal/dist/lib/base/dll.c
new file mode 100644
index 000000000..aa7045e1d
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/dll.c
@@ -0,0 +1,326 @@
+/*	$NetBSD: dll.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/***********************************************************************
+ * Copyright (c) 2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ **********************************************************************/
+
+/*
+ * This is an implementation of thread-specific storage with
+ * destructors.  WIN32 doesn't quite have this.  Instead it has
+ * DllMain(), an entry point in every DLL that gets called to notify the
+ * DLL of thread/process "attach"/"detach" events.
+ *
+ * We use __thread (or __declspec(thread)) for the thread-local itself
+ * and DllMain() DLL_THREAD_DETACH events to drive destruction of
+ * thread-local values.
+ *
+ * When building in maintainer mode on non-Windows pthread systems this
+ * uses a single pthread key instead to implement multiple keys.  This
+ * keeps the code from rotting when modified by non-Windows developers.
+ */
+
+#include "baselocl.h"
+
+#ifdef WIN32
+#include <windows.h>
+#endif
+
+#ifdef HEIM_WIN32_TLS
+#include <assert.h>
+#include <err.h>
+#include <heim_threads.h>
+
+#ifndef WIN32
+#include <pthread.h>
+#endif
+
+/* Logical array of keys that grows lock-lessly */
+typedef struct tls_keys tls_keys;
+struct tls_keys {
+    void (**keys_dtors)(void *);    /* array of destructors         */
+    size_t keys_start_idx;          /* index of first destructor    */
+    size_t keys_num;
+    tls_keys *keys_next;
+};
+
+/*
+ * Well, not quite locklessly.  We need synchronization primitives to do
+ * this locklessly.  An atomic CAS will do.
+ */
+static HEIMDAL_MUTEX tls_key_defs_lock = HEIMDAL_MUTEX_INITIALIZER;
+static tls_keys *tls_key_defs;
+
+/* Logical array of values (per-thread; no locking needed here) */
+struct tls_values {
+    void **values; /* realloc()ed */
+    size_t values_num;
+};
+
+static HEIMDAL_THREAD_LOCAL struct tls_values values;
+
+#define DEAD_KEY ((void *)8)
+
+void
+heim_w32_service_thread_detach(void *unused)
+{
+    tls_keys *key_defs;
+    void (*dtor)(void*);
+    size_t i;
+
+    HEIMDAL_MUTEX_lock(&tls_key_defs_lock);
+    key_defs = tls_key_defs;
+    HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+
+    if (key_defs == NULL)
+        return;
+
+    for (i = 0; i < values.values_num; i++) {
+        assert(i >= key_defs->keys_start_idx);
+        if (i >= key_defs->keys_start_idx + key_defs->keys_num) {
+            HEIMDAL_MUTEX_lock(&tls_key_defs_lock);
+            key_defs = key_defs->keys_next;
+            HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+
+            assert(key_defs != NULL);
+            assert(i >= key_defs->keys_start_idx);
+            assert(i < key_defs->keys_start_idx + key_defs->keys_num);
+        }
+        dtor = key_defs->keys_dtors[i - key_defs->keys_start_idx];
+        if (values.values[i] != NULL && dtor != NULL && dtor != DEAD_KEY)
+            dtor(values.values[i]);
+        values.values[i] = NULL;
+    }
+}
+
+#if !defined(WIN32)
+static pthread_key_t pt_key;
+pthread_once_t pt_once = PTHREAD_ONCE_INIT;
+
+static void
+atexit_del_tls_for_thread(void)
+{
+    heim_w32_service_thread_detach(NULL);
+}
+
+static void
+create_pt_key(void)
+{
+    int ret;
+
+    /* The main thread may not execute TLS destructors */
+    atexit(atexit_del_tls_for_thread);
+    ret = pthread_key_create(&pt_key, heim_w32_service_thread_detach);
+    if (ret != 0)
+        err(1, "pthread_key_create() failed");
+}
+
+#endif
+
+int
+heim_w32_key_create(HEIM_PRIV_thread_key *key, void (*dtor)(void *))
+{
+    tls_keys *key_defs, *new_key_defs;
+    size_t i, k;
+    int ret = ENOMEM;
+
+#if !defined(WIN32)
+    (void) pthread_once(&pt_once, create_pt_key);
+    (void) pthread_setspecific(pt_key, DEAD_KEY);
+#endif
+
+    HEIMDAL_MUTEX_lock(&tls_key_defs_lock);
+    if (tls_key_defs == NULL) {
+        /* First key */
+        new_key_defs = calloc(1, sizeof(*new_key_defs));
+        if (new_key_defs == NULL) {
+            HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+            return ENOMEM;
+        }
+        new_key_defs->keys_num = 8;
+        new_key_defs->keys_dtors = calloc(new_key_defs->keys_num,
+                                          sizeof(*new_key_defs->keys_dtors));
+        if (new_key_defs->keys_dtors == NULL) {
+            HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+            free(new_key_defs);
+            return ENOMEM;
+        }
+        tls_key_defs = new_key_defs;
+        new_key_defs->keys_dtors[0] = dtor;
+        for (i = 1; i < new_key_defs->keys_num; i++)
+            new_key_defs->keys_dtors[i] = NULL;
+        HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+        return 0;
+    }
+
+    for (key_defs = tls_key_defs;
+         key_defs != NULL;
+         key_defs = key_defs->keys_next) {
+        k = key_defs->keys_start_idx;
+        for (i = 0; i < key_defs->keys_num; i++, k++) {
+            if (key_defs->keys_dtors[i] == NULL) {
+                /* Found free slot; use it */
+                key_defs->keys_dtors[i] = dtor;
+                *key = k;
+                HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+                return 0;
+            }
+        }
+        if (key_defs->keys_next != NULL)
+            continue;
+
+        /* Grow the registration array */
+        /* XXX DRY */
+        new_key_defs = calloc(1, sizeof(*new_key_defs));
+        if (new_key_defs == NULL)
+            break;
+
+        new_key_defs->keys_dtors =
+            calloc(key_defs->keys_num + key_defs->keys_num / 2,
+                   sizeof(*new_key_defs->keys_dtors));
+        if (new_key_defs->keys_dtors == NULL) {
+            free(new_key_defs);
+            break;
+        }
+        new_key_defs->keys_start_idx = key_defs->keys_start_idx +
+            key_defs->keys_num;
+        new_key_defs->keys_num = key_defs->keys_num + key_defs->keys_num / 2;
+        new_key_defs->keys_dtors[i] = dtor;
+        for (i = 1; i < new_key_defs->keys_num; i++)
+            new_key_defs->keys_dtors[i] = NULL;
+        key_defs->keys_next = new_key_defs;
+        ret = 0;
+        break;
+    }
+    HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+    return ret;
+}
+
+static void
+key_lookup(HEIM_PRIV_thread_key key, tls_keys **kd,
+           size_t *dtor_idx, void (**dtor)(void *))
+{
+    tls_keys *key_defs;
+
+    if (kd != NULL)
+        *kd = NULL;
+    if (dtor_idx != NULL)
+        *dtor_idx = 0;
+    if (dtor != NULL)
+        *dtor = NULL;
+
+    HEIMDAL_MUTEX_lock(&tls_key_defs_lock);
+    key_defs = tls_key_defs;
+    HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+
+    while (key_defs != NULL) {
+        if (key >= key_defs->keys_start_idx &&
+            key < key_defs->keys_start_idx + key_defs->keys_num) {
+            if (kd != NULL)
+                *kd = key_defs;
+            if (dtor_idx != NULL)
+                *dtor_idx = key - key_defs->keys_start_idx;
+            if (dtor != NULL)
+                *dtor = key_defs->keys_dtors[key - key_defs->keys_start_idx];
+            return;
+        }
+
+        HEIMDAL_MUTEX_lock(&tls_key_defs_lock);
+        key_defs = key_defs->keys_next;
+        HEIMDAL_MUTEX_unlock(&tls_key_defs_lock);
+        assert(key_defs != NULL);
+        assert(key >= key_defs->keys_start_idx);
+    }
+}
+
+int
+heim_w32_delete_key(HEIM_PRIV_thread_key key)
+{
+    tls_keys *key_defs;
+    size_t dtor_idx;
+
+    key_lookup(key, &key_defs, &dtor_idx, NULL);
+    if (key_defs == NULL)
+        return EINVAL;
+    key_defs->keys_dtors[dtor_idx] = DEAD_KEY;
+    return 0;
+}
+
+int
+heim_w32_setspecific(HEIM_PRIV_thread_key key, void *value)
+{
+    void **new_values;
+    size_t new_num;
+    void (*dtor)(void *);
+    size_t i;
+
+#if !defined(WIN32)
+    (void) pthread_setspecific(pt_key, DEAD_KEY);
+#endif
+
+    key_lookup(key, NULL, NULL, &dtor);
+    if (dtor == NULL)
+        return EINVAL;
+
+    if (key >= values.values_num) {
+        if (values.values_num == 0) {
+            values.values = NULL;
+            new_num = 8;
+        } else {
+            new_num = (values.values_num + values.values_num / 2);
+        }
+        new_values = realloc(values.values, sizeof(void *) * new_num);
+        if (new_values == NULL)
+            return ENOMEM;
+        for (i = values.values_num; i < new_num; i++)
+            new_values[i] = NULL;
+        values.values = new_values;
+        values.values_num = new_num;
+    }
+
+    assert(key < values.values_num);
+
+    if (values.values[key] != NULL && dtor != NULL && dtor != DEAD_KEY)
+        dtor(values.values[key]);
+
+    values.values[key] = value;
+    return 0;
+}
+
+void *
+heim_w32_getspecific(HEIM_PRIV_thread_key key)
+{
+    if (key >= values.values_num)
+        return NULL;
+    return values.values[key];
+}
+
+#else
+static char dummy;
+#endif /* HEIM_WIN32_TLS */
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/error.c b/crypto/external/bsd/heimdal/dist/lib/base/error.c
new file mode 100644
index 000000000..1064fbf7a
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/error.c
@@ -0,0 +1,180 @@
+/*	$NetBSD: error.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+
+struct heim_error {
+    int error_code;
+    heim_string_t msg;
+    struct heim_error *next;
+};
+
+static void
+error_dealloc(void *ptr)
+{
+    struct heim_error *p = ptr;
+    heim_release(p->msg);
+    heim_release(p->next);
+}
+
+static int
+error_cmp(void *a, void *b)
+{
+    struct heim_error *ap = a, *bp = b;
+    if (ap->error_code == ap->error_code)
+	return ap->error_code - ap->error_code;
+    return heim_cmp(ap->msg, bp->msg);
+}
+
+static unsigned long
+error_hash(void *ptr)
+{
+    struct heim_error *p = ptr;
+    return p->error_code;
+}
+
+struct heim_type_data _heim_error_object = {
+    HEIM_TID_ERROR,
+    "error-object",
+    NULL,
+    error_dealloc,
+    NULL,
+    error_cmp,
+    error_hash,
+    NULL
+};
+
+heim_error_t
+heim_error_create_enomem(void)
+{
+    /* This is an immediate object; see heim_number_create() */
+    return (heim_error_t)heim_number_create(ENOMEM);
+}
+
+
+void
+heim_error_create_opt(heim_error_t *error, int error_code, const char *fmt, ...)
+{
+    if (error) {
+	va_list ap;
+	va_start(ap, fmt);
+	*error = heim_error_createv(error_code, fmt, ap);
+	va_end(ap);
+    }
+}
+
+heim_error_t
+heim_error_create(int error_code, const char *fmt, ...)
+{
+    heim_error_t e;
+    va_list ap;
+
+    va_start(ap, fmt);
+    e = heim_error_createv(error_code, fmt, ap);
+    va_end(ap);
+
+    return e;
+}
+
+heim_error_t
+heim_error_createv(int error_code, const char *fmt, va_list ap)
+{
+    heim_error_t e;
+    char *str;
+    int len;
+    int save_errno = errno;
+
+    str = malloc(1024);
+    errno = save_errno;
+    if (str == NULL)
+        return heim_error_create_enomem();
+    len = vsnprintf(str, 1024, fmt, ap);
+    errno = save_errno;
+    if (len < 0) {
+        free(str);
+	return NULL; /* XXX We should have a special heim_error_t for this */
+    }
+
+    e = _heim_alloc_object(&_heim_error_object, sizeof(struct heim_error));
+    if (e) {
+	e->msg = heim_string_create(str);
+	e->error_code = error_code;
+    }
+    free(str);
+
+    errno = save_errno;
+    return e;
+}
+
+heim_string_t
+heim_error_copy_string(heim_error_t error)
+{
+    if (heim_get_tid(error) != HEIM_TID_ERROR) {
+	if (heim_get_tid(error) == heim_number_get_type_id())
+	    return __heim_string_constant(strerror(heim_number_get_int((heim_number_t)error)));
+	heim_abort("invalid heim_error_t");
+    }
+    /* XXX concat all strings */
+    return heim_retain(error->msg);
+}
+
+int
+heim_error_get_code(heim_error_t error)
+{
+    if (error == NULL)
+	return -1;
+    if (heim_get_tid(error) != HEIM_TID_ERROR) {
+	if (heim_get_tid(error) == heim_number_get_type_id())
+	    return heim_number_get_int((heim_number_t)error);
+	heim_abort("invalid heim_error_t");
+    }
+    return error->error_code;
+}
+
+heim_error_t
+heim_error_append(heim_error_t top, heim_error_t append)
+{
+    if (heim_get_tid(top) != HEIM_TID_ERROR) {
+	if (heim_get_tid(top) == heim_number_get_type_id())
+	    return top;
+	heim_abort("invalid heim_error_t");
+    }
+    if (top->next)
+	heim_release(top->next);
+    top->next = heim_retain(append);
+    return top;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/heimbase.c b/crypto/external/bsd/heimdal/dist/lib/base/heimbase.c
new file mode 100644
index 000000000..e8798e54c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/heimbase.c
@@ -0,0 +1,1081 @@
+/*	$NetBSD: heimbase.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+#include <syslog.h>
+
+static heim_base_atomic_type tidglobal = HEIM_TID_USER;
+
+struct heim_base {
+    heim_type_t isa;
+    heim_base_atomic_type ref_cnt;
+    HEIM_TAILQ_ENTRY(heim_base) autorel;
+    heim_auto_release_t autorelpool;
+    uintptr_t isaextra[3];
+};
+
+/* specialized version of base */
+struct heim_base_mem {
+    heim_type_t isa;
+    heim_base_atomic_type ref_cnt;
+    HEIM_TAILQ_ENTRY(heim_base) autorel;
+    heim_auto_release_t autorelpool;
+    const char *name;
+    void (*dealloc)(void *);
+    uintptr_t isaextra[1];
+};
+
+#define PTR2BASE(ptr) (((struct heim_base *)ptr) - 1)
+#define BASE2PTR(ptr) ((void *)(((struct heim_base *)ptr) + 1))
+
+#ifdef HEIM_BASE_NEED_ATOMIC_MUTEX
+HEIMDAL_MUTEX _heim_base_mutex = HEIMDAL_MUTEX_INITIALIZER;
+#endif
+
+/*
+ * Auto release structure
+ */
+
+struct heim_auto_release {
+    HEIM_TAILQ_HEAD(, heim_base) pool;
+    HEIMDAL_MUTEX pool_mutex;
+    struct heim_auto_release *parent;
+};
+
+
+/**
+ * Retain object (i.e., take a reference)
+ *
+ * @param object to be released, NULL is ok
+ *
+ * @return the same object as passed in
+ */
+
+void *
+heim_retain(void *ptr)
+{
+    struct heim_base *p = PTR2BASE(ptr);
+
+    if (ptr == NULL || heim_base_is_tagged(ptr))
+	return ptr;
+
+    if (p->ref_cnt == heim_base_atomic_max)
+	return ptr;
+
+    if ((heim_base_atomic_inc(&p->ref_cnt) - 1) == 0)
+	heim_abort("resurection");
+    return ptr;
+}
+
+/**
+ * Release object, free if reference count reaches zero
+ *
+ * @param object to be released
+ */
+
+void
+heim_release(void *ptr)
+{
+    heim_base_atomic_type old;
+    struct heim_base *p = PTR2BASE(ptr);
+
+    if (ptr == NULL || heim_base_is_tagged(ptr))
+	return;
+
+    if (p->ref_cnt == heim_base_atomic_max)
+	return;
+
+    old = heim_base_atomic_dec(&p->ref_cnt) + 1;
+
+    if (old > 1)
+	return;
+
+    if (old == 1) {
+	heim_auto_release_t ar = p->autorelpool;
+	/* remove from autorel pool list */
+	if (ar) {
+	    p->autorelpool = NULL;
+	    HEIMDAL_MUTEX_lock(&ar->pool_mutex);
+	    HEIM_TAILQ_REMOVE(&ar->pool, p, autorel);
+	    HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
+	}
+	if (p->isa->dealloc)
+	    p->isa->dealloc(ptr);
+	free(p);
+    } else
+	heim_abort("over release");
+}
+
+/**
+ * If used require wrapped in autorelease pool
+ */
+
+heim_string_t
+heim_description(heim_object_t ptr)
+{
+    struct heim_base *p = PTR2BASE(ptr);
+    if (p->isa->desc == NULL)
+	return heim_auto_release(heim_string_ref_create(p->isa->name, NULL));
+    return heim_auto_release(p->isa->desc(ptr));
+}
+
+
+void
+_heim_make_permanent(heim_object_t ptr)
+{
+    struct heim_base *p = PTR2BASE(ptr);
+    p->ref_cnt = heim_base_atomic_max;
+}
+
+
+static heim_type_t tagged_isa[9] = {
+    &_heim_number_object,
+    &_heim_null_object,
+    &_heim_bool_object,
+
+    NULL,
+    NULL,
+    NULL,
+
+    NULL,
+    NULL,
+    NULL
+};
+
+heim_type_t
+_heim_get_isa(heim_object_t ptr)
+{
+    struct heim_base *p;
+    if (heim_base_is_tagged(ptr)) {
+	if (heim_base_is_tagged_object(ptr))
+	    return tagged_isa[heim_base_tagged_object_tid(ptr)];
+	heim_abort("not a supported tagged type");
+    }
+    p = PTR2BASE(ptr);
+    return p->isa;
+}
+
+/**
+ * Get type ID of object
+ *
+ * @param object object to get type id of
+ *
+ * @return type id of object
+ */
+
+heim_tid_t
+heim_get_tid(heim_object_t ptr)
+{
+    heim_type_t isa = _heim_get_isa(ptr);
+    return isa->tid;
+}
+
+/**
+ * Get hash value of object
+ *
+ * @param object object to get hash value for
+ *
+ * @return a hash value
+ */
+
+unsigned long
+heim_get_hash(heim_object_t ptr)
+{
+    heim_type_t isa = _heim_get_isa(ptr);
+    if (isa->hash)
+	return isa->hash(ptr);
+    return (unsigned long)ptr;
+}
+
+/**
+ * Compare two objects, returns 0 if equal, can use used for qsort()
+ * and friends.
+ *
+ * @param a first object to compare
+ * @param b first object to compare
+ *
+ * @return 0 if objects are equal
+ */
+
+int
+heim_cmp(heim_object_t a, heim_object_t b)
+{
+    heim_tid_t ta, tb;
+    heim_type_t isa;
+
+    ta = heim_get_tid(a);
+    tb = heim_get_tid(b);
+
+    if (ta != tb)
+	return ta - tb;
+
+    isa = _heim_get_isa(a);
+
+    if (isa->cmp)
+	return isa->cmp(a, b);
+
+    return (uintptr_t)a - (uintptr_t)b;
+}
+
+/*
+ * Private - allocates an memory object
+ */
+
+static void
+memory_dealloc(void *ptr)
+{
+    struct heim_base_mem *p = (struct heim_base_mem *)PTR2BASE(ptr);
+    if (p->dealloc)
+	p->dealloc(ptr);
+}
+
+struct heim_type_data memory_object = {
+    HEIM_TID_MEMORY,
+    "memory-object",
+    NULL,
+    memory_dealloc,
+    NULL,
+    NULL,
+    NULL,
+    NULL
+};
+
+/**
+ * Allocate memory for an object of anonymous type
+ *
+ * @param size size of object to be allocated
+ * @param name name of ad-hoc type
+ * @param dealloc destructor function
+ *
+ * Objects allocated with this interface do not serialize.
+ *
+ * @return allocated object
+ */
+
+void *
+heim_alloc(size_t size, const char *name, heim_type_dealloc dealloc)
+{
+    /* XXX use posix_memalign */
+
+    struct heim_base_mem *p = calloc(1, size + sizeof(*p));
+    if (p == NULL)
+	return NULL;
+    p->isa = &memory_object;
+    p->ref_cnt = 1;
+    p->name = name;
+    p->dealloc = dealloc;
+    return BASE2PTR(p);
+}
+
+heim_type_t
+_heim_create_type(const char *name,
+		  heim_type_init init,
+		  heim_type_dealloc dealloc,
+		  heim_type_copy copy,
+		  heim_type_cmp cmp,
+		  heim_type_hash hash,
+		  heim_type_description desc)
+{
+    heim_type_t type;
+
+    type = calloc(1, sizeof(*type));
+    if (type == NULL)
+	return NULL;
+
+    type->tid = heim_base_atomic_inc(&tidglobal);
+    type->name = name;
+    type->init = init;
+    type->dealloc = dealloc;
+    type->copy = copy;
+    type->cmp = cmp;
+    type->hash = hash;
+    type->desc = desc;
+
+    return type;
+}
+
+heim_object_t
+_heim_alloc_object(heim_type_t type, size_t size)
+{
+    /* XXX should use posix_memalign */
+    struct heim_base *p = calloc(1, size + sizeof(*p));
+    if (p == NULL)
+	return NULL;
+    p->isa = type;
+    p->ref_cnt = 1;
+
+    return BASE2PTR(p);
+}
+
+void *
+_heim_get_isaextra(heim_object_t ptr, size_t idx)
+{
+    struct heim_base *p = (struct heim_base *)PTR2BASE(ptr);
+
+    heim_assert(ptr != NULL, "internal error");
+    if (p->isa == &memory_object)
+	return NULL;
+    heim_assert(idx < 3, "invalid private heim_base extra data index");
+    return &p->isaextra[idx];
+}
+
+heim_tid_t
+_heim_type_get_tid(heim_type_t type)
+{
+    return type->tid;
+}
+
+#if !defined(WIN32) && !defined(HAVE_DISPATCH_DISPATCH_H) && defined(ENABLE_PTHREAD_SUPPORT)
+static pthread_once_t once_arg_key_once = PTHREAD_ONCE_INIT;
+static pthread_key_t once_arg_key;
+
+static void
+once_arg_key_once_init(void)
+{
+    errno = pthread_key_create(&once_arg_key, NULL);
+    if (errno != 0) {
+        fprintf(stderr,
+                "Error: pthread_key_create() failed, cannot continue: %s\n",
+                strerror(errno));
+        abort();
+    }
+}
+
+struct once_callback {
+    void (*fn)(void *);
+    void *data;
+};
+
+static void
+once_callback_caller(void)
+{
+    struct once_callback *once_callback = pthread_getspecific(once_arg_key);
+
+    if (once_callback == NULL) {
+        fprintf(stderr, "Error: pthread_once() calls callback on "
+                "different thread?!  Cannot continue.\n");
+        abort();
+    }
+    once_callback->fn(once_callback->data);
+}
+#endif
+
+/**
+ * Call func once and only once
+ *
+ * @param once pointer to a heim_base_once_t
+ * @param ctx context passed to func
+ * @param func function to be called
+ */
+
+void
+heim_base_once_f(heim_base_once_t *once, void *ctx, void (*func)(void *))
+{
+#if defined(WIN32)
+    /*
+     * With a libroken wrapper for some CAS function and a libroken yield()
+     * wrapper we could make this the default implementation when we have
+     * neither Grand Central nor POSX threads.
+     *
+     * We could also adapt the double-checked lock pattern with CAS
+     * providing the necessary memory barriers in the absence of
+     * portable explicit memory barrier APIs.
+     */
+    /*
+     * We use CAS operations in large part to provide implied memory
+     * barriers.
+     *
+     * State 0 means that func() has never executed.
+     * State 1 means that func() is executing.
+     * State 2 means that func() has completed execution.
+     */
+    if (InterlockedCompareExchange(once, 1L, 0L) == 0L) {
+	/* State is now 1 */
+	(*func)(ctx);
+	(void)InterlockedExchange(once, 2L);
+	/* State is now 2 */
+    } else {
+	/*
+	 * The InterlockedCompareExchange is being used to fetch
+	 * the current state under a full memory barrier.  As long
+	 * as the current state is 1 continue to spin.
+	 */
+	while (InterlockedCompareExchange(once, 2L, 0L) == 1L)
+	    SwitchToThread();
+    }
+#elif defined(HAVE_DISPATCH_DISPATCH_H)
+    dispatch_once_f(once, ctx, func);
+#elif defined(ENABLE_PTHREAD_SUPPORT)
+    struct once_callback once_callback;
+
+    once_callback.fn = func;
+    once_callback.data = ctx;
+
+    errno = pthread_once(&once_arg_key_once, once_arg_key_once_init);
+    if (errno != 0) {
+        fprintf(stderr, "Error: pthread_once() failed, cannot continue: %s\n",
+                strerror(errno));
+        abort();
+    }
+    errno = pthread_setspecific(once_arg_key, &once_callback);
+    if (errno != 0) {
+        fprintf(stderr,
+                "Error: pthread_setspecific() failed, cannot continue: %s\n",
+                strerror(errno));
+        abort();
+    }
+    errno = pthread_once(once, once_callback_caller);
+    if (errno != 0) {
+        fprintf(stderr, "Error: pthread_once() failed, cannot continue: %s\n",
+                strerror(errno));
+        abort();
+    }
+#else
+    static HEIMDAL_MUTEX mutex = HEIMDAL_MUTEX_INITIALIZER;
+    HEIMDAL_MUTEX_lock(&mutex);
+    if (*once == 0) {
+	*once = 1;
+	HEIMDAL_MUTEX_unlock(&mutex);
+	func(ctx);
+	HEIMDAL_MUTEX_lock(&mutex);
+	*once = 2;
+	HEIMDAL_MUTEX_unlock(&mutex);
+    } else if (*once == 2) {
+	HEIMDAL_MUTEX_unlock(&mutex);
+    } else {
+	HEIMDAL_MUTEX_unlock(&mutex);
+	while (1) {
+	    struct timeval tv = { 0, 1000 };
+	    select(0, NULL, NULL, NULL, &tv);
+	    HEIMDAL_MUTEX_lock(&mutex);
+	    if (*once == 2)
+		break;
+	    HEIMDAL_MUTEX_unlock(&mutex);
+	}
+	HEIMDAL_MUTEX_unlock(&mutex);
+    }
+#endif
+}
+
+/**
+ * Abort and log the failure (using syslog)
+ */
+
+void
+heim_abort(const char *fmt, ...)
+{
+    va_list ap;
+    va_start(ap, fmt);
+    heim_abortv(fmt, ap);
+    va_end(ap);
+}
+
+/**
+ * Abort and log the failure (using syslog)
+ */
+
+void
+heim_abortv(const char *fmt, va_list ap)
+{
+    static char str[1024];
+
+    vsnprintf(str, sizeof(str), fmt, ap);
+    syslog(LOG_ERR, "heim_abort: %s", str);
+    abort();
+}
+
+/*
+ *
+ */
+
+static int ar_created = 0;
+static HEIMDAL_thread_key ar_key;
+
+struct ar_tls {
+    struct heim_auto_release *head;
+    struct heim_auto_release *current;
+    HEIMDAL_MUTEX tls_mutex;
+};
+
+static void
+ar_tls_delete(void *ptr)
+{
+    struct ar_tls *tls = ptr;
+    heim_auto_release_t next = NULL;
+
+    if (tls == NULL)
+        return;
+    for (; tls->current != NULL; tls->current = next) {
+        next = tls->current->parent;
+        heim_release(tls->current);
+    }
+    free(tls);
+}
+
+static void
+init_ar_tls(void *ptr)
+{
+    int ret;
+    HEIMDAL_key_create(&ar_key, ar_tls_delete, ret);
+    if (ret == 0)
+	ar_created = 1;
+}
+
+static struct ar_tls *
+autorel_tls(void)
+{
+    static heim_base_once_t once = HEIM_BASE_ONCE_INIT;
+    struct ar_tls *arp;
+    int ret;
+
+    heim_base_once_f(&once, NULL, init_ar_tls);
+    if (!ar_created)
+	return NULL;
+
+    arp = HEIMDAL_getspecific(ar_key);
+    if (arp == NULL) {
+
+	arp = calloc(1, sizeof(*arp));
+	if (arp == NULL)
+	    return NULL;
+	HEIMDAL_setspecific(ar_key, arp, ret);
+	if (ret) {
+	    free(arp);
+	    return NULL;
+	}
+    }
+    return arp;
+
+}
+
+static void
+autorel_dealloc(void *ptr)
+{
+    heim_auto_release_t ar = ptr;
+    struct ar_tls *tls;
+
+    tls = autorel_tls();
+    if (tls == NULL)
+	heim_abort("autorelease pool released on thread w/o autorelease inited");
+
+    heim_auto_release_drain(ar);
+
+    if (!HEIM_TAILQ_EMPTY(&ar->pool))
+	heim_abort("pool not empty after draining");
+
+    HEIMDAL_MUTEX_lock(&tls->tls_mutex);
+    if (tls->current != ptr)
+	heim_abort("autorelease not releaseing top pool");
+
+    tls->current = ar->parent;
+    HEIMDAL_MUTEX_unlock(&tls->tls_mutex);
+}
+
+static int
+autorel_cmp(void *a, void *b)
+{
+    return (a == b);
+}
+
+static unsigned long
+autorel_hash(void *ptr)
+{
+    return (unsigned long)ptr;
+}
+
+
+static struct heim_type_data _heim_autorel_object = {
+    HEIM_TID_AUTORELEASE,
+    "autorelease-pool",
+    NULL,
+    autorel_dealloc,
+    NULL,
+    autorel_cmp,
+    autorel_hash,
+    NULL
+};
+
+/**
+ * Create thread-specific object auto-release pool
+ *
+ * Objects placed on the per-thread auto-release pool (with
+ * heim_auto_release()) can be released in one fell swoop by calling
+ * heim_auto_release_drain().
+ */
+
+heim_auto_release_t
+heim_auto_release_create(void)
+{
+    struct ar_tls *tls = autorel_tls();
+    heim_auto_release_t ar;
+
+    if (tls == NULL)
+	heim_abort("Failed to create/get autorelease head");
+
+    ar = _heim_alloc_object(&_heim_autorel_object, sizeof(struct heim_auto_release));
+    if (ar) {
+	HEIMDAL_MUTEX_lock(&tls->tls_mutex);
+	if (tls->head == NULL)
+	    tls->head = ar;
+	ar->parent = tls->current;
+	tls->current = ar;
+	HEIMDAL_MUTEX_unlock(&tls->tls_mutex);
+    }
+
+    return ar;
+}
+
+/**
+ * Place the current object on the thread's auto-release pool
+ *
+ * @param ptr object
+ */
+
+heim_object_t
+heim_auto_release(heim_object_t ptr)
+{
+    struct heim_base *p = PTR2BASE(ptr);
+    struct ar_tls *tls = autorel_tls();
+    heim_auto_release_t ar;
+
+    if (ptr == NULL || heim_base_is_tagged(ptr))
+	return ptr;
+
+    /* drop from old pool */
+    if ((ar = p->autorelpool) != NULL) {
+	HEIMDAL_MUTEX_lock(&ar->pool_mutex);
+	HEIM_TAILQ_REMOVE(&ar->pool, p, autorel);
+	p->autorelpool = NULL;
+	HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
+    }
+
+    if (tls == NULL || (ar = tls->current) == NULL)
+	heim_abort("no auto relase pool in place, would leak");
+
+    HEIMDAL_MUTEX_lock(&ar->pool_mutex);
+    HEIM_TAILQ_INSERT_HEAD(&ar->pool, p, autorel);
+    p->autorelpool = ar;
+    HEIMDAL_MUTEX_unlock(&ar->pool_mutex);
+
+    return ptr;
+}
+
+/**
+ * Release all objects on the given auto-release pool
+ */
+
+void
+heim_auto_release_drain(heim_auto_release_t autorel)
+{
+    heim_object_t obj;
+
+    /* release all elements on the tail queue */
+
+    HEIMDAL_MUTEX_lock(&autorel->pool_mutex);
+    while(!HEIM_TAILQ_EMPTY(&autorel->pool)) {
+	obj = HEIM_TAILQ_FIRST(&autorel->pool);
+	HEIMDAL_MUTEX_unlock(&autorel->pool_mutex);
+	heim_release(BASE2PTR(obj));
+	HEIMDAL_MUTEX_lock(&autorel->pool_mutex);
+    }
+    HEIMDAL_MUTEX_unlock(&autorel->pool_mutex);
+}
+
+/*
+ * Helper for heim_path_vget() and heim_path_delete().  On success
+ * outputs the node named by the path and the parent node and key
+ * (useful for heim_path_delete()).
+ */
+
+static heim_object_t
+heim_path_vget2(heim_object_t ptr, heim_object_t *parent, heim_object_t *key,
+		heim_error_t *error, va_list ap)
+{
+    heim_object_t path_element;
+    heim_object_t node, next_node;
+    heim_tid_t node_type;
+
+    *parent = NULL;
+    *key = NULL;
+    if (ptr == NULL)
+	return NULL;
+
+    for (node = ptr; node != NULL; ) {
+	path_element = va_arg(ap, heim_object_t);
+	if (path_element == NULL) {
+	    *parent = node;
+	    *key = path_element;
+	    return node;
+	}
+
+	node_type = heim_get_tid(node);
+	switch (node_type) {
+	case HEIM_TID_ARRAY:
+	case HEIM_TID_DICT:
+	case HEIM_TID_DB:
+	    break;
+	default:
+	    if (node == ptr)
+		heim_abort("heim_path_get() only operates on container types");
+	    return NULL;
+	}
+
+	if (node_type == HEIM_TID_DICT) {
+	    next_node = heim_dict_get_value(node, path_element);
+	} else if (node_type == HEIM_TID_DB) {
+	    next_node = _heim_db_get_value(node, NULL, path_element, NULL);
+	} else if (node_type == HEIM_TID_ARRAY) {
+	    int idx = -1;
+
+	    if (heim_get_tid(path_element) == HEIM_TID_NUMBER)
+		idx = heim_number_get_int(path_element);
+	    if (idx < 0) {
+		if (error)
+		    *error = heim_error_create(EINVAL,
+					       "heim_path_get() path elements "
+					       "for array nodes must be "
+					       "numeric and positive");
+		return NULL;
+	    }
+	    next_node = heim_array_get_value(node, idx);
+	} else {
+	    if (error)
+		*error = heim_error_create(EINVAL,
+					   "heim_path_get() node in path "
+					   "not a container type");
+	    return NULL;
+	}
+	node = next_node;
+    }
+    return NULL;
+}
+
+/**
+ * Get a node in a heim_object tree by path
+ *
+ * @param ptr tree
+ * @param error error (output)
+ * @param ap NULL-terminated va_list of heim_object_ts that form a path
+ *
+ * @return object (not retained) if found
+ *
+ * @addtogroup heimbase
+ */
+
+heim_object_t
+heim_path_vget(heim_object_t ptr, heim_error_t *error, va_list ap)
+{
+    heim_object_t p, k;
+
+    return heim_path_vget2(ptr, &p, &k, error, ap);
+}
+
+/**
+ * Get a node in a tree by path, with retained reference
+ *
+ * @param ptr tree
+ * @param error error (output)
+ * @param ap NULL-terminated va_list of heim_object_ts that form a path
+ *
+ * @return retained object if found
+ *
+ * @addtogroup heimbase
+ */
+
+heim_object_t
+heim_path_vcopy(heim_object_t ptr, heim_error_t *error, va_list ap)
+{
+    heim_object_t p, k;
+
+    return heim_retain(heim_path_vget2(ptr, &p, &k, error, ap));
+}
+
+/**
+ * Get a node in a tree by path
+ *
+ * @param ptr tree
+ * @param error error (output)
+ * @param ... NULL-terminated va_list of heim_object_ts that form a path
+ *
+ * @return object (not retained) if found
+ *
+ * @addtogroup heimbase
+ */
+
+heim_object_t
+heim_path_get(heim_object_t ptr, heim_error_t *error, ...)
+{
+    heim_object_t o;
+    heim_object_t p, k;
+    va_list ap;
+
+    if (ptr == NULL)
+	return NULL;
+
+    va_start(ap, error);
+    o = heim_path_vget2(ptr, &p, &k, error, ap);
+    va_end(ap);
+    return o;
+}
+
+/**
+ * Get a node in a tree by path, with retained reference
+ *
+ * @param ptr tree
+ * @param error error (output)
+ * @param ... NULL-terminated va_list of heim_object_ts that form a path
+ *
+ * @return retained object if found
+ *
+ * @addtogroup heimbase
+ */
+
+heim_object_t
+heim_path_copy(heim_object_t ptr, heim_error_t *error, ...)
+{
+    heim_object_t o;
+    heim_object_t p, k;
+    va_list ap;
+
+    if (ptr == NULL)
+	return NULL;
+
+    va_start(ap, error);
+    o = heim_retain(heim_path_vget2(ptr, &p, &k, error, ap));
+    va_end(ap);
+    return o;
+}
+
+/**
+ * Create a path in a heim_object_t tree
+ *
+ * @param ptr the tree
+ * @param size the size of the heim_dict_t nodes to be created
+ * @param leaf leaf node to be added, if any
+ * @param error error (output)
+ * @param ap NULL-terminated of path component objects
+ *
+ * Create a path of heim_dict_t interior nodes in a given heim_object_t
+ * tree, as necessary, and set/replace a leaf, if given (if leaf is NULL
+ * then the leaf is not deleted).
+ *
+ * @return 0 on success, else a system error
+ *
+ * @addtogroup heimbase
+ */
+
+int
+heim_path_vcreate(heim_object_t ptr, size_t size, heim_object_t leaf,
+		  heim_error_t *error, va_list ap)
+{
+    heim_object_t path_element = va_arg(ap, heim_object_t);
+    heim_object_t next_path_element = NULL;
+    heim_object_t node = ptr;
+    heim_object_t next_node = NULL;
+    heim_tid_t node_type;
+    int ret = 0;
+
+    if (ptr == NULL)
+	heim_abort("heim_path_vcreate() does not create root nodes");
+
+    while (path_element != NULL) {
+	next_path_element = va_arg(ap, heim_object_t);
+	node_type = heim_get_tid(node);
+
+	if (node_type == HEIM_TID_DICT) {
+	    next_node = heim_dict_get_value(node, path_element);
+	} else if (node_type == HEIM_TID_ARRAY) {
+	    int idx = -1;
+
+	    if (heim_get_tid(path_element) == HEIM_TID_NUMBER)
+		idx = heim_number_get_int(path_element);
+	    if (idx < 0) {
+		if (error)
+		    *error = heim_error_create(EINVAL,
+					       "heim_path() path elements for "
+					       "array nodes must be numeric "
+					       "and positive");
+		return EINVAL;
+	    }
+	    if (idx < heim_array_get_length(node))
+		next_node = heim_array_get_value(node, idx);
+	    else
+		next_node = NULL;
+	} else if (node_type == HEIM_TID_DB && next_path_element != NULL) {
+	    if (error)
+		*error = heim_error_create(EINVAL, "Interior node is a DB");
+	    return EINVAL;
+	}
+
+	if (next_path_element == NULL)
+	    break;
+
+	/* Create missing interior node */
+	if (next_node == NULL) {
+	    next_node = heim_dict_create(size); /* no arrays or DBs, just dicts */
+	    if (next_node == NULL) {
+		ret = ENOMEM;
+		goto err;
+	    }
+
+	    if (node_type == HEIM_TID_DICT) {
+		ret = heim_dict_set_value(node, path_element, next_node);
+	    } else if (node_type == HEIM_TID_ARRAY &&
+		heim_number_get_int(path_element) <= heim_array_get_length(node)) {
+		ret = heim_array_insert_value(node,
+					      heim_number_get_int(path_element),
+					      next_node);
+	    } else {
+		ret = EINVAL;
+		if (error)
+		    *error = heim_error_create(ret, "Node in path not a "
+					       "container");
+	    }
+	    heim_release(next_node);
+	    if (ret)
+		goto err;
+	}
+
+	path_element = next_path_element;
+	node = next_node;
+	next_node = NULL;
+    }
+
+    if (path_element == NULL)
+	goto err;
+
+    /* Add the leaf */
+    if (leaf != NULL) {
+	if (node_type == HEIM_TID_DICT)
+	    ret = heim_dict_set_value(node, path_element, leaf);
+	else
+	    ret = heim_array_insert_value(node,
+					  heim_number_get_int(path_element),
+					  leaf);
+    }
+    return ret;
+
+err:
+    if (error && !*error) {
+	if (ret == ENOMEM)
+	    *error = heim_error_create_enomem();
+	else
+	    *error = heim_error_create(ret, "Could not set "
+				       "dict value");
+    }
+    return ret;
+}
+
+/**
+ * Create a path in a heim_object_t tree
+ *
+ * @param ptr the tree
+ * @param size the size of the heim_dict_t nodes to be created
+ * @param leaf leaf node to be added, if any
+ * @param error error (output)
+ * @param ... NULL-terminated list of path component objects
+ *
+ * Create a path of heim_dict_t interior nodes in a given heim_object_t
+ * tree, as necessary, and set/replace a leaf, if given (if leaf is NULL
+ * then the leaf is not deleted).
+ *
+ * @return 0 on success, else a system error
+ *
+ * @addtogroup heimbase
+ */
+
+int
+heim_path_create(heim_object_t ptr, size_t size, heim_object_t leaf,
+		 heim_error_t *error, ...)
+{
+    va_list ap;
+    int ret;
+
+    va_start(ap, error);
+    ret = heim_path_vcreate(ptr, size, leaf, error, ap);
+    va_end(ap);
+    return ret;
+}
+
+/**
+ * Delete leaf node named by a path in a heim_object_t tree
+ *
+ * @param ptr the tree
+ * @param error error (output)
+ * @param ap NULL-terminated list of path component objects
+ *
+ * @addtogroup heimbase
+ */
+
+void
+heim_path_vdelete(heim_object_t ptr, heim_error_t *error, va_list ap)
+{
+    heim_object_t parent, key, child;
+
+    child = heim_path_vget2(ptr, &parent, &key, error, ap);
+    if (child != NULL) {
+	if (heim_get_tid(parent) == HEIM_TID_DICT)
+	    heim_dict_delete_key(parent, key);
+	else if (heim_get_tid(parent) == HEIM_TID_DB)
+	    heim_db_delete_key(parent, NULL, key, error);
+	else if (heim_get_tid(parent) == HEIM_TID_ARRAY)
+	    heim_array_delete_value(parent, heim_number_get_int(key));
+	heim_release(child);
+    }
+}
+
+/**
+ * Delete leaf node named by a path in a heim_object_t tree
+ *
+ * @param ptr the tree
+ * @param error error (output)
+ * @param ap NULL-terminated list of path component objects
+ *
+ * @addtogroup heimbase
+ */
+
+void
+heim_path_delete(heim_object_t ptr, heim_error_t *error, ...)
+{
+    va_list ap;
+
+    va_start(ap, error);
+    heim_path_vdelete(ptr, error, ap);
+    va_end(ap);
+    return;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/heimbase.h b/crypto/external/bsd/heimdal/dist/lib/base/heimbase.h
new file mode 100644
index 000000000..73e72d290
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/heimbase.h
@@ -0,0 +1,433 @@
+/*	$NetBSD: heimbase.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef HEIM_BASE_H
+#define HEIM_BASE_H 1
+
+#include <sys/types.h>
+#if !defined(WIN32) && !defined(HAVE_DISPATCH_DISPATCH_H) && defined(ENABLE_PTHREAD_SUPPORT)
+#include <pthread.h>
+#endif
+#include <krb5/krb5-types.h>
+#include <stdarg.h>
+#ifdef HAVE_STDBOOL_H
+#include <stdbool.h>
+#else
+#ifndef false
+#define false 0
+#endif
+#ifndef true
+#define true 1
+#endif
+#endif
+
+#define HEIM_BASE_API_VERSION 20130210
+
+typedef void * heim_object_t;
+typedef unsigned int heim_tid_t;
+typedef heim_object_t heim_bool_t;
+typedef heim_object_t heim_null_t;
+#ifdef WIN32
+typedef LONG heim_base_once_t;
+#define HEIM_BASE_ONCE_INIT 0
+#elif defined(HAVE_DISPATCH_DISPATCH_H)
+typedef long heim_base_once_t; /* XXX arch dependant */
+#define HEIM_BASE_ONCE_INIT 0
+#elif defined(ENABLE_PTHREAD_SUPPORT)
+typedef pthread_once_t heim_base_once_t;
+#define HEIM_BASE_ONCE_INIT PTHREAD_ONCE_INIT
+#else
+typedef long heim_base_once_t; /* XXX arch dependant */
+#define HEIM_BASE_ONCE_INIT 0
+#endif
+
+#if !defined(__has_extension)
+#define __has_extension(x) 0
+#endif
+
+#define HEIM_REQUIRE_GNUC(m,n,p) \
+    (((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + __GNUC_PATCHLEVEL__) >= \
+     (((m) * 10000) + ((n) * 100) + (p)))
+
+
+#if __has_extension(__builtin_expect) || HEIM_REQUIRE_GNUC(3,0,0)
+#define heim_builtin_expect(_op,_res) __builtin_expect(_op,_res)
+#else
+#define heim_builtin_expect(_op,_res) (_op)
+#endif
+
+
+void *	heim_retain(heim_object_t);
+void	heim_release(heim_object_t);
+
+void	heim_show(heim_object_t);
+
+typedef void (*heim_type_dealloc)(void *);
+
+void *
+heim_alloc(size_t size, const char *name, heim_type_dealloc dealloc);
+
+heim_tid_t
+heim_get_tid(heim_object_t object);
+
+int
+heim_cmp(heim_object_t a, heim_object_t b);
+
+unsigned long
+heim_get_hash(heim_object_t ptr);
+
+void
+heim_base_once_f(heim_base_once_t *, void *, void (*)(void *));
+
+void
+heim_abort(const char *fmt, ...)
+    HEIMDAL_NORETURN_ATTRIBUTE
+    HEIMDAL_PRINTF_ATTRIBUTE((__printf__, 1, 2));
+
+void
+heim_abortv(const char *fmt, va_list ap)
+    HEIMDAL_NORETURN_ATTRIBUTE
+    HEIMDAL_PRINTF_ATTRIBUTE((__printf__, 1, 0));
+
+#define heim_assert(e,t) \
+    (heim_builtin_expect(!(e), 0) ? heim_abort(t ":" #e) : (void)0)
+
+/*
+ *
+ */
+
+heim_null_t
+heim_null_create(void);
+
+heim_bool_t
+heim_bool_create(int);
+
+int
+heim_bool_val(heim_bool_t);
+
+/*
+ * Array
+ */
+
+typedef struct heim_array_data *heim_array_t;
+
+heim_array_t heim_array_create(void);
+heim_tid_t heim_array_get_type_id(void);
+
+typedef void (*heim_array_iterator_f_t)(heim_object_t, void *, int *);
+typedef int (*heim_array_filter_f_t)(heim_object_t, void *);
+
+int	heim_array_append_value(heim_array_t, heim_object_t);
+int	heim_array_insert_value(heim_array_t, size_t idx, heim_object_t);
+void	heim_array_iterate_f(heim_array_t, void *, heim_array_iterator_f_t);
+void	heim_array_iterate_reverse_f(heim_array_t, void *, heim_array_iterator_f_t);
+#ifdef __BLOCKS__
+void	heim_array_iterate(heim_array_t, void (^)(heim_object_t, int *));
+void	heim_array_iterate_reverse(heim_array_t, void (^)(heim_object_t, int *));
+#endif
+size_t	heim_array_get_length(heim_array_t);
+heim_object_t
+	heim_array_get_value(heim_array_t, size_t);
+heim_object_t
+	heim_array_copy_value(heim_array_t, size_t);
+void	heim_array_set_value(heim_array_t, size_t, heim_object_t);
+void	heim_array_delete_value(heim_array_t, size_t);
+void	heim_array_filter_f(heim_array_t, void *, heim_array_filter_f_t);
+#ifdef __BLOCKS__
+void	heim_array_filter(heim_array_t, int (^)(heim_object_t));
+#endif
+
+/*
+ * Dict
+ */
+
+typedef struct heim_dict_data *heim_dict_t;
+
+heim_dict_t heim_dict_create(size_t size);
+heim_tid_t heim_dict_get_type_id(void);
+
+typedef void (*heim_dict_iterator_f_t)(heim_object_t, heim_object_t, void *);
+
+int	heim_dict_set_value(heim_dict_t, heim_object_t, heim_object_t);
+void	heim_dict_iterate_f(heim_dict_t, void *, heim_dict_iterator_f_t);
+#ifdef __BLOCKS__
+void	heim_dict_iterate(heim_dict_t, void (^)(heim_object_t, heim_object_t));
+#endif
+
+heim_object_t
+	heim_dict_get_value(heim_dict_t, heim_object_t);
+heim_object_t
+	heim_dict_copy_value(heim_dict_t, heim_object_t);
+void	heim_dict_delete_key(heim_dict_t, heim_object_t);
+
+/*
+ * String
+ */
+
+typedef struct heim_string_data *heim_string_t;
+typedef void (*heim_string_free_f_t)(void *);
+
+heim_string_t heim_string_create(const char *);
+heim_string_t heim_string_ref_create(const char *, heim_string_free_f_t);
+heim_string_t heim_string_create_with_bytes(const void *, size_t);
+heim_string_t heim_string_ref_create_with_bytes(const void *, size_t,
+						heim_string_free_f_t);
+heim_string_t heim_string_create_with_format(const char *, ...);
+heim_tid_t heim_string_get_type_id(void);
+const char * heim_string_get_utf8(heim_string_t);
+
+#define HSTR(_str) (__heim_string_constant("" _str ""))
+heim_string_t __heim_string_constant(const char *);
+
+/*
+ * Errors
+ */
+
+typedef struct heim_error * heim_error_t;
+
+heim_error_t heim_error_create_enomem(void);
+
+heim_error_t	heim_error_create(int, const char *, ...)
+    HEIMDAL_PRINTF_ATTRIBUTE((__printf__, 2, 3));
+
+void		heim_error_create_opt(heim_error_t *error, int error_code, const char *fmt, ...)
+    HEIMDAL_PRINTF_ATTRIBUTE((__printf__, 3, 4));
+
+heim_error_t	heim_error_createv(int, const char *, va_list)
+    HEIMDAL_PRINTF_ATTRIBUTE((__printf__, 2, 0));
+
+heim_string_t heim_error_copy_string(heim_error_t);
+int heim_error_get_code(heim_error_t);
+
+heim_error_t heim_error_append(heim_error_t, heim_error_t);
+
+/*
+ * Path
+ */
+
+heim_object_t heim_path_get(heim_object_t ptr, heim_error_t *error, ...);
+heim_object_t heim_path_copy(heim_object_t ptr, heim_error_t *error, ...);
+heim_object_t heim_path_vget(heim_object_t ptr, heim_error_t *error,
+			     va_list ap);
+heim_object_t heim_path_vcopy(heim_object_t ptr, heim_error_t *error,
+				  va_list ap);
+
+int heim_path_vcreate(heim_object_t ptr, size_t size, heim_object_t leaf,
+		      heim_error_t *error, va_list ap);
+int heim_path_create(heim_object_t ptr, size_t size, heim_object_t leaf,
+		     heim_error_t *error, ...);
+
+void heim_path_vdelete(heim_object_t ptr, heim_error_t *error, va_list ap);
+void heim_path_delete(heim_object_t ptr, heim_error_t *error, ...);
+
+/*
+ * Data (octet strings)
+ */
+
+#ifndef __HEIM_BASE_DATA__
+#define __HEIM_BASE_DATA__
+struct heim_base_data {
+    size_t length;
+    void *data;
+};
+typedef struct heim_base_data heim_octet_string;
+#endif
+
+typedef struct heim_base_data * heim_data_t;
+typedef void (*heim_data_free_f_t)(void *);
+
+heim_data_t	heim_data_create(const void *, size_t);
+heim_data_t	heim_data_ref_create(const void *, size_t, heim_data_free_f_t);
+heim_tid_t	heim_data_get_type_id(void);
+const heim_octet_string *
+		heim_data_get_data(heim_data_t);
+const void *	heim_data_get_ptr(heim_data_t);
+size_t		heim_data_get_length(heim_data_t);
+
+/*
+ * DB
+ */
+
+typedef struct heim_db_data *heim_db_t;
+
+typedef void (*heim_db_iterator_f_t)(heim_data_t, heim_data_t, void *);
+
+typedef int (*heim_db_plug_open_f_t)(void *, const char *, const char *,
+				     heim_dict_t, void **, heim_error_t *);
+typedef int (*heim_db_plug_clone_f_t)(void *, void **, heim_error_t *);
+typedef int (*heim_db_plug_close_f_t)(void *, heim_error_t *);
+typedef int (*heim_db_plug_lock_f_t)(void *, int, heim_error_t *);
+typedef int (*heim_db_plug_unlock_f_t)(void *, heim_error_t *);
+typedef int (*heim_db_plug_sync_f_t)(void *, heim_error_t *);
+typedef int (*heim_db_plug_begin_f_t)(void *, int, heim_error_t *);
+typedef int (*heim_db_plug_commit_f_t)(void *, heim_error_t *);
+typedef int (*heim_db_plug_rollback_f_t)(void *, heim_error_t *);
+typedef heim_data_t (*heim_db_plug_copy_value_f_t)(void *, heim_string_t,
+                                                   heim_data_t,
+                                                   heim_error_t *);
+typedef int (*heim_db_plug_set_value_f_t)(void *, heim_string_t, heim_data_t,
+                                          heim_data_t, heim_error_t *);
+typedef int (*heim_db_plug_del_key_f_t)(void *, heim_string_t, heim_data_t,
+                                        heim_error_t *);
+typedef void (*heim_db_plug_iter_f_t)(void *, heim_string_t, void *,
+                                      heim_db_iterator_f_t, heim_error_t *);
+
+struct heim_db_type {
+    int                         version;
+    heim_db_plug_open_f_t       openf;
+    heim_db_plug_clone_f_t      clonef;
+    heim_db_plug_close_f_t      closef;
+    heim_db_plug_lock_f_t       lockf;
+    heim_db_plug_unlock_f_t     unlockf;
+    heim_db_plug_sync_f_t       syncf;
+    heim_db_plug_begin_f_t      beginf;
+    heim_db_plug_commit_f_t     commitf;
+    heim_db_plug_rollback_f_t   rollbackf;
+    heim_db_plug_copy_value_f_t copyf;
+    heim_db_plug_set_value_f_t  setf;
+    heim_db_plug_del_key_f_t    delf;
+    heim_db_plug_iter_f_t       iterf;
+};
+
+extern struct heim_db_type heim_sorted_text_file_dbtype;
+
+#define HEIM_DB_TYPE_VERSION_01 1
+
+int heim_db_register(const char *dbtype,
+		     void *data,
+		     struct heim_db_type *plugin);
+
+heim_db_t heim_db_create(const char *dbtype, const char *dbname,
+		         heim_dict_t options, heim_error_t *error);
+heim_db_t heim_db_clone(heim_db_t, heim_error_t *);
+int heim_db_begin(heim_db_t, int, heim_error_t *);
+int heim_db_commit(heim_db_t, heim_error_t *);
+int heim_db_rollback(heim_db_t, heim_error_t *);
+heim_tid_t heim_db_get_type_id(void);
+
+int     heim_db_set_value(heim_db_t, heim_string_t, heim_data_t, heim_data_t,
+                          heim_error_t *);
+heim_data_t heim_db_copy_value(heim_db_t, heim_string_t, heim_data_t,
+                               heim_error_t *);
+int     heim_db_delete_key(heim_db_t, heim_string_t, heim_data_t,
+                           heim_error_t *);
+void    heim_db_iterate_f(heim_db_t, heim_string_t, void *,
+                          heim_db_iterator_f_t, heim_error_t *);
+#ifdef __BLOCKS__
+void    heim_db_iterate(heim_db_t, heim_string_t,
+                        void (^)(heim_data_t, heim_data_t), heim_error_t *);
+#endif
+
+
+/*
+ * Number
+ */
+
+typedef struct heim_number_data *heim_number_t;
+
+heim_number_t heim_number_create(int);
+heim_tid_t heim_number_get_type_id(void);
+int heim_number_get_int(heim_number_t);
+
+/*
+ *
+ */
+
+typedef struct heim_auto_release * heim_auto_release_t;
+
+heim_auto_release_t heim_auto_release_create(void);
+void heim_auto_release_drain(heim_auto_release_t);
+heim_object_t heim_auto_release(heim_object_t);
+
+/*
+ * JSON
+ */
+typedef enum heim_json_flags {
+	HEIM_JSON_F_NO_C_NULL = 1,
+	HEIM_JSON_F_STRICT_STRINGS = 2,
+	HEIM_JSON_F_NO_DATA = 4,
+	HEIM_JSON_F_NO_DATA_DICT = 8,
+	HEIM_JSON_F_STRICT_DICT = 16,
+	HEIM_JSON_F_STRICT = 31,
+	HEIM_JSON_F_CNULL2JSNULL = 32,
+	HEIM_JSON_F_TRY_DECODE_DATA = 64,
+	HEIM_JSON_F_ONE_LINE = 128
+} heim_json_flags_t;
+
+heim_object_t heim_json_create(const char *, size_t, heim_json_flags_t,
+			       heim_error_t *);
+heim_object_t heim_json_create_with_bytes(const void *, size_t, size_t,
+					  heim_json_flags_t,
+					  heim_error_t *);
+heim_string_t heim_json_copy_serialize(heim_object_t, heim_json_flags_t,
+				       heim_error_t *);
+
+
+/*
+ * Debug
+ */
+
+heim_string_t
+heim_description(heim_object_t ptr);
+
+/*
+ * Binary search.
+ *
+ * Note: these are private until integrated into the heimbase object system.
+ */
+typedef struct bsearch_file_handle *bsearch_file_handle;
+int _bsearch_text(const char *buf, size_t buf_sz, const char *key,
+		   char **value, size_t *location, size_t *loops);
+int _bsearch_file_open(const char *fname, size_t max_sz, size_t page_sz,
+			bsearch_file_handle *bfh, size_t *reads);
+int _bsearch_file(bsearch_file_handle bfh, const char *key, char **value,
+		   size_t *location, size_t *loops, size_t *reads);
+void _bsearch_file_info(bsearch_file_handle bfh, size_t *page_sz,
+			 size_t *max_sz, int *blockwise);
+void _bsearch_file_close(bsearch_file_handle *bfh);
+
+/*
+ * Thread-specific keys
+ */
+
+int heim_w32_key_create(unsigned long *, void (*)(void *));
+int heim_w32_delete_key(unsigned long);
+int heim_w32_setspecific(unsigned long, void *);
+void *heim_w32_getspecific(unsigned long);
+void heim_w32_service_thread_detach(void *);
+
+#endif /* HEIM_BASE_H */
diff --git a/crypto/external/bsd/heimdal/dist/base/heimbasepriv.h b/crypto/external/bsd/heimdal/dist/lib/base/heimbasepriv.h
similarity index 74%
rename from crypto/external/bsd/heimdal/dist/base/heimbasepriv.h
rename to crypto/external/bsd/heimdal/dist/lib/base/heimbasepriv.h
index be771eeb4..c5e120a19 100644
--- a/crypto/external/bsd/heimdal/dist/base/heimbasepriv.h
+++ b/crypto/external/bsd/heimdal/dist/lib/base/heimbasepriv.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heimbasepriv.h,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: heimbasepriv.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -35,10 +35,17 @@
  * SUCH DAMAGE.
  */
 
+#if defined(HEIM_BASE_MAINTAINER) && defined(ENABLE_PTHREAD_SUPPORT)
+#define HEIM_WIN32_TLS
+#elif defined(WIN32)
+#define HEIM_WIN32_TLS
+#endif
+
 typedef void (*heim_type_init)(void *);
 typedef heim_object_t (*heim_type_copy)(void *);
 typedef int (*heim_type_cmp)(void *, void *);
 typedef unsigned long (*heim_type_hash)(void *);
+typedef heim_string_t (*heim_type_description)(void *);
 
 typedef struct heim_type_data *heim_type_t;
 
@@ -46,16 +53,19 @@ enum {
     HEIM_TID_NUMBER = 0,
     HEIM_TID_NULL = 1,
     HEIM_TID_BOOL = 2,
-    HEIM_TID_TAGGED_UNUSED2 = 3,
-    HEIM_TID_TAGGED_UNUSED3 = 4,
-    HEIM_TID_TAGGED_UNUSED4 = 5,
-    HEIM_TID_TAGGED_UNUSED5 = 6,
-    HEIM_TID_TAGGED_UNUSED6 = 7,
+    HEIM_TID_TAGGED_UNUSED2 = 3, /* reserved for tagged object types */
+    HEIM_TID_TAGGED_UNUSED3 = 4, /* reserved for tagged object types */
+    HEIM_TID_TAGGED_UNUSED4 = 5, /* reserved for tagged object types */
+    HEIM_TID_TAGGED_UNUSED5 = 6, /* reserved for tagged object types */
+    HEIM_TID_TAGGED_UNUSED6 = 7, /* reserved for tagged object types */
     HEIM_TID_MEMORY = 128,
     HEIM_TID_ARRAY = 129,
     HEIM_TID_DICT = 130,
     HEIM_TID_STRING = 131,
     HEIM_TID_AUTORELEASE = 132,
+    HEIM_TID_ERROR = 133,
+    HEIM_TID_DATA = 134,
+    HEIM_TID_DB = 135,
     HEIM_TID_USER = 255
 
 };
@@ -68,6 +78,7 @@ struct heim_type_data {
     heim_type_copy copy;
     heim_type_cmp cmp;
     heim_type_hash hash;
+    heim_type_description desc;
 };
 
 heim_type_t _heim_get_isa(heim_object_t);
@@ -78,14 +89,25 @@ _heim_create_type(const char *name,
 		  heim_type_dealloc dealloc,
 		  heim_type_copy copy,
 		  heim_type_cmp cmp,
-		  heim_type_hash hash);
+		  heim_type_hash hash,
+		  heim_type_description desc);
 
 heim_object_t
 _heim_alloc_object(heim_type_t type, size_t size);
 
+void *
+_heim_get_isaextra(heim_object_t o, size_t idx);
+
 heim_tid_t
 _heim_type_get_tid(heim_type_t type);
 
+void
+_heim_make_permanent(heim_object_t ptr);
+
+heim_data_t
+_heim_db_get_value(heim_db_t, heim_string_t, heim_data_t, heim_error_t *);
+
+
 /* tagged tid */
 extern struct heim_type_data _heim_null_object;
 extern struct heim_type_data _heim_bool_object;
diff --git a/crypto/external/bsd/heimdal/dist/base/heimqueue.h b/crypto/external/bsd/heimdal/dist/lib/base/heimqueue.h
similarity index 98%
rename from crypto/external/bsd/heimdal/dist/base/heimqueue.h
rename to crypto/external/bsd/heimdal/dist/lib/base/heimqueue.h
index 281eb388a..f77d1a538 100644
--- a/crypto/external/bsd/heimdal/dist/base/heimqueue.h
+++ b/crypto/external/bsd/heimdal/dist/lib/base/heimqueue.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heimqueue.h,v 1.1.1.2 2011/04/14 14:08:07 elric Exp $	*/
+/*	$NetBSD: heimqueue.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*	NetBSD: queue.h,v 1.38 2004/04/18 14:12:05 lukem Exp	*/
 /*	Id */
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/json.c b/crypto/external/bsd/heimdal/dist/lib/base/json.c
new file mode 100644
index 000000000..21d0c10d4
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/json.c
@@ -0,0 +1,813 @@
+/*	$NetBSD: json.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+#include <ctype.h>
+#include <krb5/base64.h>
+
+static heim_base_once_t heim_json_once = HEIM_BASE_ONCE_INIT;
+static heim_string_t heim_tid_data_uuid_key = NULL;
+static const char base64_chars[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static void
+json_init_once(void *arg)
+{
+    heim_tid_data_uuid_key = __heim_string_constant("heimdal-type-data-76d7fca2-d0da-4b20-a126-1a10f8a0eae6");
+}
+
+struct twojson {
+    void *ctx;
+    void (*out)(void *, const char *);
+    size_t indent;
+    heim_json_flags_t flags;
+    int ret;
+    int first;
+};
+
+struct heim_strbuf {
+    char *str;
+    size_t len;
+    size_t alloced;
+    int	enomem;
+    heim_json_flags_t flags;
+};
+
+static int
+base2json(heim_object_t, struct twojson *);
+
+static void
+indent(struct twojson *j)
+{
+    size_t i = j->indent;
+    if (j->flags & HEIM_JSON_F_ONE_LINE)
+	return;
+    while (i--)
+	j->out(j->ctx, "\t");
+}
+
+static void
+array2json(heim_object_t value, void *ctx, int *stop)
+{
+    struct twojson *j = ctx;
+    if (j->ret)
+	return;
+    if (j->first) {
+	j->first = 0;
+    } else {
+	j->out(j->ctx, NULL); /* eat previous '\n' if possible */
+	j->out(j->ctx, ",\n");
+    }
+    j->ret = base2json(value, j);
+}
+
+static void
+dict2json(heim_object_t key, heim_object_t value, void *ctx)
+{
+    struct twojson *j = ctx;
+    if (j->ret)
+	return;
+    if (j->first) {
+	j->first = 0;
+    } else {
+	j->out(j->ctx, NULL); /* eat previous '\n' if possible */
+	j->out(j->ctx, ",\n");
+    }
+    j->ret = base2json(key, j);
+    if (j->ret)
+	return;
+    j->out(j->ctx, " : \n");
+    j->indent++;
+    j->ret = base2json(value, j);
+    if (j->ret)
+	return;
+    j->indent--;
+}
+
+static int
+base2json(heim_object_t obj, struct twojson *j)
+{
+    heim_tid_t type;
+    int first = 0;
+
+    if (obj == NULL) {
+	if (j->flags & HEIM_JSON_F_CNULL2JSNULL) {
+	    obj = heim_null_create();
+	} else if (j->flags & HEIM_JSON_F_NO_C_NULL) {
+	    return EINVAL;
+	} else {
+	    indent(j);
+	    j->out(j->ctx, "<NULL>\n"); /* This is NOT valid JSON! */
+	    return 0;
+	}
+    }
+
+    type = heim_get_tid(obj);
+    switch (type) {
+    case HEIM_TID_ARRAY:
+	indent(j);
+	j->out(j->ctx, "[\n");
+	j->indent++;
+	first = j->first;
+	j->first = 1;
+	heim_array_iterate_f(obj, j, array2json);
+	j->indent--;
+	if (!j->first)
+	    j->out(j->ctx, "\n");
+	indent(j);
+	j->out(j->ctx, "]\n");
+	j->first = first;
+	break;
+
+    case HEIM_TID_DICT:
+	indent(j);
+	j->out(j->ctx, "{\n");
+	j->indent++;
+	first = j->first;
+	j->first = 1;
+	heim_dict_iterate_f(obj, j, dict2json);
+	j->indent--;
+	if (!j->first)
+	    j->out(j->ctx, "\n");
+	indent(j);
+	j->out(j->ctx, "}\n");
+	j->first = first;
+	break;
+
+    case HEIM_TID_STRING:
+	indent(j);
+	j->out(j->ctx, "\"");
+	j->out(j->ctx, heim_string_get_utf8(obj));
+	j->out(j->ctx, "\"");
+	break;
+
+    case HEIM_TID_DATA: {
+	heim_dict_t d;
+	heim_string_t v;
+	const heim_octet_string *data;
+	char *b64 = NULL;
+	int ret;
+
+	if (j->flags & HEIM_JSON_F_NO_DATA)
+	    return EINVAL; /* JSON doesn't do binary */
+
+	data = heim_data_get_data(obj);
+	ret = rk_base64_encode(data->data, data->length, &b64);
+	if (ret < 0 || b64 == NULL)
+	    return ENOMEM;
+
+	if (j->flags & HEIM_JSON_F_NO_DATA_DICT) {
+	    indent(j);
+	    j->out(j->ctx, "\"");
+	    j->out(j->ctx, b64); /* base64-encode; hope there's no aliasing */
+	    j->out(j->ctx, "\"");
+	    free(b64);
+	} else {
+	    /*
+	     * JSON has no way to represent binary data, therefore the
+	     * following is a Heimdal-specific convention.
+	     *
+	     * We encode binary data as a dict with a single very magic
+	     * key with a base64-encoded value.  The magic key includes
+	     * a uuid, so we're not likely to alias accidentally.
+	     */
+	    d = heim_dict_create(2);
+	    if (d == NULL) {
+		free(b64);
+		return ENOMEM;
+	    }
+	    v = heim_string_ref_create(b64, free);
+	    if (v == NULL) {
+		free(b64);
+		heim_release(d);
+		return ENOMEM;
+	    }
+	    ret = heim_dict_set_value(d, heim_tid_data_uuid_key, v);
+	    heim_release(v);
+	    if (ret) {
+		heim_release(d);
+		return ENOMEM;
+	    }
+	    ret = base2json(d, j);
+	    heim_release(d);
+	    if (ret)
+		return ret;
+	}
+	break;
+    }
+
+    case HEIM_TID_NUMBER: {
+	char num[32];
+	indent(j);
+	snprintf(num, sizeof (num), "%d", heim_number_get_int(obj));
+	j->out(j->ctx, num);
+	break;
+    }
+    case HEIM_TID_NULL:
+	indent(j);
+	j->out(j->ctx, "null");
+	break;
+    case HEIM_TID_BOOL:
+	indent(j);
+	j->out(j->ctx, heim_bool_val(obj) ? "true" : "false");
+	break;
+    default:
+	return 1;
+    }
+    return 0;
+}
+
+static int
+heim_base2json(heim_object_t obj, void *ctx, heim_json_flags_t flags,
+	       void (*out)(void *, const char *))
+{
+    struct twojson j;
+
+    if (flags & HEIM_JSON_F_STRICT_STRINGS)
+	return ENOTSUP; /* Sorry, not yet! */
+
+    heim_base_once_f(&heim_json_once, NULL, json_init_once);
+
+    j.indent = 0;
+    j.ctx = ctx;
+    j.out = out;
+    j.flags = flags;
+    j.ret = 0;
+    j.first = 1;
+
+    return base2json(obj, &j);
+}
+
+
+/*
+ *
+ */
+
+struct parse_ctx {
+    unsigned long lineno;
+    const uint8_t *p;
+    const uint8_t *pstart;
+    const uint8_t *pend;
+    heim_error_t error;
+    size_t depth;
+    heim_json_flags_t flags;
+};
+
+
+static heim_object_t
+parse_value(struct parse_ctx *ctx);
+
+/*
+ * This function eats whitespace, but, critically, it also succeeds
+ * only if there's anything left to parse.
+ */
+static int
+white_spaces(struct parse_ctx *ctx)
+{
+    while (ctx->p < ctx->pend) {
+	uint8_t c = *ctx->p;
+	if (c == ' ' || c == '\t' || c == '\r') {
+
+	} else if (c == '\n') {
+	    ctx->lineno++;
+	} else
+	    return 0;
+	(ctx->p)++;
+    }
+    return -1;
+}
+
+static int
+is_number(uint8_t n)
+{
+    return ('0' <= n && n <= '9');
+}
+
+static heim_number_t
+parse_number(struct parse_ctx *ctx)
+{
+    int number = 0, neg = 1;
+
+    if (ctx->p >= ctx->pend)
+	return NULL;
+
+    if (*ctx->p == '-') {
+	if (ctx->p + 1 >= ctx->pend)
+	    return NULL;
+	neg = -1;
+	ctx->p += 1;
+    }
+
+    while (ctx->p < ctx->pend) {
+	if (is_number(*ctx->p)) {
+	    number = (number * 10) + (*ctx->p - '0');
+	} else {
+	    break;
+	}
+	ctx->p += 1;
+    }
+
+    return heim_number_create(number * neg);
+}
+
+static heim_string_t
+parse_string(struct parse_ctx *ctx)
+{
+    const uint8_t *start;
+    int quote = 0;
+
+    if (ctx->flags & HEIM_JSON_F_STRICT_STRINGS) {
+	ctx->error = heim_error_create(EINVAL, "Strict JSON string encoding "
+				       "not yet supported");
+	return NULL;
+    }
+
+    if (*ctx->p != '"') {
+	ctx->error = heim_error_create(EINVAL, "Expected a JSON string but "
+				       "found something else at line %lu",
+				       ctx->lineno);
+	return NULL;
+    }
+    start = ++ctx->p;
+
+    while (ctx->p < ctx->pend) {
+	if (*ctx->p == '\n') {
+	    ctx->lineno++;
+	} else if (*ctx->p == '\\') {
+	    if (ctx->p + 1 == ctx->pend)
+		goto out;
+	    ctx->p++;
+	    quote = 1;
+	} else if (*ctx->p == '"') {
+	    heim_object_t o;
+
+	    if (quote) {
+		char *p0, *p;
+		p = p0 = malloc(ctx->p - start);
+		if (p == NULL)
+		    goto out;
+		while (start < ctx->p) {
+		    if (*start == '\\') {
+			start++;
+			/* XXX validate quoted char */
+		    }
+		    *p++ = *start++;
+		}
+		o = heim_string_create_with_bytes(p0, p - p0);
+		free(p0);
+	    } else {
+		o = heim_string_create_with_bytes(start, ctx->p - start);
+		if (o == NULL) {
+		    ctx->error = heim_error_create_enomem();
+		    return NULL;
+		}
+
+		/* If we can decode as base64, then let's */
+		if (ctx->flags & HEIM_JSON_F_TRY_DECODE_DATA) {
+		    void *buf;
+		    size_t len;
+		    const char *s;
+
+		    s = heim_string_get_utf8(o);
+		    len = strlen(s);
+
+		    if (len >= 4 && strspn(s, base64_chars) >= len - 2) {
+			buf = malloc(len);
+			if (buf == NULL) {
+			    heim_release(o);
+			    ctx->error = heim_error_create_enomem();
+			    return NULL;
+			}
+			len = rk_base64_decode(s, buf);
+			if (len == -1) {
+			    free(buf);
+			    return o;
+			}
+			heim_release(o);
+			o = heim_data_ref_create(buf, len, free);
+		    }
+		}
+	    }
+	    ctx->p += 1;
+
+	    return o;
+	}
+	ctx->p += 1;
+    }
+    out:
+    ctx->error = heim_error_create(EINVAL, "ran out of string");
+    return NULL;
+}
+
+static int
+parse_pair(heim_dict_t dict, struct parse_ctx *ctx)
+{
+    heim_string_t key;
+    heim_object_t value;
+
+    if (white_spaces(ctx))
+	return -1;
+
+    if (*ctx->p == '}') {
+	ctx->p++;
+	return 0;
+    }
+
+    if (ctx->flags & HEIM_JSON_F_STRICT_DICT)
+	/* JSON allows only string keys */
+	key = parse_string(ctx);
+    else
+	/* heim_dict_t allows any heim_object_t as key */
+	key = parse_value(ctx);
+    if (key == NULL)
+	/* Even heim_dict_t does not allow C NULLs as keys though! */
+	return -1;
+
+    if (white_spaces(ctx)) {
+	heim_release(key);
+	return -1;
+    }
+
+    if (*ctx->p != ':') {
+	heim_release(key);
+	return -1;
+    }
+
+    ctx->p += 1; /* safe because we call white_spaces() next */
+
+    if (white_spaces(ctx)) {
+	heim_release(key);
+	return -1;
+    }
+
+    value = parse_value(ctx);
+    if (value == NULL &&
+	(ctx->error != NULL || (ctx->flags & HEIM_JSON_F_NO_C_NULL))) {
+	if (ctx->error == NULL)
+	    ctx->error = heim_error_create(EINVAL, "Invalid JSON encoding");
+	heim_release(key);
+	return -1;
+    }
+    heim_dict_set_value(dict, key, value);
+    heim_release(key);
+    heim_release(value);
+
+    if (white_spaces(ctx))
+	return -1;
+
+    if (*ctx->p == '}') {
+	/*
+	 * Return 1 but don't consume the '}' so we can count the one
+	 * pair in a one-pair dict
+	 */
+	return 1;
+    } else if (*ctx->p == ',') {
+	ctx->p++;
+	return 1;
+    }
+    return -1;
+}
+
+static heim_dict_t
+parse_dict(struct parse_ctx *ctx)
+{
+    heim_dict_t dict;
+    size_t count = 0;
+    int ret;
+
+    heim_assert(*ctx->p == '{', "string doesn't start with {");
+
+    dict = heim_dict_create(11);
+    if (dict == NULL) {
+	ctx->error = heim_error_create_enomem();
+	return NULL;
+    }
+
+    ctx->p += 1; /* safe because parse_pair() calls white_spaces() first */
+
+    while ((ret = parse_pair(dict, ctx)) > 0)
+	count++;
+    if (ret < 0) {
+	heim_release(dict);
+	return NULL;
+    }
+    if (count == 1 && !(ctx->flags & HEIM_JSON_F_NO_DATA_DICT)) {
+	heim_object_t v = heim_dict_copy_value(dict, heim_tid_data_uuid_key);
+
+	/*
+	 * Binary data encoded as a dict with a single magic key with
+	 * base64-encoded value?  Decode as heim_data_t.
+	 */
+	if (v != NULL && heim_get_tid(v) == HEIM_TID_STRING) {
+	    void *buf;
+	    size_t len;
+
+	    buf = malloc(strlen(heim_string_get_utf8(v)));
+	    if (buf == NULL) {
+		heim_release(dict);
+		heim_release(v);
+		ctx->error = heim_error_create_enomem();
+		return NULL;
+	    }
+	    len = rk_base64_decode(heim_string_get_utf8(v), buf);
+	    heim_release(v);
+	    if (len == -1) {
+		free(buf);
+		return dict; /* assume aliasing accident */
+	    }
+	    heim_release(dict);
+	    return (heim_dict_t)heim_data_ref_create(buf, len, free);
+	}
+    }
+    return dict;
+}
+
+static int
+parse_item(heim_array_t array, struct parse_ctx *ctx)
+{
+    heim_object_t value;
+
+    if (white_spaces(ctx))
+	return -1;
+
+    if (*ctx->p == ']') {
+	ctx->p++; /* safe because parse_value() calls white_spaces() first */
+	return 0;
+    }
+
+    value = parse_value(ctx);
+    if (value == NULL &&
+	(ctx->error || (ctx->flags & HEIM_JSON_F_NO_C_NULL)))
+	return -1;
+
+    heim_array_append_value(array, value);
+    heim_release(value);
+
+    if (white_spaces(ctx))
+	return -1;
+
+    if (*ctx->p == ']') {
+	ctx->p++;
+	return 0;
+    } else if (*ctx->p == ',') {
+	ctx->p++;
+	return 1;
+    }
+    return -1;
+}
+
+static heim_array_t
+parse_array(struct parse_ctx *ctx)
+{
+    heim_array_t array = heim_array_create();
+    int ret;
+
+    heim_assert(*ctx->p == '[', "array doesn't start with [");
+    ctx->p += 1;
+
+    while ((ret = parse_item(array, ctx)) > 0)
+	;
+    if (ret < 0) {
+	heim_release(array);
+	return NULL;
+    }
+    return array;
+}
+
+static heim_object_t
+parse_value(struct parse_ctx *ctx)
+{
+    size_t len;
+    heim_object_t o;
+
+    if (white_spaces(ctx))
+	return NULL;
+
+    if (*ctx->p == '"') {
+	return parse_string(ctx);
+    } else if (*ctx->p == '{') {
+	if (ctx->depth-- == 1) {
+	    ctx->error = heim_error_create(EINVAL, "JSON object too deep");
+	    return NULL;
+	}
+	o = parse_dict(ctx);
+	ctx->depth++;
+	return o;
+    } else if (*ctx->p == '[') {
+	if (ctx->depth-- == 1) {
+	    ctx->error = heim_error_create(EINVAL, "JSON object too deep");
+	    return NULL;
+	}
+	o = parse_array(ctx);
+	ctx->depth++;
+	return o;
+    } else if (is_number(*ctx->p) || *ctx->p == '-') {
+	return parse_number(ctx);
+    }
+
+    len = ctx->pend - ctx->p;
+
+    if ((ctx->flags & HEIM_JSON_F_NO_C_NULL) == 0 &&
+	len >= 6 && memcmp(ctx->p, "<NULL>", 6) == 0) {
+	ctx->p += 6;
+	return heim_null_create();
+    } else if (len >= 4 && memcmp(ctx->p, "null", 4) == 0) {
+	ctx->p += 4;
+	return heim_null_create();
+    } else if (len >= 4 && strncasecmp((char *)ctx->p, "true", 4) == 0) {
+	ctx->p += 4;
+	return heim_bool_create(1);
+    } else if (len >= 5 && strncasecmp((char *)ctx->p, "false", 5) == 0) {
+	ctx->p += 5;
+	return heim_bool_create(0);
+    }
+
+    ctx->error = heim_error_create(EINVAL, "unknown char %c at %lu line %lu",
+				   (char)*ctx->p, 
+				   (unsigned long)(ctx->p - ctx->pstart),
+				   ctx->lineno);
+    return NULL;
+}
+
+
+heim_object_t
+heim_json_create(const char *string, size_t max_depth, heim_json_flags_t flags,
+		 heim_error_t *error)
+{
+    return heim_json_create_with_bytes(string, strlen(string), max_depth, flags,
+				       error);
+}
+
+heim_object_t
+heim_json_create_with_bytes(const void *data, size_t length, size_t max_depth,
+			    heim_json_flags_t flags, heim_error_t *error)
+{
+    struct parse_ctx ctx;
+    heim_object_t o;
+
+    heim_base_once_f(&heim_json_once, NULL, json_init_once);
+
+    ctx.lineno = 1;
+    ctx.p = data;
+    ctx.pstart = data;
+    ctx.pend = ((uint8_t *)data) + length;
+    ctx.error = NULL;
+    ctx.flags = flags;
+    ctx.depth = max_depth;
+
+    o = parse_value(&ctx);
+
+    if (o == NULL && error) {
+	*error = ctx.error;
+    } else if (ctx.error) {
+	heim_release(ctx.error);
+    }
+
+    return o;
+}
+
+
+static void
+show_printf(void *ctx, const char *str)
+{
+    if (str == NULL)
+	return;
+    fprintf(ctx, "%s", str);
+}
+
+/**
+ * Dump a heimbase object to stderr (useful from the debugger!)
+ *
+ * @param obj object to dump using JSON or JSON-like format
+ *
+ * @addtogroup heimbase
+ */
+void
+heim_show(heim_object_t obj)
+{
+    heim_base2json(obj, stderr, HEIM_JSON_F_NO_DATA_DICT, show_printf);
+}
+
+static void
+strbuf_add(void *ctx, const char *str)
+{
+    struct heim_strbuf *strbuf = ctx;
+    size_t len;
+
+    if (strbuf->enomem)
+	return;
+
+    if (str == NULL) {
+	/*
+	 * Eat the last '\n'; this is used when formatting dict pairs
+	 * and array items so that the ',' separating them is never
+	 * preceded by a '\n'.
+	 */
+	if (strbuf->len > 0 && strbuf->str[strbuf->len - 1] == '\n')
+	    strbuf->len--;
+	return;
+    }
+
+    len = strlen(str);
+    if ((len + 1) > (strbuf->alloced - strbuf->len)) {
+	size_t new_len = strbuf->alloced + (strbuf->alloced >> 2) + len + 1;
+	char *s;
+
+	s = realloc(strbuf->str, new_len);
+	if (s == NULL) {
+	    strbuf->enomem = 1;
+	    return;
+	}
+	strbuf->str = s;
+	strbuf->alloced = new_len;
+    }
+    /* +1 so we copy the NUL */
+    (void) memcpy(strbuf->str + strbuf->len, str, len + 1);
+    strbuf->len += len;
+    if (strbuf->str[strbuf->len - 1] == '\n' && 
+	strbuf->flags & HEIM_JSON_F_ONE_LINE)
+	strbuf->len--;
+}
+
+#define STRBUF_INIT_SZ 64
+
+heim_string_t
+heim_json_copy_serialize(heim_object_t obj, heim_json_flags_t flags, heim_error_t *error)
+{
+    heim_string_t str;
+    struct heim_strbuf strbuf;
+    int ret;
+
+    if (error)
+	*error = NULL;
+
+    memset(&strbuf, 0, sizeof (strbuf));
+    strbuf.str = malloc(STRBUF_INIT_SZ);
+    if (strbuf.str == NULL) {
+	if (error)
+	    *error = heim_error_create_enomem();
+	return NULL;
+    }
+    strbuf.len = 0;
+    strbuf.alloced = STRBUF_INIT_SZ;
+    strbuf.str[0] = '\0';
+    strbuf.flags = flags;
+
+    ret = heim_base2json(obj, &strbuf, flags, strbuf_add);
+    if (ret || strbuf.enomem) {
+	if (error) {
+	    if (strbuf.enomem || ret == ENOMEM)
+		*error = heim_error_create_enomem();
+	    else
+		*error = heim_error_create(1, "Impossible to JSON-encode "
+					   "object");
+	}
+	free(strbuf.str);
+	return NULL;
+    }
+    if (flags & HEIM_JSON_F_ONE_LINE) {
+	strbuf.flags &= ~HEIM_JSON_F_ONE_LINE;
+	strbuf_add(&strbuf, "\n");
+    }
+    str = heim_string_ref_create(strbuf.str, free);
+    if (str == NULL) {
+	if (error)
+	    *error = heim_error_create_enomem();
+	free(strbuf.str);
+    }
+    return str;
+}
diff --git a/crypto/external/bsd/heimdal/dist/base/null.c b/crypto/external/bsd/heimdal/dist/lib/base/null.c
similarity index 96%
rename from crypto/external/bsd/heimdal/dist/base/null.c
rename to crypto/external/bsd/heimdal/dist/lib/base/null.c
index b602bf665..0c3baeb16 100644
--- a/crypto/external/bsd/heimdal/dist/base/null.c
+++ b/crypto/external/bsd/heimdal/dist/lib/base/null.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: null.c,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: null.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -44,6 +44,7 @@ struct heim_type_data _heim_null_object = {
     NULL,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
diff --git a/crypto/external/bsd/heimdal/dist/base/number.c b/crypto/external/bsd/heimdal/dist/lib/base/number.c
similarity index 97%
rename from crypto/external/bsd/heimdal/dist/base/number.c
rename to crypto/external/bsd/heimdal/dist/lib/base/number.c
index 3c3aa3d27..59da0b288 100644
--- a/crypto/external/bsd/heimdal/dist/base/number.c
+++ b/crypto/external/bsd/heimdal/dist/lib/base/number.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: number.c,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: number.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -75,7 +75,8 @@ struct heim_type_data _heim_number_object = {
     number_dealloc,
     NULL,
     number_cmp,
-    number_hash
+    number_hash,
+    NULL
 };
 
 /**
diff --git a/crypto/external/bsd/heimdal/dist/base/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/base/roken_rename.h
similarity index 91%
rename from crypto/external/bsd/heimdal/dist/base/roken_rename.h
rename to crypto/external/bsd/heimdal/dist/lib/base/roken_rename.h
index 79b76f21e..bd95fae18 100644
--- a/crypto/external/bsd/heimdal/dist/base/roken_rename.h
+++ b/crypto/external/bsd/heimdal/dist/lib/base/roken_rename.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_rename.h,v 1.1.1.2 2011/04/14 14:08:07 elric Exp $	*/
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
@@ -38,9 +38,6 @@
 #ifndef __heimbase_roken_rename_h__
 #define __heimbase_roken_rename_h__
 
-#ifndef HAVE_SNPRINTF
-#define rk_snprintf heimbase_snprintf
-#endif
 #ifndef HAVE_VSNPRINTF
 #define rk_vsnprintf heimbase_vsnprintf
 #endif
@@ -56,5 +53,11 @@
 #ifndef HAVE_VASNPRINTF
 #define rk_vasnprintf heimbase_vasnprintf
 #endif
+#ifndef HAVE_STRDUP
+#define rk_strdup heimbase_strdup
+#endif
+#ifndef HAVE_STRNDUP
+#define rk_strndup heimbase_strndup
+#endif
 
 #endif /* __heimbase_roken_rename_h__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/string.c b/crypto/external/bsd/heimdal/dist/lib/base/string.c
new file mode 100644
index 000000000..2eea72b68
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/string.c
@@ -0,0 +1,262 @@
+/*	$NetBSD: string.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "baselocl.h"
+#include <string.h>
+
+static void
+string_dealloc(void *ptr)
+{
+    heim_string_t s = ptr;
+    heim_string_free_f_t *deallocp;
+    heim_string_free_f_t dealloc;
+
+    if (*(const char *)ptr != '\0')
+	return;
+
+    /* Possible string ref */
+    deallocp = _heim_get_isaextra(s, 0);
+    dealloc = *deallocp;
+    if (dealloc != NULL) {
+	char **strp = _heim_get_isaextra(s, 1);
+	dealloc(*strp);
+    }
+}
+
+static int
+string_cmp(void *a, void *b)
+{
+    if (*(char *)a == '\0') {
+	char **strp = _heim_get_isaextra(a, 1);
+
+	if (*strp != NULL)
+	    a = *strp; /* a is a string ref */
+    }
+    if (*(char *)b == '\0') {
+	char **strp = _heim_get_isaextra(b, 1);
+
+	if (*strp != NULL)
+	    b = *strp; /* b is a string ref */
+    }
+    return strcmp(a, b);
+}
+
+static unsigned long
+string_hash(void *ptr)
+{
+    const char *s = ptr;
+    unsigned long n;
+
+    for (n = 0; *s; ++s)
+	n += *s;
+    return n;
+}
+
+struct heim_type_data _heim_string_object = {
+    HEIM_TID_STRING,
+    "string-object",
+    NULL,
+    string_dealloc,
+    NULL,
+    string_cmp,
+    string_hash,
+    NULL
+};
+
+/**
+ * Create a string object
+ *
+ * @param string the string to create, must be an utf8 string
+ *
+ * @return string object
+ */
+
+heim_string_t
+heim_string_create(const char *string)
+{
+    return heim_string_create_with_bytes(string, strlen(string));
+}
+
+/**
+ * Create a string object without copying the source.
+ *
+ * @param string the string to referenced, must be UTF-8
+ * @param dealloc the function to use to release the referece to the string
+ *
+ * @return string object
+ */
+
+heim_string_t
+heim_string_ref_create(const char *string, heim_string_free_f_t dealloc)
+{
+    heim_string_t s;
+    heim_string_free_f_t *deallocp;
+
+    s = _heim_alloc_object(&_heim_string_object, 1);
+    if (s) {
+	const char **strp;
+
+	((char *)s)[0] = '\0';
+	deallocp = _heim_get_isaextra(s, 0);
+	*deallocp = dealloc;
+	strp = _heim_get_isaextra(s, 1);
+	*strp = string;
+    }
+    return s;
+}
+
+/**
+ * Create a string object
+ *
+ * @param string the string to create, must be an utf8 string
+ * @param len the length of the string
+ *
+ * @return string object
+ */
+
+heim_string_t
+heim_string_create_with_bytes(const void *data, size_t len)
+{
+    heim_string_t s;
+
+    s = _heim_alloc_object(&_heim_string_object, len + 1);
+    if (s) {
+	memcpy(s, data, len);
+	((char *)s)[len] = '\0';
+    }
+    return s;
+}
+
+/**
+ * Create a string object using a format string
+ *
+ * @param fmt format string
+ * @param ...
+ *
+ * @return string object
+ */
+
+heim_string_t
+heim_string_create_with_format(const char *fmt, ...)
+{
+    heim_string_t s;
+    char *str = NULL;
+    va_list ap;
+    int ret;
+
+    va_start(ap, fmt);
+    ret = vasprintf(&str, fmt, ap);
+    va_end(ap);
+    if (ret < 0 || str == NULL)
+	return NULL;
+
+    s = heim_string_ref_create(str, string_dealloc);
+    if (s == NULL)
+	free(str);
+    return s;
+}
+
+/**
+ * Return the type ID of string objects
+ *
+ * @return type id of string objects
+ */
+
+heim_tid_t
+heim_string_get_type_id(void)
+{
+    return HEIM_TID_STRING;
+}
+
+/**
+ * Get the string value of the content.
+ *
+ * @param string the string object to get the value from
+ *
+ * @return a utf8 string
+ */
+
+const char *
+heim_string_get_utf8(heim_string_t string)
+{
+    if (*(const char *)string == '\0') {
+	const char **strp;
+
+	/* String ref */
+	strp = _heim_get_isaextra(string, 1);
+	if (*strp != NULL)
+	    return *strp;
+    }
+    return (const char *)string;
+}
+
+/*
+ *
+ */
+
+static void
+init_string(void *ptr)
+{
+    heim_dict_t *dict = ptr;
+    *dict = heim_dict_create(101);
+    heim_assert(*dict != NULL, "__heim_string_constant");
+}
+
+heim_string_t
+__heim_string_constant(const char *_str)
+{
+    static HEIMDAL_MUTEX mutex = HEIMDAL_MUTEX_INITIALIZER;
+    static heim_base_once_t once;
+    static heim_dict_t dict = NULL;
+    heim_string_t s, s2;
+
+    heim_base_once_f(&once, &dict, init_string);
+    s = heim_string_create(_str);
+
+    HEIMDAL_MUTEX_lock(&mutex);
+    s2 = heim_dict_get_value(dict, s);
+    if (s2) {
+	heim_release(s);
+	s = s2;
+    } else {
+	_heim_make_permanent(s);
+	heim_dict_set_value(dict, s, s);
+    }
+    HEIMDAL_MUTEX_unlock(&mutex);
+
+    return s;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/test_base.c b/crypto/external/bsd/heimdal/dist/lib/base/test_base.c
new file mode 100644
index 000000000..58437348d
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/test_base.c
@@ -0,0 +1,963 @@
+/*	$NetBSD: test_base.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
+
+/*
+ * Copyright (c) 2010-2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * This is a test of libheimbase functionality.  If you make any changes
+ * to libheimbase or to this test you should run it under valgrind with
+ * the following options:
+ *
+ *  -v --track-fds=yes --num-callers=30 --leak-check=full
+ *  
+ * and make sure that there are no leaks that don't have
+ * __heim_string_constant() or heim_db_register() in their stack trace.
+ */
+
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#ifndef WIN32
+#include <sys/file.h>
+#endif
+#ifdef HAVE_IO_H
+#include <io.h>
+#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#include <fcntl.h>
+
+#include "baselocl.h"
+
+static void
+memory_free(heim_object_t obj)
+{
+}
+
+static int
+test_memory(void)
+{
+    void *ptr;
+
+    ptr = heim_alloc(10, "memory", memory_free);
+
+    heim_retain(ptr);
+    heim_release(ptr);
+
+    heim_retain(ptr);
+    heim_release(ptr);
+
+    heim_release(ptr);
+
+    ptr = heim_alloc(10, "memory", NULL);
+    heim_release(ptr);
+
+    return 0;
+}
+
+static int
+test_mutex(void)
+{
+    HEIMDAL_MUTEX m = HEIMDAL_MUTEX_INITIALIZER;
+
+    HEIMDAL_MUTEX_lock(&m);
+    HEIMDAL_MUTEX_unlock(&m);
+    HEIMDAL_MUTEX_destroy(&m);
+
+    HEIMDAL_MUTEX_init(&m);
+    HEIMDAL_MUTEX_lock(&m);
+    HEIMDAL_MUTEX_unlock(&m);
+    HEIMDAL_MUTEX_destroy(&m);
+
+    return 0;
+}
+
+static int
+test_rwlock(void)
+{
+    HEIMDAL_RWLOCK l = HEIMDAL_RWLOCK_INITIALIZER;
+
+    HEIMDAL_RWLOCK_rdlock(&l);
+    HEIMDAL_RWLOCK_unlock(&l);
+    HEIMDAL_RWLOCK_wrlock(&l);
+    HEIMDAL_RWLOCK_unlock(&l);
+    if (HEIMDAL_RWLOCK_trywrlock(&l) != 0)
+	err(1, "HEIMDAL_RWLOCK_trywrlock() failed with lock not held");
+    HEIMDAL_RWLOCK_unlock(&l);
+    if (HEIMDAL_RWLOCK_tryrdlock(&l))
+	err(1, "HEIMDAL_RWLOCK_tryrdlock() failed with lock not held");
+    HEIMDAL_RWLOCK_unlock(&l);
+    HEIMDAL_RWLOCK_destroy(&l);
+
+    HEIMDAL_RWLOCK_init(&l);
+    HEIMDAL_RWLOCK_rdlock(&l);
+    HEIMDAL_RWLOCK_unlock(&l);
+    HEIMDAL_RWLOCK_wrlock(&l);
+    HEIMDAL_RWLOCK_unlock(&l);
+    if (HEIMDAL_RWLOCK_trywrlock(&l))
+	err(1, "HEIMDAL_RWLOCK_trywrlock() failed with lock not held");
+    HEIMDAL_RWLOCK_unlock(&l);
+    if (HEIMDAL_RWLOCK_tryrdlock(&l))
+	err(1, "HEIMDAL_RWLOCK_tryrdlock() failed with lock not held");
+    HEIMDAL_RWLOCK_unlock(&l);
+    HEIMDAL_RWLOCK_destroy(&l);
+
+    return 0;
+}
+
+static int
+test_dict(void)
+{
+    heim_dict_t dict;
+    heim_number_t a1 = heim_number_create(1);
+    heim_string_t a2 = heim_string_create("hejsan");
+    heim_number_t a3 = heim_number_create(3);
+    heim_string_t a4 = heim_string_create("foosan");
+
+    dict = heim_dict_create(10);
+
+    heim_dict_set_value(dict, a1, a2);
+    heim_dict_set_value(dict, a3, a4);
+
+    heim_dict_delete_key(dict, a3);
+    heim_dict_delete_key(dict, a1);
+
+    heim_release(a1);
+    heim_release(a2);
+    heim_release(a3);
+    heim_release(a4);
+
+    heim_release(dict);
+
+    return 0;
+}
+
+static int
+test_auto_release(void)
+{
+    heim_auto_release_t ar1, ar2;
+    heim_number_t n1;
+    heim_string_t s1;
+
+    ar1 = heim_auto_release_create();
+
+    s1 = heim_string_create("hejsan");
+    heim_auto_release(s1);
+
+    n1 = heim_number_create(1);
+    heim_auto_release(n1);
+
+    ar2 = heim_auto_release_create();
+
+    n1 = heim_number_create(1);
+    heim_auto_release(n1);
+
+    heim_release(ar2);
+    heim_release(ar1);
+
+    return 0;
+}
+
+static int
+test_string(void)
+{
+    heim_string_t s1, s2;
+    const char *string = "hejsan";
+
+    s1 = heim_string_create(string);
+    s2 = heim_string_create(string);
+
+    if (heim_cmp(s1, s2) != 0) {
+	printf("the same string is not the same\n");
+	exit(1);
+    }
+
+    heim_release(s1);
+    heim_release(s2);
+
+    return 0;
+}
+
+static int
+test_error(void)
+{
+    heim_error_t e;
+    heim_string_t s;
+
+    e = heim_error_create(10, "foo: %s", "bar");
+    heim_assert(heim_error_get_code(e) == 10, "error_code != 10");
+
+    s = heim_error_copy_string(e);
+    heim_assert(strcmp(heim_string_get_utf8(s), "foo: bar") == 0, "msg wrong");
+
+    heim_release(s);
+    heim_release(e);
+
+    return 0;
+}
+
+static int
+test_json(void)
+{
+    static char *j[] = {
+	"{ \"k1\" : \"s1\", \"k2\" : \"s2\" }",
+	"{ \"k1\" : [\"s1\", \"s2\", \"s3\"], \"k2\" : \"s3\" }",
+	"{ \"k1\" : {\"k2\":\"s1\",\"k3\":\"s2\",\"k4\":\"s3\"}, \"k5\" : \"s4\" }",
+	"[ \"v1\", \"v2\", [\"v3\",\"v4\",[\"v 5\",\" v 7 \"]], -123456789, "
+	    "null, true, false, 123456789, \"\"]",
+	" -1"
+    };
+    char *s;
+    size_t i, k;
+    heim_object_t o, o2;
+    heim_string_t k1 = heim_string_create("k1");
+
+    o = heim_json_create("\"string\"", 10, 0, NULL);
+    heim_assert(o != NULL, "string");
+    heim_assert(heim_get_tid(o) == heim_string_get_type_id(), "string-tid");
+    heim_assert(strcmp("string", heim_string_get_utf8(o)) == 0, "wrong string");
+    heim_release(o);
+
+    o = heim_json_create(" \"foo\\\"bar\" ]", 10, 0, NULL);
+    heim_assert(o != NULL, "string");
+    heim_assert(heim_get_tid(o) == heim_string_get_type_id(), "string-tid");
+    heim_assert(strcmp("foo\"bar", heim_string_get_utf8(o)) == 0, "wrong string");
+    heim_release(o);
+
+    o = heim_json_create(" { \"key\" : \"value\" }", 10, 0, NULL);
+    heim_assert(o != NULL, "dict");
+    heim_assert(heim_get_tid(o) == heim_dict_get_type_id(), "dict-tid");
+    heim_release(o);
+
+    o = heim_json_create("{ { \"k1\" : \"s1\", \"k2\" : \"s2\" } : \"s3\", "
+			 "{ \"k3\" : \"s4\" } : -1 }", 10, 0, NULL);
+    heim_assert(o != NULL, "dict");
+    heim_assert(heim_get_tid(o) == heim_dict_get_type_id(), "dict-tid");
+    heim_release(o);
+
+    o = heim_json_create("{ { \"k1\" : \"s1\", \"k2\" : \"s2\" } : \"s3\", "
+			 "{ \"k3\" : \"s4\" } : -1 }", 10,
+			 HEIM_JSON_F_STRICT_DICT, NULL);
+    heim_assert(o == NULL, "dict");
+
+    o = heim_json_create(" { \"k1\" : \"s1\", \"k2\" : \"s2\" }", 10, 0, NULL);
+    heim_assert(o != NULL, "dict");
+    heim_assert(heim_get_tid(o) == heim_dict_get_type_id(), "dict-tid");
+    o2 = heim_dict_copy_value(o, k1);
+    heim_assert(heim_get_tid(o2) == heim_string_get_type_id(), "string-tid");
+    heim_release(o2);
+    heim_release(o);
+
+    o = heim_json_create(" { \"k1\" : { \"k2\" : \"s2\" } }", 10, 0, NULL);
+    heim_assert(o != NULL, "dict");
+    heim_assert(heim_get_tid(o) == heim_dict_get_type_id(), "dict-tid");
+    o2 = heim_dict_copy_value(o, k1);
+    heim_assert(heim_get_tid(o2) == heim_dict_get_type_id(), "dict-tid");
+    heim_release(o2);
+    heim_release(o);
+
+    o = heim_json_create("{ \"k1\" : 1 }", 10, 0, NULL);
+    heim_assert(o != NULL, "array");
+    heim_assert(heim_get_tid(o) == heim_dict_get_type_id(), "dict-tid");
+    o2 = heim_dict_copy_value(o, k1);
+    heim_assert(heim_get_tid(o2) == heim_number_get_type_id(), "number-tid");
+    heim_release(o2);
+    heim_release(o);
+
+    o = heim_json_create("-10", 10, 0, NULL);
+    heim_assert(o != NULL, "number");
+    heim_assert(heim_get_tid(o) == heim_number_get_type_id(), "number-tid");
+    heim_release(o);
+
+    o = heim_json_create("99", 10, 0, NULL);
+    heim_assert(o != NULL, "number");
+    heim_assert(heim_get_tid(o) == heim_number_get_type_id(), "number-tid");
+    heim_release(o);
+
+    o = heim_json_create(" [ 1 ]", 10, 0, NULL);
+    heim_assert(o != NULL, "array");
+    heim_assert(heim_get_tid(o) == heim_array_get_type_id(), "array-tid");
+    heim_release(o);
+
+    o = heim_json_create(" [ -1 ]", 10, 0, NULL);
+    heim_assert(o != NULL, "array");
+    heim_assert(heim_get_tid(o) == heim_array_get_type_id(), "array-tid");
+    heim_release(o);
+
+    for (i = 0; i < (sizeof (j) / sizeof (j[0])); i++) {
+	o = heim_json_create(j[i], 10, 0, NULL);
+	if (o == NULL) {
+	    fprintf(stderr, "Failed to parse this JSON: %s\n", j[i]);
+	    return 1;
+	}
+	heim_release(o);
+	/* Simple fuzz test */
+	for (k = strlen(j[i]) - 1; k > 0; k--) {
+	    o = heim_json_create_with_bytes(j[i], k, 10, 0, NULL);
+	    if (o != NULL) {
+		fprintf(stderr, "Invalid JSON parsed: %.*s\n", (int)k, j[i]);
+		return EINVAL;
+	    }
+	}
+	/* Again, but this time make it so valgrind can find invalid accesses */
+	for (k = strlen(j[i]) - 1; k > 0; k--) {
+	    s = strndup(j[i], k);
+	    if (s == NULL)
+		return ENOMEM;
+	    o = heim_json_create(s, 10, 0, NULL);
+	    free(s);
+	    if (o != NULL) {
+		fprintf(stderr, "Invalid JSON parsed: %s\n", j[i]);
+		return EINVAL;
+	    }
+	}
+	/* Again, but with no NUL termination */
+	for (k = strlen(j[i]) - 1; k > 0; k--) {
+	    s = malloc(k);
+	    if (s == NULL)
+		return ENOMEM;
+	    memcpy(s, j[i], k);
+	    o = heim_json_create_with_bytes(s, k, 10, 0, NULL);
+	    free(s);
+	    if (o != NULL) {
+		fprintf(stderr, "Invalid JSON parsed: %s\n", j[i]);
+		return EINVAL;
+	    }
+	}
+    }
+
+    heim_release(k1);
+
+    return 0;
+}
+
+static int
+test_path(void)
+{
+    heim_dict_t dict = heim_dict_create(11);
+    heim_string_t p1 = heim_string_create("abc");
+    heim_string_t p2a = heim_string_create("def");
+    heim_string_t p2b = heim_string_create("DEF");
+    heim_number_t p3 = heim_number_create(0);
+    heim_string_t p4a = heim_string_create("ghi");
+    heim_string_t p4b = heim_string_create("GHI");
+    heim_array_t a = heim_array_create();
+    heim_number_t l1 = heim_number_create(42);
+    heim_number_t l2 = heim_number_create(813);
+    heim_number_t l3 = heim_number_create(1234);
+    heim_string_t k1 = heim_string_create("k1");
+    heim_string_t k2 = heim_string_create("k2");
+    heim_string_t k3 = heim_string_create("k3");
+    heim_string_t k2_1 = heim_string_create("k2-1");
+    heim_string_t k2_2 = heim_string_create("k2-2");
+    heim_string_t k2_3 = heim_string_create("k2-3");
+    heim_string_t k2_4 = heim_string_create("k2-4");
+    heim_string_t k2_5 = heim_string_create("k2-5");
+    heim_string_t k2_5_1 = heim_string_create("k2-5-1");
+    heim_object_t o;
+    heim_object_t neg_num;
+    int ret;
+
+    if (!dict || !p1 || !p2a || !p2b || !p4a || !p4b)
+	return ENOMEM;
+
+    ret = heim_path_create(dict, 11, a, NULL, p1, p2a, NULL);
+    heim_release(a);
+    if (ret)
+	return ret;
+    ret = heim_path_create(dict, 11, l3, NULL, p1, p2b, NULL);
+    if (ret)
+	return ret;
+    o = heim_path_get(dict, NULL, p1, p2b, NULL);
+    if (o != l3)
+	return 1;
+    ret = heim_path_create(dict, 11, NULL, NULL, p1, p2a, p3, NULL);
+    if (ret)
+	return ret;
+    ret = heim_path_create(dict, 11, l1, NULL, p1, p2a, p3, p4a, NULL);
+    if (ret)
+	return ret;
+    ret = heim_path_create(dict, 11, l2, NULL, p1, p2a, p3, p4b, NULL);
+    if (ret)
+	return ret;
+
+    o = heim_path_get(dict, NULL, p1, p2a, p3, p4a, NULL);
+    if (o != l1)
+	return 1;
+    o = heim_path_get(dict, NULL, p1, p2a, p3, p4b, NULL);
+    if (o != l2)
+	return 1;
+
+    heim_release(dict);
+
+    /* Test that JSON parsing works right by using heim_path_get() */
+    dict = heim_json_create("{\"k1\":1,"
+			    "\"k2\":{\"k2-1\":21,"
+				    "\"k2-2\":null,"
+				    "\"k2-3\":true,"
+				    "\"k2-4\":false,"
+				    "\"k2-5\":[1,2,3,{\"k2-5-1\":-1},-2]},"
+			    "\"k3\":[true,false,0,42]}", 10, 0, NULL);
+    heim_assert(dict != NULL, "dict");
+    o = heim_path_get(dict, NULL, k1, NULL);
+    if (heim_cmp(o, heim_number_create(1))) return 1;
+    o = heim_path_get(dict, NULL, k2, NULL);
+    if (heim_get_tid(o) != heim_dict_get_type_id()) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_1, NULL);
+    if (heim_cmp(o, heim_number_create(21))) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_2, NULL);
+    if (heim_cmp(o, heim_null_create())) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_3, NULL);
+    if (heim_cmp(o, heim_bool_create(1))) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_4, NULL);
+    if (heim_cmp(o, heim_bool_create(0))) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_5, NULL);
+    if (heim_get_tid(o) != heim_array_get_type_id()) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_5, heim_number_create(0), NULL);
+    if (heim_cmp(o, heim_number_create(1))) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_5, heim_number_create(1), NULL);
+    if (heim_cmp(o, heim_number_create(2))) return 1;
+    o = heim_path_get(dict, NULL, k2, k2_5, heim_number_create(3), k2_5_1, NULL);
+    if (heim_cmp(o, neg_num = heim_number_create(-1))) return 1;
+    heim_release(neg_num);
+    o = heim_path_get(dict, NULL, k2, k2_5, heim_number_create(4), NULL);
+    if (heim_cmp(o, neg_num = heim_number_create(-2))) return 1;
+    heim_release(neg_num);
+    o = heim_path_get(dict, NULL, k3, heim_number_create(3), NULL);
+    if (heim_cmp(o, heim_number_create(42))) return 1;
+
+    heim_release(dict);
+    heim_release(p1);
+    heim_release(p2a);
+    heim_release(p2b);
+    heim_release(p4a);
+    heim_release(p4b);
+    heim_release(k1);
+    heim_release(k2);
+    heim_release(k3);
+    heim_release(k2_1);
+    heim_release(k2_2);
+    heim_release(k2_3);
+    heim_release(k2_4);
+    heim_release(k2_5);
+    heim_release(k2_5_1);
+
+    return 0;
+}
+
+typedef struct dict_db {
+    heim_dict_t dict;
+    int locked;
+} *dict_db_t;
+
+static int
+dict_db_open(void *plug, const char *dbtype, const char *dbname,
+	     heim_dict_t options, void **db, heim_error_t *error)
+{
+    dict_db_t dictdb;
+    heim_dict_t contents = NULL;
+
+    if (error)
+	*error = NULL;
+    if (dbtype && *dbtype && strcmp(dbtype, "dictdb"))
+	return EINVAL;
+    if (dbname && *dbname && strcmp(dbname, "MEMORY") != 0)
+	return EINVAL;
+    dictdb = heim_alloc(sizeof (*dictdb), "dict_db", NULL);
+    if (dictdb == NULL)
+	return ENOMEM;
+
+    if (contents != NULL)
+	dictdb->dict = contents;
+    else {
+	dictdb->dict = heim_dict_create(29);
+	if (dictdb->dict == NULL) {
+	    heim_release(dictdb);
+	    return ENOMEM;
+	}
+    }
+
+    *db = dictdb;
+    return 0;
+}
+
+static int
+dict_db_close(void *db, heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+    heim_release(dictdb->dict);
+    heim_release(dictdb);
+    return 0;
+}
+
+static int
+dict_db_lock(void *db, int read_only, heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+    if (dictdb->locked)
+	return EWOULDBLOCK;
+    dictdb->locked = 1;
+    return 0;
+}
+
+static int
+dict_db_unlock(void *db, heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+    dictdb->locked = 0;
+    return 0;
+}
+
+static heim_data_t
+dict_db_copy_value(void *db, heim_string_t table, heim_data_t key,
+		  heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+
+    return heim_retain(heim_path_get(dictdb->dict, error, table, key, NULL));
+}
+
+static int
+dict_db_set_value(void *db, heim_string_t table,
+		  heim_data_t key, heim_data_t value, heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    return heim_path_create(dictdb->dict, 29, value, error, table, key, NULL);
+}
+
+static int
+dict_db_del_key(void *db, heim_string_t table, heim_data_t key,
+		heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+
+    if (error)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    heim_path_delete(dictdb->dict, error, table, key, NULL);
+    return 0;
+}
+
+struct dict_db_iter_ctx {
+    heim_db_iterator_f_t        iter_f;
+    void                        *iter_ctx;
+};
+
+static void dict_db_iter_f(heim_object_t key, heim_object_t value, void *arg)
+{
+    struct dict_db_iter_ctx *ctx = arg;
+
+    ctx->iter_f((heim_object_t)key, (heim_object_t)value, ctx->iter_ctx);
+}
+
+static void
+dict_db_iter(void *db, heim_string_t table, void *iter_data,
+	     heim_db_iterator_f_t iter_f, heim_error_t *error)
+{
+    dict_db_t dictdb = db;
+    struct dict_db_iter_ctx ctx;
+    heim_dict_t table_dict;
+
+    if (error)
+	*error = NULL;
+
+    if (table == NULL)
+	table = HSTR("");
+
+    table_dict = heim_dict_copy_value(dictdb->dict, table);
+    if (table_dict == NULL)
+	return;
+
+    ctx.iter_ctx = iter_data;
+    ctx.iter_f = iter_f;
+
+    heim_dict_iterate_f(table_dict, &ctx, dict_db_iter_f);
+    heim_release(table_dict);
+}
+
+static void
+test_db_iter(heim_data_t k, heim_data_t v, void *arg)
+{
+    int *ret = arg;
+    const void *kptr, *vptr;
+    size_t klen, vlen;
+
+    heim_assert(heim_get_tid(k) == heim_data_get_type_id(), "...");
+
+    kptr = heim_data_get_ptr(k);
+    klen = heim_data_get_length(k);
+    vptr = heim_data_get_ptr(v);
+    vlen = heim_data_get_length(v);
+
+    if (klen == strlen("msg") && !strncmp(kptr, "msg", strlen("msg")) &&
+	vlen == strlen("abc") && !strncmp(vptr, "abc", strlen("abc")))
+	*ret &= ~(1);
+    else if (klen == strlen("msg2") &&
+	!strncmp(kptr, "msg2", strlen("msg2")) &&
+	vlen == strlen("FooBar") && !strncmp(vptr, "FooBar", strlen("FooBar")))
+	*ret &= ~(2);
+    else
+	*ret |= 4;
+}
+
+static struct heim_db_type dbt = {
+    1, dict_db_open, NULL, dict_db_close,
+    dict_db_lock, dict_db_unlock, NULL, NULL, NULL, NULL,
+    dict_db_copy_value, dict_db_set_value,
+    dict_db_del_key, dict_db_iter
+};
+
+static int
+test_db(const char *dbtype, const char *dbname)
+{
+    heim_data_t k1, k2, v, v1, v2, v3;
+    heim_db_t db;
+    int ret;
+
+    if (dbtype == NULL) {
+	ret = heim_db_register("dictdb", NULL, &dbt);
+	heim_assert(!ret, "...");
+	db = heim_db_create("dictdb", "foo", NULL, NULL);
+	heim_assert(!db, "...");
+	db = heim_db_create("foobar", "MEMORY", NULL, NULL);
+	heim_assert(!db, "...");
+	db = heim_db_create("dictdb", "MEMORY", NULL, NULL);
+	heim_assert(db, "...");
+    } else {
+	heim_dict_t options;
+
+	options = heim_dict_create(11);
+	if (options == NULL) return ENOMEM;
+	if (heim_dict_set_value(options, HSTR("journal-filename"),
+				HSTR("json-journal")))
+	    return ENOMEM;
+	if (heim_dict_set_value(options, HSTR("create"), heim_null_create()))
+	    return ENOMEM;
+	if (heim_dict_set_value(options, HSTR("truncate"), heim_null_create()))
+	    return ENOMEM;
+	db = heim_db_create(dbtype, dbname, options, NULL);
+	heim_assert(db, "...");
+	heim_release(options);
+    }
+
+    k1 = heim_data_create("msg", strlen("msg"));
+    k2 = heim_data_create("msg2", strlen("msg2"));
+    v1 = heim_data_create("Hello world!", strlen("Hello world!"));
+    v2 = heim_data_create("FooBar", strlen("FooBar"));
+    v3 = heim_data_create("abc", strlen("abc"));
+
+    ret = heim_db_set_value(db, NULL, k1, v1, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v1), "...");
+    heim_release(v);
+
+    ret = heim_db_set_value(db, NULL, k2, v2, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k2, NULL);
+    heim_assert(v && !heim_cmp(v, v2), "...");
+    heim_release(v);
+
+    ret = heim_db_set_value(db, NULL, k1, v3, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v3), "...");
+    heim_release(v);
+
+    ret = 3;
+    heim_db_iterate_f(db, NULL, &ret, test_db_iter, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_begin(db, 0, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_commit(db, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_begin(db, 0, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_rollback(db, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_begin(db, 0, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_set_value(db, NULL, k1, v1, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v1), "...");
+    heim_release(v);
+
+    ret = heim_db_rollback(db, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v3), "...");
+    heim_release(v);
+
+    ret = heim_db_begin(db, 0, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_set_value(db, NULL, k1, v1, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v1), "...");
+    heim_release(v);
+
+    ret = heim_db_commit(db, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v1), "...");
+    heim_release(v);
+
+    ret = heim_db_begin(db, 0, NULL);
+    heim_assert(!ret, "...");
+
+    ret = heim_db_delete_key(db, NULL, k1, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v == NULL, "...");
+    heim_release(v);
+
+    ret = heim_db_rollback(db, NULL);
+    heim_assert(!ret, "...");
+
+    v = heim_db_copy_value(db, NULL, k1, NULL);
+    heim_assert(v && !heim_cmp(v, v1), "...");
+    heim_release(v);
+
+    if (dbtype != NULL) {
+	heim_data_t k3 = heim_data_create("value-is-a-dict", strlen("value-is-a-dict"));
+	heim_dict_t vdict = heim_dict_create(11);
+	heim_db_t db2;
+
+	heim_assert(k3 && vdict, "...");
+	ret = heim_dict_set_value(vdict, HSTR("vdict-k1"), heim_number_create(11));
+	heim_assert(!ret, "...");
+	ret = heim_dict_set_value(vdict, HSTR("vdict-k2"), heim_null_create());
+	heim_assert(!ret, "...");
+	ret = heim_dict_set_value(vdict, HSTR("vdict-k3"), HSTR("a value"));
+	heim_assert(!ret, "...");
+	ret = heim_db_set_value(db, NULL, k3, (heim_data_t)vdict, NULL);
+	heim_assert(!ret, "...");
+
+	heim_release(vdict);
+
+	db2 = heim_db_create(dbtype, dbname, NULL, NULL);
+	heim_assert(db2, "...");
+
+	vdict = (heim_dict_t)heim_db_copy_value(db2, NULL, k3, NULL);
+	heim_release(db2);
+	heim_release(k3);
+	heim_assert(vdict, "...");
+	heim_assert(heim_get_tid(vdict) == heim_dict_get_type_id(), "...");
+
+	v = heim_dict_copy_value(vdict, HSTR("vdict-k1"));
+	heim_assert(v && !heim_cmp(v, heim_number_create(11)), "...");
+	heim_release(v);
+
+	v = heim_dict_copy_value(vdict, HSTR("vdict-k2"));
+	heim_assert(v && !heim_cmp(v, heim_null_create()), "...");
+	heim_release(v);
+
+	v = heim_dict_copy_value(vdict, HSTR("vdict-k3"));
+	heim_assert(v && !heim_cmp(v, HSTR("a value")), "...");
+	heim_release(v);
+
+	heim_release(vdict);
+    }
+
+    heim_release(db);
+    heim_release(k1);
+    heim_release(k2);
+    heim_release(v1);
+    heim_release(v2);
+    heim_release(v3);
+
+    return 0;
+}
+
+struct test_array_iter_ctx {
+    char buf[256];
+};
+
+static void test_array_iter(heim_object_t elt, void *arg, int *stop)
+{
+    struct test_array_iter_ctx *iter_ctx = arg;
+
+    strcat(iter_ctx->buf, heim_string_get_utf8((heim_string_t)elt));
+}
+
+static int
+test_array()
+{
+    struct test_array_iter_ctx iter_ctx;
+    heim_string_t s1 = heim_string_create("abc");
+    heim_string_t s2 = heim_string_create("def");
+    heim_string_t s3 = heim_string_create("ghi");
+    heim_string_t s4 = heim_string_create("jkl");
+    heim_string_t s5 = heim_string_create("mno");
+    heim_string_t s6 = heim_string_create("pqr");
+    heim_array_t a = heim_array_create();
+
+    if (!s1 || !s2 || !s3 || !s4 || !s5 || !s6 || !a)
+	return ENOMEM;
+
+    heim_array_append_value(a, s4);
+    heim_array_append_value(a, s5);
+    heim_array_insert_value(a, 0, s3);
+    heim_array_insert_value(a, 0, s2);
+    heim_array_append_value(a, s6);
+    heim_array_insert_value(a, 0, s1);
+
+    iter_ctx.buf[0] = '\0';
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "abcdefghijklmnopqr") != 0)
+	return 1;
+
+    iter_ctx.buf[0] = '\0';
+    heim_array_delete_value(a, 2);
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "abcdefjklmnopqr") != 0)
+	return 1;
+
+    iter_ctx.buf[0] = '\0';
+    heim_array_delete_value(a, 2);
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "abcdefmnopqr") != 0)
+	return 1;
+
+    iter_ctx.buf[0] = '\0';
+    heim_array_delete_value(a, 0);
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "defmnopqr") != 0)
+	return 1;
+
+    iter_ctx.buf[0] = '\0';
+    heim_array_delete_value(a, 2);
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "defmno") != 0)
+	return 1;
+
+    heim_array_insert_value(a, 0, s1);
+    iter_ctx.buf[0] = '\0';
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "abcdefmno") != 0)
+	return 1;
+
+    heim_array_insert_value(a, 0, s2);
+    iter_ctx.buf[0] = '\0';
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "defabcdefmno") != 0)
+	return 1;
+
+    heim_array_append_value(a, s3);
+    iter_ctx.buf[0] = '\0';
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "defabcdefmnoghi") != 0)
+	return 1;
+
+    heim_array_append_value(a, s6);
+    iter_ctx.buf[0] = '\0';
+    heim_array_iterate_f(a, &iter_ctx, test_array_iter);
+    if (strcmp(iter_ctx.buf, "defabcdefmnoghipqr") != 0)
+	return 1;
+
+    heim_release(s1);
+    heim_release(s2);
+    heim_release(s3);
+    heim_release(s4);
+    heim_release(s5);
+    heim_release(s6);
+    heim_release(a);
+
+    return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+    int res = 0;
+
+    res |= test_memory();
+    res |= test_mutex();
+    res |= test_rwlock();
+    res |= test_dict();
+    res |= test_auto_release();
+    res |= test_string();
+    res |= test_error();
+    res |= test_json();
+    res |= test_path();
+    res |= test_db(NULL, NULL);
+    res |= test_db("json", argc > 1 ? argv[1] : "test_db.json");
+    res |= test_array();
+
+    return res ? 1 : 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/base/version-script.map b/crypto/external/bsd/heimdal/dist/lib/base/version-script.map
new file mode 100644
index 000000000..656277e37
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/base/version-script.map
@@ -0,0 +1,94 @@
+
+HEIMDAL_BASE_1.0 {
+	global:
+		_bsearch_file;
+		_bsearch_file_close;
+		_bsearch_file_info;
+		_bsearch_file_open;
+		_bsearch_text;
+		__heim_string_constant;
+                DllMain;
+		heim_abort;
+		heim_abortv;
+		heim_alloc;
+		heim_array_append_value;
+		heim_array_copy_value;
+		heim_array_create;
+		heim_array_delete_value;
+		heim_array_filter_f;
+		heim_array_get_length;
+		heim_array_get_type_id;
+		heim_array_get_value;
+		heim_array_iterate_f;
+		heim_array_iterate_reverse_f;
+		heim_array_insert_value;
+		heim_array_set_value;
+		heim_auto_release;
+		heim_auto_release_create;
+		heim_auto_release_drain;
+		heim_base_once_f;
+		heim_bool_create;
+		heim_bool_val;
+		heim_cmp;
+		heim_data_create;
+		heim_data_ref_create;
+		heim_data_get_data;
+		heim_data_get_length;
+		heim_data_get_ptr;
+		heim_data_get_type_id;
+		heim_data_ref_get_type_id;
+		heim_db_begin;
+		heim_db_clone;
+		heim_db_commit;
+		heim_db_copy_value;
+		heim_db_delete_key;
+		heim_db_get_type_id;
+		heim_db_iterate_f;
+		heim_db_create;
+		heim_db_register;
+		heim_db_rollback;
+		heim_db_set_value;
+		heim_dict_copy_value;
+		heim_dict_create;
+		heim_dict_delete_key;
+		heim_dict_get_type_id;
+		heim_dict_get_value;
+		heim_dict_iterate_f;
+		heim_dict_set_value;
+		heim_error_append;
+		heim_error_copy_string;
+		heim_error_create_opt;
+		heim_error_create;
+		heim_error_createv;
+		heim_error_create_enomem;
+		heim_error_get_code;
+		heim_get_hash;
+		heim_get_tid;
+		heim_json_create;
+		heim_json_create_with_bytes;
+		heim_json_copy_serialize;
+		heim_null_create;
+		heim_number_create;
+		heim_number_get_int;
+		heim_number_get_type_id;
+		heim_path_create;
+		heim_path_delete;
+		heim_path_get;
+		heim_path_copy;
+		heim_path_vcreate;
+		heim_path_vdelete;
+		heim_path_vget;
+		heim_path_vcopy;
+		heim_release;
+		heim_retain;
+		heim_show;
+		heim_sorted_text_file_dbtype;
+		heim_string_create;
+		heim_string_create_with_bytes;
+		heim_string_create_with_format;
+		heim_string_get_type_id;
+		heim_string_get_utf8;
+		heim_string_ref_create;
+	local:
+		*;
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/com_err/Makefile.am
index 2fd5a71aa..ea3985eca 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/Makefile.am
@@ -13,7 +13,7 @@ endif
 
 libcom_err_la_LIBADD = $(LIB_libintl)
 
-bin_PROGRAMS = compile_et
+noinst_PROGRAMS = compile_et
 
 include_HEADERS = com_err.h com_right.h
 
@@ -42,6 +42,7 @@ strlcpy.c:
 
 EXTRA_DIST = \
 	NTMakefile \
+	com_err.3 \
 	compile_et-version.rc \
 	libcom_err-version.rc \
 	libcom_err-exports.def \
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.3 b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.3
index 2ac479de9..dd6b908f4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.3
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: com_err.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: com_err.3,v 1.4 2017/01/28 21:31:45 christos Exp $
 .\"
 .\" Copyright (c) 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.c b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.c
index 18a2bfe3c..86f91c335 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.c
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: com_err.c,v 1.1.1.1 2011/04/13 18:14:42 elric Exp $	*/
+/*	$NetBSD: com_err.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -72,7 +72,7 @@ init_error_table(const char **msgs, long base, int count)
 
 static void KRB5_CALLCONV
 default_proc (const char *whoami, long code, const char *fmt, va_list args)
-    __attribute__((__format__(__printf__, 3, 0)));
+    __attribute__ ((__format__ (__printf__, 3, 0)));
 
 static void KRB5_CALLCONV
 default_proc (const char *whoami, long code, const char *fmt, va_list args)
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.h b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.h
index 5696991d8..11886fe8b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.h
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/com_err.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: com_err.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: com_err.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -57,11 +57,11 @@ init_error_table (const char**, long, int);
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 com_err_va (const char *, long, const char *, va_list)
-    __attribute__((format(printf, 3, 0)));
+    __attribute__ ((__format__ (__printf__, 3, 0)));
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 com_err (const char *, long, const char *, ...)
-    __attribute__((format(printf, 3, 4)));
+    __attribute__ ((__format__ (__printf__, 3, 4)));
 
 KRB5_LIB_FUNCTION errf KRB5_LIB_CALL
 set_com_err_hook (errf);
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/com_right.h b/crypto/external/bsd/heimdal/dist/lib/com_err/com_right.h
index 69d0ca274..02af01d15 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/com_right.h
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/com_right.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: com_right.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: com_right.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -60,6 +60,7 @@
 
 #ifdef __STDC__
 #include <stdarg.h>
+#include <stddef.h>
 #endif
 
 struct error_table {
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.c b/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.c
index c5f242f25..2524f6578 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.c
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compile_et.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: compile_et.c,v 1.4 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1998-2002 Kungliga Tekniska Högskolan
@@ -59,7 +59,8 @@ char name[128];
 char Basename[128];
 
 #ifdef YYDEBUG
-extern int yydebug = 1;
+extern int yydebug;
+int yydebug = 1;
 #endif
 
 char *filename;
@@ -189,8 +190,8 @@ generate(void)
 int version_flag;
 int help_flag;
 struct getargs args[] = {
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.h b/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.h
index e73400aae..af2e951ed 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.h
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/compile_et.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: compile_et.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: compile_et.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/error.c b/crypto/external/bsd/heimdal/dist/lib/com_err/error.c
index cbd9147fc..8af4ae90b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: error.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: error.c,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 2001 Kungliga Tekniska Högskolan
@@ -67,7 +67,7 @@ com_right_r(struct et_list *list, long code, char *str, size_t len)
 	    const char *msg = p->table->msgs[code - p->table->base];
 #ifdef LIBINTL
 	    char domain[12 + 20];
-	    snprintf(domain, sizeof(domain), "heim_com_err%d", p->table->base);
+	    snprintf(domain, sizeof(domain), "heim_com_err%ld", p->table->base);
 #endif
 	    strlcpy(str, dgettext(domain, msg), len);
 	    return str;
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/lex.h b/crypto/external/bsd/heimdal/dist/lib/com_err/lex.h
index c5f628d47..8513dc04f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/lex.h
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/lex.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: lex.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: lex.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -36,6 +36,6 @@
 /* Id */
 
 void _lex_error_message (const char *, ...)
-__attribute__ ((format (printf, 1, 2)));
+__attribute__ ((__format__ (__printf__, 1, 2)));
 
 int yylex(void);
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/lex.l b/crypto/external/bsd/heimdal/dist/lib/com_err/lex.l
index 28839ac9d..f268b33b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/lex.l
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/lex.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: lex.l,v 1.1.1.1 2011/04/13 18:14:43 elric Exp $	*/
+/*	$NetBSD: lex.l,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 %{
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/parse.y b/crypto/external/bsd/heimdal/dist/lib/com_err/parse.y
index 0166835ed..7e1a93fcf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/parse.y
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/parse.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse.y,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: parse.y,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 %{
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/com_err/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/com_err/roken_rename.h
index 8a453b2b2..8ea75fb05 100644
--- a/crypto/external/bsd/heimdal/dist/lib/com_err/roken_rename.h
+++ b/crypto/external/bsd/heimdal/dist/lib/com_err/roken_rename.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_rename.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:45 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/gssapi/Makefile.am
index 18ee693f8..bdd9423e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/Makefile.am
@@ -12,9 +12,7 @@ AM_CPPFLAGS += \
 	-I$(srcdir)/ntlm \
 	-I$(srcdir)/krb5 \
 	-I$(srcdir)/spnego \
-	$(INCLUDE_libintl) \
-	$(INCLUDE_hcrypto) \
-	$(INCLUDE_krb4)
+	$(INCLUDE_libintl)
 
 lib_LTLIBRARIES = libgssapi.la
 
@@ -46,7 +44,7 @@ krb5src = \
 	krb5/external.c \
 	krb5/get_mic.c \
 	krb5/gsskrb5_locl.h \
-	krb5/gsskrb5-private.h \
+	$(srcdir)/krb5/gsskrb5-private.h \
 	krb5/import_name.c \
 	krb5/import_sec_context.c \
 	krb5/indicate_mechs.c \
@@ -165,7 +163,7 @@ spnegosrc = \
 	spnego/external.c \
 	spnego/init_sec_context.c \
 	spnego/spnego_locl.h \
-	spnego/spnego-private.h
+	$(srcdir)/spnego/spnego-private.h
 
 ntlmsrc = \
 	ntlm/accept_sec_context.c \
@@ -184,7 +182,6 @@ ntlmsrc = \
 	ntlm/export_sec_context.c \
 	ntlm/external.c \
 	ntlm/ntlm.h \
-	ntlm/ntlm-private.h \
 	ntlm/import_name.c \
 	ntlm/import_sec_context.c \
 	ntlm/indicate_mechs.c \
@@ -200,7 +197,7 @@ ntlmsrc = \
 	ntlm/release_name.c \
 	ntlm/kdc.c
 
-$(srcdir)/ntlm/ntlm-private.h:
+$(srcdir)/ntlm/ntlm-private.h: $(ntlmsrc)
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p ntlm/ntlm-private.h $(ntlmsrc) || rm -f ntlm/ntlm-private.h
 
 dist_libgssapi_la_SOURCES  = \
@@ -235,9 +232,9 @@ man_MANS = gssapi.3 gss_acquire_cred.3 mech/mech.5
 include_HEADERS = gssapi.h
 noinst_HEADERS = \
 	gssapi_mech.h \
-	ntlm/ntlm-private.h \
-	spnego/spnego-private.h \
-	krb5/gsskrb5-private.h
+	$(srcdir)/ntlm/ntlm-private.h \
+	$(srcdir)/spnego/spnego-private.h \
+	$(srcdir)/krb5/gsskrb5-private.h
 
 nobase_include_HEADERS = \
 	gssapi/gssapi.h \
@@ -274,10 +271,13 @@ $(libgssapi_la_OBJECTS): $(srcdir)/version-script.map
 
 BUILT_SOURCES = $(spnego_files:.x=.c) $(gssapi_files:.x=.c)
 
+$(libgssapi_la_OBJECTS): gkrb5_err.h
+gkrb5_err.h: $(srcdir)/krb5/gkrb5_err.et
+
 CLEANFILES = $(BUILT_SOURCES) \
 	gkrb5_err.h gkrb5_err.c \
-	$(spnego_files) spnego_asn1*.h* spnego_asn1_files spnego_asn1-template.c \
-	$(gssapi_files) gssapi_asn1*.h* gssapi_asn1_files gssapi_asn1-template.c \
+	$(spnego_files) spnego_asn1*.h* spnego_asn1_files spnego_asn1-template.[cx] \
+	$(gssapi_files) gssapi_asn1*.h* gssapi_asn1_files gssapi_asn1-template.[cx] \
 	gss-commands.h gss-commands.c
 
 $(spnego_files) spnego_asn1.hx spnego_asn1-priv.hx: spnego_asn1_files
@@ -304,12 +304,14 @@ test_cfx_SOURCES = krb5/test_cfx.c
 check_PROGRAMS = test_acquire_cred $(TESTS)
 
 bin_PROGRAMS = gsstool
-noinst_PROGRAMS = test_cred test_kcred test_context test_ntlm
+noinst_PROGRAMS = test_cred test_kcred test_context test_ntlm test_add_store_cred
 
 test_context_SOURCES = test_context.c test_common.c test_common.h
 test_ntlm_SOURCES = test_ntlm.c test_common.c test_common.h
 test_acquire_cred_SOURCES = test_acquire_cred.c test_common.c test_common.h
 
+test_add_store_cred_SOURCES = test_add_store_cred.c
+
 test_ntlm_LDADD = \
 	$(top_builddir)/lib/ntlm/libheimntlm.la \
 	$(LDADD)
@@ -339,6 +341,13 @@ EXTRA_DIST = \
 	libgssapi-version.rc \
 	libgssapi-exports.def \
 	$(man_MANS) \
+	gen-oid.pl \
+	gssapi/gssapi_netlogon.h \
+	krb5/test_acquire_cred.c \
+	krb5/test_cred.c \
+	krb5/test_kcred.c \
+	krb5/test_oid.c \
+	oid.txt \
 	krb5/gkrb5_err.et \
 	mech/gssapi.asn1 \
 	spnego/spnego.asn1 \
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/gssapi/NTMakefile
index ecf44ba4d..402b110a1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/NTMakefile
@@ -553,6 +553,7 @@ all-tools:: $(BINDIR)\gsstool.exe
 
 $(BINDIR)\gsstool.exe: $(OBJ)\gsstool.obj $(OBJ)\gss-commands.obj $(LIBGSSAPI) $(LIBROKEN) $(LIBSL) $(LIBVERS)
 	$(EXECONLINK)
+	$(EXEPREP)
 
 $(OBJ)\gss-commands.c $(OBJ)\gss-commands.h: gss-commands.in
 	cd $(OBJ)
@@ -630,10 +631,10 @@ test-binaries: $(LIBGSSAPI) $(TEST_BINARIES)
 
 run-test:
 	cd $(OBJ)
-	test_oid
-	test_names
-	test_cfx
-	test_kcred
+	-test_oid
+	-test_names
+	-test_cfx
+	-test_kcred
 	cd $(SRCDIR)
 
 test:: test-binaries run-test
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gen-oid.pl b/crypto/external/bsd/heimdal/dist/lib/gssapi/gen-oid.pl
index 4a519f89a..a2341ad98 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gen-oid.pl
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gen-oid.pl
@@ -31,14 +31,14 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 
-require 'getopts.pl';
+use Getopt::Std;
 
 my $output;
 my $CFILE, $HFILE;
 my $onlybase;
 my $header = 0;
 
-Getopts('b:h') || die "foo";
+getopts('b:h') || die "USAGE: ./gen-oid [-b BASE] [-h HEADER]";
 
 if($opt_b) {
     $onlybase = $opt_b;
@@ -122,15 +122,15 @@ while(<>) {
 
 }
 
-foreach my $k (keys %types) {
+foreach my $k (sort keys %types) {
     if (!$header) {
 	print "struct _gss_oid_name_table _gss_ont_" . $k . "[] = {\n";
-	foreach my $m (values %tables) {
+	foreach my $m (sort {$$a->{oid} cmp $$b->{oid}} values %tables) {
 	    if ($$m->{type} eq $k) {
 		printf "  { %s, \"%s\", %s, %s },\n", $$m->{oid}, $$m->{oid}, $$m->{short}, $$m->{long};
 	    }
 	}
-	printf "  { NULL }\n";
+	printf "  { NULL, NULL, NULL, NULL }\n";
 	printf "};\n\n";
 	
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gss-commands.in b/crypto/external/bsd/heimdal/dist/lib/gssapi/gss-commands.in
index fef099a03..446578afd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gss-commands.in
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gss-commands.in
@@ -33,10 +33,12 @@
 /* Id */
 
 command = {
+	name = "mechanisms"
 	name = "supported-mechanisms"
 	help = "Print the supported mechanisms"
 }
 command = {
+	name = "attributes"
 	name = "attrs-for-mech"
 	help = "Print the attributes for mechs"
 	option = {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gss_acquire_cred.3 b/crypto/external/bsd/heimdal/dist/lib/gssapi/gss_acquire_cred.3
index 4f4e3d462..ae60a6c18 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gss_acquire_cred.3
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gss_acquire_cred.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: gss_acquire_cred.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: gss_acquire_cred.3,v 1.4 2017/01/28 21:31:46 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -93,7 +93,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Fo gss_accept_sec_context
 .Fa "OM_uint32 * minor_status"
 .Fa "gss_ctx_id_t * context_handle"
-.Fa "const gss_cred_id_t acceptor_cred_handle"
+.Fa "gss_const_cred_id_t acceptor_cred_handle"
 .Fa "const gss_buffer_t input_token_buffer"
 .Fa "const gss_channel_bindings_t input_chan_bindings"
 .Fa "gss_name_t * src_name"
@@ -107,7 +107,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_acquire_cred
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t desired_name"
+.Fa "gss_const_name_t desired_name"
 .Fa "OM_uint32 time_req"
 .Fa "const gss_OID_set desired_mechs"
 .Fa "gss_cred_usage_t cred_usage"
@@ -118,8 +118,8 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_add_cred
 .Fa "OM_uint32 *minor_status"
-.Fa "const gss_cred_id_t input_cred_handle"
-.Fa "const gss_name_t desired_name"
+.Fa "gss_const_cred_id_t input_cred_handle"
+.Fa "gss_const_name_t desired_name"
 .Fa "const gss_OID desired_mech"
 .Fa "gss_cred_usage_t cred_usage"
 .Fa "OM_uint32 initiator_time_req"
@@ -138,21 +138,21 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_canonicalize_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t input_name"
+.Fa "gss_const_name_t input_name"
 .Fa "const gss_OID mech_type"
 .Fa "gss_name_t * output_name"
 .Fc
 .Ft OM_uint32
 .Fo gss_compare_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t name1"
-.Fa "const gss_name_t name2"
+.Fa "gss_const_name_t name1"
+.Fa "gss_const_name_t name2"
 .Fa "int * name_equal"
 .Fc
 .Ft OM_uint32
 .Fo gss_context_time
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "OM_uint32 * time_rec"
 .Fc
 .Ft OM_uint32
@@ -169,7 +169,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_display_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t input_name"
+.Fa "gss_const_name_t input_name"
 .Fa "gss_buffer_t output_name_buffer"
 .Fa "gss_OID * output_name_type"
 .Fc
@@ -185,13 +185,13 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_duplicate_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t src_name"
+.Fa "gss_const_name_t src_name"
 .Fa "gss_name_t * dest_name"
 .Fc
 .Ft OM_uint32
 .Fo gss_export_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t input_name"
+.Fa "gss_const_name_t input_name"
 .Fa "gss_buffer_t exported_name"
 .Fc
 .Ft OM_uint32
@@ -203,7 +203,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_get_mic
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "gss_qop_t qop_req"
 .Fa "const gss_buffer_t message_buffer"
 .Fa "gss_buffer_t message_token"
@@ -229,9 +229,9 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_init_sec_context
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_cred_id_t initiator_cred_handle"
+.Fa "gss_const_cred_id_t initiator_cred_handle"
 .Fa "gss_ctx_id_t * context_handle"
-.Fa "const gss_name_t target_name"
+.Fa "gss_const_name_t target_name"
 .Fa "const gss_OID mech_type"
 .Fa "OM_uint32 req_flags"
 .Fa "OM_uint32 time_req"
@@ -245,7 +245,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_inquire_context
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "gss_name_t * src_name"
 .Fa "gss_name_t * targ_name"
 .Fa "OM_uint32 * lifetime_rec"
@@ -257,7 +257,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_inquire_cred
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_cred_id_t cred_handle"
+.Fa "gss_const_cred_id_t cred_handle"
 .Fa "gss_name_t * name"
 .Fa "OM_uint32 * lifetime"
 .Fa "gss_cred_usage_t * cred_usage"
@@ -266,7 +266,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_inquire_cred_by_mech
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_cred_id_t cred_handle"
+.Fa "gss_const_cred_id_t cred_handle"
 .Fa "const gss_OID mech_type"
 .Fa "gss_name_t * name"
 .Fa "OM_uint32 * initiator_lifetime"
@@ -276,7 +276,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_inquire_mechs_for_name
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_name_t input_name"
+.Fa "gss_const_name_t input_name"
 .Fa "gss_OID_set * mech_types"
 .Fc
 .Ft OM_uint32
@@ -338,7 +338,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_process_context_token
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "const gss_buffer_t token_buffer"
 .Fc
 .Ft OM_uint32
@@ -398,7 +398,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_unwrap
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "const gss_buffer_t input_message_buffer"
 .Fa "gss_buffer_t output_message_buffer"
 .Fa "int * conf_state"
@@ -415,7 +415,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_verify_mic
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "const gss_buffer_t message_buffer"
 .Fa "const gss_buffer_t token_buffer"
 .Fa "gss_qop_t * qop_state"
@@ -423,7 +423,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_wrap
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "int conf_req_flag"
 .Fa "gss_qop_t qop_req"
 .Fa "const gss_buffer_t input_message_buffer"
@@ -433,7 +433,7 @@ GSS-API library (libgssapi, -lgssapi)
 .Ft OM_uint32
 .Fo gss_wrap_size_limit
 .Fa "OM_uint32 * minor_status"
-.Fa "const gss_ctx_id_t context_handle"
+.Fa "gss_const_ctx_id_t context_handle"
 .Fa "int conf_req_flag"
 .Fa "gss_qop_t qop_req"
 .Fa "OM_uint32 req_output_size"
@@ -556,7 +556,7 @@ the default syntax is used for all mechanism the GSS-API
 implementation supports.
 When compare the imported name of
 .Dv GSS_C_NO_OID
-it may match serveral mechanism names (MN).
+it may match several mechanism names (MN).
 .Pp
 The resulting name from
 .Fn gss_display_name
@@ -586,7 +586,7 @@ Information is available even after the context have expired.
 .Fa lifetime_rec
 argument is set to
 .Dv GSS_C_INDEFINITE
-(dont expire) or the number of seconds that the context is still valid.
+(don't expire) or the number of seconds that the context is still valid.
 A value of 0 means that the context is expired.
 .Fa mech_type
 argument should be considered readonly and must not be released.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.3 b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.3
index c542dde45..0b02c2fc6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.3
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: gssapi.3,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: gssapi.3,v 1.5 2017/01/28 21:31:46 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.h
index 649b2a31d..bf0e713fb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi.h,v 1.1.1.2 2011/04/14 14:08:24 elric Exp $	*/
+/*	$NetBSD: gssapi.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi.h
index 7f7ca980a..8d7e924d9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi.h,v 1.1.1.3 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gssapi.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -97,7 +97,7 @@ typedef const struct gss_name_t_desc_struct *gss_const_name_t;
 
 struct gss_ctx_id_t_desc_struct;
 typedef struct gss_ctx_id_t_desc_struct *gss_ctx_id_t;
-typedef const struct gss_ctx_id_t_desc_struct gss_const_ctx_id_t;
+typedef const struct gss_ctx_id_t_desc_struct *gss_const_ctx_id_t;
 
 typedef struct gss_OID_desc_struct {
       OM_uint32 length;
@@ -472,7 +472,7 @@ extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_nt_export_name_oid_desc;
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_acquire_cred
            (OM_uint32 * /*minor_status*/,
-            const gss_name_t /*desired_name*/,
+            gss_const_name_t /*desired_name*/,
             OM_uint32 /*time_req*/,
             const gss_OID_set /*desired_mechs*/,
             gss_cred_usage_t /*cred_usage*/,
@@ -488,9 +488,9 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_cred
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_init_sec_context
            (OM_uint32 * /*minor_status*/,
-            const gss_cred_id_t /*initiator_cred_handle*/,
+            gss_const_cred_id_t /*initiator_cred_handle*/,
             gss_ctx_id_t * /*context_handle*/,
-            const gss_name_t /*target_name*/,
+            gss_const_name_t /*target_name*/,
             const gss_OID /*mech_type*/,
             OM_uint32 /*req_flags*/,
             OM_uint32 /*time_req*/,
@@ -505,7 +505,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_init_sec_context
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_accept_sec_context
            (OM_uint32 * /*minor_status*/,
             gss_ctx_id_t * /*context_handle*/,
-            const gss_cred_id_t /*acceptor_cred_handle*/,
+            gss_const_cred_id_t /*acceptor_cred_handle*/,
             const gss_buffer_t /*input_token_buffer*/,
             const gss_channel_bindings_t /*input_chan_bindings*/,
             gss_name_t * /*src_name*/,
@@ -518,7 +518,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_accept_sec_context
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_process_context_token
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             const gss_buffer_t /*token_buffer*/
            );
 
@@ -530,13 +530,13 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_delete_sec_context
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_context_time
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             OM_uint32 * /*time_rec*/
            );
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_get_mic
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             gss_qop_t /*qop_req*/,
             const gss_buffer_t /*message_buffer*/,
             gss_buffer_t /*message_token*/
@@ -544,7 +544,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_get_mic
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_verify_mic
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             const gss_buffer_t /*message_buffer*/,
             const gss_buffer_t /*token_buffer*/,
             gss_qop_t * /*qop_state*/
@@ -552,7 +552,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_verify_mic
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             int /*conf_req_flag*/,
             gss_qop_t /*qop_req*/,
             const gss_buffer_t /*input_message_buffer*/,
@@ -562,7 +562,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_unwrap
            (OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             const gss_buffer_t /*input_message_buffer*/,
             gss_buffer_t /*output_message_buffer*/,
             int * /*conf_state*/,
@@ -585,14 +585,14 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_indicate_mechs
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_compare_name
            (OM_uint32 * /*minor_status*/,
-            const gss_name_t /*name1*/,
-            const gss_name_t /*name2*/,
+            gss_const_name_t /*name1*/,
+            gss_const_name_t /*name2*/,
             int * /*name_equal*/
            );
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_display_name
            (OM_uint32 * /*minor_status*/,
-            const gss_name_t /*input_name*/,
+            gss_const_name_t /*input_name*/,
             gss_buffer_t /*output_name_buffer*/,
             gss_OID * /*output_name_type*/
            );
@@ -606,7 +606,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_import_name
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_export_name
            (OM_uint32  * /*minor_status*/,
-            const gss_name_t /*input_name*/,
+            gss_const_name_t /*input_name*/,
             gss_buffer_t /*exported_name*/
            );
 
@@ -627,7 +627,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_oid_set
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_cred
            (OM_uint32 * /*minor_status*/,
-            const gss_cred_id_t /*cred_handle*/,
+            gss_const_cred_id_t /*cred_handle*/,
             gss_name_t * /*name*/,
             OM_uint32 * /*lifetime*/,
             gss_cred_usage_t * /*cred_usage*/,
@@ -636,7 +636,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_cred
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_context (
             OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             gss_name_t * /*src_name*/,
             gss_name_t * /*targ_name*/,
             OM_uint32 * /*lifetime_rec*/,
@@ -648,7 +648,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_context (
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_size_limit (
             OM_uint32 * /*minor_status*/,
-            const gss_ctx_id_t /*context_handle*/,
+            gss_const_ctx_id_t /*context_handle*/,
             int /*conf_req_flag*/,
             gss_qop_t /*qop_req*/,
             OM_uint32 /*req_output_size*/,
@@ -657,8 +657,8 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_size_limit (
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_cred (
             OM_uint32 * /*minor_status*/,
-            const gss_cred_id_t /*input_cred_handle*/,
-            const gss_name_t /*desired_name*/,
+            gss_const_cred_id_t /*input_cred_handle*/,
+            gss_const_name_t /*desired_name*/,
             const gss_OID /*desired_mech*/,
             gss_cred_usage_t /*cred_usage*/,
             OM_uint32 /*initiator_time_req*/,
@@ -671,7 +671,7 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_cred (
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_cred_by_mech (
             OM_uint32 * /*minor_status*/,
-            const gss_cred_id_t /*cred_handle*/,
+            gss_const_cred_id_t /*cred_handle*/,
             const gss_OID /*mech_type*/,
             gss_name_t * /*name*/,
             OM_uint32 * /*initiator_lifetime*/,
@@ -717,20 +717,20 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_names_for_mech (
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_mechs_for_name (
             OM_uint32 * /*minor_status*/,
-            const gss_name_t /*input_name*/,
+            gss_const_name_t /*input_name*/,
             gss_OID_set * /*mech_types*/
            );
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_canonicalize_name (
             OM_uint32 * /*minor_status*/,
-            const gss_name_t /*input_name*/,
+            gss_const_name_t /*input_name*/,
             const gss_OID /*mech_type*/,
             gss_name_t * /*output_name*/
            );
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_duplicate_name (
             OM_uint32 * /*minor_status*/,
-            const gss_name_t /*src_name*/,
+            gss_const_name_t /*src_name*/,
             gss_name_t * /*dest_name*/
            );
 
@@ -756,7 +756,7 @@ gss_oid_to_str(
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_sec_context_by_oid(
 	    OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_OID desired_object,
             gss_buffer_set_t *data_set
            );
@@ -794,7 +794,7 @@ gss_release_buffer_set
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_cred_by_oid(OM_uint32 *minor_status,
-	                const gss_cred_id_t cred_handle,
+	                gss_const_cred_id_t cred_handle,
 	                const gss_OID desired_object,
 	                gss_buffer_set_t *data_set);
 
@@ -846,7 +846,7 @@ extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_attr_stream_sizes_oid_desc;
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_context_query_attributes(OM_uint32 * /* minor_status */,
-			     const gss_ctx_id_t /* context_handle */,
+			     gss_const_ctx_id_t /* context_handle */,
 			     const gss_OID /* attribute */,
 			     void * /*data*/,
 			     size_t /* len */);
@@ -936,6 +936,13 @@ gss_wrap_iov_length(OM_uint32 *, gss_ctx_id_t, int, gss_qop_t, int *,
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_release_iov_buffer(OM_uint32 *, gss_iov_buffer_desc *, int);
 
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_wrap_aead(OM_uint32 *, gss_ctx_id_t, int, gss_qop_t,
+	      gss_buffer_t, gss_buffer_t, int *, gss_buffer_t);
+
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_unwrap_aead(OM_uint32 *, gss_ctx_id_t, gss_buffer_t,
+		gss_buffer_t, gss_buffer_t, int *, gss_qop_t *);
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_export_cred(OM_uint32 * /* minor_status */,
@@ -1006,7 +1013,7 @@ gss_display_mech_attr(OM_uint32 * minor_status,
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_acquire_cred_with_password
            (OM_uint32 * /*minor_status*/,
-            const gss_name_t /*desired_name*/,
+            gss_const_name_t /*desired_name*/,
             const gss_buffer_t /*password*/,
             OM_uint32 /*time_req*/,
             const gss_OID_set /*desired_mechs*/,
@@ -1018,8 +1025,8 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_acquire_cred_with_password
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_cred_with_password (
             OM_uint32 * /*minor_status*/,
-            const gss_cred_id_t /*input_cred_handle*/,
-            const gss_name_t /*desired_name*/,
+            gss_const_cred_id_t /*input_cred_handle*/,
+            gss_const_name_t /*desired_name*/,
             const gss_OID /*desired_mech*/,
             const gss_buffer_t /*password*/,
             gss_cred_usage_t /*cred_usage*/,
@@ -1031,21 +1038,28 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_cred_with_password (
             OM_uint32 * /*acceptor_time_rec*/
            );
 
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_localname(
+        OM_uint32 *minor,
+        gss_const_name_t name,
+        const gss_OID mech_type,
+        gss_buffer_t localname);
+
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_pname_to_uid(
         OM_uint32 *minor,
-        const gss_name_t name,
+        gss_const_name_t name,
         const gss_OID mech_type,
         uid_t *uidOut);
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_authorize_localname(
         OM_uint32 *minor,
-        const gss_name_t name,
-        const gss_name_t user);
+        gss_const_name_t name,
+        gss_const_name_t user);
 
 GSSAPI_LIB_FUNCTION int GSSAPI_LIB_CALL
-gss_userok(const gss_name_t name,
+gss_userok(gss_const_name_t name,
            const char *user);
 
 extern GSSAPI_LIB_VARIABLE gss_buffer_desc __gss_c_attr_local_login_user;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_krb5.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_krb5.h
index cf3751fe3..a6ec30eb3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_krb5.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_krb5.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_krb5.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $	*/
+/*	$NetBSD: gssapi_krb5.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -39,6 +39,7 @@
 #define GSSAPI_KRB5_H_
 
 #include <gssapi/gssapi.h>
+#include <gssapi/gssapi_oid.h>
 
 GSSAPI_CPP_START
 
@@ -62,9 +63,6 @@ extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_nt_principal_name_oid_desc;
 #define GSS_KRB5_NT_MACHINE_UID_NAME (&__gss_c_nt_machine_uid_name_oid_desc)
 #define GSS_KRB5_NT_STRING_UID_NAME (&__gss_c_nt_string_uid_name_oid_desc)
 
-extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_mechanism_oid_desc;
-#define GSS_KRB5_MECHANISM (&__gss_krb5_mechanism_oid_desc)
-
 /* for compatibility with MIT api */
 
 #define gss_mech_krb5 GSS_KRB5_MECHANISM
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_netlogon.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_netlogon.h
index 0626bed02..4ddb197ef 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_netlogon.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_netlogon.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_netlogon.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $	*/
+/*	$NetBSD: gssapi_netlogon.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_ntlm.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_ntlm.h
index add539e66..069b46c89 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_ntlm.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_ntlm.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_ntlm.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $	*/
+/*	$NetBSD: gssapi_ntlm.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_oid.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_oid.h
index 74f89fc2c..e6db20553 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_oid.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_oid.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_oid.h,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gssapi_oid.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /* Generated file */
 #ifndef GSSAPI_GSSAPI_OID
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_spnego.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_spnego.h
index fb3fb3b20..c127c85e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_spnego.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi/gssapi_spnego.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_spnego.h,v 1.1.1.2 2011/04/14 14:08:25 elric Exp $	*/
+/*	$NetBSD: gssapi_spnego.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi_mech.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi_mech.h
index 50aeeb0c1..5b9e2d2f6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi_mech.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gssapi_mech.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gssapi_mech.h,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gssapi_mech.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -35,7 +35,7 @@
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_acquire_cred_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* desired_name */
+	       gss_const_name_t,       /* desired_name */
 	       OM_uint32,              /* time_req */
 	       const gss_OID_set,      /* desired_mechs */
 	       gss_cred_usage_t,       /* cred_usage */
@@ -51,9 +51,9 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_release_cred_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_init_sec_context_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_cred_id_t,    /* initiator_cred_handle */
+	       gss_const_cred_id_t,    /* initiator_cred_handle */
 	       gss_ctx_id_t *,         /* context_handle */
-	       const gss_name_t,       /* target_name */
+	       gss_const_name_t,       /* target_name */
 	       const gss_OID,          /* mech_type */
 	       OM_uint32,              /* req_flags */
 	       OM_uint32,              /* time_req */
@@ -69,7 +69,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_init_sec_context_t
 typedef OM_uint32 GSSAPI_CALLCONV _gss_accept_sec_context_t
 	      (OM_uint32 *,            /* minor_status */
 	       gss_ctx_id_t *,         /* context_handle */
-	       const gss_cred_id_t,    /* acceptor_cred_handle */
+	       gss_const_cred_id_t,    /* acceptor_cred_handle */
 	       const gss_buffer_t,     /* input_token_buffer */
 	       const gss_channel_bindings_t,
 				       /* input_chan_bindings */
@@ -83,7 +83,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_accept_sec_context_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_process_context_token_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       const gss_buffer_t      /* token_buffer */
 	      );
 
@@ -95,13 +95,13 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_delete_sec_context_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_context_time_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       OM_uint32 *             /* time_rec */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_get_mic_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       gss_qop_t,              /* qop_req */
 	       const gss_buffer_t,     /* message_buffer */
 	       gss_buffer_t            /* message_token */
@@ -109,7 +109,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_get_mic_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_verify_mic_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       const gss_buffer_t,     /* message_buffer */
 	       const gss_buffer_t,     /* token_buffer */
 	       gss_qop_t *             /* qop_state */
@@ -117,7 +117,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_verify_mic_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       int,                    /* conf_req_flag */
 	       gss_qop_t,              /* qop_req */
 	       const gss_buffer_t,     /* input_message_buffer */
@@ -127,7 +127,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_unwrap_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       const gss_buffer_t,     /* input_message_buffer */
 	       gss_buffer_t,           /* output_message_buffer */
 	       int *,                  /* conf_state */
@@ -150,14 +150,14 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_indicate_mechs_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_compare_name_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* name1 */
-	       const gss_name_t,       /* name2 */
+	       gss_const_name_t,       /* name1 */
+	       gss_const_name_t,       /* name2 */
 	       int *                   /* name_equal */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_display_name_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* input_name */
+	       gss_const_name_t,       /* input_name */
 	       gss_buffer_t,           /* output_name_buffer */
 	       gss_OID *               /* output_name_type */
 	      );
@@ -171,7 +171,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_import_name_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_export_name_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* input_name */
+	       gss_const_name_t,       /* input_name */
 	       gss_buffer_t            /* exported_name */
 	      );
 
@@ -182,7 +182,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_release_name_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_cred_id_t,    /* cred_handle */
+	       gss_const_cred_id_t,    /* cred_handle */
 	       gss_name_t *,           /* name */
 	       OM_uint32 *,            /* lifetime */
 	       gss_cred_usage_t *,     /* cred_usage */
@@ -191,7 +191,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_context_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       gss_name_t *,           /* src_name */
 	       gss_name_t *,           /* targ_name */
 	       OM_uint32 *,            /* lifetime_rec */
@@ -203,7 +203,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_context_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_size_limit_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_ctx_id_t,     /* context_handle */
+	       gss_const_ctx_id_t,     /* context_handle */
 	       int,                    /* conf_req_flag */
 	       gss_qop_t,              /* qop_req */
 	       OM_uint32,              /* req_output_size */
@@ -212,8 +212,8 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_wrap_size_limit_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_add_cred_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_cred_id_t,    /* input_cred_handle */
-	       const gss_name_t,       /* desired_name */
+	       gss_const_cred_id_t,    /* input_cred_handle */
+	       gss_const_name_t,       /* desired_name */
 	       const gss_OID,          /* desired_mech */
 	       gss_cred_usage_t,       /* cred_usage */
 	       OM_uint32,              /* initiator_time_req */
@@ -226,7 +226,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_add_cred_t (
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_by_mech_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_cred_id_t,    /* cred_handle */
+	       gss_const_cred_id_t,    /* cred_handle */
 	       const gss_OID,          /* mech_type */
 	       gss_name_t *,           /* name */
 	       OM_uint32 *,            /* initiator_lifetime */
@@ -254,33 +254,33 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_names_for_mech_t (
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_mechs_for_name_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* input_name */
+	       gss_const_name_t,       /* input_name */
 	       gss_OID_set *           /* mech_types */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_canonicalize_name_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* input_name */
+	       gss_const_name_t,       /* input_name */
 	       const gss_OID,          /* mech_type */
 	       gss_name_t *            /* output_name */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_duplicate_name_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* src_name */
+	       gss_const_name_t,       /* src_name */
 	       gss_name_t *            /* dest_name */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_sec_context_by_oid (
 	       OM_uint32 *minor_status,
-	       const gss_ctx_id_t context_handle,
+	       gss_const_ctx_id_t context_handle,
 	       const gss_OID desired_object,
 	       gss_buffer_set_t *data_set
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_cred_by_oid (
 	       OM_uint32 *minor_status,
-	       const gss_cred_id_t cred,
+	       gss_const_cred_id_t cred,
 	       const gss_OID desired_object,
 	       gss_buffer_set_t *data_set
 	      );
@@ -358,7 +358,7 @@ _gss_import_cred_t(OM_uint32 * minor_status,
 
 typedef OM_uint32 GSSAPI_CALLCONV
 _gss_acquire_cred_ext_t(OM_uint32 * /*minor_status */,
-		        const gss_name_t /* desired_name */,
+		        gss_const_name_t /* desired_name */,
 		        gss_const_OID /* credential_type */,
 		        const void * /* credential_data */,
 		        OM_uint32 /* time_req */,
@@ -462,16 +462,16 @@ struct gss_mo_desc_struct {
     int (*set)(gss_const_OID, gss_mo_desc *, int, gss_buffer_t);
 };
 
-typedef OM_uint32 GSSAPI_CALLCONV _gss_pname_to_uid_t (
+typedef OM_uint32 GSSAPI_CALLCONV _gss_localname_t (
 	       OM_uint32 *,		/* minor_status */
-	       const gss_name_t,	/* name */
+	       gss_const_name_t,	/* name */
 	       const gss_OID,		/* mech_type */
-	       uid_t *			/* uidOut */
+	       gss_buffer_t		/* localname */
 	      );
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_authorize_localname_t (
 	       OM_uint32 *,		/* minor_status */
-	       const gss_name_t,	/* name */
+	       gss_const_name_t,	/* name */
 	       gss_const_buffer_t,	/* user */
 	       gss_const_OID		/* user_name_type */
 	      );
@@ -538,7 +538,7 @@ typedef struct gssapi_mech_interface_desc {
 	_gss_cred_label_set_t		*gm_cred_label_set;
         gss_mo_desc			*gm_mo;
         size_t				 gm_mo_num;
-        _gss_pname_to_uid_t             *gm_pname_to_uid;
+        _gss_localname_t                *gm_localname;
         _gss_authorize_localname_t      *gm_authorize_localname;
         _gss_display_name_ext_t         *gm_display_name_ext;
         _gss_inquire_name_t             *gm_inquire_name;
@@ -584,7 +584,7 @@ extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_certificate_oid_desc;
 
 OM_uint32 _gss_acquire_cred_ext
            (OM_uint32 * /*minor_status*/,
-            const gss_name_t /*desired_name*/,
+            gss_const_name_t /*desired_name*/,
             gss_const_OID /*credential_type*/,
             const void * /*credential_data*/,
             OM_uint32 /*time_req*/,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/gsstool.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/gsstool.c
index 5afbe1d25..308d95057 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/gsstool.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/gsstool.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gsstool.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: gsstool.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -74,7 +74,7 @@ usage (int ret)
 #define COL_SASL	"SASL"
 
 int
-supported_mechanisms(void *argptr, int argc, char **argv)
+mechanisms(void *argptr, int argc, char **argv)
 {
     OM_uint32 maj_stat, min_stat;
     gss_OID_set mechs;
@@ -186,7 +186,7 @@ print_mech_attr(const char *mechname, gss_const_OID mech, gss_OID_set set)
 
 
 int
-attrs_for_mech(struct attrs_for_mech_options *opt, int argc, char **argv)
+attributes(struct attributes_options *opt, int argc, char **argv)
 {
     gss_OID_set mech_attr = NULL, known_mech_attrs = NULL;
     gss_OID mech = GSS_C_NO_OID;
@@ -231,9 +231,10 @@ help(void *opt, int argc, char **argv)
 int
 main(int argc, char **argv)
 {
-    int optidx = 0;
+    int exit_status = 0, ret, optidx = 0;
 
     setprogname(argv[0]);
+
     if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
@@ -248,10 +249,18 @@ main(int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
-    if (argc == 0) {
-	help(NULL, argc, argv);
-	return 1;
+    if (argc != 0) {
+	ret = sl_command(commands, argc, argv);
+	if(ret == -1)
+	    sl_did_you_mean(commands, argv[0]);
+	else if (ret == -2)
+	    ret = 0;
+	if(ret != 0)
+	    exit_status = 1;
+    } else {
+	sl_slc_help(commands, argc, argv);
+	exit_status = 1;
     }
 
-    return sl_command (commands, argc, argv);
+    return exit_status;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/8003.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/8003.c
index 912ded89d..35317eee0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/8003.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/8003.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: 8003.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: 8003.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -159,7 +159,7 @@ _gsskrb5_create_8003_checksum (
 	*p++ = (fwd_data->length >> 8) & 0xFF;    /* Dlgth  */
 	memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length);
 
-	p += fwd_data->length;
+	/* p += fwd_data->length; */ /* commented out to quiet warning */
     }
 
     return GSS_S_COMPLETE;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/accept_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/accept_sec_context.c
index 779440416..9e3778f49 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/accept_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/accept_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: accept_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: accept_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -106,7 +106,6 @@ _gsskrb5_register_acceptor_identity(OM_uint32 *min_stat, const char *identity)
 void
 _gsskrb5i_is_cfx(krb5_context context, gsskrb5_ctx ctx, int acceptor)
 {
-    krb5_error_code ret;
     krb5_keyblock *key;
 
     if (acceptor) {
@@ -146,7 +145,8 @@ _gsskrb5i_is_cfx(krb5_context context, gsskrb5_ctx ctx, int acceptor)
     }
     if (ctx->crypto)
         krb5_crypto_destroy(context, ctx->crypto);
-    ret = krb5_crypto_init(context, key, 0, &ctx->crypto);
+    /* XXX We really shouldn't ignore this; will come back to this */
+    (void) krb5_crypto_init(context, key, 0, &ctx->crypto);
 }
 
 
@@ -166,12 +166,13 @@ gsskrb5_accept_delegated_token
 
     /* XXX Create a new delegated_cred_handle? */
     if (delegated_cred_handle == NULL) {
-	kret = krb5_cc_default (context, &ccache);
-    } else {
-	*delegated_cred_handle = NULL;
-	kret = krb5_cc_new_unique (context, krb5_cc_type_memory,
-				   NULL, &ccache);
+        ret = GSS_S_COMPLETE;
+        goto out;
     }
+
+    *delegated_cred_handle = NULL;
+    kret = krb5_cc_new_unique (context, krb5_cc_type_memory,
+                               NULL, &ccache);
     if (kret) {
 	ctx->flags &= ~GSS_C_DELEG_FLAG;
 	goto out;
@@ -272,7 +273,7 @@ gsskrb5_acceptor_ready(OM_uint32 * minor_status,
 					     ctx,
 					     context,
 					     delegated_cred_handle);
-	if (ret)
+	if (ret != GSS_S_COMPLETE)
 	    return ret;
     } else {
 	/* Well, looks like it wasn't there after all */
@@ -349,7 +350,7 @@ static OM_uint32
 gsskrb5_acceptor_start(OM_uint32 * minor_status,
 		       gsskrb5_ctx ctx,
 		       krb5_context context,
-		       const gss_cred_id_t acceptor_cred_handle,
+		       gss_const_cred_id_t acceptor_cred_handle,
 		       const gss_buffer_t input_token_buffer,
 		       const gss_channel_bindings_t input_chan_bindings,
 		       gss_name_t * src_name,
@@ -365,6 +366,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
     krb5_flags ap_options;
     krb5_keytab keytab = NULL;
     int is_cfx = 0;
+    int close_kt = 0;
     const gsskrb5_cred acceptor_cred = (gsskrb5_cred)acceptor_cred_handle;
 
     /*
@@ -386,8 +388,20 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
      * We need to get our keytab
      */
     if (acceptor_cred == NULL) {
-	if (_gsskrb5_keytab != NULL)
-	    keytab = _gsskrb5_keytab;
+	HEIMDAL_MUTEX_lock(&gssapi_keytab_mutex);
+	if (_gsskrb5_keytab != NULL) {
+	    char *name = NULL;
+	    kret = krb5_kt_get_full_name(context, _gsskrb5_keytab, &name);
+	    if (kret == 0) {
+		kret = krb5_kt_resolve(context, name, &keytab);
+		krb5_xfree(name);
+	    }
+	    if (kret == 0)
+		close_kt = 1;
+	    else
+		keytab = NULL;
+	}
+	HEIMDAL_MUTEX_unlock(&gssapi_keytab_mutex);
     } else if (acceptor_cred->keytab != NULL) {
 	keytab = acceptor_cred->keytab;
     }
@@ -410,6 +424,8 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 	if (kret) {
 	    if (in)
 		krb5_rd_req_in_ctx_free(context, in);
+	    if (close_kt)
+		krb5_kt_close(context, keytab);
 	    *minor_status = kret;
 	    return GSS_S_FAILURE;
 	}
@@ -420,6 +436,8 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 			       server,
 			       in, &out);
 	krb5_rd_req_in_ctx_free(context, in);
+	if (close_kt)
+	    krb5_kt_close(context, keytab);
 	if (kret == KRB5KRB_AP_ERR_SKEW || kret == KRB5KRB_AP_ERR_TKT_NYV) {
 	    /*
 	     * No reply in non-MUTUAL mode, but we don't know that its
@@ -445,7 +463,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 	if (kret == 0)
 	    kret = krb5_rd_req_out_get_keyblock(context, out,
 						&ctx->service_keyblock);
-	ctx->lifetime = ctx->ticket->ticket.endtime;
+	ctx->endtime = ctx->ticket->ticket.endtime;
 
 	krb5_rd_req_out_ctx_free(context, out);
 	if (kret) {
@@ -466,6 +484,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
     if (kret) {
 	ret = GSS_S_FAILURE;
 	*minor_status = kret;
+	return ret;
     }
 
     kret = krb5_copy_principal(context,
@@ -512,62 +531,61 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 	    return ret;
 	}
 
-	if (authenticator->cksum == NULL) {
-	    krb5_free_authenticator(context, &authenticator);
-	    *minor_status = 0;
-	    return GSS_S_BAD_BINDINGS;
-	}
-
-        if (authenticator->cksum->cksumtype == CKSUMTYPE_GSSAPI) {
+        if (authenticator->cksum != NULL
+	    && authenticator->cksum->cksumtype == CKSUMTYPE_GSSAPI) {
             ret = _gsskrb5_verify_8003_checksum(minor_status,
 						input_chan_bindings,
 						authenticator->cksum,
 						&ctx->flags,
 						&ctx->fwd_data);
 
-	    krb5_free_authenticator(context, &authenticator);
 	    if (ret) {
+		krb5_free_authenticator(context, &authenticator);
 		return ret;
 	    }
         } else {
-	    krb5_crypto crypto;
+	    if (authenticator->cksum != NULL) {
+		krb5_crypto crypto;
 
-	    kret = krb5_crypto_init(context,
-				    ctx->auth_context->keyblock,
-				    0, &crypto);
-	    if(kret) {
-		krb5_free_authenticator(context, &authenticator);
+		kret = krb5_crypto_init(context,
+					ctx->auth_context->keyblock,
+					0, &crypto);
+		if (kret) {
+		    krb5_free_authenticator(context, &authenticator);
+		    ret = GSS_S_FAILURE;
+		    *minor_status = kret;
+		    return ret;
+		}
 
-		ret = GSS_S_FAILURE;
-		*minor_status = kret;
-		return ret;
+		/*
+		 * Windows accepts Samba3's use of a kerberos, rather than
+		 * GSSAPI checksum here
+		 */
+
+		kret = krb5_verify_checksum(context,
+					    crypto, KRB5_KU_AP_REQ_AUTH_CKSUM, NULL, 0,
+					    authenticator->cksum);
+		krb5_crypto_destroy(context, crypto);
+
+		if (kret) {
+		    krb5_free_authenticator(context, &authenticator);
+		    ret = GSS_S_BAD_SIG;
+		    *minor_status = kret;
+		    return ret;
+		}
 	    }
 
 	    /*
-	     * Windows accepts Samba3's use of a kerberos, rather than
-	     * GSSAPI checksum here
+	     * If there is no checksum or a kerberos checksum (which Windows
+	     * and Samba accept), we use the ap_options to guess the mutual
+	     * flag.
 	     */
 
-	    kret = krb5_verify_checksum(context,
-					crypto, KRB5_KU_AP_REQ_AUTH_CKSUM, NULL, 0,
-					authenticator->cksum);
-	    krb5_free_authenticator(context, &authenticator);
-	    krb5_crypto_destroy(context, crypto);
-
-	    if(kret) {
-		ret = GSS_S_BAD_SIG;
-		*minor_status = kret;
-		return ret;
-	    }
-
-	    /*
-	     * Samba style get some flags (but not DCE-STYLE), use
-	     * ap_options to guess the mutual flag.
-	     */
- 	    ctx->flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
+	    ctx->flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
 	    if (ap_options & AP_OPTS_MUTUAL_REQUIRED)
 		ctx->flags |= GSS_C_MUTUAL_FLAG;
-        }
+	}
+	krb5_free_authenticator(context, &authenticator);
     }
 
     if(ctx->flags & GSS_C_MUTUAL_FLAG) {
@@ -595,8 +613,8 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 						    rkey);
 		if (kret == 0)
 		    use_subkey = 1;
-		krb5_free_keyblock(context, rkey);
 	    }
+            krb5_free_keyblock(context, rkey);
 	}
 	if (use_subkey) {
 	    ctx->more_flags |= ACCEPTOR_SUBKEY;
@@ -632,7 +650,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
 
     /* Remember the flags */
 
-    ctx->lifetime = ctx->ticket->ticket.endtime;
+    ctx->endtime = ctx->ticket->ticket.endtime;
     ctx->more_flags |= OPEN;
 
     if (mech_type)
@@ -641,7 +659,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
     if (time_rec) {
 	ret = _gsskrb5_lifetime_left(minor_status,
 				     context,
-				     ctx->lifetime,
+				     ctx->endtime,
 				     time_rec);
 	if (ret) {
 	    return ret;
@@ -677,7 +695,7 @@ static OM_uint32
 acceptor_wait_for_dcestyle(OM_uint32 * minor_status,
 			   gsskrb5_ctx ctx,
 			   krb5_context context,
-			   const gss_cred_id_t acceptor_cred_handle,
+			   gss_const_cred_id_t acceptor_cred_handle,
 			   const gss_buffer_t input_token_buffer,
 			   const gss_channel_bindings_t input_chan_bindings,
 			   gss_name_t * src_name,
@@ -759,7 +777,7 @@ acceptor_wait_for_dcestyle(OM_uint32 * minor_status,
 
 	ret = _gsskrb5_lifetime_left(minor_status,
 				     context,
-				     ctx->lifetime,
+				     ctx->endtime,
 				     &lifetime_rec);
 	if (ret) {
 	    return ret;
@@ -840,7 +858,7 @@ acceptor_wait_for_dcestyle(OM_uint32 * minor_status,
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_accept_sec_context(OM_uint32 * minor_status,
 			    gss_ctx_id_t * context_handle,
-			    const gss_cred_id_t acceptor_cred_handle,
+			    gss_const_cred_id_t acceptor_cred_handle,
 			    const gss_buffer_t input_token_buffer,
 			    const gss_channel_bindings_t input_chan_bindings,
 			    gss_name_t * src_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/acquire_cred.c
index d46d6c996..fa418df8a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: acquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -42,37 +42,16 @@ __gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
 			  krb5_principal principal,
 			  OM_uint32 *lifetime)
 {
-    krb5_creds in_cred, out_cred;
-    krb5_const_realm realm;
     krb5_error_code kret;
+    time_t left;
 
-    memset(&in_cred, 0, sizeof(in_cred));
-    in_cred.client = principal;
-
-    realm = krb5_principal_get_realm(context,  principal);
-    if (realm == NULL) {
-	_gsskrb5_clear_status ();
-	*minor_status = KRB5_PRINC_NOMATCH; /* XXX */
-	return GSS_S_FAILURE;
-    }
-
-    kret = krb5_make_principal(context, &in_cred.server,
-			       realm, KRB5_TGS_NAME, realm, NULL);
+    kret = krb5_cc_get_lifetime(context, id, &left);
     if (kret) {
-	*minor_status = kret;
-	return GSS_S_FAILURE;
+        *minor_status = kret;
+        return GSS_S_FAILURE;
     }
 
-    kret = krb5_cc_retrieve_cred(context, id, 0, &in_cred, &out_cred);
-    krb5_free_principal(context, in_cred.server);
-    if (kret) {
-	*minor_status = 0;
-	*lifetime = 0;
-	return GSS_S_COMPLETE;
-    }
-
-    *lifetime = out_cred.times.endtime;
-    krb5_free_cred_contents(context, &out_cred);
+    *lifetime = left;
 
     return GSS_S_COMPLETE;
 }
@@ -103,146 +82,282 @@ get_keytab(krb5_context context, krb5_keytab *keytab)
     return (kret);
 }
 
-static OM_uint32 acquire_initiator_cred
-		  (OM_uint32 * minor_status,
-		   krb5_context context,
-		   gss_const_OID credential_type,
-		   const void *credential_data,
-		   const gss_name_t desired_name,
-		   OM_uint32 time_req,
-		   gss_const_OID desired_mech,
-		   gss_cred_usage_t cred_usage,
-		   gsskrb5_cred handle
-		  )
+/*
+ * This function produces a cred with a MEMORY ccache containing a TGT
+ * acquired with a password.
+ */
+static OM_uint32
+acquire_cred_with_password(OM_uint32 *minor_status,
+                           krb5_context context,
+                           const char *password,
+                           OM_uint32 time_req,
+                           gss_const_OID desired_mech,
+                           gss_cred_usage_t cred_usage,
+                           gsskrb5_cred handle)
 {
-    OM_uint32 ret;
+    OM_uint32 ret = GSS_S_FAILURE;
     krb5_creds cred;
-    krb5_principal def_princ;
     krb5_get_init_creds_opt *opt;
-    krb5_ccache ccache;
-    krb5_keytab keytab;
+    krb5_ccache ccache = NULL;
     krb5_error_code kret;
+    time_t now;
+    OM_uint32 left;
 
-    keytab = NULL;
+    if (cred_usage == GSS_C_ACCEPT) {
+        /*
+         * TODO: Here we should eventually support user2user (when we get
+         *       support for that via an extension to the mechanism
+         *       allowing for more than two security context tokens),
+         *       and/or new unique MEMORY keytabs (we have MEMORY keytab
+         *       support, but we don't have a keytab equivalent of
+         *       krb5_cc_new_unique()).  Either way, for now we can't
+         *       support this.
+         */
+        *minor_status = ENOTSUP; /* XXX Better error? */
+        return GSS_S_FAILURE;
+    }
+
+    memset(&cred, 0, sizeof(cred));
+
+    if (handle->principal == NULL) {
+        kret = krb5_get_default_principal(context, &handle->principal);
+        if (kret)
+            goto end;
+    }
+    kret = krb5_get_init_creds_opt_alloc(context, &opt);
+    if (kret)
+        goto end;
+
+    /*
+     * Get the current time before the AS exchange so we don't
+     * accidentally end up returning a value that puts advertised
+     * expiration past the real expiration.
+     *
+     * We need to do this because krb5_cc_get_lifetime() returns a
+     * relative time that we need to add to the current time.  We ought
+     * to have a version of krb5_cc_get_lifetime() that returns absolute
+     * time...
+     */
+    krb5_timeofday(context, &now);
+
+    kret = krb5_get_init_creds_password(context, &cred, handle->principal,
+                                        password, NULL, NULL, 0, NULL, opt);
+    krb5_get_init_creds_opt_free(context, opt);
+    if (kret)
+        goto end;
+
+    kret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &ccache);
+    if (kret)
+        goto end;
+
+    kret = krb5_cc_initialize(context, ccache, cred.client);
+    if (kret)
+        goto end;
+
+    kret = krb5_cc_store_cred(context, ccache, &cred);
+    if (kret)
+        goto end;
+
+    handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
+
+    ret = __gsskrb5_ccache_lifetime(minor_status, context, ccache,
+                                    handle->principal, &left);
+    if (ret != GSS_S_COMPLETE)
+        goto end;
+    handle->endtime = now + left;
+    handle->ccache = ccache;
     ccache = NULL;
-    def_princ = NULL;
-    ret = GSS_S_FAILURE;
+    ret = GSS_S_COMPLETE;
+    kret = 0;
+
+end:
+    if (ccache != NULL)
+        krb5_cc_destroy(context, ccache);
+    if (cred.client != NULL)
+	krb5_free_cred_contents(context, &cred);
+    if (ret != GSS_S_COMPLETE && kret != 0)
+	*minor_status = kret;
+    return (ret);
+}
+
+/*
+ * Acquires an initiator credential from a ccache or using a keytab.
+ */
+static OM_uint32
+acquire_initiator_cred(OM_uint32 *minor_status,
+                       krb5_context context,
+                       OM_uint32 time_req,
+                       gss_const_OID desired_mech,
+                       gss_cred_usage_t cred_usage,
+                       gsskrb5_cred handle)
+{
+    OM_uint32 ret = GSS_S_FAILURE;
+    krb5_creds cred;
+    krb5_get_init_creds_opt *opt;
+    krb5_principal def_princ = NULL;
+    krb5_ccache def_ccache = NULL;
+    krb5_ccache ccache = NULL;  /* we may store into this ccache */
+    krb5_keytab keytab = NULL;
+    krb5_error_code kret = 0;
+    OM_uint32 left;
+    time_t lifetime = 0;
+    time_t now;
+
     memset(&cred, 0, sizeof(cred));
 
     /*
-     * If we have a preferred principal, lets try to find it in all
-     * caches, otherwise, fall back to default cache, ignore all
-     * errors while searching.
+     * Get current time early so we can set handle->endtime to a value that
+     * cannot accidentally be past the real endtime.  We need a variant of
+     * krb5_cc_get_lifetime() that returns absolute endtime.
+     */
+    krb5_timeofday(context, &now);
+
+    /*
+     * First look for a ccache that has the desired_name (which may be
+     * the default credential name).
+     *
+     * If we don't have an unexpired credential, acquire one with a
+     * keytab.
+     *
+     * If we acquire one with a keytab, save it in the ccache we found
+     * with the expired credential, if any.
+     *
+     * If we don't have any such ccache, then use a MEMORY ccache.
      */
 
-    if (credential_type != GSS_C_NO_OID &&
-	!gss_oid_equal(credential_type, GSS_C_CRED_PASSWORD)) {
-	kret = KRB5_NOCREDS_SUPPLIED; /* XXX */
-	goto end;
-    }
-
-    if (handle->principal) {
-	kret = krb5_cc_cache_match (context,
-				    handle->principal,
-				    &ccache);
+    if (handle->principal != NULL) {
+        /*
+         * Not default credential case.  See if we can find a ccache in
+         * the cccol for the desired_name.
+         */
+	kret = krb5_cc_cache_match(context,
+				   handle->principal,
+				   &ccache);
 	if (kret == 0) {
-	    ret = GSS_S_COMPLETE;
-	    goto found;
+            kret = krb5_cc_get_lifetime(context, ccache, &lifetime);
+            if (kret == 0) {
+                if (lifetime > 0)
+                    goto found;
+                else
+                    goto try_keytab;
+            }
 	}
+        /*
+         * Fall through.  We shouldn't find this in the default ccache
+         * either, but we'll give it a try, then we'll try using a keytab.
+         */
     }
 
+    /*
+     * Either desired_name was GSS_C_NO_NAME (default cred) or
+     * krb5_cc_cache_match() failed (or found expired).
+     */
+    kret = krb5_cc_default(context, &def_ccache);
+    if (kret != 0)
+        goto try_keytab;
+    kret = krb5_cc_get_lifetime(context, def_ccache, &lifetime);
+    if (kret != 0)
+        lifetime = 0;
+    kret = krb5_cc_get_principal(context, def_ccache, &def_princ);
+    if (kret != 0)
+        goto try_keytab;
+    /*
+     * Have a default ccache; see if it matches desired_name.
+     */
+    if (handle->principal == NULL ||
+        krb5_principal_compare(context, handle->principal,
+                               def_princ) == TRUE) {
+        /*
+         * It matches.
+         *
+         * If we end up trying a keytab then we can write the result to
+         * the default ccache.
+         */
+        if (handle->principal == NULL) {
+            kret = krb5_copy_principal(context, def_princ, &handle->principal);
+            if (kret)
+                goto end;
+        }
+        if (ccache != NULL)
+            krb5_cc_close(context, ccache);
+        ccache = def_ccache;
+        def_ccache = NULL;
+        if (lifetime > 0)
+            goto found;
+        /* else we fall through and try using a keytab */
+    }
+
+try_keytab:
+    if (handle->principal == NULL) {
+        /* We need to know what client principal to use */
+        kret = krb5_get_default_principal(context, &handle->principal);
+        if (kret)
+            goto end;
+    }
+    kret = get_keytab(context, &keytab);
+    if (kret)
+        goto end;
+
+    kret = krb5_get_init_creds_opt_alloc(context, &opt);
+    if (kret)
+        goto end;
+    krb5_timeofday(context, &now);
+    kret = krb5_get_init_creds_keytab(context, &cred, handle->principal,
+                                      keytab, 0, NULL, opt);
+    krb5_get_init_creds_opt_free(context, opt);
+    if (kret)
+        goto end;
+
+    /*
+     * We got a credential with a keytab.  Save it if we can.
+     */
     if (ccache == NULL) {
-	kret = krb5_cc_default(context, &ccache);
-	if (kret)
-	    goto end;
-    }
-    kret = krb5_cc_get_principal(context, ccache, &def_princ);
-    if (kret != 0) {
-	/* we'll try to use a keytab below */
-	krb5_cc_close(context, ccache);
-	def_princ = NULL;
-	kret = 0;
-    } else if (handle->principal == NULL)  {
-	kret = krb5_copy_principal(context, def_princ, &handle->principal);
-	if (kret)
-	    goto end;
-    } else if (handle->principal != NULL &&
-	       krb5_principal_compare(context, handle->principal,
-				      def_princ) == FALSE) {
-	krb5_free_principal(context, def_princ);
-	def_princ = NULL;
-	krb5_cc_close(context, ccache);
-	ccache = NULL;
-    }
-    if (def_princ == NULL) {
-	/* We have no existing credentials cache,
-	 * so attempt to get a TGT using a keytab.
-	 */
-	if (handle->principal == NULL) {
-	    kret = krb5_get_default_principal(context, &handle->principal);
-	    if (kret)
-		goto end;
-	}
-	kret = krb5_get_init_creds_opt_alloc(context, &opt);
-	if (kret)
-	    goto end;
-	if (credential_type != GSS_C_NO_OID &&
-	    gss_oid_equal(credential_type, GSS_C_CRED_PASSWORD)) {
-	    gss_buffer_t password = (gss_buffer_t)credential_data;
+        /*
+         * There's no ccache we can overwrite with the credentials we acquired
+         * with a keytab.  We'll use a MEMORY ccache then.
+         *
+         * Note that an application that falls into this repeatedly will do an
+         * AS exchange every time it acquires a credential handle.  Hopefully
+         * this doesn't happen much.  A workaround is to kinit -k once so that
+         * we always re-initialize the matched/default ccache here.  I.e., once
+         * there's a FILE/DIR ccache, we'll keep it frash automatically if we
+         * have a keytab, but if there's no FILE/DIR ccache, then we'll
+         * get a fresh credential *every* time we're asked.
+         */
+        kret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &ccache);
+        if (kret)
+            goto end;
+        handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
+    } /* else we'll re-initialize whichever ccache we matched above */
 
-	    /* XXX are we requiring password to be NUL terminated? */
+    kret = krb5_cc_initialize(context, ccache, cred.client);
+    if (kret)
+        goto end;
+    kret = krb5_cc_store_cred(context, ccache, &cred);
+    if (kret)
+        goto end;
 
-	    kret = krb5_get_init_creds_password(context, &cred,
-						handle->principal,
-						password->value,
-						NULL, NULL, 0, NULL, opt);
-	} else {
-	    kret = get_keytab(context, &keytab);
-	    if (kret) {
-		krb5_get_init_creds_opt_free(context, opt);
-		goto end;
-	    }
-	    kret = krb5_get_init_creds_keytab(context, &cred,
-					      handle->principal, keytab,
-					      0, NULL, opt);
-	}
-	krb5_get_init_creds_opt_free(context, opt);
-	if (kret)
-	    goto end;
-	kret = krb5_cc_new_unique(context, krb5_cc_type_memory,
-				  NULL, &ccache);
-	if (kret)
-	    goto end;
-	kret = krb5_cc_initialize(context, ccache, cred.client);
-	if (kret) {
-	    krb5_cc_destroy(context, ccache);
-	    goto end;
-	}
-	kret = krb5_cc_store_cred(context, ccache, &cred);
-	if (kret) {
-	    krb5_cc_destroy(context, ccache);
-	    goto end;
-	}
-	handle->lifetime = cred.times.endtime;
-	handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
-    } else {
-
-	ret = __gsskrb5_ccache_lifetime(minor_status,
-					context,
-					ccache,
-					handle->principal,
-					&handle->lifetime);
-	if (ret != GSS_S_COMPLETE) {
-	    krb5_cc_close(context, ccache);
-	    goto end;
-	}
-	kret = 0;
-    }
- found:
+found:
+    assert(handle->principal != NULL);
+    ret = __gsskrb5_ccache_lifetime(minor_status, context, ccache,
+                                    handle->principal, &left);
+    if (ret != GSS_S_COMPLETE)
+        goto end;
+    handle->endtime = now + left;
     handle->ccache = ccache;
+    ccache = NULL;
     ret = GSS_S_COMPLETE;
+    kret = 0;
 
 end:
+    if (ccache != NULL) {
+        if ((handle->cred_flags & GSS_CF_DESTROY_CRED_ON_RELEASE) != 0)
+            krb5_cc_destroy(context, ccache);
+        else
+            krb5_cc_close(context, ccache);
+    }
+    if (def_ccache != NULL)
+        krb5_cc_close(context, def_ccache);
     if (cred.client != NULL)
 	krb5_free_cred_contents(context, &cred);
     if (def_princ != NULL)
@@ -254,28 +369,19 @@ end:
     return (ret);
 }
 
-static OM_uint32 acquire_acceptor_cred
-		  (OM_uint32 * minor_status,
-		   krb5_context context,
-		   gss_const_OID credential_type,
-		   const void *credential_data,
-		   const gss_name_t desired_name,
-		   OM_uint32 time_req,
-		   gss_const_OID desired_mech,
-		   gss_cred_usage_t cred_usage,
-		   gsskrb5_cred handle
-		  )
+static OM_uint32
+acquire_acceptor_cred(OM_uint32 * minor_status,
+                      krb5_context context,
+                      OM_uint32 time_req,
+                      gss_const_OID desired_mech,
+                      gss_cred_usage_t cred_usage,
+                      gsskrb5_cred handle)
 {
     OM_uint32 ret;
     krb5_error_code kret;
 
     ret = GSS_S_FAILURE;
 
-    if (credential_type != GSS_C_NO_OID) {
-	kret = EINVAL;
-	goto end;
-    }
-
     kret = get_keytab(context, &handle->keytab);
     if (kret)
 	goto end;
@@ -320,7 +426,7 @@ end:
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred
 (OM_uint32 * minor_status,
- const gss_name_t desired_name,
+ gss_const_name_t desired_name,
  OM_uint32 time_req,
  const gss_OID_set desired_mechs,
  gss_cred_usage_t cred_usage,
@@ -368,7 +474,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred_ext
 (OM_uint32 * minor_status,
- const gss_name_t desired_name,
+ gss_const_name_t desired_name,
  gss_const_OID credential_type,
  const void *credential_data,
  OM_uint32 time_req,
@@ -383,25 +489,26 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred_ext
 
     cred_usage &= GSS_C_OPTION_MASK;
 
-    if (cred_usage != GSS_C_ACCEPT && cred_usage != GSS_C_INITIATE && cred_usage != GSS_C_BOTH) {
+    if (cred_usage != GSS_C_ACCEPT && cred_usage != GSS_C_INITIATE &&
+        cred_usage != GSS_C_BOTH) {
 	*minor_status = GSS_KRB5_S_G_BAD_USAGE;
 	return GSS_S_FAILURE;
     }
 
     GSSAPI_KRB5_INIT(&context);
 
-    *output_cred_handle = NULL;
+    *output_cred_handle = GSS_C_NO_CREDENTIAL;
 
     handle = calloc(1, sizeof(*handle));
     if (handle == NULL) {
 	*minor_status = ENOMEM;
-        return (GSS_S_FAILURE);
+        return GSS_S_FAILURE;
     }
 
     HEIMDAL_MUTEX_init(&handle->cred_id_mutex);
 
     if (desired_name != GSS_C_NO_NAME) {
-	ret = _gsskrb5_canon_name(minor_status, context, 1, NULL,
+	ret = _gsskrb5_canon_name(minor_status, context,
 				  desired_name, &handle->principal);
 	if (ret) {
 	    HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
@@ -409,29 +516,75 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred_ext
 	    return ret;
 	}
     }
-    if (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH) {
-	ret = acquire_initiator_cred(minor_status, context,
-				     credential_type, credential_data,
-				     desired_name, time_req,
-				     desired_mech, cred_usage, handle);
-    	if (ret != GSS_S_COMPLETE) {
-	    HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
-	    krb5_free_principal(context, handle->principal);
-	    free(handle);
-	    return (ret);
-	}
-    }
-    if (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH) {
-	ret = acquire_acceptor_cred(minor_status, context,
-				    credential_type, credential_data,
-				    desired_name, time_req,
-				    desired_mech, cred_usage, handle);
-	if (ret != GSS_S_COMPLETE) {
-	    HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
-	    krb5_free_principal(context, handle->principal);
-	    free(handle);
-	    return (ret);
-	}
+
+    if (credential_type != GSS_C_NO_OID &&
+        gss_oid_equal(credential_type, GSS_C_CRED_PASSWORD)) {
+        /* Acquire a cred with a password */
+        gss_const_buffer_t pwbuf = credential_data;
+        char *pw;
+
+        if (pwbuf == NULL) {
+            HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+            free(handle);
+            *minor_status = KRB5_NOCREDS_SUPPLIED; /* see below */
+            return GSS_S_CALL_INACCESSIBLE_READ;
+        }
+
+        /* NUL-terminate the password, if it wasn't already */
+        pw = strndup(pwbuf->value, pwbuf->length);
+        if (pw == NULL) {
+            HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+            free(handle);
+            *minor_status = krb5_enomem(context);
+            return GSS_S_CALL_INACCESSIBLE_READ;
+        }
+        ret = acquire_cred_with_password(minor_status, context, pw, time_req,
+                                         desired_mech, cred_usage, handle);
+        free(pw);
+        if (ret != GSS_S_COMPLETE) {
+            HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+            krb5_free_principal(context, handle->principal);
+            free(handle);
+            return (ret);
+        }
+    } else if (credential_type != GSS_C_NO_OID) {
+        /*
+         * _gss_acquire_cred_ext() called with something other than a password.
+         *
+         * Not supported.
+         *
+         * _gss_acquire_cred_ext() is not a supported public interface, so
+         * we don't have to try too hard as to minor status codes here.
+         */
+        HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+        free(handle);
+        *minor_status = ENOTSUP;
+        return GSS_S_FAILURE;
+    } else {
+        /*
+         * Acquire a credential from the background credential store (ccache,
+         * keytab).
+         */
+        if (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH) {
+            ret = acquire_initiator_cred(minor_status, context, time_req,
+                                         desired_mech, cred_usage, handle);
+            if (ret != GSS_S_COMPLETE) {
+                HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+                krb5_free_principal(context, handle->principal);
+                free(handle);
+                return (ret);
+            }
+        }
+        if (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH) {
+            ret = acquire_acceptor_cred(minor_status, context, time_req,
+                                        desired_mech, cred_usage, handle);
+            if (ret != GSS_S_COMPLETE) {
+                HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
+                krb5_free_principal(context, handle->principal);
+                free(handle);
+                return (ret);
+            }
+        }
     }
     ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
     if (ret == GSS_S_COMPLETE)
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/add_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/add_cred.c
index 055fe7462..a4045a7c6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/add_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/add_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: add_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -37,8 +37,8 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
      OM_uint32           *minor_status,
-     const gss_cred_id_t input_cred_handle,
-     const gss_name_t    desired_name,
+     gss_const_cred_id_t input_cred_handle,
+     gss_const_name_t    desired_name,
      const gss_OID       desired_mech,
      gss_cred_usage_t    cred_usage,
      OM_uint32           initiator_time_req,
@@ -49,7 +49,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
      OM_uint32           *acceptor_time_rec)
 {
     krb5_context context;
-    OM_uint32 ret, lifetime;
+    OM_uint32 major, lifetime;
     gsskrb5_cred cred, handle;
     krb5_const_principal dname;
 
@@ -57,99 +57,120 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
     cred = (gsskrb5_cred)input_cred_handle;
     dname = (krb5_const_principal)desired_name;
 
+    if (cred == NULL && output_cred_handle == NULL) {
+        *minor_status = EINVAL;
+        return GSS_S_CALL_INACCESSIBLE_WRITE;
+    }
+
     GSSAPI_KRB5_INIT (&context);
 
-    if (gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0) {
+    if (desired_mech != GSS_C_NO_OID &&
+        gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0) {
 	*minor_status = 0;
 	return GSS_S_BAD_MECH;
     }
 
-    if (cred == NULL && output_cred_handle == NULL) {
-	*minor_status = 0;
-	return GSS_S_NO_CRED;
-    }
+    if (cred == NULL) {
+        /*
+         * Acquire a credential; output_cred_handle can't be NULL, see above.
+         */
+        heim_assert(output_cred_handle != NULL,
+                    "internal error in _gsskrb5_add_cred()");
 
-    if (cred == NULL) { /* XXX standard conformance failure */
-	*minor_status = 0;
-	return GSS_S_NO_CRED;
-    }
+        major = _gsskrb5_acquire_cred(minor_status, desired_name,
+                                      min(initiator_time_req,
+                                          acceptor_time_req),
+                                      GSS_C_NO_OID_SET,
+                                      cred_usage,
+                                      output_cred_handle,
+                                      actual_mechs, &lifetime);
+        if (major != GSS_S_COMPLETE)
+            goto failure;
+
+    } else {
+        /*
+         * Check that we're done or copy input to output if
+         * output_cred_handle != NULL.
+         */
 
-    /* check if requested output usage is compatible with output usage */
-    if (output_cred_handle != NULL) {
 	HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
+
+        /* Check if requested output usage is compatible with output usage */
 	if (cred->usage != cred_usage && cred->usage != GSS_C_BOTH) {
 	    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	    *minor_status = GSS_KRB5_S_G_BAD_USAGE;
 	    return(GSS_S_FAILURE);
 	}
-    }
 
-    /* check that we have the same name */
-    if (dname != NULL &&
-	krb5_principal_compare(context, dname,
-			       cred->principal) != FALSE) {
-	if (output_cred_handle)
-	    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-	*minor_status = 0;
-	return GSS_S_BAD_NAME;
-    }
+        /* Check that we have the same name */
+        if (dname != NULL &&
+            krb5_principal_compare(context, dname,
+                                   cred->principal) != FALSE) {
+            HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+            *minor_status = 0;
+            return GSS_S_BAD_NAME;
+        }
 
-    /* make a copy */
-    if (output_cred_handle) {
-	krb5_error_code kret;
+        if (output_cred_handle == NULL) {
+            /*
+             * This case is basically useless as we implement a single
+             * mechanism here, so we can't add elements to the
+             * input_cred_handle.
+             */
+            HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+            *minor_status = 0;
+            return GSS_S_COMPLETE;
+        }
+
+        /*
+         * Copy input to output -- this works as if we were a
+         * GSS_Duplicate_cred() for one mechanism element.
+         */
 
 	handle = calloc(1, sizeof(*handle));
 	if (handle == NULL) {
-	    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+            if (cred != NULL)
+                HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	    *minor_status = ENOMEM;
 	    return (GSS_S_FAILURE);
 	}
 
 	handle->usage = cred_usage;
-	handle->lifetime = cred->lifetime;
+	handle->endtime = cred->endtime;
 	handle->principal = NULL;
 	handle->keytab = NULL;
 	handle->ccache = NULL;
 	handle->mechanisms = NULL;
 	HEIMDAL_MUTEX_init(&handle->cred_id_mutex);
 
-	ret = GSS_S_FAILURE;
+	major = GSS_S_FAILURE;
 
-	kret = krb5_copy_principal(context, cred->principal,
-				  &handle->principal);
-	if (kret) {
+	*minor_status = krb5_copy_principal(context, cred->principal,
+                                            &handle->principal);
+	if (*minor_status) {
 	    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	    free(handle);
-	    *minor_status = kret;
 	    return GSS_S_FAILURE;
 	}
 
 	if (cred->keytab) {
 	    char *name = NULL;
 
-	    ret = GSS_S_FAILURE;
-
-	    kret = krb5_kt_get_full_name(context, cred->keytab, &name);
-	    if (kret) {
-		*minor_status = kret;
+            *minor_status = krb5_kt_get_full_name(context, cred->keytab,
+                                                  &name);
+	    if (*minor_status)
 		goto failure;
-	    }
 
-	    kret = krb5_kt_resolve(context, name,
-				   &handle->keytab);
+            *minor_status = krb5_kt_resolve(context, name, &handle->keytab);
 	    krb5_xfree(name);
-	    if (kret){
-		*minor_status = kret;
+	    if (*minor_status)
 		goto failure;
-	    }
 	}
 
 	if (cred->ccache) {
 	    const char *type, *name;
 	    char *type_name = NULL;
 
-	    ret = GSS_S_FAILURE;
-
 	    type = krb5_cc_get_type(context, cred->ccache);
 	    if (type == NULL){
 		*minor_status = ENOMEM;
@@ -157,19 +178,15 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
 	    }
 
 	    if (strcmp(type, "MEMORY") == 0) {
-		ret = krb5_cc_new_unique(context, type,
-					 NULL, &handle->ccache);
-		if (ret) {
-		    *minor_status = ret;
+		*minor_status = krb5_cc_new_unique(context, type,
+                                                   NULL, &handle->ccache);
+		if (*minor_status)
 		    goto failure;
-		}
 
-		ret = krb5_cc_copy_cache(context, cred->ccache,
-					 handle->ccache);
-		if (ret) {
-		    *minor_status = ret;
+                *minor_status = krb5_cc_copy_cache(context, cred->ccache,
+                                                   handle->ccache);
+		if (*minor_status)
 		    goto failure;
-		}
 
 	    } else {
 		name = krb5_cc_get_name(context, cred->ccache);
@@ -178,52 +195,47 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
 		    goto failure;
 		}
 
-		kret = asprintf(&type_name, "%s:%s", type, name);
-		if (kret < 0 || type_name == NULL) {
+		if (asprintf(&type_name, "%s:%s", type, name) == -1 ||
+                    type_name == NULL) {
 		    *minor_status = ENOMEM;
 		    goto failure;
 		}
 
-		kret = krb5_cc_resolve(context, type_name,
-				       &handle->ccache);
+                *minor_status = krb5_cc_resolve(context, type_name,
+                                                &handle->ccache);
 		free(type_name);
-		if (kret) {
-		    *minor_status = kret;
+		if (*minor_status)
 		    goto failure;
-		}
 	    }
 	}
-	ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
-	if (ret)
+	major = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
+	if (major != GSS_S_COMPLETE)
 	    goto failure;
 
-	ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-				     &handle->mechanisms);
-	if (ret)
+	major = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
+				       &handle->mechanisms);
+	if (major != GSS_S_COMPLETE)
 	    goto failure;
+
+        HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+
+        major = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)cred,
+                                      NULL, &lifetime, NULL, actual_mechs);
+        if (major != GSS_S_COMPLETE)
+            goto failure;
+
+	*output_cred_handle = (gss_cred_id_t)handle;
     }
 
-    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-
-    ret = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)cred,
-				NULL, &lifetime, NULL, actual_mechs);
-    if (ret)
-	goto failure;
-
     if (initiator_time_rec)
 	*initiator_time_rec = lifetime;
     if (acceptor_time_rec)
 	*acceptor_time_rec = lifetime;
 
-    if (output_cred_handle) {
-	*output_cred_handle = (gss_cred_id_t)handle;
-    }
-
     *minor_status = 0;
-    return ret;
-
- failure:
+    return major;
 
+failure:
     if (handle) {
 	if (handle->principal)
 	    krb5_free_principal(context, handle->principal);
@@ -235,7 +247,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
 	    gss_release_oid_set(NULL, &handle->mechanisms);
 	free(handle);
     }
-    if (output_cred_handle)
+    if (cred && output_cred_handle)
 	HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-    return ret;
+    return major;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/address_to_krb5addr.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/address_to_krb5addr.c
index 8ed70114b..48a89a24c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/address_to_krb5addr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/address_to_krb5addr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: address_to_krb5addr.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: address_to_krb5addr.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/aeap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/aeap.c
index 045f08634..f889811b8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/aeap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/aeap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: aeap.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: aeap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2008  Kungliga Tekniska Högskolan
@@ -46,17 +46,43 @@ _gk_wrap_iov(OM_uint32 * minor_status,
 	     gss_iov_buffer_desc *iov,
 	     int iov_count)
 {
-  const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
-  krb5_context context;
+    const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
+    krb5_context context;
+    OM_uint32 ret;
+    krb5_keyblock *key;
+    krb5_keytype keytype;
 
-  GSSAPI_KRB5_INIT (&context);
+    GSSAPI_KRB5_INIT (&context);
 
-  if (ctx->more_flags & IS_CFX)
-      return _gssapi_wrap_cfx_iov(minor_status, ctx, context,
-				  conf_req_flag, conf_state,
-				  iov, iov_count);
+    if (ctx->more_flags & IS_CFX)
+        return _gssapi_wrap_cfx_iov(minor_status, ctx, context,
+				    conf_req_flag, conf_state,
+				    iov, iov_count);
 
-    return GSS_S_FAILURE;
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    ret = _gsskrb5i_get_token_key(ctx, context, &key);
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+    krb5_enctype_to_keytype(context, key->keytype, &keytype);
+
+    switch (keytype) {
+    case KEYTYPE_ARCFOUR:
+    case KEYTYPE_ARCFOUR_56:
+	ret = _gssapi_wrap_iov_arcfour(minor_status, ctx, context,
+				       conf_req_flag, conf_state,
+				       iov, iov_count, key);
+	break;
+
+    default:
+	ret = GSS_S_FAILURE;
+	break;
+    }
+
+    krb5_free_keyblock(context, key);
+    return ret;
 }
 
 OM_uint32 GSSAPI_CALLCONV
@@ -69,6 +95,9 @@ _gk_unwrap_iov(OM_uint32 *minor_status,
 {
     const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
     krb5_context context;
+    OM_uint32 ret;
+    krb5_keytype keytype;
+    krb5_keyblock *key;
 
     GSSAPI_KRB5_INIT (&context);
 
@@ -76,7 +105,30 @@ _gk_unwrap_iov(OM_uint32 *minor_status,
 	return _gssapi_unwrap_cfx_iov(minor_status, ctx, context,
 				      conf_state, qop_state, iov, iov_count);
 
-    return GSS_S_FAILURE;
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    ret = _gsskrb5i_get_token_key(ctx, context, &key);
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+    krb5_enctype_to_keytype(context, key->keytype, &keytype);
+
+    switch (keytype) {
+    case KEYTYPE_ARCFOUR:
+    case KEYTYPE_ARCFOUR_56:
+	ret = _gssapi_unwrap_iov_arcfour(minor_status, ctx, context,
+					 conf_state, qop_state,
+					 iov, iov_count, key);
+	break;
+
+    default:
+	ret = GSS_S_FAILURE;
+	break;
+    }
+
+    krb5_free_keyblock(context, key);
+    return ret;
 }
 
 OM_uint32 GSSAPI_CALLCONV
@@ -90,6 +142,9 @@ _gk_wrap_iov_length(OM_uint32 * minor_status,
 {
     const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
     krb5_context context;
+    OM_uint32 ret;
+    krb5_keytype keytype;
+    krb5_keyblock *key;
 
     GSSAPI_KRB5_INIT (&context);
 
@@ -98,5 +153,28 @@ _gk_wrap_iov_length(OM_uint32 * minor_status,
 					   conf_req_flag, qop_req, conf_state,
 					   iov, iov_count);
 
-    return GSS_S_FAILURE;
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    ret = _gsskrb5i_get_token_key(ctx, context, &key);
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+    krb5_enctype_to_keytype(context, key->keytype, &keytype);
+
+    switch (keytype) {
+    case KEYTYPE_ARCFOUR:
+    case KEYTYPE_ARCFOUR_56:
+	ret = _gssapi_wrap_iov_length_arcfour(minor_status, ctx, context,
+					      conf_req_flag, qop_req, conf_state,
+					      iov, iov_count);
+	break;
+
+    default:
+	ret = GSS_S_FAILURE;
+	break;
+    }
+
+    krb5_free_keyblock(context, key);
+    return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/arcfour.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/arcfour.c
index b47f3dc02..a3e65ea37 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/arcfour.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/arcfour.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: arcfour.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: arcfour.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
@@ -71,7 +71,7 @@
 
 static krb5_error_code
 arcfour_mic_key(krb5_context context, krb5_keyblock *key,
-		void *cksum_data, size_t cksum_size,
+		const void *cksum_data, size_t cksum_size,
 		void *key6_data, size_t key6_size)
 {
     krb5_error_code ret;
@@ -88,7 +88,7 @@ arcfour_mic_key(krb5_context context, krb5_keyblock *key,
     cksum_k5.checksum.data = k5_data;
     cksum_k5.checksum.length = sizeof(k5_data);
 
-    if (key->keytype == ENCTYPE_ARCFOUR_HMAC_MD5_56) {
+    if (key->keytype == KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56) {
 	char L40[14] = "fortybits";
 
 	memcpy(L40 + 10, T, sizeof(T));
@@ -102,7 +102,7 @@ arcfour_mic_key(krb5_context context, krb5_keyblock *key,
     if (ret)
 	return ret;
 
-    key5.keytype = ENCTYPE_ARCFOUR_HMAC_MD5;
+    key5.keytype = KRB5_ENCTYPE_ARCFOUR_HMAC_MD5;
     key5.keyvalue = cksum_k5.checksum;
 
     cksum_k6.checksum.data = key6_data;
@@ -114,30 +114,73 @@ arcfour_mic_key(krb5_context context, krb5_keyblock *key,
 
 
 static krb5_error_code
-arcfour_mic_cksum(krb5_context context,
-		  krb5_keyblock *key, unsigned usage,
-		  u_char *sgn_cksum, size_t sgn_cksum_sz,
-		  const u_char *v1, size_t l1,
-		  const void *v2, size_t l2,
-		  const void *v3, size_t l3)
+arcfour_mic_cksum_iov(krb5_context context,
+		      krb5_keyblock *key, unsigned usage,
+		      u_char *sgn_cksum, size_t sgn_cksum_sz,
+		      const u_char *v1, size_t l1,
+		      const void *v2, size_t l2,
+		      const gss_iov_buffer_desc *iov,
+		      int iov_count,
+		      const gss_iov_buffer_desc *padding)
 {
     Checksum CKSUM;
     u_char *ptr;
     size_t len;
+    size_t ofs = 0;
+    int i;
     krb5_crypto crypto;
     krb5_error_code ret;
 
     assert(sgn_cksum_sz == 8);
 
-    len = l1 + l2 + l3;
+    len = l1 + l2;
+
+    for (i=0; i < iov_count; i++) {
+	switch (GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	case GSS_IOV_BUFFER_TYPE_DATA:
+	case GSS_IOV_BUFFER_TYPE_SIGN_ONLY:
+	    break;
+	default:
+	    continue;
+	}
+
+	len += iov[i].buffer.length;
+    }
+
+    if (padding) {
+	len += padding->buffer.length;
+    }
 
     ptr = malloc(len);
     if (ptr == NULL)
 	return ENOMEM;
 
-    memcpy(ptr, v1, l1);
-    memcpy(ptr + l1, v2, l2);
-    memcpy(ptr + l1 + l2, v3, l3);
+    memcpy(ptr + ofs, v1, l1);
+    ofs += l1;
+    memcpy(ptr + ofs, v2, l2);
+    ofs += l2;
+
+    for (i=0; i < iov_count; i++) {
+	switch (GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	case GSS_IOV_BUFFER_TYPE_DATA:
+	case GSS_IOV_BUFFER_TYPE_SIGN_ONLY:
+	    break;
+	default:
+	    continue;
+	}
+
+	memcpy(ptr + ofs,
+	       iov[i].buffer.value,
+	       iov[i].buffer.length);
+	ofs += iov[i].buffer.length;
+    }
+
+    if (padding) {
+	memcpy(ptr + ofs,
+	       padding->buffer.value,
+	       padding->buffer.length);
+	ofs += padding->buffer.length;
+    }
 
     ret = krb5_crypto_init(context, key, 0, &crypto);
     if (ret) {
@@ -151,6 +194,7 @@ arcfour_mic_cksum(krb5_context context,
 			       0,
 			       ptr, len,
 			       &CKSUM);
+    memset(ptr, 0, len);
     free(ptr);
     if (ret == 0) {
 	memcpy(sgn_cksum, CKSUM.checksum.data, sgn_cksum_sz);
@@ -161,6 +205,26 @@ arcfour_mic_cksum(krb5_context context,
     return ret;
 }
 
+static krb5_error_code
+arcfour_mic_cksum(krb5_context context,
+		  krb5_keyblock *key, unsigned usage,
+		  u_char *sgn_cksum, size_t sgn_cksum_sz,
+		  const u_char *v1, size_t l1,
+		  const void *v2, size_t l2,
+		  const void *v3, size_t l3)
+{
+    gss_iov_buffer_desc iov;
+
+    iov.type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
+    iov.buffer.value = rk_UNCONST(v3);
+    iov.buffer.length = l3;
+
+    return arcfour_mic_cksum_iov(context, key, usage,
+				 sgn_cksum, sgn_cksum_sz,
+				 v1, l1, v2, l2,
+				 &iov, 1, NULL);
+}
+
 
 OM_uint32
 _gssapi_get_mic_arcfour(OM_uint32 * minor_status,
@@ -762,3 +826,563 @@ _gssapi_wrap_size_arcfour(OM_uint32 *minor_status,
 
     return GSS_S_COMPLETE;
 }
+
+OM_uint32
+_gssapi_wrap_iov_length_arcfour(OM_uint32 *minor_status,
+				gsskrb5_ctx ctx,
+				krb5_context context,
+				int conf_req_flag,
+				gss_qop_t qop_req,
+				int *conf_state,
+				gss_iov_buffer_desc *iov,
+				int iov_count)
+{
+    OM_uint32 major_status;
+    size_t data_len = 0;
+    int i;
+    gss_iov_buffer_desc *header = NULL;
+    gss_iov_buffer_desc *padding = NULL;
+    gss_iov_buffer_desc *trailer = NULL;
+
+    *minor_status = 0;
+
+    for (i = 0; i < iov_count; i++) {
+	switch(GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	case GSS_IOV_BUFFER_TYPE_EMPTY:
+	    break;
+	case GSS_IOV_BUFFER_TYPE_DATA:
+	    data_len += iov[i].buffer.length;
+	    break;
+	case GSS_IOV_BUFFER_TYPE_HEADER:
+	    if (header != NULL) {
+		*minor_status = EINVAL;
+		return GSS_S_FAILURE;
+	    }
+	    header = &iov[i];
+	    break;
+	case GSS_IOV_BUFFER_TYPE_TRAILER:
+	    if (trailer != NULL) {
+		*minor_status = EINVAL;
+		return GSS_S_FAILURE;
+	    }
+	    trailer = &iov[i];
+	    break;
+	case GSS_IOV_BUFFER_TYPE_PADDING:
+	    if (padding != NULL) {
+		*minor_status = EINVAL;
+		return GSS_S_FAILURE;
+	    }
+	    padding = &iov[i];
+	    break;
+	case GSS_IOV_BUFFER_TYPE_SIGN_ONLY:
+	    break;
+	default:
+	    *minor_status = EINVAL;
+	    return GSS_S_FAILURE;
+	}
+    }
+
+    major_status = _gk_verify_buffers(minor_status, ctx, header, padding, trailer);
+    if (major_status != GSS_S_COMPLETE) {
+	    return major_status;
+    }
+
+    if (IS_DCE_STYLE(ctx)) {
+	size_t len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
+	size_t total_len;
+	_gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
+	header->buffer.length = total_len;
+    } else {
+	size_t len;
+	size_t total_len;
+	if (padding) {
+	    data_len += 1; /* padding */
+	}
+	len = data_len + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
+	_gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
+	header->buffer.length = total_len - data_len;
+    }
+
+    if (trailer) {
+	trailer->buffer.length = 0;
+    }
+
+    if (padding) {
+	padding->buffer.length = 1;
+    }
+
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32
+_gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
+			 gsskrb5_ctx ctx,
+			 krb5_context context,
+			 int conf_req_flag,
+			 int *conf_state,
+			 gss_iov_buffer_desc *iov,
+			 int iov_count,
+			 krb5_keyblock *key)
+{
+    OM_uint32 major_status, junk;
+    gss_iov_buffer_desc *header, *padding, *trailer;
+    krb5_error_code kret;
+    int32_t seq_number;
+    u_char Klocaldata[16], k6_data[16], *p, *p0;
+    size_t make_len = 0;
+    size_t header_len = 0;
+    size_t data_len = 0;
+    krb5_keyblock Klocal;
+    int i;
+
+    header = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_HEADER);
+    padding = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_PADDING);
+    trailer = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_TRAILER);
+
+    major_status = _gk_verify_buffers(minor_status, ctx, header, padding, trailer);
+    if (major_status != GSS_S_COMPLETE) {
+	return major_status;
+    }
+
+    for (i = 0; i < iov_count; i++) {
+	switch (GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	case GSS_IOV_BUFFER_TYPE_DATA:
+	    break;
+	default:
+	    continue;
+	}
+
+	data_len += iov[i].buffer.length;
+    }
+
+    if (padding) {
+	data_len += 1;
+    }
+
+    if (IS_DCE_STYLE(ctx)) {
+	size_t unwrapped_len;
+	unwrapped_len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
+	_gssapi_encap_length(unwrapped_len,
+			     &make_len,
+			     &header_len,
+			     GSS_KRB5_MECHANISM);
+    } else {
+	size_t unwrapped_len;
+	unwrapped_len = GSS_ARCFOUR_WRAP_TOKEN_SIZE + data_len;
+	_gssapi_encap_length(unwrapped_len,
+			     &make_len,
+			     &header_len,
+			     GSS_KRB5_MECHANISM);
+	header_len -= data_len;
+    }
+
+    if (GSS_IOV_BUFFER_FLAGS(header->type) & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE) {
+	major_status = _gk_allocate_buffer(minor_status, header,
+					   header_len);
+	if (major_status != GSS_S_COMPLETE)
+	    goto failure;
+    } else if (header->buffer.length < header_len) {
+	*minor_status = KRB5_BAD_MSIZE;
+	major_status = GSS_S_FAILURE;
+	goto failure;
+    } else {
+	header->buffer.length = header_len;
+    }
+
+    if (padding) {
+	if (GSS_IOV_BUFFER_FLAGS(padding->type) & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE) {
+	    major_status = _gk_allocate_buffer(minor_status, padding, 1);
+	    if (major_status != GSS_S_COMPLETE)
+		goto failure;
+	} else if (padding->buffer.length < 1) {
+	    *minor_status = KRB5_BAD_MSIZE;
+	    major_status = GSS_S_FAILURE;
+	    goto failure;
+	} else {
+	    padding->buffer.length = 1;
+	}
+	memset(padding->buffer.value, 1, 1);
+    }
+
+    if (trailer) {
+	trailer->buffer.length = 0;
+	trailer->buffer.value = NULL;
+    }
+
+    p0 = _gssapi_make_mech_header(header->buffer.value,
+				  make_len,
+				  GSS_KRB5_MECHANISM);
+    p = p0;
+
+    *p++ = 0x02; /* TOK_ID */
+    *p++ = 0x01;
+    *p++ = 0x11; /* SGN_ALG */
+    *p++ = 0x00;
+    if (conf_req_flag) {
+	*p++ = 0x10; /* SEAL_ALG */
+	*p++ = 0x00;
+    } else {
+	*p++ = 0xff; /* SEAL_ALG */
+	*p++ = 0xff;
+    }
+    *p++ = 0xff; /* Filler */
+    *p++ = 0xff;
+
+    p = NULL;
+
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    krb5_auth_con_getlocalseqnumber(context,
+				    ctx->auth_context,
+				    &seq_number);
+    _gsskrb5_encode_be_om_uint32(seq_number, p0 + 8);
+
+    krb5_auth_con_setlocalseqnumber(context,
+				    ctx->auth_context,
+				    ++seq_number);
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+
+    memset(p0 + 8 + 4,
+           (ctx->more_flags & LOCAL) ? 0 : 0xff,
+           4);
+
+    krb5_generate_random_block(p0 + 24, 8); /* fill in Confounder */
+
+    /* Sign Data */
+    kret = arcfour_mic_cksum_iov(context,
+				 key, KRB5_KU_USAGE_SEAL,
+				 p0 + 16, 8, /* SGN_CKSUM */
+				 p0, 8, /* TOK_ID, SGN_ALG, SEAL_ALG, Filler */
+				 p0 + 24, 8, /* Confounder */
+				 iov, iov_count, /* Data + SignOnly */
+				 padding); /* padding */
+    if (kret) {
+	*minor_status = kret;
+	major_status = GSS_S_FAILURE;
+	goto failure;
+    }
+
+    Klocal.keytype = key->keytype;
+    Klocal.keyvalue.data = Klocaldata;
+    Klocal.keyvalue.length = sizeof(Klocaldata);
+
+    for (i = 0; i < 16; i++) {
+	Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
+    }
+    kret = arcfour_mic_key(context, &Klocal,
+			   p0 + 8, 4, /* SND_SEQ */
+			   k6_data, sizeof(k6_data));
+    memset(Klocaldata, 0, sizeof(Klocaldata));
+    if (kret) {
+	*minor_status = kret;
+	major_status = GSS_S_FAILURE;
+	goto failure;
+    }
+
+    if (conf_req_flag) {
+	EVP_CIPHER_CTX rc4_key;
+
+	EVP_CIPHER_CTX_init(&rc4_key);
+	EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
+
+	/* Confounder */
+	EVP_Cipher(&rc4_key, p0 + 24, p0 + 24, 8);
+
+	/* Seal Data */
+	for (i=0; i < iov_count; i++) {
+	    switch (GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	    case GSS_IOV_BUFFER_TYPE_DATA:
+		break;
+	    default:
+		continue;
+	    }
+
+	    EVP_Cipher(&rc4_key, iov[i].buffer.value,
+		       iov[i].buffer.value, iov[i].buffer.length);
+	}
+
+	/* Padding */
+	if (padding) {
+	    EVP_Cipher(&rc4_key, padding->buffer.value,
+		       padding->buffer.value, padding->buffer.length);
+	}
+
+	EVP_CIPHER_CTX_cleanup(&rc4_key);
+    }
+    memset(k6_data, 0, sizeof(k6_data));
+
+    kret = arcfour_mic_key(context, key,
+			   p0 + 16, 8, /* SGN_CKSUM */
+			   k6_data, sizeof(k6_data));
+    if (kret) {
+	*minor_status = kret;
+	major_status = GSS_S_FAILURE;
+        return major_status;
+    }
+
+    {
+	EVP_CIPHER_CTX rc4_key;
+
+	EVP_CIPHER_CTX_init(&rc4_key);
+	EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
+	EVP_Cipher(&rc4_key, p0 + 8, p0 + 8, 8); /* SND_SEQ */
+	EVP_CIPHER_CTX_cleanup(&rc4_key);
+
+	memset(k6_data, 0, sizeof(k6_data));
+    }
+
+    if (conf_state)
+	*conf_state = conf_req_flag;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+
+failure:
+
+    gss_release_iov_buffer(&junk, iov, iov_count);
+
+    return major_status;
+}
+
+OM_uint32
+_gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
+			   gsskrb5_ctx ctx,
+			   krb5_context context,
+			   int *pconf_state,
+			   gss_qop_t *pqop_state,
+			   gss_iov_buffer_desc *iov,
+			   int iov_count,
+			   krb5_keyblock *key)
+{
+    OM_uint32 major_status;
+    gss_iov_buffer_desc *header, *padding, *trailer;
+    krb5_keyblock Klocal;
+    uint8_t Klocaldata[16];
+    uint8_t k6_data[16], snd_seq[8], Confounder[8];
+    uint8_t cksum_data[8];
+    uint8_t *_p = NULL;
+    const uint8_t *p, *p0;
+    size_t verify_len = 0;
+    uint32_t seq_number;
+    size_t hlen = 0;
+    int conf_state;
+    int cmp;
+    size_t i;
+    krb5_error_code kret;
+    OM_uint32 ret;
+
+    if (pconf_state != NULL) {
+	*pconf_state = 0;
+    }
+    if (pqop_state != NULL) {
+	*pqop_state = 0;
+    }
+
+    header = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_HEADER);
+    padding = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_PADDING);
+    trailer = _gk_find_buffer(iov, iov_count, GSS_IOV_BUFFER_TYPE_TRAILER);
+
+    /* Check if the packet is correct */
+    major_status = _gk_verify_buffers(minor_status,
+				  ctx,
+				  header,
+				  padding,
+				  trailer);
+    if (major_status != GSS_S_COMPLETE) {
+	return major_status;
+    }
+
+    if (padding != NULL && padding->buffer.length != 1) {
+	*minor_status = EINVAL;
+	return GSS_S_FAILURE;
+    }
+
+    if (IS_DCE_STYLE(context)) {
+	verify_len = GSS_ARCFOUR_WRAP_TOKEN_SIZE +
+		     GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE;
+	if (header->buffer.length > verify_len) {
+	    return GSS_S_BAD_MECH;
+	}
+    } else {
+	verify_len = header->buffer.length;
+    }
+    _p = header->buffer.value;
+
+    ret = _gssapi_verify_mech_header(&_p,
+				     verify_len,
+				     GSS_KRB5_MECHANISM);
+    if (ret) {
+	return ret;
+    }
+    p0 = _p;
+
+    /* length of mech header */
+    hlen = (p0 - (uint8_t *)header->buffer.value);
+    hlen += GSS_ARCFOUR_WRAP_TOKEN_SIZE;
+
+    if (hlen > header->buffer.length) {
+	return GSS_S_BAD_MECH;
+    }
+
+    p = p0;
+
+    if (memcmp(p, "\x02\x01", 2) != 0)
+	return GSS_S_BAD_SIG;
+    p += 2;
+    if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
+	return GSS_S_BAD_SIG;
+    p += 2;
+
+    if (memcmp (p, "\x10\x00", 2) == 0)
+	conf_state = 1;
+    else if (memcmp (p, "\xff\xff", 2) == 0)
+	conf_state = 0;
+    else
+	return GSS_S_BAD_SIG;
+
+    p += 2;
+    if (memcmp (p, "\xff\xff", 2) != 0)
+	return GSS_S_BAD_MIC;
+    p = NULL;
+
+    kret = arcfour_mic_key(context,
+			   key,
+			   p0 + 16, /* SGN_CKSUM */
+			   8,       /* SGN_CKSUM_LEN */
+			   k6_data,
+			   sizeof(k6_data));
+    if (kret) {
+	*minor_status = kret;
+	return GSS_S_FAILURE;
+    }
+
+    {
+	EVP_CIPHER_CTX rc4_key;
+
+	EVP_CIPHER_CTX_init(&rc4_key);
+	EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
+	EVP_Cipher(&rc4_key, snd_seq, p0 + 8, 8); /* SND_SEQ */
+	EVP_CIPHER_CTX_cleanup(&rc4_key);
+
+	memset(k6_data, 0, sizeof(k6_data));
+    }
+
+    _gsskrb5_decode_be_om_uint32(snd_seq, &seq_number);
+
+    if (ctx->more_flags & LOCAL) {
+	cmp = memcmp(&snd_seq[4], "\xff\xff\xff\xff", 4);
+    } else {
+	cmp = memcmp(&snd_seq[4], "\x00\x00\x00\x00", 4);
+    }
+    if (cmp != 0) {
+	*minor_status = 0;
+	return GSS_S_BAD_MIC;
+    }
+
+    if (ctx->more_flags & LOCAL) {
+	cmp = memcmp(&snd_seq[4], "\xff\xff\xff\xff", 4);
+    } else {
+	cmp = memcmp(&snd_seq[4], "\x00\x00\x00\x00", 4);
+    }
+    if (cmp != 0) {
+	*minor_status = 0;
+	return GSS_S_BAD_MIC;
+    }
+
+    /* keyblock */
+    Klocal.keytype = key->keytype;
+    Klocal.keyvalue.data = Klocaldata;
+    Klocal.keyvalue.length = sizeof(Klocaldata);
+
+    for (i = 0; i < 16; i++) {
+	Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
+    }
+
+    kret = arcfour_mic_key(context,
+			   &Klocal,
+			   snd_seq,
+			   4,
+			   k6_data, sizeof(k6_data));
+    memset(Klocaldata, 0, sizeof(Klocaldata));
+    if (kret) {
+	*minor_status = kret;
+	return GSS_S_FAILURE;
+    }
+
+    if (conf_state == 1) {
+	EVP_CIPHER_CTX rc4_key;
+
+	EVP_CIPHER_CTX_init(&rc4_key);
+	EVP_CipherInit_ex(&rc4_key, EVP_rc4(), NULL, k6_data, NULL, 1);
+
+	/* Confounder */
+	EVP_Cipher(&rc4_key, Confounder, p0 + 24, 8);
+
+	/* Data */
+	for (i = 0; i < iov_count; i++) {
+	    switch (GSS_IOV_BUFFER_TYPE(iov[i].type)) {
+	    case GSS_IOV_BUFFER_TYPE_DATA:
+		break;
+	    default:
+		continue;
+	    }
+
+	    EVP_Cipher(&rc4_key, iov[i].buffer.value,
+		       iov[i].buffer.value, iov[i].buffer.length);
+	}
+
+	/* Padding */
+	if (padding) {
+	    EVP_Cipher(&rc4_key, padding->buffer.value,
+		       padding->buffer.value, padding->buffer.length);
+	}
+
+	EVP_CIPHER_CTX_cleanup(&rc4_key);
+    } else {
+	/* Confounder */
+	memcpy(Confounder, p0 + 24, 8);
+    }
+    memset(k6_data, 0, sizeof(k6_data));
+
+    /* Prepare the buffer for signing */
+    kret = arcfour_mic_cksum_iov(context,
+				 key, KRB5_KU_USAGE_SEAL,
+				 cksum_data, sizeof(cksum_data),
+				 p0, 8,
+				 Confounder, sizeof(Confounder),
+				 iov, iov_count,
+				 padding);
+    if (kret) {
+	*minor_status = kret;
+	return GSS_S_FAILURE;
+    }
+
+    cmp = memcmp(cksum_data, p0 + 16, 8); /* SGN_CKSUM */
+    if (cmp != 0) {
+	*minor_status = 0;
+	return GSS_S_BAD_MIC;
+    }
+
+    if (padding) {
+	size_t plen;
+
+	ret = _gssapi_verify_pad(&padding->buffer, 1, &plen);
+	if (ret) {
+	    *minor_status = 0;
+	    return ret;
+	}
+    }
+
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    ret = _gssapi_msg_order_check(ctx->order, seq_number);
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+    if (ret != 0) {
+	return ret;
+    }
+
+    if (pconf_state) {
+	*pconf_state = conf_state;
+    }
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/authorize_localname.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/authorize_localname.c
index cddd292e7..d5eab4e88 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/authorize_localname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/authorize_localname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: authorize_localname.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: authorize_localname.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2011, PADL Software Pty Ltd.
@@ -36,7 +36,7 @@
 
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_authorize_localname(OM_uint32 *minor_status,
-                             const gss_name_t input_name,
+                             gss_const_name_t input_name,
                              gss_const_buffer_t user_name,
                              gss_const_OID user_name_type)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/canonicalize_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/canonicalize_name.c
index 4fbe81bae..8322c0f66 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/canonicalize_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/canonicalize_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: canonicalize_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: canonicalize_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_canonicalize_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             const gss_OID mech_type,
             gss_name_t * output_name
            )
@@ -50,7 +50,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_canonicalize_name (
 
     GSSAPI_KRB5_INIT (&context);
 
-    ret = _gsskrb5_canon_name(minor_status, context, 1, NULL, input_name, &name);
+    ret = _gsskrb5_canon_name(minor_status, context, input_name, &name);
     if (ret)
 	return ret;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ccache_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ccache_name.c
index 4bdc4ac5e..9213494db 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ccache_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ccache_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ccache_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: ccache_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.c
index e60bbfaa5..56b8c3308 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cfx.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: cfx.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003, PADL Software Pty Ltd.
@@ -393,7 +393,6 @@ _gssapi_wrap_cfx_iov(OM_uint32 *minor_status,
 	if (IS_DCE_STYLE(ctx))
 	    rrc -= ec;
 	gsshsize += gsstsize;
-	gsstsize = 0;
     } else if (GSS_IOV_BUFFER_FLAGS(trailer->type) & GSS_IOV_BUFFER_FLAG_ALLOCATE) {
 	major_status = _gk_allocate_buffer(minor_status, trailer, gsstsize);
 	if (major_status)
@@ -685,6 +684,7 @@ unrotate_iov(OM_uint32 *minor_status, size_t rrc, gss_iov_buffer_desc *iov, int
 	    if (iov[i].buffer.length <= skip) {
 		skip -= iov[i].buffer.length;
 	    } else {
+                /* copy back to original buffer */
 		memcpy(((uint8_t *)iov[i].buffer.value) + skip, q, iov[i].buffer.length - skip);
 		q += iov[i].buffer.length - skip;
 		skip = 0;
@@ -699,13 +699,14 @@ unrotate_iov(OM_uint32 *minor_status, size_t rrc, gss_iov_buffer_desc *iov, int
 	    GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_PADDING ||
 	    GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_TRAILER)
 	{
-	    memcpy(q, iov[i].buffer.value, min(iov[i].buffer.length, skip));
+	    memcpy(iov[i].buffer.value, q, min(iov[i].buffer.length, skip));
 	    if (iov[i].buffer.length > skip)
 		break;
 	    skip -= iov[i].buffer.length;
 	    q += iov[i].buffer.length;
 	}
     }
+    free(p);
     return GSS_S_COMPLETE;
 }
 
@@ -932,7 +933,6 @@ _gssapi_unwrap_cfx_iov(OM_uint32 *minor_status,
 	    }
 
 	    gsshsize += gsstsize;
-	    gsstsize = 0;
 	} else if (trailer->buffer.length != gsstsize) {
 	    major_status = GSS_S_DEFECTIVE_TOKEN;
 	    goto failure;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.h
index cf419d7e7..547d95492 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/cfx.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: cfx.h,v 1.1.1.2 2011/04/14 14:08:26 elric Exp $	*/
+/*	$NetBSD: cfx.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compare_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compare_name.c
index 7eefafbf9..a3d922684 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compare_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compare_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compare_name.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: compare_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
@@ -37,8 +37,8 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_compare_name
            (OM_uint32 * minor_status,
-            const gss_name_t name1,
-            const gss_name_t name2,
+            gss_const_name_t name1,
+            gss_const_name_t name2,
             int * name_equal
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compat.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compat.c
index 5da52e5ae..a31432ffb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/compat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compat.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: compat.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/context_time.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/context_time.c
index 99b78c901..33ce7b386 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/context_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/context_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context_time.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: context_time.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -38,27 +38,28 @@
 OM_uint32
 _gsskrb5_lifetime_left(OM_uint32 *minor_status,
 		       krb5_context context,
-		       OM_uint32 lifetime,
+		       OM_uint32 endtime,
 		       OM_uint32 *lifetime_rec)
 {
-    krb5_timestamp timeret;
+    krb5_timestamp now;
     krb5_error_code kret;
 
-    if (lifetime == 0) {
+    if (endtime == 0) {
 	*lifetime_rec = GSS_C_INDEFINITE;
 	return GSS_S_COMPLETE;
     }
 
-    kret = krb5_timeofday(context, &timeret);
+    kret = krb5_timeofday(context, &now);
     if (kret) {
+        *lifetime_rec = 0;
 	*minor_status = kret;
 	return GSS_S_FAILURE;
     }
 
-    if (lifetime < timeret)
+    if (endtime < now)
 	*lifetime_rec = 0;
     else
-	*lifetime_rec = lifetime - timeret;
+	*lifetime_rec = endtime - now;
 
     return GSS_S_COMPLETE;
 }
@@ -66,23 +67,23 @@ _gsskrb5_lifetime_left(OM_uint32 *minor_status,
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_context_time
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             OM_uint32 * time_rec
            )
 {
     krb5_context context;
-    OM_uint32 lifetime;
+    OM_uint32 endtime;
     OM_uint32 major_status;
     const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
 
     GSSAPI_KRB5_INIT (&context);
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
-    lifetime = ctx->lifetime;
+    endtime = ctx->endtime;
     HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 
     major_status = _gsskrb5_lifetime_left(minor_status, context,
-					  lifetime, time_rec);
+					  endtime, time_rec);
     if (major_status != GSS_S_COMPLETE)
 	return major_status;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/copy_ccache.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/copy_ccache.c
index ebf1638cc..a5e1e5152 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/copy_ccache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/copy_ccache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: copy_ccache.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: copy_ccache.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001, 2003 Kungliga Tekniska Högskolan
@@ -91,6 +91,8 @@ _gsskrb5_krb5_import_cred(OM_uint32 *minor_status,
     handle->usage = 0;
 
     if (id) {
+	time_t now;
+	OM_uint32 left;
 	char *str;
 
 	handle->usage |= GSS_C_INITIATE;
@@ -118,17 +120,18 @@ _gsskrb5_krb5_import_cred(OM_uint32 *minor_status,
 	    }
 	}
 
+	krb5_timeofday(context, &now);
 	ret = __gsskrb5_ccache_lifetime(minor_status,
 					context,
 					id,
 					handle->principal,
-					&handle->lifetime);
+					&left);
 	if (ret != GSS_S_COMPLETE) {
 	    krb5_free_principal(context, handle->principal);
 	    free(handle);
 	    return ret;
 	}
-
+	handle->endtime = now + left;
 
 	kret = krb5_cc_get_full_name(context, id, &str);
 	if (kret)
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/creds.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/creds.c
index 80c150ebe..8317de93d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: creds.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: creds.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -64,6 +64,9 @@ _gsskrb5_export_cred(OM_uint32 *minor_status,
     type = krb5_cc_get_type(context, handle->ccache);
     if (strcmp(type, "MEMORY") == 0) {
 	krb5_creds *creds;
+	krb5_data config_start_realm;
+	char *start_realm;
+
 	ret = krb5_store_uint32(sp, 0);
 	if (ret) {
 	    krb5_storage_free(sp);
@@ -71,9 +74,25 @@ _gsskrb5_export_cred(OM_uint32 *minor_status,
 	    return GSS_S_FAILURE;
 	}
 
-	ret = _krb5_get_krbtgt(context, handle->ccache,
-			       handle->principal->realm,
-			       &creds);
+	ret = krb5_cc_get_config(context, handle->ccache, NULL, "start_realm",
+				 &config_start_realm);
+	if (ret == 0) {
+	    start_realm = strndup(config_start_realm.data,
+				  config_start_realm.length);
+	    krb5_data_free(&config_start_realm);
+	} else {
+	    start_realm = strdup(krb5_principal_get_realm(context,
+							  handle->principal));
+	}
+	if (start_realm == NULL) {
+	    *minor_status = krb5_enomem(context);
+	    krb5_storage_free(sp);
+	    return GSS_S_FAILURE;
+	}
+
+	ret = _krb5_get_krbtgt(context, handle->ccache, start_realm, &creds);
+	free(start_realm);
+	start_realm = NULL;
 	if (ret) {
 	    krb5_storage_free(sp);
 	    *minor_status = ret;
@@ -212,6 +231,10 @@ _gsskrb5_import_cred(OM_uint32 * minor_status,
 
 	ret = krb5_cc_store_cred(context, id, &creds);
 	krb5_free_cred_contents(context, &creds);
+	if (ret) {
+	    *minor_status = ret;
+	    return GSS_S_FAILURE;
+	}
 
 	flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/decapsulate.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/decapsulate.c
index c22eee6ba..e2ea4503f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/decapsulate.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/decapsulate.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: decapsulate.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: decapsulate.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -192,6 +192,9 @@ _gssapi_verify_pad(gss_buffer_t wrapped_token,
     size_t padlength;
     int i;
 
+    if (wrapped_token->length < 1)
+	return GSS_S_BAD_MECH;
+
     pad = (u_char *)wrapped_token->value + wrapped_token->length - 1;
     padlength = *pad;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/delete_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/delete_sec_context.c
index 3dd0b8133..1a8313bf5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/delete_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/delete_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: delete_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: delete_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_name.c
index cf6ffc323..69e05b3c7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: display_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: display_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_display_name
            (OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t output_name_buffer,
             gss_OID * output_name_type
            )
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_status.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_status.c
index 30694280b..4b7526501 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_status.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/display_status.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: display_status.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: display_status.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/duplicate_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/duplicate_name.c
index a6cac8a42..4695dcdbe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/duplicate_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/duplicate_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: duplicate_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: duplicate_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_duplicate_name (
             OM_uint32 * minor_status,
-            const gss_name_t src_name,
+            gss_const_name_t src_name,
             gss_name_t * dest_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/encapsulate.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/encapsulate.c
index 64a7c3a46..168050ce9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/encapsulate.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/encapsulate.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: encapsulate.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: encapsulate.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_name.c
index 3d668f7cf..fc8e9a22c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: export_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: export_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1999, 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_export_name
            (OM_uint32  * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t exported_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_sec_context.c
index 91b16bf12..b078b556c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/export_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: export_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: export_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
@@ -36,9 +36,9 @@
 #include "gsskrb5_locl.h"
 
 OM_uint32 GSSAPI_CALLCONV
-_gsskrb5_export_sec_context (
-    OM_uint32 * minor_status,
-    gss_ctx_id_t * context_handle,
+_gsskrb5_export_sec_context(
+    OM_uint32 *minor_status,
+    gss_ctx_id_t *context_handle,
     gss_buffer_t interprocess_token
     )
 {
@@ -206,7 +206,11 @@ _gsskrb5_export_sec_context (
 	*minor_status = kret;
 	goto failure;
     }
-    kret = krb5_store_int32 (sp, ctx->lifetime);
+    /*
+     * XXX We should put a 64-bit int here, but we don't have a
+     * krb5_store_int64() yet.
+     */
+    kret = krb5_store_int32 (sp, ctx->endtime);
     if (kret) {
 	*minor_status = kret;
 	goto failure;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/external.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/external.c
index 4285eb9c9..edd125948 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/external.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/external.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: external.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: external.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -204,67 +204,131 @@ static gss_mo_desc krb5_mo[] = {
     },
     {
 	GSS_C_MA_MECH_CONCRETE,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_ITOK_FRAMED,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_AUTH_INIT,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_AUTH_TARG,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_AUTH_INIT_ANON,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_DELEG_CRED,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_INTEG_PROT,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_CONF_PROT,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_MIC,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_WRAP,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_PROT_READY,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_REPLAY_DET,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_OOS_DET,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_CBINDINGS,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_PFS,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_CTX_TRANS,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     }
 };
 
@@ -326,7 +390,7 @@ static gssapi_mech_interface_desc krb5_mech = {
     NULL,
     krb5_mo,
     sizeof(krb5_mo) / sizeof(krb5_mo[0]),
-    _gsskrb5_pname_to_uid,
+    _gsskrb5_localname,
     _gsskrb5_authorize_localname,
     NULL,
     NULL,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/get_mic.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/get_mic.c
index e7950ea08..12075f2c7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/get_mic.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/get_mic.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_mic.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: get_mic.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -277,7 +277,7 @@ mic_des3
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_get_mic
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             gss_qop_t qop_req,
             const gss_buffer_t message_buffer,
             gss_buffer_t message_token
@@ -287,7 +287,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_get_mic
   const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
   krb5_keyblock *key;
   OM_uint32 ret;
-  krb5_keytype keytype;
 
   GSSAPI_KRB5_INIT (&context);
 
@@ -302,10 +301,11 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_get_mic
       *minor_status = ret;
       return GSS_S_FAILURE;
   }
-  krb5_enctype_to_keytype (context, key->keytype, &keytype);
 
-  switch (keytype) {
-  case KEYTYPE_DES :
+  switch (key->keytype) {
+  case KRB5_ENCTYPE_DES_CBC_CRC :
+  case KRB5_ENCTYPE_DES_CBC_MD4 :
+  case KRB5_ENCTYPE_DES_CBC_MD5 :
 #ifdef HEIM_WEAK_CRYPTO
       ret = mic_des (minor_status, ctx, context, qop_req,
 		     message_buffer, message_token, key);
@@ -313,12 +313,13 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_get_mic
       ret = GSS_S_FAILURE;
 #endif
       break;
-  case KEYTYPE_DES3 :
+  case KRB5_ENCTYPE_DES3_CBC_MD5 :
+  case KRB5_ENCTYPE_DES3_CBC_SHA1 :
       ret = mic_des3 (minor_status, ctx, context, qop_req,
 		      message_buffer, message_token, key);
       break;
-  case KEYTYPE_ARCFOUR:
-  case KEYTYPE_ARCFOUR_56:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56:
       ret = _gssapi_get_mic_arcfour (minor_status, ctx, context, qop_req,
 				     message_buffer, message_token, key);
       break;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/gsskrb5_locl.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/gsskrb5_locl.h
index 82a324718..b2a70de82 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/gsskrb5_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/gsskrb5_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: gsskrb5_locl.h,v 1.1.1.2 2011/04/14 14:08:26 elric Exp $	*/
+/*	$NetBSD: gsskrb5_locl.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -83,7 +83,7 @@ typedef struct gsskrb5_ctx {
   krb5_creds *kcred;
   krb5_ccache ccache;
   struct krb5_ticket *ticket;
-  OM_uint32 lifetime;
+  time_t endtime;
   HEIMDAL_MUTEX ctx_id_mutex;
   struct gss_msg_order *order;
   krb5_keyblock *service_keyblock;
@@ -97,7 +97,7 @@ typedef struct {
 #define GSS_CF_DESTROY_CRED_ON_RELEASE	1
 #define GSS_CF_NO_CI_FLAGS		2
   struct krb5_keytab_data *keytab;
-  OM_uint32 lifetime;
+  time_t endtime;
   gss_cred_usage_t usage;
   gss_OID_set mechanisms;
   struct krb5_ccache_data *ccache;
@@ -136,7 +136,4 @@ extern HEIMDAL_MUTEX gssapi_keytab_mutex;
 #define SC_LOCAL_SUBKEY	  0x08
 #define SC_REMOTE_SUBKEY  0x10
 
-/* type to signal that that dns canon maybe should be done */
-#define MAGIC_HOSTBASED_NAME_TYPE 4711
-
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_name.c
index 3454ee941..2c723b1d6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: import_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: import_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -85,26 +85,21 @@ import_krb5_name (OM_uint32 *minor_status,
 
 OM_uint32
 _gsskrb5_canon_name(OM_uint32 *minor_status, krb5_context context,
-		    int use_dns, krb5_const_principal sourcename, gss_name_t targetname,
-		    krb5_principal *out)
+		    gss_const_name_t targetname, krb5_principal *out)
 {
-    krb5_principal p = (krb5_principal)targetname;
+    krb5_const_principal p = (krb5_const_principal)targetname;
     krb5_error_code ret;
     char *hostname = NULL, *service;
+    int type;
+    const char *comp;
 
     *minor_status = 0;
 
     /* If its not a hostname */
-    if (krb5_principal_get_type(context, p) != MAGIC_HOSTBASED_NAME_TYPE) {
-	ret = krb5_copy_principal(context, p, out);
-    } else if (!use_dns) {
-	ret = krb5_copy_principal(context, p, out);
-	if (ret)
-	    goto out;
-	krb5_principal_set_type(context, *out, KRB5_NT_SRV_HST);
-	if (sourcename)
-	    ret = krb5_principal_set_realm(context, *out, sourcename->realm);
-    } else {
+    type = krb5_principal_get_type(context, p);
+    comp = krb5_principal_get_comp_string(context, p, 0);
+    if (type == KRB5_NT_SRV_HST || type == KRB5_NT_SRV_HST_NEEDS_CANON ||
+	(type == KRB5_NT_UNKNOWN && comp != NULL && strcmp(comp, "host") == 0)) {
 	if (p->name.name_string.len == 0)
 	    return GSS_S_BAD_NAME;
 	else if (p->name.name_string.len > 1)
@@ -117,9 +112,10 @@ _gsskrb5_canon_name(OM_uint32 *minor_status, krb5_context context,
 				      service,
 				      KRB5_NT_SRV_HST,
 				      out);
+    } else {
+	ret = krb5_copy_principal(context, p, out);
     }
 
- out:
     if (ret) {
 	*minor_status = ret;
 	return GSS_S_FAILURE;
@@ -130,10 +126,10 @@ _gsskrb5_canon_name(OM_uint32 *minor_status, krb5_context context,
 
 
 static OM_uint32
-import_hostbased_name (OM_uint32 *minor_status,
-		       krb5_context context,
-		       const gss_buffer_t input_name_buffer,
-		       gss_name_t *output_name)
+import_hostbased_name(OM_uint32 *minor_status,
+		      krb5_context context,
+		      const gss_buffer_t input_name_buffer,
+		      gss_name_t *output_name)
 {
     krb5_principal princ = NULL;
     krb5_error_code kerr;
@@ -155,7 +151,7 @@ import_hostbased_name (OM_uint32 *minor_status,
 	host = p + 1;
     }
 
-    kerr = krb5_make_principal(context, &princ, NULL, tmp, host, NULL);
+    kerr = krb5_make_principal(context, &princ, "", tmp, host, NULL);
     free (tmp);
     *minor_status = kerr;
     if (kerr == KRB5_PARSE_ILLCHAR || kerr == KRB5_PARSE_MALFORMED)
@@ -163,7 +159,7 @@ import_hostbased_name (OM_uint32 *minor_status,
     else if (kerr)
 	return GSS_S_FAILURE;
 
-    krb5_principal_set_type(context, princ, MAGIC_HOSTBASED_NAME_TYPE);
+    krb5_principal_set_type(context, princ, KRB5_NT_SRV_HST);
     *output_name = (gss_name_t)princ;
 
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_sec_context.c
index 7f5049077..517a61ed4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/import_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: import_sec_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: import_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
@@ -194,9 +194,13 @@ _gsskrb5_import_sec_context (
     if (krb5_ret_int32 (sp, &tmp))
 	goto failure;
     ctx->more_flags = tmp;
+    /*
+     * XXX endtime should be a 64-bit int, but we don't have
+     * krb5_ret_int64() yet.
+     */
     if (krb5_ret_int32 (sp, &tmp))
 	goto failure;
-    ctx->lifetime = tmp;
+    ctx->endtime = tmp;
 
     ret = _gssapi_msg_order_import(minor_status, sp, &ctx->order);
     if (ret)
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/indicate_mechs.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/indicate_mechs.c
index 23db2a6b7..3282c978c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/indicate_mechs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/indicate_mechs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: indicate_mechs.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: indicate_mechs.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init.c
index e51e504c0..fc10294d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: init.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003, 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init_sec_context.c
index df4ceb1ea..346211951 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/init_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_sec_context.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: init_sec_context.c,v 1.4 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -130,7 +130,7 @@ _gsskrb5_create_ctx(
     ctx->service_keyblock	= NULL;
     ctx->ticket			= NULL;
     krb5_data_zero(&ctx->fwd_data);
-    ctx->lifetime		= GSS_C_INDEFINITE;
+    ctx->endtime		= 0;
     ctx->order			= NULL;
     ctx->crypto			= NULL;
     HEIMDAL_MUTEX_init(&ctx->ctx_id_mutex);
@@ -139,6 +139,7 @@ _gsskrb5_create_ctx(
     if (kret) {
 	*minor_status = kret;
 	HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
+	free(ctx);
 	return GSS_S_FAILURE;
     }
 
@@ -147,6 +148,7 @@ _gsskrb5_create_ctx(
 	*minor_status = kret;
 	krb5_auth_con_free(context, ctx->auth_context);
 	HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
+	free(ctx);
 	return GSS_S_FAILURE;
     }
 
@@ -158,7 +160,7 @@ _gsskrb5_create_ctx(
 	krb5_auth_con_free(context, ctx->deleg_auth_context);
 
 	HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
-
+	free(ctx);
 	return GSS_S_BAD_BINDINGS;
     }
 
@@ -170,7 +172,7 @@ _gsskrb5_create_ctx(
 	krb5_auth_con_free(context, ctx->deleg_auth_context);
 
 	HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
-
+	free(ctx);
 	return GSS_S_BAD_BINDINGS;
     }
 
@@ -206,8 +208,7 @@ gsskrb5_get_creds(
 	krb5_context context,
 	krb5_ccache ccache,
 	gsskrb5_ctx ctx,
-	const gss_name_t target_name,
-	int use_dns,
+	gss_const_name_t target_name,
 	OM_uint32 time_req,
 	OM_uint32 * time_rec)
 {
@@ -225,8 +226,8 @@ gsskrb5_get_creds(
 	ctx->kcred = NULL;
     }
 
-    ret = _gsskrb5_canon_name(minor_status, context, use_dns,
-			      ctx->source, target_name, &ctx->target);
+    ret = _gsskrb5_canon_name(minor_status, context, target_name,
+                              &ctx->target);
     if (ret)
 	return ret;
 
@@ -255,10 +256,10 @@ gsskrb5_get_creds(
 	return GSS_S_FAILURE;
     }
 
-    ctx->lifetime = ctx->kcred->times.endtime;
+    ctx->endtime = ctx->kcred->times.endtime;
 
     ret = _gsskrb5_lifetime_left(minor_status, context,
-				 ctx->lifetime, &lifetime_rec);
+				 ctx->endtime, &lifetime_rec);
     if (ret) return ret;
 
     if (lifetime_rec == 0) {
@@ -346,8 +347,7 @@ do_delegation (krb5_context context,
     fwd_flags.forwarded = 1;
     fwd_flags.forwardable = 1;
 
-    if ( /*target_name->name.name_type != KRB5_NT_SRV_HST ||*/
-	name->name.name_string.len < 2)
+    if (name->name.name_string.len < 2)
 	goto out;
 
     kret = krb5_get_forwarded_creds(context,
@@ -380,7 +380,7 @@ init_auth
  gsskrb5_cred cred,
  gsskrb5_ctx ctx,
  krb5_context context,
- gss_name_t name,
+ gss_const_name_t name,
  const gss_OID mech_type,
  OM_uint32 req_flags,
  OM_uint32 time_req,
@@ -393,12 +393,9 @@ init_auth
 {
     OM_uint32 ret = GSS_S_FAILURE;
     krb5_error_code kret;
-    krb5_data outbuf;
     krb5_data fwd_data;
     OM_uint32 lifetime_rec;
-    int allow_dns = 1;
 
-    krb5_data_zero(&outbuf);
     krb5_data_zero(&fwd_data);
 
     *minor_status = 0;
@@ -427,44 +424,17 @@ init_auth
     /*
      * This is hideous glue for (NFS) clients that wants to limit the
      * available enctypes to what it can support (encryption in
-     * kernel). If there is no enctypes selected for this credential,
-     * reset it to the default set of enctypes.
+     * kernel).
      */
-    {
-	krb5_enctype *enctypes = NULL;
+    if (cred && cred->enctypes)
+	krb5_set_default_in_tkt_etypes(context, cred->enctypes);
 
-	if (cred && cred->enctypes)
-	    enctypes = cred->enctypes;
-	krb5_set_default_in_tkt_etypes(context, enctypes);
-    }
-
-    /* canon name if needed for client + target realm */
-    kret = krb5_cc_get_config(context, ctx->ccache, NULL,
-			      "realm-config", &outbuf);
-    if (kret == 0) {
-	/* XXX 2 is no server canon */
-	if (outbuf.length < 1 || ((((unsigned char *)outbuf.data)[0]) & 2))
-	    allow_dns = 0;
-	krb5_data_free(&outbuf);
-    }
-
-    /*
-     * First we try w/o dns, hope that the KDC have register alias
-     * (and referrals if cross realm) for this principal. If that
-     * fails and if we are allowed to using this realm try again with
-     * DNS canonicalizion.
-     */
     ret = gsskrb5_get_creds(minor_status, context, ctx->ccache,
-			    ctx, name, 0, time_req,
-			    time_rec);
-    if (ret && allow_dns)
-	ret = gsskrb5_get_creds(minor_status, context, ctx->ccache,
-				ctx, name, 1, time_req,
-				time_rec);
+			    ctx, name, time_req, time_rec);
     if (ret)
 	goto failure;
 
-    ctx->lifetime = ctx->kcred->times.endtime;
+    ctx->endtime = ctx->kcred->times.endtime;
 
     ret = _gss_DES3_get_mic_compat(minor_status, ctx, context);
     if (ret)
@@ -472,7 +442,7 @@ init_auth
 
     ret = _gsskrb5_lifetime_left(minor_status,
 				 context,
-				 ctx->lifetime,
+				 ctx->endtime,
 				 &lifetime_rec);
     if (ret)
 	goto failure;
@@ -819,14 +789,11 @@ repl_mutual
 			       repl);
 
     *minor_status = 0;
-    if (time_rec) {
-	ret = _gsskrb5_lifetime_left(minor_status,
-				     context,
-				     ctx->lifetime,
-				     time_rec);
-    } else {
-	ret = GSS_S_COMPLETE;
-    }
+    if (time_rec)
+        _gsskrb5_lifetime_left(minor_status,
+                               context,
+                               ctx->endtime,
+                               time_rec);
     if (ret_flags)
 	*ret_flags = ctx->flags;
 
@@ -867,9 +834,9 @@ repl_mutual
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_init_sec_context
 (OM_uint32 * minor_status,
- const gss_cred_id_t cred_handle,
+ gss_const_cred_id_t cred_handle,
  gss_ctx_id_t * context_handle,
- const gss_name_t target_name,
+ gss_const_name_t target_name,
  const gss_OID mech_type,
  OM_uint32 req_flags,
  OM_uint32 time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_context.c
index eefe4bd86..18fd3ca59 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_context.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: inquire_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_context (
     OM_uint32 * minor_status,
-	const gss_ctx_id_t context_handle,
+	gss_const_ctx_id_t context_handle,
 	gss_name_t * src_name,
 	gss_name_t * targ_name,
 	OM_uint32 * lifetime_rec,
@@ -78,7 +78,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_context (
     if (lifetime_rec) {
 	ret = _gsskrb5_lifetime_left(minor_status,
 				     context,
-				     ctx->lifetime,
+				     ctx->endtime,
 				     lifetime_rec);
 	if (ret)
 	    goto failed;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred.c
index 3898afe21..bdbe5fdda 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: inquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred
 (OM_uint32 * minor_status,
- const gss_cred_id_t cred_handle,
+ gss_const_cred_id_t cred_handle,
  gss_name_t * output_name,
  OM_uint32 * lifetime,
  gss_cred_usage_t * cred_usage,
@@ -47,136 +47,179 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred
     krb5_context context;
     gss_cred_id_t aqcred_init = GSS_C_NO_CREDENTIAL;
     gss_cred_id_t aqcred_accept = GSS_C_NO_CREDENTIAL;
-    gsskrb5_cred acred = NULL, icred = NULL;
+    gsskrb5_cred cred = (gsskrb5_cred)cred_handle;
+    gss_OID_set amechs = GSS_C_NO_OID_SET;
+    gss_OID_set imechs = GSS_C_NO_OID_SET;
+    OM_uint32 junk;
+    OM_uint32 aminor;
     OM_uint32 ret;
+    OM_uint32 aret;
+    OM_uint32 alife = GSS_C_INDEFINITE;
+    OM_uint32 ilife = GSS_C_INDEFINITE;
+
+    /*
+     * XXX This function is more complex than it has to be.  It should call
+     * _gsskrb5_inquire_cred_by_mech() twice and merge the results in the
+     * cred_handle == GSS_C_NO_CREDENTIAL case, but since
+     * _gsskrb5_inquire_cred_by_mech() is implemented in terms of this
+     * function, first we must fix _gsskrb5_inquire_cred_by_mech().
+     */
 
     *minor_status = 0;
 
     if (output_name)
-	*output_name = NULL;
+        *output_name = GSS_C_NO_NAME;
+    if (cred_usage)
+        *cred_usage = GSS_C_BOTH; /* There's no NONE */
     if (mechanisms)
-	*mechanisms = GSS_C_NO_OID_SET;
+        *mechanisms = GSS_C_NO_OID_SET;
 
     GSSAPI_KRB5_INIT (&context);
 
     if (cred_handle == GSS_C_NO_CREDENTIAL) {
-	ret = _gsskrb5_acquire_cred(minor_status,
-				    GSS_C_NO_NAME,
-				    GSS_C_INDEFINITE,
-				    GSS_C_NO_OID_SET,
-				    GSS_C_ACCEPT,
-				    &aqcred_accept,
-				    NULL,
-				    NULL);
-	if (ret == GSS_S_COMPLETE)
-	    acred = (gsskrb5_cred)aqcred_accept;
+        /*
+         * From here to the end of this if we should refactor into a separate
+         * function.
+         */
+        /* Get the info for the default ACCEPT credential */
+        aret = _gsskrb5_acquire_cred(&aminor,
+                                    GSS_C_NO_NAME,
+                                    GSS_C_INDEFINITE,
+                                    GSS_C_NO_OID_SET,
+                                    GSS_C_ACCEPT,
+                                    &aqcred_accept,
+                                    NULL,
+                                    NULL);
+        if (aret == GSS_S_COMPLETE) {
+            aret = _gsskrb5_inquire_cred(&aminor,
+                                        aqcred_accept,
+                                        output_name,
+                                        &alife,
+                                        NULL,
+                                        &amechs);
+            (void) _gsskrb5_release_cred(&junk, &aqcred_accept);
+            if (aret == GSS_S_COMPLETE) {
+                output_name = NULL; /* Can't merge names; output only one */
+                if (cred_usage)
+                    *cred_usage = GSS_C_ACCEPT;
+                if (lifetime)
+                    *lifetime = alife;
+                if (mechanisms) {
+                    *mechanisms = amechs;
+                    amechs = GSS_C_NO_OID_SET;
+                }
+                (void) gss_release_oid_set(&junk, &amechs);
+            } else if (aret != GSS_S_NO_CRED) {
+                *minor_status = aminor;
+                return aret;
+            } else {
+                alife = GSS_C_INDEFINITE;
+            }
+        }
 
-	ret = _gsskrb5_acquire_cred(minor_status,
-				    GSS_C_NO_NAME,
-				    GSS_C_INDEFINITE,
-				    GSS_C_NO_OID_SET,
-				    GSS_C_INITIATE,
-				    &aqcred_init,
-				    NULL,
-				    NULL);
-	if (ret == GSS_S_COMPLETE)
-	    icred = (gsskrb5_cred)aqcred_init;
+        /* Get the info for the default INITIATE credential */
+        ret = _gsskrb5_acquire_cred(minor_status,
+                                    GSS_C_NO_NAME,
+                                    GSS_C_INDEFINITE,
+                                    GSS_C_NO_OID_SET,
+                                    GSS_C_INITIATE,
+                                    &aqcred_init,
+                                    NULL,
+                                    NULL);
+        if (ret == GSS_S_COMPLETE) {
+            ret = _gsskrb5_inquire_cred(minor_status,
+                                        aqcred_init,
+                                        output_name,
+                                        &ilife,
+                                        NULL,
+                                        &imechs);
+            (void) _gsskrb5_release_cred(&junk, &aqcred_init);
+            if (ret == GSS_S_COMPLETE) {
+                /*
+                 * Merge results for INITIATE with ACCEPT if we had ACCEPT and
+                 * for those outputs that are desired.
+                 */
+                if (cred_usage) {
+                    *cred_usage = (*cred_usage == GSS_C_ACCEPT) ?
+                        GSS_C_BOTH : GSS_C_INITIATE;
+                }
+                if (lifetime)
+                    *lifetime = min(alife, ilife);
+                if (mechanisms) {
+                    /*
+                     * This is just one mechanism (IAKERB and such would live
+                     * elsewhere).  imechs will be equal to amechs, though not
+                     * ==.
+                     */
+                    if (aret != GSS_S_COMPLETE) {
+                        *mechanisms = imechs;
+                        imechs = GSS_C_NO_OID_SET;
+                    }
+                }
+                (void) gss_release_oid_set(&junk, &amechs);
+            } else if (ret != GSS_S_NO_CRED) {
+                *minor_status = aminor;
+                return aret;
+            }
+        }
 
-	if (icred == NULL && acred == NULL) {
-	    *minor_status = 0;
-	    return GSS_S_NO_CRED;
-	}
-    } else
-	acred = (gsskrb5_cred)cred_handle;
+        if (aret != GSS_S_COMPLETE && ret != GSS_S_COMPLETE) {
+            *minor_status = aminor;
+            return aret;
+        }
+        *minor_status = 0; /* Even though 0 is not specified to be special */
+        return GSS_S_COMPLETE;
+    }
 
-    if (acred)
-	HEIMDAL_MUTEX_lock(&acred->cred_id_mutex);
-    if (icred)
-	HEIMDAL_MUTEX_lock(&icred->cred_id_mutex);
+    HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
 
     if (output_name != NULL) {
-	if (icred && icred->principal != NULL) {
-	    gss_name_t name;
-
-	    if (acred && acred->principal)
-		name = (gss_name_t)acred->principal;
-	    else
-		name = (gss_name_t)icred->principal;
-
+        if (cred->principal != NULL) {
+            gss_name_t name = (gss_name_t)cred->principal;
             ret = _gsskrb5_duplicate_name(minor_status, name, output_name);
             if (ret)
-		goto out;
-	} else if (acred && acred->usage == GSS_C_ACCEPT) {
-	    krb5_principal princ;
-	    *minor_status = krb5_sname_to_principal(context, NULL,
-						    NULL, KRB5_NT_SRV_HST,
-						    &princ);
-	    if (*minor_status) {
-		ret = GSS_S_FAILURE;
-		goto out;
-	    }
-	    *output_name = (gss_name_t)princ;
-	} else {
-	    krb5_principal princ;
-	    *minor_status = krb5_get_default_principal(context,
-						       &princ);
-	    if (*minor_status) {
-		ret = GSS_S_FAILURE;
-		goto out;
-	    }
-	    *output_name = (gss_name_t)princ;
-	}
+                goto out;
+        } else if (cred->usage == GSS_C_ACCEPT) {
+            /*
+             * Keytab case, princ may not be set (yet, ever, whatever).
+             *
+             * We used to unconditionally output the krb5_sname_to_principal()
+             * of the host service for the hostname, but we didn't know if we
+             * had keytab entries for it, so it was incorrect.  We can't be
+             * breaking anything in tree by outputting GSS_C_NO_NAME, but we
+             * might be breaking other callers.
+             */
+            *output_name = GSS_C_NO_NAME;
+        } else {
+            /* This shouldn't happen */
+            *minor_status = KRB5_NOCREDS_SUPPLIED; /* XXX */
+            ret = GSS_S_NO_CRED;
+            goto out;
+        }
     }
     if (lifetime != NULL) {
-	OM_uint32 alife = GSS_C_INDEFINITE, ilife = GSS_C_INDEFINITE;
-
-	if (acred) alife = acred->lifetime;
-	if (icred) ilife = icred->lifetime;
-
-	ret = _gsskrb5_lifetime_left(minor_status,
-				     context,
-				     min(alife,ilife),
-				     lifetime);
-	if (ret)
-	    goto out;
+        ret = _gsskrb5_lifetime_left(minor_status,
+                                     context,
+                                     cred->endtime,
+                                     lifetime);
+        if (ret)
+            goto out;
     }
-    if (cred_usage != NULL) {
-	if (acred && icred)
-	    *cred_usage = GSS_C_BOTH;
-	else if (acred)
-	    *cred_usage = GSS_C_ACCEPT;
-	else if (icred)
-	    *cred_usage = GSS_C_INITIATE;
-	else
-	    abort();
-    }
-
+    if (cred_usage != NULL)
+        *cred_usage = cred->usage;
     if (mechanisms != NULL) {
         ret = gss_create_empty_oid_set(minor_status, mechanisms);
         if (ret)
-	    goto out;
-	if (acred)
-	    ret = gss_add_oid_set_member(minor_status,
-					 &acred->mechanisms->elements[0],
-					 mechanisms);
-	if (ret == GSS_S_COMPLETE && icred)
-	    ret = gss_add_oid_set_member(minor_status,
-					 &icred->mechanisms->elements[0],
-					 mechanisms);
+            goto out;
+        ret = gss_add_oid_set_member(minor_status,
+                                     &cred->mechanisms->elements[0],
+                                     mechanisms);
         if (ret)
-	    goto out;
+            goto out;
     }
     ret = GSS_S_COMPLETE;
+
 out:
-    if (acred)
-	HEIMDAL_MUTEX_unlock(&acred->cred_id_mutex);
-    if (icred)
-	HEIMDAL_MUTEX_unlock(&icred->cred_id_mutex);
-
-    if (aqcred_init != GSS_C_NO_CREDENTIAL)
-	ret = _gsskrb5_release_cred(minor_status, &aqcred_init);
-    if (aqcred_accept != GSS_C_NO_CREDENTIAL)
-	ret = _gsskrb5_release_cred(minor_status, &aqcred_accept);
-
+    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_mech.c
index 890ca5d89..a56134210 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred_by_mech.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: inquire_cred_by_mech.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003, 2006, 2007 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred_by_mech (
     OM_uint32 * minor_status,
-	const gss_cred_id_t cred_handle,
+	gss_const_cred_id_t cred_handle,
 	const gss_OID mech_type,
 	gss_name_t * name,
 	OM_uint32 * initiator_lifetime,
@@ -49,6 +49,10 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred_by_mech (
     OM_uint32 maj_stat;
     OM_uint32 lifetime;
 
+    /*
+     * XXX This is busted.  _gsskrb5_inquire_cred() should be implemented in
+     * terms of _gsskrb5_inquire_cred_by_mech(), NOT the other way around.
+     */
     maj_stat =
 	_gsskrb5_inquire_cred (minor_status, cred_handle,
 			       name, &lifetime, &usage, NULL);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_oid.c
index 5ca4bef02..e90d578f3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_cred_by_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred_by_oid.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: inquire_cred_by_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -36,7 +36,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_cred_by_oid
 	   (OM_uint32 * minor_status,
-	    const gss_cred_id_t cred_handle,
+	    gss_const_cred_id_t cred_handle,
 	    const gss_OID desired_object,
 	    gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_mechs_for_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_mechs_for_name.c
index 49d88411c..af9b9fbb2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_mechs_for_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_mechs_for_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_mechs_for_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: inquire_mechs_for_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_mechs_for_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_OID_set * mech_types
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_names_for_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_names_for_mech.c
index 2c6b937b8..b296b3495 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_names_for_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_names_for_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_names_for_mech.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: inquire_names_for_mech.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_sec_context_by_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_sec_context_by_oid.c
index 0a4794193..e03a38cda 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_sec_context_by_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/inquire_sec_context_by_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_sec_context_by_oid.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: inquire_sec_context_by_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -151,7 +151,6 @@ static OM_uint32 inquire_sec_context_get_subkey
     }
 
     ret = krb5_store_keyblock(sp, *key);
-    krb5_free_keyblock (context, key);
     if (ret)
 	goto out;
 
@@ -171,6 +170,7 @@ static OM_uint32 inquire_sec_context_get_subkey
     }
 
 out:
+    krb5_free_keyblock(context, key);
     krb5_data_free(&data);
     if (sp)
 	krb5_storage_free(sp);
@@ -335,7 +335,8 @@ export_lucid_sec_context_v1(OM_uint32 *minor_status,
     if (ret) goto out;
     ret = krb5_store_int32(sp, (context_handle->more_flags & LOCAL) ? 1 : 0);
     if (ret) goto out;
-    ret = krb5_store_int32(sp, context_handle->lifetime);
+    /* XXX need krb5_store_int64() */
+    ret = krb5_store_int32(sp, context_handle->endtime);
     if (ret) goto out;
     krb5_auth_con_getlocalseqnumber (context,
 				     context_handle->auth_context,
@@ -531,7 +532,7 @@ out:
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_sec_context_by_oid
            (OM_uint32 *minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_OID desired_object,
             gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/pname_to_uid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/pname_to_uid.c
index c634e00a4..e3f730afe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/pname_to_uid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/pname_to_uid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pname_to_uid.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: pname_to_uid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2011, PADL Software Pty Ltd.
@@ -35,53 +35,38 @@
 #include "gsskrb5_locl.h"
 
 OM_uint32 GSSAPI_CALLCONV
-_gsskrb5_pname_to_uid(OM_uint32 *minor_status,
-                      const gss_name_t pname,
-                      const gss_OID mech_type,
-                      uid_t *uidp)
+_gsskrb5_localname(OM_uint32 *minor_status,
+                   gss_const_name_t pname,
+                   const gss_OID mech_type,
+                   gss_buffer_t localname)
 {
-#ifdef NO_LOCALNAME
-    *minor_status = KRB5_NO_LOCALNAME;
-    return GSS_S_FAILURE;
-#else
     krb5_error_code ret;
     krb5_context context;
     krb5_const_principal princ = (krb5_const_principal)pname;
-    char localname[256];
-#ifdef POSIX_GETPWNAM_R
-    char pwbuf[2048];
-    struct passwd pw, *pwd;
-#else
-    struct passwd *pwd;
-#endif
+    char lnamebuf[256];
 
     GSSAPI_KRB5_INIT(&context);
 
     *minor_status = 0;
 
     ret = krb5_aname_to_localname(context, princ,
-                                  sizeof(localname), localname);
+                                  sizeof(lnamebuf), lnamebuf);
     if (ret != 0) {
         *minor_status = ret;
         return GSS_S_FAILURE;
     }
 
-#ifdef POSIX_GETPWNAM_R
-    if (getpwnam_r(localname, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
-        *minor_status = KRB5_NO_LOCALNAME;
-        return GSS_S_FAILURE;
-    }
-#else
-    pwd = getpwnam(localname);
-#endif
+    localname->length = strlen(lnamebuf);
 
-    if (pwd == NULL) {
-        *minor_status = KRB5_NO_LOCALNAME;
+    localname->value = malloc(localname->length + 1);
+    if (localname->value == NULL) {
+        localname->length = 0;
+        *minor_status = ENOMEM;
         return GSS_S_FAILURE;
     }
 
-    *uidp = pwd->pw_uid;
+    memcpy(localname->value, lnamebuf, localname->length + 1);
+    *minor_status = 0;
 
     return GSS_S_COMPLETE;
-#endif /* NO_LOCALNAME */
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/prf.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/prf.c
index 75afe435c..f6960c61e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/prf.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/prf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: prf.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: prf.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/process_context_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/process_context_token.c
index 8c01453e5..4d802ca1d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/process_context_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/process_context_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: process_context_token.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: process_context_token.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_process_context_token (
 	OM_uint32          *minor_status,
-	const gss_ctx_id_t context_handle,
+	gss_const_ctx_id_t context_handle,
 	const gss_buffer_t token_buffer
     )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_buffer.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_buffer.c
index 1b5855e9c..e4c7ecb24 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_buffer.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_buffer.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: release_buffer.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: release_buffer.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_cred.c
index f08d3e2e1..bdd318308 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: release_cred.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: release_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_name.c
index cc34bc751..6e76181f3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/release_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: release_name.c,v 1.1.1.1 2011/04/13 18:14:45 elric Exp $	*/
+/*	$NetBSD: release_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/sequence.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/sequence.c
index be9cdd23e..cfabb09b1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/sequence.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/sequence.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sequence.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: sequence.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_cred_option.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_cred_option.c
index 3f7c92972..240ac60ec 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_cred_option.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_cred_option.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_cred_option.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: set_cred_option.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_sec_context_option.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_sec_context_option.c
index 2600029f3..8799475e1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_sec_context_option.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/set_sec_context_option.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_sec_context_option.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: set_sec_context_option.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -180,23 +180,9 @@ _gsskrb5_set_sec_context_option
 
     } else if (gss_oid_equal(desired_object, GSS_KRB5_SEND_TO_KDC_X)) {
 
-	if (value == NULL || value->length == 0) {
-	    krb5_set_send_to_kdc_func(context, NULL, NULL);
-	} else {
-	    struct gsskrb5_send_to_kdc c;
+	*minor_status = EINVAL;
+	return GSS_S_FAILURE;
 
-	    if (value->length != sizeof(c)) {
-		*minor_status = EINVAL;
-		return GSS_S_FAILURE;
-	    }
-	    memcpy(&c, value->value, sizeof(c));
-	    krb5_set_send_to_kdc_func(context,
-				      (krb5_send_to_kdc_func)c.func,
-				      c.ptr);
-	}
-
-	*minor_status = 0;
-	return GSS_S_COMPLETE;
     } else if (gss_oid_equal(desired_object, GSS_KRB5_CCACHE_NAME_X)) {
 	char *str;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/store_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/store_cred.c
index 40008cef8..cd17453d1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/store_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/store_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: store_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -48,8 +48,11 @@ _gsskrb5_store_cred(OM_uint32         *minor_status,
     krb5_context context;
     krb5_error_code ret;
     gsskrb5_cred cred;
-    krb5_ccache id;
-    int destroy = 0;
+    krb5_ccache id = NULL;
+    krb5_ccache def_ccache = NULL;
+    const char *def_type = NULL;
+    time_t exp_current;
+    time_t exp_new;
 
     *minor_status = 0;
 
@@ -58,7 +61,8 @@ _gsskrb5_store_cred(OM_uint32         *minor_status,
 	return GSS_S_FAILURE;
     }
 
-    if (gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0)
+    if (desired_mech != GSS_C_NO_OID &&
+        gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0)
 	return GSS_S_BAD_MECH;
 
     cred = (gsskrb5_cred)input_cred_handle;
@@ -71,48 +75,87 @@ _gsskrb5_store_cred(OM_uint32         *minor_status,
     if (cred->usage != cred_usage && cred->usage != GSS_C_BOTH) {
 	HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	*minor_status = GSS_KRB5_S_G_BAD_USAGE;
-	return(GSS_S_FAILURE);
+	return GSS_S_FAILURE;
+    }
+
+    ret = krb5_cc_get_lifetime(context, cred->ccache, &exp_new);
+    if (ret) {
+	HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+	*minor_status = ret;
+	return GSS_S_NO_CRED;
     }
 
     if (cred->principal == NULL) {
 	HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	*minor_status = GSS_KRB5_S_KG_TGT_MISSING;
-	return(GSS_S_FAILURE);
+	return GSS_S_FAILURE;
     }
 
-    /* write out cred to credential cache */
+    ret = krb5_cc_default(context, &def_ccache);
+    if (ret == 0) {
+        def_type = krb5_cc_get_type(context, def_ccache);
+        krb5_cc_close(context, def_ccache);
+    }
+    def_ccache = NULL;
 
+    /* write out cred to credential cache */
     ret = krb5_cc_cache_match(context, cred->principal, &id);
     if (ret) {
-	ret = krb5_cc_new_unique(context, NULL, NULL, &id);
-	if (ret) {
-	    HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-	    *minor_status = ret;
-	    return(GSS_S_FAILURE);
-	}
-	destroy = 1;
+        if (default_cred) {
+            ret = krb5_cc_default(context, &id);
+            if (ret) {
+                HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+                *minor_status = ret;
+                return GSS_S_FAILURE;
+            }
+        } else {
+            if (def_type == NULL ||
+                !krb5_cc_support_switch(context, def_type)) {
+                HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+                *minor_status = 0;      /* XXX */
+                return GSS_S_NO_CRED;   /* XXX */
+            }
+            ret = krb5_cc_new_unique(context, def_type, NULL, &id);
+            if (ret) {
+                HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+                *minor_status = ret;
+                return GSS_S_FAILURE;
+            }
+            overwrite_cred = 1;
+        }
+    }
+
+    if (!overwrite_cred) {
+        /* If current creds are expired or near it, overwrite */
+        ret = krb5_cc_get_lifetime(context, id, &exp_current);
+        if (ret != 0 || exp_new > exp_current)
+            overwrite_cred = 1;
+    }
+
+    if (!overwrite_cred) {
+        /* Nothing to do */
+        krb5_cc_close(context, id);
+        HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
+        *minor_status = 0;
+        return GSS_S_DUPLICATE_ELEMENT;
     }
 
     ret = krb5_cc_initialize(context, id, cred->principal);
     if (ret == 0)
 	ret = krb5_cc_copy_match_f(context, cred->ccache, id, NULL, NULL, NULL);
     if (ret) {
-	if (destroy)
-	    krb5_cc_destroy(context, id);
-	else
-	    krb5_cc_close(context, id);
+        krb5_cc_close(context, id);
 	HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
 	*minor_status = ret;
 	return(GSS_S_FAILURE);
     }
 
-    if (default_cred)
+    if (default_cred && def_type != NULL &&
+        krb5_cc_support_switch(context, def_type))
 	krb5_cc_switch(context, id);
 
     krb5_cc_close(context, id);
-
     HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-
     *minor_status = 0;
     return GSS_S_COMPLETE;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_acquire_cred.c
index ee1b71f19..ca95d5b74 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_acquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_acquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cfx.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cfx.c
index f9c8f469b..280f19d30 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cfx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cfx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_cfx.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_cfx.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -150,7 +150,7 @@ main(int argc, char **argv)
 	errx(1, "krb5_context_init: %d", ret);
 
     ret = krb5_generate_random_keyblock(context,
-					ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+					KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 					&keyblock);
     if (ret)
 	krb5_err(context, 1, ret, "krb5_generate_random_keyblock");
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cred.c
index a8ca8431c..5ee866374 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_kcred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_kcred.c
index d1bfb0459..aebe8bef4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_kcred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_kcred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_kcred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_kcred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_oid.c
index baedace84..e75c30265 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/test_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_oid.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: test_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ticket_flags.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ticket_flags.c
index 2e1f1a798..6cb6856c2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ticket_flags.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/ticket_flags.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ticket_flags.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: ticket_flags.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/unwrap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/unwrap.c
index 0b134e7e1..f56796240 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/unwrap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/unwrap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: unwrap.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: unwrap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -384,7 +384,7 @@ unwrap_des3
 
 OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t input_message_buffer,
             gss_buffer_t output_message_buffer,
             int * conf_state,
@@ -394,7 +394,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap
   krb5_keyblock *key;
   krb5_context context;
   OM_uint32 ret;
-  krb5_keytype keytype;
   gsskrb5_ctx ctx = (gsskrb5_ctx) context_handle;
 
   output_message_buffer->value = NULL;
@@ -416,12 +415,13 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap
       *minor_status = ret;
       return GSS_S_FAILURE;
   }
-  krb5_enctype_to_keytype (context, key->keytype, &keytype);
 
   *minor_status = 0;
 
-  switch (keytype) {
-  case KEYTYPE_DES :
+  switch (key->keytype) {
+  case KRB5_ENCTYPE_DES_CBC_CRC :
+  case KRB5_ENCTYPE_DES_CBC_MD4 :
+  case KRB5_ENCTYPE_DES_CBC_MD5 :
 #ifdef HEIM_WEAK_CRYPTO
       ret = unwrap_des (minor_status, ctx,
 			input_message_buffer, output_message_buffer,
@@ -430,13 +430,14 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap
       ret = GSS_S_FAILURE;
 #endif
       break;
-  case KEYTYPE_DES3 :
+  case KRB5_ENCTYPE_DES3_CBC_MD5 :
+  case KRB5_ENCTYPE_DES3_CBC_SHA1 :
       ret = unwrap_des3 (minor_status, ctx, context,
 			 input_message_buffer, output_message_buffer,
 			 conf_state, qop_state, key);
       break;
-  case KEYTYPE_ARCFOUR:
-  case KEYTYPE_ARCFOUR_56:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56:
       ret = _gssapi_unwrap_arcfour (minor_status, ctx, context,
 				    input_message_buffer, output_message_buffer,
 				    conf_state, qop_state, key);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/verify_mic.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/verify_mic.c
index dbeb4be7d..049873a92 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/verify_mic.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/verify_mic.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verify_mic.c,v 1.2 2014/05/12 15:25:49 christos Exp $	*/
+/*	$NetBSD: verify_mic.c,v 1.3 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -292,7 +292,6 @@ _gsskrb5_verify_mic_internal
 {
     krb5_keyblock *key;
     OM_uint32 ret;
-    krb5_keytype keytype;
 
     if (ctx->more_flags & IS_CFX)
         return _gssapi_verify_mic_cfx (minor_status, ctx,
@@ -307,9 +306,11 @@ _gsskrb5_verify_mic_internal
 	return GSS_S_FAILURE;
     }
     *minor_status = 0;
-    krb5_enctype_to_keytype (context, key->keytype, &keytype);
-    switch (keytype) {
-    case KEYTYPE_DES :
+
+    switch (key->keytype) {
+    case KRB5_ENCTYPE_DES_CBC_CRC :
+    case KRB5_ENCTYPE_DES_CBC_MD4 :
+    case KRB5_ENCTYPE_DES_CBC_MD5 :
 #ifdef HEIM_WEAK_CRYPTO
 	ret = verify_mic_des (minor_status, ctx, context,
 			      message_buffer, token_buffer, qop_state, key,
@@ -318,13 +319,14 @@ _gsskrb5_verify_mic_internal
       ret = GSS_S_FAILURE;
 #endif
 	break;
-    case KEYTYPE_DES3 :
+    case KRB5_ENCTYPE_DES3_CBC_MD5 :
+    case KRB5_ENCTYPE_DES3_CBC_SHA1 :
 	ret = verify_mic_des3 (minor_status, ctx, context,
 			       message_buffer, token_buffer, qop_state, key,
 			       type);
 	break;
-    case KEYTYPE_ARCFOUR :
-    case KEYTYPE_ARCFOUR_56 :
+    case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5:
+    case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56:
 	ret = _gssapi_verify_mic_arcfour (minor_status, ctx,
 					  context,
 					  message_buffer, token_buffer,
@@ -341,7 +343,7 @@ _gsskrb5_verify_mic_internal
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_verify_mic
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t message_buffer,
             const gss_buffer_t token_buffer,
             gss_qop_t * qop_state
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/wrap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/wrap.c
index d926db97f..0a6abb177 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/wrap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/krb5/wrap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: wrap.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: wrap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -139,7 +139,7 @@ sub_wrap_size (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_wrap_size_limit (
             OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             int conf_req_flag,
             gss_qop_t qop_req,
             OM_uint32 req_output_size,
@@ -149,7 +149,6 @@ _gsskrb5_wrap_size_limit (
   krb5_context context;
   krb5_keyblock *key;
   OM_uint32 ret;
-  krb5_keytype keytype;
   const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
 
   GSSAPI_KRB5_INIT (&context);
@@ -166,23 +165,25 @@ _gsskrb5_wrap_size_limit (
       *minor_status = ret;
       return GSS_S_FAILURE;
   }
-  krb5_enctype_to_keytype (context, key->keytype, &keytype);
 
-  switch (keytype) {
-  case KEYTYPE_DES :
+  switch (key->keytype) {
+  case KRB5_ENCTYPE_DES_CBC_CRC :
+  case KRB5_ENCTYPE_DES_CBC_MD4 :
+  case KRB5_ENCTYPE_DES_CBC_MD5 :
 #ifdef HEIM_WEAK_CRYPTO
       ret = sub_wrap_size(req_output_size, max_input_size, 8, 22);
 #else
       ret = GSS_S_FAILURE;
 #endif
       break;
-  case ENCTYPE_ARCFOUR_HMAC_MD5:
-  case ENCTYPE_ARCFOUR_HMAC_MD5_56:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56:
       ret = _gssapi_wrap_size_arcfour(minor_status, ctx, context,
 				      conf_req_flag, qop_req,
 				      req_output_size, max_input_size, key);
       break;
-  case KEYTYPE_DES3 :
+  case KRB5_ENCTYPE_DES3_CBC_MD5 :
+  case KRB5_ENCTYPE_DES3_CBC_SHA1 :
       ret = sub_wrap_size(req_output_size, max_input_size, 8, 34);
       break;
   default :
@@ -529,7 +530,7 @@ wrap_des3
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_wrap
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             int conf_req_flag,
             gss_qop_t qop_req,
             const gss_buffer_t input_message_buffer,
@@ -540,7 +541,6 @@ _gsskrb5_wrap
   krb5_context context;
   krb5_keyblock *key;
   OM_uint32 ret;
-  krb5_keytype keytype;
   const gsskrb5_ctx ctx = (const gsskrb5_ctx) context_handle;
 
   output_message_buffer->value = NULL;
@@ -560,10 +560,11 @@ _gsskrb5_wrap
       *minor_status = ret;
       return GSS_S_FAILURE;
   }
-  krb5_enctype_to_keytype (context, key->keytype, &keytype);
 
-  switch (keytype) {
-  case KEYTYPE_DES :
+  switch (key->keytype) {
+  case KRB5_ENCTYPE_DES_CBC_CRC :
+  case KRB5_ENCTYPE_DES_CBC_MD4 :
+  case KRB5_ENCTYPE_DES_CBC_MD5 :
 #ifdef HEIM_WEAK_CRYPTO
       ret = wrap_des (minor_status, ctx, context, conf_req_flag,
 		      qop_req, input_message_buffer, conf_state,
@@ -572,13 +573,14 @@ _gsskrb5_wrap
       ret = GSS_S_FAILURE;
 #endif
       break;
-  case KEYTYPE_DES3 :
+  case KRB5_ENCTYPE_DES3_CBC_MD5 :
+  case KRB5_ENCTYPE_DES3_CBC_SHA1 :
       ret = wrap_des3 (minor_status, ctx, context, conf_req_flag,
 		       qop_req, input_message_buffer, conf_state,
 		       output_message_buffer, key);
       break;
-  case KEYTYPE_ARCFOUR:
-  case KEYTYPE_ARCFOUR_56:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5:
+  case KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56:
       ret = _gssapi_wrap_arcfour (minor_status, ctx, context, conf_req_flag,
 				  qop_req, input_message_buffer, conf_state,
 				  output_message_buffer, key);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/libgssapi-exports.def b/crypto/external/bsd/heimdal/dist/lib/gssapi/libgssapi-exports.def
index 3cbcc4eb1..b8e4dce41 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/libgssapi-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/libgssapi-exports.def
@@ -65,6 +65,7 @@ EXPORTS
 	gss_krb5_get_tkt_flags
 	gss_krb5_import_cred
 	gss_krb5_set_allowable_enctypes
+	gss_localname
 	gss_mg_collect_error
         gss_mo_get
         gss_mo_set
@@ -93,11 +94,13 @@ EXPORTS
 	gss_test_oid_set_member
 	gss_unseal
 	gss_unwrap
+	gss_unwrap_aead
 	gss_unwrap_iov
 	gss_userok
 	gss_verify
 	gss_verify_mic
 	gss_wrap
+	gss_wrap_aead
 	gss_wrap_iov
 	gss_wrap_iov_length
 	gss_wrap_size_limit
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/compat.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/compat.h
index 554c69947..0a68d73e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/compat.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/compat.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: compat.h,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: compat.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
@@ -55,7 +55,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_inquire_attrs_for_mech_t (
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_acquire_cred_with_password_t
 	      (OM_uint32 *,            /* minor_status */
-	       const gss_name_t,       /* desired_name */
+	       gss_const_name_t,       /* desired_name */
 	       const gss_buffer_t,     /* password */
 	       OM_uint32,              /* time_req */
 	       const gss_OID_set,      /* desired_mechs */
@@ -67,8 +67,8 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_acquire_cred_with_password_t
 
 typedef OM_uint32 GSSAPI_CALLCONV _gss_add_cred_with_password_t (
 	       OM_uint32 *,            /* minor_status */
-	       const gss_cred_id_t,    /* input_cred_handle */
-	       const gss_name_t,       /* desired_name */
+	       gss_const_cred_id_t,    /* input_cred_handle */
+	       gss_const_name_t,       /* desired_name */
 	       const gss_OID,          /* desired_mech */
 	       const gss_buffer_t,     /* password */
 	       gss_cred_usage_t,       /* cred_usage */
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.c
index 696c8ab63..3595c4efa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 #include "mech_locl.h"
 #include "heim_threads.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.h
index 31bc4f135..dd411266b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/context.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: context.h,v 1.1.1.2 2011/04/14 14:08:27 elric Exp $	*/
+/*	$NetBSD: context.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/cred.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/cred.h
index 3a96ec7dd..67f3d8c5e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/cred.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/cred.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: cred.h,v 1.1.1.3 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: cred.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/doxygen.c
index 5e51ff8ba..364c760f8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -41,13 +41,12 @@
  * - SPNEGO
  * - NTLM
  *
- * See @ref gssapi_mechs for more describtion about these mechanisms.
- *
- * The project web page: http://www.h5l.org/
+ * @sa
  *
  * - @ref gssapi_services_intro
  * - @ref gssapi_mechs
  * - @ref gssapi_api_INvsMN
+ * - The project web page: http://www.h5l.org/
  */
 
 /**
@@ -107,28 +106,30 @@
  * @page internalVSmechname Internal names and mechanism names
  * @section gssapi_api_INvsMN Name forms
  *
- * There are two forms of name in GSS-API, Internal form and
- * Contiguous string ("flat") form. gss_export_name() and
+ * There are two name representations in GSS-API: Internal form and
+ * Contiguous string ("flat") form. Functions gss_export_name() and
  * gss_import_name() can be used to convert between the two forms.
  *
  * - The contiguous string form is described by an oid specificing the
  *   type and an octet string. A special form of the contiguous
  *   string form is the exported name object. The exported name
  *   defined for each mechanism, is something that can be stored and
- *   complared later. The exported name is what should be used for
+ *   compared later. The exported name is what should be used for
  *   ACLs comparisons.
  *
- * - The Internal form
+ * - The Internal form is opaque to the application programmer and
+ *   is implementation-dependent.
  *
- *   There is also special form of the Internal Name (IN), and that is
+ * - There is also a special form of the Internal Name (IN), and that is
  *   the Mechanism Name (MN). In the mechanism name all the generic
  *   information is stripped of and only contain the information for
  *   one mechanism.  In GSS-API some function return MN and some
  *   require MN as input. Each of these function is marked up as such.
  *
- *
- * Describe relationship between import_name, canonicalize_name,
- * export_name and friends.
+ * @FIXME Describe relationship between import_name, canonicalize_name,
+ * export_name and friends.  Also, update for RFC2743 language
+ * ("contiguous" and "flat" are gone, leaving just "exported name
+ * token", "internal", and "MN").
  */
 
 /** @defgroup gssapi Heimdal GSS-API functions */
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_accept_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_accept_sec_context.c
index 48cd9864d..21ae5e827 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_accept_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_accept_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_accept_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_accept_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -146,7 +146,7 @@ choose_mech(const gss_buffer_t input, gss_OID mech_oid)
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_accept_sec_context(OM_uint32 *minor_status,
     gss_ctx_id_t *context_handle,
-    const gss_cred_id_t acceptor_cred_handle,
+    gss_const_cred_id_t acceptor_cred_handle,
     const gss_buffer_t input_token,
     const gss_channel_bindings_t input_chan_bindings,
     gss_name_t *src_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred.c
index ebe64010e..6bb344515 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_acquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_acquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_acquire_cred(OM_uint32 *minor_status,
-    const gss_name_t desired_name,
+    gss_const_name_t desired_name,
     OM_uint32 time_req,
     const gss_OID_set desired_mechs,
     gss_cred_usage_t cred_usage,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_ext.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_ext.c
index 890300dd3..766aaecc5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_ext.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_ext.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_acquire_cred_ext.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_acquire_cred_ext.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -102,13 +102,22 @@ _gss_acquire_mech_cred(OM_uint32 *minor_status,
 	mc= NULL;
     }
 
-    *output_cred_handle = mc;
+    if (major_status != GSS_S_COMPLETE)
+        free(mc);
+    else
+        *output_cred_handle = mc;
     return major_status;
 }
 
+/**
+ * This function is not a public interface and is deprecated anyways, do
+ * not use.  Use gss_acquire_cred_with_password() instead for now.
+ *
+ * @deprecated
+ */
 OM_uint32
 _gss_acquire_cred_ext(OM_uint32 *minor_status,
-    const gss_name_t desired_name,
+    gss_const_name_t desired_name,
     gss_const_OID credential_type,
     const void *credential_data,
     OM_uint32 time_req,
@@ -154,7 +163,6 @@ _gss_acquire_cred_ext(OM_uint32 *minor_status,
     for (i = 0; i < mechs->count; i++) {
 	struct _gss_mechanism_name *mn = NULL;
 	struct _gss_mechanism_cred *mc = NULL;
-	gss_name_t desired_mech_name = GSS_C_NO_NAME;
 
 	m = __gss_get_mechanism(&mechs->elements[i]);
 	if (!m)
@@ -165,16 +173,17 @@ _gss_acquire_cred_ext(OM_uint32 *minor_status,
 					&mechs->elements[i], &mn);
 	    if (major_status != GSS_S_COMPLETE)
 		continue;
-
-	    desired_mech_name = mn->gmn_name;
 	}
 
 	major_status = _gss_acquire_mech_cred(minor_status, m, mn,
 					      credential_type, credential_data,
 					      time_req, desired_mech, cred_usage,
 					      &mc);
-	if (GSS_ERROR(major_status))
+	if (GSS_ERROR(major_status)) {
+            if (mechs->count == 1)
+                _gss_mg_error(m, major_status, *minor_status);
 	    continue;
+        }
 
 	HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
     }
@@ -185,7 +194,8 @@ _gss_acquire_cred_ext(OM_uint32 *minor_status,
      */
     if (!HEIM_SLIST_FIRST(&cred->gc_mc)) {
 	free(cred);
-	*minor_status = 0;
+        if (mechs->count > 1)
+            *minor_status = 0;
 	return GSS_S_NO_CRED;
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_with_password.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_with_password.c
index abf1201d7..4025061cd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_with_password.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_acquire_cred_with_password.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_acquire_cred_with_password.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_acquire_cred_with_password.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2011, PADL Software Pty Ltd.
@@ -36,7 +36,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_acquire_cred_with_password(OM_uint32 *minor_status,
-			       const gss_name_t desired_name,
+			       gss_const_name_t desired_name,
 			       const gss_buffer_t password,
 			       OM_uint32 time_req,
 			       const gss_OID_set desired_mechs,
@@ -95,7 +95,8 @@ gss_acquire_cred_with_password(OM_uint32 *minor_status,
 
 	if (!HEIM_SLIST_FIRST(&new_cred->gc_mc)) {
 	    free(new_cred);
-	    *minor_status = 0;
+            if (desired_mechs->count > 1)
+                *minor_status = 0;
 	    return GSS_S_NO_CRED;
 	}
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred.c
index a0d5e4a8c..0d5e86bdc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_add_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_add_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -74,8 +74,8 @@ _gss_copy_cred(struct _gss_mechanism_cred *mc)
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_add_cred(OM_uint32 *minor_status,
-    const gss_cred_id_t input_cred_handle,
-    const gss_name_t desired_name,
+    gss_const_cred_id_t input_cred_handle,
+    gss_const_name_t desired_name,
     const gss_OID desired_mech,
     gss_cred_usage_t cred_usage,
     OM_uint32 initiator_time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred_with_password.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred_with_password.c
index e21745b0b..27dca3288 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred_with_password.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_cred_with_password.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_add_cred_with_password.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_add_cred_with_password.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,8 +32,8 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_add_cred_with_password(OM_uint32 *minor_status,
-    const gss_cred_id_t input_cred_handle,
-    const gss_name_t desired_name,
+    gss_const_cred_id_t input_cred_handle,
+    gss_const_name_t desired_name,
     const gss_OID desired_mech,
     const gss_buffer_t password,
     gss_cred_usage_t cred_usage,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_oid_set_member.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_oid_set_member.c
index df715c467..38267abdb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_oid_set_member.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_add_oid_set_member.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_add_oid_set_member.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_add_oid_set_member.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_aeap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_aeap.c
index 88989d08a..42d27f0fc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_aeap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_aeap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_aeap.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_aeap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * AEAD support
@@ -201,7 +201,7 @@ gss_OID_desc GSSAPI_LIB_FUNCTION __gss_c_attr_stream_sizes_oid_desc =
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_context_query_attributes(OM_uint32 *minor_status,
-			     const gss_ctx_id_t context_handle,
+			     gss_const_ctx_id_t context_handle,
 			     const gss_OID attribute,
 			     void *data,
 			     size_t len)
@@ -216,3 +216,121 @@ gss_context_query_attributes(OM_uint32 *minor_status,
 
     return GSS_S_FAILURE;
 }
+
+/*
+ * AEAD wrap API for a single piece of associated data, for compatibility
+ * with MIT and as specified by draft-howard-gssapi-aead-00.txt.
+ *
+ * @ingroup gssapi
+ */
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_wrap_aead(OM_uint32 *minor_status,
+	      gss_ctx_id_t context_handle,
+              int conf_req_flag,
+              gss_qop_t qop_req,
+              gss_buffer_t input_assoc_buffer,
+              gss_buffer_t input_payload_buffer,
+              int *conf_state,
+              gss_buffer_t output_message_buffer)
+{
+    OM_uint32 major_status, tmp, flags = 0;
+    gss_iov_buffer_desc iov[5];
+    size_t i;
+    unsigned char *p;
+
+    memset(iov, 0, sizeof(iov));
+
+    iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER;
+
+    iov[1].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
+    if (input_assoc_buffer)
+	iov[1].buffer = *input_assoc_buffer;
+
+    iov[2].type = GSS_IOV_BUFFER_TYPE_DATA;
+    if (input_payload_buffer)
+	iov[2].buffer.length = input_payload_buffer->length;
+
+    gss_inquire_context(minor_status, context_handle, NULL, NULL,
+			NULL, NULL, &flags, NULL, NULL);
+
+    /* krb5 mech rejects padding/trailer if DCE-style is set */
+    iov[3].type = (flags & GSS_C_DCE_STYLE) ? GSS_IOV_BUFFER_TYPE_EMPTY
+					    : GSS_IOV_BUFFER_TYPE_PADDING;
+    iov[4].type = (flags & GSS_C_DCE_STYLE) ? GSS_IOV_BUFFER_TYPE_EMPTY
+					    : GSS_IOV_BUFFER_TYPE_TRAILER;
+
+    major_status = gss_wrap_iov_length(minor_status, context_handle,
+				       conf_req_flag, qop_req, conf_state,
+				       iov, 5);
+    if (GSS_ERROR(major_status))
+	return major_status;
+
+    for (i = 0, output_message_buffer->length = 0; i < 5; i++) {
+        if (GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_SIGN_ONLY)
+	    continue;
+
+	output_message_buffer->length += iov[i].buffer.length;
+    }
+
+    output_message_buffer->value = malloc(output_message_buffer->length);
+    if (output_message_buffer->value == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    for (i = 0, p = output_message_buffer->value; i < 5; i++) {
+	if (GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_SIGN_ONLY)
+	    continue;
+	else if (GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_DATA)
+	    memcpy(p, input_payload_buffer->value, input_payload_buffer->length);
+
+	iov[i].buffer.value = p;
+	p += iov[i].buffer.length;
+    }
+
+    major_status = gss_wrap_iov(minor_status, context_handle, conf_req_flag,
+				qop_req, conf_state, iov, 5);
+    if (GSS_ERROR(major_status))
+        gss_release_buffer(&tmp, output_message_buffer);
+
+    return major_status;
+}
+
+/*
+ * AEAD unwrap for a single piece of associated data, for compatibility
+ * with MIT and as specified by draft-howard-gssapi-aead-00.txt.
+ *
+ * @ingroup gssapi
+ */
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_unwrap_aead(OM_uint32 *minor_status,
+		gss_ctx_id_t context_handle,
+		gss_buffer_t input_message_buffer,
+		gss_buffer_t input_assoc_buffer,
+		gss_buffer_t output_payload_buffer,
+		int *conf_state,
+		gss_qop_t *qop_state)
+{
+    OM_uint32 major_status, tmp;
+    gss_iov_buffer_desc iov[3];
+
+    memset(iov, 0, sizeof(iov));
+
+    iov[0].type = GSS_IOV_BUFFER_TYPE_STREAM;
+    iov[0].buffer = *input_message_buffer;
+
+    iov[1].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
+    if (input_assoc_buffer)
+	iov[1].buffer = *input_assoc_buffer;
+
+    iov[2].type = GSS_IOV_BUFFER_TYPE_DATA | GSS_IOV_BUFFER_FLAG_ALLOCATE;
+
+    major_status = gss_unwrap_iov(minor_status, context_handle, conf_state,
+				  qop_state, iov, 3);
+    if (GSS_ERROR(major_status))
+	gss_release_iov_buffer(&tmp, &iov[2], 1);
+    else
+	*output_payload_buffer = iov[2].buffer;
+
+    return major_status;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_authorize_localname.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_authorize_localname.c
index feb97e64b..462fe412e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_authorize_localname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_authorize_localname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_authorize_localname.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_authorize_localname.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2011, PADL Software Pty Ltd.
@@ -116,8 +116,8 @@ attr_authorize_localname(OM_uint32 *minor_status,
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_authorize_localname(OM_uint32 *minor_status,
-	                const gss_name_t gss_name,
-	                const gss_name_t gss_user)
+	                gss_const_name_t gss_name,
+	                gss_const_name_t gss_user)
 
 {
     OM_uint32 major_status;
@@ -166,7 +166,7 @@ gss_authorize_localname(OM_uint32 *minor_status,
 }
 
 GSSAPI_LIB_FUNCTION int GSSAPI_LIB_CALL
-gss_userok(const gss_name_t name,
+gss_userok(gss_const_name_t name,
            const char *user)
 {
     OM_uint32 major_status, minor_status;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_buffer_set.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_buffer_set.c
index d02047dad..ad2c858db 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_buffer_set.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_buffer_set.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_buffer_set.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_buffer_set.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_canonicalize_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_canonicalize_name.c
index 52cb19e08..ab884d4dd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_canonicalize_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_canonicalize_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_canonicalize_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_canonicalize_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -56,7 +56,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_canonicalize_name(OM_uint32 *minor_status,
-    const gss_name_t input_name,
+    gss_const_name_t input_name,
     const gss_OID mech_type,
     gss_name_t *output_name)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_compare_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_compare_name.c
index e5c2ae82e..b8e561f03 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_compare_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_compare_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_compare_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_compare_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,8 +32,8 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_compare_name(OM_uint32 *minor_status,
-    const gss_name_t name1_arg,
-    const gss_name_t name2_arg,
+    gss_const_name_t name1_arg,
+    gss_const_name_t name2_arg,
     int *name_equal)
 {
 	struct _gss_name *name1 = (struct _gss_name *) name1_arg;
@@ -49,7 +49,7 @@ gss_compare_name(OM_uint32 *minor_status,
 		if (!gss_oid_equal(&name1->gn_type, &name2->gn_type)) {
 			*name_equal = 0;
 		} else if (name1->gn_value.length != name2->gn_value.length ||
-		    memcmp(name1->gn_value.value, name1->gn_value.value,
+		    memcmp(name1->gn_value.value, name2->gn_value.value,
 			name1->gn_value.length)) {
 			*name_equal = 0;
 		}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_context_time.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_context_time.c
index 75e9c0ed7..a2f092a6b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_context_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_context_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_context_time.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_context_time.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_context_time(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     OM_uint32 *time_rec)
 {
 	struct _gss_context *ctx = (struct _gss_context *) context_handle;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_create_empty_oid_set.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_create_empty_oid_set.c
index 22e9a0e2f..f8eba27e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_create_empty_oid_set.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_create_empty_oid_set.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_create_empty_oid_set.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_create_empty_oid_set.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_cred.c
index 16f5464bf..91a5d8df5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_decapsulate_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_decapsulate_token.c
index 159c99a43..e85c6aa3f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_decapsulate_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_decapsulate_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_decapsulate_token.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_decapsulate_token.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_name_attribute.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_name_attribute.c
index bb221aca8..93377d19d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_name_attribute.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_name_attribute.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_delete_name_attribute.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_delete_name_attribute.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_sec_context.c
index e49bcd727..253bdff03 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_delete_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_delete_sec_context.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_delete_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -35,7 +35,7 @@ gss_delete_sec_context(OM_uint32 *minor_status,
     gss_ctx_id_t *context_handle,
     gss_buffer_t output_token)
 {
-	OM_uint32 major_status;
+	OM_uint32 major_status = GSS_S_COMPLETE;
 	struct _gss_context *ctx = (struct _gss_context *) *context_handle;
 
 	if (output_token)
@@ -55,5 +55,5 @@ gss_delete_sec_context(OM_uint32 *minor_status,
 		*context_handle = GSS_C_NO_CONTEXT;
 	}
 
-	return (GSS_S_COMPLETE);
+	return (major_status);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name.c
index 555a844f1..3066e6246 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_display_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_display_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_display_name(OM_uint32 *minor_status,
-    const gss_name_t input_name,
+    gss_const_name_t input_name,
     gss_buffer_t output_name_buffer,
     gss_OID *output_name_type)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name_ext.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name_ext.c
index a53649b9c..fd2dca44e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name_ext.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_name_ext.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_display_name_ext.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_display_name_ext.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_status.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_status.c
index c4d7a2109..ae95b6993 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_status.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_display_status.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_display_status.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_display_status.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -136,25 +136,43 @@ supplementary_error(OM_uint32 v)
 	return msgs[v];
 }
 
-
+/**
+ * Convert a GSS-API status code to text
+ *
+ * @param minor_status     minor status code
+ * @param status_value     status value to convert
+ * @param status_type      One of:
+ *                         GSS_C_GSS_CODE - status_value is a GSS status code,
+ *                         GSS_C_MECH_CODE - status_value is a mechanism status code
+ * @param mech_type        underlying mechanism. Use GSS_C_NO_OID to obtain the
+ *                         system default.
+ * @param message_context  state information to extract further messages from the
+ *                         status_value
+ * @param status_string    the allocated text representation. Release with
+ *                         gss_release_buffer()
+ *
+ * @returns a gss_error code.
+ *
+ * @ingroup gssapi
+ */
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_display_status(OM_uint32 *minor_status,
     OM_uint32 status_value,
     int status_type,
     const gss_OID mech_type,
-    OM_uint32 *message_content,
+    OM_uint32 *message_context,
     gss_buffer_t status_string)
 {
 	OM_uint32 major_status;
 
 	_mg_buffer_zero(status_string);
-	*message_content = 0;
+	*message_context = 0;
 
 	major_status = _gss_mg_get_error(mech_type, status_type,
 					 status_value, status_string);
 	if (major_status == GSS_S_COMPLETE) {
 
-	    *message_content = 0;
+	    *message_context = 0;
 	    *minor_status = 0;
 	    return GSS_S_COMPLETE;
 	}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_name.c
index d428aa1ee..4e208cd1a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_duplicate_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_duplicate_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_duplicate_name(OM_uint32 *minor_status,
-    const gss_name_t src_name,
+    gss_const_name_t src_name,
     gss_name_t *dest_name)
 {
 	OM_uint32		major_status;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_oid.c
index f43470086..a57254c25 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_duplicate_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_duplicate_oid.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_duplicate_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_encapsulate_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_encapsulate_token.c
index effd143e5..807ffcabe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_encapsulate_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_encapsulate_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_encapsulate_token.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_encapsulate_token.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name.c
index c782f4916..e2eb205d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_export_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_export_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -30,9 +30,23 @@
 
 #include "mech_locl.h"
 
+/**
+ * Convert a GGS-API name from internal form to contiguous string.
+ *
+ * @sa gss_import_name(), @ref internalVSmechname.
+ *
+ * @param minor_status   minor status code
+ * @param input_name     input name in internal name form
+ * @param exported_name  output name in contiguos string form
+ *
+ * @returns a gss_error code, see gss_display_status() about printing
+ *        the error code.
+ *
+ * @ingroup gssapi
+ */
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_export_name(OM_uint32 *minor_status,
-    const gss_name_t input_name,
+    gss_const_name_t input_name,
     gss_buffer_t exported_name)
 {
 	struct _gss_name *name = (struct _gss_name *) input_name;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name_composite.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name_composite.c
index b90546669..9b8816364 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name_composite.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_name_composite.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_export_name_composite.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_export_name_composite.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_sec_context.c
index 9cbd35367..351ca49d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_export_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_export_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_export_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_mic.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_mic.c
index be1ab8177..5264767e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_mic.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_mic.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_get_mic.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_get_mic.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_get_mic(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     gss_qop_t qop_req,
     const gss_buffer_t message_buffer,
     gss_buffer_t message_token)
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_name_attribute.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_name_attribute.c
index c38229301..4833057ff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_name_attribute.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_get_name_attribute.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_get_name_attribute.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_get_name_attribute.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_name.c
index b66ec08c5..21f484717 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_import_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_import_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -151,7 +151,7 @@ _gss_import_export_name(OM_uint32 *minor_status,
 }
 
 /**
- * Import a name internal or mechanism name
+ * Convert a GGS-API name from contiguous string to internal form.
  *
  * Type of name and their format:
  * - GSS_C_NO_OID
@@ -161,12 +161,12 @@ _gss_import_export_name(OM_uint32 *minor_status,
  * - GSS_C_NT_ANONYMOUS
  * - GSS_KRB5_NT_PRINCIPAL_NAME
  *
- * For more information about @ref internalVSmechname.
+ * @sa gss_export_name(), @ref internalVSmechname.
  *
- * @param minor_status minor status code
- * @param input_name_buffer import name buffer
- * @param input_name_type type of the import name buffer
- * @param output_name the resulting type, release with
+ * @param minor_status       minor status code
+ * @param input_name_buffer  import name buffer
+ * @param input_name_type    type of the import name buffer
+ * @param output_name        the resulting type, release with
  *        gss_release_name(), independent of input_name
  *
  * @returns a gss_error code, see gss_display_status() about printing
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_sec_context.c
index 7cdbd6a93..6cfd6a2b9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_import_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_import_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_import_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_indicate_mechs.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_indicate_mechs.c
index 8b3f9a286..c41cc6c56 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_indicate_mechs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_indicate_mechs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_indicate_mechs.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_indicate_mechs.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -45,6 +45,7 @@ gss_indicate_mechs(OM_uint32 *minor_status,
 	if (major_status)
 		return (major_status);
 
+        /* XXX We ignore ENOMEM from gss_add_oid_set_member() */
 	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_indicate_mechs) {
 			major_status = m->gm_mech.gm_indicate_mechs(
@@ -52,11 +53,11 @@ gss_indicate_mechs(OM_uint32 *minor_status,
 			if (major_status)
 				continue;
 			for (i = 0; i < set->count; i++)
-				major_status = gss_add_oid_set_member(
+				gss_add_oid_set_member(
 				    minor_status, &set->elements[i], mech_set);
 			gss_release_oid_set(minor_status, &set);
 		} else {
-			major_status = gss_add_oid_set_member(
+			gss_add_oid_set_member(
 			    minor_status, &m->gm_mech_oid, mech_set);
 		}
 	}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_init_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_init_sec_context.c
index e252962a2..9488c462a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_init_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_init_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_init_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_init_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -31,7 +31,7 @@
 #include "mech_locl.h"
 
 static gss_cred_id_t
-_gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
+_gss_mech_cred_find(gss_const_cred_id_t cred_handle, gss_OID mech_type)
 {
 	struct _gss_cred *cred = (struct _gss_cred *)cred_handle;
 	struct _gss_mechanism_cred *mc;
@@ -109,9 +109,9 @@ _gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_init_sec_context(OM_uint32 * minor_status,
-    const gss_cred_id_t initiator_cred_handle,
+    gss_const_cred_id_t initiator_cred_handle,
     gss_ctx_id_t * context_handle,
-    const gss_name_t target_name,
+    gss_const_name_t target_name,
     const gss_OID input_mech_type,
     OM_uint32 req_flags,
     OM_uint32 time_req,
@@ -127,7 +127,7 @@ gss_init_sec_context(OM_uint32 * minor_status,
 	struct _gss_name *name = (struct _gss_name *) target_name;
 	struct _gss_mechanism_name *mn;
 	struct _gss_context *ctx = (struct _gss_context *) *context_handle;
-	gss_cred_id_t cred_handle;
+	gss_const_cred_id_t cred_handle;
 	int allocated_ctx;
 	gss_OID mech_type = input_mech_type;
 
@@ -174,7 +174,7 @@ gss_init_sec_context(OM_uint32 * minor_status,
 	major_status = _gss_find_mn(minor_status, name, mech_type, &mn);
 	if (major_status != GSS_S_COMPLETE) {
 		if (allocated_ctx)
-			free(ctx);
+                    free(ctx);
 		return major_status;
 	}
 
@@ -186,6 +186,13 @@ gss_init_sec_context(OM_uint32 * minor_status,
 	else
 		cred_handle = _gss_mech_cred_find(initiator_cred_handle, mech_type);
 
+        if (initiator_cred_handle != GSS_C_NO_CREDENTIAL &&
+            cred_handle == NULL) {
+            if (allocated_ctx)
+                free(ctx);
+            return GSS_S_NO_CRED;
+        }
+
 	major_status = m->gm_init_sec_context(minor_status,
 	    cred_handle,
 	    &ctx->gc_ctx,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_context.c
index 81ef64e51..60496c5e3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_inquire_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_context(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     gss_name_t *src_name,
     gss_name_t *targ_name,
     OM_uint32 *lifetime_rec,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred.c
index 70af44649..8f484dc07 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_cred.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_inquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -46,7 +46,7 @@ updateusage(gss_cred_usage_t usage, int *usagemask)
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_cred(OM_uint32 *minor_status,
-    const gss_cred_id_t cred_handle,
+    gss_const_cred_id_t cred_handle,
     gss_name_t *name_ret,
     OM_uint32 *lifetime,
     gss_cred_usage_t *cred_usage,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_mech.c
index c77f68399..fa153b969 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_cred_by_mech.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_inquire_cred_by_mech.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_cred_by_mech(OM_uint32 *minor_status,
-    const gss_cred_id_t cred_handle,
+    gss_const_cred_id_t cred_handle,
     const gss_OID mech_type,
     gss_name_t *cred_name,
     OM_uint32 *initiator_lifetime,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_oid.c
index 0ccc30f2f..a36199f31 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_cred_by_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_cred_by_oid.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_inquire_cred_by_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -36,7 +36,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_cred_by_oid (OM_uint32 *minor_status,
-			 const gss_cred_id_t cred_handle,
+			 gss_const_cred_id_t cred_handle,
 			 const gss_OID desired_object,
 			 gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_mechs_for_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_mechs_for_name.c
index d7ba2b7aa..c7df0964e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_mechs_for_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_mechs_for_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_mechs_for_name.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_inquire_mechs_for_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_mechs_for_name(OM_uint32 *minor_status,
-    const gss_name_t input_name,
+    gss_const_name_t input_name,
     gss_OID_set *mech_types)
 {
 	OM_uint32		major_status;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_name.c
index 057bff126..ae6c26e6e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_inquire_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_names_for_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_names_for_mech.c
index 8b889d546..3f7b4e802 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_names_for_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_names_for_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_names_for_mech.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_inquire_names_for_mech.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_sec_context_by_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_sec_context_by_oid.c
index ba7a96d4e..9c92872a8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_sec_context_by_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_inquire_sec_context_by_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_inquire_sec_context_by_oid.c,v 1.1.1.1 2011/04/13 18:14:46 elric Exp $	*/
+/*	$NetBSD: gss_inquire_sec_context_by_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -36,7 +36,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
-	                        const gss_ctx_id_t context_handle,
+	                        gss_const_ctx_id_t context_handle,
 	                        const gss_OID desired_object,
 	                        gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_krb5.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_krb5.c
index 86348b85e..fb2821f3b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_krb5.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_krb5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_krb5.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_krb5.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mech_switch.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mech_switch.c
index 601bcb11c..49bd6ad2a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mech_switch.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mech_switch.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_mech_switch.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_mech_switch.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -317,6 +317,8 @@ _gss_load_mech(void)
 			goto bad;
 
 		m->gm_so = so;
+		m->gm_mech_oid = mech_oid;
+		m->gm_mech.gm_name = strdup(name);
 		m->gm_mech.gm_mech_oid = mech_oid;
 		m->gm_mech.gm_flags = 0;
 		m->gm_mech.gm_compat = calloc(1, sizeof(struct gss_mech_compat_desc_struct));
@@ -383,7 +385,7 @@ _gss_load_mech(void)
 		OPTSYM(set_name_attribute);
 		OPTSYM(delete_name_attribute);
 		OPTSYM(export_name_composite);
-		OPTSYM(pname_to_uid);
+		OPTSYM(localname);
 		OPTSPISYM(authorize_localname);
 
 		mi = dlsym(so, "gss_mo_init");
@@ -416,6 +418,7 @@ _gss_load_mech(void)
 		if (m != NULL) {
 			free(m->gm_mech.gm_compat);
 			free(m->gm_mech.gm_mech_oid.elements);
+			free((char *)m->gm_mech.gm_name);
 			free(m);
 		}
 		dlclose(so);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mo.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mo.c
index 2dbc7037e..b18c3beff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_mo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_mo.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_mo.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -205,6 +205,7 @@ make_sasl_name(OM_uint32 *minor, const gss_OID mech, char sasl_name[16])
     EVP_DigestUpdate(ctx, hdr, 2);
     EVP_DigestUpdate(ctx, mech->elements, mech->length);
     EVP_DigestFinal_ex(ctx, hash, NULL);
+    EVP_MD_CTX_destroy(ctx);
 
     memcpy(p, "GS2-", 4);
     p += 4;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_names.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_names.c
index 519f9fbcc..e3cfde792 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_names.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_names.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_names.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_names.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid.c
index 0a295afe9..9a79dc420 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_oid.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /* Generated file */
 #include "mech_locl.h"
@@ -106,10 +106,10 @@ gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_mech_name_oid_desc = { 6, rk_UNCONST
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_mech_description_oid_desc = { 6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x66") };
 
 /* GSS_C_CRED_PASSWORD - 1.2.752.43.13.200 */
-gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_password_oid_desc = { 7, "\x2a\x85\x70\x2b\x0d\x81\x48" };
+gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_password_oid_desc = { 7, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x81\x48") };
 
 /* GSS_C_CRED_CERTIFICATE - 1.2.752.43.13.201 */
-gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_certificate_oid_desc = { 7, "\x2a\x85\x70\x2b\x0d\x81\x49" };
+gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_certificate_oid_desc = { 7, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x81\x49") };
 
 /* GSS_SASL_DIGEST_MD5_MECHANISM - 1.2.752.43.14.1 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_sasl_digest_md5_mechanism_oid_desc = { 6, rk_UNCONST("\x2a\x85\x70\x2b\x0e\x01") };
@@ -141,8 +141,8 @@ gss_OID_desc GSSAPI_LIB_VARIABLE __gss_ntlm_mechanism_oid_desc = { 10, rk_UNCONS
 /* GSS_SPNEGO_MECHANISM - 1.3.6.1.5.5.2 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_spnego_mechanism_oid_desc = { 6, rk_UNCONST("\x2b\x06\x01\x05\x05\x02") };
 
-/* GSS_C_PEER_HAS_UPDATED_SPNEGO - 1.3.6.1.4.1.9513.19.5 */
-gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_peer_has_updated_spnego_oid_desc = { 9, rk_UNCONST("\x2b\x06\x01\x04\x01\xca\x29\x13\x05") };
+/* GSS_C_PEER_HAS_UPDATED_SPNEGO - 1.3.6.1.4.1.5322.19.5 */
+gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_peer_has_updated_spnego_oid_desc = { 9, rk_UNCONST("\x2b\x06\x01\x04\x01\xa9\x4a\x13\x05") };
 
 /* GSS_C_MA_MECH_CONCRETE - 1.3.6.1.5.5.13.1 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_mech_concrete_oid_desc = { 7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0d\x01") };
@@ -226,43 +226,43 @@ gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_compress_oid_desc = { 7, rk_UNCONST(
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_ctx_trans_oid_desc = { 7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0d\x1b") };
 
 struct _gss_oid_name_table _gss_ont_ma[] = {
-  { GSS_C_MA_COMPRESS, "GSS_C_MA_COMPRESS", "compress", "" },
+  { GSS_C_MA_AUTH_INIT, "GSS_C_MA_AUTH_INIT", "auth-init-princ", "" },
+  { GSS_C_MA_AUTH_INIT_ANON, "GSS_C_MA_AUTH_INIT_ANON", "auth-init-princ-anon", "" },
+  { GSS_C_MA_AUTH_INIT_INIT, "GSS_C_MA_AUTH_INIT_INIT", "auth-init-princ-initial", "" },
+  { GSS_C_MA_AUTH_TARG, "GSS_C_MA_AUTH_TARG", "auth-targ-princ", "" },
+  { GSS_C_MA_AUTH_TARG_ANON, "GSS_C_MA_AUTH_TARG_ANON", "auth-targ-princ-anon", "" },
   { GSS_C_MA_AUTH_TARG_INIT, "GSS_C_MA_AUTH_TARG_INIT", "auth-targ-princ-initial", "" },
   { GSS_C_MA_CBINDINGS, "GSS_C_MA_CBINDINGS", "channel-bindings", "" },
-  { GSS_C_MA_WRAP, "GSS_C_MA_WRAP", "wrap", "" },
-  { GSS_C_MA_ITOK_FRAMED, "GSS_C_MA_ITOK_FRAMED", "initial-is-framed", "" },
-  { GSS_C_MA_MECH_NEGO, "GSS_C_MA_MECH_NEGO", "mech-negotiation-mech", "" },
-  { GSS_C_MA_MECH_COMPOSITE, "GSS_C_MA_MECH_COMPOSITE", "composite-mech", "" },
-  { GSS_C_MA_REPLAY_DET, "GSS_C_MA_REPLAY_DET", "replay-detection", "" },
-  { GSS_C_MA_AUTH_INIT_ANON, "GSS_C_MA_AUTH_INIT_ANON", "auth-init-princ-anon", "" },
-  { GSS_C_MA_PROT_READY, "GSS_C_MA_PROT_READY", "prot-ready", "" },
-  { GSS_C_MA_AUTH_INIT, "GSS_C_MA_AUTH_INIT", "auth-init-princ", "" },
-  { GSS_C_MA_PFS, "GSS_C_MA_PFS", "pfs", "" },
+  { GSS_C_MA_COMPRESS, "GSS_C_MA_COMPRESS", "compress", "" },
   { GSS_C_MA_CONF_PROT, "GSS_C_MA_CONF_PROT", "conf-prot", "" },
-  { GSS_C_MA_MECH_PSEUDO, "GSS_C_MA_MECH_PSEUDO", "pseudo-mech", "" },
-  { GSS_C_MA_AUTH_TARG, "GSS_C_MA_AUTH_TARG", "auth-targ-princ", "" },
-  { GSS_C_MA_MECH_NAME, "GSS_C_MA_MECH_NAME", "GSS mech name", "The name of the GSS-API mechanism" },
-  { GSS_C_MA_NOT_MECH, "GSS_C_MA_NOT_MECH", "not-mech", "" },
-  { GSS_C_MA_MIC, "GSS_C_MA_MIC", "mic", "" },
-  { GSS_C_MA_DEPRECATED, "GSS_C_MA_DEPRECATED", "mech-deprecated", "" },
-  { GSS_C_MA_MECH_GLUE, "GSS_C_MA_MECH_GLUE", "mech-glue", "" },
-  { GSS_C_MA_DELEG_CRED, "GSS_C_MA_DELEG_CRED", "deleg-cred", "" },
-  { GSS_C_MA_NOT_DFLT_MECH, "GSS_C_MA_NOT_DFLT_MECH", "mech-not-default", "" },
-  { GSS_C_MA_AUTH_TARG_ANON, "GSS_C_MA_AUTH_TARG_ANON", "auth-targ-princ-anon", "" },
-  { GSS_C_MA_INTEG_PROT, "GSS_C_MA_INTEG_PROT", "integ-prot", "" },
   { GSS_C_MA_CTX_TRANS, "GSS_C_MA_CTX_TRANS", "context-transfer", "" },
-  { GSS_C_MA_MECH_DESCRIPTION, "GSS_C_MA_MECH_DESCRIPTION", "Mech description", "The long description of the mechanism" },
-  { GSS_C_MA_OOS_DET, "GSS_C_MA_OOS_DET", "oos-detection", "" },
-  { GSS_C_MA_AUTH_INIT_INIT, "GSS_C_MA_AUTH_INIT_INIT", "auth-init-princ-initial", "" },
+  { GSS_C_MA_DELEG_CRED, "GSS_C_MA_DELEG_CRED", "deleg-cred", "" },
+  { GSS_C_MA_DEPRECATED, "GSS_C_MA_DEPRECATED", "mech-deprecated", "" },
+  { GSS_C_MA_INTEG_PROT, "GSS_C_MA_INTEG_PROT", "integ-prot", "" },
+  { GSS_C_MA_ITOK_FRAMED, "GSS_C_MA_ITOK_FRAMED", "initial-is-framed", "" },
+  { GSS_C_MA_MECH_COMPOSITE, "GSS_C_MA_MECH_COMPOSITE", "composite-mech", "" },
   { GSS_C_MA_MECH_CONCRETE, "GSS_C_MA_MECH_CONCRETE", "concrete-mech", "Indicates that a mech is neither a pseudo-mechanism nor a composite mechanism" },
+  { GSS_C_MA_MECH_DESCRIPTION, "GSS_C_MA_MECH_DESCRIPTION", "Mech description", "The long description of the mechanism" },
+  { GSS_C_MA_MECH_GLUE, "GSS_C_MA_MECH_GLUE", "mech-glue", "" },
+  { GSS_C_MA_MECH_NAME, "GSS_C_MA_MECH_NAME", "GSS mech name", "The name of the GSS-API mechanism" },
+  { GSS_C_MA_MECH_NEGO, "GSS_C_MA_MECH_NEGO", "mech-negotiation-mech", "" },
+  { GSS_C_MA_MECH_PSEUDO, "GSS_C_MA_MECH_PSEUDO", "pseudo-mech", "" },
+  { GSS_C_MA_MIC, "GSS_C_MA_MIC", "mic", "" },
+  { GSS_C_MA_NOT_DFLT_MECH, "GSS_C_MA_NOT_DFLT_MECH", "mech-not-default", "" },
+  { GSS_C_MA_NOT_MECH, "GSS_C_MA_NOT_MECH", "not-mech", "" },
+  { GSS_C_MA_OOS_DET, "GSS_C_MA_OOS_DET", "oos-detection", "" },
+  { GSS_C_MA_PFS, "GSS_C_MA_PFS", "pfs", "" },
+  { GSS_C_MA_PROT_READY, "GSS_C_MA_PROT_READY", "prot-ready", "" },
+  { GSS_C_MA_REPLAY_DET, "GSS_C_MA_REPLAY_DET", "replay-detection", "" },
   { GSS_C_MA_SASL_MECH_NAME, "GSS_C_MA_SASL_MECH_NAME", "SASL mechanism name", "The name of the SASL mechanism" },
-  { NULL }
+  { GSS_C_MA_WRAP, "GSS_C_MA_WRAP", "wrap", "" },
+  { NULL, NULL, NULL, NULL }
 };
 
 struct _gss_oid_name_table _gss_ont_mech[] = {
   { GSS_KRB5_MECHANISM, "GSS_KRB5_MECHANISM", "Kerberos 5", "Heimdal Kerberos 5 mechanism" },
-  { GSS_SPNEGO_MECHANISM, "GSS_SPNEGO_MECHANISM", "SPNEGO", "Heimdal SPNEGO mechanism" },
   { GSS_NTLM_MECHANISM, "GSS_NTLM_MECHANISM", "NTLM", "Heimdal NTLM mechanism" },
-  { NULL }
+  { GSS_SPNEGO_MECHANISM, "GSS_SPNEGO_MECHANISM", "SPNEGO", "Heimdal SPNEGO mechanism" },
+  { NULL, NULL, NULL, NULL }
 };
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_equal.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_equal.c
index 40fd1827c..6fc57e337 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_equal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_equal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_oid_equal.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_oid_equal.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_to_str.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_to_str.c
index 851c84943..95a113c9d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_to_str.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_oid_to_str.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_oid_to_str.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_oid_to_str.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pname_to_uid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pname_to_uid.c
index 187447a8c..4ecd307cc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pname_to_uid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pname_to_uid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_pname_to_uid.c,v 1.1.1.1 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_pname_to_uid.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 2011, PADL Software Pty Ltd.
@@ -35,21 +35,21 @@
 #include "mech_locl.h"
 
 static OM_uint32
-mech_pname_to_uid(OM_uint32 *minor_status,
-                  struct _gss_mechanism_name *mn,
-                  uid_t *uidp)
+mech_localname(OM_uint32 *minor_status,
+               struct _gss_mechanism_name *mn,
+               gss_buffer_t localname)
 {
     OM_uint32 major_status = GSS_S_UNAVAILABLE;
 
     *minor_status = 0;
 
-    if (mn->gmn_mech->gm_pname_to_uid == NULL)
+    if (mn->gmn_mech->gm_localname == NULL)
         return GSS_S_UNAVAILABLE;
 
-    major_status = mn->gmn_mech->gm_pname_to_uid(minor_status,
-                                                 mn->gmn_name,
-                                                 mn->gmn_mech_oid,
-                                                 uidp);
+    major_status = mn->gmn_mech->gm_localname(minor_status,
+                                              mn->gmn_name,
+                                              mn->gmn_mech_oid,
+                                              localname);
     if (GSS_ERROR(major_status))
         _gss_mg_error(mn->gmn_mech, major_status, *minor_status);
 
@@ -57,86 +57,55 @@ mech_pname_to_uid(OM_uint32 *minor_status,
 }
 
 static OM_uint32
-attr_pname_to_uid(OM_uint32 *minor_status,
-                  struct _gss_mechanism_name *mn,
-                  uid_t *uidp)
+attr_localname(OM_uint32 *minor_status,
+               struct _gss_mechanism_name *mn,
+               gss_buffer_t localname)
 {
-#ifdef NO_LOCALNAME
-    return GSS_S_UNAVAILABLE;
-#else
     OM_uint32 major_status = GSS_S_UNAVAILABLE;
     OM_uint32 tmpMinor;
+    gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
+    int authenticated = 0, complete = 0;
     int more = -1;
 
     *minor_status = 0;
 
+    localname->length = 0;
+    localname->value = NULL;
+
     if (mn->gmn_mech->gm_get_name_attribute == NULL)
         return GSS_S_UNAVAILABLE;
 
-    while (more != 0) {
-        gss_buffer_desc value;
-        gss_buffer_desc display_value;
-        int authenticated = 0, complete = 0;
-#ifdef POSIX_GETPWNAM_R
-        char pwbuf[2048];
-        struct passwd pw, *pwd;
-#else
-        struct passwd *pwd;
-#endif
-        char *localname;
-
-        major_status = mn->gmn_mech->gm_get_name_attribute(minor_status,
-                                                           mn->gmn_name,
-                                                           GSS_C_ATTR_LOCAL_LOGIN_USER,
-                                                           &authenticated,
-                                                           &complete,
-                                                           &value,
-                                                           &display_value,
-                                                           &more);
-        if (GSS_ERROR(major_status)) {
-            _gss_mg_error(mn->gmn_mech, major_status, *minor_status);
-            break;
-        }
-
-        localname = malloc(value.length + 1);
-        if (localname == NULL) {
-            major_status = GSS_S_FAILURE;
-            *minor_status = ENOMEM;
-            break;
-        }
-
-        memcpy(localname, value.value, value.length);
-        localname[value.length] = '\0';
-
-#ifdef POSIX_GETPWNAM_R
-        if (getpwnam_r(localname, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0)
-            pwd = NULL;
-#else
-        pwd = getpwnam(localname);
-#endif
-
-        free(localname);
-        gss_release_buffer(&tmpMinor, &value);
-        gss_release_buffer(&tmpMinor, &display_value);
-
-        if (pwd != NULL) {
-            *uidp = pwd->pw_uid;
-            major_status = GSS_S_COMPLETE;
-            *minor_status = 0;
-            break;
-        } else
-            major_status = GSS_S_UNAVAILABLE;
+    major_status = mn->gmn_mech->gm_get_name_attribute(minor_status,
+                                                       mn->gmn_name,
+                                                       GSS_C_ATTR_LOCAL_LOGIN_USER,
+                                                       &authenticated,
+                                                       &complete,
+                                                       &value,
+                                                       &display_value,
+                                                       &more);
+    if (GSS_ERROR(major_status)) {
+        _gss_mg_error(mn->gmn_mech, major_status, *minor_status);
+        return major_status;
     }
 
+    if (authenticated) {
+        *localname = value;
+    } else {
+        major_status = GSS_S_UNAVAILABLE;
+        gss_release_buffer(&tmpMinor, &value);
+    }
+
+    gss_release_buffer(&tmpMinor, &display_value);
+
     return major_status;
-#endif /* NO_LOCALNAME */
 }
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_pname_to_uid(OM_uint32 *minor_status,
-                 const gss_name_t pname,
-                 const gss_OID mech_type,
-                 uid_t *uidp)
+gss_localname(OM_uint32 *minor_status,
+              gss_const_name_t pname,
+              const gss_OID mech_type,
+              gss_buffer_t localname)
 {
     OM_uint32 major_status = GSS_S_UNAVAILABLE;
     struct _gss_name *name = (struct _gss_name *) pname;
@@ -149,14 +118,14 @@ gss_pname_to_uid(OM_uint32 *minor_status,
         if (GSS_ERROR(major_status))
             return major_status;
 
-        major_status = mech_pname_to_uid(minor_status, mn, uidp);
+        major_status = mech_localname(minor_status, mn, localname);
         if (major_status != GSS_S_COMPLETE)
-            major_status = attr_pname_to_uid(minor_status, mn, uidp);
+            major_status = attr_localname(minor_status, mn, localname);
     } else {
         HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
-            major_status = mech_pname_to_uid(minor_status, mn, uidp);
+            major_status = mech_localname(minor_status, mn, localname);
             if (major_status != GSS_S_COMPLETE)
-                major_status = attr_pname_to_uid(minor_status, mn, uidp);
+                major_status = attr_localname(minor_status, mn, localname);
             if (major_status != GSS_S_UNAVAILABLE)
                 break;
         }
@@ -167,3 +136,52 @@ gss_pname_to_uid(OM_uint32 *minor_status,
 
     return major_status;
 }
+
+
+GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
+gss_pname_to_uid(OM_uint32 *minor_status,
+                 gss_const_name_t pname,
+                 const gss_OID mech_type,
+                 uid_t *uidp)
+{
+#ifdef NO_LOCALNAME
+    return GSS_S_UNAVAILABLE;
+#else
+    OM_uint32 major, tmpMinor;
+    gss_buffer_desc localname = GSS_C_EMPTY_BUFFER;
+    char *szLocalname;
+    char pwbuf[2048];
+    struct passwd pw, *pwd;
+
+    major = gss_localname(minor_status, pname, mech_type, &localname);
+    if (GSS_ERROR(major))
+        return major;
+
+    szLocalname = malloc(localname.length + 1);
+    if (szLocalname == NULL) {
+        gss_release_buffer(&tmpMinor, &localname);
+        *minor_status = ENOMEM;
+        return GSS_S_FAILURE;
+    }
+
+    memcpy(szLocalname, localname.value, localname.length);
+    szLocalname[localname.length] = '\0';
+
+    if (rk_getpwnam_r(szLocalname, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0)
+        pwd = NULL;
+
+    gss_release_buffer(&tmpMinor, &localname);
+    free(szLocalname);
+
+    *minor_status = 0;
+
+    if (pwd != NULL) {
+        *uidp = pwd->pw_uid;
+        major = GSS_S_COMPLETE;
+    } else {
+        major = GSS_S_UNAVAILABLE;
+    }
+
+    return major;
+#endif
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_process_context_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_process_context_token.c
index 3efab32df..fc31557ec 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_process_context_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_process_context_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_process_context_token.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_process_context_token.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_process_context_token(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     const gss_buffer_t token_buffer)
 {
 	struct _gss_context *ctx = (struct _gss_context *) context_handle;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pseudo_random.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pseudo_random.c
index 9d8cb4954..d761915f6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pseudo_random.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_pseudo_random.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_pseudo_random.c,v 1.1.1.2 2011/04/14 14:08:28 elric Exp $	*/
+/*	$NetBSD: gss_pseudo_random.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_buffer.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_buffer.c
index 4dcbc3b06..177688992 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_buffer.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_buffer.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_release_buffer.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_release_buffer.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_cred.c
index 744bc52ea..4e8505c50 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_release_cred.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_release_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_name.c
index 2f06f7678..2ba3491a9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_release_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_release_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid.c
index 0ae2980a6..23e0f68e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_release_oid.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_release_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid_set.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid_set.c
index 8f9a04d6e..0f9a49bbf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid_set.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_release_oid_set.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_release_oid_set.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_release_oid_set.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_seal.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_seal.c
index f7335fef9..c2b35f822 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_seal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_seal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_seal.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_seal.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_cred_option.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_cred_option.c
index 15a97f1d2..2dceab6f4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_cred_option.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_cred_option.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_set_cred_option.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_set_cred_option.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_name_attribute.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_name_attribute.c
index 9e56426ba..d888007b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_name_attribute.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_name_attribute.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_set_name_attribute.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_set_name_attribute.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_sec_context_option.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_sec_context_option.c
index 3fd42414a..6163672f6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_sec_context_option.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_set_sec_context_option.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_set_sec_context_option.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_set_sec_context_option.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_sign.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_sign.c
index 7d9d1a5b5..abbebd855 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_sign.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_sign.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_sign.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_sign.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_store_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_store_cred.c
index e5cb56e9f..730316930 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_store_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_store_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_store_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_store_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -47,7 +47,9 @@ gss_store_cred(OM_uint32         *minor_status,
 {
     struct _gss_cred *cred = (struct _gss_cred *) input_cred_handle;
     struct _gss_mechanism_cred *mc;
-    OM_uint32 maj, junk;
+    OM_uint32 maj = GSS_S_FAILURE;
+    OM_uint32 junk;
+    size_t successes = 0;
 
     if (minor_status == NULL)
 	return GSS_S_FAILURE;
@@ -71,26 +73,30 @@ gss_store_cred(OM_uint32         *minor_status,
 	if (m == NULL || m->gm_store_cred == NULL)
 	    continue;
 
-	if (desired_mech) {
-	    maj = gss_oid_equal(&m->gm_mech_oid, desired_mech);
-	    if (maj != 0)
-		continue;
-	}
+        if (desired_mech != GSS_C_NO_OID &&
+            !gss_oid_equal(&m->gm_mech_oid, desired_mech))
+            continue;
 
 	maj = (m->gm_store_cred)(minor_status, mc->gmc_cred,
 				 cred_usage, desired_mech, overwrite_cred,
 				 default_cred, NULL, cred_usage_stored);
-	if (maj != GSS_S_COMPLETE) {
-	    gss_release_oid_set(&junk, elements_stored);
-	    return maj;
-	}
-
-	if (elements_stored) {
-	    gss_add_oid_set_member(&junk,
-				   &m->gm_mech_oid,
-				   elements_stored);
-	}
+        if (maj == GSS_S_COMPLETE) {
+            if (elements_stored)
+                gss_add_oid_set_member(&junk, desired_mech, elements_stored);
+            successes++;
+        } else if (desired_mech != GSS_C_NO_OID) {
+            gss_release_oid_set(&junk, elements_stored);
+            return maj;
+        }
 
     }
+
+    if (successes == 0) {
+        if (maj != GSS_S_COMPLETE)
+            return maj; /* last failure */
+        return GSS_S_FAILURE;
+    }
+
+    *minor_status = 0;
     return GSS_S_COMPLETE;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_test_oid_set_member.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_test_oid_set_member.c
index 328bc2bba..12c7838b8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_test_oid_set_member.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_test_oid_set_member.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_test_oid_set_member.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_test_oid_set_member.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unseal.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unseal.c
index 088c346d2..aeadae494 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unseal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unseal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_unseal.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_unseal.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unwrap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unwrap.c
index ecc5bba15..cce56f801 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unwrap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_unwrap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_unwrap.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_unwrap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_unwrap(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     const gss_buffer_t input_message_buffer,
     gss_buffer_t output_message_buffer,
     int *conf_state,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_utils.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_utils.c
index 4638c0841..ab21c740e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_utils.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_utils.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_utils.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_utils.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify.c
index 166989022..87e491f06 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_verify.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_verify.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify_mic.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify_mic.c
index f9ea67dd2..c7e1d750c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify_mic.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_verify_mic.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_verify_mic.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_verify_mic.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_verify_mic(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     const gss_buffer_t message_buffer,
     const gss_buffer_t token_buffer,
     gss_qop_t *qop_state)
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap.c
index 42d2b49c4..a3e1ebf79 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_wrap.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: gss_wrap.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -47,7 +47,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_wrap(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     int conf_req_flag,
     gss_qop_t qop_req,
     const gss_buffer_t input_message_buffer,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap_size_limit.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap_size_limit.c
index 40c1cc197..d781bb960 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap_size_limit.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gss_wrap_size_limit.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gss_wrap_size_limit.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: gss_wrap_size_limit.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
@@ -32,7 +32,7 @@
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_wrap_size_limit(OM_uint32 *minor_status,
-    const gss_ctx_id_t context_handle,
+    gss_const_ctx_id_t context_handle,
     int conf_req_flag,
     gss_qop_t qop_req,
     OM_uint32 req_output_size,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gssapi.asn1 b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gssapi.asn1
index 48d7752f8..c39175f64 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gssapi.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/gssapi.asn1
@@ -9,4 +9,4 @@ GSSAPIContextToken ::= [APPLICATION 0] IMPLICIT SEQUENCE {
 	innerContextToken heim_any_set
 }
 
-END
\ No newline at end of file
+END
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech.5 b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech.5
index 0eebf1103..41ef90b40 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech.5
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD: mech.5,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: mech.5,v 1.5 2017/01/28 21:31:46 christos Exp $
 .\"
 .\" Copyright (c) 2005 Doug Rabson
 .\" All rights reserved.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_locl.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_locl.h
index c0ee0ed4c..2fc40760f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mech_locl.h,v 1.1.1.3 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: mech_locl.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_switch.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_switch.h
index 564838fff..9156ba9ed 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_switch.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mech_switch.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mech_switch.h,v 1.1.1.2 2011/04/14 14:08:28 elric Exp $	*/
+/*	$NetBSD: mech_switch.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mechqueue.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mechqueue.h
index e9bc50823..dd8311510 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mechqueue.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/mechqueue.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mechqueue.h,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: mechqueue.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*	NetBSD: queue.h,v 1.39 2004/04/18 14:25:34 lukem Exp	*/
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/name.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/name.h
index 54a557efb..86baabb73 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/name.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/name.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: name.h,v 1.1.1.2 2011/04/14 14:08:28 elric Exp $	*/
+/*	$NetBSD: name.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/utils.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/utils.h
index 2d7b87446..b69a0fd8b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/utils.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/mech/utils.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: utils.h,v 1.1.1.2 2011/04/14 14:08:28 elric Exp $	*/
+/*	$NetBSD: utils.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*-
  * Copyright (c) 2005 Doug Rabson
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/accept_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/accept_sec_context.c
index b21463377..b7577a6f1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/accept_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/accept_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: accept_sec_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: accept_sec_context.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -45,7 +45,7 @@ OM_uint32
 _netlogon_accept_sec_context
 (OM_uint32 * minor_status,
  gss_ctx_id_t * context_handle,
- const gss_cred_id_t acceptor_cred_handle,
+ gss_const_cred_id_t acceptor_cred_handle,
  const gss_buffer_t input_token_buffer,
  const gss_channel_bindings_t input_chan_bindings,
  gss_name_t * src_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/acquire_cred.c
index b425fc8b6..3169e42fa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acquire_cred.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: acquire_cred.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 
 OM_uint32
 _netlogon_acquire_cred(OM_uint32 * min_stat,
-                       const gss_name_t desired_name,
+                       gss_const_name_t desired_name,
                        OM_uint32 time_req,
                        const gss_OID_set desired_mechs,
                        gss_cred_usage_t cred_usage,
@@ -84,7 +84,7 @@ _netlogon_acquire_cred(OM_uint32 * min_stat,
 
 OM_uint32
 _netlogon_acquire_cred_ex(gss_status_id_t status,
-                          const gss_name_t desired_name,
+                          gss_const_name_t desired_name,
                           OM_uint32 flags,
                           OM_uint32 time_req,
                           gss_cred_usage_t cred_usage,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/add_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/add_cred.c
index 8920f6104..8eeed7a3e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/add_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/add_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add_cred.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: add_cred.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,8 +39,8 @@
 
 OM_uint32 _netlogon_add_cred (
      OM_uint32           *minor_status,
-     const gss_cred_id_t input_cred_handle,
-     const gss_name_t    desired_name,
+     gss_const_cred_id_t input_cred_handle,
+     gss_const_name_t    desired_name,
      const gss_OID       desired_mech,
      gss_cred_usage_t    cred_usage,
      OM_uint32           initiator_time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/canonicalize_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/canonicalize_name.c
index 2b0f7ba03..76dbbf24b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/canonicalize_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/canonicalize_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: canonicalize_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: canonicalize_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_canonicalize_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             const gss_OID mech_type,
             gss_name_t * output_name
            )
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/compare_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/compare_name.c
index 32d5c318c..dd65099ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/compare_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/compare_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compare_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: compare_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,8 +39,8 @@
 
 OM_uint32 _netlogon_compare_name
            (OM_uint32 * minor_status,
-            const gss_name_t name1,
-            const gss_name_t name2,
+            gss_const_name_t name1,
+            gss_const_name_t name2,
             int * name_equal
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/context_time.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/context_time.c
index 1c8b65680..68954b991 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/context_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/context_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context_time.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: context_time.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/crypto.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/crypto.c
index 0b28983ef..2feecc943 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/crypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/crypto.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: crypto.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/display_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/display_name.c
index 8e271ec05..3bc517b8a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/display_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/display_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: display_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: display_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_display_name
            (OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t output_name_buffer,
             gss_OID * output_name_type
            )
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/duplicate_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/duplicate_name.c
index 2f5675eeb..3a096ec04 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/duplicate_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/duplicate_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: duplicate_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: duplicate_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_duplicate_name (
             OM_uint32 * minor_status,
-            const gss_name_t src_name,
+            gss_const_name_t src_name,
             gss_name_t * dest_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/export_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/export_name.c
index 643426f74..2c083f77e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/export_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/export_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: export_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: export_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_export_name
            (OM_uint32  * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t exported_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/init_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/init_sec_context.c
index 8a08c9874..41f8a94da 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/init_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/init_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_sec_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: init_sec_context.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -203,9 +203,9 @@ _netlogon_alloc_context(OM_uint32 *minor_status,
 
 OM_uint32
 _netlogon_init_sec_context(OM_uint32 * minor_status,
-			   const gss_cred_id_t initiator_cred_handle,
+			   gss_const_cred_id_t initiator_cred_handle,
 			   gss_ctx_id_t * context_handle,
-			   const gss_name_t target_name,
+			   gss_const_name_t target_name,
 			   const gss_OID mech_type,
 			   OM_uint32 req_flags,
 			   OM_uint32 time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_context.c
index 4fa9b53c2..a4606ea08 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: inquire_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred.c
index 21f29b2f1..9c2dd620f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: inquire_cred.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_inquire_cred
            (OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             gss_name_t * name,
             OM_uint32 * lifetime,
             gss_cred_usage_t * cred_usage,
@@ -56,7 +56,7 @@ OM_uint32 _netlogon_inquire_cred
 
     if (name != NULL) {
         ret = _netlogon_duplicate_name(minor_status,
-                                       (const gss_name_t)cred->Name, name);
+                                       (gss_const_name_t)cred->Name, name);
         if (GSS_ERROR(ret))
             return ret;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred_by_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred_by_mech.c
index 8b224ebcc..0e6c113c8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred_by_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_cred_by_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred_by_mech.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: inquire_cred_by_mech.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_inquire_cred_by_mech (
             OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             const gss_OID mech_type,
             gss_name_t * name,
             OM_uint32 * initiator_lifetime,
@@ -52,7 +52,7 @@ OM_uint32 _netlogon_inquire_cred_by_mech (
 
     if (name != NULL) {
         ret = _netlogon_duplicate_name(minor_status,
-                                       (const gss_name_t)cred->Name, name);
+                                       (gss_const_name_t)cred->Name, name);
         if (GSS_ERROR(ret))
             return ret;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_mechs_for_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_mechs_for_name.c
index 69ee8f24e..677419582 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_mechs_for_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/inquire_mechs_for_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_mechs_for_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: inquire_mechs_for_name.c,v 1.3 2017/01/30 20:27:58 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 _netlogon_inquire_mechs_for_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_OID_set * mech_types
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/process_context_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/process_context_token.c
index ce215bc6c..972eef238 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/process_context_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/netlogon/process_context_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: process_context_token.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: process_context_token.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/accept_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/accept_sec_context.c
index bf8095cec..b14d20a39 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/accept_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/accept_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: accept_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: accept_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -70,7 +70,7 @@ OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_accept_sec_context
 (OM_uint32 * minor_status,
  gss_ctx_id_t * context_handle,
- const gss_cred_id_t acceptor_cred_handle,
+ gss_const_cred_id_t acceptor_cred_handle,
  const gss_buffer_t input_token_buffer,
  const gss_channel_bindings_t input_chan_bindings,
  gss_name_t * src_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/acquire_cred.c
index da987f831..405dc95e6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: acquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -35,18 +35,18 @@
 
 #include "ntlm.h"
 
-OM_uint32 GSSAPI_CALLCONV _gss_ntlm_acquire_cred
-           (OM_uint32 * min_stat,
-            const gss_name_t desired_name,
-            OM_uint32 time_req,
-            const gss_OID_set desired_mechs,
-            gss_cred_usage_t cred_usage,
-            gss_cred_id_t * output_cred_handle,
-            gss_OID_set * actual_mechs,
-            OM_uint32 * time_rec
-           )
+OM_uint32 GSSAPI_CALLCONV
+_gss_ntlm_acquire_cred(OM_uint32            *min_stat,
+                       gss_const_name_t     desired_name,
+                       OM_uint32            time_req,
+                       const gss_OID_set    desired_mechs,
+                       gss_cred_usage_t     cred_usage,
+                       gss_cred_id_t        *output_cred_handle,
+                       gss_OID_set          *actual_mechs,
+                       OM_uint32            *time_rec)
 {
     ntlm_name name = (ntlm_name) desired_name;
+    const char *domain = NULL;
     OM_uint32 maj_stat;
     ntlm_ctx ctx;
 
@@ -57,17 +57,14 @@ OM_uint32 GSSAPI_CALLCONV _gss_ntlm_acquire_cred
     if (time_rec)
 	*time_rec = GSS_C_INDEFINITE;
 
-    if (desired_name == NULL)
-	return GSS_S_NO_CRED;
-
     if (cred_usage == GSS_C_BOTH || cred_usage == GSS_C_ACCEPT) {
 
 	maj_stat = _gss_ntlm_allocate_ctx(min_stat, &ctx);
 	if (maj_stat != GSS_S_COMPLETE)
 	    return maj_stat;
 
-	maj_stat = (*ctx->server->nsi_probe)(min_stat, ctx->ictx,
-					     name->domain);
+        domain = name != NULL ? name->domain : NULL;
+	maj_stat = (*ctx->server->nsi_probe)(min_stat, ctx->ictx, domain);
 	{
 	    gss_ctx_id_t context = (gss_ctx_id_t)ctx;
 	    OM_uint32 junk;
@@ -81,7 +78,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_ntlm_acquire_cred
 
 	*min_stat = _gss_ntlm_get_user_cred(name, &cred);
 	if (*min_stat)
-	    return GSS_S_FAILURE;
+	    return GSS_S_NO_CRED;
 	cred->usage = cred_usage;
 
 	*output_cred_handle = (gss_cred_id_t)cred;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/add_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/add_cred.c
index bbaccfb3f..16cfebd48 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/add_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/add_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add_cred.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: add_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -37,8 +37,8 @@
 
 OM_uint32 GSSAPI_CALLCONV _gss_ntlm_add_cred (
      OM_uint32           *minor_status,
-     const gss_cred_id_t input_cred_handle,
-     const gss_name_t    desired_name,
+     gss_const_cred_id_t input_cred_handle,
+     gss_const_name_t    desired_name,
      const gss_OID       desired_mech,
      gss_cred_usage_t    cred_usage,
      OM_uint32           initiator_time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/canonicalize_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/canonicalize_name.c
index 18f2b2e56..fe40757fc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/canonicalize_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/canonicalize_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: canonicalize_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: canonicalize_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_canonicalize_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             const gss_OID mech_type,
             gss_name_t * output_name
            )
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/compare_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/compare_name.c
index 8dc81ff9d..c83b14089 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/compare_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/compare_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compare_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: compare_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
@@ -37,8 +37,8 @@
 
 OM_uint32 GSSAPI_CALLCONV _gss_ntlm_compare_name
            (OM_uint32 * minor_status,
-            const gss_name_t name1,
-            const gss_name_t name2,
+            gss_const_name_t name1,
+            gss_const_name_t name2,
             int * name_equal
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/context_time.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/context_time.c
index 76c5e73b5..052df937e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/context_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/context_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context_time.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: context_time.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gss_ntlm_context_time
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             OM_uint32 * time_rec
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/creds.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/creds.c
index 9ec2c4ffd..4aa3687c6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: creds.c,v 1.2 2014/05/12 15:27:36 christos Exp $	*/
+/*	$NetBSD: creds.c,v 1.3 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_cred
            (OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             gss_name_t * name,
             OM_uint32 * lifetime,
             gss_cred_usage_t * cred_usage,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/crypto.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/crypto.c
index 2cafceae1..f251d2dca 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/crypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/crypto.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: crypto.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: crypto.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -34,11 +34,17 @@
  */
 
 #include "ntlm.h"
-
-uint32_t
-_krb5_crc_update (const char *p, size_t len, uint32_t res);
-void
-_krb5_crc_init_table(void);
+struct hx509_certs_data;
+struct krb5_pk_identity;
+struct krb5_pk_cert;
+struct ContentInfo;
+struct AlgorithmIdentifier;
+struct _krb5_krb_auth_data;
+struct krb5_dh_moduli;
+struct _krb5_key_data;
+struct _krb5_encryption_type;
+struct _krb5_key_type;
+#include "krb5_locl.h"
 
 /*
  *
@@ -265,7 +271,7 @@ v2_unseal_message(gss_buffer_t in,
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_get_mic
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             gss_qop_t qop_req,
             const gss_buffer_t message_buffer,
             gss_buffer_t message_token
@@ -340,7 +346,7 @@ _gss_ntlm_get_mic
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_verify_mic
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t message_buffer,
             const gss_buffer_t token_buffer,
             gss_qop_t * qop_state
@@ -426,7 +432,7 @@ _gss_ntlm_verify_mic
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_wrap_size_limit (
             OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             int conf_req_flag,
             gss_qop_t qop_req,
             OM_uint32 req_output_size,
@@ -457,7 +463,7 @@ _gss_ntlm_wrap_size_limit (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_wrap
 (OM_uint32 * minor_status,
- const gss_ctx_id_t context_handle,
+ gss_const_ctx_id_t context_handle,
  int conf_req_flag,
  gss_qop_t qop_req,
  const gss_buffer_t input_message_buffer,
@@ -528,7 +534,7 @@ _gss_ntlm_wrap
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_unwrap
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t input_message_buffer,
             gss_buffer_t output_message_buffer,
             int * conf_state,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/delete_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/delete_sec_context.c
index 280985eab..8bcb362e8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/delete_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/delete_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: delete_sec_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: delete_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_name.c
index 6c9a68538..b30395a16 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: display_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: display_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_display_name
            (OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t output_name_buffer,
             gss_OID * output_name_type
            )
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_status.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_status.c
index 0bb9a7f08..5f59b753f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_status.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/display_status.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: display_status.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: display_status.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/duplicate_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/duplicate_name.c
index 0905c2134..7a76c52b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/duplicate_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/duplicate_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: duplicate_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: duplicate_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_duplicate_name (
             OM_uint32 * minor_status,
-            const gss_name_t src_name,
+            gss_const_name_t src_name,
             gss_name_t * dest_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_name.c
index 6532bade7..4bb60b1fb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: export_name.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: export_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1999, 2003 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_export_name
            (OM_uint32  * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t exported_name
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_sec_context.c
index 5a48761a3..5ce6a0fe4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/export_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: export_sec_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: export_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/external.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/external.c
index 7c7ee0e23..66c56ab44 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/external.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/external.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: external.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: external.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -122,6 +122,9 @@ static gssapi_mech_interface_desc ntlm_mech = {
     NULL,
     NULL,
     NULL,
+    NULL,
+    NULL,
+    NULL,
 };
 
 gssapi_mech_interface
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_name.c
index 95a76cd03..784e4691b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: import_name.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: import_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_sec_context.c
index c0d4b76e9..c626e6fad 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/import_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: import_sec_context.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: import_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/indicate_mechs.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/indicate_mechs.c
index 7b552c82e..b04971625 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/indicate_mechs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/indicate_mechs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: indicate_mechs.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: indicate_mechs.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/init_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/init_sec_context.c
index 24e7b4382..b3036998c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/init_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/init_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: init_sec_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -37,11 +37,13 @@
 
 static int
 from_file(const char *fn, const char *target_domain,
-	  char **username, struct ntlm_buf *key)
+          char **domainp, char **usernamep, struct ntlm_buf *key)
 {
     char *str, buf[1024];
     FILE *f;
 
+    *domainp = NULL;
+
     f = fopen(fn, "r");
     if (f == NULL)
 	return ENOENT;
@@ -54,14 +56,21 @@ from_file(const char *fn, const char *target_domain,
 	    continue;
 	str = NULL;
 	d = strtok_r(buf, ":", &str);
-	if (d && strcasecmp(target_domain, d) != 0)
+        free(*domainp);
+	*domainp = NULL;
+	if (d && target_domain != NULL && strcasecmp(target_domain, d) != 0)
 	    continue;
+        *domainp = strdup(d);
+        if (*domainp == NULL)
+            return ENOMEM;
 	u = strtok_r(NULL, ":", &str);
 	p = strtok_r(NULL, ":", &str);
 	if (u == NULL || p == NULL)
 	    continue;
 
-	*username = strdup(u);
+	*usernamep = strdup(u);
+        if (*usernamep == NULL)
+            return ENOMEM;
 
 	heim_ntlm_nt_key(p, key);
 
@@ -76,17 +85,22 @@ from_file(const char *fn, const char *target_domain,
 
 static int
 get_user_file(const ntlm_name target_name,
-	      char **username, struct ntlm_buf *key)
+	      char **domainp, char **usernamep, struct ntlm_buf *key)
 {
+    const char *domain;
     const char *fn;
 
+    *domainp = NULL;
+
     if (issuid())
 	return ENOENT;
 
+    domain = target_name != NULL ? target_name->domain : NULL;
+
     fn = getenv("NTLM_USER_FILE");
     if (fn == NULL)
 	return ENOENT;
-    if (from_file(fn, target_name->domain, username, key) == 0)
+    if (from_file(fn, domain, domainp, usernamep, key) == 0)
 	return 0;
 
     return ENOENT;
@@ -97,7 +111,7 @@ get_user_file(const ntlm_name target_name,
  */
 
 static int
-get_user_ccache(const ntlm_name name, char **username, struct ntlm_buf *key)
+get_user_ccache(const ntlm_name name, char **domainp, char **usernamep, struct ntlm_buf *key)
 {
     krb5_context context = NULL;
     krb5_principal client;
@@ -105,8 +119,10 @@ get_user_ccache(const ntlm_name name, char **username, struct ntlm_buf *key)
     krb5_error_code ret;
     char *confname;
     krb5_data data;
+    int aret;
 
-    *username = NULL;
+    *domainp = NULL;
+    *usernamep = NULL;
     krb5_data_zero(&data);
     key->length = 0;
     key->data = NULL;
@@ -125,22 +141,40 @@ get_user_ccache(const ntlm_name name, char **username, struct ntlm_buf *key)
 
     ret = krb5_unparse_name_flags(context, client,
 				  KRB5_PRINCIPAL_UNPARSE_NO_REALM,
-				  username);
+				  usernamep);
     krb5_free_principal(context, client);
     if (ret)
 	goto out;
 
-    asprintf(&confname, "ntlm-key-%s", name->domain);
-    if (confname == NULL) {
-	krb5_clear_error_message(context);
-	ret = ENOMEM;
+    if (name != NULL) {
+        *domainp = strdup(name->domain);
+    } else {
+        krb5_data data_domain;
+
+        krb5_data_zero(&data_domain);
+        ret = krb5_cc_get_config(context, id, NULL, "default-ntlm-domain",
+                                 &data_domain);
+        if (ret)
+            goto out;
+
+        *domainp = strndup(data_domain.data, data_domain.length);
+        krb5_data_free(&data_domain);
+    }
+
+    if (*domainp == NULL) {
+        ret = krb5_enomem(context);
 	goto out;
     }
 
-    ret = krb5_cc_get_config(context, id, NULL,
-			     confname, &data);
-    if (ret)
+    aret = asprintf(&confname, "ntlm-key-%s", *domainp);
+    if (aret == -1) {
+        ret = krb5_enomem(context);
 	goto out;
+    }
+
+    ret = krb5_cc_get_config(context, id, NULL, confname, &data);
+    if (ret)
+        goto out;
 
     key->data = malloc(data.length);
     if (key->data == NULL) {
@@ -171,15 +205,16 @@ _gss_ntlm_get_user_cred(const ntlm_name target_name,
     if (cred == NULL)
 	return ENOMEM;
 
-    ret = get_user_file(target_name, &cred->username, &cred->key);
+    ret = get_user_file(target_name,
+                        &cred->domain, &cred->username, &cred->key);
     if (ret)
-	ret = get_user_ccache(target_name, &cred->username, &cred->key);
+	ret = get_user_ccache(target_name,
+                              &cred->domain, &cred->username, &cred->key);
     if (ret) {
 	free(cred);
 	return ret;
     }
 
-    cred->domain = strdup(target_name->domain);
     *rcred = cred;
 
     return ret;
@@ -218,9 +253,9 @@ _gss_copy_cred(ntlm_cred from, ntlm_cred *to)
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_init_sec_context
            (OM_uint32 * minor_status,
-            const gss_cred_id_t initiator_cred_handle,
+            gss_const_cred_id_t initiator_cred_handle,
             gss_ctx_id_t * context_handle,
-            const gss_name_t target_name,
+            gss_const_name_t target_name,
             const gss_OID mech_type,
             OM_uint32 req_flags,
             OM_uint32 time_req,
@@ -474,7 +509,7 @@ _gss_ntlm_init_sec_context
 
 
 
-	ret = heim_ntlm_encode_type3(&type3, &data);
+	ret = heim_ntlm_encode_type3(&type3, &data, NULL);
 	free(type3.sessionkey.data);
 	if (type3.lm.data)
 	    free(type3.lm.data);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_context.c
index 5a95dbafd..9e49f5fea 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_context.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: inquire_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_context (
             OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             gss_name_t * src_name,
             gss_name_t * targ_name,
             OM_uint32 * lifetime_rec,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_cred_by_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_cred_by_mech.c
index af95545d1..fc3c6bb92 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_cred_by_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_cred_by_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_cred_by_mech.c,v 1.1.1.1 2011/04/13 18:14:47 elric Exp $	*/
+/*	$NetBSD: inquire_cred_by_mech.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_cred_by_mech (
             OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             const gss_OID mech_type,
             gss_name_t * name,
             OM_uint32 * initiator_lifetime,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_mechs_for_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_mechs_for_name.c
index 918ce9a5e..3a914e16e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_mechs_for_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_mechs_for_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_mechs_for_name.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: inquire_mechs_for_name.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_mechs_for_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_OID_set * mech_types
            )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_names_for_mech.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_names_for_mech.c
index 0eef44b6a..13dd1385f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_names_for_mech.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_names_for_mech.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_names_for_mech.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: inquire_names_for_mech.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_sec_context_by_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_sec_context_by_oid.c
index fa91f87b5..223367ca0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_sec_context_by_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/inquire_sec_context_by_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inquire_sec_context_by_oid.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: inquire_sec_context_by_oid.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_sec_context_by_oid(OM_uint32 *minor_status,
-				     const gss_ctx_id_t context_handle,
+				     gss_const_ctx_id_t context_handle,
 				     const gss_OID desired_object,
 				     gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/iter_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/iter_cred.c
index 53152c3fc..218148791 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/iter_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/iter_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: iter_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: iter_cred.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/kdc.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/kdc.c
index cb2de8b8f..c960b28b1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/kdc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/kdc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kdc.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: kdc.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -253,7 +253,7 @@ kdc_type2(OM_uint32 *minor_status,
     struct ntlmkrb5 *c = ctx;
     krb5_error_code ret;
     struct ntlm_type2 type2;
-    krb5_data challange;
+    krb5_data challenge;
     struct ntlm_buf data;
     krb5_data ti;
 
@@ -295,18 +295,18 @@ kdc_type2(OM_uint32 *minor_status,
     }
     *ret_flags = type2.flags;
 
-    ret = krb5_ntlm_init_get_challange(c->context, c->ntlm, &challange);
+    ret = krb5_ntlm_init_get_challenge(c->context, c->ntlm, &challenge);
     if (ret) {
 	*minor_status = ret;
 	return GSS_S_FAILURE;
     }
 
-    if (challange.length != sizeof(type2.challenge)) {
+    if (challenge.length != sizeof(type2.challenge)) {
 	*minor_status = EINVAL;
 	return GSS_S_FAILURE;
     }
-    memcpy(type2.challenge, challange.data, sizeof(type2.challenge));
-    krb5_data_free(&challange);
+    memcpy(type2.challenge, challenge.data, sizeof(type2.challenge));
+    krb5_data_free(&challenge);
 
     ret = krb5_ntlm_init_get_targetname(c->context, c->ntlm,
 					&type2.targetname);
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/ntlm.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/ntlm.h
index d71213698..0cbf6fba9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/ntlm.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/ntlm.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ntlm.h,v 1.1.1.2 2011/04/14 14:08:29 elric Exp $	*/
+/*	$NetBSD: ntlm.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/process_context_token.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/process_context_token.c
index bdba64fd6..47d89d1b2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/process_context_token.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/process_context_token.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: process_context_token.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: process_context_token.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 OM_uint32 GSSAPI_CALLCONV _gss_ntlm_process_context_token (
 	OM_uint32          *minor_status,
-	const gss_ctx_id_t context_handle,
+	gss_const_ctx_id_t context_handle,
 	const gss_buffer_t token_buffer
     )
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_cred.c
index d9306e089..aa791e218 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: release_cred.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: release_cred.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_name.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_name.c
index 21281da23..476e19a1e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/ntlm/release_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: release_name.c,v 1.1.1.1 2011/04/13 18:14:48 elric Exp $	*/
+/*	$NetBSD: release_name.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/oid.txt b/crypto/external/bsd/heimdal/dist/lib/gssapi/oid.txt
index 9dd0addda..cd6c2fa04 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/oid.txt
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/oid.txt
@@ -67,7 +67,7 @@ oid	base	GSS_SPNEGO_MECHANISM			1.3.6.1.5.5.2
 
 # /* From Luke Howard */
 
-oid	base	GSS_C_PEER_HAS_UPDATED_SPNEGO		1.3.6.1.4.1.9513.19.5
+oid	base	GSS_C_PEER_HAS_UPDATED_SPNEGO		1.3.6.1.4.1.5322.19.5
 
 #/*
 # * OID mappings with name and short description and and slightly longer description
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/accept_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/accept_sec_context.c
index cc298f6c5..2a1a35a0c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/accept_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/accept_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: accept_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: accept_sec_context.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -472,7 +472,7 @@ static OM_uint32 GSSAPI_CALLCONV
 acceptor_start
 	   (OM_uint32 * minor_status,
 	    gss_ctx_id_t * context_handle,
-	    const gss_cred_id_t acceptor_cred_handle,
+	    gss_const_cred_id_t acceptor_cred_handle,
 	    const gss_buffer_t input_token_buffer,
 	    const gss_channel_bindings_t input_chan_bindings,
 	    gss_name_t * src_name,
@@ -689,7 +689,7 @@ static OM_uint32 GSSAPI_CALLCONV
 acceptor_continue
 	   (OM_uint32 * minor_status,
 	    gss_ctx_id_t * context_handle,
-	    const gss_cred_id_t acceptor_cred_handle,
+	    gss_const_cred_id_t acceptor_cred_handle,
 	    const gss_buffer_t input_token_buffer,
 	    const gss_channel_bindings_t input_chan_bindings,
 	    gss_name_t * src_name,
@@ -876,7 +876,7 @@ OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_accept_sec_context
 	   (OM_uint32 * minor_status,
 	    gss_ctx_id_t * context_handle,
-	    const gss_cred_id_t acceptor_cred_handle,
+	    gss_const_cred_id_t acceptor_cred_handle,
 	    const gss_buffer_t input_token_buffer,
 	    const gss_channel_bindings_t input_chan_bindings,
 	    gss_name_t * src_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/compat.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/compat.c
index 36414ffa8..b76de4957 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/compat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/compat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: compat.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: compat.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -236,7 +236,7 @@ _gss_spnego_indicate_mechtypelist (OM_uint32 *minor_status,
 				   gss_name_t target_name,
 				   OM_uint32 (*func)(gss_name_t, gss_OID),
 				   int includeMSCompatOID,
-				   const gss_cred_id_t cred_handle,
+				   gss_const_cred_id_t cred_handle,
 				   MechTypeList *mechtypelist,
 				   gss_OID *preferred_mech)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/context_stubs.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/context_stubs.c
index aab8130d4..144111664 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/context_stubs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/context_stubs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context_stubs.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: context_stubs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -70,18 +70,18 @@ spnego_supported_mechs(OM_uint32 *minor_status, gss_OID_set *mechs)
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_process_context_token
            (OM_uint32 *minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t token_buffer
            )
 {
-    gss_ctx_id_t context ;
+    gss_ctx_id_t context;
     gssspnego_ctx ctx;
     OM_uint32 ret;
 
     if (context_handle == GSS_C_NO_CONTEXT)
 	return GSS_S_NO_CONTEXT;
 
-    context = context_handle;
+    context = (gss_ctx_id_t)context_handle;
     ctx = (gssspnego_ctx)context_handle;
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
@@ -123,7 +123,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_delete_sec_context
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_context_time
            (OM_uint32 *minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             OM_uint32 *time_rec
            )
 {
@@ -147,7 +147,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_context_time
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_get_mic
            (OM_uint32 *minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             gss_qop_t qop_req,
             const gss_buffer_t message_buffer,
             gss_buffer_t message_token
@@ -173,7 +173,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_get_mic
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_verify_mic
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t message_buffer,
             const gss_buffer_t token_buffer,
             gss_qop_t * qop_state
@@ -202,7 +202,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_verify_mic
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_wrap
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             int conf_req_flag,
             gss_qop_t qop_req,
             const gss_buffer_t input_message_buffer,
@@ -235,7 +235,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_wrap
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_unwrap
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_buffer_t input_message_buffer,
             gss_buffer_t output_message_buffer,
             int * conf_state,
@@ -266,8 +266,8 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_unwrap
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_compare_name
            (OM_uint32 *minor_status,
-            const gss_name_t name1,
-            const gss_name_t name2,
+            gss_const_name_t name1,
+            gss_const_name_t name2,
             int * name_equal
            )
 {
@@ -290,7 +290,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_compare_name
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_display_name
            (OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t output_name_buffer,
             gss_OID * output_name_type
            )
@@ -344,7 +344,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_import_name
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_export_name
            (OM_uint32  * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_buffer_t exported_name
            )
 {
@@ -384,7 +384,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_release_name
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_context (
             OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             gss_name_t * src_name,
             gss_name_t * targ_name,
             OM_uint32 * lifetime_rec,
@@ -451,7 +451,7 @@ enomem:
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_wrap_size_limit (
             OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             int conf_req_flag,
             gss_qop_t qop_req,
             OM_uint32 req_output_size,
@@ -533,6 +533,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_import_sec_context (
     gss_ctx_id_t context;
     gssspnego_ctx ctx;
 
+    *context_handle = GSS_C_NO_CONTEXT;
     ret = _gss_spnego_alloc_sec_context(minor_status, &context);
     if (ret != GSS_S_COMPLETE) {
 	return ret;
@@ -545,7 +546,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_import_sec_context (
 				 interprocess_token,
 				 &ctx->negotiated_ctx_id);
     if (ret != GSS_S_COMPLETE) {
-	_gss_spnego_internal_delete_sec_context(&minor, context_handle, GSS_C_NO_BUFFER);
+	_gss_spnego_internal_delete_sec_context(&minor, &context, GSS_C_NO_BUFFER);
 	return ret;
     }
 
@@ -604,7 +605,7 @@ out:
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_mechs_for_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             gss_OID_set * mech_types
            )
 {
@@ -625,7 +626,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_mechs_for_name (
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_canonicalize_name (
             OM_uint32 * minor_status,
-            const gss_name_t input_name,
+            gss_const_name_t input_name,
             const gss_OID mech_type,
             gss_name_t * output_name
            )
@@ -636,7 +637,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_canonicalize_name (
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_duplicate_name (
             OM_uint32 * minor_status,
-            const gss_name_t src_name,
+            gss_const_name_t src_name,
             gss_name_t * dest_name
            )
 {
@@ -709,7 +710,7 @@ _gss_spnego_wrap_iov_length(OM_uint32 * minor_status,
 #if 0
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_complete_auth_token
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
 	    gss_buffer_t input_message_buffer)
 {
     gssspnego_ctx ctx;
@@ -734,7 +735,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_complete_auth_token
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_sec_context_by_oid
            (OM_uint32 * minor_status,
-            const gss_ctx_id_t context_handle,
+            gss_const_ctx_id_t context_handle,
             const gss_OID desired_object,
             gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/cred_stubs.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/cred_stubs.c
index 4b405fb24..74dc68774 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/cred_stubs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/cred_stubs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cred_stubs.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: cred_stubs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -58,7 +58,7 @@ _gss_spnego_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
  */
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_acquire_cred
 (OM_uint32 *minor_status,
- const gss_name_t desired_name,
+ gss_const_name_t desired_name,
  OM_uint32 time_req,
  const gss_OID_set desired_mechs,
  gss_cred_usage_t cred_usage,
@@ -131,7 +131,7 @@ out:
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred
            (OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             gss_name_t * name,
             OM_uint32 * lifetime,
             gss_cred_usage_t * cred_usage,
@@ -173,7 +173,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred_by_mech (
             OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             const gss_OID mech_type,
             gss_name_t * name,
             OM_uint32 * initiator_lifetime,
@@ -218,7 +218,7 @@ OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred_by_mech (
 
 OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred_by_oid
            (OM_uint32 * minor_status,
-            const gss_cred_id_t cred_handle,
+            gss_const_cred_id_t cred_handle,
             const gss_OID desired_object,
             gss_buffer_set_t *data_set)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/external.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/external.c
index 3afda82ec..870facdf0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/external.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/external.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: external.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: external.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
@@ -68,11 +68,19 @@ static gss_mo_desc spnego_mo[] = {
     },
     {
 	GSS_C_MA_MECH_NEGO,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     },
     {
 	GSS_C_MA_MECH_PSEUDO,
-	GSS_MO_MA
+	GSS_MO_MA,
+	NULL,
+	NULL,
+	NULL,
+	NULL
     }
 };
 
@@ -136,6 +144,9 @@ static gssapi_mech_interface_desc spnego_mech = {
     NULL,
     NULL,
     NULL,
+    NULL,
+    NULL,
+    NULL,
 };
 
 gssapi_mech_interface
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/init_sec_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/init_sec_context.c
index 920d0d06b..bafa7f5df 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/init_sec_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/init_sec_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_sec_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: init_sec_context.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -179,9 +179,9 @@ spnego_reply_internal(OM_uint32 *minor_status,
 static OM_uint32
 spnego_initial
            (OM_uint32 * minor_status,
-	    gss_cred_id_t cred,
+	    gss_const_cred_id_t cred,
             gss_ctx_id_t * context_handle,
-            const gss_name_t target_name,
+            gss_const_name_t target_name,
             const gss_OID mech_type,
             OM_uint32 req_flags,
             OM_uint32 time_req,
@@ -376,9 +376,9 @@ spnego_initial
 static OM_uint32
 spnego_reply
            (OM_uint32 * minor_status,
-	    const gss_cred_id_t cred,
+	    gss_const_cred_id_t cred,
             gss_ctx_id_t * context_handle,
-            const gss_name_t target_name,
+            gss_const_name_t target_name,
             const gss_OID mech_type,
             OM_uint32 req_flags,
             OM_uint32 time_req,
@@ -616,9 +616,9 @@ spnego_reply
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_init_sec_context
            (OM_uint32 * minor_status,
-            const gss_cred_id_t initiator_cred_handle,
+            gss_const_cred_id_t initiator_cred_handle,
             gss_ctx_id_t * context_handle,
-            const gss_name_t target_name,
+            gss_const_name_t target_name,
             const gss_OID mech_type,
             OM_uint32 req_flags,
             OM_uint32 time_req,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/spnego_locl.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/spnego_locl.h
index 07e8e352d..1c16417c4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/spnego_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/spnego/spnego_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: spnego_locl.h,v 1.1.1.3 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: spnego_locl.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_acquire_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_acquire_cred.c
index 77003b916..5b34eafbd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_acquire_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_acquire_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_acquire_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_acquire_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_add_store_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_add_store_cred.c
new file mode 100644
index 000000000..e28a9dace
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_add_store_cred.c
@@ -0,0 +1,181 @@
+/*	$NetBSD: test_add_store_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015 Cryptonector LLC.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. The name Cryptonector LLC may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <krb5/roken.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <gssapi/gssapi.h>
+#include <err.h>
+#include <krb5/getarg.h>
+
+static void
+print_gss_err(OM_uint32 stat, int status_type, gss_OID mech)
+{
+    gss_buffer_desc str;
+    OM_uint32 maj;
+    OM_uint32 min;
+    OM_uint32 msg_ctx = 0;
+    int first = 1;
+
+    do {
+        maj = gss_display_status(&min, stat, status_type, mech, &msg_ctx,
+                                 &str);
+        if (maj != GSS_S_COMPLETE) {
+            fprintf(stderr, "Error displaying GSS %s error (%lu): %lu, %lu",
+                    status_type == GSS_C_GSS_CODE ? "major" : "minor",
+                    (unsigned long)stat, (unsigned long)maj,
+                    (unsigned long)min);
+            return;
+        }
+        if (first) {
+            fprintf(stderr, "GSS %s error: %.*s\n",
+                    status_type == GSS_C_GSS_CODE ? "major" : "minor",
+                    (int)str.length, (char *)str.value);
+            first = 0;
+        } else {
+            fprintf(stderr, "\t%.*s\n", (int)str.length, (char *)str.value);
+        }
+        gss_release_buffer(&min, &str);
+    } while (msg_ctx != 0);
+}
+
+static void
+print_gss_errs(OM_uint32 major, OM_uint32 minor, gss_OID mech)
+{
+    print_gss_err(major, GSS_C_GSS_CODE, GSS_C_NO_OID);
+    print_gss_err(major, GSS_C_MECH_CODE, mech);
+}
+
+static void
+gss_err(int exitval, OM_uint32 major, OM_uint32 minor, gss_OID mech,
+        const char *fmt, ...)
+{
+    va_list args;
+
+    va_start(args, fmt);
+    vwarnx(fmt, args);
+    va_end(args);
+    print_gss_errs(major, minor, mech);
+    exit(exitval);
+}
+
+static int version_flag = 0;
+static int help_flag    = 0;
+
+static struct getargs args[] = {
+    {"version", 0,      arg_flag,       &version_flag, "print version", NULL },
+    {"help",    0,      arg_flag,       &help_flag,  NULL, NULL }
+};
+
+static void
+usage(int ret)
+{
+    arg_printusage(args, sizeof(args)/sizeof(*args),
+                   NULL, "from_ccache to_ccache");
+    exit(ret);
+}
+
+int
+main(int argc, char **argv)
+{
+    OM_uint32 major, minor;
+    gss_cred_id_t from_cred = GSS_C_NO_CREDENTIAL;
+    gss_cred_id_t to_cred = GSS_C_NO_CREDENTIAL;
+    gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
+    char *from_env;
+    char *to_env;
+    int optidx = 0;
+
+    setprogname(argv[0]);
+    if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
+        usage(1);
+
+    if (help_flag)
+        usage (0);
+
+    if (version_flag){
+        print_version(NULL);
+        exit(0);
+    }
+
+    argc -= optidx;
+    argv += optidx;
+
+    if (argc < 2)
+        errx(1, "required arguments missing");
+    if (argc > 2)
+        errx(1, "too many arguments");
+
+    if (asprintf(&from_env, "KRB5CCNAME=%s", argv[0]) == -1 || from_env == NULL)
+        err(1, "out of memory");
+    if (asprintf(&to_env, "KRB5CCNAME=%s", argv[1]) == -1 || to_env == NULL)
+        err(1, "out of memory");
+
+    putenv(from_env);
+    major = gss_add_cred(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
+                         GSS_KRB5_MECHANISM, GSS_C_INITIATE, GSS_C_INDEFINITE,
+                         GSS_C_INDEFINITE, &from_cred, NULL, NULL, NULL);
+    if (major != GSS_S_COMPLETE)
+        gss_err(1, major, minor, GSS_KRB5_MECHANISM,
+                "failed to acquire creds from %s", argv[0]);
+
+    putenv(to_env);
+    major = gss_store_cred(&minor, from_cred, GSS_C_INITIATE,
+                           GSS_KRB5_MECHANISM, 1, 1, NULL, NULL);
+    if (major != GSS_S_COMPLETE)
+        gss_err(1, major, minor, GSS_KRB5_MECHANISM,
+                "failed to store creds into %s", argv[1]);
+
+    (void) gss_release_cred(&minor, &from_cred);
+    (void) gss_release_cred(&minor, &to_cred);
+
+    major = gss_add_cred(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
+                         GSS_KRB5_MECHANISM, GSS_C_INITIATE, GSS_C_INDEFINITE,
+                         GSS_C_INDEFINITE, &cred, NULL, NULL, NULL);
+    if (major != GSS_S_COMPLETE)
+        gss_err(1, major, minor, GSS_KRB5_MECHANISM,
+                "failed to acquire creds from %s", argv[1]);
+    (void) gss_release_cred(&minor, &cred);
+    putenv("KRB5CCNAME");
+    free(from_env);
+    free(to_env);
+
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.c
index bc0979ed8..48677f117 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_common.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_common.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 char *
 gssapi_err(OM_uint32 maj_stat, OM_uint32 min_stat, gss_OID mech)
 {
-	OM_uint32 disp_min_stat, disp_maj_stat;
+	OM_uint32 disp_min_stat;
 	gss_buffer_desc maj_error_message;
 	gss_buffer_desc min_error_message;
 	OM_uint32 msg_ctx = 0;
@@ -52,12 +52,10 @@ gssapi_err(OM_uint32 maj_stat, OM_uint32 min_stat, gss_OID mech)
 	min_error_message.length = 0;
 	min_error_message.value = NULL;
 
-	disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat,
-					   GSS_C_GSS_CODE,
-					   mech, &msg_ctx, &maj_error_message);
-	disp_maj_stat = gss_display_status(&disp_min_stat, min_stat,
-					   GSS_C_MECH_CODE,
-					   mech, &msg_ctx, &min_error_message);
+	(void) gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
+				  mech, &msg_ctx, &maj_error_message);
+	(void) gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
+				  mech, &msg_ctx, &min_error_message);
 	if (asprintf(&ret, "gss-code: %lu %.*s -- mech-code: %lu %.*s",
 		     (unsigned long)maj_stat,
 		     (int)maj_error_message.length,
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.h b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.h
index 2a7e45918..928dfd6ee 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.h
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_common.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_common.h,v 1.1.1.2 2011/04/14 14:08:24 elric Exp $	*/
+/*	$NetBSD: test_common.h,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_context.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_context.c
index 4ce067c65..ce96e1cd1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_context.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_context.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -44,6 +44,7 @@
 
 static char *type_string;
 static char *mech_string;
+static char *mechs_string;
 static char *ret_mech_string;
 static char *client_name;
 static char *client_password;
@@ -52,6 +53,7 @@ static int mutual_auth_flag = 0;
 static int dce_style_flag = 0;
 static int wrapunwrap_flag = 0;
 static int iov_flag = 0;
+static int aead_flag = 0;
 static int getverifymic_flag = 0;
 static int deleg_flag = 0;
 static int policy_deleg_flag = 0;
@@ -92,17 +94,49 @@ init_o2n(void)
 static gss_OID
 string_to_oid(const char *name)
 {
-    int i;
+    size_t i;
     for (i = 0; i < sizeof(o2n)/sizeof(o2n[0]); i++)
 	if (strcasecmp(name, o2n[i].name) == 0)
 	    return o2n[i].oid;
     errx(1, "name '%s' not unknown", name);
 }
 
+static void
+string_to_oids(gss_OID_set *oidsetp, gss_OID_set oidset,
+               gss_OID_desc *oidarray, size_t oidarray_len,
+               char *names)
+{
+    char *name;
+    char *s;
+
+    if (names[0] == '\0') {
+        *oidsetp = GSS_C_NO_OID_SET;
+        return;
+    }
+
+    oidset->elements = &oidarray[0];
+    if (strcasecmp(names, "all") == 0) {
+        if (sizeof(o2n)/sizeof(o2n[0]) > oidarray_len)
+            errx(1, "internal error: oidarray must be enlarged");
+        for (oidset->count = 0; oidset->count < oidarray_len; oidset->count++)
+            oidset->elements[oidset->count] = *o2n[oidset->count].oid;
+    } else {
+        for (oidset->count = 0, name = strtok_r(names, ", ", &s);
+             name != NULL;
+             oidset->count++, name = strtok_r(NULL, ", ", &s)) {
+            if (oidset->count >= oidarray_len)
+                errx(1, "too many mech names given");
+            oidset->elements[oidset->count] = *string_to_oid(name);
+        }
+        oidset->count = oidset->count;
+    }
+    *oidsetp = oidset;
+}
+
 static const char *
 oid_to_string(const gss_OID oid)
 {
-    int i;
+    size_t i;
     for (i = 0; i < sizeof(o2n)/sizeof(o2n[0]); i++)
 	if (gss_oid_equal(oid, o2n[i].oid))
 	    return o2n[i].name;
@@ -413,10 +447,65 @@ wrapunwrap_iov(gss_ctx_id_t cctx, gss_ctx_id_t sctx, int flags, gss_OID mechoid)
     if (conf_state2 != conf_state)
 	errx(1, "conf state wrong for iov: %x", flags);
 
+    gss_release_iov_buffer(&min_stat, iov, iov_len);
 
     free(token.data);
 }
 
+static void
+wrapunwrap_aead(gss_ctx_id_t cctx, gss_ctx_id_t sctx, int flags, gss_OID mechoid)
+{
+    gss_buffer_desc token, assoc, message = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc output;
+    OM_uint32 min_stat, maj_stat;
+    gss_qop_t qop_state;
+    int conf_state, conf_state2;
+    char assoc_data[9] = "ABCheader";
+    char token_data[16] = "0123456789abcdef";
+
+    if (flags & USE_SIGN_ONLY) {
+	assoc.value = assoc_data;
+	assoc.length = 9;
+    } else {
+	assoc.value = NULL;
+	assoc.length = 0;
+    }
+
+    token.value = token_data;
+    token.length = 16;
+
+    maj_stat = gss_wrap_aead(&min_stat, cctx, dce_style_flag || flags & USE_CONF,
+			     GSS_C_QOP_DEFAULT, &assoc, &token,
+			     &conf_state, &message);
+    if (maj_stat != GSS_S_COMPLETE)
+	errx(1, "gss_wrap_aead failed");
+
+    if ((flags & (USE_SIGN_ONLY|FORCE_IOV)) == 0) {
+	maj_stat = gss_unwrap(&min_stat, sctx, &message,
+			      &output, &conf_state2, &qop_state);
+
+	if (maj_stat != GSS_S_COMPLETE)
+	    errx(1, "gss_unwrap from gss_wrap_aead failed: %s",
+		 gssapi_err(maj_stat, min_stat, mechoid));
+    } else {
+	maj_stat = gss_unwrap_aead(&min_stat, sctx, &message, &assoc,
+				   &output, &conf_state2, &qop_state);
+	if (maj_stat != GSS_S_COMPLETE)
+	    errx(1, "gss_unwrap_aead failed: %x %s", flags,
+		 gssapi_err(maj_stat, min_stat, mechoid));
+    }
+
+    if (output.length != token.length)
+	errx(1, "plaintext length wrong for aead");
+    else if (memcmp(output.value, token.value, token.length) != 0)
+	errx(1, "plaintext wrong for aead");
+    if (conf_state2 != conf_state)
+	errx(1, "conf state wrong for aead: %x", flags);
+
+    gss_release_buffer(&min_stat, &message);
+    gss_release_buffer(&min_stat, &output);
+}
+
 static void
 getverifymic(gss_ctx_id_t cctx, gss_ctx_id_t sctx, gss_OID mechoid)
 {
@@ -463,7 +552,8 @@ empty_release(void)
 
 static struct getargs args[] = {
     {"name-type",0,	arg_string, &type_string,  "type of name", NULL },
-    {"mech-type",0,	arg_string, &mech_string,  "type of mech", NULL },
+    {"mech-type",0,	arg_string, &mech_string,  "mech type (name)", NULL },
+    {"mech-types",0,	arg_string, &mechs_string, "mech types (names)", NULL },
     {"ret-mech-type",0,	arg_string, &ret_mech_string,
      "type of return mech", NULL },
     {"dns-canonicalize",0,arg_negative_flag, &dns_canon_flag,
@@ -475,6 +565,7 @@ static struct getargs args[] = {
     {"dce-style",0,	arg_flag,	&dce_style_flag, "dce-style", NULL },
     {"wrapunwrap",0,	arg_flag,	&wrapunwrap_flag, "wrap/unwrap", NULL },
     {"iov", 0, 		arg_flag,	&iov_flag, "wrap/unwrap iov", NULL },
+    {"aead", 0, 	arg_flag,	&aead_flag, "wrap/unwrap aead", NULL },
     {"getverifymic",0,	arg_flag,	&getverifymic_flag,
      "get and verify mic", NULL },
     {"delegate",0,	arg_flag,	&deleg_flag, "delegate credential", NULL },
@@ -503,7 +594,7 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     OM_uint32 min_stat, maj_stat;
     gss_ctx_id_t cctx, sctx;
     void *ctx;
@@ -511,6 +602,9 @@ main(int argc, char **argv)
     gss_cred_id_t client_cred = GSS_C_NO_CREDENTIAL, deleg_cred = GSS_C_NO_CREDENTIAL;
     gss_name_t cname = GSS_C_NO_NAME;
     gss_buffer_desc credential_data = GSS_C_EMPTY_BUFFER;
+    gss_OID_desc oids[4];
+    gss_OID_set_desc mechoid_descs;
+    gss_OID_set mechoids = GSS_C_NO_OID_SET;
 
     setprogname(argv[0]);
 
@@ -521,7 +615,7 @@ main(int argc, char **argv)
 
     cctx = sctx = GSS_C_NO_CONTEXT;
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
@@ -532,8 +626,8 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 1)
 	usage(1);
@@ -548,13 +642,44 @@ main(int argc, char **argv)
     else if (strcmp(type_string, "krb5-principal-name") == 0)
 	nameoid = GSS_KRB5_NT_PRINCIPAL_NAME;
     else
-	errx(1, "%s not suppported", type_string);
+	errx(1, "%s not supported", type_string);
 
     if (mech_string == NULL)
 	mechoid = GSS_KRB5_MECHANISM;
     else
 	mechoid = string_to_oid(mech_string);
 
+    if (mechs_string == NULL) {
+        /*
+         * We ought to be able to use the OID set of the one mechanism
+         * OID given.  But there's some breakage that conspires to make
+         * that fail though it should succeed:
+         *
+         *  - the NTLM gss_acquire_cred() refuses to work with
+         *    desired_name == GSS_C_NO_NAME
+         *  - gss_acquire_cred() with desired_mechs == GSS_C_NO_OID_SET
+         *    does work here because we happen to have Kerberos
+         *    credentials in check-ntlm, and the subsequent
+         *    gss_init_sec_context() call finds no cred element for NTLM
+         *    but plows on anyways, surprisingly enough, and then the
+         *    NTLM gss_init_sec_context() just works.
+         *
+         * In summary, there's some breakage in gss_init_sec_context()
+         * and some breakage in NTLM that conspires against us here.
+         *
+         * We work around this in check-ntlm and check-spnego by adding
+         * --client-name=user1@${R} to the invocations of this test
+         * program that require it.
+         */
+        oids[0] = *mechoid;
+        mechoid_descs.elements = &oids[0];
+        mechoid_descs.count = 1;
+        mechoids = &mechoid_descs;
+    } else {
+        string_to_oids(&mechoids, &mechoid_descs,
+                       oids, sizeof(oids)/sizeof(oids[0]), mechs_string);
+    }
+
     if (gsskrb5_acceptor_identity) {
 	maj_stat = gsskrb5_register_acceptor_identity(gsskrb5_acceptor_identity);
 	if (maj_stat)
@@ -584,19 +709,24 @@ main(int argc, char **argv)
 						  cname,
 						  &credential_data,
 						  GSS_C_INDEFINITE,
-						  GSS_C_NO_OID_SET,
+						  mechoids,
 						  GSS_C_INITIATE,
 						  &client_cred,
 						  NULL,
 						  NULL);
-	if (GSS_ERROR(maj_stat))
+	if (GSS_ERROR(maj_stat)) {
+            if (mechoids != GSS_C_NO_OID_SET && mechoids->count == 1)
+                mechoid = &mechoids->elements[0];
+            else
+                mechoid = GSS_C_NO_OID;
 	    errx(1, "gss_acquire_cred_with_password: %s",
-		 gssapi_err(maj_stat, min_stat, GSS_C_NO_OID));
+		 gssapi_err(maj_stat, min_stat, mechoid));
+        }
     } else {
 	maj_stat = gss_acquire_cred(&min_stat,
 				    cname,
 				    GSS_C_INDEFINITE,
-				    GSS_C_NO_OID_SET,
+				    mechoids,
 				    GSS_C_INITIATE,
 				    &client_cred,
 				    NULL,
@@ -646,7 +776,7 @@ main(int argc, char **argv)
 
     /* XXX should be actual_mech */
     if (gss_oid_equal(mechoid, GSS_KRB5_MECHANISM)) {
-	time_t time;
+	time_t sc_time;
 	gss_buffer_desc authz_data;
 	gss_buffer_desc in, out1, out2;
 	krb5_keyblock *keyblock, *keyblock2;
@@ -687,15 +817,15 @@ main(int argc, char **argv)
 
  	maj_stat = gsskrb5_extract_authtime_from_sec_context(&min_stat,
 							     sctx,
-							     &time);
+							     &sc_time);
 	if (maj_stat != GSS_S_COMPLETE)
 	    errx(1, "gsskrb5_extract_authtime_from_sec_context failed: %s",
 		     gssapi_err(maj_stat, min_stat, actual_mech));
 
-	if (time > now)
+	if (sc_time > now)
 	    errx(1, "gsskrb5_extract_authtime_from_sec_context failed: "
 		 "time authtime is before now: %ld %ld",
-		 (long)time, (long)now);
+		 (long)sc_time, (long)now);
 
  	maj_stat = gsskrb5_extract_service_keyblock(&min_stat,
 						    sctx,
@@ -882,6 +1012,29 @@ main(int argc, char **argv)
 	wrapunwrap_iov(cctx, sctx, USE_CONF|USE_HEADER_ONLY|FORCE_IOV, actual_mech);
     }
 
+    if (aead_flag) {
+	wrapunwrap_aead(cctx, sctx, 0, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_CONF, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, FORCE_IOV, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_CONF|FORCE_IOV, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, USE_SIGN_ONLY|FORCE_IOV, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_CONF|USE_SIGN_ONLY|FORCE_IOV, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, 0, actual_mech);
+	wrapunwrap_aead(cctx, sctx, FORCE_IOV, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, USE_CONF, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_CONF|FORCE_IOV, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, USE_SIGN_ONLY, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_SIGN_ONLY|FORCE_IOV, actual_mech);
+
+	wrapunwrap_aead(cctx, sctx, USE_CONF|USE_SIGN_ONLY, actual_mech);
+	wrapunwrap_aead(cctx, sctx, USE_CONF|USE_SIGN_ONLY|FORCE_IOV, actual_mech);
+    }
+
     if (getverifymic_flag) {
 	getverifymic(cctx, sctx, actual_mech);
 	getverifymic(cctx, sctx, actual_mech);
@@ -907,6 +1060,13 @@ main(int argc, char **argv)
 
 	gss_release_cred(&min_stat, &cred2);
 
+#if 0
+        /*
+         * XXX We can't do this.  Delegated credentials only work with
+         * the actual_mech.  We could gss_store_cred the delegated
+         * credentials *then* gss_add/acquire_cred() with SPNEGO, then
+         * we could try loop() with those credentials.
+         */
 	/* try again using SPNEGO */
 	if (verbose_flag)
 	    printf("checking spnego on delegated cred\n");
@@ -917,6 +1077,7 @@ main(int argc, char **argv)
 	gss_delete_sec_context(&min_stat, &sctx, NULL);
 
 	gss_release_cred(&min_stat, &cred2);
+#endif
 
 	/* check export/import */
 	if (ei_flag) {
@@ -945,6 +1106,8 @@ main(int argc, char **argv)
 	    gss_delete_sec_context(&min_stat, &cctx, NULL);
 	    gss_delete_sec_context(&min_stat, &sctx, NULL);
 
+#if 0
+            /* XXX See above */
 	    /* try again using SPNEGO */
 	    if (verbose_flag)
 		printf("checking SPNEGO on export/imported cred\n");
@@ -955,6 +1118,7 @@ main(int argc, char **argv)
 
 	    gss_delete_sec_context(&min_stat, &cctx, NULL);
 	    gss_delete_sec_context(&min_stat, &sctx, NULL);
+#endif
 
 	    gss_release_cred(&min_stat, &cred2);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_cred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_cred.c
index 1f694ce0f..05c34c7bb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_cred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_cred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
@@ -156,6 +156,8 @@ acquire_add_release_add(gss_name_t name, gss_cred_usage_t usage)
 			    NULL,
 			    NULL,
 			    NULL);
+    if (maj_stat != GSS_S_COMPLETE)
+	gss_err(1, min_stat, "add_cred 2 %d != GSS_S_COMPLETE", (int)maj_stat);
 
     maj_stat = gss_release_cred(&min_stat, &cred2);
     if (maj_stat != GSS_S_COMPLETE)
@@ -163,7 +165,7 @@ acquire_add_release_add(gss_name_t name, gss_cred_usage_t usage)
 
     maj_stat = gss_release_cred(&min_stat, &cred3);
     if (maj_stat != GSS_S_COMPLETE)
-	gss_err(1, min_stat, "release 2 %d != GSS_S_COMPLETE", (int)maj_stat);
+	gss_err(1, min_stat, "release 3 %d != GSS_S_COMPLETE", (int)maj_stat);
 }
 
 static int version_flag = 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_kcred.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_kcred.c
index 6d1c0a38d..b2c6f8f96 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_kcred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_kcred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_kcred.c,v 1.1.1.2 2014/04/24 12:45:29 pettai Exp $	*/
+/*	$NetBSD: test_kcred.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_names.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_names.c
index 3c8bbe125..d7a5015f6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_names.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_names.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_names.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: test_names.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_ntlm.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_ntlm.c
index dbb4c3588..a3b39ba34 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_ntlm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_ntlm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_ntlm.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: test_ntlm.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -133,7 +133,7 @@ test_libntlm_v1(int flags)
 	free(key.data);
     }
 
-    ret = heim_ntlm_encode_type3(&type3, &data);
+    ret = heim_ntlm_encode_type3(&type3, &data, NULL);
     if (ret)
 	errx(1, "heim_ntlm_encode_type3");
 
@@ -262,7 +262,7 @@ test_libntlm_v2(int flags)
 	}
     }
 
-    ret = heim_ntlm_encode_type3(&type3, &data);
+    ret = heim_ntlm_encode_type3(&type3, &data, NULL);
     if (ret)
 	errx(1, "heim_ntlm_encode_type3");
 
@@ -311,11 +311,11 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int ret = 0, optind = 0;
+    int ret = 0, optidx = 0;
 
     setprogname(argv[0]);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
@@ -326,8 +326,8 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     ret += test_libntlm_v1(0);
     ret += test_libntlm_v1(NTLM_NEG_KEYEX);
@@ -335,5 +335,5 @@ main(int argc, char **argv)
     ret += test_libntlm_v2(0);
     ret += test_libntlm_v2(NTLM_NEG_KEYEX);
 
-    return 0;
+    return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_oid.c b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_oid.c
index b10a1c3d0..b2c64f0a0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/test_oid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/test_oid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_oid.c,v 1.1.1.1 2011/04/13 18:14:44 elric Exp $	*/
+/*	$NetBSD: test_oid.c,v 1.2 2017/01/28 21:31:46 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/gssapi/version-script.map b/crypto/external/bsd/heimdal/dist/lib/gssapi/version-script.map
index ae929369d..62f9ec30d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/gssapi/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/gssapi/version-script.map
@@ -65,6 +65,7 @@ HEIMDAL_GSS_2.0 {
 		gss_krb5_get_tkt_flags;
 		gss_krb5_import_cred;
 		gss_krb5_set_allowable_enctypes;
+		gss_localname;
 		gss_mg_collect_error;
 		gss_oid_equal;
 		gss_oid_to_str;
@@ -87,11 +88,13 @@ HEIMDAL_GSS_2.0 {
 		gss_test_oid_set_member;
 		gss_unseal;
 		gss_unwrap;
+		gss_unwrap_aead;
 		gss_unwrap_iov;
 		gss_userok;
 		gss_verify;
 		gss_verify_mic;
 		gss_wrap;
+		gss_wrap_aead;
 		gss_wrap_iov;
 		gss_wrap_iov_length;
 		gss_wrap_size_limit;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/hcrypto/Makefile.am
index 5c2d52e9d..1479d5e0d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/Makefile.am
@@ -2,7 +2,14 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += -I$(srcdir)/libtommath -DUSE_HCRYPTO_LTM=1
+AUTOMAKE_OPTIONS = subdir-objects
+
+if HAVE_HCRYPTO_W_OPENSSL
+AM_CPPFLAGS += $(INCLUDE_openssl_crypto)
+endif
+
+AM_CPPFLAGS += -I$(top_srcdir)/lib/hx509 \
+	       -I$(srcdir)/libtommath -DUSE_HCRYPTO_LTM=1
 
 lib_LTLIBRARIES = libhcrypto.la
 check_LTLIBRARIES = libhctest.la
@@ -11,8 +18,13 @@ libhcrypto_la_LDFLAGS = -version-info 5:0:1
 libhcrypto_la_LIBADD = \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_dlopen) \
+	$(LIB_heimbase) \
 	$(LIBADD_roken)
 
+if HAVE_HCRYPTO_W_OPENSSL
+libhcrypto_la_LIBADD += $(LIB_openssl_crypto)
+endif
+
 hcryptoincludedir = $(includedir)/hcrypto
 buildhcryptoinclude = $(buildinclude)/hcrypto
 
@@ -29,6 +41,8 @@ hcryptoinclude_HEADERS =	\
 	evp.h			\
 	evp-hcrypto.h		\
 	evp-cc.h		\
+	evp-openssl.h		\
+	evp-pkcs11.h		\
 	hmac.h			\
 	md2.h			\
 	md4.h			\
@@ -39,7 +53,8 @@ hcryptoinclude_HEADERS =	\
 	rc4.h			\
 	rsa.h			\
 	sha.h			\
-	ui.h
+	ui.h			\
+	undef.h
 
 install-build-headers:: $(hcryptoinclude_HEADERS)
 	@foo='$(hcryptoinclude_HEADERS)'; \
@@ -60,6 +75,7 @@ PROGRAM_TESTS = \
 	rc2test  \
 	rctest \
 	test_bn \
+	test_bulk \
 	test_cipher \
 	test_engine_dso \
 	test_hmac \
@@ -85,7 +101,8 @@ check_SCRIPTS = $(SCRIPT_TESTS)
 
 TESTS = $(PROGRAM_TESTS) $(SCRIPT_TESTS)
 
-LDADD = $(lib_LTLIBRARIES) $(LIB_roken)
+LDADD = $(lib_LTLIBRARIES) $(LIB_roken) $(LIB_openssl_crypto)
+test_rand_LDADD = $(LDADD) -lm
 
 libhcrypto_la_SOURCES =	\
 	$(ltmsources)	\
@@ -112,6 +129,8 @@ libhcrypto_la_SOURCES =	\
 	evp.h		\
 	evp-hcrypto.c	\
 	evp-cc.c	\
+	evp-openssl.c	\
+	evp-pkcs11.c	\
 	engine.c	\
 	engine.h	\
 	hash.h		\
@@ -125,7 +144,6 @@ libhcrypto_la_SOURCES =	\
 	md5.h		\
 	pkcs5.c		\
 	pkcs12.c	\
-	rand-egd.c	\
 	rand-fortuna.c	\
 	rand-timer.c	\
 	rand-unix.c	\
@@ -149,7 +167,8 @@ libhcrypto_la_SOURCES =	\
 	sha512.c	\
 	validate.c	\
 	ui.c		\
-	ui.h
+	ui.h		\
+	undef.h
 
 ltmsources = \
 	libtommath/tommath.h \
@@ -240,7 +259,6 @@ ltmsources = \
 	libtommath/bn_mp_prime_is_prime.c \
 	libtommath/bn_mp_prime_next_prime.c \
 	libtommath/bn_mp_find_prime.c \
-	libtommath/bn_mp_isprime.c \
 	libtommath/bn_mp_dr_reduce.c \
 	libtommath/bn_mp_dr_is_modulus.c \
 	libtommath/bn_mp_dr_setup.c \
@@ -317,10 +335,15 @@ EXTRA_DIST = \
 	DESperate.txt \
 	passwd_dialog.rc \
 	libhcrypto-exports.def \
-	dllmain.c \
+	dh-tfm.c \
 	ec.h \
 	ecdh.h \
 	ecdsa.h \
+	evp-crypt.c \
+	evp-w32.c \
+	evp-w32.h \
+	evp-wincng.c \
+	evp-wincng.h \
 	gen-des.pl \
 	md5crypt_test.c \
 	passwd_dialog.aps \
@@ -329,7 +352,9 @@ EXTRA_DIST = \
 	passwd_dialog.res \
 	passwd_dlg.c \
 	passwd_dlg.h \
+	rand-w32.c \
 	resource.h \
+	rsa-tfm.c \
 	rsakey.der \
 	rsakey2048.der \
 	rsakey4096.der \
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/hcrypto/NTMakefile
index eced950c6..8063ca616 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2009, Secure Endpoints Inc.
+# Copyright (c) 2009-2016, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -33,10 +33,21 @@ SUBDIRS=libtommath
 
 RELDIR=lib\hcrypto
 
-intcflags=-DKRB5 -DASN1_LIB -I$(HCRYPTOINCLUDEDIR) -DUSE_HCRYPTO_LTM=1
-
 !include ../../windows/NTMakefile.w32
 
+HCRYPTOINCLUDEDIR = $(INCDIR)\hcrypto
+
+HEIMBASEDIR = $(SRC)\lib\base
+
+HX509DIR = $(SRC)\lib\hx509
+
+!ifdef INCLUDE_openssl_crypto
+openssl_inc=-I$(INCLUDE_openssl_crypto)
+!endif
+
+intcflags=-DKRB5 -DASN1_LIB -I$(HCRYPTOINCLUDEDIR) -DUSE_HCRYPTO_LTM=1 \
+	-I$(HX509DIR) $(openssl_inc)
+
 # Do dependencies first
 
 all:: subdirs
@@ -47,8 +58,6 @@ test:: test-subdirs
 
 # Include files
 
-HCRYPTOINCLUDEDIR=$(INCDIR)\hcrypto
-
 INCFILES=	\
 	$(HCRYPTOINCLUDEDIR)\aes.h	\
 	$(HCRYPTOINCLUDEDIR)\bn.h	\
@@ -62,6 +71,10 @@ INCFILES=	\
 	$(HCRYPTOINCLUDEDIR)\evp.h	\
 	$(HCRYPTOINCLUDEDIR)\evp-hcrypto.h	\
 	$(HCRYPTOINCLUDEDIR)\evp-cc.h	\
+	$(HCRYPTOINCLUDEDIR)\evp-openssl.h	\
+	$(HCRYPTOINCLUDEDIR)\evp-pkcs11.h	\
+	$(HCRYPTOINCLUDEDIR)\evp-wincng.h	\
+	$(HCRYPTOINCLUDEDIR)\evp-w32.h	\
 	$(HCRYPTOINCLUDEDIR)\hmac.h	\
 	$(HCRYPTOINCLUDEDIR)\md2.h	\
 	$(HCRYPTOINCLUDEDIR)\md4.h	\
@@ -73,7 +86,8 @@ INCFILES=	\
 	$(HCRYPTOINCLUDEDIR)\rc4.h	\
 	$(HCRYPTOINCLUDEDIR)\rsa.h	\
 	$(HCRYPTOINCLUDEDIR)\sha.h	\
-	$(HCRYPTOINCLUDEDIR)\ui.h
+	$(HCRYPTOINCLUDEDIR)\ui.h	\
+	$(HCRYPTOINCLUDEDIR)\undef.h
 
 mkincdir:
 !if !exist($(HCRYPTOINCLUDEDIR))
@@ -103,6 +117,10 @@ libhcrypto_OBJs = 			\
 	$(OBJ)\evp.obj			\
 	$(OBJ)\evp-hcrypto.obj		\
 	$(OBJ)\evp-cc.obj		\
+	$(OBJ)\evp-openssl.obj		\
+	$(OBJ)\evp-pkcs11.obj		\
+	$(OBJ)\evp-wincng.obj		\
+	$(OBJ)\evp-w32.obj		\
 	$(OBJ)\engine.obj		\
 	$(OBJ)\hmac.obj			\
 	$(OBJ)\md2.obj			\
@@ -150,6 +168,7 @@ test-binaries:				\
 	$(OBJ)\rc2test.exe		\
 	$(OBJ)\rctest.exe		\
 	$(OBJ)\test_bn.exe		\
+	$(OBJ)\test_bulk.exe		\
 	$(OBJ)\test_cipher.exe		\
 	$(OBJ)\test_engine_dso.exe	\
 	$(OBJ)\test_hmac.exe		\
@@ -160,59 +179,63 @@ test-binaries:				\
 	$(OBJ)\test_rand.exe		\
 	$(OBJ)\test_crypto.sh
 
-$(OBJ)\destest.exe: $(OBJ)\destest.obj $(TESTLIB) $(LIBROKEN)
+$(OBJ)\destest.exe: $(OBJ)\destest.obj $(TESTLIB) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\example_evp_cipher.exe: $(OBJ)\example_evp_cipher.obj $(TESTLIB) $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\example_evp_cipher.exe: $(OBJ)\example_evp_cipher.obj $(TESTLIB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\mdtest.exe: $(OBJ)\mdtest.obj $(LIBHEIMDAL) $(LIBROKEN) $(OBJ)\sha512.obj
+$(OBJ)\mdtest.exe: $(OBJ)\mdtest.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(OBJ)\sha512.obj
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\rc2test.exe: $(OBJ)\rc2test.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\rc2test.exe: $(OBJ)\rc2test.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\rctest.exe: $(OBJ)\rctest.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\rctest.exe: $(OBJ)\rctest.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_bn.exe: $(OBJ)\test_bn.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\test_bn.exe: $(OBJ)\test_bn.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_cipher.exe: $(OBJ)\test_cipher.obj $(TESTLIB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+$(OBJ)\test_bulk.exe: $(OBJ)\test_bulk.obj $(TESTLIB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_engine_dso.exe: $(OBJ)\test_engine_dso.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+$(OBJ)\test_cipher.exe: $(OBJ)\test_cipher.obj $(TESTLIB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_hmac.exe: $(OBJ)\test_hmac.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\test_engine_dso.exe: $(OBJ)\test_engine_dso.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_pkcs5.exe: $(OBJ)\test_pkcs5.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\test_hmac.exe: $(OBJ)\test_hmac.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_pkcs12.exe: $(OBJ)\test_pkcs12.obj $(LIBHEIMDAL) $(LIBROKEN)
+$(OBJ)\test_pkcs5.exe: $(OBJ)\test_pkcs5.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_rsa.exe: $(OBJ)\test_rsa.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+$(OBJ)\test_pkcs12.exe: $(OBJ)\test_pkcs12.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_dh.exe: $(OBJ)\test_dh.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+$(OBJ)\test_rsa.exe: $(OBJ)\test_rsa.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_rand.exe: $(OBJ)\test_rand.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+$(OBJ)\test_dh.exe: $(OBJ)\test_dh.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
+	$(EXECONLINK)
+	$(EXEPREP_NODIST)
+
+$(OBJ)\test_rand.exe: $(OBJ)\test_rand.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHEIMBASE) $(LIBVERS)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
@@ -224,20 +247,22 @@ $(OBJ)\test_crypto.sh: test_crypto.in NTMakefile
 test-run:
 	cd $(OBJ)
 !ifdef SH
-	$(SH) test_crypto.sh
+	-$(SH) test_crypto.sh
 !endif
-	destest.exe
-	mdtest.exe
-	rc2test.exe
-	rctest.exe
-	test_bn.exe
-	test_cipher.exe
-	test_engine_dso.exe
-	test_hmac.exe
-	test_pkcs5.exe
-	test_pkcs12.exe
-	test_rsa.exe
-	test_dh.exe
+	-destest.exe
+	-mdtest.exe
+	-rc2test.exe
+	-rctest.exe
+	-test_bn.exe
+	-test_bulk.exe --provider=hcrypto
+	-test_bulk.exe --provider=w32crypto
+	-test_cipher.exe
+	-test_engine_dso.exe
+	-test_hmac.exe
+	-test_pkcs5.exe
+	-test_pkcs12.exe
+	-test_rsa.exe
+	-test_dh.exe
 	cd $(SRCDIR)
 
 test:: $(TESTLIB) test-binaries test-run
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.c
index e686e248a..b0f04937a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: aes.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: aes.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -33,15 +33,13 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
-
+#include <config.h>
+#include <krb5/roken.h>
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
 
-#include <string.h>
-
 #include "rijndael-alg-fst.h"
 #include "aes.h"
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.h
index 98ca7ea84..68c6d4fab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/aes.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: aes.h,v 1.1.1.2 2011/04/14 14:08:30 elric Exp $	*/
+/*	$NetBSD: aes.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.c
index 6a472d2b9..d978c8e9c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: bn.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,15 +34,9 @@
  */
 
 #include <config.h>
-
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <limits.h>
+#include <krb5/roken.h>
 
 #include <krb5/krb5-types.h>
-#include <krb5/roken.h>
 #include <krb5/rfc2459_asn1.h> /* XXX */
 #include <krb5/der.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.h
index 9a58b0f40..2869a6fcf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/bn.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: bn.h,v 1.1.1.2 2011/04/14 14:08:30 elric Exp $	*/
+/*	$NetBSD: bn.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -70,6 +70,13 @@
 #define BN_CTX_start hc_BN_CTX_start
 #define BN_CTX_end hc_BN_CTX_end
 
+#define BIGNUM hc_BIGNUM
+#define BN_GENCB hc_BN_GENCB
+#define BN_CTX hc_BN_CTX
+#define BN_BLINDING hc_BN_BLINDING
+#define BN_MONT_CTX hc_BN_MONT_CTX
+
+
 /*
  *
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.c
index ba31b5df5..9aee8f161 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: camellia-ntt.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: camellia-ntt.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* camellia.c ver 1.2.0
  *
@@ -32,16 +32,12 @@
  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  */
 
-#include "config.h"
-
-#include <string.h>
-#include <stdlib.h>
+#include <config.h>
+#include <krb5/roken.h>
 
 #include <krb5/krb5-types.h>
 #include "camellia-ntt.h"
 
-#include <krb5/roken.h>
-
 /* key constants */
 
 #define CAMELLIA_SIGMA1L (0xA09E667FL)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.h
index 38a963699..224718962 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia-ntt.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: camellia-ntt.h,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: camellia-ntt.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* camellia.h ver 1.2.0
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.c
index cdfa7f8fb..3488a6fbb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: camellia.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: camellia.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -33,19 +33,16 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
 
-#include <string.h>
-
 #include "camellia-ntt.h"
 #include "camellia.h"
 
-#include <krb5/roken.h>
-
 int
 CAMELLIA_set_key(const unsigned char *userkey,
 		 const int bits, CAMELLIA_KEY *key)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.h
index 8354558e9..46c50b4c2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/camellia.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: camellia.h,v 1.1.1.2 2011/04/14 14:08:30 elric Exp $	*/
+/*	$NetBSD: camellia.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.c
index 2c5929d7b..4cb8fd250 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: common.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: common.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -36,11 +36,7 @@
  */
 
 #include <config.h>
-
-#include <errno.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 
 #include <krb5/krb5-types.h>
 #include <krb5/rfc2459_asn1.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.h
index 951d92c23..7bbd795ab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/common.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: common.h,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: common.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des-tables.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des-tables.h
index 30c08f3c6..21b862fad 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des-tables.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des-tables.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: des-tables.h,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: des-tables.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* GENERATE FILE from gen-des.pl, do not edit */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.c
index 7982d4d5e..523282526 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: des.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: des.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -85,17 +85,12 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <krb5/krb5-types.h>
 #include <assert.h>
 
-#include <krb5/roken.h>
-
 #include "des.h"
 #include "ui.h"
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.h
index a3e10815d..1df9ee511 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/des.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: des.h,v 1.1.1.3 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: des.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/destest.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/destest.c
index f40a54b01..7825ede00 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/destest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/destest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: destest.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: destest.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -33,15 +33,13 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
 
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-ltm.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-ltm.c
index e1d122890..79ee56b3a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-ltm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-ltm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dh-ltm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: dh-ltm.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -36,13 +36,10 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dh.h>
-
 #include <krb5/roken.h>
 
+#include <dh.h>
+
 #include "tommath.h"
 
 static void
@@ -110,8 +107,10 @@ ltm_dh_generate_key(DH *dh)
 		return 0;
 	    }
 	}
-	if (dh->pub_key)
+	if (dh->pub_key) {
 	    BN_free(dh->pub_key);
+	    dh->pub_key = NULL;
+	}
 
 	mp_init_multi(&pub, &priv_key, &g, &p, NULL);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-tfm.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-tfm.c
index 7fc4598d4..4ace6566b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-tfm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh-tfm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dh-tfm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: dh-tfm.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,13 +34,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dh.h>
-
 #include <krb5/roken.h>
 
+#include <dh.h>
+
 #ifdef USE_HCRYPTO_TFM
 
 #include "tfm.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.c
index fae211211..683eb58e6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dh.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: dh.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -36,16 +36,13 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+#include <krb5/roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <krb5/krb5-types.h>
 #include <krb5/rfc2459_asn1.h>
 
 #include <dh.h>
 
-#include <krb5/roken.h>
-
 /**
  * @page page_dh DH - Diffie-Hellman key exchange
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.h
index 794502c88..35de6c8a9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dh.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: dh.h,v 1.1.1.2 2011/04/14 14:08:31 elric Exp $	*/
+/*	$NetBSD: dh.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -41,6 +41,8 @@
 #define _HEIM_DH_H 1
 
 /* symbol renaming */
+#define DH hc_DH
+#define DH_METHOD hc_DH_METHOD
 #define DH_null_method hc_DH_null_method
 #define DH_tfm_method hc_DH_tfm_method
 #define DH_ltm_method hc_DH_ltm_method
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/doxygen.c
index b0b91d465..73e346c88 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.c
index 791a17a34..df7f4ede0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dsa.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: dsa.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,13 +34,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dsa.h>
-
 #include <krb5/roken.h>
 
+#include <dsa.h>
+
 /*
  *
  */
@@ -91,7 +88,16 @@ DSA_up_ref(DSA *dsa)
  */
 
 static const DSA_METHOD dsa_null_method = {
-    "hcrypto null DSA"
+    "hcrypto null DSA",
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    0,
+    NULL
 };
 
 const DSA_METHOD *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.h
index d293ec65c..51901b5e3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/dsa.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: dsa.h,v 1.1.1.2 2011/04/14 14:08:31 elric Exp $	*/
+/*	$NetBSD: dsa.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -43,6 +43,8 @@
 #include <hcrypto/bn.h>
 
 /* symbol renaming */
+#define DSA hc_DSA
+#define DSA_METHOD hc_DSA_METHOD
 #define DSA_null_method hc_DSA_null_method
 #define DSA_new hc_DSA_new
 #define DSA_free hc_DSA_free
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.c
index 5d2e6deab..6dc97ea60 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ec.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: ec.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.h
index 617c905fc..4ded0753d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ec.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: ec.h,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: ec.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2009 Kungliga Tekniska Högskolan
+ * Copyright (c) 2009-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -36,6 +36,10 @@
 #ifndef HEIM_EC_H
 #define HEIM_EC_H 1
 
+#define EC_KEY hc_EC_KEY
+#define EC_GROUP hc_EC_GROUP
+#define EC_GROUP_ID hc_EC_GROUP_ID
+#define EC_GROUP_ID_s hc_EC_GROUP_ID_s
 #define EC_GROUP_get_degree hc_EC_GROUP_get_degree
 #define EC_KEY_get0_group hc_EC_KEY_get0_group
 #define EC_GROUP_get_order hc_EC_GROUP_get_order
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdh.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdh.h
index d89d7f964..17aaf55dd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdh.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdh.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ecdh.h,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: ecdh.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdsa.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdsa.h
index 41fdd43ea..1a6fae112 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdsa.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ecdsa.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ecdsa.h,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: ecdsa.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.c
index 99b957357..2336cd7b1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: engine.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: engine.c,v 1.4 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,10 +34,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 
 #include <engine.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.h
index 9eba26a83..13e627b05 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/engine.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: engine.h,v 1.1.1.2 2011/04/14 14:08:31 elric Exp $	*/
+/*	$NetBSD: engine.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -64,6 +64,8 @@
 #define ENGINE_set_default_DH hc_ENGINE_set_default_DH
 #define ENGINE_set_default_RSA hc_ENGINE_set_default_RSA
 
+#define ENGINE hc_ENGINE
+
 /*
  *
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.c
index b1a4dd11a..cb2e56ff7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: evp-cc.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: evp-cc.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -39,12 +39,9 @@
 
 #ifdef __APPLE__
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #ifdef HAVE_COMMONCRYPTO_COMMONDIGEST_H
@@ -55,6 +52,7 @@
 #endif
 
 #include <evp.h>
+#include <evp-hcrypto.h>
 #include <evp-cc.h>
 
 /*
@@ -89,43 +87,6 @@ cc_do_cipher(EVP_CIPHER_CTX *ctx,
     return 1;
 }
 
-static int
-cc_do_cfb8_cipher(EVP_CIPHER_CTX *ctx,
-                  unsigned char *out,
-                  const unsigned char *in,
-                  unsigned int size)
-{
-    struct cc_key *cc = ctx->cipher_data;
-    CCCryptorStatus ret;
-    size_t moved;
-    unsigned int i;
-
-    for (i = 0; i < size; i++) {
-        unsigned char oiv[EVP_MAX_IV_LENGTH + 1];
-
-        assert(ctx->cipher->iv_len + 1 <= sizeof(oiv));
-        memcpy(oiv, ctx->iv, ctx->cipher->iv_len);
-
-        ret = CCCryptorUpdate(cc->href, ctx->iv, ctx->cipher->iv_len,
-                              ctx->iv, ctx->cipher->iv_len, &moved);
-        if (ret)
-            return 0;
-
-        if (moved != ctx->cipher->iv_len)
-            return 0;
-
-        if (!ctx->encrypt)
-            oiv[ctx->cipher->iv_len] = in[i];
-        out[i] = in[i] ^ ctx->iv[0];
-        if (ctx->encrypt)
-            oiv[ctx->cipher->iv_len] = out[i];
-
-        memcpy(ctx->iv, &oiv[1], ctx->cipher->iv_len);
-    }
-
-    return 1;
-}
-
 static int
 cc_cleanup(EVP_CIPHER_CTX *ctx)
 {
@@ -136,10 +97,13 @@ cc_cleanup(EVP_CIPHER_CTX *ctx)
 }
 
 static int
-init_cc_key(int encp, CCAlgorithm alg, CCOptions opts, const void *key,
-	    size_t keylen, const void *iv, CCCryptorRef *ref)
+init_cc_key(int encp, unsigned long flags,
+	    CCAlgorithm alg, const void *key, size_t keylen,
+	    const void *iv, CCCryptorRef *ref)
 {
     CCOperation op = encp ? kCCEncrypt : kCCDecrypt;
+    CCMode mode;
+    CCModeOptions options = 0;
     CCCryptorStatus ret;
 
     if (*ref) {
@@ -150,9 +114,26 @@ init_cc_key(int encp, CCAlgorithm alg, CCOptions opts, const void *key,
 	CCCryptorRelease(*ref);
     }
 
-    ret = CCCryptorCreate(op, alg, opts, key, keylen, iv, ref);
-    if (ret)
-	return 0;
+    if (key) {
+	switch (flags & EVP_CIPH_MODE) {
+	case EVP_CIPH_STREAM_CIPHER:
+	    mode = kCCModeRC4;
+	    break;
+	case EVP_CIPH_CFB8_MODE:
+	    mode = kCCModeCFB8;
+	    break;
+	default:
+	    mode = kCCModeCBC;
+	    break;
+	}
+
+	ret = CCCryptorCreateWithMode(op, mode, alg, ccNoPadding,
+				      iv, key, keylen, NULL, 0, 0,
+				      options, ref);
+	if (ret)
+	    return 0;
+    }
+
     return 1;
 }
 
@@ -163,13 +144,14 @@ cc_des_ede3_cbc_init(EVP_CIPHER_CTX *ctx,
 		     int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    return init_cc_key(encp, kCCAlgorithm3DES, 0, key, kCCKeySize3DES, iv, &cc->href);
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithm3DES,
+		       key, kCCKeySize3DES, iv, &cc->href);
 }
 
 #endif /* HAVE_COMMONCRYPTO_COMMONCRYPTOR_H */
 
 /**
- * The tripple DES cipher type (Apple CommonCrypto provider)
+ * The triple DES cipher type (Apple CommonCrypto provider)
  *
  * @return the DES-EDE3-CBC EVP_CIPHER pointer.
  *
@@ -196,6 +178,8 @@ EVP_cc_des_ede3_cbc(void)
 	NULL
     };
     return &des_ede3_cbc;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_des_ede3_cbc();
 #else
     return NULL;
 #endif
@@ -213,7 +197,8 @@ cc_des_cbc_init(EVP_CIPHER_CTX *ctx,
 		int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    return init_cc_key(encp, kCCAlgorithmDES, 0, key, kCCBlockSizeDES, iv, &cc->href);
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithmDES,
+		       key, kCCBlockSizeDES, iv, &cc->href);
 }
 #endif
 
@@ -245,6 +230,8 @@ EVP_cc_des_cbc(void)
 	NULL
     };
     return &des_ede3_cbc;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_des_cbc();
 #else
     return NULL;
 #endif
@@ -262,7 +249,8 @@ cc_aes_cbc_init(EVP_CIPHER_CTX *ctx,
 		int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    return init_cc_key(encp, kCCAlgorithmAES128, 0, key, ctx->cipher->key_len, iv, &cc->href);
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithmAES128,
+		       key, ctx->cipher->key_len, iv, &cc->href);
 }
 #endif
 
@@ -294,6 +282,8 @@ EVP_cc_aes_128_cbc(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_128_cbc();
 #else
     return NULL;
 #endif
@@ -327,6 +317,8 @@ EVP_cc_aes_192_cbc(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_192_cbc();
 #else
     return NULL;
 #endif
@@ -360,6 +352,8 @@ EVP_cc_aes_256_cbc(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_256_cbc();
 #else
     return NULL;
 #endif
@@ -377,8 +371,7 @@ cc_aes_cfb8_init(EVP_CIPHER_CTX *ctx,
 		int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    memcpy(ctx->iv, iv, ctx->cipher->iv_len);
-    return init_cc_key(1, kCCAlgorithmAES128, kCCOptionECBMode,
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithmAES128,
 		       key, ctx->cipher->key_len, NULL, &cc->href);
 }
 #endif
@@ -402,7 +395,7 @@ EVP_cc_aes_128_cfb8(void)
 	kCCBlockSizeAES128,
 	EVP_CIPH_CFB8_MODE|EVP_CIPH_ALWAYS_CALL_INIT,
 	cc_aes_cfb8_init,
-	cc_do_cfb8_cipher,
+	cc_do_cipher,
 	cc_cleanup,
 	sizeof(struct cc_key),
 	NULL,
@@ -411,6 +404,8 @@ EVP_cc_aes_128_cfb8(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_128_cfb8();
 #else
     return NULL;
 #endif
@@ -435,7 +430,7 @@ EVP_cc_aes_192_cfb8(void)
 	kCCBlockSizeAES128,
 	EVP_CIPH_CFB8_MODE|EVP_CIPH_ALWAYS_CALL_INIT,
 	cc_aes_cfb8_init,
-	cc_do_cfb8_cipher,
+	cc_do_cipher,
 	cc_cleanup,
 	sizeof(struct cc_key),
 	NULL,
@@ -444,6 +439,8 @@ EVP_cc_aes_192_cfb8(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_192_cfb8();
 #else
     return NULL;
 #endif
@@ -468,7 +465,7 @@ EVP_cc_aes_256_cfb8(void)
 	kCCBlockSizeAES128,
 	EVP_CIPH_CFB8_MODE|EVP_CIPH_ALWAYS_CALL_INIT,
 	cc_aes_cfb8_init,
-	cc_do_cfb8_cipher,
+	cc_do_cipher,
 	cc_cleanup,
 	sizeof(struct cc_key),
 	NULL,
@@ -477,6 +474,8 @@ EVP_cc_aes_256_cfb8(void)
 	NULL
     };
     return &c;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_aes_256_cfb8();
 #else
     return NULL;
 #endif
@@ -494,7 +493,8 @@ cc_rc2_cbc_init(EVP_CIPHER_CTX *ctx,
 		int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    return init_cc_key(encp, kCCAlgorithmRC2, 0, key, ctx->cipher->key_len, iv, &cc->href);
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithmRC2,
+		       key, ctx->cipher->key_len, iv, &cc->href);
 }
 #endif
 
@@ -527,6 +527,8 @@ EVP_cc_rc2_cbc(void)
 	NULL
     };
     return &rc2_cbc;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_rc2_cbc();
 #else
     return NULL;
 #endif
@@ -561,6 +563,8 @@ EVP_cc_rc2_40_cbc(void)
 	NULL
     };
     return &rc2_40_cbc;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_rc2_40_cbc();
 #else
     return NULL;
 #endif
@@ -596,6 +600,8 @@ EVP_cc_rc2_64_cbc(void)
 	NULL
     };
     return &rc2_64_cbc;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_rc2_64_cbc();
 #else
     return NULL;
 #endif
@@ -621,6 +627,8 @@ EVP_cc_md2(void)
 	(hc_evp_md_cleanup)NULL
     };
     return &md2;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_md2();
 #else
     return NULL;
 #endif
@@ -646,6 +654,8 @@ EVP_cc_md4(void)
 	(hc_evp_md_cleanup)NULL
     };
     return &md4;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_md4();
 #else
     return NULL;
 #endif
@@ -671,6 +681,8 @@ EVP_cc_md5(void)
 	(hc_evp_md_cleanup)NULL
     };
     return &md5;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_md5();
 #else
     return NULL;
 #endif
@@ -696,6 +708,8 @@ EVP_cc_sha1(void)
 	(hc_evp_md_cleanup)NULL
     };
     return &sha1;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_sha1();
 #else
     return NULL;
 #endif
@@ -721,6 +735,62 @@ EVP_cc_sha256(void)
 	(hc_evp_md_cleanup)NULL
     };
     return &sha256;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_sha256();
+#else
+    return NULL;
+#endif
+}
+
+/**
+ * The CommonCrypto sha384 provider
+ *
+ * @ingroup hcrypto_evp
+ */
+
+const EVP_MD *
+EVP_cc_sha384(void)
+{
+#ifdef HAVE_COMMONCRYPTO_COMMONDIGEST_H
+    static const struct hc_evp_md sha384 = {
+	CC_SHA384_DIGEST_LENGTH,
+	CC_SHA384_BLOCK_BYTES,
+	sizeof(CC_SHA512_CTX),
+	(hc_evp_md_init)CC_SHA384_Init,
+	(hc_evp_md_update)CC_SHA384_Update,
+	(hc_evp_md_final)CC_SHA384_Final,
+	(hc_evp_md_cleanup)NULL
+    };
+    return &sha384;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_sha384();
+#else
+    return NULL;
+#endif
+}
+
+/**
+ * The CommonCrypto sha512 provider
+ *
+ * @ingroup hcrypto_evp
+ */
+
+const EVP_MD *
+EVP_cc_sha512(void)
+{
+#ifdef HAVE_COMMONCRYPTO_COMMONDIGEST_H
+    static const struct hc_evp_md sha512 = {
+	CC_SHA512_DIGEST_LENGTH,
+	CC_SHA512_BLOCK_BYTES,
+	sizeof(CC_SHA512_CTX),
+	(hc_evp_md_init)CC_SHA512_Init,
+	(hc_evp_md_update)CC_SHA512_Update,
+	(hc_evp_md_final)CC_SHA512_Final,
+	(hc_evp_md_cleanup)NULL
+    };
+    return &sha512;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_sha512();
 #else
     return NULL;
 #endif
@@ -737,7 +807,11 @@ EVP_cc_sha256(void)
 const EVP_CIPHER *
 EVP_cc_camellia_128_cbc(void)
 {
+#if HCRYPTO_FALLBACK
+    return EVP_hcrypto_camellia_128_cbc();
+#else
     return NULL;
+#endif
 }
 
 /**
@@ -751,7 +825,11 @@ EVP_cc_camellia_128_cbc(void)
 const EVP_CIPHER *
 EVP_cc_camellia_192_cbc(void)
 {
+#if HCRYPTO_FALLBACK
+    return EVP_hcrypto_camellia_192_cbc();
+#else
     return NULL;
+#endif
 }
 
 /**
@@ -765,7 +843,11 @@ EVP_cc_camellia_192_cbc(void)
 const EVP_CIPHER *
 EVP_cc_camellia_256_cbc(void)
 {
+#if HCRYPTO_FALLBACK
+    return EVP_hcrypto_camellia_256_cbc();
+#else
     return NULL;
+#endif
 }
 
 #ifdef HAVE_COMMONCRYPTO_COMMONCRYPTOR_H
@@ -781,7 +863,8 @@ cc_rc4_init(EVP_CIPHER_CTX *ctx,
 	    int encp)
 {
     struct cc_key *cc = ctx->cipher_data;
-    return init_cc_key(encp, kCCAlgorithmRC4, 0, key, ctx->key_len, iv, &cc->href);
+    return init_cc_key(encp, ctx->cipher->flags, kCCAlgorithmRC4,
+		       key, ctx->key_len, iv, &cc->href);
 }
 
 #endif
@@ -815,6 +898,8 @@ EVP_cc_rc4(void)
 	NULL
     };
     return &rc4;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_rc4();
 #else
     return NULL;
 #endif
@@ -849,6 +934,8 @@ EVP_cc_rc4_40(void)
 	NULL
     };
     return &rc4_40;
+#elif HCRYPTO_FALLBACK
+    return EVP_hcrypto_rc4_40();
 #else
     return NULL;
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.h
index afea0b891..d62b2b1a9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-cc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: evp-cc.h,v 1.1.1.2 2011/04/14 14:08:31 elric Exp $	*/
+/*	$NetBSD: evp-cc.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -44,6 +44,8 @@
 #define EVP_cc_md5 hc_EVP_cc_md5
 #define EVP_cc_sha1 hc_EVP_cc_sha1
 #define EVP_cc_sha256 hc_EVP_cc_sha256
+#define EVP_cc_sha384 hc_EVP_cc_sha384
+#define EVP_cc_sha512 hc_EVP_cc_sha512
 #define EVP_cc_des_cbc hc_EVP_cc_des_cbc
 #define EVP_cc_des_ede3_cbc hc_EVP_cc_des_ede3_cbc
 #define EVP_cc_aes_128_cbc hc_EVP_cc_aes_128_cbc
@@ -72,6 +74,8 @@ const EVP_MD * EVP_cc_md4(void);
 const EVP_MD * EVP_cc_md5(void);
 const EVP_MD * EVP_cc_sha1(void);
 const EVP_MD * EVP_cc_sha256(void);
+const EVP_MD * EVP_cc_sha384(void);
+const EVP_MD * EVP_cc_sha512(void);
 
 const EVP_CIPHER * EVP_cc_rc2_cbc(void);
 const EVP_CIPHER * EVP_cc_rc2_40_cbc(void);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-crypt.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-crypt.c
index 3d30c4a3c..a45323cb1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-crypt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-crypt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: evp-crypt.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: evp-crypt.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -36,13 +36,10 @@
 /* Windows crypto provider plugin, sample */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
@@ -138,7 +135,7 @@ crypto_des_ede3_cbc_init(EVP_CIPHER_CTX *ctx,
 }
 
 /**
- * The tripple DES cipher type (Micrsoft crypt provider)
+ * The triple DES cipher type (Micrsoft crypt provider)
  *
  * @return the DES-EDE3-CBC EVP_CIPHER pointer.
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.c
index 5473d4ddf..004f812ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: evp-hcrypto.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: evp-hcrypto.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -34,13 +34,10 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
@@ -71,7 +68,7 @@ aes_init(EVP_CIPHER_CTX *ctx,
 	 int encp)
 {
     AES_KEY *k = ctx->cipher_data;
-    if (ctx->encrypt)
+    if (ctx->encrypt || EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB8_MODE)
 	AES_set_encrypt_key(key, ctx->cipher->key_len * 8, k);
     else
 	AES_set_decrypt_key(key, ctx->cipher->key_len * 8, k);
@@ -85,7 +82,7 @@ aes_do_cipher(EVP_CIPHER_CTX *ctx,
 	      unsigned int size)
 {
     AES_KEY *k = ctx->cipher_data;
-    if (ctx->flags & EVP_CIPH_CFB8_MODE)
+    if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB8_MODE)
         AES_cfb8_encrypt(in, out, size, k, ctx->iv, ctx->encrypt);
     else
         AES_cbc_encrypt(in, out, size, k, ctx->iv, ctx->encrypt);
@@ -533,7 +530,7 @@ des_ede3_cbc_do_cipher(EVP_CIPHER_CTX *ctx,
 }
 
 /**
- * The tripple DES cipher type - hcrypto
+ * The triple DES cipher type - hcrypto
  *
  * @return the DES-EDE3-CBC EVP_CIPHER pointer.
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.h
index e4f2400cc..5f744eabd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-hcrypto.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: evp-hcrypto.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: evp-hcrypto.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.c
new file mode 100644
index 000000000..179937af1
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.c
@@ -0,0 +1,646 @@
+/*	$NetBSD: evp-openssl.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2016, Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* OpenSSL provider */
+
+#include "config.h"
+#include <krb5/roken.h>
+#include <krb5/heimbase.h>
+
+#include <assert.h>
+#include <evp.h>
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+
+/*
+ * This is the OpenSSL 1.x backend for hcrypto.  It has been tested with
+ * OpenSSL 1.0.1f and OpenSSL 1.1.0-pre3-dev.
+ *
+ * NOTE: In order for this to work with OpenSSL 1.1.x and up, it is
+ *       critical to use opaque OpenSSL type accessors everywhere /
+ *       never use knowledge of opaque OpenSSL type internals.
+ */
+
+#include <evp-openssl.h>
+
+/*
+ * This being an OpenSSL backend for hcrypto... we need to be able to
+ * refer to types and objects (functions) from both, OpenSSL and
+ * hcrypto.
+ *
+ * The hcrypto API is *very* similar to the OpenSSL 1.0.x API, with the
+ * same type and symbol names in many cases, except that the hcrypto
+ * names are prefixed with hc_*.  hcrypto has convenience macros that
+ * provide OpenSSL aliases for the hcrypto interfaces, and hcrypto
+ * applications are expected to use the OpenSSL names.
+ *
+ * Since here we must be able to refer to types and objects from both
+ * OpenSSL and from hcrypto, we disable the hcrypto renaming for the
+ * rest of this file.  These #undefs could be collected into an
+ * <hcrypto/undef.h> for the purpose of permitting other applications to
+ * use both, hcrypto and OpenSSL in the same source files (provided that
+ * such applications refer to hcrypto types and objects by their proper
+ * hc_-prefixed names).
+ */
+#include <undef.h>
+
+/* Now it's safe to include OpenSSL headers */
+#include <openssl/evp.h>
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+#define EVP_MD_CTX_new EVP_MD_CTX_create
+#define EVP_MD_CTX_free EVP_MD_CTX_destroy
+#endif
+
+/* A HEIM_BASE_ONCE argument struct for per-EVP one-time initialization */
+struct once_init_cipher_ctx {
+    const hc_EVP_CIPHER **hc_memoizep;
+    hc_EVP_CIPHER *hc_memoize;
+    const hc_EVP_CIPHER *fallback;
+    unsigned long flags;
+    int nid;
+};
+
+/* Our wrapper for OpenSSL EVP_CIPHER_CTXs */
+struct ossl_cipher_ctx {
+    EVP_CIPHER_CTX      *ossl_cipher_ctx;   /* OpenSSL cipher ctx */
+    const EVP_CIPHER    *ossl_cipher;       /* OpenSSL cipher */
+    int                 initialized;
+};
+
+/*
+ * Our hc_EVP_CIPHER init() method; wraps around OpenSSL
+ * EVP_CipherInit_ex().
+ *
+ * This is very similar to the init() function pointer in an OpenSSL
+ * EVP_CIPHER, but a) we can't access them in 1.1, and b) the method
+ * invocation protocols in hcrypto and OpenSSL are similar but not the
+ * same, thus we must have this wrapper.
+ */
+static int
+cipher_ctx_init(hc_EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                const unsigned char *iv, int enc)
+{
+    struct ossl_cipher_ctx *ossl_ctx = ctx->cipher_data; /* EVP_CIPHER_CTX wrapper */
+    const EVP_CIPHER *c;
+
+    assert(ossl_ctx != NULL);
+    assert(ctx->cipher != NULL);
+    assert(ctx->cipher->app_data != NULL);
+
+    /*
+     * Here be dragons.
+     *
+     * We need to make sure that the OpenSSL EVP_CipherInit_ex() is
+     * called with cipher!=NULL just once per EVP_CIPHER_CTX, otherwise
+     * state in the OpenSSL EVP_CIPHER_CTX will get cleaned up and then
+     * we'll segfault.
+     *
+     * hcrypto applications can re-initialize an (hc_)EVP_CIPHER_CTX as
+     * usual by calling (hc)EVP_CipherInit_ex() with a non-NULL cipher
+     * argument, and that will cause cipher_cleanup() (below) to be
+     * called.
+     */
+    c = ossl_ctx->ossl_cipher = ctx->cipher->app_data; /* OpenSSL's EVP_CIPHER * */
+    if (!ossl_ctx->initialized) {
+        ossl_ctx->ossl_cipher_ctx = EVP_CIPHER_CTX_new();
+        if (ossl_ctx->ossl_cipher_ctx == NULL)
+            return 0;
+        /*
+         * So we always call EVP_CipherInit_ex() with c!=NULL, but other
+         * things NULL...
+         */
+        if (!EVP_CipherInit_ex(ossl_ctx->ossl_cipher_ctx, c, NULL, NULL, NULL, enc))
+            return 0;
+        ossl_ctx->initialized = 1;
+    }
+
+    /* ...and from here on always call EVP_CipherInit_ex() with c=NULL */
+    if ((ctx->cipher->flags & hc_EVP_CIPH_VARIABLE_LENGTH) &&
+        ctx->key_len > 0)
+        EVP_CIPHER_CTX_set_key_length(ossl_ctx->ossl_cipher_ctx, ctx->key_len);
+
+    return EVP_CipherInit_ex(ossl_ctx->ossl_cipher_ctx, NULL, NULL, key, iv, enc);
+}
+
+static int
+cipher_do_cipher(hc_EVP_CIPHER_CTX *ctx, unsigned char *out,
+                 const unsigned char *in, unsigned int len)
+{
+    struct ossl_cipher_ctx *ossl_ctx = ctx->cipher_data;
+
+    assert(ossl_ctx != NULL);
+    return EVP_Cipher(ossl_ctx->ossl_cipher_ctx, out, in, len);
+}
+
+static int
+cipher_cleanup(hc_EVP_CIPHER_CTX *ctx)
+{
+    struct ossl_cipher_ctx *ossl_ctx = ctx->cipher_data;
+
+    if (ossl_ctx == NULL || !ossl_ctx->initialized)
+        return 1;
+
+    if (ossl_ctx->ossl_cipher_ctx != NULL)
+        EVP_CIPHER_CTX_free(ossl_ctx->ossl_cipher_ctx);
+
+    ossl_ctx->ossl_cipher_ctx = NULL;
+    ossl_ctx->ossl_cipher = NULL;
+    ossl_ctx->initialized = 0;
+    return 1;
+}
+
+static int
+cipher_ctrl(hc_EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
+{
+    struct ossl_cipher_ctx *ossl_ctx = ctx->cipher_data;
+
+    assert(ossl_ctx != NULL);
+    return EVP_CIPHER_CTX_ctrl(ossl_ctx->ossl_cipher_ctx, type, arg, ptr);
+}
+
+
+static void
+get_EVP_CIPHER_once_cb(void *d)
+{
+    struct once_init_cipher_ctx *arg = d;
+    const EVP_CIPHER *ossl_evp;
+    hc_EVP_CIPHER *hc_evp;
+
+    hc_evp = arg->hc_memoize;
+
+    /*
+     * We lookup EVP_CIPHER *s by NID so that we don't fail to find a
+     * symbol such as EVP_aes...() when libcrypto changes after build
+     * time (e.g., updates, LD_LIBRARY_PATH/LD_PRELOAD).
+     */
+    ossl_evp = EVP_get_cipherbynid(arg->nid);
+    if (ossl_evp == NULL) {
+        (void) memset(hc_evp, 0, sizeof(*hc_evp));
+#if HCRYPTO_FALLBACK
+        *arg->hc_memoizep = arg->fallback;
+#endif
+        return;
+    }
+
+    /* Build the hc_EVP_CIPHER */
+    hc_evp->nid = EVP_CIPHER_nid(ossl_evp); /* We would an hcrypto NIDs if we had them */
+    hc_evp->block_size = EVP_CIPHER_block_size(ossl_evp);
+    hc_evp->key_len = EVP_CIPHER_key_length(ossl_evp);
+    hc_evp->iv_len = EVP_CIPHER_iv_length(ossl_evp);
+
+    /*
+     * We force hc_EVP_CipherInit_ex to always call our init() function,
+     * otherwise we don't get a chance to call EVP_CipherInit_ex()
+     * correctly.
+     */
+    hc_evp->flags = hc_EVP_CIPH_ALWAYS_CALL_INIT | arg->flags;
+
+    /* Our cipher context */
+    hc_evp->ctx_size = sizeof(struct ossl_cipher_ctx);
+
+    /* Our wrappers */
+    hc_evp->init = cipher_ctx_init;
+    hc_evp->do_cipher = cipher_do_cipher;
+    hc_evp->cleanup = cipher_cleanup;
+    hc_evp->set_asn1_parameters = NULL;
+    hc_evp->get_asn1_parameters = NULL;
+    hc_evp->ctrl = cipher_ctrl;
+
+    /* Our link to the OpenSSL EVP_CIPHER */
+    hc_evp->app_data = (void *)ossl_evp;
+
+    /* Finally, set the static hc_EVP_CIPHER * to the one we just built */
+    *arg->hc_memoizep = hc_evp;
+}
+
+static const hc_EVP_CIPHER *
+get_EVP_CIPHER(heim_base_once_t *once, hc_EVP_CIPHER *hc_memoize,
+               const hc_EVP_CIPHER **hc_memoizep,
+               const hc_EVP_CIPHER *fallback,
+               unsigned long flags, int nid)
+{
+    struct once_init_cipher_ctx arg;
+
+    arg.flags = flags;
+    arg.hc_memoizep = hc_memoizep;
+    arg.hc_memoize = hc_memoize;
+    arg.fallback = fallback;
+    arg.nid = nid;
+    heim_base_once_f(once, &arg, get_EVP_CIPHER_once_cb);
+    return *hc_memoizep; /* May be NULL */
+}
+
+#define OSSL_CIPHER_ALGORITHM(name, flags)                              \
+    extern const hc_EVP_CIPHER *hc_EVP_hcrypto_##name(void);            \
+    const hc_EVP_CIPHER *hc_EVP_ossl_##name(void)                       \
+    {                                                                   \
+        static hc_EVP_CIPHER ossl_##name##_st;                          \
+        static const hc_EVP_CIPHER *ossl_##name;                        \
+        static heim_base_once_t once = HEIM_BASE_ONCE_INIT;             \
+        return get_EVP_CIPHER(&once, &ossl_##name##_st, &ossl_##name,   \
+                              hc_EVP_hcrypto_##name(),                  \
+                              flags, NID_##name);                       \
+    }
+
+/* As above, but for EVP_MDs */
+
+struct ossl_md_ctx {
+    EVP_MD_CTX          *ossl_md_ctx;       /* OpenSSL md ctx */
+    const EVP_MD        *ossl_md;           /* OpenSSL md */
+    int                 initialized;
+};
+
+static int
+ossl_md_init(struct ossl_md_ctx *ctx, const EVP_MD *md)
+{
+    if (ctx->initialized)
+        EVP_MD_CTX_free(ctx->ossl_md_ctx);
+    ctx->initialized = 0;
+
+    ctx->ossl_md = md;
+    ctx->ossl_md_ctx = EVP_MD_CTX_new();
+    if (!EVP_DigestInit(ctx->ossl_md_ctx, md)) {
+        EVP_MD_CTX_free(ctx->ossl_md_ctx);
+        ctx->ossl_md_ctx = NULL;
+        ctx->ossl_md = NULL;
+        return 0;
+    }
+    ctx->initialized = 1;
+    return 1;
+}
+
+static int
+ossl_md_update(hc_EVP_MD_CTX *d, const void *data, size_t count)
+{
+    struct ossl_md_ctx *ctx = (void *)d;
+
+    return EVP_DigestUpdate(ctx->ossl_md_ctx, data, count);
+}
+
+static int
+ossl_md_final(void *md_data, hc_EVP_MD_CTX *d)
+{
+    struct ossl_md_ctx *ctx = (void *)d;
+
+    return EVP_DigestFinal(ctx->ossl_md_ctx, md_data, NULL);
+}
+
+static int
+ossl_md_cleanup(hc_EVP_MD_CTX *d)
+{
+    struct ossl_md_ctx *ctx = (void *)d;
+
+    if (!ctx->initialized)
+        return 1;
+    EVP_MD_CTX_free(ctx->ossl_md_ctx);
+    ctx->ossl_md = NULL;
+    ctx->initialized = 0;
+
+    return 1;
+}
+
+struct once_init_md_ctx {
+    const EVP_MD **ossl_memoizep;
+    const hc_EVP_MD **hc_memoizep;
+    hc_EVP_MD *hc_memoize;
+    const hc_EVP_MD *fallback;
+    hc_evp_md_init md_init;
+    int nid;
+};
+
+static void
+get_EVP_MD_once_cb(void *d)
+{
+    struct once_init_md_ctx *arg = d;
+    const EVP_MD *ossl_evp;
+    hc_EVP_MD *hc_evp;
+
+    hc_evp = arg->hc_memoize;
+    *arg->ossl_memoizep = ossl_evp = EVP_get_digestbynid(arg->nid);
+
+    if (ossl_evp == NULL) {
+        (void) memset(hc_evp, 0, sizeof(*hc_evp));
+#if HCRYPTO_FALLBACK
+        *arg->hc_memoizep = arg->fallback;
+#endif
+        return;
+    }
+
+    /* Build the hc_EVP_MD */
+    hc_evp->block_size = EVP_MD_block_size(ossl_evp);
+    hc_evp->hash_size = EVP_MD_size(ossl_evp);
+    hc_evp->ctx_size = sizeof(struct ossl_md_ctx);
+    hc_evp->init = arg->md_init;
+    hc_evp->update = ossl_md_update;
+    hc_evp->final = ossl_md_final;
+    hc_evp->cleanup = ossl_md_cleanup;
+
+    *arg->hc_memoizep = hc_evp;
+}
+
+static const hc_EVP_MD *
+get_EVP_MD(heim_base_once_t *once, hc_EVP_MD *hc_memoize,
+           const hc_EVP_MD **hc_memoizep, const EVP_MD **ossl_memoizep,
+           const hc_EVP_MD *fallback,
+           hc_evp_md_init md_init, int nid)
+{
+    struct once_init_md_ctx ctx;
+
+    ctx.ossl_memoizep = ossl_memoizep;
+    ctx.hc_memoizep = hc_memoizep;
+    ctx.hc_memoize = hc_memoize;
+    ctx.fallback = fallback;
+    ctx.md_init = md_init;
+    ctx.nid = nid;
+    heim_base_once_f(once, &ctx, get_EVP_MD_once_cb);
+    return *hc_memoizep; /* May be NULL */
+}
+
+#define OSSL_MD_ALGORITHM(name)                                         \
+    extern const hc_EVP_MD *hc_EVP_hcrypto_##name(void);                \
+    static const EVP_MD *ossl_EVP_##name;                               \
+    static const hc_EVP_MD *ossl_##name;                                \
+    static int ossl_init_##name(hc_EVP_MD_CTX *d)                       \
+    {                                                                   \
+        return ossl_md_init((void *)d, ossl_EVP_##name);                \
+    }                                                                   \
+    const hc_EVP_MD *hc_EVP_ossl_##name(void)                           \
+    {                                                                   \
+        static hc_EVP_MD ossl_##name##_st;                              \
+        static heim_base_once_t once = HEIM_BASE_ONCE_INIT;             \
+        return get_EVP_MD(&once, &ossl_##name##_st, &ossl_##name,       \
+                          &ossl_EVP_##name, hc_EVP_hcrypto_##name(),    \
+                          ossl_init_##name, NID_##name);                \
+    }
+
+#else /* HAVE_HCRYPTO_W_OPENSSL */
+
+#include "evp-hcrypto.h"
+
+#define OSSL_CIPHER_ALGORITHM(name, flags)                              \
+    extern const hc_EVP_CIPHER *hc_EVP_ossl_##name(void);               \
+    const hc_EVP_CIPHER *hc_EVP_ossl_##name(void)                       \
+    {                                                                   \
+        return hc_EVP_hcrypto_##name();                                 \
+    }
+
+#define OSSL_MD_ALGORITHM(name)                                         \
+    extern const hc_EVP_MD *hc_EVP_ossl_##name(void);                   \
+    const hc_EVP_MD *hc_EVP_ossl_##name(void)                           \
+    {                                                                   \
+        return hc_EVP_hcrypto_##name();                                 \
+    }
+
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+/**
+ * The triple DES cipher type (OpenSSL provider)
+ *
+ * @return the DES-EDE3-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(des_ede3_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The DES cipher type (OpenSSL provider)
+ *
+ * @return the DES-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(des_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-128 cipher type (OpenSSL provider)
+ *
+ * @return the AES-128-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_128_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-192 cipher type (OpenSSL provider)
+ *
+ * @return the AES-192-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_192_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-256 cipher type (OpenSSL provider)
+ *
+ * @return the AES-256-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_256_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-128 CFB8 cipher type (OpenSSL provider)
+ *
+ * @return the AES-128-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_128_cfb8, hc_EVP_CIPH_CFB8_MODE)
+
+/**
+ * The AES-192 CFB8 cipher type (OpenSSL provider)
+ *
+ * @return the AES-192-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_192_cfb8, hc_EVP_CIPH_CFB8_MODE)
+
+/**
+ * The AES-256 CFB8 cipher type (OpenSSL provider)
+ *
+ * @return the AES-256-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(aes_256_cfb8, hc_EVP_CIPH_CFB8_MODE)
+
+/*
+ * RC2 is only needed for tests of PKCS#12 support, which currently uses
+ * the RC2 PBE.  So no RC2 -> tests fail.
+ */
+
+/**
+ * The RC2 cipher type - OpenSSL
+ *
+ * @return the RC2 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(rc2_cbc,
+                      hc_EVP_CIPH_CBC_MODE |
+                      hc_EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The RC2-40 cipher type - OpenSSL
+ *
+ * @return the RC2-40 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(rc2_40_cbc,
+                      hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The RC2-64 cipher type - OpenSSL
+ *
+ * @return the RC2-64 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(rc2_64_cbc,
+                      hc_EVP_CIPH_CBC_MODE |
+                      hc_EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The Camellia-128 cipher type - OpenSSL
+ *
+ * @return the Camellia-128 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(camellia_128_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The Camellia-198 cipher type - OpenSSL
+ *
+ * @return the Camellia-198 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(camellia_192_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The Camellia-256 cipher type - OpenSSL
+ *
+ * @return the Camellia-256 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(camellia_256_cbc, hc_EVP_CIPH_CBC_MODE)
+
+/**
+ * The RC4 cipher type (OpenSSL provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(rc4,
+                      hc_EVP_CIPH_STREAM_CIPHER |
+                      hc_EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The RC4-40 cipher type (OpenSSL provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_CIPHER_ALGORITHM(rc4_40,
+                      hc_EVP_CIPH_STREAM_CIPHER |
+                      hc_EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The MD2 hash algorithm (OpenSSL provider)
+ *
+ * @return the MD2 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(md2)
+
+/**
+ * The MD4 hash algorithm (OpenSSL provider)
+ *
+ * @return the MD4 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(md4)
+
+/**
+ * The MD5 hash algorithm (OpenSSL provider)
+ *
+ * @return the MD5 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(md5)
+
+/**
+ * The SHA-1 hash algorithm (OpenSSL provider)
+ *
+ * @return the SHA-1 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(sha1)
+
+/**
+ * The SHA-256 hash algorithm (OpenSSL provider)
+ *
+ * @return the SHA-256 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(sha256)
+
+/**
+ * The SHA-384 hash algorithm (OpenSSL provider)
+ *
+ * @return the SHA-384 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(sha384)
+
+/**
+ * The SHA-512 hash algorithm (OpenSSL provider)
+ *
+ * @return the SHA-512 EVP_MD pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+OSSL_MD_ALGORITHM(sha512)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.h
new file mode 100644
index 000000000..7794f6078
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-openssl.h
@@ -0,0 +1,104 @@
+/*	$NetBSD: evp-openssl.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2009-2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIM_EVP_OSSL_H
+#define HEIM_EVP_OSSL_H 1
+
+/* symbol renaming */
+#define EVP_ossl_md2 hc_EVP_ossl_md2
+#define EVP_ossl_md4 hc_EVP_ossl_md4
+#define EVP_ossl_md5 hc_EVP_ossl_md5
+#define EVP_ossl_sha1 hc_EVP_ossl_sha1
+#define EVP_ossl_sha256 hc_EVP_ossl_sha256
+#define EVP_ossl_sha384 hc_EVP_ossl_sha384
+#define EVP_ossl_sha512 hc_EVP_ossl_sha512
+#define EVP_ossl_des_cbc hc_EVP_ossl_des_cbc
+#define EVP_ossl_des_ede3_cbc hc_EVP_ossl_des_ede3_cbc
+#define EVP_ossl_aes_128_cbc hc_EVP_ossl_aes_128_cbc
+#define EVP_ossl_aes_192_cbc hc_EVP_ossl_aes_192_cbc
+#define EVP_ossl_aes_256_cbc hc_EVP_ossl_aes_256_cbc
+#define EVP_ossl_aes_128_cfb8 hc_EVP_ossl_aes_128_cfb8
+#define EVP_ossl_aes_192_cfb8 hc_EVP_ossl_aes_192_cfb8
+#define EVP_ossl_aes_256_cfb8 hc_EVP_ossl_aes_256_cfb8
+#define EVP_ossl_rc4 hc_EVP_ossl_rc4
+#define EVP_ossl_rc4_40 hc_EVP_ossl_rc4_40
+#define EVP_ossl_rc2_40_cbc hc_EVP_ossl_rc2_40_cbc
+#define EVP_ossl_rc2_64_cbc hc_EVP_ossl_rc2_64_cbc
+#define EVP_ossl_rc2_cbc hc_EVP_ossl_rc2_cbc
+#define EVP_ossl_camellia_128_cbc hc_EVP_ossl_camellia_128_cbc
+#define EVP_ossl_camellia_192_cbc hc_EVP_ossl_camellia_192_cbc
+#define EVP_ossl_camellia_256_cbc hc_EVP_ossl_camellia_256_cbc
+
+/*
+ *
+ */
+
+HC_CPP_BEGIN
+
+const hc_EVP_MD * hc_EVP_ossl_md2(void);
+const hc_EVP_MD * hc_EVP_ossl_md4(void);
+const hc_EVP_MD * hc_EVP_ossl_md5(void);
+const hc_EVP_MD * hc_EVP_ossl_sha1(void);
+const hc_EVP_MD * hc_EVP_ossl_sha256(void);
+const hc_EVP_MD * hc_EVP_ossl_sha384(void);
+const hc_EVP_MD * hc_EVP_ossl_sha512(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_rc2_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_rc2_40_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_rc2_64_cbc(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_rc4(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_rc4_40(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_des_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_des_ede3_cbc(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_128_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_192_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_256_cbc(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_128_cfb8(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_192_cfb8(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_aes_256_cfb8(void);
+
+const hc_EVP_CIPHER * hc_EVP_ossl_camellia_128_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_camellia_192_cbc(void);
+const hc_EVP_CIPHER * hc_EVP_ossl_camellia_256_cbc(void);
+
+HC_CPP_END
+
+#endif /* HEIM_EVP_OSSL_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.c
new file mode 100644
index 000000000..d92fc0219
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.c
@@ -0,0 +1,798 @@
+/*	$NetBSD: evp-pkcs11.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015-2016, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* PKCS#11 provider */
+
+#include <config.h>
+#include <krb5/roken.h>
+#include <assert.h>
+#ifdef HAVE_DLFCN_H
+#include <dlfcn.h>
+#ifndef RTLD_LAZY
+#define RTLD_LAZY 0
+#endif
+#ifndef RTLD_LOCAL
+#define RTLD_LOCAL 0
+#endif
+#ifndef RTLD_GROUP
+#define RTLD_GROUP 0
+#endif
+#ifndef RTLD_NODELETE
+#define RTLD_NODELETE 0
+#endif
+#else
+#error PKCS11 support requires dlfcn.h
+#endif
+
+#include <krb5/heimbase.h>
+
+#include <evp.h>
+#include <evp-hcrypto.h>
+#include <evp-pkcs11.h>
+
+#include <ref/pkcs11.h>
+
+#if __sun && !defined(PKCS11_MODULE_PATH)
+# if _LP64
+# define PKCS11_MODULE_PATH "/usr/lib/64/libpkcs11.so"
+# else
+# define PKCS11_MODULE_PATH "/usr/lib/libpkcs11.so"
+# endif
+#elif defined(__linux__)
+/*
+ * XXX We should have an autoconf check for OpenCryptoki and such
+ * things.  However, there's no AC_CHECK_OBJECT(), and we'd have to
+ * write one.  Today I'm feeling lazy.  Another possibility would be to
+ * have a symlink from the libdir we'll install into, and then we could
+ * dlopen() that on all platforms.
+ *
+ * XXX Also, we should pick an appropriate shared object based on 32- vs
+ * 64-bits.
+ */
+# define PKCS11_MODULE_PATH "/usr/lib/pkcs11/PKCS11_API.so"
+#endif
+
+static CK_FUNCTION_LIST_PTR p11_module;
+
+static int
+p11_cleanup(EVP_CIPHER_CTX *ctx);
+
+struct pkcs11_cipher_ctx {
+    CK_SESSION_HANDLE hSession;
+    CK_OBJECT_HANDLE hSecret;
+    int cipher_init_done;
+};
+
+struct pkcs11_md_ctx {
+    CK_SESSION_HANDLE hSession;
+};
+
+static void *pkcs11_module_handle;
+static void
+p11_module_init_once(void *context)
+{
+    CK_RV rv;
+    CK_FUNCTION_LIST_PTR module;
+    CK_RV (*C_GetFunctionList_fn)(CK_FUNCTION_LIST_PTR_PTR);
+
+    if (!issuid()) {
+        char *pkcs11ModulePath = getenv("PKCS11_MODULE_PATH");
+        if (pkcs11ModulePath != NULL) {
+	    pkcs11_module_handle =
+		dlopen(pkcs11ModulePath,
+		       RTLD_LAZY | RTLD_LOCAL | RTLD_GROUP | RTLD_NODELETE);
+	    if (pkcs11_module_handle == NULL)
+                fprintf(stderr, "p11_module_init(%s): %s\n", pkcs11ModulePath, dlerror());
+        }
+    }
+#ifdef PKCS11_MODULE_PATH
+    if (pkcs11_module_handle == NULL) {
+	pkcs11_module_handle =
+	    dlopen(PKCS11_MODULE_PATH,
+		   RTLD_LAZY | RTLD_LOCAL | RTLD_GROUP | RTLD_NODELETE);
+	if (pkcs11_module_handle == NULL)
+            fprintf(stderr, "p11_module_init(%s): %s\n", PKCS11_MODULE_PATH, dlerror());
+    }
+#endif
+    if (pkcs11_module_handle == NULL)
+        goto cleanup;
+
+    C_GetFunctionList_fn = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))
+	dlsym(pkcs11_module_handle, "C_GetFunctionList");
+    if (C_GetFunctionList_fn == NULL)
+        goto cleanup;
+
+    rv = C_GetFunctionList_fn(&module);
+    if (rv != CKR_OK)
+        goto cleanup;
+
+    rv = module->C_Initialize(NULL);
+    if (rv == CKR_CRYPTOKI_ALREADY_INITIALIZED)
+        rv = CKR_OK;
+    if (rv == CKR_OK)
+        *((CK_FUNCTION_LIST_PTR_PTR)context) = module;
+
+cleanup:
+    if (pkcs11_module_handle != NULL && p11_module == NULL) {
+	dlclose(pkcs11_module_handle);
+	pkcs11_module_handle = NULL;
+    }
+    /* else leak pkcs11_module_handle */
+}
+
+static CK_RV
+p11_module_init(void)
+{
+    static heim_base_once_t init_module = HEIM_BASE_ONCE_INIT;
+
+    heim_base_once_f(&init_module, &p11_module, p11_module_init_once);
+
+    return p11_module != NULL ? CKR_OK : CKR_LIBRARY_LOAD_FAILED;
+}
+
+static CK_RV
+p11_session_init(CK_MECHANISM_TYPE mechanismType, CK_SESSION_HANDLE_PTR phSession)
+{
+    CK_RV rv;
+    CK_ULONG i, ulSlotCount = 0;
+    CK_SLOT_ID_PTR pSlotList = NULL;
+    CK_MECHANISM_INFO info;
+
+    if (phSession != NULL)
+        *phSession = CK_INVALID_HANDLE;
+
+    rv = p11_module_init();
+    if (rv != CKR_OK)
+        goto cleanup;
+
+    assert(p11_module != NULL);
+
+    rv = p11_module->C_GetSlotList(CK_FALSE, NULL, &ulSlotCount);
+    if (rv != CKR_OK)
+        goto cleanup;
+
+    pSlotList = (CK_SLOT_ID_PTR)calloc(ulSlotCount, sizeof(CK_SLOT_ID));
+    if (pSlotList == NULL) {
+        rv = CKR_HOST_MEMORY;
+        goto cleanup;
+    }
+
+    rv = p11_module->C_GetSlotList(CK_FALSE, pSlotList, &ulSlotCount);
+    if (rv != CKR_OK)
+        goto cleanup;
+
+    /*
+     * Note that this approach of using the first slot that supports the desired
+     * mechanism may not always be what the user wants (for example it may prefer
+     * software to hardware crypto). We're going to assume that this code will be
+     * principally used on Solaris (which has a meta-slot provider that sorts by
+     * hardware first) or in situations where the user can configure the slots in
+     * order of provider preference. In the future we should make this configurable.
+     */
+    for (i = 0; i < ulSlotCount; i++) {
+        rv = p11_module->C_GetMechanismInfo(pSlotList[i], mechanismType, &info);
+        if (rv == CKR_OK)
+            break;
+    }
+
+    if (i == ulSlotCount) {
+        rv = CKR_MECHANISM_INVALID;
+        goto cleanup;
+    }
+
+    if (phSession != NULL) {
+        rv = p11_module->C_OpenSession(pSlotList[i], CKF_SERIAL_SESSION, NULL, NULL, phSession);
+        if (rv != CKR_OK)
+            goto cleanup;
+    }
+
+cleanup:
+    free(pSlotList);
+
+    return rv;
+}
+
+static int
+p11_mech_available_p(CK_MECHANISM_TYPE mechanismType)
+{
+    return p11_session_init(mechanismType, NULL) == CKR_OK;
+}
+
+static CK_KEY_TYPE
+p11_key_type_for_mech(CK_MECHANISM_TYPE mechanismType)
+{
+    CK_KEY_TYPE keyType = 0;
+
+    switch (mechanismType) {
+    case CKM_RC2_CBC:
+        keyType = CKK_RC2;
+        break;
+    case CKM_RC4:
+        keyType = CKK_RC4;
+        break;
+    case CKM_DES_CBC:
+        keyType = CKK_DES;
+        break;
+    case CKM_DES3_CBC:
+        keyType = CKK_DES3;
+        break;
+    case CKM_AES_CBC:
+    case CKM_AES_CFB8:
+        keyType = CKK_AES;
+        break;
+    case CKM_CAMELLIA_CBC:
+        keyType = CKK_CAMELLIA;
+        break;
+    default:
+        assert(0 && "Unknown PKCS#11 mechanism type");
+        break;
+    }
+
+    return keyType;
+}
+
+static int
+p11_key_init(EVP_CIPHER_CTX *ctx,
+             const unsigned char *key,
+             const unsigned char *iv,
+             int encp)
+{
+    CK_RV rv;
+    CK_BBOOL bFalse = CK_FALSE;
+    CK_BBOOL bTrue = CK_TRUE;
+    CK_MECHANISM_TYPE mechanismType = (CK_MECHANISM_TYPE)ctx->cipher->app_data;
+    CK_KEY_TYPE keyType = p11_key_type_for_mech(mechanismType);
+    CK_OBJECT_CLASS objectClass = CKO_SECRET_KEY;
+    CK_ATTRIBUTE_TYPE op = encp ? CKA_ENCRYPT : CKA_DECRYPT;
+    CK_ATTRIBUTE attributes[] = {
+        { CKA_EXTRACTABLE,      &bFalse,        sizeof(bFalse)          },
+        { CKA_CLASS,            &objectClass,   sizeof(objectClass)     },
+        { CKA_KEY_TYPE,         &keyType,       sizeof(keyType)         },
+        { CKA_TOKEN,            &bFalse,        sizeof(bFalse)          },
+        { CKA_PRIVATE,          &bFalse,        sizeof(bFalse)          },
+        { CKA_SENSITIVE,        &bTrue,         sizeof(bTrue)           },
+        { CKA_VALUE,            (void *)key,    ctx->key_len            },
+        { op,                   &bTrue,         sizeof(bTrue)           }
+    };
+    struct pkcs11_cipher_ctx *p11ctx = (struct pkcs11_cipher_ctx *)ctx->cipher_data;
+    p11ctx->cipher_init_done = 0;
+
+    rv = p11_session_init(mechanismType, &p11ctx->hSession);
+    if (rv != CKR_OK)
+        goto cleanup;
+
+    assert(p11_module != NULL);
+
+    rv = p11_module->C_CreateObject(p11ctx->hSession, attributes,
+                                    sizeof(attributes) / sizeof(attributes[0]),
+                                    &p11ctx->hSecret);
+    if (rv != CKR_OK)
+        goto cleanup;
+
+cleanup:
+    if (rv != CKR_OK)
+        p11_cleanup(ctx);
+
+    return rv == CKR_OK;
+}
+
+static int
+p11_do_cipher(EVP_CIPHER_CTX *ctx,
+              unsigned char *out,
+              const unsigned char *in,
+              unsigned int size)
+{
+    struct pkcs11_cipher_ctx *p11ctx = (struct pkcs11_cipher_ctx *)ctx->cipher_data;
+    CK_RV rv = CKR_OK;
+    CK_ULONG ulCipherTextLen = size;
+    CK_MECHANISM_TYPE mechanismType = (CK_MECHANISM_TYPE)ctx->cipher->app_data;
+    CK_MECHANISM mechanism = {
+        mechanismType,
+        ctx->cipher->iv_len ? ctx->iv : NULL,
+        ctx->cipher->iv_len
+    };
+
+    assert(p11_module != NULL);
+    /* The EVP layer only ever calls us with complete cipher blocks */
+    assert(EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_STREAM_CIPHER ||
+           (size % ctx->cipher->block_size) == 0);
+
+    if (ctx->encrypt) {
+        if (!p11ctx->cipher_init_done) {
+            rv = p11_module->C_EncryptInit(p11ctx->hSession, &mechanism, p11ctx->hSecret);
+            if (rv == CKR_OK)
+                p11ctx->cipher_init_done = 1;
+        }
+        if (rv == CKR_OK)
+            rv = p11_module->C_EncryptUpdate(p11ctx->hSession, (unsigned char *)in, size, out, &ulCipherTextLen);
+    } else {
+        if (!p11ctx->cipher_init_done) {
+            rv = p11_module->C_DecryptInit(p11ctx->hSession, &mechanism, p11ctx->hSecret);
+            if (rv == CKR_OK)
+                p11ctx->cipher_init_done = 1;
+        }
+        if (rv == CKR_OK)
+            rv = p11_module->C_DecryptUpdate(p11ctx->hSession, (unsigned char *)in, size, out, &ulCipherTextLen);
+    }
+
+    return rv == CKR_OK;
+}
+
+static int
+p11_cleanup(EVP_CIPHER_CTX *ctx)
+{
+    struct pkcs11_cipher_ctx *p11ctx = (struct pkcs11_cipher_ctx *)ctx->cipher_data;
+
+    assert(p11_module != NULL);
+
+    if (p11ctx->hSecret != CK_INVALID_HANDLE)  {
+        p11_module->C_DestroyObject(p11ctx->hSession, p11ctx->hSecret);
+        p11ctx->hSecret = CK_INVALID_HANDLE;
+    }
+    if (p11ctx->hSession != CK_INVALID_HANDLE) {
+        p11_module->C_CloseSession(p11ctx->hSession);
+        p11ctx->hSession = CK_INVALID_HANDLE;
+    }
+
+    return 1;
+}
+
+static int
+p11_md_hash_init(CK_MECHANISM_TYPE mechanismType, EVP_MD_CTX *ctx)
+{
+    struct pkcs11_md_ctx *p11ctx = (struct pkcs11_md_ctx *)ctx;
+    CK_RV rv;
+
+    rv = p11_session_init(mechanismType, &p11ctx->hSession);
+    if (rv == CKR_OK) {
+        CK_MECHANISM mechanism = { mechanismType, NULL, 0 };
+
+        assert(p11_module != NULL);
+
+        rv = p11_module->C_DigestInit(p11ctx->hSession, &mechanism);
+    }
+
+    return rv == CKR_OK;
+}
+
+static int
+p11_md_update(EVP_MD_CTX *ctx, const void *data, size_t length)
+{
+    struct pkcs11_md_ctx *p11ctx = (struct pkcs11_md_ctx *)ctx;
+    CK_RV rv;
+
+    assert(p11_module != NULL);
+
+    rv = p11_module->C_DigestUpdate(p11ctx->hSession, (unsigned char *)data, length);
+
+    return rv == CKR_OK;
+}
+
+static int
+p11_md_final(void *digest, EVP_MD_CTX *ctx)
+{
+    struct pkcs11_md_ctx *p11ctx = (struct pkcs11_md_ctx *)ctx;
+    CK_RV rv;
+    CK_ULONG digestLen = 0;
+
+    assert(p11_module != NULL);
+
+    rv = p11_module->C_DigestFinal(p11ctx->hSession, NULL, &digestLen);
+    if (rv == CKR_OK)
+        rv = p11_module->C_DigestFinal(p11ctx->hSession, digest, &digestLen);
+
+    return rv == CKR_OK;
+}
+
+static int
+p11_md_cleanup(EVP_MD_CTX *ctx)
+{
+    struct pkcs11_md_ctx *p11ctx = (struct pkcs11_md_ctx *)ctx;
+    CK_RV rv;
+
+    assert(p11_module != NULL);
+
+    rv = p11_module->C_CloseSession(p11ctx->hSession);
+    if (rv == CKR_OK)
+        p11ctx->hSession = CK_INVALID_HANDLE;
+
+    return rv == CKR_OK;
+}
+
+#define PKCS11_CIPHER_ALGORITHM(name, mechanismType, block_size,        \
+                                key_len, iv_len, flags)                 \
+                                                                        \
+    static EVP_CIPHER                                                   \
+    pkcs11_##name = {                                                   \
+        0,                                                              \
+        block_size,                                                     \
+        key_len,                                                        \
+        iv_len,                                                         \
+        flags,                                                          \
+        p11_key_init,                                                   \
+        p11_do_cipher,                                                  \
+        p11_cleanup,                                                    \
+        sizeof(struct pkcs11_cipher_ctx),                               \
+        NULL,                                                           \
+        NULL,                                                           \
+        NULL,                                                           \
+        (void *)mechanismType                                           \
+    };                                                                  \
+                                                                        \
+    const EVP_CIPHER *                                                  \
+    hc_EVP_pkcs11_##name(void)                                          \
+    {                                                                   \
+        if (p11_mech_available_p(mechanismType))                        \
+            return &pkcs11_##name;                                      \
+        else                                                            \
+            return NULL;                                                \
+    }                                                                   \
+                                                                        \
+    static void                                                         \
+    pkcs11_hcrypto_##name##_init_once(void *context)                    \
+    {                                                                   \
+        const EVP_CIPHER *cipher;                                       \
+                                                                        \
+        cipher = hc_EVP_pkcs11_ ##name();                               \
+        if (cipher == NULL && HCRYPTO_FALLBACK)                         \
+            cipher = hc_EVP_hcrypto_ ##name();                          \
+                                                                        \
+        *((const EVP_CIPHER **)context) = cipher;                       \
+    }                                                                   \
+                                                                        \
+    const EVP_CIPHER *                                                  \
+    hc_EVP_pkcs11_hcrypto_##name(void)                                  \
+    {                                                                   \
+        static const EVP_CIPHER *__cipher;                              \
+        static heim_base_once_t __init = HEIM_BASE_ONCE_INIT;           \
+                                                                        \
+        heim_base_once_f(&__init, &__cipher,                            \
+                         pkcs11_hcrypto_##name##_init_once);            \
+                                                                        \
+        return __cipher;                                                \
+    }
+
+#define PKCS11_MD_ALGORITHM(name, mechanismType, hash_size, block_size) \
+                                                                        \
+    static int p11_##name##_init(EVP_MD_CTX *ctx)                       \
+    {                                                                   \
+        return p11_md_hash_init(mechanismType, ctx);                    \
+    }                                                                   \
+                                                                        \
+    const EVP_MD *                                                      \
+    hc_EVP_pkcs11_##name(void)                                          \
+    {                                                                   \
+        static struct hc_evp_md name = {                                \
+            hash_size,                                                  \
+            block_size,                                                 \
+            sizeof(struct pkcs11_md_ctx),                               \
+            p11_##name##_init,                                          \
+            p11_md_update,                                              \
+            p11_md_final,                                               \
+            p11_md_cleanup                                              \
+        };                                                              \
+                                                                        \
+        if (p11_mech_available_p(mechanismType))                        \
+            return &name;                                               \
+        else                                                            \
+            return NULL;                                                \
+    }                                                                   \
+                                                                        \
+    static void                                                         \
+    pkcs11_hcrypto_##name##_init_once(void *context)                    \
+    {                                                                   \
+        const EVP_MD *md;                                               \
+                                                                        \
+        md = hc_EVP_pkcs11_ ##name();                                   \
+        if (md == NULL && HCRYPTO_FALLBACK)                             \
+            md = hc_EVP_hcrypto_ ##name();                              \
+                                                                        \
+        *((const EVP_MD **)context) = md;                               \
+    }                                                                   \
+                                                                        \
+    const EVP_MD *                                                      \
+    hc_EVP_pkcs11_hcrypto_##name(void)                                  \
+    {                                                                   \
+        static const EVP_MD *__md;                                      \
+        static heim_base_once_t __init = HEIM_BASE_ONCE_INIT;           \
+                                                                        \
+        heim_base_once_f(&__init, &__md,                                \
+                         pkcs11_hcrypto_##name##_init_once);            \
+                                                                        \
+        return __md;                                                    \
+    }
+
+#define PKCS11_MD_ALGORITHM_UNAVAILABLE(name)                           \
+                                                                        \
+    const EVP_MD *                                                      \
+    hc_EVP_pkcs11_##name(void)                                          \
+    {                                                                   \
+        return NULL;                                                    \
+    }                                                                   \
+                                                                        \
+    const EVP_MD *                                                      \
+    hc_EVP_pkcs11_hcrypto_##name(void)                                  \
+    {                                                                   \
+        return hc_EVP_hcrypto_ ##name();                                \
+    }
+
+/**
+ * The triple DES cipher type (PKCS#11 provider)
+ *
+ * @return the DES-EDE3-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(des_ede3_cbc,
+                        CKM_DES3_CBC,
+                        8,
+                        24,
+                        8,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The DES cipher type (PKCS#11 provider)
+ *
+ * @return the DES-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(des_cbc,
+                        CKM_DES_CBC,
+                        8,
+                        8,
+                        8,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-128 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-128-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_128_cbc,
+                        CKM_AES_CBC,
+                        16,
+                        16,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-192 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-192-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_192_cbc,
+                        CKM_AES_CBC,
+                        16,
+                        24,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-256 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-256-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_256_cbc,
+                        CKM_AES_CBC,
+                        16,
+                        32,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The AES-128 CFB8 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-128-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_128_cfb8,
+                        CKM_AES_CFB8,
+                        16,
+                        16,
+                        16,
+                        EVP_CIPH_CFB8_MODE)
+
+/**
+ * The AES-192 CFB8 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-192-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_192_cfb8,
+                        CKM_AES_CFB8,
+                        16,
+                        24,
+                        16,
+                        EVP_CIPH_CFB8_MODE)
+
+/**
+ * The AES-256 CFB8 cipher type (PKCS#11 provider)
+ *
+ * @return the AES-256-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(aes_256_cfb8,
+                        CKM_AES_CFB8,
+                        16,
+                        32,
+                        16,
+                        EVP_CIPH_CFB8_MODE)
+
+/**
+ * The RC2 cipher type - PKCS#11
+ *
+ * @return the RC2 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(rc2_cbc,
+                        CKM_RC2_CBC,
+                        8,
+                        16,
+                        8,
+                        EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The RC2-40 cipher type - PKCS#11
+ *
+ * @return the RC2-40 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(rc2_40_cbc,
+                        CKM_RC2_CBC,
+                        8,
+                        5,
+                        8,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The RC2-64 cipher type - PKCS#11
+ *
+ * @return the RC2-64 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(rc2_64_cbc,
+                        CKM_RC2_CBC,
+                        8,
+                        8,
+                        8,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The Camellia-128 cipher type - PKCS#11
+ *
+ * @return the Camellia-128 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(camellia_128_cbc,
+                        CKM_CAMELLIA_CBC,
+                        16,
+                        16,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The Camellia-198 cipher type - PKCS#11
+ *
+ * @return the Camellia-198 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(camellia_192_cbc,
+                        CKM_CAMELLIA_CBC,
+                        16,
+                        24,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The Camellia-256 cipher type - PKCS#11
+ *
+ * @return the Camellia-256 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(camellia_256_cbc,
+                        CKM_CAMELLIA_CBC,
+                        16,
+                        32,
+                        16,
+                        EVP_CIPH_CBC_MODE)
+
+/**
+ * The RC4 cipher type (PKCS#11 provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(rc4,
+                        CKM_RC4,
+                        1,
+                        16,
+                        0,
+                        EVP_CIPH_STREAM_CIPHER | EVP_CIPH_VARIABLE_LENGTH)
+
+/**
+ * The RC4-40 cipher type (PKCS#11 provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+PKCS11_CIPHER_ALGORITHM(rc4_40,
+                        CKM_RC4,
+                        1,
+                        5,
+                        0,
+                        EVP_CIPH_STREAM_CIPHER | EVP_CIPH_VARIABLE_LENGTH)
+
+PKCS11_MD_ALGORITHM(md2,    CKM_MD2,    16, 16)
+#ifdef CKM_MD4 /* non-standard extension */
+PKCS11_MD_ALGORITHM(md4,    CKM_MD4,    16, 64)
+#else
+PKCS11_MD_ALGORITHM_UNAVAILABLE(md4)
+#endif
+PKCS11_MD_ALGORITHM(md5,    CKM_MD5,    16, 64)
+PKCS11_MD_ALGORITHM(sha1,   CKM_SHA_1,  20, 64)
+PKCS11_MD_ALGORITHM(sha256, CKM_SHA256, 32, 64)
+PKCS11_MD_ALGORITHM(sha384, CKM_SHA384, 48, 128)
+PKCS11_MD_ALGORITHM(sha512, CKM_SHA512, 64, 128)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.h
new file mode 100644
index 000000000..e8f8e9faf
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-pkcs11.h
@@ -0,0 +1,159 @@
+/*	$NetBSD: evp-pkcs11.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIM_EVP_PKCS11_H
+#define HEIM_EVP_PKCS11_H 1
+
+/* symbol renaming */
+
+#define EVP_pkcs11_md2() hc_EVP_pkcs11_md2()
+#define EVP_pkcs11_md4() hc_EVP_pkcs11_md4()
+#define EVP_pkcs11_md5() hc_EVP_pkcs11_md5()
+#define EVP_pkcs11_sha1() hc_EVP_pkcs11_sha1()
+#define EVP_pkcs11_sha256() hc_EVP_pkcs11_sha256()
+#define EVP_pkcs11_sha384() hc_EVP_pkcs11_sha384()
+#define EVP_pkcs11_sha512() hc_EVP_pkcs11_sha512()
+#define EVP_pkcs11_des_cbc() hc_EVP_pkcs11_des_cbc()
+#define EVP_pkcs11_des_ede3_cbc() hc_EVP_pkcs11_des_ede3_cbc()
+#define EVP_pkcs11_aes_128_cbc() hc_EVP_pkcs11_aes_128_cbc()
+#define EVP_pkcs11_aes_192_cbc() hc_EVP_pkcs11_aes_192_cbc()
+#define EVP_pkcs11_aes_256_cbc() hc_EVP_pkcs11_aes_256_cbc()
+#define EVP_pkcs11_aes_128_cfb8() hc_EVP_pkcs11_aes_128_cfb8()
+#define EVP_pkcs11_aes_192_cfb8() hc_EVP_pkcs11_aes_192_cfb8()
+#define EVP_pkcs11_aes_256_cfb8() hc_EVP_pkcs11_aes_256_cfb8()
+#define EVP_pkcs11_rc4() hc_EVP_pkcs11_rc4()
+#define EVP_pkcs11_rc4_40() hc_EVP_pkcs11_rc4_40()
+#define EVP_pkcs11_rc2_40_cbc() hc_EVP_pkcs11_rc2_40_cbc()
+#define EVP_pkcs11_rc2_64_cbc() hc_EVP_pkcs11_rc2_64_cbc()
+#define EVP_pkcs11_rc2_cbc() hc_EVP_pkcs11_rc2_cbc()
+#define EVP_pkcs11_camellia_128_cbc() hc_EVP_pkcs11_camellia_128_cbc()
+#define EVP_pkcs11_camellia_192_cbc() hc_EVP_pkcs11_camellia_192_cbc()
+#define EVP_pkcs11_camellia_256_cbc() hc_EVP_pkcs11_camellia_256_cbc()
+
+#define EVP_pkcs11_hcrypto_md2() hc_EVP_pkcs11_hcrypto_md2()
+#define EVP_pkcs11_hcrypto_md4() hc_EVP_pkcs11_hcrypto_md4()
+#define EVP_pkcs11_hcrypto_md5() hc_EVP_pkcs11_hcrypto_md5()
+#define EVP_pkcs11_hcrypto_sha1() hc_EVP_pkcs11_hcrypto_sha1()
+#define EVP_pkcs11_hcrypto_sha256() hc_EVP_pkcs11_hcrypto_sha256()
+#define EVP_pkcs11_hcrypto_sha384() hc_EVP_pkcs11_hcrypto_sha384()
+#define EVP_pkcs11_hcrypto_sha512() hc_EVP_pkcs11_hcrypto_sha512()
+#define EVP_pkcs11_hcrypto_des_cbc() hc_EVP_pkcs11_hcrypto_des_cbc()
+#define EVP_pkcs11_hcrypto_des_ede3_cbc() hc_EVP_pkcs11_hcrypto_des_ede3_cbc()
+#define EVP_pkcs11_hcrypto_aes_128_cbc() hc_EVP_pkcs11_hcrypto_aes_128_cbc()
+#define EVP_pkcs11_hcrypto_aes_192_cbc() hc_EVP_pkcs11_hcrypto_aes_192_cbc()
+#define EVP_pkcs11_hcrypto_aes_256_cbc() hc_EVP_pkcs11_hcrypto_aes_256_cbc()
+#define EVP_pkcs11_hcrypto_aes_128_cfb8() hc_EVP_pkcs11_hcrypto_aes_128_cfb8()
+#define EVP_pkcs11_hcrypto_aes_192_cfb8() hc_EVP_pkcs11_hcrypto_aes_192_cfb8()
+#define EVP_pkcs11_hcrypto_aes_256_cfb8() hc_EVP_pkcs11_hcrypto_aes_256_cfb8()
+#define EVP_pkcs11_hcrypto_rc4() hc_EVP_pkcs11_hcrypto_rc4()
+#define EVP_pkcs11_hcrypto_rc4_40() hc_EVP_pkcs11_hcrypto_rc4_40()
+#define EVP_pkcs11_hcrypto_rc2_40_cbc() hc_EVP_pkcs11_hcrypto_rc2_40_cbc()
+#define EVP_pkcs11_hcrypto_rc2_64_cbc() hc_EVP_pkcs11_hcrypto_rc2_64_cbc()
+#define EVP_pkcs11_hcrypto_rc2_cbc() hc_EVP_pkcs11_hcrypto_rc2_cbc()
+#define EVP_pkcs11_hcrypto_camellia_128_cbc() hc_EVP_pkcs11_hcrypto_camellia_128_cbc()
+#define EVP_pkcs11_hcrypto_camellia_192_cbc() hc_EVP_pkcs11_hcrypto_camellia_192_cbc()
+#define EVP_pkcs11_hcrypto_camellia_256_cbc() hc_EVP_pkcs11_hcrypto_camellia_256_cbc()
+
+HC_CPP_BEGIN
+
+/*
+ * Strict PKCS#11 implementations (these will return NULL if the underlying
+ * PKCS#11 implementation does not implement the cipher or hash).
+ */
+const EVP_MD * hc_EVP_pkcs11_md2(void);
+const EVP_MD * hc_EVP_pkcs11_md4(void);
+const EVP_MD * hc_EVP_pkcs11_md5(void);
+const EVP_MD * hc_EVP_pkcs11_sha1(void);
+const EVP_MD * hc_EVP_pkcs11_sha256(void);
+const EVP_MD * hc_EVP_pkcs11_sha384(void);
+const EVP_MD * hc_EVP_pkcs11_sha512(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_rc2_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_rc2_40_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_rc2_64_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_rc4(void);
+const EVP_CIPHER * hc_EVP_pkcs11_rc4_40(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_des_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_des_ede3_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_aes_128_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_aes_192_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_aes_256_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_aes_128_cfb8(void);
+const EVP_CIPHER * hc_EVP_pkcs11_aes_192_cfb8(void);
+const EVP_CIPHER * hc_EVP_pkcs11_aes_256_cfb8(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_camellia_128_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_camellia_192_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_camellia_256_cbc(void);
+
+/*
+ * PKCS#11 implementations with fallback to hcrypto.
+ */
+const EVP_MD * hc_EVP_pkcs11_hcrypto_md2(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_md4(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_md5(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_sha1(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_sha256(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_sha384(void);
+const EVP_MD * hc_EVP_pkcs11_hcrypto_sha512(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_rc2_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_rc2_40_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_rc2_64_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_rc4(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_rc4_40(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_des_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_des_ede3_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_128_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_192_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_256_cbc(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_128_cfb8(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_192_cfb8(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_aes_256_cfb8(void);
+
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_camellia_128_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_camellia_192_cbc(void);
+const EVP_CIPHER * hc_EVP_pkcs11_hcrypto_camellia_256_cbc(void);
+
+HC_CPP_END
+
+#endif /* HEIM_EVP_PKCS11_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.c
new file mode 100644
index 000000000..89d90c228
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.c
@@ -0,0 +1,142 @@
+/*	$NetBSD: evp-w32.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Windows fallback provider: decides whether to use hcrypto or
+ * wincng depending on whether bcrypt.dll is available (i.e. it
+ * is runtime compatible back to XP, but will use the native
+ * crypto APIs from Vista onwards).
+ */
+
+#include <config.h>
+#include <krb5/roken.h>
+
+#include <assert.h>
+
+#include <evp.h>
+#include <evp-w32.h>
+#include <evp-hcrypto.h>
+
+#include <evp-wincng.h>
+
+static LONG wincng_available = -1;
+
+static __inline int
+wincng_check_availability(void)
+{
+    if (wincng_available == -1) {
+	char szBCryptDllPath[MAX_PATH];
+	UINT cbBCryptDllPath;
+
+	cbBCryptDllPath = GetSystemDirectory(szBCryptDllPath,
+					     sizeof(szBCryptDllPath));
+	if (cbBCryptDllPath > 0 &&
+	    cbBCryptDllPath < sizeof(szBCryptDllPath) &&
+	    strncat_s(szBCryptDllPath,
+		      sizeof(szBCryptDllPath), "\\bcrypt.dll", 11) == 0) {
+	    HANDLE hBCryptDll = LoadLibrary(szBCryptDllPath);
+
+	    InterlockedCompareExchangeRelease(&wincng_available,
+					      !!hBCryptDll, -1);
+	    if (hBCryptDll)
+		FreeLibrary(hBCryptDll);
+	}
+    }
+
+    return wincng_available == 1;
+}
+
+BOOL WINAPI
+_hc_w32crypto_DllMain(HINSTANCE hinstDLL,
+		      DWORD fdwReason,
+		      LPVOID lpvReserved)
+{
+    if (fdwReason == DLL_PROCESS_DETACH) {
+	/*
+	 * Don't bother cleaning up on process exit, only on
+	 * FreeLibrary() (in which case lpvReserved will be NULL).
+	 */
+	if (lpvReserved == NULL)
+	    _hc_wincng_cleanup();
+    }
+
+    return TRUE;
+}
+
+#define EVP_W32CRYPTO_PROVIDER(type, name)		    \
+							    \
+    const type *hc_EVP_w32crypto_ ##name (void)		    \
+    {							    \
+	if (wincng_check_availability())		    \
+	    return hc_EVP_wincng_ ##name ();		    \
+	else if (HCRYPTO_FALLBACK)			    \
+	    return hc_EVP_hcrypto_ ##name ();		    \
+	else						    \
+	    return NULL;				    \
+    }
+
+#define EVP_W32CRYPTO_PROVIDER_CNG_UNAVAILABLE(type, name)  \
+							    \
+    const type *hc_EVP_w32crypto_ ##name (void)		    \
+    {							    \
+	return hc_EVP_hcrypto_ ##name ();		    \
+    }
+
+EVP_W32CRYPTO_PROVIDER(EVP_MD, md2)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, md4)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, md5)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, sha1)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, sha256)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, sha384)
+EVP_W32CRYPTO_PROVIDER(EVP_MD, sha512)
+
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, rc2_cbc)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, rc2_40_cbc)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, rc2_64_cbc)
+
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, rc4)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, rc4_40)
+
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, des_cbc)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, des_ede3_cbc)
+
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_128_cbc)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_192_cbc)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_256_cbc)
+
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_128_cfb8)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_192_cfb8)
+EVP_W32CRYPTO_PROVIDER(EVP_CIPHER, aes_256_cfb8)
+
+EVP_W32CRYPTO_PROVIDER_CNG_UNAVAILABLE(EVP_CIPHER, camellia_128_cbc)
+EVP_W32CRYPTO_PROVIDER_CNG_UNAVAILABLE(EVP_CIPHER, camellia_192_cbc)
+EVP_W32CRYPTO_PROVIDER_CNG_UNAVAILABLE(EVP_CIPHER, camellia_256_cbc)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.h
new file mode 100644
index 000000000..92318dc7c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-w32.h
@@ -0,0 +1,102 @@
+/*	$NetBSD: evp-w32.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIM_EVP_W32_H
+#define HEIM_EVP_W32_H 1
+
+/* symbol renaming */
+#define EVP_w32crypto_md2() hc_EVP_w32crypto_md2()
+#define EVP_w32crypto_md4() hc_EVP_w32crypto_md4()
+#define EVP_w32crypto_md5() hc_EVP_w32crypto_md5()
+#define EVP_w32crypto_sha1() hc_EVP_w32crypto_sha1()
+#define EVP_w32crypto_sha256() hc_EVP_w32crypto_sha256()
+#define EVP_w32crypto_sha384() hc_EVP_w32crypto_sha384()
+#define EVP_w32crypto_sha512() hc_EVP_w32crypto_sha512()
+#define EVP_w32crypto_des_cbc() hc_EVP_w32crypto_des_cbc()
+#define EVP_w32crypto_des_ede3_cbc() hc_EVP_w32crypto_des_ede3_cbc()
+#define EVP_w32crypto_aes_128_cbc() hc_EVP_w32crypto_aes_128_cbc()
+#define EVP_w32crypto_aes_192_cbc() hc_EVP_w32crypto_aes_192_cbc()
+#define EVP_w32crypto_aes_256_cbc() hc_EVP_w32crypto_aes_256_cbc()
+#define EVP_w32crypto_aes_128_cfb8() hc_EVP_w32crypto_aes_128_cfb8()
+#define EVP_w32crypto_aes_192_cfb8() hc_EVP_w32crypto_aes_192_cfb8()
+#define EVP_w32crypto_aes_256_cfb8() hc_EVP_w32crypto_aes_256_cfb8()
+#define EVP_w32crypto_rc4() hc_EVP_w32crypto_rc4()
+#define EVP_w32crypto_rc4_40() hc_EVP_w32crypto_rc4_40()
+#define EVP_w32crypto_rc2_40_cbc() hc_EVP_w32crypto_rc2_40_cbc()
+#define EVP_w32crypto_rc2_64_cbc() hc_EVP_w32crypto_rc2_64_cbc()
+#define EVP_w32crypto_rc2_cbc() hc_EVP_w32crypto_rc2_cbc()
+#define EVP_w32crypto_camellia_128_cbc() hc_EVP_w32crypto_camellia_128_cbc()
+#define EVP_w32crypto_camellia_192_cbc() hc_EVP_w32crypto_camellia_192_cbc()
+#define EVP_w32crypto_camellia_256_cbc() hc_EVP_w32crypto_camellia_256_cbc()
+
+/*
+ * This provider dynamically selects between Windows CNG (if running
+ * on Vista or above) or the inbuilt provider (if running on XP).
+ */
+
+HC_CPP_BEGIN
+
+const EVP_MD * hc_EVP_w32crypto_md2(void);
+const EVP_MD * hc_EVP_w32crypto_md4(void);
+const EVP_MD * hc_EVP_w32crypto_md5(void);
+const EVP_MD * hc_EVP_w32crypto_sha1(void);
+const EVP_MD * hc_EVP_w32crypto_sha256(void);
+const EVP_MD * hc_EVP_w32crypto_sha384(void);
+const EVP_MD * hc_EVP_w32crypto_sha512(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_des_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_des_ede3_cbc(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_aes_128_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_aes_192_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_aes_256_cbc(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_aes_128_cfb8(void);
+const EVP_CIPHER * hc_EVP_w32crypto_aes_192_cfb8(void);
+const EVP_CIPHER * hc_EVP_w32crypto_aes_256_cfb8(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_rc4(void);
+const EVP_CIPHER * hc_EVP_w32crypto_rc4_40(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_rc2_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_rc2_40_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_rc2_64_cbc(void);
+
+const EVP_CIPHER * hc_EVP_w32crypto_camellia_128_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_camellia_192_cbc(void);
+const EVP_CIPHER * hc_EVP_w32crypto_camellia_256_cbc(void);
+
+HC_CPP_END
+
+#endif /* HEIM_EVP_W32_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.c
new file mode 100644
index 000000000..1f95f41cd
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.c
@@ -0,0 +1,707 @@
+/*	$NetBSD: evp-wincng.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Windows CNG provider */
+
+#include <config.h>
+#include <krb5/roken.h>
+#include <assert.h>
+
+#include <evp.h>
+#include <evp-wincng.h>
+
+#include <bcrypt.h>
+
+/*
+ * CNG cipher provider
+ */
+
+struct wincng_key {
+    BCRYPT_KEY_HANDLE hKey;
+    UCHAR rgbKeyObject[1];
+};
+
+#define WINCNG_KEY_OBJECT_SIZE(ctx) \
+	((ctx)->cipher->ctx_size - sizeof(struct wincng_key) + 1)
+
+static int
+wincng_do_cipher(EVP_CIPHER_CTX *ctx,
+		 unsigned char *out,
+		 const unsigned char *in,
+		 unsigned int size)
+{
+    struct wincng_key *cng = ctx->cipher_data;
+    NTSTATUS status;
+    ULONG cbResult;
+
+    assert(EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_STREAM_CIPHER ||
+	   (size % ctx->cipher->block_size) == 0);
+
+    if (ctx->encrypt) {
+	status = BCryptEncrypt(cng->hKey,
+			       (PUCHAR)in,
+			       size,
+			       NULL, /* pPaddingInfo */
+			       ctx->cipher->iv_len ? ctx->iv : NULL,
+			       ctx->cipher->iv_len,
+			       out,
+			       size,
+			       &cbResult,
+			       0);
+    } else {
+	status = BCryptDecrypt(cng->hKey,
+			       (PUCHAR)in,
+			       size,
+			       NULL, /* pPaddingInfo */
+			       ctx->cipher->iv_len ? ctx->iv : NULL,
+			       ctx->cipher->iv_len,
+			       out,
+			       size,
+			       &cbResult,
+			       0);
+    }
+
+    return BCRYPT_SUCCESS(status) && cbResult == size;
+}
+
+static int
+wincng_cleanup(EVP_CIPHER_CTX *ctx)
+{
+    struct wincng_key *cng = ctx->cipher_data;
+
+    if (cng->hKey)
+	BCryptDestroyKey(cng->hKey);
+    SecureZeroMemory(cng->rgbKeyObject, WINCNG_KEY_OBJECT_SIZE(ctx));
+
+    return 1;
+}
+
+static int
+wincng_cipher_algorithm_init(EVP_CIPHER *cipher,
+			     LPWSTR pszAlgId)
+{
+    BCRYPT_ALG_HANDLE hAlgorithm = NULL;
+    NTSTATUS status;
+    LPCWSTR pszChainingMode;
+    ULONG cbKeyObject, cbChainingMode, cbData;
+
+    if (cipher->app_data)
+	return 1;
+
+    status = BCryptOpenAlgorithmProvider(&hAlgorithm,
+					 pszAlgId,
+					 NULL,
+					 0);
+    if (!BCRYPT_SUCCESS(status))
+	return 0;
+
+    status = BCryptGetProperty(hAlgorithm,
+			       BCRYPT_OBJECT_LENGTH,
+			       (PUCHAR)&cbKeyObject,
+			       sizeof(ULONG),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status)) {
+	BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	return 0;
+    }
+
+    cipher->ctx_size = sizeof(struct wincng_key) + cbKeyObject - 1;
+
+    switch (cipher->flags & EVP_CIPH_MODE) {
+    case EVP_CIPH_CBC_MODE:
+	pszChainingMode = BCRYPT_CHAIN_MODE_CBC;
+	cbChainingMode = sizeof(BCRYPT_CHAIN_MODE_CBC);
+	break;
+    case EVP_CIPH_CFB8_MODE:
+	pszChainingMode = BCRYPT_CHAIN_MODE_CFB;
+	cbChainingMode = sizeof(BCRYPT_CHAIN_MODE_CFB);
+	break;
+    default:
+	pszChainingMode = NULL;
+	cbChainingMode = 0;
+	break;
+    }
+
+    if (cbChainingMode) {
+	status = BCryptSetProperty(hAlgorithm,
+				   BCRYPT_CHAINING_MODE,
+				   (PUCHAR)pszChainingMode,
+				   cbChainingMode,
+				   0);
+	if (!BCRYPT_SUCCESS(status)) {
+	    BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	    return 0;
+	}
+    }
+
+    if (wcscmp(pszAlgId, BCRYPT_RC2_ALGORITHM) == 0) {
+	ULONG cbEffectiveKeyLength = EVP_CIPHER_key_length(cipher) * 8;
+
+	status = BCryptSetProperty(hAlgorithm,
+				   BCRYPT_EFFECTIVE_KEY_LENGTH,
+				   (PUCHAR)&cbEffectiveKeyLength,
+				   sizeof(cbEffectiveKeyLength),
+				   0);
+	if (!BCRYPT_SUCCESS(status)) {
+	    BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	    return 0;
+	}
+    }
+
+    InterlockedCompareExchangePointerRelease(&cipher->app_data,
+					     hAlgorithm, NULL);
+    return 1;
+}
+
+static int
+wincng_key_init(EVP_CIPHER_CTX *ctx,
+		const unsigned char *key,
+		const unsigned char *iv,
+		int encp)
+{
+    struct wincng_key *cng = ctx->cipher_data;
+    NTSTATUS status;
+
+    assert(cng != NULL);
+    assert(ctx->cipher != NULL);
+
+    if (ctx->cipher->app_data == NULL)
+	return 0;
+
+    /*
+     * Note: ctx->key_len not EVP_CIPHER_CTX_key_length() for
+     * variable length key support.
+     */
+    status = BCryptGenerateSymmetricKey(ctx->cipher->app_data,
+					&cng->hKey,
+					cng->rgbKeyObject,
+					WINCNG_KEY_OBJECT_SIZE(ctx),
+					(PUCHAR)key,
+					ctx->key_len,
+					0);
+
+    return BCRYPT_SUCCESS(status);
+}
+
+#define WINCNG_CIPHER_ALGORITHM(name, alg_id, block_size, key_len,      \
+				iv_len, flags)				\
+									\
+    static EVP_CIPHER							\
+    wincng_##name = {							\
+	0,								\
+	block_size,							\
+	key_len,							\
+	iv_len,								\
+	flags,								\
+	wincng_key_init,						\
+	wincng_do_cipher,						\
+	wincng_cleanup,							\
+	0,								\
+	NULL,								\
+	NULL,								\
+	NULL,								\
+	NULL								\
+    };									\
+									\
+    const EVP_CIPHER *							\
+    hc_EVP_wincng_##name(void)						\
+    {									\
+	wincng_cipher_algorithm_init(&wincng_##name, alg_id);		\
+	return wincng_##name.app_data ? &wincng_##name : NULL;		\
+    }
+
+#define WINCNG_CIPHER_ALGORITHM_CLEANUP(name) do {			\
+	if (wincng_##name.app_data) {					\
+	    BCryptCloseAlgorithmProvider(wincng_##name.app_data, 0);	\
+	    wincng_##name.app_data = NULL;				\
+	}								\
+    } while (0)
+
+#define WINCNG_CIPHER_ALGORITHM_UNAVAILABLE(name)			\
+									\
+    const EVP_CIPHER *							\
+    hc_EVP_wincng_##name(void)						\
+    {									\
+	return NULL;							\
+    }
+
+/**
+ * The triple DES cipher type (Windows CNG provider)
+ *
+ * @return the DES-EDE3-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(des_ede3_cbc,
+			BCRYPT_3DES_ALGORITHM,
+			8,
+			24,
+			8,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The DES cipher type (Windows CNG provider)
+ *
+ * @return the DES-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(des_cbc,
+			BCRYPT_DES_ALGORITHM,
+			8,
+			8,
+			8,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The AES-128 cipher type (Windows CNG provider)
+ *
+ * @return the AES-128-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_128_cbc,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			16,
+			16,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The AES-192 cipher type (Windows CNG provider)
+ *
+ * @return the AES-192-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_192_cbc,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			24,
+			16,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The AES-256 cipher type (Windows CNG provider)
+ *
+ * @return the AES-256-CBC EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_256_cbc,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			32,
+			16,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The AES-128 CFB8 cipher type (Windows CNG provider)
+ *
+ * @return the AES-128-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_128_cfb8,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			16,
+			16,
+			EVP_CIPH_CFB8_MODE);
+
+/**
+ * The AES-192 CFB8 cipher type (Windows CNG provider)
+ *
+ * @return the AES-192-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_192_cfb8,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			24,
+			16,
+			EVP_CIPH_CFB8_MODE);
+
+/**
+ * The AES-256 CFB8 cipher type (Windows CNG provider)
+ *
+ * @return the AES-256-CFB8 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(aes_256_cfb8,
+			BCRYPT_AES_ALGORITHM,
+			16,
+			32,
+			16,
+			EVP_CIPH_CFB8_MODE);
+
+/**
+ * The RC2 cipher type - Windows CNG
+ *
+ * @return the RC2 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(rc2_cbc,
+			BCRYPT_RC2_ALGORITHM,
+			8,
+			16,
+			8,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The RC2-40 cipher type - Windows CNG
+ *
+ * @return the RC2-40 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(rc2_40_cbc,
+			BCRYPT_RC2_ALGORITHM,
+			8,
+			5,
+			8,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The RC2-64 cipher type - Windows CNG
+ *
+ * @return the RC2-64 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(rc2_64_cbc,
+			BCRYPT_RC2_ALGORITHM,
+			8,
+			8,
+			8,
+			EVP_CIPH_CBC_MODE);
+
+/**
+ * The Camellia-128 cipher type - CommonCrypto
+ *
+ * @return the Camellia-128 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM_UNAVAILABLE(camellia_128_cbc);
+
+/**
+ * The Camellia-198 cipher type - CommonCrypto
+ *
+ * @return the Camellia-198 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM_UNAVAILABLE(camellia_192_cbc);
+
+/**
+ * The Camellia-256 cipher type - CommonCrypto
+ *
+ * @return the Camellia-256 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM_UNAVAILABLE(camellia_256_cbc);
+
+/**
+ * The RC4 cipher type (Windows CNG provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(rc4,
+			BCRYPT_RC4_ALGORITHM,
+			1,
+			16,
+			0,
+			EVP_CIPH_STREAM_CIPHER | EVP_CIPH_VARIABLE_LENGTH);
+
+/**
+ * The RC4-40 cipher type (Windows CNG provider)
+ *
+ * @return the RC4 EVP_CIPHER pointer.
+ *
+ * @ingroup hcrypto_evp
+ */
+
+WINCNG_CIPHER_ALGORITHM(rc4_40,
+			BCRYPT_RC4_ALGORITHM,
+			1,
+			5,
+			0,
+			EVP_CIPH_STREAM_CIPHER | EVP_CIPH_VARIABLE_LENGTH);
+
+static void
+wincng_cipher_algorithm_cleanup(void)
+{
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(des_ede3_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(des_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_128_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_192_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_256_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_128_cfb8);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_192_cfb8);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(aes_256_cfb8);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(rc2_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(rc2_40_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(rc2_64_cbc);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(rc4);
+    WINCNG_CIPHER_ALGORITHM_CLEANUP(rc4_40);
+}
+
+/*
+ * CNG digest provider
+ */
+
+struct wincng_md_ctx {
+    BCRYPT_HASH_HANDLE hHash;
+    ULONG cbHashObject;
+    UCHAR rgbHashObject[1];
+};
+
+static BCRYPT_ALG_HANDLE
+wincng_md_algorithm_init(EVP_MD *md,
+			 LPCWSTR pszAlgId)
+{
+    BCRYPT_ALG_HANDLE hAlgorithm;
+    NTSTATUS status;
+    ULONG cbHashObject, cbData;
+    ULONG cbHash = 0, cbBlock = 0;
+
+    status = BCryptOpenAlgorithmProvider(&hAlgorithm,
+					 pszAlgId,
+					 NULL,
+					 0);
+    if (!BCRYPT_SUCCESS(status))
+	return NULL;
+
+    status = BCryptGetProperty(hAlgorithm,
+			       BCRYPT_HASH_LENGTH,
+			       (PUCHAR)&cbHash,
+			       sizeof(ULONG),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status)) {
+	BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	return NULL;
+    }
+
+    status = BCryptGetProperty(hAlgorithm,
+			       BCRYPT_HASH_BLOCK_LENGTH,
+			       (PUCHAR)&cbBlock,
+			       sizeof(ULONG),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status)) {
+	BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	return NULL;
+    }
+
+    status = BCryptGetProperty(hAlgorithm,
+			       BCRYPT_OBJECT_LENGTH,
+			       (PUCHAR)&cbHashObject,
+			       sizeof(ULONG),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status)) {
+	BCryptCloseAlgorithmProvider(hAlgorithm, 0);
+	return NULL;
+    }
+
+    md->hash_size = cbHash;
+    md->block_size = cbBlock;
+    md->ctx_size = sizeof(struct wincng_md_ctx) + cbHashObject - 1;
+
+    return hAlgorithm;
+}
+
+static int
+wincng_md_hash_init(BCRYPT_ALG_HANDLE hAlgorithm,
+		    EVP_MD_CTX *ctx)
+{
+    struct wincng_md_ctx *cng = (struct wincng_md_ctx *)ctx;
+    NTSTATUS status;
+    ULONG cbData;
+
+    status = BCryptGetProperty(hAlgorithm,
+			       BCRYPT_OBJECT_LENGTH,
+			       (PUCHAR)&cng->cbHashObject,
+			       sizeof(ULONG),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status))
+	return 0;
+
+    status = BCryptCreateHash(hAlgorithm,
+			      &cng->hHash,
+			      cng->rgbHashObject,
+			      cng->cbHashObject,
+			      NULL,
+			      0,
+			      0);
+
+    return BCRYPT_SUCCESS(status);
+}
+
+static int
+wincng_md_update(EVP_MD_CTX *ctx,
+		 const void *data,
+		 size_t length)
+{
+    struct wincng_md_ctx *cng = (struct wincng_md_ctx *)ctx;
+    NTSTATUS status;
+
+    status = BCryptHashData(cng->hHash, (PUCHAR)data, length, 0);
+
+    return BCRYPT_SUCCESS(status);
+}
+
+static int
+wincng_md_final(void *digest,
+		EVP_MD_CTX *ctx)
+{
+    struct wincng_md_ctx *cng = (struct wincng_md_ctx *)ctx;
+    NTSTATUS status;
+    ULONG cbHash, cbData;
+
+    status = BCryptGetProperty(cng->hHash,
+			       BCRYPT_HASH_LENGTH,
+			       (PUCHAR)&cbHash,
+			       sizeof(DWORD),
+			       &cbData,
+			       0);
+    if (!BCRYPT_SUCCESS(status))
+	return 0;
+
+    status = BCryptFinishHash(cng->hHash,
+			      digest,
+			      cbHash,
+			      0);
+
+    return BCRYPT_SUCCESS(status);
+}
+
+static int
+wincng_md_cleanup(EVP_MD_CTX *ctx)
+{
+    struct wincng_md_ctx *cng = (struct wincng_md_ctx *)ctx;
+
+    if (cng->hHash)
+	BCryptDestroyHash(cng->hHash);
+    SecureZeroMemory(cng->rgbHashObject, cng->cbHashObject);
+
+    return 1;
+}
+
+#define WINCNG_MD_ALGORITHM(name, alg_id)				\
+									\
+    static BCRYPT_ALG_HANDLE wincng_hAlgorithm_##name;			\
+									\
+    static int wincng_##name##_init(EVP_MD_CTX *ctx)			\
+    {									\
+	return wincng_md_hash_init(wincng_hAlgorithm_##name, ctx);	\
+    }									\
+									\
+    const EVP_MD *							\
+    hc_EVP_wincng_##name(void)						\
+    {									\
+	static struct hc_evp_md name = {				\
+	    0,								\
+	    0,								\
+	    0,								\
+	    wincng_##name##_init,					\
+	    wincng_md_update,						\
+	    wincng_md_final,						\
+	    wincng_md_cleanup						\
+	};								\
+									\
+	if (wincng_hAlgorithm_##name == NULL) {				\
+	    BCRYPT_ALG_HANDLE hAlgorithm =				\
+		wincng_md_algorithm_init(&name, alg_id);		\
+	    InterlockedCompareExchangePointerRelease(			\
+		&wincng_hAlgorithm_##name, hAlgorithm, NULL);		\
+	}								\
+	return wincng_hAlgorithm_##name ? &name : NULL;			\
+    }
+
+#define WINCNG_MD_ALGORITHM_CLEANUP(name) do {				\
+	if (wincng_hAlgorithm_##name) {					\
+	    BCryptCloseAlgorithmProvider(wincng_hAlgorithm_##name, 0);	\
+	    wincng_hAlgorithm_##name = NULL;				\
+	}								\
+    } while (0)
+
+WINCNG_MD_ALGORITHM(md2,    BCRYPT_MD2_ALGORITHM);
+WINCNG_MD_ALGORITHM(md4,    BCRYPT_MD4_ALGORITHM);
+WINCNG_MD_ALGORITHM(md5,    BCRYPT_MD5_ALGORITHM);
+WINCNG_MD_ALGORITHM(sha1,   BCRYPT_SHA1_ALGORITHM);
+WINCNG_MD_ALGORITHM(sha256, BCRYPT_SHA256_ALGORITHM);
+WINCNG_MD_ALGORITHM(sha384, BCRYPT_SHA384_ALGORITHM);
+WINCNG_MD_ALGORITHM(sha512, BCRYPT_SHA512_ALGORITHM);
+
+static void
+wincng_md_algorithm_cleanup(void)
+{
+    WINCNG_MD_ALGORITHM_CLEANUP(md2);
+    WINCNG_MD_ALGORITHM_CLEANUP(md4);
+    WINCNG_MD_ALGORITHM_CLEANUP(md5);
+    WINCNG_MD_ALGORITHM_CLEANUP(sha1);
+    WINCNG_MD_ALGORITHM_CLEANUP(sha256);
+    WINCNG_MD_ALGORITHM_CLEANUP(sha384);
+    WINCNG_MD_ALGORITHM_CLEANUP(sha512);
+}
+
+void _hc_wincng_cleanup(void)
+{
+    wincng_md_algorithm_cleanup();
+    wincng_cipher_algorithm_cleanup();
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.h
new file mode 100644
index 000000000..cea1b5e96
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp-wincng.h
@@ -0,0 +1,99 @@
+/*	$NetBSD: evp-wincng.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIM_EVP_WINCNG_H
+#define HEIM_EVP_WINCNG_H 1
+
+/* symbol renaming */
+#define EVP_wincng_md2() EVP_wincng_md2()
+#define EVP_wincng_md4() EVP_wincng_md4()
+#define EVP_wincng_md5() EVP_wincng_md5()
+#define EVP_wincng_sha1() EVP_wincng_sha1()
+#define EVP_wincng_sha256() EVP_wincng_sha256()
+#define EVP_wincng_sha384() EVP_wincng_sha384()
+#define EVP_wincng_sha512() EVP_wincng_sha512()
+#define EVP_wincng_des_cbc() EVP_wincng_des_cbc()
+#define EVP_wincng_des_ede3_cbc() EVP_wincng_des_ede3_cbc()
+#define EVP_wincng_aes_128_cbc() EVP_wincng_aes_128_cbc()
+#define EVP_wincng_aes_192_cbc() EVP_wincng_aes_192_cbc()
+#define EVP_wincng_aes_256_cbc() EVP_wincng_aes_256_cbc()
+#define EVP_wincng_aes_128_cfb8() EVP_wincng_aes_128_cfb8()
+#define EVP_wincng_aes_192_cfb8() EVP_wincng_aes_192_cfb8()
+#define EVP_wincng_aes_256_cfb8() EVP_wincng_aes_256_cfb8()
+#define EVP_wincng_rc4() EVP_wincng_rc4()
+#define EVP_wincng_rc4_40() EVP_wincng_rc4_40()
+#define EVP_wincng_rc2_40_cbc() EVP_wincng_rc2_40_cbc()
+#define EVP_wincng_rc2_64_cbc() EVP_wincng_rc2_64_cbc()
+#define EVP_wincng_rc2_cbc() EVP_wincng_rc2_cbc()
+#define EVP_wincng_camellia_128_cbc() EVP_wincng_camellia_128_cbc()
+#define EVP_wincng_camellia_192_cbc() EVP_wincng_camellia_192_cbc()
+#define EVP_wincng_camellia_256_cbc() EVP_wincng_camellia_256_cbc()
+
+/*
+ *
+ */
+
+HC_CPP_BEGIN
+
+const EVP_MD * hc_EVP_wincng_md2(void);
+const EVP_MD * hc_EVP_wincng_md4(void);
+const EVP_MD * hc_EVP_wincng_md5(void);
+const EVP_MD * hc_EVP_wincng_sha1(void);
+const EVP_MD * hc_EVP_wincng_sha256(void);
+const EVP_MD * hc_EVP_wincng_sha384(void);
+const EVP_MD * hc_EVP_wincng_sha512(void);
+
+const EVP_CIPHER * hc_EVP_wincng_rc2_cbc(void);
+const EVP_CIPHER * hc_EVP_wincng_rc2_40_cbc(void);
+const EVP_CIPHER * hc_EVP_wincng_rc2_64_cbc(void);
+
+const EVP_CIPHER * hc_EVP_wincng_rc4(void);
+const EVP_CIPHER * hc_EVP_wincng_rc4_40(void);
+
+const EVP_CIPHER * hc_EVP_wincng_des_cbc(void);
+const EVP_CIPHER * hc_EVP_wincng_des_ede3_cbc(void);
+
+const EVP_CIPHER * hc_EVP_wincng_aes_128_cbc(void);
+const EVP_CIPHER * hc_EVP_wincng_aes_192_cbc(void);
+const EVP_CIPHER * hc_EVP_wincng_aes_256_cbc(void);
+
+const EVP_CIPHER * hc_EVP_wincng_aes_128_cfb8(void);
+const EVP_CIPHER * hc_EVP_wincng_aes_192_cfb8(void);
+const EVP_CIPHER * hc_EVP_wincng_aes_256_cfb8(void);
+
+void _hc_wincng_cleanup(void);
+
+HC_CPP_END
+
+#endif /* HEIM_EVP_WINCNG_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.c
index 2356e1a31..98c18830d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: evp.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: evp.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -36,25 +36,34 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED
 #define HC_DEPRECATED_CRYPTO
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
 #include <evp-hcrypto.h>
 #include <evp-cc.h>
+#if defined(_WIN32)
+#include <evp-w32.h>
+#endif
+#include <evp-pkcs11.h>
+#include <evp-openssl.h>
 
 #include <krb5/krb5-types.h>
-#include <krb5/roken.h>
 
 #ifndef HCRYPTO_DEF_PROVIDER
-#define HCRYPTO_DEF_PROVIDER hcrypto
+# ifdef __APPLE__
+#  define HCRYPTO_DEF_PROVIDER cc
+# elif __sun
+#  define HCRYPTO_DEF_PROVIDER pkcs11_hcrypto
+# elif HAVE_HCRYPTO_W_OPENSSL
+#  define HCRYPTO_DEF_PROVIDER ossl
+# else
+#  define HCRYPTO_DEF_PROVIDER hcrypto
+# endif
 #endif
 
 #define HC_CONCAT4(x,y,z,aa)	x ## y ## z ## aa
@@ -177,10 +186,13 @@ EVP_MD_CTX_destroy(EVP_MD_CTX *ctx)
 int
 EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) HC_DEPRECATED
 {
-    if (ctx->md && ctx->md->cleanup)
-	(ctx->md->cleanup)(ctx);
-    else if (ctx->md)
+    if (ctx->md && ctx->md->cleanup) {
+	int ret = (ctx->md->cleanup)(ctx->ptr);
+	if (!ret)
+	    return ret;
+    } else if (ctx->md) {
 	memset(ctx->ptr, 0, ctx->md->ctx_size);
+    }
     ctx->md = NULL;
     ctx->engine = NULL;
     free(ctx->ptr);
@@ -255,13 +267,16 @@ EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *md, ENGINE *engine)
 	EVP_MD_CTX_cleanup(ctx);
 	ctx->md = md;
 	ctx->engine = engine;
+        if (md == NULL)
+            return 0;
 
 	ctx->ptr = calloc(1, md->ctx_size);
 	if (ctx->ptr == NULL)
 	    return 0;
     }
-    (ctx->md->init)(ctx->ptr);
-    return 1;
+    if (ctx->md == 0)
+        return 0;
+    return (ctx->md->init)(ctx->ptr);
 }
 
 /**
@@ -584,10 +599,14 @@ EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *c)
 int
 EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
 {
-    if (c->cipher && c->cipher->cleanup)
-	c->cipher->cleanup(c);
+    if (c->cipher && c->cipher->cleanup) {
+	int ret = c->cipher->cleanup(c);
+	if (!ret)
+	    return ret;
+    }
     if (c->cipher_data) {
-	memset(c->cipher_data, 0, c->cipher->ctx_size);
+        if (c->cipher)
+            memset(c->cipher_data, 0, c->cipher->ctx_size);
 	free(c->cipher_data);
 	c->cipher_data = NULL;
     }
@@ -789,6 +808,10 @@ EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *c, ENGINE *engine,
 	/* assume block size is a multiple of 2 */
 	ctx->block_mask = EVP_CIPHER_block_size(c) - 1;
 
+        if ((ctx->cipher->flags & EVP_CIPH_CTRL_INIT) &&
+            !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL))
+            return 0;
+
     } else if (ctx->cipher == NULL) {
 	/* reuse of cipher, but not any cipher ever set! */
 	return 0;
@@ -816,7 +839,7 @@ EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *c, ENGINE *engine,
     }
 
     if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT))
-	ctx->cipher->init(ctx, key, iv, encp);
+	return ctx->cipher->init(ctx, key, iv, encp);
 
     return 1;
 }
@@ -1118,7 +1141,7 @@ EVP_des_cbc(void)
 }
 
 /**
- * The tripple DES cipher type
+ * The triple DES cipher type
  *
  * @return the DES-EDE3-CBC EVP_CIPHER pointer.
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.h
index ed5c34c8e..186a99ce5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/evp.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: evp.h,v 1.1.1.3 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: evp.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2005 - 2008 Kungliga Tekniska Högskolan
+ * Copyright (c) 2005 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -100,6 +100,7 @@
 #define EVP_sha256 hc_EVP_sha256
 #define EVP_sha384 hc_EVP_sha384
 #define EVP_sha512 hc_EVP_sha512
+#define PKCS5_PBKDF2_HMAC hc_PKCS5_PBKDF2_HMAC
 #define PKCS5_PBKDF2_HMAC_SHA1 hc_PKCS5_PBKDF2_HMAC_SHA1
 #define EVP_BytesToKey hc_EVP_BytesToKey
 #define EVP_get_cipherbyname hc_EVP_get_cipherbyname
@@ -110,6 +111,27 @@
 #define EVP_CIPHER_CTX_rand_key hc_EVP_CIPHER_CTX_rand_key
 #define hcrypto_validate hc_hcrypto_validate
 
+/* Type name renaming */
+#define EVP_MD_CTX hc_EVP_MD_CTX
+#define EVP_PKEY hc_EVP_PKEY
+#define EVP_MD hc_EVP_MD
+#define EVP_CIPHER hc_EVP_CIPHER
+#define EVP_CIPHER_CTX hc_EVP_CIPHER_CTX
+
+/* Constant renaming */
+#define EVP_CIPH_STREAM_CIPHER hc_EVP_CIPH_STREAM_CIPHER
+#define EVP_CIPH_CBC_MODE hc_EVP_CIPH_CBC_MODE
+#define EVP_CIPH_CFB8_MODE hc_EVP_CIPH_CFB8_MODE
+#define EVP_CIPH_MODE hc_EVP_CIPH_MODE
+#define EVP_CIPH_CTRL_INIT hc_EVP_CIPH_CTRL_INIT
+
+#define EVP_CIPH_VARIABLE_LENGTH hc_EVP_CIPH_VARIABLE_LENGTH
+#define EVP_CIPH_ALWAYS_CALL_INIT hc_EVP_CIPH_ALWAYS_CALL_INIT
+#define EVP_CIPH_RAND_KEY hc_EVP_CIPH_RAND_KEY
+
+#define EVP_CTRL_INIT hc_EVP_CTRL_INIT
+
+
 /*
  *
  */
@@ -135,22 +157,25 @@ struct hc_CIPHER {
      * cipher is used in (use EVP_CIPHER.._mode() to extract the
      * mode). The rest of the flag field is a bitfield.
      */
-#define EVP_CIPH_STREAM_CIPHER		0
-#define EVP_CIPH_CBC_MODE		2
-#define EVP_CIPH_CFB8_MODE              4
-#define EVP_CIPH_MODE			0x7
+#define hc_EVP_CIPH_STREAM_CIPHER               0
+#define hc_EVP_CIPH_CBC_MODE                    2
+#define hc_EVP_CIPH_CFB8_MODE                   4
+#define hc_EVP_CIPH_MODE                        0x7
+#define hc_EVP_CIPH_CTRL_INIT                   0x40
 
-#define EVP_CIPH_VARIABLE_LENGTH	0x008 /* variable key length */
-#define EVP_CIPH_ALWAYS_CALL_INIT	0x020
-#define EVP_CIPH_RAND_KEY		0x200
+#define hc_EVP_CTRL_INIT                        0x0
+
+#define hc_EVP_CIPH_VARIABLE_LENGTH     0x008 /* variable key length */
+#define hc_EVP_CIPH_ALWAYS_CALL_INIT    0x020
+#define hc_EVP_CIPH_RAND_KEY            0x200
 
     int (*init)(EVP_CIPHER_CTX*,const unsigned char*,const unsigned char*,int);
     int (*do_cipher)(EVP_CIPHER_CTX *, unsigned char *,
 		     const unsigned char *, unsigned int);
     int (*cleanup)(EVP_CIPHER_CTX *);
     int ctx_size;
-    void *set_asn1_parameters;
-    void *get_asn1_parameters;
+    int (*set_asn1_parameters)(void);
+    int (*get_asn1_parameters)(void);
     int (*ctrl)(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
 #define EVP_CTRL_RAND_KEY		0x6
 
@@ -175,6 +200,10 @@ struct hc_CIPHER_CTX {
     unsigned char final[EVP_MAX_BLOCK_LENGTH];
 };
 
+/*
+ * LIES.  It's not an EVP_MD_CTX that gets passed to these functions
+ * here in hcrypto, but an object of ctx_size.
+ */
 typedef int (*hc_evp_md_init)(EVP_MD_CTX *);
 typedef int (*hc_evp_md_update)(EVP_MD_CTX *,const void *, size_t);
 typedef int (*hc_evp_md_final)(void *, EVP_MD_CTX *);
@@ -307,6 +336,9 @@ int	EVP_CipherFinal_ex(EVP_CIPHER_CTX *, void *, int *);
 
 int	EVP_Cipher(EVP_CIPHER_CTX *,void *,const void *,size_t);
 
+int	PKCS5_PBKDF2_HMAC(const void *, size_t, const void *, size_t,
+			  unsigned long, const EVP_MD *, size_t, void *);
+
 int	PKCS5_PBKDF2_HMAC_SHA1(const void *, size_t, const void *, size_t,
 			       unsigned long, size_t, void *);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/example_evp_cipher.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/example_evp_cipher.c
index 23334d125..cb8faeba2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/example_evp_cipher.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/example_evp_cipher.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: example_evp_cipher.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: example_evp_cipher.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -33,17 +33,22 @@
  * SUCH DAMAGE.
  */
 
+#include <config.h>
+#include <krb5/roken.h>
+
 #include <krb5/krb5-types.h> /* should really be stdint.h */
 #include <hcrypto/evp.h>
+#include <hcrypto/evp-pkcs11.h>
+#ifdef __APPLE__
+#include <hcrypto/evp-cc.h>
+#endif
+#ifdef _WIN32
+#include <hcrypto/evp-w32.h>
+#endif
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <err.h>
 #include <assert.h>
 
-#include <krb5/roken.h>
-
 /* key and initial vector */
 static char key[16] =
     "\xaa\xbb\x45\xd4\xaa\xbb\x45\xd4"
@@ -58,7 +63,7 @@ usage(int exit_code) __attribute__((noreturn));
 static void
 usage(int exit_code)
 {
-    printf("usage: %s in out\n", getprogname());
+    printf("usage: %s in out [pkcs11 | cc | w32]\n", getprogname());
     exit(exit_code);
 }
 
@@ -86,12 +91,26 @@ main(int argc, char **argv)
 	if (strcmp(argv[1], "--help") == 0)
 	    usage(0);
 	usage(1);
-    } else if (argc == 4) {
+    } else if (argc == 4 || argc == 5) {
 	block_size = atoi(argv[1]);
 	if (block_size == 0)
 	    errx(1, "invalid blocksize %s", argv[1]);
 	ifn = argv[2];
 	ofn = argv[3];
+        if (argc == 5) {
+            if (strcmp(argv[4], "pkcs11") == 0)
+                c = hc_EVP_pkcs11_aes_128_cbc();
+#ifdef __APPLE__
+            else if (strcmp(argv[4], "cc") == 0)
+                c = hc_EVP_cc_aes_128_cbc();
+#endif
+#ifdef _WIN32
+            else if (strcmp(argv[4], "w32") == 0)
+                c = hc_EVP_w32crypto_aes_128_cbc();
+#endif
+            else
+                usage(1);
+        }
     } else
 	usage(1);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hash.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hash.h
index 4aec107b6..362d56136 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hash.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hash.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hash.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: hash.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -42,7 +42,6 @@
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
-#include <krb5/roken.h>
 
 #ifndef min
 #define min(a,b) (((a)>(b))?(b):(a))
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.c
index a45be88b9..b4d939014 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hmac.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: hmac.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -33,10 +33,9 @@
  * SUCH DAMAGE.
  */
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <config.h>
+#include <krb5/roken.h>
+
 #include <hmac.h>
 
 void
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.h
index 317412479..a0fe74fc3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/hmac.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hmac.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: hmac.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libhcrypto-exports.def b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libhcrypto-exports.def
index a7208f931..ab692b4e5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libhcrypto-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libhcrypto-exports.def
@@ -167,6 +167,8 @@ EXPORTS
 ;!	hc_EVP_cc_md5
 ;!	hc_EVP_cc_sha1
 ;!	hc_EVP_cc_sha256
+;!	hc_EVP_cc_sha384
+;!	hc_EVP_cc_sha512
 ;!	hc_EVP_cc_des_ede3_cbc
 ;!	hc_EVP_cc_aes_128_cbc
 ;!	hc_EVP_cc_aes_192_cbc
@@ -175,6 +177,63 @@ EXPORTS
 ;!	hc_EVP_cc_aes_192_cfb8
 ;!	hc_EVP_cc_aes_256_cfb8
 
+	hc_EVP_ossl_md2
+	hc_EVP_ossl_md4
+	hc_EVP_ossl_md5
+	hc_EVP_ossl_sha1
+	hc_EVP_ossl_sha256
+	hc_EVP_ossl_sha384
+	hc_EVP_ossl_sha512
+	hc_EVP_ossl_des_ede3_cbc
+	hc_EVP_ossl_aes_128_cbc
+	hc_EVP_ossl_aes_192_cbc
+	hc_EVP_ossl_aes_256_cbc
+	hc_EVP_ossl_aes_128_cfb8
+	hc_EVP_ossl_aes_192_cfb8
+	hc_EVP_ossl_aes_256_cfb8
+	hc_EVP_ossl_rc2_cbc
+	hc_EVP_ossl_rc2_40_cbc
+	hc_EVP_ossl_rc4
+	hc_EVP_ossl_rc4_40
+
+	hc_EVP_pkcs11_md2
+	hc_EVP_pkcs11_md4
+	hc_EVP_pkcs11_md5
+	hc_EVP_pkcs11_sha1
+	hc_EVP_pkcs11_sha256
+	hc_EVP_pkcs11_des_ede3_cbc
+	hc_EVP_pkcs11_aes_128_cbc
+	hc_EVP_pkcs11_aes_192_cbc
+	hc_EVP_pkcs11_aes_256_cbc
+	hc_EVP_pkcs11_aes_128_cfb8
+	hc_EVP_pkcs11_aes_192_cfb8
+	hc_EVP_pkcs11_aes_256_cfb8
+	hc_EVP_pkcs11_rc2_40_cbc
+	hc_EVP_pkcs11_rc2_64_cbc
+	hc_EVP_pkcs11_rc2_cbc
+	hc_EVP_pkcs11_rc4
+	hc_EVP_pkcs11_rc4_40
+
+	hc_EVP_w32crypto_md2		;!
+	hc_EVP_w32crypto_md4		;!
+	hc_EVP_w32crypto_md5		;!
+	hc_EVP_w32crypto_sha1		;!
+	hc_EVP_w32crypto_sha256		;!
+	hc_EVP_w32crypto_sha384		;!
+	hc_EVP_w32crypto_sha512		;!
+	hc_EVP_w32crypto_des_ede3_cbc	;!
+	hc_EVP_w32crypto_aes_128_cbc	;!
+	hc_EVP_w32crypto_aes_192_cbc	;!
+	hc_EVP_w32crypto_aes_256_cbc	;!
+	hc_EVP_w32crypto_rc2_40_cbc	;!
+	hc_EVP_w32crypto_rc2_cbc	;!
+	hc_EVP_w32crypto_rc4		;!
+	hc_EVP_w32crypto_rc4_40		;!
+
+	hc_EVP_w32crypto_aes_128_cfb8	;!
+	hc_EVP_w32crypto_aes_192_cfb8	;!
+	hc_EVP_w32crypto_aes_256_cfb8	;!
+
 	hc_EVP_hcrypto_md2
 	hc_EVP_hcrypto_md4
 	hc_EVP_hcrypto_md5
@@ -217,13 +276,11 @@ EXPORTS
 	hc_OpenSSL_add_all_algorithms_conf
 	hc_OpenSSL_add_all_algorithms_noconf
 	hc_PKCS12_key_gen
+	hc_PKCS5_PBKDF2_HMAC
 	hc_PKCS5_PBKDF2_HMAC_SHA1
 	hc_RAND_add
 	hc_RAND_bytes
 	hc_RAND_cleanup
-;!	hc_RAND_egd
-;!	hc_RAND_egd_bytes
-;!	hc_RAND_egd_method
 	hc_RAND_file_name
 ;!	hc_RAND_fortuna_method
 	hc_RAND_get_rand_method
@@ -284,6 +341,7 @@ EXPORTS
 	hc_EVP_CIPHER_CTX_ctrl
 	hc_EVP_CIPHER_CTX_rand_key
 	hc_EVP_CIPHER_CTX_set_key_length
+	hc_EVP_hcrypto_rc2_cbc
 	hc_EVP_hcrypto_rc2_40_cbc
 	hc_EVP_hcrypto_camellia_128_cbc
 	hc_EVP_CipherUpdate
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_error.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_error.c
index 2301286ae..510171665 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_error.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: bn_error.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_ERROR_C
@@ -19,7 +19,7 @@
 
 static const struct {
      int code;
-     char *msg;
+     const char *msg;
 } msgs[] = {
      { MP_OKAY, "Successful" },
      { MP_MEM,  "Out of heap" },
@@ -27,7 +27,7 @@ static const struct {
 };
 
 /* return a char * string for a given code */
-char *mp_error_to_string(int code)
+const char *mp_error_to_string(int code)
 {
    int x;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_invmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_invmod.c
index 22daba5e6..3cefb88bd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_invmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_invmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_fast_mp_invmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_fast_mp_invmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_FAST_MP_INVMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_montgomery_reduce.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_montgomery_reduce.c
index 94bf27a43..54ed43276 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_montgomery_reduce.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_mp_montgomery_reduce.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_fast_mp_montgomery_reduce.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_fast_mp_montgomery_reduce.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_digs.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_digs.c
index 1c2a728e8..678c27949 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_digs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_digs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_fast_s_mp_mul_digs.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_fast_s_mp_mul_digs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_FAST_S_MP_MUL_DIGS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_high_digs.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_high_digs.c
index dae8a984e..da7978003 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_high_digs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_mul_high_digs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_fast_s_mp_mul_high_digs.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_fast_s_mp_mul_high_digs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_FAST_S_MP_MUL_HIGH_DIGS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_sqr.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_sqr.c
index 56791b2ac..9c811c060 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_sqr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_fast_s_mp_sqr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_fast_s_mp_sqr.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_fast_s_mp_sqr.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_FAST_S_MP_SQR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_2expt.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_2expt.c
index d66862713..4e4ba3a9d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_2expt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_2expt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_2expt.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_2expt.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_2EXPT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_abs.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_abs.c
index 2c20b2723..a307d8519 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_abs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_abs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_abs.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_abs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ABS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add.c
index 33f852d90..d9ed6b639 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_add.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_add.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ADD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add_d.c
index 05e940875..4cc0b9822 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_add_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_add_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_add_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ADD_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_addmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_addmod.c
index cd8abafc6..fb9f1295d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_addmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_addmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_addmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_addmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ADDMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_and.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_and.c
index 6ff51e005..b2dcfc048 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_and.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_and.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_and.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_and.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_AND_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clamp.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clamp.c
index 6c1f403cb..7681879be 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clamp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clamp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_clamp.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_clamp.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CLAMP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear.c
index 988b14766..f9075467a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_clear.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_clear.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CLEAR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear_multi.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear_multi.c
index 932df29b3..3b35fc47d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear_multi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_clear_multi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_clear_multi.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_clear_multi.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CLEAR_MULTI_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp.c
index 5794fe4b3..807c1231b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_cmp.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_cmp.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CMP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_d.c
index 9fb083b2f..01bed67e0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_cmp_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_cmp_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CMP_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_mag.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_mag.c
index 7b405f245..19932b8af 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_mag.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cmp_mag.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_cmp_mag.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_cmp_mag.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CMP_MAG_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cnt_lsb.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cnt_lsb.c
index e9f4ad8eb..398298c38 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cnt_lsb.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_cnt_lsb.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_cnt_lsb.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_cnt_lsb.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_CNT_LSB_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_copy.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_copy.c
index 1ddfa92a9..60b80a010 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_copy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_copy.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_copy.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_COPY_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_count_bits.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_count_bits.c
index b733d1428..60526d2eb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_count_bits.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_count_bits.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_count_bits.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_count_bits.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_COUNT_BITS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div.c
index 9740cf952..2b6131ece 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_div.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_div.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DIV_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2.c
index baf3153f7..344c41d66 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_div_2.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_div_2.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DIV_2_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2d.c
index 0721fd8f3..1180ef63a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_2d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_div_2d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_div_2d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DIV_2D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_3.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_3.c
index 85c65e69f..95e958965 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_3.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_3.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_div_3.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_div_3.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DIV_3_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_d.c
index a830f379c..02904164c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_div_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_div_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_div_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DIV_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_is_modulus.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_is_modulus.c
index 38ab295b2..1f6144dc6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_is_modulus.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_is_modulus.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_dr_is_modulus.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_dr_is_modulus.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DR_IS_MODULUS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_reduce.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_reduce.c
index 22833ee13..6bde311d2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_reduce.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_reduce.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_dr_reduce.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_dr_reduce.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DR_REDUCE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_setup.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_setup.c
index a3a7834e6..3127443b3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_dr_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_dr_setup.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_dr_setup.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_DR_SETUP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exch.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exch.c
index 6a9b9a30d..7d0612e84 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exch.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exch.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_exch.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_exch.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_EXCH_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_expt_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_expt_d.c
index 38cd1cbd7..fc2afe418 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_expt_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_expt_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_expt_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_expt_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_EXPT_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod.c
index 799360ba4..21a8f32bf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_exptmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_exptmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_EXPTMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod_fast.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod_fast.c
index d90db1797..34a7b4eb4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod_fast.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exptmod_fast.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_exptmod_fast.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_exptmod_fast.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_EXPTMOD_FAST_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exteuclid.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exteuclid.c
index e1e9c82d1..5d3f2e795 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exteuclid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_exteuclid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_exteuclid.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_exteuclid.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_EXTEUCLID_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_find_prime.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_find_prime.c
index 35cf16f79..f32f44fd2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_find_prime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_find_prime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_find_prime.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_find_prime.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* TomsFastMath, a fast ISO C bignum library.
  *
@@ -7,17 +7,26 @@
  * Love Hornquist Astrand <lha@h5l.org>
  */
 #include <tommath.h>
-
-int mp_find_prime(mp_int *a)
+#ifdef BN_MP_FIND_PRIME_C
+int mp_find_prime(mp_int *a, int t)
 {
-  int res;
+  int res = MP_NO;
+
+  /* valid value of t? */
+  if (t <= 0 || t > PRIME_SIZE) {
+    return MP_VAL;
+  }
 
   if (mp_iseven(a))
     mp_add_d(a, 1, a);
 
   do {
+    if (mp_prime_is_prime(a, t, &res) != 0) {
+      res = MP_VAL;
+      break;
+    }
 
-    if ((res = mp_isprime(a)) == MP_NO) {
+    if (res == MP_NO) {
       mp_add_d(a, 2, a);
       continue;
     }
@@ -26,3 +35,4 @@ int mp_find_prime(mp_int *a)
 
   return res;
 }
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fread.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fread.c
index ae6a4b1f5..098745aea 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fread.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fread.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_fread.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_fread.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_FREAD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fwrite.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fwrite.c
index 014a5b74b..c88047700 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fwrite.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_fwrite.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_fwrite.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_fwrite.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_FWRITE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_gcd.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_gcd.c
index dd9496852..ae4ca12ff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_gcd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_gcd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_gcd.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_gcd.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_GCD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_get_int.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_get_int.c
index e41a2f0e5..edf258dc7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_get_int.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_get_int.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_get_int.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_get_int.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_GET_INT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_grow.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_grow.c
index 400d29a4d..f364e06f8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_grow.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_grow.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_grow.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_grow.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_GROW_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init.c
index 328467b9e..daee2ce73 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_copy.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_copy.c
index 69aeeff77..cc20ba34c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_copy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init_copy.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init_copy.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_COPY_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_multi.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_multi.c
index 659de6381..fc95eeec1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_multi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_multi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init_multi.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init_multi.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_MULTI_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set.c
index 02644d6c2..36029bdbf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init_set.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init_set.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_SET_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set_int.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set_int.c
index 051c090d7..6b9bfad2e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set_int.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_set_int.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init_set_int.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init_set_int.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_SET_INT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_size.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_size.c
index 523f7f26a..6e6d37245 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_size.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_init_size.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_init_size.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_init_size.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INIT_SIZE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod.c
index ec20e8079..a058f0902 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_invmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_invmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INVMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod_slow.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod_slow.c
index be29dc60e..502b06642 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod_slow.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_invmod_slow.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_invmod_slow.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_invmod_slow.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_INVMOD_SLOW_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_is_square.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_is_square.c
index 7d54a9a58..0ab41c518 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_is_square.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_is_square.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_is_square.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_is_square.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_IS_SQUARE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_isprime.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_isprime.c
deleted file mode 100644
index 98edc6908..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_isprime.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/*	$NetBSD: bn_mp_isprime.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
-
-/* TomsFastMath, a fast ISO C bignum library.
- *
- * This project is meant to fill in where LibTomMath
- * falls short.  That is speed ;-)
- *
- * This project is public domain and free for all purposes.
- *
- * Tom St Denis, tomstdenis@gmail.com
- */
-#include <tommath.h>
-
-/* a few primes */
-static const mp_digit primes[256] = {
-  0x0002, 0x0003, 0x0005, 0x0007, 0x000B, 0x000D, 0x0011, 0x0013,
-  0x0017, 0x001D, 0x001F, 0x0025, 0x0029, 0x002B, 0x002F, 0x0035,
-  0x003B, 0x003D, 0x0043, 0x0047, 0x0049, 0x004F, 0x0053, 0x0059,
-  0x0061, 0x0065, 0x0067, 0x006B, 0x006D, 0x0071, 0x007F, 0x0083,
-  0x0089, 0x008B, 0x0095, 0x0097, 0x009D, 0x00A3, 0x00A7, 0x00AD,
-  0x00B3, 0x00B5, 0x00BF, 0x00C1, 0x00C5, 0x00C7, 0x00D3, 0x00DF,
-  0x00E3, 0x00E5, 0x00E9, 0x00EF, 0x00F1, 0x00FB, 0x0101, 0x0107,
-  0x010D, 0x010F, 0x0115, 0x0119, 0x011B, 0x0125, 0x0133, 0x0137,
-
-  0x0139, 0x013D, 0x014B, 0x0151, 0x015B, 0x015D, 0x0161, 0x0167,
-  0x016F, 0x0175, 0x017B, 0x017F, 0x0185, 0x018D, 0x0191, 0x0199,
-  0x01A3, 0x01A5, 0x01AF, 0x01B1, 0x01B7, 0x01BB, 0x01C1, 0x01C9,
-  0x01CD, 0x01CF, 0x01D3, 0x01DF, 0x01E7, 0x01EB, 0x01F3, 0x01F7,
-  0x01FD, 0x0209, 0x020B, 0x021D, 0x0223, 0x022D, 0x0233, 0x0239,
-  0x023B, 0x0241, 0x024B, 0x0251, 0x0257, 0x0259, 0x025F, 0x0265,
-  0x0269, 0x026B, 0x0277, 0x0281, 0x0283, 0x0287, 0x028D, 0x0293,
-  0x0295, 0x02A1, 0x02A5, 0x02AB, 0x02B3, 0x02BD, 0x02C5, 0x02CF,
-
-  0x02D7, 0x02DD, 0x02E3, 0x02E7, 0x02EF, 0x02F5, 0x02F9, 0x0301,
-  0x0305, 0x0313, 0x031D, 0x0329, 0x032B, 0x0335, 0x0337, 0x033B,
-  0x033D, 0x0347, 0x0355, 0x0359, 0x035B, 0x035F, 0x036D, 0x0371,
-  0x0373, 0x0377, 0x038B, 0x038F, 0x0397, 0x03A1, 0x03A9, 0x03AD,
-  0x03B3, 0x03B9, 0x03C7, 0x03CB, 0x03D1, 0x03D7, 0x03DF, 0x03E5,
-  0x03F1, 0x03F5, 0x03FB, 0x03FD, 0x0407, 0x0409, 0x040F, 0x0419,
-  0x041B, 0x0425, 0x0427, 0x042D, 0x043F, 0x0443, 0x0445, 0x0449,
-  0x044F, 0x0455, 0x045D, 0x0463, 0x0469, 0x047F, 0x0481, 0x048B,
-
-  0x0493, 0x049D, 0x04A3, 0x04A9, 0x04B1, 0x04BD, 0x04C1, 0x04C7,
-  0x04CD, 0x04CF, 0x04D5, 0x04E1, 0x04EB, 0x04FD, 0x04FF, 0x0503,
-  0x0509, 0x050B, 0x0511, 0x0515, 0x0517, 0x051B, 0x0527, 0x0529,
-  0x052F, 0x0551, 0x0557, 0x055D, 0x0565, 0x0577, 0x0581, 0x058F,
-  0x0593, 0x0595, 0x0599, 0x059F, 0x05A7, 0x05AB, 0x05AD, 0x05B3,
-  0x05BF, 0x05C9, 0x05CB, 0x05CF, 0x05D1, 0x05D5, 0x05DB, 0x05E7,
-  0x05F3, 0x05FB, 0x0607, 0x060D, 0x0611, 0x0617, 0x061F, 0x0623,
-  0x062B, 0x062F, 0x063D, 0x0641, 0x0647, 0x0649, 0x064D, 0x0653
-};
-
-int mp_isprime(mp_int *a)
-{
-   mp_int   b;
-   mp_digit d;
-   int      r, res;
-
-   /* do trial division */
-   for (r = 0; r < 256; r++) {
-       mp_mod_d(a, primes[r], &d);
-       if (d == 0) {
-          return MP_NO;
-       }
-   }
-
-   /* now do 8 miller rabins */
-   mp_init(&b);
-   for (r = 0; r < 128; r++) {
-       mp_set(&b, primes[r]);
-       mp_prime_miller_rabin(a, &b, &res);
-       if (res == MP_NO) {
-          return MP_NO;
-       }
-   }
-   return MP_YES;
-}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_jacobi.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_jacobi.c
index 465e0d600..ef0d8c567 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_jacobi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_jacobi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_jacobi.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_jacobi.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_JACOBI_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_mul.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_mul.c
index 90cfb2ff6..ce7a10857 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_mul.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_mul.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_karatsuba_mul.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_karatsuba_mul.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_KARATSUBA_MUL_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_sqr.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_sqr.c
index 99aa06967..142a2d362 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_sqr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_karatsuba_sqr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_karatsuba_sqr.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_karatsuba_sqr.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_KARATSUBA_SQR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lcm.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lcm.c
index d36a8b245..944c150fc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lcm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lcm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_lcm.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_lcm.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_LCM_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lshd.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lshd.c
index 1d5bfd20b..23bb257dc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lshd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_lshd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_lshd.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_lshd.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_LSHD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod.c
index 240ab138a..fecaf578e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MOD_C
@@ -17,7 +17,7 @@
  * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
  */
 
-/* c = a mod b, 0 <= c < b */
+/* c = a mod b, 0 <= c < b if b > 0, b < c <= 0 if b < 0 */
 int
 mp_mod (mp_int * a, mp_int * b, mp_int * c)
 {
@@ -33,11 +33,11 @@ mp_mod (mp_int * a, mp_int * b, mp_int * c)
     return res;
   }
 
-  if (t.sign != b->sign) {
-    res = mp_add (b, &t, c);
-  } else {
+  if (mp_iszero(&t) || t.sign == b->sign) {
     res = MP_OKAY;
     mp_exch (&t, c);
+  } else {
+    res = mp_add (b, &t, c);
   }
 
   mp_clear (&t);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_2d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_2d.c
index 1a11f3692..3edd23360 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_2d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_2d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mod_2d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mod_2d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MOD_2D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_d.c
index dd2a31a03..e8088ebc8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mod_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mod_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mod_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MOD_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_calc_normalization.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_calc_normalization.c
index 6b279cd87..2d2f388fa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_calc_normalization.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_calc_normalization.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_montgomery_calc_normalization.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_montgomery_calc_normalization.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MONTGOMERY_CALC_NORMALIZATION_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_reduce.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_reduce.c
index b5c0a3c65..27e6e83c1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_reduce.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_reduce.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_montgomery_reduce.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_montgomery_reduce.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MONTGOMERY_REDUCE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_setup.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_setup.c
index 36a397206..5646b42db 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_montgomery_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_montgomery_setup.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_montgomery_setup.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MONTGOMERY_SETUP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul.c
index 732a12dbe..288a28daa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mul.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mul.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MUL_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2.c
index b2afafd50..aa026974f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mul_2.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mul_2.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MUL_2_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2d.c
index 3ab229a02..7e0f2c51c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_2d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mul_2d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mul_2d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MUL_2D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_d.c
index d3d11b1a7..dedffee70 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mul_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mul_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mul_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MUL_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mulmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mulmod.c
index 0a69abae7..f8770b6a6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mulmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_mulmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_mulmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_mulmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_MULMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_n_root.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_n_root.c
index aac3bd6e0..48704c55a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_n_root.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_n_root.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_n_root.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_n_root.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_N_ROOT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_neg.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_neg.c
index a962c96e4..b1c3be09d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_neg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_neg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_neg.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_neg.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_NEG_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_or.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_or.c
index efe46e8b3..d920730b9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_or.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_or.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_or.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_or.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_OR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_fermat.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_fermat.c
index aab2f856a..cac65bd72 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_fermat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_fermat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_fermat.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_fermat.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_FERMAT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_divisible.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_divisible.c
index ef7b1245a..ba209dfeb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_divisible.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_divisible.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_is_divisible.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_is_divisible.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_IS_DIVISIBLE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_prime.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_prime.c
index 99c36892b..b7a9e0dd7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_prime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_is_prime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_is_prime.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_is_prime.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_IS_PRIME_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_miller_rabin.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_miller_rabin.c
index 695af1eca..844fd76f8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_miller_rabin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_miller_rabin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_miller_rabin.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_miller_rabin.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_MILLER_RABIN_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_next_prime.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_next_prime.c
index a2374c4f0..cbc3e6089 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_next_prime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_next_prime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_next_prime.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_next_prime.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_NEXT_PRIME_C
@@ -144,7 +144,7 @@ int mp_prime_next_prime(mp_int *a, int t, int bbs_style)
       }
 
       /* is this prime? */
-      for (x = 0; x < t && x < PRIME_SIZE; x++) {
+      for (x = 0; x < t; x++) {
           mp_set(&b, ltm_prime_tab[x]);
           if ((err = mp_prime_miller_rabin(a, &b, &res)) != MP_OKAY) {
              goto LBL_ERR;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_rabin_miller_trials.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_rabin_miller_trials.c
index 0e0a8711c..51832d481 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_rabin_miller_trials.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_rabin_miller_trials.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_rabin_miller_trials.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_rabin_miller_trials.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_RABIN_MILLER_TRIALS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_random_ex.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_random_ex.c
index e2695787c..2d541f47e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_random_ex.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_prime_random_ex.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_prime_random_ex.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_prime_random_ex.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_PRIME_RANDOM_EX_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_size.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_size.c
index a384c82ee..a2bc83445 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_size.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_size.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_radix_size.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_radix_size.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_RADIX_SIZE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_smap.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_smap.c
index 7f91575a3..e734513b9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_smap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_radix_smap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_radix_smap.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_radix_smap.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_RADIX_SMAP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rand.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rand.c
index 9a0b8c69a..ea6b8962e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rand.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rand.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_rand.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_rand.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_RAND_C
@@ -31,7 +31,7 @@ mp_rand (mp_int * a, int digits)
 
   /* first place a random non-zero digit */
   do {
-    d = ((mp_digit) abs (rand ())) & MP_MASK;
+    d = ((mp_digit) labs (rand ())) & MP_MASK;
   } while (d == 0);
 
   if ((res = mp_add_d (a, d, a)) != MP_OKAY) {
@@ -43,7 +43,7 @@ mp_rand (mp_int * a, int digits)
       return res;
     }
 
-    if ((res = mp_add_d (a, ((mp_digit) abs (rand ())), a)) != MP_OKAY) {
+    if ((res = mp_add_d (a, ((mp_digit) labs (rand ())), a)) != MP_OKAY) {
       return res;
     }
   }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_radix.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_radix.c
index 00efc6ac4..c36f637a3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_radix.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_radix.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_read_radix.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_read_radix.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_READ_RADIX_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_signed_bin.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_signed_bin.c
index 1c99033af..e62cdcaa8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_signed_bin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_signed_bin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_read_signed_bin.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_read_signed_bin.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_READ_SIGNED_BIN_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_unsigned_bin.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_unsigned_bin.c
index d6060e67f..c9a3033c6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_unsigned_bin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_read_unsigned_bin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_read_unsigned_bin.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_read_unsigned_bin.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_READ_UNSIGNED_BIN_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce.c
index d533bd2d6..b1b7ead4f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k.c
index 6050fdceb..ed4728b8c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_2k.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_2k.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_2K_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_l.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_l.c
index f37f7225d..c07807abf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_l.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_l.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_2k_l.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_2k_l.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_2K_L_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup.c
index 075ae5b96..a7d93cca1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_2k_setup.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_2k_setup.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_2K_SETUP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup_l.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup_l.c
index 19987307d..3899b125c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup_l.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_2k_setup_l.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_2k_setup_l.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_2k_setup_l.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_2K_SETUP_L_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k.c
index 9f60fb9d3..592ab1591 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_is_2k.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_is_2k.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_IS_2K_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k_l.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k_l.c
index 8ef9e6786..0ad8af4d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k_l.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_is_2k_l.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_is_2k_l.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_is_2k_l.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_IS_2K_L_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_setup.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_setup.c
index bd808197b..410c50d67 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_reduce_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_reduce_setup.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_reduce_setup.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_REDUCE_SETUP_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rshd.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rshd.c
index 6a144a80a..e3b4cb8a0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rshd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_rshd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_rshd.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_rshd.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_RSHD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set.c
index 8c960a808..031e358b3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_set.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_set.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SET_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set_int.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set_int.c
index bc36b7feb..b20e68c98 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set_int.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_set_int.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_set_int.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_set_int.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SET_INT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_shrink.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_shrink.c
index 2a4ca8431..547e21a82 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_shrink.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_shrink.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_shrink.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_shrink.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SHRINK_C
@@ -21,12 +21,17 @@
 int mp_shrink (mp_int * a)
 {
   mp_digit *tmp;
-  if (a->alloc != a->used && a->used > 0) {
-    if ((tmp = OPT_CAST(mp_digit) XREALLOC (a->dp, sizeof (mp_digit) * a->used)) == NULL) {
+  int used = 1;
+
+  if(a->used > 0)
+    used = a->used;
+
+  if (a->alloc != used) {
+    if ((tmp = OPT_CAST(mp_digit) XREALLOC (a->dp, sizeof (mp_digit) * used)) == NULL) {
       return MP_MEM;
     }
     a->dp    = tmp;
-    a->alloc = a->used;
+    a->alloc = used;
   }
   return MP_OKAY;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_signed_bin_size.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_signed_bin_size.c
index 3afa80c45..fe998598b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_signed_bin_size.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_signed_bin_size.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_signed_bin_size.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_signed_bin_size.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SIGNED_BIN_SIZE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqr.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqr.c
index 09c50b1b8..9ef90a85c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_sqr.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_sqr.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SQR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrmod.c
index c8c73ee94..c150268d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_sqrmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_sqrmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SQRMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrt.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrt.c
index 8fc3d4b45..37091aef3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sqrt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_sqrt.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_sqrt.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SQRT_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub.c
index 71ed43a6b..5e77ce812 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_sub.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_sub.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SUB_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub_d.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub_d.c
index 56519da9c..dbaab5d66 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub_d.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_sub_d.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_sub_d.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_sub_d.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SUB_D_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_submod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_submod.c
index c3482463c..07a1b4047 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_submod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_submod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_submod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_submod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_SUBMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin.c
index 30f643c8a..48c0df998 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_to_signed_bin.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_to_signed_bin.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TO_SIGNED_BIN_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin_n.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin_n.c
index 09551e720..06d9b9b1b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin_n.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_signed_bin_n.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_to_signed_bin_n.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_to_signed_bin_n.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TO_SIGNED_BIN_N_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin.c
index 252e658b2..6df2acb07 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_to_unsigned_bin.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_to_unsigned_bin.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TO_UNSIGNED_BIN_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin_n.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin_n.c
index c1f53a5d0..9beb5d090 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin_n.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_to_unsigned_bin_n.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_to_unsigned_bin_n.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_to_unsigned_bin_n.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TO_UNSIGNED_BIN_N_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_mul.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_mul.c
index 48edfc5e2..789fcfa36 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_mul.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_mul.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_toom_mul.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_toom_mul.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TOOM_MUL_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_sqr.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_sqr.c
index 6fd8b1882..3d641083e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_sqr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toom_sqr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_toom_sqr.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_toom_sqr.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TOOM_SQR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix.c
index 4b808bc79..1d99714e6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_toradix.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_toradix.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TORADIX_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix_n.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix_n.c
index fb5c4d4b1..c6ede689f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix_n.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_toradix_n.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_toradix_n.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_toradix_n.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_TORADIX_N_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_unsigned_bin_size.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_unsigned_bin_size.c
index 431c374f9..b89ee9abf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_unsigned_bin_size.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_unsigned_bin_size.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_unsigned_bin_size.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_unsigned_bin_size.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_UNSIGNED_BIN_SIZE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_xor.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_xor.c
index 125fb708d..57d171bec 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_xor.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_xor.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_xor.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_xor.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_XOR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero.c
index a965779af..2334a2d75 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_zero.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_zero.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ZERO_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero_multi.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero_multi.c
index bca4cda83..2bb0c640c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero_multi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_mp_zero_multi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_mp_zero_multi.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_mp_zero_multi.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_MP_ZERO_MULTI_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_prime_tab.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_prime_tab.c
index 70d2a7779..a156ab86f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_prime_tab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_prime_tab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_prime_tab.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_prime_tab.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_PRIME_TAB_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_reverse.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_reverse.c
index b1f42d5d2..5787634d7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_reverse.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_reverse.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_reverse.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_reverse.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_REVERSE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_add.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_add.c
index f0bf3a3a8..fcef9b765 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_add.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_add.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_add.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_add.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_ADD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_exptmod.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_exptmod.c
index 83feeedbc..0cb6d3139 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_exptmod.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_exptmod.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_exptmod.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_exptmod.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_EXPTMOD_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_digs.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_digs.c
index 2c032c7f1..ac46ad738 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_digs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_digs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_mul_digs.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_mul_digs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_MUL_DIGS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_high_digs.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_high_digs.c
index 0f83c06e3..61371dd3d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_high_digs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_mul_high_digs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_mul_high_digs.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_mul_high_digs.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_MUL_HIGH_DIGS_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sqr.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sqr.c
index d01d952c8..aa69ca9a8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sqr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sqr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_sqr.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_sqr.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_SQR_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sub.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sub.c
index bb2939d7c..4e4db7282 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sub.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bn_s_mp_sub.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bn_s_mp_sub.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bn_s_mp_sub.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BN_S_MP_SUB_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bncore.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bncore.c
index d7f277b2c..f7bbadb1a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bncore.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/bncore.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bncore.c,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: bncore.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <tommath.h>
 #ifdef BNCORE_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/demo/demo.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/demo/demo.c
index e0659264c..7d758159a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/demo/demo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/demo/demo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: demo.c,v 1.1.1.2 2014/04/24 12:45:39 pettai Exp $	*/
+/*	$NetBSD: demo.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #include <time.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/pprime.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/pprime.c
index 0e03ab1ba..2b00a6672 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/pprime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/pprime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pprime.c,v 1.1.1.2 2014/04/24 12:45:39 pettai Exp $	*/
+/*	$NetBSD: pprime.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /* Generates provable primes
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/timer.asm b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/timer.asm
index 35890d985..f1d6bfb95 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/timer.asm
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/etc/timer.asm
@@ -34,4 +34,4 @@ _t_read:
    sub eax,[time+4]
    sbb edx,[time+0]
    ret
-   
\ No newline at end of file
+   
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/gen.pl b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/gen.pl
index 72365912e..28c78bc29 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/gen.pl
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/gen.pl
@@ -14,4 +14,4 @@ foreach my $filename (glob "bn*.c") {
    close SRC or die "Error closing $filename after reading: $!";
 }
 print OUT "\n/* EOF */\n";
-close OUT or die "Error closing mpi.c after writing: $!";
\ No newline at end of file
+close OUT or die "Error closing mpi.c after writing: $!";
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/logs/README b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/logs/README
index 965e7c83c..da8260a55 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/logs/README
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/logs/README
@@ -10,4 +10,4 @@ them all :-)
 
 Have fun
 
-Tom
\ No newline at end of file
+Tom
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mpi.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mpi.c
index ab648c6c7..4d1f605f6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mpi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mpi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mpi.c,v 1.1.1.3 2014/04/24 12:45:39 pettai Exp $	*/
+/*	$NetBSD: mpi.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
     mpi.c
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mtest.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mtest.c
index 6bfac51cb..b6d21ed48 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mtest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/mtest/mtest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mtest.c,v 1.1.1.2 2014/04/24 12:45:39 pettai Exp $	*/
+/*	$NetBSD: mtest.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /* makes a bignum test harness with NUM tests per operation
  *
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pics/makefile b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pics/makefile
index 3ecb02ff7..246d44fcd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pics/makefile
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pics/makefile
@@ -32,4 +32,4 @@ pdfes: sliding_window.pdf expt_state.pdf primality.pdf design_process.pdf
 
 clean:
 	rm -rf *.ps *.pdf .xvpics
-   
\ No newline at end of file
+   
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pretty.build b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pretty.build
index a708b8af2..0f5081902 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pretty.build
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/pretty.build
@@ -63,4 +63,4 @@ printf("\nFinished building source (%d seconds, %3.2f files per second).\n", tim
 print "Compiled approximately $filesbuilt files and $lines lines of code.\n";
 print "Doing final make (building archive...)\n";
 !system("make > /dev/null 2>/dev/null") or die "\nERROR: Failed to perform last make command!!!\n";
-print "done.\n";
\ No newline at end of file
+print "done.\n";
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath.h
index cad8080a2..ff0bb1b43 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: tommath.h,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: tommath.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* LibTomMath, multiple-precision integer library -- Tom St Denis
  *
@@ -48,7 +48,7 @@ extern "C" {
 
 
 /* detect 64-bit mode if possible */
-#if defined(__x86_64__)
+#if defined(__x86_64__) && !defined(__ILP32__)
    #if !(defined(MP_64BIT) && defined(MP_16BIT) && defined(MP_8BIT))
       #define MP_64BIT
    #endif
@@ -191,8 +191,8 @@ typedef int ltm_prime_callback(unsigned char *dst, int len, void *dat);
 #define DIGIT(m,k) ((m)->dp[(k)])
 #define SIGN(m)    ((m)->sign)
 
-/* error code to char* string */
-char *mp_error_to_string(int code);
+/* error code to const char* string */
+const char *mp_error_to_string(int code);
 
 /* ---> init and deinit bignum functions <--- */
 /* init a bignum */
@@ -522,9 +522,7 @@ int mp_prime_next_prime(mp_int *a, int t, int bbs_style);
  */
 int mp_prime_random_ex(mp_int *a, int t, int size, int flags, ltm_prime_callback cb, void *dat);
 
-int mp_find_prime(mp_int *a);
-
-int mp_isprime(mp_int *a);
+int mp_find_prime(mp_int *a, int t);
 
 /* ---> radix conversion <--- */
 int mp_count_bits(mp_int *a);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_class.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_class.h
index fe92cd4b8..cc0ac2748 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_class.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_class.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: tommath_class.h,v 1.1.1.2 2014/04/24 12:45:31 pettai Exp $	*/
+/*	$NetBSD: tommath_class.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 #if !(defined(LTM1) && defined(LTM2) && defined(LTM3))
 #if defined(LTM2)
@@ -44,6 +44,7 @@
 #define BN_MP_EXPTMOD_C
 #define BN_MP_EXPTMOD_FAST_C
 #define BN_MP_EXTEUCLID_C
+#define BN_MP_FIND_PRIME_C
 #define BN_MP_FREAD_C
 #define BN_MP_FWRITE_C
 #define BN_MP_GCD_C
@@ -57,6 +58,7 @@
 #define BN_MP_INIT_SIZE_C
 #define BN_MP_INVMOD_C
 #define BN_MP_INVMOD_SLOW_C
+#define BN_MP_ISPRIME_C
 #define BN_MP_IS_SQUARE_C
 #define BN_MP_JACOBI_C
 #define BN_MP_KARATSUBA_MUL_C
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_superclass.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_superclass.h
index 9047e970d..84bedde3e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_superclass.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/libtommath/tommath_superclass.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: tommath_superclass.h,v 1.1.1.2 2014/04/24 12:45:39 pettai Exp $	*/
+/*	$NetBSD: tommath_superclass.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /* super class file for PK algos */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.c
index 7ccc4d091..758421967 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: md2.c,v 1.2 2014/03/27 16:10:45 apb Exp $	*/
+/*	$NetBSD: md2.c,v 1.3 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "md2.h"
@@ -59,10 +60,11 @@ static const unsigned char subst[256] = {
   31, 26, 219, 153, 141, 51, 159, 17, 131, 20
 };
 
-void
+int
 MD2_Init (struct md2 *m)
 {
     memset(m, 0, sizeof(*m));
+    return 1;
 }
 
 static void
@@ -93,7 +95,7 @@ calc(struct md2 *m, const void *v)
     memset(x, 0, sizeof(x));
 }
 
-void
+int
 MD2_Update (struct md2 *m, const void *v, size_t len)
 {
     size_t idx = m->len & 0xf;
@@ -116,9 +118,10 @@ MD2_Update (struct md2 *m, const void *v, size_t len)
     }
 
     memcpy(m->data + idx, p, len);
+    return 1;
 }
 
-void
+int
 MD2_Final (void *res, struct md2 *m)
 {
     unsigned char pad[16];
@@ -133,4 +136,5 @@ MD2_Final (void *res, struct md2 *m)
 
     memcpy(res, m->state, MD2_DIGEST_LENGTH);
     memset(m, 0, sizeof(*m));
+    return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.h
index 8a10e16ae..77c869917 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md2.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: md2.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: md2.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -58,8 +58,8 @@ struct md2 {
 
 typedef struct md2 MD2_CTX;
 
-void MD2_Init (struct md2 *m);
-void MD2_Update (struct md2 *m, const void *p, size_t len);
-void MD2_Final (void *res, struct md2 *m);
+int MD2_Init (struct md2 *m);
+int MD2_Update (struct md2 *m, const void *p, size_t len);
+int MD2_Final (void *res, struct md2 *m);
 
 #endif /* HEIM_MD2_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.c
index 54a4191cb..3a647f98a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: md4.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: md4.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "md4.h"
@@ -44,7 +45,7 @@
 #define D m->counter[3]
 #define X data
 
-void
+int
 MD4_Init (struct md4 *m)
 {
   m->sz[0] = 0;
@@ -53,6 +54,7 @@ MD4_Init (struct md4 *m)
   C = 0x98badcfe;
   B = 0xefcdab89;
   A = 0x67452301;
+  return 1;
 }
 
 #define F(x,y,z) CRAYFIX((x & y) | (~x & z))
@@ -172,7 +174,7 @@ struct x32{
   unsigned int b:32;
 };
 
-void
+int
 MD4_Update (struct md4 *m, const void *v, size_t len)
 {
     const unsigned char *p = v;
@@ -205,9 +207,10 @@ MD4_Update (struct md4 *m, const void *v, size_t len)
 	    offset = 0;
 	}
     }
+    return 1;
 }
 
-void
+int
 MD4_Final (void *res, struct md4 *m)
 {
   unsigned char zeros[72];
@@ -245,4 +248,5 @@ MD4_Final (void *res, struct md4 *m)
       r[i] = swap_uint32_t (m->counter[i]);
   }
 #endif
+  return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.h
index 56b604e38..f7dfaac83 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md4.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: md4.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: md4.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -57,8 +57,8 @@ struct md4 {
 
 typedef struct md4 MD4_CTX;
 
-void MD4_Init (struct md4 *m);
-void MD4_Update (struct md4 *m, const void *p, size_t len);
-void MD4_Final (void *res, struct md4 *m);
+int MD4_Init (struct md4 *m);
+int MD4_Update (struct md4 *m, const void *p, size_t len);
+int MD4_Final (void *res, struct md4 *m);
 
 #endif /* HEIM_MD4_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.c
index be72d7911..64686c689 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: md5.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: md5.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "md5.h"
@@ -44,7 +45,7 @@
 #define D m->counter[3]
 #define X data
 
-void
+int
 MD5_Init (struct md5 *m)
 {
   m->sz[0] = 0;
@@ -53,6 +54,7 @@ MD5_Init (struct md5 *m)
   C = 0x98badcfe;
   B = 0xefcdab89;
   A = 0x67452301;
+  return 1;
 }
 
 #define F(x,y,z) CRAYFIX((x & y) | (~x & z))
@@ -196,7 +198,7 @@ struct x32{
   unsigned int b:32;
 };
 
-void
+int
 MD5_Update (struct md5 *m, const void *v, size_t len)
 {
   const unsigned char *p = v;
@@ -216,22 +218,23 @@ MD5_Update (struct md5 *m, const void *v, size_t len)
     if(offset == 64){
 #if defined(WORDS_BIGENDIAN)
       int i;
-      uint32_t current[16];
+      uint32_t swapped[16];
       struct x32 *us = (struct x32*)m->save;
       for(i = 0; i < 8; i++){
-	current[2*i+0] = swap_uint32_t(us[i].a);
-	current[2*i+1] = swap_uint32_t(us[i].b);
+	swapped[2*i+0] = swap_uint32_t(us[i].a);
+	swapped[2*i+1] = swap_uint32_t(us[i].b);
       }
-      calc(m, current);
+      calc(m, swapped);
 #else
       calc(m, (uint32_t*)m->save);
 #endif
       offset = 0;
     }
   }
+  return 1;
 }
 
-void
+int
 MD5_Final (void *res, struct md5 *m)
 {
   unsigned char zeros[72];
@@ -269,4 +272,5 @@ MD5_Final (void *res, struct md5 *m)
       r[i] = swap_uint32_t (m->counter[i]);
   }
 #endif
+    return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.h
index e25a8c325..5e9181ded 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: md5.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: md5.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -57,8 +57,8 @@ struct md5 {
 
 typedef struct md5 MD5_CTX;
 
-void MD5_Init (struct md5 *m);
-void MD5_Update (struct md5 *m, const void *p, size_t len);
-void MD5_Final (void *res, struct md5 *m); /* uint32_t res[4] */
+int MD5_Init (struct md5 *m);
+int MD5_Update (struct md5 *m, const void *p, size_t len);
+int MD5_Final (void *res, struct md5 *m); /* uint32_t res[4] */
 
 #endif /* HEIM_MD5_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5crypt_test.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5crypt_test.c
index c88689279..0f25b4c03 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5crypt_test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/md5crypt_test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: md5crypt_test.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: md5crypt_test.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -34,9 +34,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <string.h>
+#include <krb5/roken.h>
 #include <des.h>
 
 struct test {
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/mdtest.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/mdtest.c
index 341823ecc..351196014 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/mdtest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/mdtest.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: mdtest.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: mdtest.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -34,14 +34,10 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED_CRYPTO
 
-#include <stdio.h>
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#include <string.h>
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
@@ -142,7 +138,7 @@ struct test md2_tests[] = {
      "\xda\x33\xde\xf2\xa4\x2d\xf1\x39\x75\x35\x28\x46\xc3\x03\x38\xcd" },
     {"12345678901234567890123456789012345678901234567890123456789012345678901234567890",
      "\xd5\x97\x6f\x79\xd8\x3d\x3a\x0d\xc9\x80\x6c\x3c\x66\xf3\xef\xd8" },
-    {NULL }
+    {NULL, { 0 } }
 };
 
 struct test md4_tests[] = {
@@ -186,7 +182,7 @@ struct test sha1_tests[] = {
       {0x34, 0xaa, 0x97, 0x3c, 0xd4, 0xc4, 0xda, 0xa4,
        0xf6, 0x1e, 0xeb, 0x2b, 0xdb, 0xad, 0x27, 0x31,
        0x65, 0x34, 0x01, 0x6f}},
-    { NULL }
+    { NULL, { 0 } }
 };
 
 struct test sha256_tests[] = {
@@ -205,7 +201,7 @@ struct test sha256_tests[] = {
        0x81,0xa1,0xc7,0xe2, 0x84,0xd7,0x3e,0x67,
        0xf1,0x80,0x9a,0x48, 0xa4,0x97,0x20,0x0e,
        0x04,0x6d,0x39,0xcc, 0xc7,0x11,0x2c,0xd0 }},
-    { NULL }
+    { NULL, { 0 } }
 };
 
 struct test sha384_tests[] = {
@@ -231,7 +227,7 @@ struct test sha384_tests[] = {
 	0x79,0x72,0xce,0xc5,0x70,0x4c,0x2a,0x5b,
 	0x07,0xb8,0xb3,0xdc,0x38,0xec,0xc4,0xeb,
 	0xae,0x97,0xdd,0xd8,0x7f,0x3d,0x89,0x85}},
-    {NULL}
+    {NULL, { 0 }}
 };
 
 struct test sha512_tests[] = {
@@ -263,7 +259,7 @@ struct test sha512_tests[] = {
 	0x4c,0xb0,0x43,0x2c,0xe5,0x77,0xc3,0x1b,
 	0xeb,0x00,0x9c,0x5c,0x2c,0x49,0xaa,0x2e,
 	0x4e,0xad,0xb2,0x17,0xad,0x8c,0xc0,0x9b }},
-    { NULL }
+    { NULL, { 0 } }
 };
 
 static int
@@ -280,6 +276,10 @@ hash_test (struct hash_foo *hash, struct test *tests)
 	char buf[1000];
 
 	ectx = EVP_MD_CTX_create();
+        if (hash->evp() == NULL) {
+            printf("unavailable\n");
+            continue;
+        }
 	EVP_DigestInit_ex(ectx, hash->evp(), NULL);
 
 	(*hash->init)(ctx);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.c
index 12e99bcba..d9cd3cfce 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: passwd_dlg.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: passwd_dlg.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
@@ -39,9 +39,9 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #ifdef WIN32	/* Visual C++ 4.0 (Windows95/NT) */
-#include <Windows.h>
 #include "passwd_dlg.h"
 #include "Resource.h"
 #define passwdBufSZ 64
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.h
index d1a36e973..07dc50d46 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/passwd_dlg.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: passwd_dlg.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: passwd_dlg.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.c
index ece02b593..09438cb09 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pkcs12.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: pkcs12.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,16 +34,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <assert.h>
 
 #include <pkcs12.h>
 #include <bn.h>
 
-#include <krb5/roken.h>
-
 int
 PKCS12_key_gen(const void *key, size_t keylen,
 	       const void *salt, size_t saltlen,
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.h
index 7d29194e6..055d0984f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs12.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: pkcs12.h,v 1.1.1.2 2011/04/14 14:08:32 elric Exp $	*/
+/*	$NetBSD: pkcs12.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs5.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs5.c
index c9fecd527..2ad78dfdb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs5.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/pkcs5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pkcs5.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: pkcs5.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,19 +34,15 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
 
-#include <stdio.h>
-#include <stdlib.h>
-
 #include <evp.h>
 #include <hmac.h>
 
-#include <krb5/roken.h>
-
 /**
  * As descriped in PKCS5, convert a password, salt, and iteration counter into a crypto key.
  *
@@ -55,6 +51,7 @@
  * @param salt Salt
  * @param salt_len Length of salt.
  * @param iter iteration counter.
+ * @param md the digest function.
  * @param keylen the output key length.
  * @param key the output key.
  *
@@ -64,21 +61,23 @@
  */
 
 int
-PKCS5_PBKDF2_HMAC_SHA1(const void * password, size_t password_len,
-		       const void * salt, size_t salt_len,
-		       unsigned long iter,
-		       size_t keylen, void *key)
+PKCS5_PBKDF2_HMAC(const void * password, size_t password_len,
+		  const void * salt, size_t salt_len,
+		  unsigned long iter,
+		  const EVP_MD *md,
+		  size_t keylen, void *key)
 {
     size_t datalen, leftofkey, checksumsize;
     char *data, *tmpcksum;
     uint32_t keypart;
-    const EVP_MD *md;
     unsigned long i;
     int j;
     char *p;
     unsigned int hmacsize;
 
-    md = EVP_sha1();
+    if (md == NULL)
+	return 0;
+
     checksumsize = EVP_MD_size(md);
     datalen = salt_len + 4;
 
@@ -128,3 +127,28 @@ PKCS5_PBKDF2_HMAC_SHA1(const void * password, size_t password_len,
 
     return 1;
 }
+
+/**
+ * As descriped in PKCS5, convert a password, salt, and iteration counter into a crypto key.
+ *
+ * @param password Password.
+ * @param password_len Length of password.
+ * @param salt Salt
+ * @param salt_len Length of salt.
+ * @param iter iteration counter.
+ * @param keylen the output key length.
+ * @param key the output key.
+ *
+ * @return 1 on success, non 1 on failure.
+ *
+ * @ingroup hcrypto_misc
+ */
+int
+PKCS5_PBKDF2_HMAC_SHA1(const void * password, size_t password_len,
+		       const void * salt, size_t salt_len,
+		       unsigned long iter,
+		       size_t keylen, void *key)
+{
+    return PKCS5_PBKDF2_HMAC(password, password_len, salt, salt_len, iter,
+			     EVP_sha1(), keylen, key);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-egd.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-egd.c
deleted file mode 100644
index 3fc81b037..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-egd.c
+++ /dev/null
@@ -1,262 +0,0 @@
-/*	$NetBSD: rand-egd.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
-
-/*
- * Copyright (c) 2007 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <config.h>
-
-#include <sys/types.h>
-#ifdef HAVE_SYS_UN_H
-#include <sys/un.h>
-#endif
-
-#include <stdio.h>
-#include <stdlib.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <assert.h>
-
-#include <rand.h>
-#include <randi.h>
-
-#include <krb5/roken.h>
-
-static const char *egd_path = "/var/run/egd-pool";
-
-#define MAX_EGD_DATA 255
-
-static int
-connect_egd(const char *path)
-{
-    struct sockaddr_un addr;
-    int fd;
-
-    memset(&addr, 0, sizeof(addr));
-
-    if (strlen(path) > sizeof(addr.sun_path))
-	return -1;
-
-    addr.sun_family = AF_UNIX;
-    strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
-
-    fd = socket(AF_UNIX, SOCK_STREAM, 0);
-    if (fd < 0)
-	return -1;
-
-    rk_cloexec(fd);
-
-    if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
-	close(fd);
-	return -1;
-    }
-
-    return fd;
-}
-
-static int
-get_entropy(int fd, void *data, size_t len)
-{
-    unsigned char msg[2];
-
-    assert(len <= MAX_EGD_DATA);
-
-    msg[0] = 0x02; /* read blocking data */
-    msg[1] = len; /* wanted length */
-
-    if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
-	return 0;
-
-    if (net_read(fd, data, len) != len)
-	return 0;
-
-    return 1;
-}
-
-static int
-put_entropy(int fd, const void *data, size_t len)
-{
-    unsigned char msg[4];
-
-    assert (len <= MAX_EGD_DATA);
-
-    msg[0] = 0x03; /* write data */
-    msg[1] = 0; /* dummy */
-    msg[2] = 0; /* entropy */
-    msg[3] = len; /* length */
-
-    if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
-	return 0;
-    if (net_write(fd, data, len) != len)
-	return 0;
-
-    return 1;
-}
-
-/*
- *
- */
-
-static void
-egd_seed(const void *indata, int size)
-{
-    size_t len;
-    int fd, ret = 1;
-
-    fd = connect_egd(egd_path);
-    if (fd < 0)
-	return;
-
-    while(size) {
-	len = size;
-	if (len > MAX_EGD_DATA)
-	    len = MAX_EGD_DATA;
-	ret = put_entropy(fd, indata, len);
-	if (ret != 1)
-	    break;
-	indata = ((unsigned char *)indata) + len;
-	size -= len;
-    }
-    close(fd);
-}
-
-static int
-get_bytes(const char *path, unsigned char *outdata, int size)
-{
-    size_t len;
-    int fd, ret = 1;
-
-    if (path == NULL)
-	path = egd_path;
-
-    fd = connect_egd(path);
-    if (fd < 0)
-	return 0;
-
-    while(size) {
-	len = size;
-	if (len > MAX_EGD_DATA)
-	    len = MAX_EGD_DATA;
-	ret = get_entropy(fd, outdata, len);
-	if (ret != 1)
-	    break;
-	outdata += len;
-	size -= len;
-    }
-    close(fd);
-
-    return ret;
-}
-
-static int
-egd_bytes(unsigned char *outdata, int size)
-{
-    return get_bytes(NULL, outdata, size);
-}
-
-static void
-egd_cleanup(void)
-{
-}
-
-static void
-egd_add(const void *indata, int size, double entropi)
-{
-    egd_seed(indata, size);
-}
-
-static int
-egd_pseudorand(unsigned char *outdata, int size)
-{
-    return get_bytes(NULL, outdata, size);
-}
-
-static int
-egd_status(void)
-{
-    int fd;
-    fd = connect_egd(egd_path);
-    if (fd < 0)
-	return 0;
-    close(fd);
-    return 1;
-}
-
-const RAND_METHOD hc_rand_egd_method = {
-    egd_seed,
-    egd_bytes,
-    egd_cleanup,
-    egd_add,
-    egd_pseudorand,
-    egd_status
-};
-
-const RAND_METHOD *
-RAND_egd_method(void)
-{
-    return &hc_rand_egd_method;
-}
-
-
-int
-RAND_egd(const char *filename)
-{
-    return RAND_egd_bytes(filename, 128);
-}
-
-int
-RAND_egd_bytes(const char *filename, int size)
-{
-    void *data;
-    int ret;
-
-    if (size <= 0)
-	return 0;
-
-    data = malloc(size);
-    if (data == NULL)
-	return 0;
-
-    ret = get_bytes(filename, data, size);
-    if (ret != 1) {
-	free(data);
-	return ret;
-    }
-
-    RAND_seed(data, size);
-
-    memset(data, 0, size);
-    free(data);
-
-    return 1;
-}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-fortuna.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-fortuna.c
index 54806b03f..38a9e6e88 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-fortuna.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-fortuna.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand-fortuna.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: rand-fortuna.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * fortuna.c
@@ -32,16 +32,13 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <rand.h>
 #include <heim_threads.h>
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
-#include <krb5/roken.h>
 
 #include "randi.h"
 #include "aes.h"
@@ -487,20 +484,6 @@ fortuna_reseed(void)
 	add_entropy(&main_state, (void *)buf, sizeof(buf));
 	entropy_p = 1;
     }
-#endif
-#ifndef NO_RAND_EGD_METHOD
-    /*
-     * Only to get egd entropy if /dev/random or arc4rand failed since
-     * it can be horribly slow to generate new bits.
-     */
-    if (!entropy_p) {
-	unsigned char buf[INIT_BYTES];
-	if ((*hc_rand_egd_method.bytes)(buf, sizeof(buf)) == 1) {
-	    add_entropy(&main_state, buf, sizeof(buf));
-	    entropy_p = 1;
-	    memset(buf, 0, sizeof(buf));
-	}
-    }
 #endif
     /*
      * Fall back to gattering data from timer and secret files, this
@@ -641,6 +624,16 @@ fortuna_status(void)
     return result ? 1 : 0;
 }
 
+#if defined(__GNUC__) || (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901)
+const RAND_METHOD hc_rand_fortuna_method = {
+    .seed = fortuna_seed,
+    .bytes = fortuna_bytes,
+    .cleanup = fortuna_cleanup,
+    .add = fortuna_add,
+    .pseudorand = fortuna_pseudorand,
+    .status = fortuna_status
+};
+#else
 const RAND_METHOD hc_rand_fortuna_method = {
     fortuna_seed,
     fortuna_bytes,
@@ -649,6 +642,7 @@ const RAND_METHOD hc_rand_fortuna_method = {
     fortuna_pseudorand,
     fortuna_status
 };
+#endif
 
 const RAND_METHOD *
 RAND_fortuna_method(void)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-timer.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-timer.c
index 081d6c492..5d5939a13 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-timer.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-timer.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand-timer.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: rand-timer.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1999, 2007 Kungliga Tekniska Högskolan
@@ -34,13 +34,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <rand.h>
-
 #include <krb5/roken.h>
 
+#include <rand.h>
+
 #include "randi.h"
 
 #ifndef WIN32 /* don't bother with this on windows */
@@ -188,6 +185,16 @@ timer_status(void)
 #endif
 }
 
+#if defined(__GNUC__) || (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901)
+const RAND_METHOD hc_rand_timer_method = {
+    .seed = timer_seed,
+    .bytes = timer_bytes,
+    .cleanup = timer_cleanup,
+    .add = timer_add,
+    .pseudorand = timer_pseudorand,
+    .status = timer_status
+};
+#else
 const RAND_METHOD hc_rand_timer_method = {
     timer_seed,
     timer_bytes,
@@ -196,6 +203,7 @@ const RAND_METHOD hc_rand_timer_method = {
     timer_pseudorand,
     timer_status
 };
+#endif
 
 const RAND_METHOD *
 RAND_timer_method(void)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-unix.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-unix.c
index cbb2d47eb..7f6671015 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-unix.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-unix.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand-unix.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: rand-unix.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,14 +34,11 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <heim_threads.h>
 
-#include <krb5/roken.h>
-
 #include "randi.h"
 
 /*
@@ -73,20 +70,33 @@ _hc_unix_device_fd(int flags, const char **fn)
 }
 
 static void
-unix_seed(const void *indata, int size)
+unix_seed(const void *p, int size)
 {
+    const unsigned char *indata = p;
+    ssize_t count;
     int fd;
 
-    if (size <= 0)
+    if (size < 0)
+	return;
+    else if (size == 0)
 	return;
 
-    fd = _hc_unix_device_fd(O_WRONLY, NULL);
+    fd = _hc_unix_device_fd(O_RDONLY, NULL);
     if (fd < 0)
 	return;
 
-    write(fd, indata, size);
+    while (size > 0) {
+	count = write(fd, indata, size);
+	if (count < 0 && errno == EINTR)
+	    continue;
+	else if (count <= 0) {
+	    close(fd);
+	    return;
+	}
+	indata += count;
+	size -= count;
+    }
     close(fd);
-
 }
 
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-w32.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-w32.c
index 44bfbff80..67da3ace3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-w32.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand-w32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand-w32.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: rand-w32.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -38,23 +38,21 @@
 
 #include <wincrypt.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <heim_threads.h>
 
 #include "randi.h"
 
-volatile static HCRYPTPROV g_cryptprovider = 0;
+volatile static HCRYPTPROV g_cryptprovider = NULL;
 
 static HCRYPTPROV
 _hc_CryptProvider(void)
 {
     BOOL rv;
-    HCRYPTPROV cryptprovider = 0;
+    HCRYPTPROV cryptprovider = NULL;
 
-    if (g_cryptprovider != 0)
-	return g_cryptprovider;
+    if (g_cryptprovider != NULL)
+	goto out;
 
     rv = CryptAcquireContext(&cryptprovider, NULL,
 			      MS_ENHANCED_PROV, PROV_RSA_FULL,
@@ -84,15 +82,15 @@ _hc_CryptProvider(void)
                                  CRYPT_VERIFYCONTEXT);
     }
 
-    if (rv &&
+    if (rv == 0 &&
         InterlockedCompareExchangePointer((PVOID *) &g_cryptprovider,
-					  (PVOID) cryptprovider, 0) != 0) {
+					  (PVOID) cryptprovider, NULL) != 0) {
 
         CryptReleaseContext(cryptprovider, 0);
-        cryptprovider = g_cryptprovider;
     }
 
-    return cryptprovider;
+out:
+    return g_cryptprovider;
 }
 
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.c
index 4f184c74c..39fe61e48 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: rand.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -36,14 +36,11 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <randi.h>
 
-#include <krb5/roken.h>
-
 #ifndef O_BINARY
 #define O_BINARY 0
 #endif
@@ -58,7 +55,7 @@
  * See the library functions here: @ref hcrypto_rand
  */
 
-const static RAND_METHOD *selected_meth = NULL;
+static const RAND_METHOD *selected_meth = NULL;
 static ENGINE *selected_engine = NULL;
 
 static void
@@ -211,6 +208,8 @@ RAND_set_rand_method(const RAND_METHOD *meth)
 /**
  * Get the default random method.
  *
+ * @return Returns a RAND_METHOD
+ *
  * @ingroup hcrypto_rand
  */
 
@@ -267,6 +266,8 @@ RAND_set_rand_engine(ENGINE *engine)
  * @param filename name of file to read.
  * @param size minimum size to read.
  *
+ * @return Returns the number of seed bytes loaded (0 indicates failure)
+ *
  * @ingroup hcrypto_rand
  */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.h
index 2f0f867b6..b4d24888f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rand.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: rand.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 
 /*
@@ -41,6 +41,8 @@
 #ifndef _HEIM_RAND_H
 #define _HEIM_RAND_H 1
 
+#define RAND_METHOD hc_RAND_METHOD
+
 typedef struct RAND_METHOD RAND_METHOD;
 
 #include <hcrypto/engine.h>
@@ -58,10 +60,7 @@ typedef struct RAND_METHOD RAND_METHOD;
 #define RAND_load_file hc_RAND_load_file
 #define RAND_write_file hc_RAND_write_file
 #define RAND_status hc_RAND_status
-#define RAND_egd hc_RAND_egd
-#define RAND_egd_bytes hc_RAND_egd_bytes
 #define RAND_fortuna_method hc_RAND_fortuna_method
-#define RAND_egd_method hc_RAND_egd_method
 #define RAND_unix_method hc_RAND_unix_method
 #define RAND_w32crypto_method hc_RAND_w32crypto_method
 
@@ -99,13 +98,10 @@ const char *
 int	RAND_load_file(const char *, size_t);
 int	RAND_write_file(const char *);
 int	RAND_status(void);
-int	RAND_egd(const char *);
-int	RAND_egd_bytes(const char *, int);
 
 
 const RAND_METHOD *	RAND_fortuna_method(void);
 const RAND_METHOD *	RAND_unix_method(void);
-const RAND_METHOD *	RAND_egd_method(void);
 const RAND_METHOD *	RAND_w32crypto_method(void);
 
 #endif /* _HEIM_RAND_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/randi.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/randi.h
index c5f8bab2a..4b1db952a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/randi.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/randi.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: randi.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: randi.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -42,7 +42,6 @@
 
 extern const RAND_METHOD hc_rand_fortuna_method;
 extern const RAND_METHOD hc_rand_unix_method;
-extern const RAND_METHOD hc_rand_egd_method;
 extern const RAND_METHOD hc_rand_timer_method;
 extern const RAND_METHOD hc_rand_w32crypto_method;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.c
index 0aa4dd8cc..cf01c1905 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rc2.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: rc2.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -34,11 +34,9 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #include "rc2.h"
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 
 /*
  * Implemented from Peter Gutmann's "Specification for Ron Rivests Cipher No.2"
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.h
index 1a0df38c7..d412f60d7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rc2.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: rc2.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2test.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2test.c
index 702265e5d..356234ef0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc2test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rc2test.c,v 1.1.1.1 2011/04/13 18:14:50 elric Exp $	*/
+/*	$NetBSD: rc2test.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -34,11 +34,9 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #include <rc2.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 
 struct {
     const void *key;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.c
index 40222e14d..15d23ed60 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rc4.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rc4.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -35,7 +35,8 @@
 
 /* implemented from description in draft-kaukonen-cipher-arcfour-03.txt */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include <rc4.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.h
index 430541c36..410aba56a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rc4.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rc4.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: rc4.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rctest.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rctest.c
index 47c02a093..513943676 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rctest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rctest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rctest.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rctest.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -34,9 +34,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <string.h>
+#include <krb5/roken.h>
 #include <rc4.h>
 
 static unsigned char plain1[8] =
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/resource.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/resource.h
index c2649d7fb..eb85250d3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/resource.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/resource.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: resource.h,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: resource.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 //{{NO_DEPENDENCIES}}
 // Microsoft Developer Studio generated include file.
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.c
index 59745b5c7..c2adcc313 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rijndael-alg-fst.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rijndael-alg-fst.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*	NetBSD: rijndael-alg-fst.c,v 1.5 2001/11/13 01:40:10 lukem Exp	*/
 /*	$KAME: rijndael-alg-fst.c,v 1.10 2003/07/15 10:47:16 itojun Exp $	*/
@@ -30,10 +30,9 @@
 
 /* "NetBSD: rijndael-alg-fst.c,v 1.5 2001/11/13 01:40:10 lukem Exp" */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
-
-#include <stdlib.h>
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.h
index 2ed320287..e6780eea0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rijndael-alg-fst.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rijndael-alg-fst.h,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rijndael-alg-fst.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*	NetBSD: rijndael-alg-fst.h,v 1.2 2000/10/02 17:19:15 itojun Exp	*/
 /*	$KAME: rijndael-alg-fst.h,v 1.5 2003/07/15 10:47:16 itojun Exp $	*/
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rnd_keys.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rnd_keys.c
index 064fb889a..c775e02fe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rnd_keys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rnd_keys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rnd_keys.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rnd_keys.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1999 Kungliga Tekniska Högskolan
@@ -33,15 +33,14 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
-
+#include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED
 
 #ifdef KRB5
 #include <krb5/krb5-types.h>
 #endif
-#include <stdlib.h>
 
 #include <des.h>
 #include <rand.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-gmp.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-gmp.c
index 742dd7258..ff84262fa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-gmp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-gmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsa-gmp.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: rsa-gmp.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -34,16 +34,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <krb5/krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <krb5/roken.h>
-
 #ifdef HAVE_GMP
 
 #include <gmp.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-ltm.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-ltm.c
index cf130fa1e..9ac2cfa17 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-ltm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-ltm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsa-ltm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: rsa-ltm.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007, 2010 Kungliga Tekniska Högskolan
@@ -34,16 +34,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <krb5/krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <krb5/roken.h>
-
 #include "tommath.h"
 
 static int
@@ -159,13 +155,18 @@ ltm_rsa_public_encrypt(int flen, const unsigned char* from,
     size = RSA_size(rsa);
 
     if (size < RSA_PKCS1_PADDING_SIZE || size - RSA_PKCS1_PADDING_SIZE < flen) {
-	mp_clear_multi(&n, &e, &enc, &dec);
+	mp_clear_multi(&n, &e, &enc, &dec, NULL);
 	return -2;
     }
 
     BN2mpz(&n, rsa->n);
     BN2mpz(&e, rsa->e);
 
+    if (mp_cmp_d(&e, 3) == MP_LT) {
+	mp_clear_multi(&e, &n, &enc, &dec, NULL);
+	return -2;
+    }
+
     p = p0 = malloc(size - 1);
     if (p0 == NULL) {
 	mp_clear_multi(&e, &n, &enc, &dec, NULL);
@@ -235,13 +236,10 @@ ltm_rsa_public_decrypt(int flen, const unsigned char* from,
     BN2mpz(&n, rsa->n);
     BN2mpz(&e, rsa->e);
 
-#if 0
-    /* Check that the exponent is larger then 3 */
-    if (mp_int_compare_value(&e, 3) <= 0) {
+    if (mp_cmp_d(&e, 3) == MP_LT) {
 	mp_clear_multi(&e, &n, &s, &us, NULL);
 	return -3;
     }
-#endif
 
     mp_read_unsigned_bin(&s, rk_UNCONST(from), flen);
 
@@ -289,7 +287,7 @@ static int
 ltm_rsa_private_encrypt(int flen, const unsigned char* from,
 			unsigned char* to, RSA* rsa, int padding)
 {
-    unsigned char *p, *p0;
+    unsigned char *ptr, *ptr0;
     int res;
     int size;
     mp_int in, out, n, e;
@@ -307,21 +305,26 @@ ltm_rsa_private_encrypt(int flen, const unsigned char* from,
     if (size < RSA_PKCS1_PADDING_SIZE || size - RSA_PKCS1_PADDING_SIZE < flen)
 	return -2;
 
-    p0 = p = malloc(size);
-    *p++ = 0;
-    *p++ = 1;
-    memset(p, 0xff, size - flen - 3);
-    p += size - flen - 3;
-    *p++ = 0;
-    memcpy(p, from, flen);
-    p += flen;
-    assert((p - p0) == size);
+    ptr0 = ptr = malloc(size);
+    *ptr++ = 0;
+    *ptr++ = 1;
+    memset(ptr, 0xff, size - flen - 3);
+    ptr += size - flen - 3;
+    *ptr++ = 0;
+    memcpy(ptr, from, flen);
+    ptr += flen;
+    assert((ptr - ptr0) == size);
 
     BN2mpz(&n, rsa->n);
     BN2mpz(&e, rsa->e);
 
-    mp_read_unsigned_bin(&in, p0, size);
-    free(p0);
+    if (mp_cmp_d(&e, 3) == MP_LT) {
+	size = -3;
+	goto out;
+    }
+
+    mp_read_unsigned_bin(&in, ptr0, size);
+    free(ptr0);
 
     if(mp_isneg(&in) || mp_cmp(&in, &n) >= 0) {
 	size = -3;
@@ -404,6 +407,11 @@ ltm_rsa_private_decrypt(int flen, const unsigned char* from,
     BN2mpz(&n, rsa->n);
     BN2mpz(&e, rsa->e);
 
+    if (mp_cmp_d(&e, 3) == MP_LT) {
+	size = -2;
+	goto out;
+    }
+
     mp_read_unsigned_bin(&in, rk_UNCONST(from), flen);
 
     if(mp_isneg(&in) || mp_cmp(&in, &n) >= 0) {
@@ -530,7 +538,7 @@ ltm_rsa_generate_key(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb)
     do {
 	BN_GENCB_call(cb, 2, counter++);
 	CHECK(random_num(&p, bitsp), 0);
-	CHECK(mp_find_prime(&p), MP_YES);
+	CHECK(mp_find_prime(&p,128), MP_YES);
 
 	mp_sub_d(&p, 1, &t1);
 	mp_gcd(&t1, &el, &t2);
@@ -542,7 +550,7 @@ ltm_rsa_generate_key(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb)
     do {
 	BN_GENCB_call(cb, 2, counter++);
 	CHECK(random_num(&q, bits - bitsp), 0);
-	CHECK(mp_find_prime(&q), MP_YES);
+	CHECK(mp_find_prime(&q,128), MP_YES);
 
 	if (mp_cmp(&p, &q) == 0) /* don't let p and q be the same */
 	    continue;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-tfm.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-tfm.c
index 78414ee68..b8c072bca 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-tfm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa-tfm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsa-tfm.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: rsa-tfm.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007, 2010 Kungliga Tekniska Högskolan
@@ -34,16 +34,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <krb5/krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <krb5/roken.h>
-
 #ifdef USE_HCRYPTO_TFM
 
 #include "tfm.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.c
index 9c6fd4512..2285071e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsa.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: rsa.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -34,9 +34,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <krb5/roken.h>
 #include <krb5/krb5-types.h>
 #include <krb5/rfc2459_asn1.h>
 
@@ -46,8 +44,6 @@
 
 #include "common.h"
 
-#include <krb5/roken.h>
-
 /**
  * @page page_rsa RSA - public-key cryptography
  *
@@ -510,6 +506,7 @@ static const RSA_METHOD rsa_null_method = {
     0,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.h
index 328c94545..758c62de6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/rsa.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: rsa.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: rsa.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -69,6 +69,9 @@
 #define i2d_RSAPublicKey hc_i2d_RSAPublicKey
 #define d2i_RSAPublicKey hc_d2i_RSAPublicKey
 
+#define RSA hc_RSA
+#define RSA_METHOD hc_RSA_METHOD
+
 /*
  *
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.c
index ac45f1c79..80fc2b079 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sha.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: sha.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "sha.h"
@@ -45,7 +46,7 @@
 #define E m->counter[4]
 #define X data
 
-void
+int
 SHA1_Init (struct sha *m)
 {
   m->sz[0] = 0;
@@ -55,6 +56,7 @@ SHA1_Init (struct sha *m)
   C = 0x98badcfe;
   D = 0x10325476;
   E = 0xc3d2e1f0;
+  return 1;
 }
 
 
@@ -222,7 +224,7 @@ struct x32{
   unsigned int b:32;
 };
 
-void
+int
 SHA1_Update (struct sha *m, const void *v, size_t len)
 {
   const unsigned char *p = v;
@@ -255,9 +257,10 @@ SHA1_Update (struct sha *m, const void *v, size_t len)
       offset = 0;
     }
   }
+  return 1;
 }
 
-void
+int
 SHA1_Final (void *res, struct sha *m)
 {
   unsigned char zeros[72];
@@ -295,4 +298,5 @@ SHA1_Final (void *res, struct sha *m)
       r[i] = swap_uint32_t (m->counter[i]);
   }
 #endif
+  return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.h
index 889f6affd..fb25321c0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sha.h,v 1.1.1.2 2011/04/14 14:08:33 elric Exp $	*/
+/*	$NetBSD: sha.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
@@ -66,9 +66,9 @@ struct sha {
 
 typedef struct sha SHA_CTX;
 
-void SHA1_Init (struct sha *m);
-void SHA1_Update (struct sha *m, const void *v, size_t len);
-void SHA1_Final (void *res, struct sha *m);
+int SHA1_Init (struct sha *m);
+int SHA1_Update (struct sha *m, const void *v, size_t len);
+int SHA1_Final (void *res, struct sha *m);
 
 /*
  * SHA-2 256
@@ -84,9 +84,9 @@ struct hc_sha256state {
 
 typedef struct hc_sha256state SHA256_CTX;
 
-void SHA256_Init (SHA256_CTX *);
-void SHA256_Update (SHA256_CTX *, const void *, size_t);
-void SHA256_Final (void *, SHA256_CTX *);
+int SHA256_Init (SHA256_CTX *);
+int SHA256_Update (SHA256_CTX *, const void *, size_t);
+int SHA256_Final (void *, SHA256_CTX *);
 
 /*
  * SHA-2 512
@@ -102,16 +102,16 @@ struct hc_sha512state {
 
 typedef struct hc_sha512state SHA512_CTX;
 
-void SHA512_Init (SHA512_CTX *);
-void SHA512_Update (SHA512_CTX *, const void *, size_t);
-void SHA512_Final (void *, SHA512_CTX *);
+int SHA512_Init (SHA512_CTX *);
+int SHA512_Update (SHA512_CTX *, const void *, size_t);
+int SHA512_Final (void *, SHA512_CTX *);
 
 #define SHA384_DIGEST_LENGTH 48
 
 typedef struct hc_sha512state SHA384_CTX;
 
-void SHA384_Init (SHA384_CTX *);
-void SHA384_Update (SHA384_CTX *, const void *, size_t);
-void SHA384_Final (void *, SHA384_CTX *);
+int SHA384_Init (SHA384_CTX *);
+int SHA384_Update (SHA384_CTX *, const void *, size_t);
+int SHA384_Final (void *, SHA384_CTX *);
 
 #endif /* HEIM_SHA_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha256.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha256.c
index 784633461..a25d12123 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha256.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha256.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sha256.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: sha256.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "sha.h"
@@ -76,7 +77,7 @@ static const uint32_t constant_256[64] = {
     0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
 };
 
-void
+int
 SHA256_Init (SHA256_CTX *m)
 {
     m->sz[0] = 0;
@@ -89,6 +90,7 @@ SHA256_Init (SHA256_CTX *m)
     F = 0x9b05688c;
     G = 0x1f83d9ab;
     H = 0x5be0cd19;
+    return 1;
 }
 
 static void
@@ -164,7 +166,7 @@ struct x32{
     unsigned int b:32;
 };
 
-void
+int
 SHA256_Update (SHA256_CTX *m, const void *v, size_t len)
 {
     const unsigned char *p = v;
@@ -197,9 +199,10 @@ SHA256_Update (SHA256_CTX *m, const void *v, size_t len)
 	    offset = 0;
 	}
     }
+    return 1;
 }
 
-void
+int
 SHA256_Final (void *res, SHA256_CTX *m)
 {
     unsigned char zeros[72];
@@ -228,4 +231,5 @@ SHA256_Final (void *res, SHA256_CTX *m)
 	    r[4*i]   = (m->counter[i] >> 24) & 0xFF;
 	}
     }
+    return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha512.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha512.c
index b92370b94..8225f02aa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha512.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/sha512.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sha512.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: sha512.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006, 2010 Kungliga Tekniska Högskolan
@@ -33,7 +33,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <krb5/roken.h>
 
 #include "hash.h"
 #include "sha.h"
@@ -100,7 +101,7 @@ static const uint64_t constant_512[80] = {
     0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
 };
 
-void
+int
 SHA512_Init (SHA512_CTX *m)
 {
     m->sz[0] = 0;
@@ -113,6 +114,7 @@ SHA512_Init (SHA512_CTX *m)
     F = 0x9b05688c2b3e6c1fULL;
     G = 0x1f83d9abfb41bd6bULL;
     H = 0x5be0cd19137e2179ULL;
+    return 1;
 }
 
 static void
@@ -186,7 +188,7 @@ struct x64{
 };
 #endif
 
-void
+int
 SHA512_Update (SHA512_CTX *m, const void *v, size_t len)
 {
     const unsigned char *p = v;
@@ -219,9 +221,10 @@ SHA512_Update (SHA512_CTX *m, const void *v, size_t len)
 	    offset = 0;
 	}
     }
+    return 1;
 }
 
-void
+int
 SHA512_Final (void *res, SHA512_CTX *m)
 {
     unsigned char zeros[128 + 16];
@@ -263,9 +266,10 @@ SHA512_Final (void *res, SHA512_CTX *m)
 	    r[8*i]   = (m->counter[i] >> 56) & 0xFF;
 	}
     }
+    return 1;
 }
 
-void
+int
 SHA384_Init(SHA384_CTX *m)
 {
     m->sz[0] = 0;
@@ -278,19 +282,22 @@ SHA384_Init(SHA384_CTX *m)
     F = 0x8eb44a8768581511ULL;
     G = 0xdb0c2e0d64f98fa7ULL;
     H = 0x47b5481dbefa4fa4ULL;
+    return 1;
 }
 
-void
+int
 SHA384_Update (SHA384_CTX *m, const void *v, size_t len)
 {
     SHA512_Update(m, v, len);
+    return 1;
 }
 
-void
+int
 SHA384_Final (void *res, SHA384_CTX *m)
 {
     unsigned char data[SHA512_DIGEST_LENGTH];
     SHA512_Final(data, m);
     memcpy(res, data, SHA384_DIGEST_LENGTH);
+    return 1;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bn.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bn.c
index fe149de35..2c9a10ee9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_bn.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_bn.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -34,12 +34,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 
 #include <bn.h>
 #include <rand.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bulk.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bulk.c
new file mode 100644
index 000000000..a7e565ed6
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_bulk.c
@@ -0,0 +1,316 @@
+/*	$NetBSD: test_bulk.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+#include <krb5/roken.h>
+#include <assert.h>
+#include <krb5/getarg.h>
+
+#include <evp.h>
+#include <evp-hcrypto.h>
+#include <evp-cc.h>
+#if defined(_WIN32)
+#include <evp-w32.h>
+#endif
+#include <evp-pkcs11.h>
+#include <krb5/hex.h>
+#include <err.h>
+
+#ifdef WIN32
+#define STATS_START(M)                                                      \
+        LARGE_INTEGER StartingTime, EndingTime, ElapsedMicroseconds;        \
+        LARGE_INTEGER Frequency;                                            \
+                                                                            \
+        QueryPerformanceFrequency(&Frequency);                              \
+        QueryPerformanceCounter(&StartingTime);
+
+#define STATS_END(M)                                                        \
+        QueryPerformanceCounter(&EndingTime);                               \
+        ElapsedMicroseconds.QuadPart = EndingTime.QuadPart - StartingTime.QuadPart; \
+        ElapsedMicroseconds.QuadPart *= 1000000;                            \
+        ElapsedMicroseconds.QuadPart /= Frequency.QuadPart;                 \
+                                                                            \
+        M += (ElapsedMicroseconds.QuadPart - M) / (i + 1);
+#else
+#define STATS_START(M)                                                      \
+        struct timeval StartingTime, EndingTime;                            \
+                                                                            \
+        gettimeofday(&StartingTime, NULL);
+
+#define STATS_END(M)                                                        \
+        gettimeofday(&EndingTime, NULL);                                    \
+        timevalsub(&EndingTime, &StartingTime);                             \
+        M += (EndingTime.tv_sec * 1000000 + EndingTime.tv_usec - M) / (i + 1);
+#endif
+
+static int version_flag;
+static int help_flag;
+static int len = 1;
+static int loops = 20;
+static char *provider = "hcrypto";
+static unsigned char *d;
+
+#ifdef __APPLE__
+#define PROVIDER_USAGE "hcrypto|cc"
+#elif defined(WIN32)
+#define PROVIDER_USAGE "hcrypto|w32crypto"
+#elif __sun || defined(PKCS11_MODULE_PATH)
+#define PROVIDER_USAGE "hcrypto|pkcs11"
+#else
+#define PROVIDER_USAGE "hcrypto"
+#endif
+
+static struct getargs args[] = {
+    { "provider",	0,	arg_string,	&provider,
+      "crypto provider", PROVIDER_USAGE },
+    { "loops",		0,	arg_integer,	&loops,
+      "number of loops", 	"loops" },
+    { "size",	0,	arg_integer,	&len,
+      "size (KB)", NULL },
+    { "version",	0,	arg_flag,	&version_flag,
+      "print version", NULL },
+    { "help",		0,	arg_flag,	&help_flag,
+      NULL, 	NULL }
+};
+
+static void
+usage (int ret)
+{
+    arg_printusage (args,
+		    sizeof(args)/sizeof(*args),
+		    NULL,
+		    "");
+    exit (ret);
+}
+
+static int
+test_bulk_cipher(const char *cname, const EVP_CIPHER *c)
+{
+    static unsigned char key[16];
+    static unsigned char iv[16];
+    int i;
+    int64_t M = 0;
+
+    if (c == NULL) {
+        printf("%s not supported\n", cname);
+	return 0;
+    }
+
+    for (i = 0; i < loops; i++) {
+        EVP_CIPHER_CTX ectx;
+        EVP_CIPHER_CTX dctx;
+
+        STATS_START(M)
+
+        EVP_CIPHER_CTX_init(&ectx);
+        EVP_CIPHER_CTX_init(&dctx);
+
+        if (EVP_CipherInit_ex(&ectx, c, NULL, NULL, NULL, 1) != 1)
+	    errx(1, "can't init encrypt");
+        if (EVP_CipherInit_ex(&dctx, c, NULL, NULL, NULL, 0) != 1)
+	    errx(1, "can't init decrypt");
+
+        EVP_CIPHER_CTX_set_key_length(&ectx, sizeof(key));
+        EVP_CIPHER_CTX_set_key_length(&dctx, sizeof(key));
+
+        if (EVP_CipherInit_ex(&ectx, NULL, NULL, key, iv, 1) != 1)
+	    errx(1, "can't init encrypt");
+        if (EVP_CipherInit_ex(&dctx, NULL, NULL, key, iv, 0) != 1)
+	    errx(1, "can't init decrypt");
+
+        if (!EVP_Cipher(&ectx, d, d, len))
+	    errx(1, "can't encrypt");
+        if (!EVP_Cipher(&dctx, d, d, len))
+	    errx(1, "can't decrypt");
+
+        EVP_CIPHER_CTX_cleanup(&ectx);
+        EVP_CIPHER_CTX_cleanup(&dctx);
+
+        STATS_END(M);
+
+	if (d[0] != 0x00 || d[len - 1] != ((len - 1) & 0xff))
+	    errx(1, "encrypt/decrypt inconsistent");
+    }
+
+    printf("%s: mean time %llu usec%s\n", cname, (unsigned long long)M,
+           (M == 1) ? "" : "s");
+
+    return 0;
+}
+
+static int
+test_bulk_digest(const char *cname, const EVP_MD *md)
+{
+    char digest[EVP_MAX_MD_SIZE];
+    int i;
+    unsigned int tmp = sizeof(digest);
+    int64_t M = 0;
+
+    if (md == NULL) {
+        printf("%s not supported\n", cname);
+	return 0;
+    }
+
+    for (i = 0; i < loops; i++) {
+        STATS_START(M);
+        EVP_Digest(d, len, digest, &tmp, md, NULL);
+        STATS_END(M);
+    }
+
+    printf("%s: mean time %llu usec%s\n", cname, (unsigned long long)M,
+           (M == 1) ? "" : "s");
+
+    return 0;
+}
+
+static void
+test_bulk_provider_hcrypto(void)
+{
+    test_bulk_cipher("hcrypto_aes_256_cbc",	EVP_hcrypto_aes_256_cbc());
+#if 0
+    test_bulk_cipher("hcrypto_aes_256_cfb8",	EVP_hcrypto_aes_256_cfb8());
+#endif
+    test_bulk_cipher("hcrypto_rc4",		EVP_hcrypto_rc4());
+    test_bulk_digest("hcrypto_md2",		EVP_hcrypto_md2());
+    test_bulk_digest("hcrypto_md4",		EVP_hcrypto_md4());
+    test_bulk_digest("hcrypto_md5",		EVP_hcrypto_md5());
+    test_bulk_digest("hcrypto_sha1",		EVP_hcrypto_sha1());
+    test_bulk_digest("hcrypto_sha256",		EVP_hcrypto_sha256());
+    test_bulk_digest("hcrypto_sha384",		EVP_hcrypto_sha384());
+    test_bulk_digest("hcrypto_sha512",		EVP_hcrypto_sha512());
+}
+
+#ifdef __APPLE__
+static void
+test_bulk_provider_cc(void)
+{
+    test_bulk_cipher("cc_aes_256_cbc",		EVP_cc_aes_256_cbc());
+#if 0
+    test_bulk_cipher("cc_aes_256_cfb8",		EVP_cc_aes_256_cfb8());
+#endif
+    test_bulk_cipher("cc_rc4",			EVP_cc_rc4());
+    test_bulk_digest("cc_md2",			EVP_cc_md2());
+    test_bulk_digest("cc_md4",			EVP_cc_md4());
+    test_bulk_digest("cc_md5",			EVP_cc_md5());
+    test_bulk_digest("cc_sha1",			EVP_cc_sha1());
+    test_bulk_digest("cc_sha256",		EVP_cc_sha256());
+    test_bulk_digest("cc_sha384",		EVP_cc_sha384());
+    test_bulk_digest("cc_sha512",		EVP_cc_sha512());
+}
+#endif /* __APPLE__ */
+
+#ifdef WIN32
+static void
+test_bulk_provider_w32crypto(void)
+{
+    test_bulk_cipher("w32crypto_aes_256_cbc",	EVP_w32crypto_aes_256_cbc());
+#if 0
+    test_bulk_cipher("w32crypto_aes_256_cfb8",	EVP_w32crypto_aes_256_cfb8());
+#endif
+    test_bulk_cipher("w32crypto_rc4",		EVP_w32crypto_rc4());
+    test_bulk_digest("w32crypto_md2",		EVP_w32crypto_md2());
+    test_bulk_digest("w32crypto_md4",		EVP_w32crypto_md4());
+    test_bulk_digest("w32crypto_md5",		EVP_w32crypto_md5());
+    test_bulk_digest("w32crypto_sha1",		EVP_w32crypto_sha1());
+    test_bulk_digest("w32crypto_sha256",	EVP_w32crypto_sha256());
+    test_bulk_digest("w32crypto_sha384",	EVP_w32crypto_sha384());
+    test_bulk_digest("w32crypto_sha512",	EVP_w32crypto_sha512());
+}
+#endif /* WIN32 */
+
+#if __sun || defined(PKCS11_MODULE_PATH)
+static void
+test_bulk_provider_pkcs11(void)
+{
+    test_bulk_cipher("pkcs11_aes_256_cbc",	EVP_pkcs11_aes_256_cbc());
+    test_bulk_cipher("pkcs11_rc4",		EVP_pkcs11_rc4());
+    test_bulk_digest("pkcs11_md5",		EVP_pkcs11_md5());
+    test_bulk_digest("pkcs11_sha1",		EVP_pkcs11_sha1());
+    test_bulk_digest("pkcs11_sha256",		EVP_pkcs11_sha256());
+    test_bulk_digest("pkcs11_sha384",		EVP_pkcs11_sha384());
+    test_bulk_digest("pkcs11_sha512",		EVP_pkcs11_sha512());
+}
+#endif /* __sun || PKCS11_MODULE_PATH */
+
+int
+main(int argc, char **argv)
+{
+    int ret = 0;
+    int idx = 0;
+    int i;
+
+    setprogname(argv[0]);
+
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &idx))
+	usage(1);
+
+    if (help_flag)
+	usage(0);
+
+    if(version_flag) {
+	print_version(NULL);
+	exit(0);
+    }
+
+    argc -= idx;
+    argv += idx;
+
+    len *= 1024;
+
+    d = emalloc(len);
+    for (i = 0; i < len; i++)
+        d[i] = i & 0xff;
+
+    if (strcmp(provider, "hcrypto") == 0)
+        test_bulk_provider_hcrypto();
+#ifdef __APPLE__
+    else if (strcmp(provider, "cc") == 0)
+        test_bulk_provider_cc();
+#endif
+#ifdef WIN32
+    else if (strcmp(provider, "w32crypto") == 0)
+        test_bulk_provider_w32crypto();
+#endif
+#if __sun || defined(PKCS11_MODULE_PATH)
+    else if (strcmp(provider, "pkcs11") == 0)
+        test_bulk_provider_pkcs11();
+#endif
+    else
+        usage(1);
+
+    free(d);
+
+    return ret;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_cipher.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_cipher.c
index 066b7aa2c..87c82f2c1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_cipher.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_cipher.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: test_cipher.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_cipher.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -34,20 +34,20 @@
  */
 
 #include <config.h>
+#include <krb5/roken.h>
 
 #define HC_DEPRECATED_CRYPTO
 
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <krb5/getarg.h>
-#include <krb5/roken.h>
 
 #include <evp.h>
 #include <evp-hcrypto.h>
 #include <evp-cc.h>
+#if defined(_WIN32)
+#include <evp-w32.h>
+#endif
+#include <evp-pkcs11.h>
+#include <evp-openssl.h>
 #include <krb5/hex.h>
 #include <err.h>
 
@@ -70,7 +70,8 @@ struct tests aes_tests[] = {
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
       16,
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-      "\xdc\x95\xc0\x78\xa2\x40\x89\x89\xad\x48\xa2\x14\x92\x84\x20\x87"
+      "\xdc\x95\xc0\x78\xa2\x40\x89\x89\xad\x48\xa2\x14\x92\x84\x20\x87",
+      NULL
     }
 };
 
@@ -81,10 +82,25 @@ struct tests aes_cfb_tests[] = {
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
       16,
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-      "\x66\xe9\x4b\xd4\xef\x8a\x2c\x3b\x88\x4c\xfa\x59\xca\x34\x2b\x2e"
+      "\x66\x16\xf9\x2e\x42\xa8\xf1\x1a\x91\x16\x68\x57\x8e\xc3\xaa\x0f",
+      NULL
     }
 };
 
+
+struct tests rc2_tests[] = {
+    { "rc2",
+      "\x88\xbc\xa9\x0e\x90\x87\x5a\x7f\x0f\x79\xc3\x84\x62\x7b\xaf\xb2",
+      16,
+      "\x00\x00\x00\x00\x00\x00\x00\x00",
+      8,
+      "\x00\x00\x00\x00\x00\x00\x00\x00",
+      "\x22\x69\x55\x2a\xb0\xf8\x5c\xa6",
+      NULL
+    }
+};
+
+
 struct tests rc2_40_tests[] = {
     { "rc2-40",
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
@@ -92,7 +108,8 @@ struct tests rc2_40_tests[] = {
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
       16,
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-      "\xc0\xb8\xff\xa5\xd6\xeb\xc9\x62\xcc\x52\x5f\xfe\x9a\x3c\x97\xe6"
+      "\xc0\xb8\xff\xa5\xd6\xeb\xc9\x62\xcc\x52\x5f\xfe\x9a\x3c\x97\xe6",
+      NULL
     }
 };
 
@@ -105,7 +122,8 @@ struct tests des_ede3_tests[] = {
       "\xbf\x9a\x12\xb7\x26\x69\xfd\x05",
       16,
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-      "\x55\x95\x97\x76\xa9\x6c\x66\x40\x64\xc7\xf4\x1c\x21\xb7\x14\x1b"
+      "\x55\x95\x97\x76\xa9\x6c\x66\x40\x64\xc7\xf4\x1c\x21\xb7\x14\x1b",
+      NULL
     }
 };
 
@@ -225,7 +243,8 @@ struct tests rc4_tests[] = {
 	"\x89\x21\xc2\xf5\xa4\x63\x93\x8c"
 	"\xe0\x98\x22\x65\xee\xf7\x01\x79"
 	"\xbc\x55\x3f\x33\x9e\xb1\xa4\xc1"
-	"\xaf\x5f\x6a\x54\x7f"
+	"\xaf\x5f\x6a\x54\x7f",
+	NULL
     }
 };
 
@@ -261,7 +280,7 @@ test_cipher(int i, const EVP_CIPHER *c, struct tests *t)
     d = emalloc(t->datasize);
 
     if (!EVP_Cipher(&ectx, d, t->indata, t->datasize))
-	return 1;
+	errx(1, "%s: %d EVP_Cipher encrypt failed", t->name, i);
 
     if (memcmp(d, t->outdata, t->datasize) != 0) {
 	char *s, *s2;
@@ -271,7 +290,7 @@ test_cipher(int i, const EVP_CIPHER *c, struct tests *t)
     }
 
     if (!EVP_Cipher(&dctx, d, d, t->datasize))
-	return 1;
+	errx(1, "%s: %d EVP_Cipher decrypt failed", t->name, i);
 
     if (memcmp(d, t->indata, t->datasize) != 0) {
 	char *s;
@@ -335,7 +354,8 @@ main(int argc, char **argv)
 	ret += test_cipher(i, EVP_hcrypto_aes_256_cbc(), &aes_tests[i]);
     for (i = 0; i < sizeof(aes_cfb_tests)/sizeof(aes_cfb_tests[0]); i++)
 	ret += test_cipher(i, EVP_hcrypto_aes_128_cfb8(), &aes_cfb_tests[i]);
-
+    for (i = 0; i < sizeof(rc2_tests)/sizeof(rc2_tests[0]); i++)
+	ret += test_cipher(i, EVP_hcrypto_rc2_cbc(), &rc2_tests[i]);
     for (i = 0; i < sizeof(rc2_40_tests)/sizeof(rc2_40_tests[0]); i++)
 	ret += test_cipher(i, EVP_hcrypto_rc2_40_cbc(), &rc2_40_tests[i]);
     for (i = 0; i < sizeof(des_ede3_tests)/sizeof(des_ede3_tests[0]); i++)
@@ -350,10 +370,8 @@ main(int argc, char **argv)
 #ifdef __APPLE__
     for (i = 0; i < sizeof(aes_tests)/sizeof(aes_tests[0]); i++)
 	ret += test_cipher(i, EVP_cc_aes_256_cbc(), &aes_tests[i]);
-#if 0
     for (i = 0; i < sizeof(aes_cfb_tests)/sizeof(aes_cfb_tests[0]); i++)
 	ret += test_cipher(i, EVP_cc_aes_128_cfb8(), &aes_cfb_tests[i]);
-#endif
     for (i = 0; i < sizeof(rc2_40_tests)/sizeof(rc2_40_tests[0]); i++)
 	ret += test_cipher(i, EVP_cc_rc2_40_cbc(), &rc2_40_tests[i]);
     for (i = 0; i < sizeof(des_ede3_tests)/sizeof(des_ede3_tests[0]); i++)
@@ -363,7 +381,55 @@ main(int argc, char **argv)
 			   &camellia128_tests[i]);
     for (i = 0; i < sizeof(rc4_tests)/sizeof(rc4_tests[0]); i++)
 	ret += test_cipher(i, EVP_cc_rc4(), &rc4_tests[i]);
-#endif
+#endif /* __APPLE__ */
+
+    /* Windows CNG (if available) */
+#ifdef WIN32
+    for (i = 0; i < sizeof(aes_tests)/sizeof(aes_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_aes_256_cbc(), &aes_tests[i]);
+    for (i = 0; i < sizeof(aes_cfb_tests)/sizeof(aes_cfb_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_aes_128_cfb8(), &aes_cfb_tests[i]);
+    for (i = 0; i < sizeof(rc2_tests)/sizeof(rc2_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_rc2_cbc(), &rc2_tests[i]);
+    for (i = 0; i < sizeof(rc2_40_tests)/sizeof(rc2_40_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_rc2_40_cbc(), &rc2_40_tests[i]);
+    for (i = 0; i < sizeof(des_ede3_tests)/sizeof(des_ede3_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_des_ede3_cbc(), &des_ede3_tests[i]);
+    for (i = 0; i < sizeof(rc4_tests)/sizeof(rc4_tests[0]); i++)
+	ret += test_cipher(i, EVP_w32crypto_rc4(), &rc4_tests[i]);
+#endif /* WIN32 */
+
+    /* PKCS#11 */
+#if __sun || defined(PKCS11_MODULE_PATH)
+    for (i = 0; i < sizeof(aes_tests)/sizeof(aes_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_aes_256_cbc(), &aes_tests[i]);
+    for (i = 0; i < sizeof(aes_cfb_tests)/sizeof(aes_cfb_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_aes_128_cfb8(), &aes_cfb_tests[i]);
+    for (i = 0; i < sizeof(rc2_tests)/sizeof(rc2_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_rc2_cbc(), &rc2_tests[i]);
+    for (i = 0; i < sizeof(rc2_40_tests)/sizeof(rc2_40_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_rc2_40_cbc(), &rc2_40_tests[i]);
+    for (i = 0; i < sizeof(des_ede3_tests)/sizeof(des_ede3_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_des_ede3_cbc(), &des_ede3_tests[i]);
+    for (i = 0; i < sizeof(rc4_tests)/sizeof(rc4_tests[0]); i++)
+	ret += test_cipher(i, EVP_pkcs11_rc4(), &rc4_tests[i]);
+#endif /* PKCS11_MODULE_PATH */
+
+    /* OpenSSL */
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    for (i = 0; i < sizeof(aes_tests)/sizeof(aes_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_aes_256_cbc(), &aes_tests[i]);
+    for (i = 0; i < sizeof(aes_cfb_tests)/sizeof(aes_cfb_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_aes_128_cfb8(), &aes_cfb_tests[i]);
+    for (i = 0; i < sizeof(rc2_tests)/sizeof(rc2_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_rc2_cbc(), &rc2_tests[i]);
+    for (i = 0; i < sizeof(rc2_40_tests)/sizeof(rc2_40_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_rc2_40_cbc(), &rc2_40_tests[i]);
+    for (i = 0; i < sizeof(des_ede3_tests)/sizeof(des_ede3_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_des_ede3_cbc(), &des_ede3_tests[i]);
+    for (i = 0; i < sizeof(rc4_tests)/sizeof(rc4_tests[0]); i++)
+	ret += test_cipher(i, EVP_ossl_rc4(), &rc4_tests[i]);
+#endif /* PKCS11_MODULE_PATH */
 
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_crypto.in b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_crypto.in
index 40c894898..e56d3f6a0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_crypto.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_crypto.in
@@ -92,7 +92,7 @@ done
 
 #
 # Last time we run is w/o HOME and RANDFILE to make sure we can do
-# RAND_file_name() when the enviroment is lacking those.
+# RAND_file_name() when the environment is lacking those.
 #
 
 if [ -r /dev/random -o -r /dev/urandom -o -r /dev/srandom -o -r /dev/arandom ] ; then
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_dh.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_dh.c
index c800e3382..c346889e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_dh.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_dh.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_dh.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_dh.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
 * Copyright (c) 2007, Novell, Inc.
@@ -40,11 +40,9 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <ctype.h>
-
 #include <krb5/roken.h>
+
+#include <ctype.h>
 #include <krb5/getarg.h>
 
 #include <dh.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_engine_dso.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_engine_dso.c
index fa7aa025b..8717939f9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_engine_dso.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_engine_dso.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_engine_dso.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_engine_dso.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,9 +34,6 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-
 #include <krb5/roken.h>
 #include <krb5/getarg.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_hmac.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_hmac.c
index 190c55b93..c1ccfdd16 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_hmac.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_hmac.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_hmac.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_hmac.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,16 +34,10 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 
 #include <hmac.h>
 #include <evp.h>
-#include <krb5/roken.h>
 
 int
 main(int argc, char **argv)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs12.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs12.c
index eb091a373..009a653b4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs12.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs12.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pkcs12.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: test_pkcs12.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,12 +34,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 
 #include <pkcs12.h>
 #include <evp.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs5.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs5.c
index 9569a678c..52a24aa0e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs5.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_pkcs5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pkcs5.c,v 1.1.1.1 2011/04/13 18:14:51 elric Exp $	*/
+/*	$NetBSD: test_pkcs5.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -34,12 +34,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 #include <err.h>
 
 #include <evp.h>
@@ -114,24 +109,24 @@ test_pkcs5_pbe2(const struct tests *t)
     unsigned char key[32];
     int ret, error = 0;
 
-    ret = PKCS5_PBKDF2_HMAC_SHA1(t->password, strlen(t->password),
-				 t->salt, strlen(t->salt),
-				 t->iterations,
-				 16, key);
+    ret = PKCS5_PBKDF2_HMAC(t->password, strlen(t->password),
+			    t->salt, strlen(t->salt),
+			    t->iterations, EVP_sha1(),
+			    16, key);
     if (ret != 1)
-	errx(1, "PKCS5_PBKDF2_HMAC_SHA1: %d", ret);
+	errx(1, "PKCS5_PBKDF2_HMAC: %d", ret);
 
     if (memcmp(t->pbkdf2_128, key, 16) != 0) {
 	printf("incorrect 128 key\n");
 	error++;
     }
 
-    ret = PKCS5_PBKDF2_HMAC_SHA1(t->password, strlen(t->password),
-				 t->salt, strlen(t->salt),
-				 t->iterations,
-				 32, key);
+    ret = PKCS5_PBKDF2_HMAC(t->password, strlen(t->password),
+			    t->salt, strlen(t->salt),
+			    t->iterations, EVP_sha1(),
+			    32, key);
     if (ret != 1)
-	errx(1, "PKCS5_PBKDF2_HMAC_SHA1: %d", ret);
+	errx(1, "PKCS5_PBKDF2_HMAC: %d", ret);
 
     if (memcmp(t->pbkdf2_256, key, 32) != 0) {
 	printf("incorrect 256 key\n");
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rand.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rand.c
index 74d42f878..7020ee1bf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rand.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rand.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_rand.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_rand.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -36,10 +36,9 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-
 #include <krb5/roken.h>
+#include <math.h>
+
 #include <krb5/getarg.h>
 
 #include "rand.h"
@@ -106,10 +105,7 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= idx;
-    argv += idx;
-
-    if (argc != 0)
+    if (argc != idx)
 	usage(1);
 
     buffer = emalloc(len);
@@ -125,10 +121,6 @@ main(int argc, char **argv)
 	else if (strcasecmp(rand_method, "unix") == 0)
 	    RAND_set_rand_method(RAND_unix_method());
 #endif
-#ifndef NO_RAND_EGD_METHOD
-	else if (strcasecmp(rand_method, "egd") == 0)
-	    RAND_set_rand_method(RAND_egd_method());
-#endif
 #ifdef WIN32
 	else if (strcasecmp(rand_method, "w32crypto") == 0)
 	    RAND_set_rand_method(RAND_w32crypto_method());
@@ -151,12 +143,20 @@ main(int argc, char **argv)
 
     /* head vs tail */
     if (len >= 100000) {
-	int bit, i;
+	unsigned bytes[256]; 
+	unsigned bits[8];
+	size_t bit, i;
 	double res;
-	int bits[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
+	double slen = sqrt((double)len);
+
+	memset(bits, 0, sizeof(bits));
+	memset(bytes, 0, sizeof(bytes));
 
 	for (i = 0; i < len; i++) {
 	    unsigned char c = ((unsigned char *)buffer)[i];
+
+	    bytes[c]++;
+
 	    for (bit = 0; bit < 8 && c; bit++) {
 		if (c & 1)
 		    bits[bit]++;
@@ -164,14 +164,44 @@ main(int argc, char **argv)
 	    }
 	}
 
+	/*
+	 * The count for each bit value has a mean of n*p = len/2,
+	 * and a standard deviation of sqrt(n*p*q) ~ sqrt(len/4).
+	 * Normalizing by dividing by "n*p", we get a mean of 1 and
+	 * a standard deviation of sqrt(q/n*p) = 1/sqrt(len).
+	 *
+	 * A 5.33-sigma event happens 1 time in 10 million.
+	 * A 5.73-sigma event happens 1 time in 100 million.
+	 * A 6.11-sigma event happens 1 time in 1000 million.
+	 *
+	 * We tolerate 5.33-sigma events (we have 8 not entirely
+	 * independent chances of skewed results) and want to fail
+	 * with a good RNG less often than 1 time in million.
+	 */
 	for (bit = 0; bit < 8; bit++) {
+	    res = slen * fabs(1.0 - 2 * (double)bits[bit] / len);
+	    if (res > 5.33)
+		errx(1, "head%d vs tail%d: %.1f-sigma (%d of %d)",
+		     (int)bit, (int)bit, res, bits[bit], len);
+	    printf("head vs tails bit%d: %f-sigma\n", (int)bit, res);
+	}
 
-	    res = ((double)abs(len - bits[bit] * 2)) / (double)len;
-	    if (res > 0.005)
-		errx(1, "head%d vs tail%d > 0.5%%%% %lf == %d vs %d",
-		     bit, bit, res, len, bits[bit]);
-
-	    printf("head vs tails bit%d: %lf\n", bit, res);
+	/*
+	 * The count of each byte value has a mean of n*p = len/256,
+	 * and a standard deviation of sqrt(n*p*q) ~ sqrt(len/256).
+	 * Normalizing by dividing by "n*p", we get a mean of 1 and
+	 * a standard deviation of sqrt(q/n*p) ~ 16/sqrt(len).
+	 *
+	 * We tolerate 5.73-sigma events (we have 256 not entirely
+	 * independent chances of skewed results).  Note, for example,
+	 * a 5.2-sigma event was observed in ~5,000 runs.
+	 */
+	for (i = 0; i < 256; i++) {
+	    res = (slen / 16) * fabs(1.0 - 256 * (double)bytes[i] / len);
+	    if (res > 5.73)
+		errx(1, "byte %d: %.1f-sigma (%d of %d)",
+		     (int) i, res, bytes[i], len);
+	    printf("byte %d: %f-sigma\n", (int)i, res);
 	}
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rsa.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rsa.c
index 6acef8e7c..3ec10bacb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rsa.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/test_rsa.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_rsa.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: test_rsa.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -34,9 +34,6 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-
 #include <krb5/roken.h>
 #include <krb5/getarg.h>
 
@@ -151,7 +148,7 @@ cb_func(int a, int b, BN_GENCB *c)
 }
 
 static RSA *
-read_key(ENGINE *engine, const char *rsa_key)
+read_key(ENGINE *engine, const char *keyfile)
 {
     unsigned char buf[1024 * 4];
     const unsigned char *p;
@@ -159,22 +156,22 @@ read_key(ENGINE *engine, const char *rsa_key)
     RSA *rsa;
     FILE *f;
 
-    f = fopen(rsa_key, "rb");
+    f = fopen(keyfile, "rb");
     if (f == NULL)
-	err(1, "could not open file %s", rsa_key);
+	err(1, "could not open file %s", keyfile);
     rk_cloexec_file(f);
 
     size = fread(buf, 1, sizeof(buf), f);
     fclose(f);
     if (size == 0)
-	err(1, "failed to read file %s", rsa_key);
+	err(1, "failed to read file %s", keyfile);
     if (size == sizeof(buf))
-	err(1, "key too long in file %s!", rsa_key);
+	err(1, "key too long in file %s!", keyfile);
 
     p = buf;
     rsa = d2i_RSAPrivateKey(NULL, &p, size);
     if (rsa == NULL)
-	err(1, "failed to parse key in file %s", rsa_key);
+	err(1, "failed to parse key in file %s", keyfile);
 
     RSA_set_method(rsa, ENGINE_get_RSA(engine));
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.c
index 3314907da..cb957a44a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ui.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: ui.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000, 2005 Kungliga Tekniska Högskolan
@@ -34,15 +34,11 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <krb5/roken.h>
 #include <signal.h>
 #ifdef HAVE_TERMIOS_H
 #include <termios.h>
 #endif
-#include <krb5/roken.h>
 
 #include <ui.h>
 #ifdef HAVE_CONIO_H
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.h
index 319aac323..f985cc3e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/ui.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ui.h,v 1.1.1.2 2011/04/14 14:08:34 elric Exp $	*/
+/*	$NetBSD: ui.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/undef.h b/crypto/external/bsd/heimdal/dist/lib/hcrypto/undef.h
new file mode 100644
index 000000000..46aea7244
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/undef.h
@@ -0,0 +1,171 @@
+/*	$NetBSD: undef.h,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
+
+/*
+ * Copyright (c) 2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef HEIM_UNDEF_H
+#define HEIM_UNDEF_H 1
+
+#undef BIGNUM
+#undef BN_CTX
+#undef BN_BLINDING
+#undef BN_MONT_CTX
+#undef BN_GENCB
+#undef DH
+#undef DH_METHOD
+#undef DSA
+#undef DSA_METHOD
+#undef RSA
+#undef RSA_METHOD
+#undef RAND_METHOD
+#undef ENGINE
+#undef BN_GENCB_call
+#undef BN_GENCB_set
+#undef BN_CTX_new
+#undef BN_CTX_free
+#undef BN_CTX_start
+#undef BN_CTX_get
+#undef BN_CTX_end
+#undef BN_is_negative
+#undef BN_rand
+#undef BN_num_bits
+#undef BN_num_bytes
+#undef BN_new
+#undef BN_clear_free
+#undef BN_bin2bn
+#undef BN_bn2bin
+#undef BN_uadd
+#undef BN_set_negative
+#undef BN_set_word
+#undef BN_get_word
+#undef BN_cmp
+#undef BN_free
+#undef BN_is_bit_set
+#undef BN_clear
+#undef BN_dup
+#undef BN_set_bit
+#undef BN_clear_bit
+#undef BN_bn2hex
+#undef BN_hex2bn
+#undef EVP_CIPHER_CTX_block_size
+#undef EVP_CIPHER_CTX_cipher
+#undef EVP_CIPHER_CTX_cleanup
+#undef EVP_CIPHER_CTX_flags
+#undef EVP_CIPHER_CTX_get_app_data
+#undef EVP_CIPHER_CTX_init
+#undef EVP_CIPHER_CTX_iv_length
+#undef EVP_CIPHER_CTX_key_length
+#undef EVP_CIPHER_CTX_mode
+#undef EVP_CIPHER_CTX_set_app_data
+#undef EVP_CIPHER_CTX_set_key_length
+#undef EVP_CIPHER_CTX_set_padding
+#undef EVP_CIPHER_block_size
+#undef EVP_CIPHER_iv_length
+#undef EVP_CIPHER_key_length
+#undef EVP_Cipher
+#undef EVP_CipherInit_ex
+#undef EVP_CipherUpdate
+#undef EVP_CipherFinal_ex
+#undef EVP_Digest
+#undef EVP_DigestFinal_ex
+#undef EVP_DigestInit_ex
+#undef EVP_DigestUpdate
+#undef EVP_MD_CTX_block_size
+#undef EVP_MD_CTX_cleanup
+#undef EVP_MD_CTX_create
+#undef EVP_MD_CTX_init
+#undef EVP_MD_CTX_destroy
+#undef EVP_MD_CTX_md
+#undef EVP_MD_CTX_size
+#undef EVP_MD_block_size
+#undef EVP_MD_size
+#undef EVP_aes_128_cbc
+#undef EVP_aes_192_cbc
+#undef EVP_aes_256_cbc
+#undef EVP_aes_128_cfb8
+#undef EVP_aes_192_cfb8
+#undef EVP_aes_256_cfb8
+#undef EVP_des_cbc
+#undef EVP_des_ede3_cbc
+#undef EVP_enc_null
+#undef EVP_md2
+#undef EVP_md4
+#undef EVP_md5
+#undef EVP_md_null
+#undef EVP_rc2_40_cbc
+#undef EVP_rc2_64_cbc
+#undef EVP_rc2_cbc
+#undef EVP_rc4
+#undef EVP_rc4_40
+#undef EVP_camellia_128_cbc
+#undef EVP_camellia_192_cbc
+#undef EVP_camellia_256_cbc
+#undef EVP_sha
+#undef EVP_sha1
+#undef EVP_sha256
+#undef EVP_sha384
+#undef EVP_sha512
+#undef PKCS5_PBKDF2_HMAC
+#undef PKCS5_PBKDF2_HMAC_SHA1
+#undef EVP_BytesToKey
+#undef EVP_get_cipherbyname
+#undef OpenSSL_add_all_algorithms
+#undef OpenSSL_add_all_algorithms_conf
+#undef OpenSSL_add_all_algorithms_noconf
+#undef EVP_CIPHER_CTX_ctrl
+#undef EVP_CIPHER_CTX_rand_key
+#undef hcrypto_validate
+#undef EVP_MD_CTX
+#undef EVP_PKEY
+#undef EVP_MD
+#undef EVP_CIPHER
+#undef EVP_CIPHER_CTX
+#undef EVP_CIPH_STREAM_CIPHER
+#undef EVP_CIPH_CBC_MODE
+#undef EVP_CIPH_CFB8_MODE
+#undef EVP_CIPH_MODE
+#undef EVP_CIPH_CTRL_INIT
+#undef EVP_CTRL_INIT
+#undef EVP_CIPH_VARIABLE_LENGTH
+#undef EVP_CIPH_ALWAYS_CALL_INIT
+#undef EVP_CIPH_RAND_KEY
+#undef EVP_CTRL_RAND_KEY
+#undef NID_md2
+#undef NID_md4
+#undef NID_md5
+#undef NID_sha1
+#undef NID_sha256
+#undef NID_sha384
+#undef NID_sha512
+
+#endif /* HEIM_UNDEF_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/validate.c b/crypto/external/bsd/heimdal/dist/lib/hcrypto/validate.c
index ae0fbcd83..904ddb036 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/validate.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/validate.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: validate.c,v 1.1.1.2 2014/04/24 12:45:30 pettai Exp $	*/
+/*	$NetBSD: validate.c,v 1.2 2017/01/28 21:31:47 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
@@ -34,12 +34,6 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <krb5/roken.h>
 
 #include <evp.h>
@@ -68,7 +62,8 @@ static struct tests hc_tests[] = {
 	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
 	16,
 	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-	"\xdc\x95\xc0\x78\xa2\x40\x89\x89\xad\x48\xa2\x14\x92\x84\x20\x87"
+	"\xdc\x95\xc0\x78\xa2\x40\x89\x89\xad\x48\xa2\x14\x92\x84\x20\x87",
+        NULL
     },
 #if 0
     {
@@ -92,7 +87,8 @@ static struct tests hc_tests[] = {
 	"\xbf\x9a\x12\xb7\x26\x69\xfd\x05",
 	16,
 	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
-	"\x55\x95\x97\x76\xa9\x6c\x66\x40\x64\xc7\xf4\x1c\x21\xb7\x14\x1b"
+	"\x55\x95\x97\x76\xa9\x6c\x66\x40\x64\xc7\xf4\x1c\x21\xb7\x14\x1b",
+        NULL
     },
 #if 0
     {
@@ -213,7 +209,8 @@ static struct tests hc_tests[] = {
 	"\x89\x21\xc2\xf5\xa4\x63\x93\x8c"
 	"\xe0\x98\x22\x65\xee\xf7\x01\x79"
 	"\xbc\x55\x3f\x33\x9e\xb1\xa4\xc1"
-	"\xaf\x5f\x6a\x54\x7f"
+	"\xaf\x5f\x6a\x54\x7f",
+        NULL
     }
 };
 
@@ -255,8 +252,10 @@ test_cipher(struct tests *t)
     if (memcmp(d, t->indata, t->datasize) != 0)
 	errx(1, "%s: decrypt not the same", t->name);
 
+#if 0
     if (t->outiv)
 	/* XXXX check  */;
+#endif
 
     EVP_CIPHER_CTX_cleanup(&ectx);
     EVP_CIPHER_CTX_cleanup(&dctx);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/version-script.map b/crypto/external/bsd/heimdal/dist/lib/hcrypto/version-script.map
index 6ad7544ec..7cf203d5a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/hcrypto/version-script.map
@@ -174,6 +174,8 @@ HEIMDAL_CRYPTO_1.0 {
 		hc_EVP_cc_md5;
 		hc_EVP_cc_sha1;
 		hc_EVP_cc_sha256;
+		hc_EVP_cc_sha384;
+		hc_EVP_cc_sha512;
 		hc_EVP_cc_des_ede3_cbc;
 		hc_EVP_cc_aes_128_cbc;
 		hc_EVP_cc_aes_192_cbc;
@@ -199,6 +201,43 @@ HEIMDAL_CRYPTO_1.0 {
 		hc_EVP_hcrypto_rc4;
 		hc_EVP_hcrypto_rc4_40;
 
+		hc_EVP_ossl_md2;
+		hc_EVP_ossl_md4;
+		hc_EVP_ossl_md5;
+		hc_EVP_ossl_sha1;
+		hc_EVP_ossl_sha256;
+		hc_EVP_ossl_sha384;
+		hc_EVP_ossl_sha512;
+		hc_EVP_ossl_des_ede3_cbc;
+		hc_EVP_ossl_aes_128_cbc;
+		hc_EVP_ossl_aes_192_cbc;
+		hc_EVP_ossl_aes_256_cbc;
+		hc_EVP_ossl_aes_128_cfb8;
+		hc_EVP_ossl_aes_192_cfb8;
+		hc_EVP_ossl_aes_256_cfb8;
+		hc_EVP_ossl_rc2_cbc;
+		hc_EVP_ossl_rc2_40_cbc;
+		hc_EVP_ossl_rc4;
+		hc_EVP_ossl_rc4_40;
+
+		hc_EVP_pkcs11_md2;
+		hc_EVP_pkcs11_md4;
+		hc_EVP_pkcs11_md5;
+		hc_EVP_pkcs11_sha1;
+		hc_EVP_pkcs11_sha256;
+		hc_EVP_pkcs11_des_ede3_cbc;
+		hc_EVP_pkcs11_aes_128_cbc;
+		hc_EVP_pkcs11_aes_192_cbc;
+		hc_EVP_pkcs11_aes_256_cbc;
+		hc_EVP_pkcs11_aes_128_cfb8;
+		hc_EVP_pkcs11_aes_192_cfb8;
+		hc_EVP_pkcs11_aes_256_cfb8;
+		hc_EVP_pkcs11_rc2_40_cbc;
+		hc_EVP_pkcs11_rc2_64_cbc;
+		hc_EVP_pkcs11_rc2_cbc;
+		hc_EVP_pkcs11_rc4;
+		hc_EVP_pkcs11_rc4_40;
+
 		hc_EVP_hcrypto_aes_128_cts;
 		hc_EVP_hcrypto_aes_192_cts;
 		hc_EVP_hcrypto_aes_256_cts;
@@ -222,13 +261,11 @@ HEIMDAL_CRYPTO_1.0 {
 		hc_OpenSSL_add_all_algorithms_conf;
 		hc_OpenSSL_add_all_algorithms_noconf;
 		hc_PKCS12_key_gen;
+		hc_PKCS5_PBKDF2_HMAC;
 		hc_PKCS5_PBKDF2_HMAC_SHA1;
 		hc_RAND_add;
 		hc_RAND_bytes;
 		hc_RAND_cleanup;
-		hc_RAND_egd;
-		hc_RAND_egd_bytes;
-		hc_RAND_egd_method;
 		hc_RAND_file_name;
 		hc_RAND_fortuna_method;
 		hc_RAND_get_rand_method;
@@ -289,6 +326,7 @@ HEIMDAL_CRYPTO_1.0 {
 		hc_EVP_CIPHER_CTX_ctrl;
 		hc_EVP_CIPHER_CTX_rand_key;
 		hc_EVP_CIPHER_CTX_set_key_length;
+		hc_EVP_hcrypto_rc2_cbc;
 		hc_EVP_hcrypto_rc2_40_cbc;
 		hc_EVP_hcrypto_camellia_128_cbc;
 		hc_EVP_CipherUpdate;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/hdb/Makefile.am
index 7f53a4fe7..c9b6dcf94 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/Makefile.am
@@ -2,7 +2,7 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += -I../asn1 -I$(srcdir)/../asn1 $(INCLUDE_hcrypto)
+AM_CPPFLAGS += -I../asn1 -I$(srcdir)/../asn1
 AM_CPPFLAGS += $(INCLUDE_openldap) -DHDB_DB_DIR=\"$(DIR_hdbdir)\"
 AM_CPPFLAGS += -I$(srcdir)/../krb5
 AM_CPPFLAGS += $(INCLUDE_sqlite3)
@@ -29,22 +29,24 @@ gen_files_hdb = \
 	asn1_HDB_Ext_Lan_Manager_OWF.x \
 	asn1_HDB_Ext_Password.x \
 	asn1_HDB_Ext_Aliases.x \
+	asn1_HDB_Ext_KeySet.x \
 	asn1_HDB_extension.x \
 	asn1_HDB_extensions.x \
 	asn1_hdb_entry.x \
 	asn1_hdb_entry_alias.x \
-	asn1_hdb_keyset.x
+	asn1_hdb_keyset.x \
+	asn1_Keys.x
 
 CLEANFILES = $(BUILT_SOURCES) $(gen_files_hdb) \
-	hdb_asn1{,-priv}.h* hdb_asn1_files hdb_asn1-template.c*
+	hdb_asn1{,-priv}.h* hdb_asn1_files hdb_asn1-template.[cx]
 
 LDADD = libhdb.la \
-	$(LIB_openldap) \
-	$(LIB_libintl) \
 	../krb5/libkrb5.la \
 	../asn1/libasn1.la \
 	$(LIB_hcrypto) \
 	$(LIB_roken) \
+	$(LIB_openldap) \
+	$(LIB_libintl) \
 	$(LIB_ldopen)
 
 
@@ -70,7 +72,7 @@ if versionscript
 libhdb_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 
-noinst_PROGRAMS = test_dbinfo test_hdbkeys test_mkey
+noinst_PROGRAMS = test_dbinfo test_hdbkeys test_mkey test_hdbplugin
 
 dist_libhdb_la_SOURCES =			\
 	common.c				\
@@ -81,9 +83,9 @@ dist_libhdb_la_SOURCES =			\
 	hdb.c					\
 	hdb-sqlite.c				\
 	hdb-keytab.c				\
+	hdb-mdb.c				\
 	hdb-mitdb.c				\
 	hdb_locl.h				\
-	hdb-private.h				\
 	keys.c					\
 	keytab.c				\
 	dbinfo.c				\
@@ -95,9 +97,11 @@ nodist_libhdb_la_SOURCES = $(BUILT_SOURCES)
 
 libhdb_la_DEPENDENCIES = version-script.map
 
-include_HEADERS = hdb.h hdb-protos.h
+include_HEADERS = hdb.h $(srcdir)/hdb-protos.h
 nodist_include_HEADERS =  hdb_err.h hdb_asn1.h
 
+noinst_HEADERS = $(srcdir)/hdb-private.h
+
 libhdb_la_LIBADD = \
 	$(LIB_com_err) \
 	../krb5/libkrb5.la \
@@ -106,27 +110,36 @@ libhdb_la_LIBADD = \
 	$(LIBADD_roken) \
 	$(ldap_lib) \
 	$(LIB_dlopen) \
-	$(DBLIB) \
-	$(LIB_NDBM)
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
+
+HDB_PROTOS = $(srcdir)/hdb-protos.h $(srcdir)/hdb-private.h
+
+ALL_OBJECTS  = $(libhdb_la_OBJECTS)
+ALL_OBJECTS += $(test_dbinfo_OBJECTS)
+ALL_OBJECTS += $(test_hdbkeys_OBJECTS)
+ALL_OBJECTS += $(test_mkey_OBJECTS)
+ALL_OBJECTS += $(test_hdbplugin_OBJECTS)
+
+$(ALL_OBJECTS): $(HDB_PROTOS)
 
-$(libhdb_la_OBJECTS): $(srcdir)/hdb-protos.h $(srcdir)/hdb-private.h
 $(libhdb_la_OBJECTS): hdb_asn1.h hdb_asn1-priv.h hdb_err.h
 
-$(srcdir)/hdb-protos.h:
+$(srcdir)/hdb-protos.h: $(dist_libhdb_la_SOURCES)
 	cd $(srcdir); perl ../../cf/make-proto.pl -q -P comment -o hdb-protos.h $(dist_libhdb_la_SOURCES) || rm -f hdb-protos.h
 
-$(srcdir)/hdb-private.h:
+$(srcdir)/hdb-private.h: $(dist_libhdb_la_SOURCES)
 	cd $(srcdir); perl ../../cf/make-proto.pl -q -P comment -p hdb-private.h $(dist_libhdb_la_SOURCES) || rm -f hdb-private.h
 
 $(gen_files_hdb) hdb_asn1.hx hdb_asn1-priv.hx: hdb_asn1_files
 
 hdb_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/hdb.asn1
-	$(ASN1_COMPILE) $(srcdir)/hdb.asn1 hdb_asn1
+	$(ASN1_COMPILE) --sequence=HDB-Ext-KeySet --sequence=Keys $(srcdir)/hdb.asn1 hdb_asn1
 
 test_dbinfo_LIBS = libhdb.la
 
 test_hdbkeys_LIBS = ../krb5/libkrb5.la libhdb.la
 test_mkey_LIBS = $(test_hdbkeys_LIBS)
+test_hdbplugin_LIBS = $(test_hdbkeys_LIBS)
 
 # to help stupid solaris make
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/hdb/NTMakefile
index ef696fb3a..01671b078 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/NTMakefile
@@ -37,7 +37,7 @@ gen_files_hdb = $(OBJ)\asn1_hdb_asn1.x
 
 $(gen_files_hdb) $(OBJ)\hdb_asn1.hx $(OBJ)\hdb_asn1-priv.hx: $(BINDIR)\asn1_compile.exe hdb.asn1
 	cd $(OBJ)
-	$(BINDIR)\asn1_compile.exe --sequence=HDB-Ext-Keyset --sequence=Keys --one-code-file $(SRCDIR)\hdb.asn1 hdb_asn1
+	$(BINDIR)\asn1_compile.exe --sequence=HDB-Ext-KeySet --sequence=Keys --one-code-file $(SRCDIR)\hdb.asn1 hdb_asn1
 	cd $(SRCDIR)
 
 $(gen_files_hdb:.x=.c): $$(@R).x
@@ -73,6 +73,7 @@ dist_libhdb_la_SOURCES =			\
 	hdb-sqlite.c				\
 	hdb-keytab.c				\
 	hdb-mitdb.c				\
+	hdb-mdb.c				\
 	hdb_locl.h				\
 	keys.c					\
 	keytab.c				\
@@ -127,9 +128,9 @@ RES=$(OBJ)\libhdb-version.res
 
 $(LIBHDB): $(BINDIR)\libhdb.dll
 
-$(BINDIR)\libhdb.dll: $(libhdb_OBJs) $(ldap_lib) $(LIBHEIMDAL) $(LIBSQLITE) $(LIBCOMERR) $(LIBROKEN) $(RES)
+$(BINDIR)\libhdb.dll: $(libhdb_OBJs) $(ldap_lib) $(LIBHEIMBASE) $(LIBHEIMDAL) $(LIBSQLITE) $(LIBCOMERR) $(LIBROKEN) $(RES)
 	$(DLLGUILINK) -def:libhdb-exports.def -implib:$(LIBHDB)
-	$(DLLPREP)
+	$(DLLPREP_NODIST)
 
 clean::
 	-$(RM) $(BINDIR)\libhdb.*
@@ -149,7 +150,7 @@ clean::
 
 test:: test-binaries test-run
 
-test-binaries: $(OBJ)\test_dbinfo.exe $(OBJ)\test_hdbkeys.exe
+test-binaries: $(OBJ)\test_dbinfo.exe $(OBJ)\test_hdbkeys.exe $(OBJ)\test_hdbplugin.exe
 
 $(OBJ)\test_dbinfo.exe: $(OBJ)\test_dbinfo.obj $(LIBHDB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
 	$(EXECONLINK)
@@ -159,9 +160,15 @@ $(OBJ)\test_hdbkeys.exe: $(OBJ)\test_hdbkeys.obj $(LIBHDB) $(LIBHEIMDAL) $(LIBRO
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
+$(OBJ)\test_hdbplugin.exe: $(OBJ)\test_hdbplugin.obj $(LIBHDB) $(LIBHEIMDAL) $(LIBROKEN) $(LIBVERS)
+	$(EXECONLINK)
+	$(EXEPREP_NODIST)
+
 test-run:
 	cd $(OBJ)
-	test_dbinfo.exe
+	-test_dbinfo.exe
+	-test_hdbkeys.exe
+	-test_hdbplugin.exe
 	cd $(SRCDIR)
 
 !ifdef OPENLDAP_INC
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/common.c b/crypto/external/bsd/heimdal/dist/lib/hdb/common.c
index 3eb176e53..ee33b3bce 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: common.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: common.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan
@@ -107,7 +107,6 @@ _hdb_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal principal,
     krb5_principal enterprise_principal = NULL;
     krb5_data key, value;
     krb5_error_code ret;
-    int code;
 
     if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
 	if (principal->name.name_string.len != 1) {
@@ -127,43 +126,74 @@ _hdb_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal principal,
     hdb_principal2key(context, principal, &key);
     if (enterprise_principal)
 	krb5_free_principal(context, enterprise_principal);
-    code = db->hdb__get(context, db, key, &value);
+    ret = db->hdb__get(context, db, key, &value);
     krb5_data_free(&key);
-    if(code)
-	return code;
-    code = hdb_value2entry(context, &value, &entry->entry);
-    if (code == ASN1_BAD_ID && (flags & HDB_F_CANON) == 0) {
+    if(ret)
+	return ret;
+    ret = hdb_value2entry(context, &value, &entry->entry);
+    if (ret == ASN1_BAD_ID && (flags & HDB_F_CANON) == 0) {
 	krb5_data_free(&value);
 	return HDB_ERR_NOENTRY;
-    } else if (code == ASN1_BAD_ID) {
+    } else if (ret == ASN1_BAD_ID) {
 	hdb_entry_alias alias;
 
-	code = hdb_value2entry_alias(context, &value, &alias);
-	if (code) {
+	ret = hdb_value2entry_alias(context, &value, &alias);
+	if (ret) {
 	    krb5_data_free(&value);
-	    return code;
+	    return ret;
 	}
 	hdb_principal2key(context, alias.principal, &key);
 	krb5_data_free(&value);
 	free_hdb_entry_alias(&alias);
 
-	code = db->hdb__get(context, db, key, &value);
+	ret = db->hdb__get(context, db, key, &value);
 	krb5_data_free(&key);
-	if (code)
-	    return code;
-	code = hdb_value2entry(context, &value, &entry->entry);
-	if (code) {
+	if (ret)
+	    return ret;
+	ret = hdb_value2entry(context, &value, &entry->entry);
+	if (ret) {
 	    krb5_data_free(&value);
-	    return code;
+	    return ret;
 	}
     }
     krb5_data_free(&value);
-    if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
-	code = hdb_unseal_keys (context, db, &entry->entry);
-	if (code)
+    if ((flags & HDB_F_DECRYPT) && (flags & HDB_F_ALL_KVNOS)) {
+	/* Decrypt the current keys */
+	ret = hdb_unseal_keys(context, db, &entry->entry);
+	if (ret) {
 	    hdb_free_entry(context, entry);
+	    return ret;
+	}
+	/* Decrypt the key history too */
+	ret = hdb_unseal_keys_kvno(context, db, 0, flags, &entry->entry);
+	if (ret) {
+	    hdb_free_entry(context, entry);
+	    return ret;
+	}
+    } else if ((flags & HDB_F_DECRYPT)) {
+	if ((flags & HDB_F_KVNO_SPECIFIED) == 0 || kvno == entry->entry.kvno) {
+	    /* Decrypt the current keys */
+	    ret = hdb_unseal_keys(context, db, &entry->entry);
+	    if (ret) {
+		hdb_free_entry(context, entry);
+		return ret;
+	    }
+	} else {
+	    if ((flags & HDB_F_ALL_KVNOS))
+		kvno = 0;
+	    /*
+	     * Find and decrypt the keys from the history that we want,
+	     * and swap them with the current keys
+	     */
+	    ret = hdb_unseal_keys_kvno(context, db, kvno, flags, &entry->entry);
+	    if (ret) {
+		hdb_free_entry(context, entry);
+		return ret;
+	    }
+	}
     }
-    return code;
+
+    return 0;
 }
 
 static krb5_error_code
@@ -194,9 +224,11 @@ hdb_remove_aliases(krb5_context context, HDB *db, krb5_data *key)
     for (i = 0; i < aliases->aliases.len; i++) {
 	krb5_data akey;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &akey);
-	code = db->hdb__del(context, db, akey);
-	krb5_data_free(&akey);
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &akey);
+        if (code == 0) {
+            code = db->hdb__del(context, db, akey);
+            krb5_data_free(&akey);
+        }
 	if (code) {
 	    free_hdb_entry(&oldentry);
 	    return code;
@@ -223,14 +255,15 @@ hdb_add_aliases(krb5_context context, HDB *db,
 	hdb_entry_alias entryalias;
 	entryalias.principal = entry->entry.principal;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &key);
 	code = hdb_entry_alias2value(context, &entryalias, &value);
-	if (code) {
-	    krb5_data_free(&key);
+	if (code)
 	    return code;
-	}
-	code = db->hdb__put(context, db, flags, key, value);
-	krb5_data_free(&key);
+
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &key);
+        if (code == 0) {
+            code = db->hdb__put(context, db, flags, key, value);
+            krb5_data_free(&key);
+        }
 	krb5_data_free(&value);
 	if (code)
 	    return code;
@@ -255,9 +288,11 @@ hdb_check_aliases(krb5_context context, HDB *db, hdb_entry_ex *entry)
 	hdb_entry_alias alias;
 	krb5_data akey, value;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &akey);
-	code = db->hdb__get(context, db, akey, &value);
-	krb5_data_free(&akey);
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &akey);
+        if (code == 0) {
+            code = db->hdb__get(context, db, akey, &value);
+            krb5_data_free(&akey);
+        }
 	if (code == HDB_ERR_NOENTRY)
 	    continue;
 	else if (code)
@@ -286,11 +321,29 @@ _hdb_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
     krb5_data key, value;
     int code;
 
+    if (entry->entry.flags.do_not_store)
+	return HDB_ERR_MISUSE;
     /* check if new aliases already is used */
     code = hdb_check_aliases(context, db, entry);
     if (code)
 	return code;
 
+    if ((flags & HDB_F_PRECHECK) && (flags & HDB_F_REPLACE))
+        return 0;
+
+    if ((flags & HDB_F_PRECHECK)) {
+        code = hdb_principal2key(context, entry->entry.principal, &key);
+        if (code)
+            return code;
+        code = db->hdb__get(context, db, key, &value);
+        krb5_data_free(&key);
+        if (code == 0)
+            krb5_data_free(&value);
+        if (code == HDB_ERR_NOENTRY)
+            return 0;
+        return code ? code : HDB_ERR_EXISTS;
+    }
+
     if(entry->entry.generation == NULL) {
 	struct timeval t;
 	entry->entry.generation = malloc(sizeof(*entry->entry.generation));
@@ -330,13 +383,32 @@ _hdb_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 }
 
 krb5_error_code
-_hdb_remove(krb5_context context, HDB *db, krb5_const_principal principal)
+_hdb_remove(krb5_context context, HDB *db,
+            unsigned flags, krb5_const_principal principal)
 {
-    krb5_data key;
+    krb5_data key, value;
     int code;
 
     hdb_principal2key(context, principal, &key);
 
+    if ((flags & HDB_F_PRECHECK)) {
+        /*
+         * We don't check that we can delete the aliases because we
+         * assume that the DB is consistent.  If we did check for alias
+         * consistency we'd also have to provide a way to fsck the DB,
+         * otherwise admins would have no way to recover -- papering
+         * over this here is less work, but we really ought to provide
+         * an HDB fsck.
+         */
+        code = db->hdb__get(context, db, key, &value);
+        krb5_data_free(&key);
+        if (code == 0) {
+            krb5_data_free(&value);
+            return 0;
+        }
+        return code;
+    }
+
     code = hdb_remove_aliases(context, db, &key);
     if (code) {
 	krb5_data_free(&key);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/db.c b/crypto/external/bsd/heimdal/dist/lib/hdb/db.c
index 224fcf486..7a7b19873 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/db.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/db.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: db.c,v 1.1.1.1 2011/04/13 18:14:41 elric Exp $	*/
+/*	$NetBSD: db.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "hdb_locl.h"
 
-#if HAVE_DB1
+#if defined(HAVE_DB1)
 
 #if defined(HAVE_DB_185_H)
 #include <db_185.h>
@@ -43,11 +43,27 @@
 #include <db.h>
 #endif
 
+typedef struct {
+    HDB hdb;            /* generic members */
+    int lock_fd;        /* DB-specific */
+} DB1_HDB;
+
 static krb5_error_code
 DB_close(krb5_context context, HDB *db)
 {
+    DB1_HDB *db1 = (DB1_HDB *)db;
     DB *d = (DB*)db->hdb_db;
+
+    heim_assert(d != 0, "Closing already closed HDB");
+
     (*d->close)(d);
+    db->hdb_db = 0;
+
+    if (db1->lock_fd >= 0) {
+	close(db1->lock_fd);
+	db1->lock_fd = -1;
+    }
+
     return 0;
 }
 
@@ -65,27 +81,15 @@ DB_destroy(krb5_context context, HDB *db)
 static krb5_error_code
 DB_lock(krb5_context context, HDB *db, int operation)
 {
-    DB *d = (DB*)db->hdb_db;
-    int fd = (*d->fd)(d);
-    if(fd < 0) {
-	krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
-			       "Can't lock database: %s", db->hdb_name);
-	return HDB_ERR_CANT_LOCK_DB;
-    }
-    return hdb_lock(fd, operation);
+
+    return 0;
 }
 
 static krb5_error_code
 DB_unlock(krb5_context context, HDB *db)
 {
-    DB *d = (DB*)db->hdb_db;
-    int fd = (*d->fd)(d);
-    if(fd < 0) {
-	krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
-			       "Can't unlock database: %s", db->hdb_name);
-	return HDB_ERR_CANT_LOCK_DB;
-    }
-    return hdb_unlock(fd);
+
+    return 0;
 }
 
 
@@ -98,13 +102,7 @@ DB_seq(krb5_context context, HDB *db,
     krb5_data key_data, data;
     int code;
 
-    code = db->hdb_lock(context, db, HDB_RLOCK);
-    if(code == -1) {
-	krb5_set_error_message(context, HDB_ERR_DB_INUSE, "Database %s in use", db->hdb_name);
-	return HDB_ERR_DB_INUSE;
-    }
     code = (*d->seq)(d, &key, &value, flag);
-    db->hdb_unlock(context, db); /* XXX check value */
     if(code == -1) {
 	code = errno;
 	krb5_set_error_message(context, code, "Database %s seq error: %s",
@@ -161,6 +159,10 @@ DB_rename(krb5_context context, HDB *db, const char *new_name)
     int ret;
     char *old, *new;
 
+    if (strncmp(new_name, "db:", sizeof("db:") - 1) == 0)
+        new_name += sizeof("db:") - 1;
+    else if (strncmp(new_name, "db1:", sizeof("db1:") - 1) == 0)
+        new_name += sizeof("db1:") - 1;
     asprintf(&old, "%s.db", db->hdb_name);
     asprintf(&new, "%s.db", new_name);
     ret = rename(old, new);
@@ -183,11 +185,7 @@ DB__get(krb5_context context, HDB *db, krb5_data key, krb5_data *reply)
 
     k.data = key.data;
     k.size = key.length;
-    code = db->hdb_lock(context, db, HDB_RLOCK);
-    if(code)
-	return code;
     code = (*d->get)(d, &k, &v, 0);
-    db->hdb_unlock(context, db);
     if(code < 0) {
 	code = errno;
 	krb5_set_error_message(context, code, "Database %s get error: %s",
@@ -215,11 +213,8 @@ DB__put(krb5_context context, HDB *db, int replace,
     k.size = key.length;
     v.data = value.data;
     v.size = value.length;
-    code = db->hdb_lock(context, db, HDB_WLOCK);
-    if(code)
-	return code;
+    krb5_clear_error_message(context);
     code = (*d->put)(d, &k, &v, replace ? 0 : R_NOOVERWRITE);
-    db->hdb_unlock(context, db);
     if(code < 0) {
 	code = errno;
 	krb5_set_error_message(context, code, "Database %s put error: %s",
@@ -227,9 +222,15 @@ DB__put(krb5_context context, HDB *db, int replace,
 	return code;
     }
     if(code == 1) {
-	krb5_clear_error_message(context);
 	return HDB_ERR_EXISTS;
     }
+    code = (*d->sync)(d, 0);
+    if (code == -1) {
+	code = errno;
+	krb5_set_error_message(context, code, "Database %s put sync error: %s",
+			       db->hdb_name, strerror(code));
+	return code;
+    }
     return 0;
 }
 
@@ -241,25 +242,65 @@ DB__del(krb5_context context, HDB *db, krb5_data key)
     krb5_error_code code;
     k.data = key.data;
     k.size = key.length;
-    code = db->hdb_lock(context, db, HDB_WLOCK);
-    if(code)
-	return code;
+    krb5_clear_error_message(context);
     code = (*d->del)(d, &k, 0);
-    db->hdb_unlock(context, db);
-    if(code == 1) {
+    if (code == 1)
+        return HDB_ERR_NOENTRY;
+    if (code < 0) {
 	code = errno;
-	krb5_set_error_message(context, code, "Database %s put error: %s",
+	krb5_set_error_message(context, code, "Database %s del error: %s",
+			       db->hdb_name, strerror(code));
+	return code;
+    }
+    code = (*d->sync)(d, 0);
+    if (code == -1) {
+	code = errno;
+	krb5_set_error_message(context, code, "Database %s del sync error: %s",
 			       db->hdb_name, strerror(code));
 	return code;
     }
-    if(code < 0)
-	return errno;
     return 0;
 }
 
+static DB *
+_open_db(char *fn, int flags, int mode, int *fd)
+{
+#ifndef O_EXLOCK
+    int op;
+    int ret;
+
+    *fd = open(fn, flags, mode);
+    if (*fd == -1)
+	return NULL;
+
+    if ((flags & O_ACCMODE) == O_RDONLY)
+	op = LOCK_SH;
+    else
+	op = LOCK_EX;
+
+    ret = flock(*fd, op);
+    if (ret == -1) {
+	int saved_errno;
+
+	saved_errno = errno;
+	close(*fd);
+	errno = saved_errno;
+	return NULL;
+    }
+#else
+    if ((flags & O_ACCMODE) == O_RDONLY)
+	flags |= O_SHLOCK;
+    else
+	flags |= O_EXLOCK;
+#endif
+
+    return dbopen(fn, flags, mode, DB_BTREE, NULL);
+}
+
 static krb5_error_code
 DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 {
+    DB1_HDB *db1 = (DB1_HDB *)db;
     char *fn;
     krb5_error_code ret;
 
@@ -268,16 +309,15 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
-    db->hdb_db = dbopen(fn, flags, mode, DB_BTREE, NULL);
+    db->hdb_db = _open_db(fn, flags, mode, &db1->lock_fd);
     free(fn);
     /* try to open without .db extension */
     if(db->hdb_db == NULL && errno == ENOENT)
-	db->hdb_db = dbopen(db->hdb_name, flags, mode, DB_BTREE, NULL);
+	db->hdb_db = _open_db(db->hdb_name, flags, mode, &db1->lock_fd);
     if(db->hdb_db == NULL) {
-	ret = errno;
-	krb5_set_error_message(context, ret, "dbopen (%s): %s",
-			      db->hdb_name, strerror(ret));
-	return ret;
+	krb5_set_error_message(context, errno, "dbopen (%s): %s",
+			      db->hdb_name, strerror(errno));
+	return errno;
     }
     if((flags & O_ACCMODE) == O_RDONLY)
 	ret = hdb_check_db_format(context, db);
@@ -298,10 +338,11 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 }
 
 krb5_error_code
-hdb_db_create(krb5_context context, HDB **db,
-	      const char *filename)
+hdb_db1_create(krb5_context context, HDB **db,
+	       const char *filename)
 {
-    *db = calloc(1, sizeof(**db));
+    DB1_HDB **db1 = (DB1_HDB **)db;
+    *db = calloc(1, sizeof(**db1));	/* Allocate space for the larger db1 */
     if (*db == NULL) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
@@ -332,7 +373,9 @@ hdb_db_create(krb5_context context, HDB **db,
     (*db)->hdb__put = DB__put;
     (*db)->hdb__del = DB__del;
     (*db)->hdb_destroy = DB_destroy;
+
+    (*db1)->lock_fd = -1;
     return 0;
 }
 
-#endif /* HAVE_DB1 */
+#endif /* defined(HAVE_DB1) */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/db3.c b/crypto/external/bsd/heimdal/dist/lib/hdb/db3.c
index 4cd8d7cc0..c3452dca5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/db3.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/db3.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: db3.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: db3.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -35,10 +35,14 @@
 
 #include "hdb_locl.h"
 
+#include <fcntl.h>
+
 #if HAVE_DB3
 
 #ifdef HAVE_DBHEADER
 #include <db.h>
+#elif HAVE_DB6_DB_H
+#include <db6/db.h>
 #elif HAVE_DB5_DB_H
 #include <db5/db.h>
 #elif HAVE_DB4_DB_H
@@ -49,15 +53,32 @@
 #include <db.h>
 #endif
 
+typedef struct {
+    HDB hdb;            /* generic members */
+    int lock_fd;        /* DB3-specific */
+} DB3_HDB;
+
+
 static krb5_error_code
 DB_close(krb5_context context, HDB *db)
 {
+    DB3_HDB *db3 = (DB3_HDB *)db;
     DB *d = (DB*)db->hdb_db;
     DBC *dbcp = (DBC*)db->hdb_dbc;
 
-    (*dbcp->c_close)(dbcp);
+    heim_assert(d != 0, "Closing already closed HDB");
+
+    if (dbcp != NULL)
+	dbcp->c_close(dbcp);
+    if (d != NULL)
+	d->close(d, 0);
+    if (db3->lock_fd >= 0)
+	close(db3->lock_fd);
+
+    db3->lock_fd = -1;
     db->hdb_dbc = 0;
-    (*d->close)(d, 0);
+    db->hdb_db = 0;
+
     return 0;
 }
 
@@ -75,21 +96,15 @@ DB_destroy(krb5_context context, HDB *db)
 static krb5_error_code
 DB_lock(krb5_context context, HDB *db, int operation)
 {
-    DB *d = (DB*)db->hdb_db;
-    int fd;
-    if ((*d->fd)(d, &fd))
-	return HDB_ERR_CANT_LOCK_DB;
-    return hdb_lock(fd, operation);
+
+    return 0;
 }
 
 static krb5_error_code
 DB_unlock(krb5_context context, HDB *db)
 {
-    DB *d = (DB*)db->hdb_db;
-    int fd;
-    if ((*d->fd)(d, &fd))
-	return HDB_ERR_CANT_LOCK_DB;
-    return hdb_unlock(fd);
+
+    return 0;
 }
 
 
@@ -104,10 +119,7 @@ DB_seq(krb5_context context, HDB *db,
 
     memset(&key, 0, sizeof(DBT));
     memset(&value, 0, sizeof(DBT));
-    if ((*db->hdb_lock)(context, db, HDB_RLOCK))
-	return HDB_ERR_DB_INUSE;
     code = (*dbcp->c_get)(dbcp, &key, &value, flag);
-    (*db->hdb_unlock)(context, db); /* XXX check value */
     if (code == DB_NOTFOUND)
 	return HDB_ERR_NOENTRY;
     if (code)
@@ -158,16 +170,29 @@ DB_rename(krb5_context context, HDB *db, const char *new_name)
     int ret;
     char *old, *new;
 
-    asprintf(&old, "%s.db", db->hdb_name);
-    asprintf(&new, "%s.db", new_name);
+    if (strncmp(new_name, "db:", sizeof("db:") - 1) == 0)
+        new_name += sizeof("db:") - 1;
+    else if (strncmp(new_name, "db3:", sizeof("db3:") - 1) == 0)
+        new_name += sizeof("db3:") - 1;
+
+    ret = asprintf(&old, "%s.db", db->hdb_name);
+    if (ret == -1)
+	return ENOMEM;
+    ret = asprintf(&new, "%s.db", new_name);
+    if (ret == -1) {
+	free(old);
+	return ENOMEM;
+    }
     ret = rename(old, new);
     free(old);
-    free(new);
-    if(ret)
+    if(ret) {
+	free(new);
 	return errno;
+    }
 
     free(db->hdb_name);
-    db->hdb_name = strdup(new_name);
+    new[strlen(new) - 3] = '\0';
+    db->hdb_name = new;
     return 0;
 }
 
@@ -183,10 +208,7 @@ DB__get(krb5_context context, HDB *db, krb5_data key, krb5_data *reply)
     k.data = key.data;
     k.size = key.length;
     k.flags = 0;
-    if ((code = (*db->hdb_lock)(context, db, HDB_RLOCK)))
-	return code;
     code = (*d->get)(d, NULL, &k, &v, 0);
-    (*db->hdb_unlock)(context, db);
     if(code == DB_NOTFOUND)
 	return HDB_ERR_NOENTRY;
     if(code)
@@ -212,14 +234,49 @@ DB__put(krb5_context context, HDB *db, int replace,
     v.data = value.data;
     v.size = value.length;
     v.flags = 0;
-    if ((code = (*db->hdb_lock)(context, db, HDB_WLOCK)))
-	return code;
     code = (*d->put)(d, NULL, &k, &v, replace ? 0 : DB_NOOVERWRITE);
-    (*db->hdb_unlock)(context, db);
     if(code == DB_KEYEXIST)
 	return HDB_ERR_EXISTS;
-    if(code)
-	return errno;
+    if (code) {
+        /*
+         * Berkeley DB 3 and up have a terrible error reporting
+         * interface...
+         *
+         * DB->err() doesn't output a string.
+         * DB->set_errcall()'s callback function doesn't have a void *
+         * argument that can be used to place the error somewhere.
+         *
+         * The only thing we could do is fopen()/fdopen() a file, set it
+         * with DB->set_errfile(), then call DB->err(), then read the
+         * message from the file, unset it with DB->set_errfile(), close
+         * it and delete it.  That's a lot of work... so we don't do it.
+         */
+        if (code == EACCES || code == ENOSPC || code == EINVAL) {
+            krb5_set_error_message(context, code,
+                                   "Database %s put error: %s",
+                                   db->hdb_name, strerror(code));
+        } else {
+            code = HDB_ERR_UK_SERROR;
+            krb5_set_error_message(context, code,
+                                   "Database %s put error: unknown (%d)",
+                                   db->hdb_name, code);
+        }
+	return code;
+    }
+    code = (*d->sync)(d, 0);
+    if (code) {
+        if (code == EACCES || code == ENOSPC || code == EINVAL) {
+            krb5_set_error_message(context, code,
+                                   "Database %s put sync error: %s",
+                                   db->hdb_name, strerror(code));
+        } else {
+            code = HDB_ERR_UK_SERROR;
+            krb5_set_error_message(context, code,
+                                   "Database %s put sync error: unknown (%d)",
+                                   db->hdb_name, code);
+        }
+        return code;
+    }
     return 0;
 }
 
@@ -233,26 +290,96 @@ DB__del(krb5_context context, HDB *db, krb5_data key)
     k.data = key.data;
     k.size = key.length;
     k.flags = 0;
-    code = (*db->hdb_lock)(context, db, HDB_WLOCK);
-    if(code)
-	return code;
     code = (*d->del)(d, NULL, &k, 0);
-    (*db->hdb_unlock)(context, db);
     if(code == DB_NOTFOUND)
 	return HDB_ERR_NOENTRY;
-    if(code)
+    if (code) {
+        if (code == EACCES || code == ENOSPC || code == EINVAL) {
+            krb5_set_error_message(context, code,
+                                   "Database %s del error: %s",
+                                   db->hdb_name, strerror(code));
+        } else {
+            code = HDB_ERR_UK_SERROR;
+            krb5_set_error_message(context, code,
+                                   "Database %s del error: unknown (%d)",
+                                   db->hdb_name, code);
+        }
 	return code;
+    }
+    code = (*d->sync)(d, 0);
+    if (code) {
+        if (code == EACCES || code == ENOSPC || code == EINVAL) {
+            krb5_set_error_message(context, code,
+                                   "Database %s del sync error: %s",
+                                   db->hdb_name, strerror(code));
+        } else {
+            code = HDB_ERR_UK_SERROR;
+            krb5_set_error_message(context, code,
+                                   "Database %s del sync error: unknown (%d)",
+                                   db->hdb_name, code);
+        }
+        return code;
+    }
     return 0;
 }
 
+#define RD_CACHE_SZ 0x8000     /* Minimal read cache size */
+#define WR_CACHE_SZ 0x8000     /* Minimal write cache size */
+
+static int
+_open_db(DB *d, char *fn, int myflags, int flags, mode_t mode, int *fd)
+{
+    int ret;
+    int cache_size = (myflags & DB_RDONLY) ? RD_CACHE_SZ : WR_CACHE_SZ;
+
+    *fd = open(fn, flags, mode);
+
+    if (*fd == -1)
+       return errno;
+
+    /*
+     * Without DB_FCNTL_LOCKING, the DB library complains when initializing
+     * a database in an empty file. Since the database is our lock file,
+     * we create it before Berkeley DB does, so a new DB always starts empty.
+     */
+    myflags |= DB_FCNTL_LOCKING;
+
+    ret = flock(*fd, (myflags&DB_RDONLY) ? LOCK_SH : LOCK_EX);
+    if (ret == -1) {
+	ret = errno;
+	close(*fd);
+	*fd = -1;
+	return ret;
+    }
+
+    d->set_cachesize(d, 0, cache_size, 0);
+
+#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR >= 1))
+    ret = (*d->open)(d, NULL, fn, NULL, DB_BTREE, myflags, mode);
+#else
+    ret = (*d->open)(d, fn, NULL, DB_BTREE, myflags, mode);
+#endif
+
+    if (ret != 0) {
+	close(*fd);
+	*fd = -1;
+    }
+
+    return ret;
+}
+
 static krb5_error_code
 DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 {
+    DB3_HDB *db3 = (DB3_HDB *)db;
     DBC *dbc = NULL;
     char *fn;
     krb5_error_code ret;
     DB *d;
     int myflags = 0;
+    int aret;
+
+    heim_assert(db->hdb_db == 0, "Opening already open HDB");
 
     if (flags & O_CREAT)
       myflags |= DB_CREATE;
@@ -266,11 +393,12 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
     if (flags & O_TRUNC)
       myflags |= DB_TRUNCATE;
 
-    asprintf(&fn, "%s.db", db->hdb_name);
-    if (fn == NULL) {
+    aret = asprintf(&fn, "%s.db", db->hdb_name);
+    if (aret == -1) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
+
     if (db_create(&d, NULL, 0) != 0) {
 	free(fn);
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
@@ -278,33 +406,29 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
     }
     db->hdb_db = d;
 
-#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR >= 1))
-    ret = (*d->open)(db->hdb_db, NULL, fn, NULL, DB_BTREE, myflags, mode);
-#else
-    ret = (*d->open)(db->hdb_db, fn, NULL, DB_BTREE, myflags, mode);
-#endif
+    /* From here on out always DB_close() before returning on error */
 
+    ret = _open_db(d, fn, myflags, flags, mode, &db3->lock_fd);
+    free(fn);
     if (ret == ENOENT) {
 	/* try to open without .db extension */
-#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR >= 1))
-	ret = (*d->open)(db->hdb_db, NULL, db->hdb_name, NULL, DB_BTREE,
-			 myflags, mode);
-#else
-	ret = (*d->open)(db->hdb_db, db->hdb_name, NULL, DB_BTREE,
-			 myflags, mode);
-#endif
+	ret = _open_db(d, db->hdb_name, myflags, flags, mode, &db3->lock_fd);
     }
 
     if (ret) {
-	free(fn);
+	DB_close(context, db);
 	krb5_set_error_message(context, ret, "opening %s: %s",
-			      db->hdb_name, strerror(ret));
+			       db->hdb_name, strerror(ret));
 	return ret;
     }
-    free(fn);
 
-    ret = (*d->cursor)(d, NULL, &dbc, 0);
+#ifndef DB_CURSOR_BULK
+# define DB_CURSOR_BULK 0	/* Missing with DB < 4.8 */
+#endif
+    ret = (*d->cursor)(d, NULL, &dbc, DB_CURSOR_BULK);
+
     if (ret) {
+	DB_close(context, db);
 	krb5_set_error_message(context, ret, "d->cursor: %s", strerror(ret));
         return ret;
     }
@@ -328,10 +452,11 @@ DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
 }
 
 krb5_error_code
-hdb_db_create(krb5_context context, HDB **db,
-	      const char *filename)
+hdb_db3_create(krb5_context context, HDB **db,
+	       const char *filename)
 {
-    *db = calloc(1, sizeof(**db));
+    DB3_HDB **db3 = (DB3_HDB **)db;
+    *db3 = calloc(1, sizeof(**db3));    /* Allocate space for the larger db3 */
     if (*db == NULL) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
@@ -362,6 +487,8 @@ hdb_db_create(krb5_context context, HDB **db,
     (*db)->hdb__put = DB__put;
     (*db)->hdb__del = DB__del;
     (*db)->hdb_destroy = DB_destroy;
+
+    (*db3)->lock_fd = -1;
     return 0;
 }
 #endif /* HAVE_DB3 */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/dbinfo.c b/crypto/external/bsd/heimdal/dist/lib/hdb/dbinfo.c
index b95c2063d..b168c5e54 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/dbinfo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/dbinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dbinfo.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: dbinfo.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -110,11 +110,9 @@ hdb_get_dbinfo(krb5_context context, struct hdb_dbinfo **dbp)
 				      NULL);
     if (db_binding) {
 
-	ret = get_dbinfo(context, db_binding, "default", &di);
-	if (ret == 0 && di) {
-	    databases = di;
-	    dt = &di->next;
-	}
+	ret = get_dbinfo(context, db_binding, "default", &databases);
+	if (ret == 0 && databases != NULL)
+	    dt = &databases->next;
 
 	for ( ; db_binding != NULL; db_binding = db_binding->next) {
 
@@ -131,36 +129,41 @@ hdb_get_dbinfo(krb5_context context, struct hdb_dbinfo **dbp)
 
 	    if (dt)
 		*dt = di;
-	    else
+	    else {
+                hdb_free_dbinfo(context, &databases);
 		databases = di;
+            }
 	    dt = &di->next;
 
 	}
     }
 
-    if(databases == NULL) {
+    if (databases == NULL) {
 	/* if there are none specified, create one and use defaults */
-	di = calloc(1, sizeof(*di));
-	databases = di;
-	di->label = strdup("default");
+	databases = calloc(1, sizeof(*databases));
+	databases->label = strdup("default");
     }
 
-    for(di = databases; di; di = di->next) {
-	if(di->dbname == NULL) {
+    for (di = databases; di; di = di->next) {
+	if (di->dbname == NULL) {
 	    di->dbname = strdup(default_dbname);
 	    if (di->mkey_file == NULL)
 		di->mkey_file = strdup(default_mkey);
 	}
-	if(di->mkey_file == NULL) {
+	if (di->mkey_file == NULL) {
 	    p = strrchr(di->dbname, '.');
 	    if(p == NULL || strchr(p, '/') != NULL)
 		/* final pathname component does not contain a . */
-		asprintf(&di->mkey_file, "%s.mkey", di->dbname);
+		ret = asprintf(&di->mkey_file, "%s.mkey", di->dbname);
 	    else
 		/* the filename is something.else, replace .else with
                    .mkey */
-		asprintf(&di->mkey_file, "%.*s.mkey",
-			 (int)(p - di->dbname), di->dbname);
+		ret = asprintf(&di->mkey_file, "%.*s.mkey",
+			       (int)(p - di->dbname), di->dbname);
+	    if (ret == -1) {
+                hdb_free_dbinfo(context, &databases);
+		return ENOMEM;
+            }
 	}
 	if(di->acl_file == NULL)
 	    di->acl_file = strdup(default_acl);
@@ -250,6 +253,12 @@ hdb_free_dbinfo(krb5_context context, struct hdb_dbinfo **dbp)
 const char *
 hdb_db_dir(krb5_context context)
 {
+    const char *p;
+
+    p = krb5_config_get_string(context, NULL, "hdb", "db-dir", NULL);
+    if (p)
+	return p;
+
     return HDB_DB_DIR;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/ext.c b/crypto/external/bsd/heimdal/dist/lib/hdb/ext.c
index 09f2a7b17..3f6e6beff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/ext.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/ext.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ext.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: ext.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2005 Kungliga Tekniska Högskolan
@@ -103,7 +103,7 @@ hdb_replace_extension(krb5_context context,
 	ext2 = hdb_find_extension(entry, ext->data.element);
     } else {
 	/*
-	 * This is an unknown extention, and we are asked to replace a
+	 * This is an unknown extension, and we are asked to replace a
 	 * possible entry in `entry' that is of the same type. This
 	 * might seem impossible, but ASN.1 CHOICE comes to our
 	 * rescue. The first tag in each branch in the CHOICE is
@@ -122,7 +122,7 @@ hdb_replace_extension(krb5_context context,
 			  &size);
 	if (ret) {
 	    krb5_set_error_message(context, ret, "hdb: failed to decode "
-				   "replacement hdb extention");
+				   "replacement hdb extension");
 	    return ret;
 	}
 
@@ -138,7 +138,7 @@ hdb_replace_extension(krb5_context context,
 			      &size);
 	    if (ret) {
 		krb5_set_error_message(context, ret, "hdb: failed to decode "
-				       "present hdb extention");
+				       "present hdb extension");
 		return ret;
 	    }
 
@@ -155,7 +155,7 @@ hdb_replace_extension(krb5_context context,
 	ret = copy_HDB_extension(ext, ext2);
 	if (ret)
 	    krb5_set_error_message(context, ret, "hdb: failed to copy replacement "
-				   "hdb extention");
+				   "hdb extension");
 	return ret;
     }
 
@@ -434,3 +434,101 @@ hdb_entry_get_aliases(const hdb_entry *entry, const HDB_Ext_Aliases **a)
 
     return 0;
 }
+
+unsigned int
+hdb_entry_get_kvno_diff_clnt(const hdb_entry *entry)
+{
+    const HDB_extension *ext;
+
+    ext = hdb_find_extension(entry,
+			     choice_HDB_extension_data_hist_kvno_diff_clnt);
+    if (ext)
+	return ext->data.u.hist_kvno_diff_clnt;
+    return 1;
+}
+
+krb5_error_code
+hdb_entry_set_kvno_diff_clnt(krb5_context context, hdb_entry *entry,
+			     unsigned int diff)
+{
+    HDB_extension ext;
+
+    if (diff > 16384)
+	return EINVAL;
+    ext.mandatory = FALSE;
+    ext.data.element = choice_HDB_extension_data_hist_kvno_diff_clnt;
+    ext.data.u.hist_kvno_diff_clnt = diff;
+    return hdb_replace_extension(context, entry, &ext);
+}
+
+krb5_error_code
+hdb_entry_clear_kvno_diff_clnt(krb5_context context, hdb_entry *entry)
+{
+    return hdb_clear_extension(context, entry,
+			       choice_HDB_extension_data_hist_kvno_diff_clnt);
+}
+
+unsigned int
+hdb_entry_get_kvno_diff_svc(const hdb_entry *entry)
+{
+    const HDB_extension *ext;
+
+    ext = hdb_find_extension(entry,
+			     choice_HDB_extension_data_hist_kvno_diff_svc);
+    if (ext)
+	return ext->data.u.hist_kvno_diff_svc;
+    return 1024; /* max_life effectively provides a better default */
+}
+
+krb5_error_code
+hdb_entry_set_kvno_diff_svc(krb5_context context, hdb_entry *entry,
+			    unsigned int diff)
+{
+    HDB_extension ext;
+
+    if (diff > 16384)
+	return EINVAL;
+    ext.mandatory = FALSE;
+    ext.data.element = choice_HDB_extension_data_hist_kvno_diff_svc;
+    ext.data.u.hist_kvno_diff_svc = diff;
+    return hdb_replace_extension(context, entry, &ext);
+}
+
+krb5_error_code
+hdb_entry_clear_kvno_diff_svc(krb5_context context, hdb_entry *entry)
+{
+    return hdb_clear_extension(context, entry,
+			       choice_HDB_extension_data_hist_kvno_diff_svc);
+}
+
+krb5_error_code
+hdb_set_last_modified_by(krb5_context context, hdb_entry *entry,
+                         krb5_principal modby, time_t modtime)
+{
+    krb5_error_code ret;
+    Event *old_ev;
+    Event *ev;
+
+    old_ev = entry->modified_by;
+
+    ev = calloc(1, sizeof (*ev));
+    if (!ev)
+        return ENOMEM;
+    if (modby)
+        ret = krb5_copy_principal(context, modby, &ev->principal);
+    else
+        ret = krb5_parse_name(context, "root/admin", &ev->principal);
+    if (ret) {
+        free(ev);
+        return ret;
+    }
+    ev->time = modtime;
+    if (!ev->time)
+        time(&ev->time);
+
+    entry->modified_by = ev;
+    if (old_ev)
+        free_Event(old_ev);
+    return 0;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-keytab.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-keytab.c
index d5f010c65..db2ec1cf1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-keytab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-keytab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb-keytab.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hdb-keytab.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-ldap.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-ldap.c
index a727e00ec..d7507d2c9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-ldap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-ldap.c
@@ -1,9 +1,10 @@
-/*	$NetBSD: hdb-ldap.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hdb-ldap.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1999-2001, 2003, PADL Software Pty Ltd.
  * Copyright (c) 2004, Andrew Bartlett.
  * Copyright (c) 2003 - 2008, Kungliga Tekniska Högskolan.
+ * Copyright (c) 2015, Timothy Pearson.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -52,6 +53,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
 static const char *default_structural_object = "account";
 static char *structural_object;
+static const char *default_ldap_url = "ldapi:///";
 static krb5_boolean samba_forwardable;
 
 struct hdbldapdb {
@@ -59,6 +61,9 @@ struct hdbldapdb {
     int   h_msgid;
     char *h_base;
     char *h_url;
+    char *h_bind_dn;
+    char *h_bind_password;
+    krb5_boolean h_start_tls;
     char *h_createbase;
 };
 
@@ -68,6 +73,8 @@ struct hdbldapdb {
 	do { ((struct hdbldapdb *)(db)->hdb_db)->h_msgid = msgid; } while(0)
 #define HDB2BASE(dn) (((struct hdbldapdb *)(db)->hdb_db)->h_base)
 #define HDB2URL(dn) (((struct hdbldapdb *)(db)->hdb_db)->h_url)
+#define HDB2BINDDN(db) (((struct hdbldapdb *)(db)->hdb_db)->h_bind_dn)
+#define HDB2BINDPW(db) (((struct hdbldapdb *)(db)->hdb_db)->h_bind_password)
 #define HDB2CREATE(db) (((struct hdbldapdb *)(db)->hdb_db)->h_createbase)
 
 /*
@@ -87,6 +94,7 @@ static char * krb5kdcentry_attrs[] = {
     "krb5PasswordEnd",
     "krb5PrincipalName",
     "krb5PrincipalRealm",
+    "krb5ExtendedAttributes",
     "krb5ValidEnd",
     "krb5ValidStart",
     "modifiersName",
@@ -512,6 +520,33 @@ LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry_ex * ent,
 	    goto out;
     }
 
+    if (is_heimdal_entry && ent->entry.extensions) {
+	if (!is_new_entry) {
+	    vals = ldap_get_values_len(HDB2LDAP(db), msg, "krb5ExtendedAttributes");
+	    if (vals) {
+		ldap_value_free_len(vals);
+		ret = LDAP_addmod(&mods, LDAP_MOD_DELETE, "krb5ExtendedAttributes", NULL);
+		if (ret)
+		    goto out;
+	    }
+	}
+
+	for (i = 0; i < ent->entry.extensions->len; i++) {
+	    unsigned char *buf;
+	    size_t size, sz = 0;
+
+	    ASN1_MALLOC_ENCODE(HDB_extension, buf, size, &ent->entry.extensions->val[i], &sz, ret);
+	    if (ret)
+		goto out;
+	    if (size != sz)
+		krb5_abortx(context, "internal error in ASN.1 encoder");
+
+	    ret = LDAP_addmod_len(&mods, LDAP_MOD_ADD, "krb5ExtendedAttributes", buf, sz);
+	    if (ret)
+		goto out;
+	}
+    }
+
     if (is_heimdal_entry && ent->entry.valid_start) {
 	if (orig.entry.valid_end == NULL
 	    || (*(ent->entry.valid_start) != *(orig.entry.valid_start))) {
@@ -799,10 +834,10 @@ need_quote(unsigned char c)
 	(c == 0x7f);
 }
 
-const static char hexchar[] = "0123456789ABCDEF";
+static const char hexchar[] = "0123456789ABCDEF";
 
 static krb5_error_code
-escape_value(krb5_context context, const unsigned char *unquoted, char **quoted)
+escape_value(krb5_context context, const char *unquoted, char **quoted)
 {
     size_t i, len;
 
@@ -818,7 +853,7 @@ escape_value(krb5_context context, const unsigned char *unquoted, char **quoted)
     }
 
     for (i = 0; unquoted[0] ; unquoted++) {
-	if (need_quote((unsigned char *)unquoted[0])) {
+	if (need_quote((unsigned char)unquoted[0])) {
 	    (*quoted)[i++] = '\\';
 	    (*quoted)[i++] = hexchar[(unquoted[0] >> 4) & 0xf];
 	    (*quoted)[i++] = hexchar[(unquoted[0]     ) & 0xf];
@@ -977,6 +1012,7 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     char *unparsed_name = NULL, *dn = NULL, *ntPasswordIN = NULL;
     char *samba_acct_flags = NULL;
     struct berval **keys;
+    struct berval **extensions;
     struct berval **vals;
     int tmp, tmp_time, i, ret, have_arcfour = 0;
 
@@ -1015,7 +1051,6 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
     keys = ldap_get_values_len(HDB2LDAP(db), msg, "krb5Key");
     if (keys != NULL) {
-	int i;
 	size_t l;
 
 	ent->entry.keys.len = ldap_count_values_len(keys);
@@ -1045,10 +1080,35 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 #endif
     }
 
+    extensions = ldap_get_values_len(HDB2LDAP(db), msg, "krb5ExtendedAttributes");
+    if (extensions != NULL) {
+	size_t l;
+
+	ent->entry.extensions = calloc(1, sizeof(*(ent->entry.extensions)));
+	if (ent->entry.extensions == NULL) {
+	    ret = krb5_enomem(context);
+	    goto out;
+	}
+	ent->entry.extensions->len = ldap_count_values_len(extensions);
+	ent->entry.extensions->val = (HDB_extension *) calloc(ent->entry.extensions->len, sizeof(HDB_extension));
+	if (ent->entry.extensions->val == NULL) {
+	    ent->entry.extensions->len = 0;
+	    ret = krb5_enomem(context);
+	    goto out;
+	}
+	for (i = 0; i < ent->entry.extensions->len; i++) {
+	    ret = decode_HDB_extension((unsigned char *) extensions[i]->bv_val,
+		       (size_t) extensions[i]->bv_len, &ent->entry.extensions->val[i], &l);
+	    if (ret)
+		krb5_set_error_message(context, ret, "decode_HDB_extension failed");
+	}
+	ber_bvecfree(extensions);
+    } else {
+	ent->entry.extensions = NULL;
+    }
+
     vals = ldap_get_values_len(HDB2LDAP(db), msg, "krb5EncryptionType");
     if (vals != NULL) {
-	int i;
-
 	ent->entry.etypes = malloc(sizeof(*(ent->entry.etypes)));
 	if (ent->entry.etypes == NULL) {
 	    ret = ENOMEM;
@@ -1056,7 +1116,8 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 	    goto out;
 	}
 	ent->entry.etypes->len = ldap_count_values_len(vals);
-	ent->entry.etypes->val = calloc(ent->entry.etypes->len, sizeof(int));
+	ent->entry.etypes->val = calloc(ent->entry.etypes->len,
+                                        sizeof(ent->entry.etypes->val[0]));
 	if (ent->entry.etypes->val == NULL) {
 	    ret = ENOMEM;
 	    krb5_set_error_message(context, ret, "malloc: out of memory");
@@ -1091,24 +1152,22 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     ret = LDAP_get_string_value(db, msg, "sambaNTPassword", &ntPasswordIN);
     if (ret == 0 && have_arcfour == 0) {
 	unsigned *etypes;
-	Key *keys;
-	int i;
+        Key *ks;
 
-	keys = realloc(ent->entry.keys.val,
-		       (ent->entry.keys.len + 1) * sizeof(ent->entry.keys.val[0]));
-	if (keys == NULL) {
-	    free(ntPasswordIN);
+	ks = realloc(ent->entry.keys.val,
+		     (ent->entry.keys.len + 1) *
+                     sizeof(ent->entry.keys.val[0]));
+	if (ks == NULL) {
 	    ret = ENOMEM;
 	    krb5_set_error_message(context, ret, "malloc: out of memory");
 	    goto out;
 	}
-	ent->entry.keys.val = keys;
+	ent->entry.keys.val = ks;
 	memset(&ent->entry.keys.val[ent->entry.keys.len], 0, sizeof(Key));
 	ent->entry.keys.val[ent->entry.keys.len].key.keytype = ETYPE_ARCFOUR_HMAC_MD5;
 	ret = krb5_data_alloc (&ent->entry.keys.val[ent->entry.keys.len].key.keyvalue, 16);
 	if (ret) {
 	    krb5_set_error_message(context, ret, "malloc: out of memory");
-	    free(ntPasswordIN);
 	    ret = ENOMEM;
 	    goto out;
 	}
@@ -1241,21 +1300,24 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     if (ret == 0) {
 	time_t delta;
 
-	if (ent->entry.pw_end == NULL) {
-            ent->entry.pw_end = malloc(sizeof(*ent->entry.pw_end));
-            if (ent->entry.pw_end == NULL) {
-                ret = ENOMEM;
-                krb5_set_error_message(context, ret, "malloc: out of memory");
-                goto out;
-            }
-        }
-
 	delta = krb5_config_get_time_default(context, NULL,
-					     365 * 24 * 60 * 60,
+					     0,
 					     "kadmin",
 					     "password_lifetime",
 					     NULL);
-        *ent->entry.pw_end = tmp_time + delta;
+
+	if (delta) {
+		if (ent->entry.pw_end == NULL) {
+		    ent->entry.pw_end = malloc(sizeof(*ent->entry.pw_end));
+		    if (ent->entry.pw_end == NULL) {
+			ret = ENOMEM;
+			krb5_set_error_message(context, ret, "malloc: out of memory");
+			goto out;
+		    }
+		}
+
+		*ent->entry.pw_end = tmp_time + delta;
+	}
     }
 
     ret = LDAP_get_integer_value(db, msg, "sambaPwdMustChange", &tmp_time);
@@ -1335,7 +1397,6 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
 
 	*/
 
-	int i;
 	int flags_len = strlen(samba_acct_flags);
 
 	if (flags_len < 2)
@@ -1399,8 +1460,8 @@ LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
     ret = 0;
 
 out:
-    if (unparsed_name)
-	free(unparsed_name);
+    free(unparsed_name);
+    free(ntPasswordIN);
 
     if (ret)
 	hdb_free_entry(context, ent);
@@ -1515,7 +1576,7 @@ LDAP_firstkey(krb5_context context, HDB *db, unsigned flags,
 			"(|(objectClass=krb5Principal)(objectClass=sambaSamAccount))",
 			krb5kdcentry_attrs, 0,
 			NULL, NULL, NULL, 0, &msgid);
-    if (msgid < 0)
+    if (ret != LDAP_SUCCESS || msgid < 0)
 	return HDB_ERR_NOENTRY;
 
     HDBSETMSGID(db, msgid);
@@ -1541,6 +1602,16 @@ LDAP__connect(krb5_context context, HDB * db)
      * bind in progress message.
      */
     struct berval bv = { 0, "" };
+    const char *sasl_method = "EXTERNAL";
+    const char *bind_dn = NULL;
+
+    if (HDB2BINDDN(db) != NULL && HDB2BINDPW(db) != NULL) {
+	/* A bind DN was specified; use SASL SIMPLE */
+	bind_dn = HDB2BINDDN(db);
+	sasl_method = LDAP_SASL_SIMPLE;
+	bv.bv_val = HDB2BINDPW(db);
+	bv.bv_len = strlen(bv.bv_val);
+    }
 
     if (HDB2LDAP(db)) {
 	/* connection has been opened. ping server. */
@@ -1574,7 +1645,18 @@ LDAP__connect(krb5_context context, HDB * db)
 	return HDB_ERR_BADVERSION;
     }
 
-    rc = ldap_sasl_bind_s(HDB2LDAP(db), NULL, "EXTERNAL", &bv,
+    if (((struct hdbldapdb *)db->hdb_db)->h_start_tls) {
+	rc = ldap_start_tls_s(HDB2LDAP(db), NULL, NULL);
+
+	if (rc != LDAP_SUCCESS) {
+	    krb5_set_error_message(context, HDB_ERR_BADVERSION,
+				   "ldap_start_tls_s: %s", ldap_err2string(rc));
+	    LDAP_close(context, db);
+	    return HDB_ERR_BADVERSION;
+	}
+    }
+
+    rc = ldap_sasl_bind_s(HDB2LDAP(db), bind_dn, sasl_method, &bv,
 			  NULL, NULL, NULL);
     if (rc != LDAP_SUCCESS) {
 	krb5_set_error_message(context, HDB_ERR_BADVERSION,
@@ -1637,6 +1719,7 @@ LDAP_fetch_kvno(krb5_context context, HDB * db, krb5_const_principal principal,
     return ret;
 }
 
+#if 0
 static krb5_error_code
 LDAP_fetch(krb5_context context, HDB * db, krb5_const_principal principal,
 	   unsigned flags, hdb_entry_ex * entry)
@@ -1644,6 +1727,7 @@ LDAP_fetch(krb5_context context, HDB * db, krb5_const_principal principal,
     return LDAP_fetch_kvno(context, db, principal,
 			   flags & (~HDB_F_KVNO_SPECIFIED), 0, entry);
 }
+#endif
 
 static krb5_error_code
 LDAP_store(krb5_context context, HDB * db, unsigned flags,
@@ -1656,6 +1740,9 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
     LDAPMessage *msg = NULL, *e = NULL;
     char *dn = NULL, *name = NULL;
 
+    if ((flags & HDB_F_PRECHECK))
+        return 0; /* we can't guarantee whether we'll be able to perform it */
+
     ret = LDAP_principal2message(context, db, entry->entry.principal, &msg);
     if (ret == 0)
 	e = ldap_first_entry(HDB2LDAP(db), msg);
@@ -1727,13 +1814,17 @@ LDAP_store(krb5_context context, HDB * db, unsigned flags,
 }
 
 static krb5_error_code
-LDAP_remove(krb5_context context, HDB *db, krb5_const_principal principal)
+LDAP_remove(krb5_context context, HDB *db,
+            unsigned flags, krb5_const_principal principal)
 {
     krb5_error_code ret;
     LDAPMessage *msg, *e;
     char *dn = NULL;
     int rc, limit = LDAP_NO_LIMIT;
 
+    if ((flags & HDB_F_PRECHECK))
+        return 0; /* we can't guarantee whether we'll be able to perform it */
+
     ret = LDAP_principal2message(context, db, principal, &msg);
     if (ret)
 	goto out;
@@ -1805,8 +1896,19 @@ hdb_ldap_common(krb5_context context,
 {
     struct hdbldapdb *h;
     const char *create_base = NULL;
+    const char *ldap_secret_file = NULL;
 
-    if (search_base == NULL && search_base[0] == '\0') {
+    if (url == NULL || url[0] == '\0') {
+	const char *p;
+	p = krb5_config_get_string(context, NULL, "kdc",
+				   "hdb-ldap-url", NULL);
+	if (p == NULL)
+		p = default_ldap_url;
+
+	url = p;
+    }
+
+    if (search_base == NULL || search_base[0] == '\0') {
 	krb5_set_error_message(context, ENOMEM, "ldap search base not configured");
 	return ENOMEM; /* XXX */
     }
@@ -1862,6 +1964,34 @@ hdb_ldap_common(krb5_context context,
 	return ENOMEM;
     }
 
+    ldap_secret_file = krb5_config_get_string(context, NULL, "kdc",
+					      "hdb-ldap-secret-file", NULL);
+    if (ldap_secret_file != NULL) {
+	krb5_config_binding *tmp;
+	krb5_error_code ret;
+	const char *p;
+	
+	ret = krb5_config_parse_file(context, ldap_secret_file, &tmp);
+	if (ret)
+	    return ret;
+
+	p = krb5_config_get_string(context, tmp, "kdc",
+				   "hdb-ldap-bind-dn", NULL);
+	if (p != NULL)
+	    h->h_bind_dn = strdup(p);
+	
+	p = krb5_config_get_string(context, tmp, "kdc",
+				   "hdb-ldap-bind-password", NULL);
+	if (p != NULL)
+	    h->h_bind_password = strdup(p);
+
+	krb5_config_file_free(context, tmp);
+    }
+
+    h->h_start_tls =
+	krb5_config_get_bool_default(context, NULL, FALSE,
+				     "kdc", "hdb-ldap-start-tls", NULL);
+
     create_base = krb5_config_get_string(context, NULL, "kdc",
 					 "hdb-ldap-create-base", NULL);
     if (create_base == NULL)
@@ -1877,7 +2007,7 @@ hdb_ldap_common(krb5_context context,
 
     (*db)->hdb_master_key_set = 0;
     (*db)->hdb_openp = 0;
-    (*db)->hdb_capability_flags = 0;
+    (*db)->hdb_capability_flags = HDB_CAP_F_SHARED_DIRECTORY;
     (*db)->hdb_open = LDAP_open;
     (*db)->hdb_close = LDAP_close;
     (*db)->hdb_fetch_kvno = LDAP_fetch_kvno;
@@ -1896,20 +2026,27 @@ hdb_ldap_common(krb5_context context,
     return 0;
 }
 
+#ifdef OPENLDAP_MODULE
+static
+#endif
+
 krb5_error_code
 hdb_ldap_create(krb5_context context, HDB ** db, const char *arg)
 {
-    return hdb_ldap_common(context, db, arg, "ldapi:///");
+    return hdb_ldap_common(context, db, arg, NULL);
 }
 
+#ifdef OPENLDAP_MODULE
+static
+#endif
+
 krb5_error_code
 hdb_ldapi_create(krb5_context context, HDB ** db, const char *arg)
 {
     krb5_error_code ret;
     char *search_base, *p;
 
-    asprintf(&p, "ldapi:%s", arg);
-    if (p == NULL) {
+    if (asprintf(&p, "ldapi:%s", arg) == -1 || p == NULL) {
 	*db = NULL;
 	krb5_set_error_message(context, ENOMEM, "out of memory");
 	return ENOMEM;
@@ -1930,19 +2067,33 @@ hdb_ldapi_create(krb5_context context, HDB ** db, const char *arg)
 }
 
 #ifdef OPENLDAP_MODULE
+static krb5_error_code
+init(krb5_context context, void **ctx)
+{
+    *ctx = NULL;
+    return 0;
+}
 
-struct hdb_so_method hdb_ldap_interface = {
+static void
+fini(void *ctx)
+{
+}
+
+struct hdb_method hdb_ldap_interface = {
     HDB_INTERFACE_VERSION,
+    init,
+    fini,
     "ldap",
     hdb_ldap_create
 };
 
-struct hdb_so_method hdb_ldapi_interface = {
+struct hdb_method hdb_ldapi_interface = {
     HDB_INTERFACE_VERSION,
+    init,
+    fini,
     "ldapi",
     hdb_ldapi_create
 };
-
 #endif
 
 #endif				/* OPENLDAP */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mdb.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mdb.c
new file mode 100644
index 000000000..21f58b37c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mdb.c
@@ -0,0 +1,401 @@
+/*	$NetBSD: hdb-mdb.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * Copyright (c) 2011 - Howard Chu, Symas Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "hdb_locl.h"
+
+#if HAVE_LMDB
+
+/* LMDB */
+
+#include <lmdb.h>
+
+#define	KILO	1024
+
+typedef struct mdb_info {
+    MDB_env *e;
+    MDB_txn *t;
+    MDB_dbi d;
+    MDB_cursor *c;
+} mdb_info;
+
+static krb5_error_code
+DB_close(krb5_context context, HDB *db)
+{
+    mdb_info *mi = (mdb_info *)db->hdb_db;
+
+    mdb_cursor_close(mi->c);
+    mdb_txn_abort(mi->t);
+    mdb_env_close(mi->e);
+    mi->c = 0;
+    mi->t = 0;
+    mi->e = 0;
+    return 0;
+}
+
+static krb5_error_code
+DB_destroy(krb5_context context, HDB *db)
+{
+    krb5_error_code ret;
+
+    ret = hdb_clear_master_key (context, db);
+    free(db->hdb_name);
+    free(db->hdb_db);
+    free(db);
+    return ret;
+}
+
+static krb5_error_code
+DB_lock(krb5_context context, HDB *db, int operation)
+{
+    db->lock_count++;
+    return 0;
+}
+
+static krb5_error_code
+DB_unlock(krb5_context context, HDB *db)
+{
+    if (db->lock_count > 1) {
+	db->lock_count--;
+	return 0;
+    }
+    heim_assert(db->lock_count == 1, "HDB lock/unlock sequence does not match");
+    db->lock_count--;
+    return 0;
+}
+
+
+static krb5_error_code
+DB_seq(krb5_context context, HDB *db,
+       unsigned flags, hdb_entry_ex *entry, int flag)
+{
+    mdb_info *mi = db->hdb_db;
+    MDB_val key, value;
+    krb5_data key_data, data;
+    int code;
+
+    key.mv_size = 0;
+    value.mv_size = 0;
+    code = mdb_cursor_get(mi->c, &key, &value, flag);
+    if (code == MDB_NOTFOUND)
+	return HDB_ERR_NOENTRY;
+    if (code)
+	return code;
+
+    key_data.data = key.mv_data;
+    key_data.length = key.mv_size;
+    data.data = value.mv_data;
+    data.length = value.mv_size;
+    memset(entry, 0, sizeof(*entry));
+    if (hdb_value2entry(context, &data, &entry->entry))
+	return DB_seq(context, db, flags, entry, MDB_NEXT);
+    if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
+	code = hdb_unseal_keys (context, db, &entry->entry);
+	if (code)
+	    hdb_free_entry (context, entry);
+    }
+    if (entry->entry.principal == NULL) {
+	entry->entry.principal = malloc(sizeof(*entry->entry.principal));
+	if (entry->entry.principal == NULL) {
+	    hdb_free_entry (context, entry);
+	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    return ENOMEM;
+	} else {
+	    hdb_key2principal(context, &key_data, entry->entry.principal);
+	}
+    }
+    return 0;
+}
+
+
+static krb5_error_code
+DB_firstkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
+{
+    mdb_info *mi = db->hdb_db;
+    int code;
+
+    /* Always start with a fresh cursor to pick up latest DB state */
+    if (mi->t)
+	mdb_txn_abort(mi->t);
+
+    code = mdb_txn_begin(mi->e, NULL, MDB_RDONLY, &mi->t);
+    if (code)
+	return code;
+
+    code = mdb_cursor_open(mi->t, mi->d, &mi->c);
+    if (code)
+	return code;
+
+    return DB_seq(context, db, flags, entry, MDB_FIRST);
+}
+
+
+static krb5_error_code
+DB_nextkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
+{
+    return DB_seq(context, db, flags, entry, MDB_NEXT);
+}
+
+static krb5_error_code
+DB_rename(krb5_context context, HDB *db, const char *new_name)
+{
+    int ret;
+    char *old, *new;
+
+    if (strncmp(new_name, "mdb:", sizeof("mdb:") - 1) == 0)
+        new_name += sizeof("mdb:") - 1;
+    else if (strncmp(new_name, "lmdb:", sizeof("lmdb:") - 1) == 0)
+        new_name += sizeof("lmdb:") - 1;
+    if (asprintf(&old, "%s.mdb", db->hdb_name) == -1)
+		return ENOMEM;
+    if (asprintf(&new, "%s.mdb", new_name) == -1) {
+		free(old);
+		return ENOMEM;
+    }
+    ret = rename(old, new);
+    free(old);
+    free(new);
+    if(ret)
+	return errno;
+
+    free(db->hdb_name);
+    db->hdb_name = strdup(new_name);
+    return 0;
+}
+
+static krb5_error_code
+DB__get(krb5_context context, HDB *db, krb5_data key, krb5_data *reply)
+{
+    mdb_info *mi = (mdb_info*)db->hdb_db;
+    MDB_txn *txn;
+    MDB_val k, v;
+    int code;
+
+    k.mv_data = key.data;
+    k.mv_size = key.length;
+
+    code = mdb_txn_begin(mi->e, NULL, MDB_RDONLY, &txn);
+    if (code)
+	return code;
+
+    code = mdb_get(txn, mi->d, &k, &v);
+    if (code == 0)
+	krb5_data_copy(reply, v.mv_data, v.mv_size);
+    mdb_txn_abort(txn);
+    if(code == MDB_NOTFOUND)
+	return HDB_ERR_NOENTRY;
+    return code;
+}
+
+static krb5_error_code
+DB__put(krb5_context context, HDB *db, int replace,
+	krb5_data key, krb5_data value)
+{
+    mdb_info *mi = (mdb_info*)db->hdb_db;
+    MDB_txn *txn;
+    MDB_val k, v;
+    int code;
+
+    k.mv_data = key.data;
+    k.mv_size = key.length;
+    v.mv_data = value.data;
+    v.mv_size = value.length;
+
+    code = mdb_txn_begin(mi->e, NULL, 0, &txn);
+    if (code)
+	return code;
+
+    code = mdb_put(txn, mi->d, &k, &v, replace ? 0 : MDB_NOOVERWRITE);
+    if (code)
+	mdb_txn_abort(txn);
+    else
+	code = mdb_txn_commit(txn);
+    if(code == MDB_KEYEXIST)
+	return HDB_ERR_EXISTS;
+    return code;
+}
+
+static krb5_error_code
+DB__del(krb5_context context, HDB *db, krb5_data key)
+{
+    mdb_info *mi = (mdb_info*)db->hdb_db;
+    MDB_txn *txn;
+    MDB_val k;
+    krb5_error_code code;
+
+    k.mv_data = key.data;
+    k.mv_size = key.length;
+
+    code = mdb_txn_begin(mi->e, NULL, 0, &txn);
+    if (code)
+	return code;
+
+    code = mdb_del(txn, mi->d, &k, NULL);
+    if (code)
+	mdb_txn_abort(txn);
+    else
+	code = mdb_txn_commit(txn);
+    if(code == MDB_NOTFOUND)
+	return HDB_ERR_NOENTRY;
+    return code;
+}
+
+static krb5_error_code
+DB_open(krb5_context context, HDB *db, int flags, mode_t mode)
+{
+    mdb_info *mi = (mdb_info *)db->hdb_db;
+    MDB_txn *txn;
+    char *fn;
+    krb5_error_code ret;
+    int myflags = MDB_NOSUBDIR, tmp;
+
+    if((flags & O_ACCMODE) == O_RDONLY)
+      myflags |= MDB_RDONLY;
+
+    if (asprintf(&fn, "%s.mdb", db->hdb_name) == -1)
+	return krb5_enomem(context);
+    if (mdb_env_create(&mi->e)) {
+	free(fn);
+	return krb5_enomem(context);
+    }
+
+    tmp = krb5_config_get_int_default(context, NULL, 0, "kdc",
+	"hdb-mdb-maxreaders", NULL);
+    if (tmp) {
+	ret = mdb_env_set_maxreaders(mi->e, tmp);
+	if (ret) {
+            free(fn);
+	    krb5_set_error_message(context, ret, "setting maxreaders on %s: %s",
+		db->hdb_name, mdb_strerror(ret));
+	    return ret;
+	}
+    }
+
+    tmp = krb5_config_get_int_default(context, NULL, 0, "kdc",
+	"hdb-mdb-mapsize", NULL);
+    if (tmp) {
+	size_t maps = tmp;
+	maps *= KILO;
+	ret = mdb_env_set_mapsize(mi->e, maps);
+	if (ret) {
+            free(fn);
+	    krb5_set_error_message(context, ret, "setting mapsize on %s: %s",
+		db->hdb_name, mdb_strerror(ret));
+	    return ret;
+	}
+    }
+
+    ret = mdb_env_open(mi->e, fn, myflags, mode);
+    free(fn);
+    if (ret) {
+fail:
+	mdb_env_close(mi->e);
+	mi->e = 0;
+	krb5_set_error_message(context, ret, "opening %s: %s",
+			      db->hdb_name, mdb_strerror(ret));
+	return ret;
+    }
+
+    ret = mdb_txn_begin(mi->e, NULL, MDB_RDONLY, &txn);
+    if (ret)
+	goto fail;
+
+    ret = mdb_open(txn, NULL, 0, &mi->d);
+    mdb_txn_abort(txn);
+    if (ret)
+	goto fail;
+
+    if((flags & O_ACCMODE) == O_RDONLY)
+	ret = hdb_check_db_format(context, db);
+    else
+	ret = hdb_init_db(context, db);
+    if(ret == HDB_ERR_NOENTRY)
+	return 0;
+    if (ret) {
+	DB_close(context, db);
+	krb5_set_error_message(context, ret, "hdb_open: failed %s database %s",
+			       (flags & O_ACCMODE) == O_RDONLY ?
+			       "checking format of" : "initialize",
+			       db->hdb_name);
+    }
+
+    return ret;
+}
+
+krb5_error_code
+hdb_mdb_create(krb5_context context, HDB **db,
+	      const char *filename)
+{
+    *db = calloc(1, sizeof(**db));
+    if (*db == NULL) {
+	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	return ENOMEM;
+    }
+
+    (*db)->hdb_db = calloc(1, sizeof(mdb_info));
+    if ((*db)->hdb_db == NULL) {
+	free(*db);
+	*db = NULL;
+	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	return ENOMEM;
+    }
+    (*db)->hdb_name = strdup(filename);
+    if ((*db)->hdb_name == NULL) {
+	free((*db)->hdb_db);
+	free(*db);
+	*db = NULL;
+	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	return ENOMEM;
+    }
+    (*db)->hdb_master_key_set = 0;
+    (*db)->hdb_openp = 0;
+    (*db)->hdb_capability_flags = HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL;
+    (*db)->hdb_open  = DB_open;
+    (*db)->hdb_close = DB_close;
+    (*db)->hdb_fetch_kvno = _hdb_fetch_kvno;
+    (*db)->hdb_store = _hdb_store;
+    (*db)->hdb_remove = _hdb_remove;
+    (*db)->hdb_firstkey = DB_firstkey;
+    (*db)->hdb_nextkey= DB_nextkey;
+    (*db)->hdb_lock = DB_lock;
+    (*db)->hdb_unlock = DB_unlock;
+    (*db)->hdb_rename = DB_rename;
+    (*db)->hdb__get = DB__get;
+    (*db)->hdb__put = DB__put;
+    (*db)->hdb__del = DB__del;
+    (*db)->hdb_destroy = DB_destroy;
+    return 0;
+}
+#endif /* HAVE_LMDB */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mitdb.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mitdb.c
index e7c318d03..830aca7ee 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mitdb.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-mitdb.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb-mitdb.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hdb-mitdb.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -93,18 +93,28 @@ salt:
 
 #include "hdb_locl.h"
 
+static void
+attr_to_flags(unsigned attr, HDBFlags *flags)
+{
+    flags->postdate =		!(attr & KRB5_KDB_DISALLOW_POSTDATED);
+    flags->forwardable =	!(attr & KRB5_KDB_DISALLOW_FORWARDABLE);
+    flags->initial =	       !!(attr & KRB5_KDB_DISALLOW_TGT_BASED);
+    flags->renewable =		!(attr & KRB5_KDB_DISALLOW_RENEWABLE);
+    flags->proxiable =		!(attr & KRB5_KDB_DISALLOW_PROXIABLE);
+    /* DUP_SKEY */
+    flags->invalid =	       !!(attr & KRB5_KDB_DISALLOW_ALL_TIX);
+    flags->require_preauth =   !!(attr & KRB5_KDB_REQUIRES_PRE_AUTH);
+    flags->require_hwauth =    !!(attr & KRB5_KDB_REQUIRES_HW_AUTH);
+    flags->server =		!(attr & KRB5_KDB_DISALLOW_SVR);
+    flags->change_pw = 	       !!(attr & KRB5_KDB_PWCHANGE_SERVICE);
+    flags->client =	        1; /* XXX */
+}
+
 #define KDB_V1_BASE_LENGTH 38
 
-#if HAVE_DB1
-
-#if defined(HAVE_DB_185_H)
-#include <db_185.h>
-#elif defined(HAVE_DB_H)
-#include <db.h>
-#endif
-
 #define CHECK(x) do { if ((x)) goto out; } while(0)
 
+#ifdef HAVE_DB1
 static krb5_error_code
 mdb_principal2key(krb5_context context,
 		  krb5_const_principal principal,
@@ -120,6 +130,7 @@ mdb_principal2key(krb5_context context,
     key->length = strlen(str) + 1;
     return 0;
 }
+#endif /* HAVE_DB1 */
 
 #define KRB5_KDB_SALTTYPE_NORMAL	0
 #define KRB5_KDB_SALTTYPE_V4		1
@@ -130,10 +141,10 @@ mdb_principal2key(krb5_context context,
 #define KRB5_KDB_SALTTYPE_CERTHASH	6
 
 static krb5_error_code
-fix_salt(krb5_context context, hdb_entry *ent, int key_num)
+fix_salt(krb5_context context, hdb_entry *ent, Key *k)
 {
     krb5_error_code ret;
-    Salt *salt = ent->keys.val[key_num].salt;
+    Salt *salt = k->salt;
     /* fix salt type */
     switch((int)salt->type) {
     case KRB5_KDB_SALTTYPE_NORMAL:
@@ -189,8 +200,8 @@ fix_salt(krb5_context context, hdb_entry *ent, int key_num)
 	break;
     case KRB5_KDB_SALTTYPE_CERTHASH:
 	krb5_data_free(&salt->salt);
-	free(ent->keys.val[key_num].salt);
-	ent->keys.val[key_num].salt = NULL;
+	free(k->salt);
+	k->salt = NULL;
 	break;
     default:
 	abort();
@@ -199,16 +210,216 @@ fix_salt(krb5_context context, hdb_entry *ent, int key_num)
 }
 
 
+/**
+ * This function takes a key from a krb5_storage from an MIT KDB encoded
+ * entry and places it in the given Key object.
+ *
+ * @param context   Context
+ * @param entry	    HDB entry
+ * @param sp	    krb5_storage with current offset set to the beginning of a
+ *		    key
+ * @param version   See comments in caller body for the backstory on this
+ * @param k	    Key * to load the key into
+ */
 static krb5_error_code
-mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry *entry)
+mdb_keyvalue2key(krb5_context context, hdb_entry *entry, krb5_storage *sp, uint16_t version, Key *k)
+{
+    size_t i;
+    uint16_t u16, type;
+    krb5_error_code ret;
+
+    k->mkvno = malloc(sizeof(*k->mkvno));
+    if (k->mkvno == NULL) {
+	ret = ENOMEM;
+	goto out;
+    }
+    *k->mkvno = 1;
+
+    for (i = 0; i < version; i++) {
+	CHECK(ret = krb5_ret_uint16(sp, &type));
+	CHECK(ret = krb5_ret_uint16(sp, &u16));
+	if (i == 0) {
+	    /* This "version" means we have a key */
+	    k->key.keytype = type;
+	    /*
+	     * MIT stores keys encrypted keys as {16-bit length
+	     * of plaintext key, {encrypted key}}.  The reason
+	     * for this is that the Kerberos cryptosystem is not
+	     * length-preserving.  Heimdal's approach is to
+	     * truncate the plaintext to the expected length of
+	     * the key given its enctype, so we ignore this
+	     * 16-bit length-of-plaintext-key field.
+	     */
+	    if (u16 > 2) {
+		krb5_storage_seek(sp, 2, SEEK_CUR); /* skip real length */
+		k->key.keyvalue.length = u16 - 2;   /* adjust cipher len */
+		k->key.keyvalue.data = malloc(k->key.keyvalue.length);
+		krb5_storage_read(sp, k->key.keyvalue.data,
+				  k->key.keyvalue.length);
+	    } else {
+		/* We'll ignore this key; see our caller */
+		k->key.keyvalue.length = 0;
+		k->key.keyvalue.data = NULL;
+		krb5_storage_seek(sp, u16, SEEK_CUR); /* skip real length */
+	    }
+	} else if (i == 1) {
+	    /* This "version" means we have a salt */
+	    k->salt = calloc(1, sizeof(*k->salt));
+	    if (k->salt == NULL) {
+		ret = ENOMEM;
+		goto out;
+	    }
+	    k->salt->type = type;
+	    if (u16 != 0) {
+		k->salt->salt.data = malloc(u16);
+		if (k->salt->salt.data == NULL) {
+		    ret = ENOMEM;
+		    goto out;
+		}
+		k->salt->salt.length = u16;
+		krb5_storage_read(sp, k->salt->salt.data, k->salt->salt.length);
+	    }
+	    fix_salt(context, entry, k);
+	} else {
+	    /*
+	     * Whatever this "version" might be, we skip it
+	     *
+	     * XXX A krb5.conf parameter requesting that we log
+	     * about strangeness like this, or return an error
+	     * from here, might be nice.
+	     */
+	    krb5_storage_seek(sp, u16, SEEK_CUR);
+	}
+    }
+
+    return 0;
+
+out:
+    free_Key(k);
+    return ret;
+}
+
+
+static krb5_error_code
+add_1des_dup(krb5_context context, Keys *keys, Key *key, krb5_keytype keytype)
+{
+    key->key.keytype = keytype;
+    return add_Keys(keys, key);
+}
+
+/*
+ * This monstrosity is here so we can avoid having to do enctype
+ * similarity checking in the KDC.  This helper function dups 1DES keys
+ * in a keyset for all the similar 1DES enctypes for which keys are
+ * missing.  And, of course, we do this only if there's any 1DES keys in
+ * the keyset to begin with.
+ */
+static krb5_error_code
+dup_similar_keys_in_keyset(krb5_context context, Keys *keys)
+{
+    krb5_error_code ret;
+    size_t i, k;
+    Key key;
+    int keyset_has_1des_crc = 0;
+    int keyset_has_1des_md4 = 0;
+    int keyset_has_1des_md5 = 0;
+
+    memset(&key, 0, sizeof (key));
+    k = keys->len;
+    for (i = 0; i < keys->len; i++) {
+	if (keys->val[i].key.keytype == ETYPE_DES_CBC_CRC) {
+	    keyset_has_1des_crc = 1;
+	    if (k == keys->len)
+		k = i;
+	} else if (keys->val[i].key.keytype == ETYPE_DES_CBC_MD4) {
+	    keyset_has_1des_crc = 1;
+	    if (k == keys->len)
+		k = i;
+	} else if (keys->val[i].key.keytype == ETYPE_DES_CBC_MD5) {
+	    keyset_has_1des_crc = 1;
+	    if (k == keys->len)
+		k = i;
+	}
+    }
+    if (k == keys->len)
+	return 0;
+
+    ret = copy_Key(&keys->val[k], &key);
+    if (ret)
+	return ret;
+    if (!keyset_has_1des_crc) {
+	ret = add_1des_dup(context, keys, &key, ETYPE_DES_CBC_CRC);
+	if (ret)
+	    goto out;
+    }
+    if (!keyset_has_1des_md4) {
+	ret = add_1des_dup(context, keys, &key, ETYPE_DES_CBC_MD4);
+	if (ret)
+	    goto out;
+    }
+    if (!keyset_has_1des_md5) {
+	ret = add_1des_dup(context, keys, &key, ETYPE_DES_CBC_MD5);
+	if (ret)
+	    goto out;
+    }
+
+out:
+    free_Key(&key);
+    return ret;
+}
+
+
+static krb5_error_code
+dup_similar_keys(krb5_context context, hdb_entry *entry)
+{
+    krb5_error_code ret;
+    HDB_Ext_KeySet *hist_keys;
+    HDB_extension *extp;
+    size_t i;
+
+    ret = dup_similar_keys_in_keyset(context, &entry->keys);
+    if (ret)
+	return ret;
+    extp = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (extp == NULL)
+	return 0;
+
+    hist_keys = &extp->data.u.hist_keys;
+    for (i = 0; i < hist_keys->len; i++) {
+	ret = dup_similar_keys_in_keyset(context, &hist_keys->val[i].keys);
+	if (ret)
+	    return ret;
+    }
+    return 0;
+}
+
+
+/**
+ * This function parses an MIT krb5 encoded KDB entry and fills in the
+ * given HDB entry with it.
+ *
+ * @param context	krb5_context
+ * @param data		Encoded MIT KDB entry
+ * @param target_kvno	Desired kvno, or 0 for the entry's current kvno
+ * @param entry		Desired kvno, or 0 for the entry's current kvno
+ */
+krb5_error_code
+_hdb_mdb_value2entry(krb5_context context, krb5_data *data,
+                     krb5_kvno target_kvno, hdb_entry *entry)
 {
     krb5_error_code ret;
     krb5_storage *sp;
+    Key k;
+    krb5_kvno key_kvno;
     uint32_t u32;
     uint16_t u16, num_keys, num_tl;
-    size_t i, j;
+    ssize_t sz;
+    size_t i;
     char *p;
 
+    memset(&k, 0, sizeof (k));
+    memset(entry, 0, sizeof(*entry));
+
     sp = krb5_storage_from_data(data);
     if (sp == NULL) {
 	krb5_set_error_message(context, ENOMEM, "out of memory");
@@ -230,24 +441,14 @@ mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry
      * XXX But... surely we ought to log about this extra data, or skip
      * it, or something, in case anyone has MIT KDBs with ancient
      * entries in them...  Logging would allow the admin to know which
-     * entries to dump with MIT krb5's kdb5_util.
+     * entries to dump with MIT krb5's kdb5_util.  But logging would be
+     * noisy.  For now we do nothing.
      */
     CHECK(ret = krb5_ret_uint16(sp, &u16));
     if (u16 != KDB_V1_BASE_LENGTH) { ret = EINVAL; goto out; }
     /* 32: attributes */
     CHECK(ret = krb5_ret_uint32(sp, &u32));
-    entry->flags.postdate =	 !(u32 & KRB5_KDB_DISALLOW_POSTDATED);
-    entry->flags.forwardable =	 !(u32 & KRB5_KDB_DISALLOW_FORWARDABLE);
-    entry->flags.initial =	!!(u32 & KRB5_KDB_DISALLOW_TGT_BASED);
-    entry->flags.renewable =	 !(u32 & KRB5_KDB_DISALLOW_RENEWABLE);
-    entry->flags.proxiable =	 !(u32 & KRB5_KDB_DISALLOW_PROXIABLE);
-    /* DUP_SKEY */
-    entry->flags.invalid =	!!(u32 & KRB5_KDB_DISALLOW_ALL_TIX);
-    entry->flags.require_preauth =!!(u32 & KRB5_KDB_REQUIRES_PRE_AUTH);
-    entry->flags.require_hwauth =!!(u32 & KRB5_KDB_REQUIRES_HW_AUTH);
-    entry->flags.server =	 !(u32 & KRB5_KDB_DISALLOW_SVR);
-    entry->flags.change_pw = 	!!(u32 & KRB5_KDB_PWCHANGE_SERVICE);
-    entry->flags.client =	   1; /* XXX */
+    attr_to_flags(u32, &entry->flags);
 
     /* 32: max time */
     CHECK(ret = krb5_ret_uint32(sp, &u32));
@@ -298,7 +499,11 @@ mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry
 	    ret = ENOMEM;
 	    goto out;
 	}
-	krb5_storage_read(sp, p, u16);
+	sz = krb5_storage_read(sp, p, u16);
+        if (sz != u16) {
+            ret = EINVAL; /* XXX */
+            goto out;
+        }
 	p[u16] = '\0';
 	CHECK(ret = krb5_parse_name(context, p, &entry->principal));
 	free(p);
@@ -307,12 +512,53 @@ mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry
            16: tl data type
            16: tl data length
            length: length */
+#define mit_KRB5_TL_LAST_PWD_CHANGE     1
+#define mit_KRB5_TL_MOD_PRINC           2
     for (i = 0; i < num_tl; i++) {
+        int tl_type;
+        krb5_principal modby;
 	/* 16: TL data type */
 	CHECK(ret = krb5_ret_uint16(sp, &u16));
+        tl_type = u16;
 	/* 16: TL data length */
 	CHECK(ret = krb5_ret_uint16(sp, &u16));
-	krb5_storage_seek(sp, u16, SEEK_CUR);
+        /*
+         * For rollback to MIT purposes we really must understand some
+         * TL data!
+         *
+         * XXX Move all this to separate functions, one per-TL type.
+         */
+        switch (tl_type) {
+        case mit_KRB5_TL_LAST_PWD_CHANGE:
+            CHECK(ret = krb5_ret_uint32(sp, &u32));
+            CHECK(ret = hdb_entry_set_pw_change_time(context, entry, u32));
+            break;
+        case mit_KRB5_TL_MOD_PRINC:
+            if (u16 < 5) {
+                ret = EINVAL; /* XXX */
+                goto out;
+            }
+            CHECK(ret = krb5_ret_uint32(sp, &u32)); /* mod time */
+            p = malloc(u16 - 4 + 1);
+            if (!p) {
+                ret = ENOMEM;
+                goto out;
+            }
+            p[u16 - 4] = '\0';
+            sz = krb5_storage_read(sp, p, u16 - 4);
+            if (sz != u16 - 4) { 
+                ret = EINVAL; /* XXX */
+                goto out;
+            }
+            CHECK(ret = krb5_parse_name(context, p, &modby));
+            ret = hdb_set_last_modified_by(context, entry, modby, u32);
+            krb5_free_principal(context, modby);
+            free(p);
+            break;
+        default:
+            krb5_storage_seek(sp, u16, SEEK_CUR);
+            break;
+        }
     }
     /*
      * for num key data times
@@ -328,140 +574,92 @@ mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry
      * That's right... hold that gag reflex, you can do it.
      */
     for (i = 0; i < num_keys; i++) {
-	int keep = 0;
 	uint16_t version;
-	void *ptr;
 
 	CHECK(ret = krb5_ret_uint16(sp, &u16));
 	version = u16;
 	CHECK(ret = krb5_ret_uint16(sp, &u16));
+	key_kvno = u16;
 
-	/*
-	 * First time through, and until we find one matching key,
-	 * entry->kvno == 0.
-	 */
-	if ((entry->kvno < u16) && (kvno == 0 || kvno == u16)) {
-	    keep = 1;
-	    entry->kvno = u16;
+	ret = mdb_keyvalue2key(context, entry, sp, version, &k);
+	if (ret)
+	    goto out;
+	if (k.key.keytype == 0 || k.key.keyvalue.length == 0) {
 	    /*
-	     * Found a higher kvno than earlier, so free the old highest
-	     * kvno keys.
+	     * Older MIT KDBs may have enctype 0 / length 0 keys.  We
+	     * ignore these.
+	     */
+	    free_Key(&k);
+	    continue;
+	}
+
+	if ((target_kvno == 0 && entry->kvno < key_kvno) ||
+	    (target_kvno == key_kvno && entry->kvno != target_kvno)) {
+	    /*
+	     * MIT's KDB doesn't keep track of kvno.  The highest kvno
+	     * is the current kvno, and we just found a new highest
+	     * kvno or the desired kvno.
 	     *
-	     * XXX Of course, we actually want to extract the old kvnos
-	     * as well, for some of the kadm5 APIs.  We shouldn't free
-	     * these keys, but keep them elsewhere.
+	     * Note that there's no guarantee of any key ordering, but
+	     * generally MIT KDB entries have keys in strictly
+	     * descending kvno order.
+	     *
+	     * XXX We do assume that keys are clustered by kvno.  If
+	     * not, then bad.  It might be possible to construct
+	     * non-clustered keys via the kadm5 API.  It wouldn't be
+	     * hard to cope with this, since if it happens the worst
+	     * that will happen is that some of the current keys can be
+	     * found in the history extension, and we could just pull
+	     * them back out in that case.
 	     */
-	    for (j = 0; j < entry->keys.len; j++)
-		free_Key(&entry->keys.val[j]);
-	    free(entry->keys.val);
-	    entry->keys.len = 0;
-	    entry->keys.val = NULL;
-	} else if (entry->kvno == u16)
-	    /* Accumulate keys */
-	    keep = 1;
-
-	if (keep) {
-	    Key *k;
-
-	    ptr = realloc(entry->keys.val, sizeof(entry->keys.val[0]) * (entry->keys.len + 1));
-	    if (ptr == NULL) {
-		ret = ENOMEM;
+	    ret = hdb_add_current_keys_to_history(context, entry);
+	    if (ret)
 		goto out;
-	    }
-	    entry->keys.val = ptr;
-
-	    /* k points to current Key */
-	    k = &entry->keys.val[entry->keys.len];
-
-	    memset(k, 0, sizeof(*k));
-	    entry->keys.len += 1;
-
-	    k->mkvno = malloc(sizeof(*k->mkvno));
-	    if (k->mkvno == NULL) {
-		ret = ENOMEM;
+	    free_Keys(&entry->keys);
+	    ret = add_Keys(&entry->keys, &k);
+	    free_Key(&k);
+	    if (ret)
 		goto out;
-	    }
-	    *k->mkvno = 1;
+	    entry->kvno = key_kvno;
+	    continue;
+	}
 
-	    for (j = 0; j < version; j++) {
-		uint16_t type;
-		CHECK(ret = krb5_ret_uint16(sp, &type));
-		CHECK(ret = krb5_ret_uint16(sp, &u16));
-		if (j == 0) {
-		    /* This "version" means we have a key */
-		    k->key.keytype = type;
-		    if (u16 < 2) {
-			ret = EINVAL;
-			goto out;
-		    }
-		    /*
-		     * MIT stores keys encrypted keys as {16-bit length
-		     * of plaintext key, {encrypted key}}.  The reason
-		     * for this is that the Kerberos cryptosystem is not
-		     * length-preserving.  Heimdal's approach is to
-		     * truncate the plaintext to the expected length of
-		     * the key given its enctype, so we ignore this
-		     * 16-bit length-of-plaintext-key field.
-		     */
-		    krb5_storage_seek(sp, 2, SEEK_CUR); /* skip real length */
-		    k->key.keyvalue.length = u16 - 2;   /* adjust cipher len */
-		    k->key.keyvalue.data = malloc(k->key.keyvalue.length);
-		    krb5_storage_read(sp, k->key.keyvalue.data,
-				      k->key.keyvalue.length);
-		} else if (j == 1) {
-		    /* This "version" means we have a salt */
-		    k->salt = calloc(1, sizeof(*k->salt));
-		    if (k->salt == NULL) {
-			ret = ENOMEM;
-			goto out;
-		    }
-		    k->salt->type = type;
-		    if (u16 != 0) {
-			k->salt->salt.data = malloc(u16);
-			if (k->salt->salt.data == NULL) {
-			    ret = ENOMEM;
-			    goto out;
-			}
-			k->salt->salt.length = u16;
-			krb5_storage_read(sp, k->salt->salt.data, k->salt->salt.length);
-		    }
-		    fix_salt(context, entry, entry->keys.len - 1);
-		} else {
-		    /*
-		     * Whatever this "version" might be, we skip it
-		     *
-		     * XXX A krb5.conf parameter requesting that we log
-		     * about strangeness like this, or return an error
-		     * from here, might be nice.
-		     */
-		    krb5_storage_seek(sp, u16, SEEK_CUR);
-		}
-	    }
-	} else {
+	if (entry->kvno == key_kvno) {
 	    /*
-	     * XXX For now we skip older kvnos, but we should extract
-	     * them...
+	     * Note that if key_kvno == 0 and target_kvno == 0 then we
+	     * end up adding those keys here.  Yeah, kvno 0 is very
+	     * special for us, but just in case, we keep such keys.
 	     */
-	    for (j = 0; j < version; j++) {
-		/* enctype */
-		CHECK(ret = krb5_ret_uint16(sp, &u16));
-		/* encrypted key (or plaintext salt) */
-		CHECK(ret = krb5_ret_uint16(sp, &u16));
-		krb5_storage_seek(sp, u16, SEEK_CUR);
-	    }
+	    ret = add_Keys(&entry->keys, &k);
+	    free_Key(&k);
+	    if (ret)
+		goto out;
+	    entry->kvno = key_kvno;
+	} else  {
+	    ret = hdb_add_history_key(context, entry, key_kvno, &k);
+	    if (ret)
+		goto out;
+	    free_Key(&k);
 	}
     }
 
-    if (entry->kvno == 0 && kvno != 0) {
-	ret = HDB_ERR_NOT_FOUND_HERE;
+    if (target_kvno != 0 && entry->kvno != target_kvno) {
+	ret = HDB_ERR_KVNO_NOT_FOUND;
 	goto out;
     }
 
-    return 0;
- out:
+    krb5_storage_free(sp);
+
+    return dup_similar_keys(context, entry);
+
+out:
+    krb5_storage_free(sp);
+
     if (ret == HEIM_ERR_EOF)
 	/* Better error code than "end of file" */
 	ret = HEIM_ERR_BAD_HDBENT_ENCODING;
+    free_hdb_entry(entry);
+    free_Key(&k);
     return ret;
 }
 
@@ -473,6 +671,14 @@ mdb_entry2value(krb5_context context, hdb_entry *entry, krb5_data *data)
 }
 #endif
 
+#if HAVE_DB1
+
+#if defined(HAVE_DB_185_H)
+#include <db_185.h>
+#elif defined(HAVE_DB_H)
+#include <db.h>
+#endif
+
 
 static krb5_error_code
 mdb_close(krb5_context context, HDB *db)
@@ -498,12 +704,24 @@ mdb_lock(krb5_context context, HDB *db, int operation)
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
+    krb5_error_code ret;
+
+    if (db->lock_count > 1) {
+	db->lock_count++;
+	if (db->lock_type == HDB_WLOCK || db->lock_count == operation)
+	    return 0;
+    }
+
     if(fd < 0) {
 	krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 			       "Can't lock database: %s", db->hdb_name);
 	return HDB_ERR_CANT_LOCK_DB;
     }
-    return hdb_lock(fd, operation);
+    ret = hdb_lock(fd, operation);
+    if (ret)
+	return ret;
+    db->lock_count++;
+    return 0;
 }
 
 static krb5_error_code
@@ -511,6 +729,14 @@ mdb_unlock(krb5_context context, HDB *db)
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
+
+    if (db->lock_count > 1) {
+        db->lock_count--;
+        return 0;
+    }
+    heim_assert(db->lock_count == 1, "HDB lock/unlock sequence does not match");
+    db->lock_count--;
+
     if(fd < 0) {
 	krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 			       "Can't unlock database: %s", db->hdb_name);
@@ -553,7 +779,7 @@ mdb_seq(krb5_context context, HDB *db,
     data.length = value.size;
     memset(entry, 0, sizeof(*entry));
 
-    if (mdb_value2entry(context, &data, 0, &entry->entry))
+    if (_hdb_mdb_value2entry(context, &data, 0, &entry->entry))
 	return mdb_seq(context, db, flags, entry, R_NEXT);
 
     if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
@@ -583,19 +809,25 @@ static krb5_error_code
 mdb_rename(krb5_context context, HDB *db, const char *new_name)
 {
     int ret;
-    char *old, *new;
+    char *old = NULL;
+    char *new = NULL;
 
-    asprintf(&old, "%s.db", db->hdb_name);
-    asprintf(&new, "%s.db", new_name);
+    if (asprintf(&old, "%s.db", db->hdb_name) < 0)
+	goto out;
+    if (asprintf(&new, "%s.db", new_name) < 0)
+	goto out;
     ret = rename(old, new);
-    free(old);
-    free(new);
     if(ret)
-	return errno;
+	goto out;
 
     free(db->hdb_name);
     db->hdb_name = strdup(new_name);
-    return 0;
+    errno = 0;
+
+out:
+    free(old);
+    free(new);
+    return errno;
 }
 
 static krb5_error_code
@@ -686,24 +918,26 @@ mdb_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal principal,
 	       unsigned flags, krb5_kvno kvno, hdb_entry_ex *entry)
 {
     krb5_data key, value;
-    krb5_error_code code;
+    krb5_error_code ret;
 
-    code = mdb_principal2key(context, principal, &key);
-    if (code)
-	return code;
-    code = db->hdb__get(context, db, key, &value);
+    ret = mdb_principal2key(context, principal, &key);
+    if (ret)
+	return ret;
+    ret = db->hdb__get(context, db, key, &value);
     krb5_data_free(&key);
-    if(code)
-	return code;
-    code = mdb_value2entry(context, &value, kvno, &entry->entry);
+    if(ret)
+	return ret;
+    ret = _hdb_mdb_value2entry(context, &value, kvno, &entry->entry);
     krb5_data_free(&value);
-    if (code)
-	return code;
+    if (ret)
+	return ret;
 
     if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
-	code = hdb_unseal_keys (context, db, &entry->entry);
-	if (code)
+	ret = hdb_unseal_keys (context, db, &entry->entry);
+	if (ret) {
 	    hdb_free_entry(context, entry);
+            return ret;
+        }
     }
 
     return 0;
@@ -712,15 +946,83 @@ mdb_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal principal,
 static krb5_error_code
 mdb_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 {
-    krb5_set_error_message(context, EINVAL, "can't set principal in mdb");
-    return EINVAL;
+    krb5_error_code ret;
+    krb5_storage *sp = NULL;
+    krb5_storage *spent = NULL;
+    krb5_data line = { 0, 0 };
+    krb5_data kdb_ent = { 0, 0 };
+    krb5_data key = { 0, 0 };
+    krb5_data value = { 0, 0 };
+    ssize_t sz;
+
+    if ((flags & HDB_F_PRECHECK) && (flags & HDB_F_REPLACE))
+        return 0;
+
+    if ((flags & HDB_F_PRECHECK)) {
+        ret = mdb_principal2key(context, entry->entry.principal, &key);
+        if (ret) return ret;
+        ret = db->hdb__get(context, db, key, &value);
+        krb5_data_free(&key);
+        if (ret == 0)
+            krb5_data_free(&value);
+        if (ret == HDB_ERR_NOENTRY)
+            return 0;
+        return ret ? ret : HDB_ERR_EXISTS;
+    }
+
+    sp = krb5_storage_emem();
+    if (!sp) return ENOMEM;
+    ret = _hdb_set_master_key_usage(context, db, 0); /* MIT KDB uses KU 0 */
+    ret = hdb_seal_keys(context, db, &entry->entry);
+    if (ret) return ret;
+    ret = entry2mit_string_int(context, sp, &entry->entry);
+    if (ret) goto out;
+    sz = krb5_storage_write(sp, "\n", 2); /* NUL-terminate */
+    ret = ENOMEM;
+    if (sz == -1) goto out;
+    ret = krb5_storage_to_data(sp, &line);
+    if (ret) goto out;
+
+    ret = ENOMEM;
+    spent = krb5_storage_emem();
+    if (!spent) goto out;
+    ret = _hdb_mit_dump2mitdb_entry(context, line.data, spent);
+    if (ret) goto out;
+    ret = krb5_storage_to_data(spent, &kdb_ent);
+    if (ret) goto out;
+    ret = mdb_principal2key(context, entry->entry.principal, &key);
+    if (ret) goto out;
+    ret = mdb__put(context, db, 1, key, kdb_ent);
+
+out:
+    if (sp)
+        krb5_storage_free(sp);
+    if (spent)
+        krb5_storage_free(spent);
+    krb5_data_free(&line);
+    krb5_data_free(&kdb_ent);
+    krb5_data_free(&key);
+
+    return ret;
 }
 
 static krb5_error_code
-mdb_remove(krb5_context context, HDB *db, krb5_const_principal principal)
+mdb_remove(krb5_context context, HDB *db,
+           unsigned flags, krb5_const_principal principal)
 {
     krb5_error_code code;
     krb5_data key;
+    krb5_data value = { 0, 0 };
+
+    if ((flags & HDB_F_PRECHECK)) {
+        code = db->hdb__get(context, db, key, &value);
+        krb5_data_free(&key);
+        if (code == 0) {
+            krb5_data_free(&value);
+            return 0;
+        }
+        return code;
+    }
 
     mdb_principal2key(context, principal, &key);
     code = db->hdb__del(context, db, key);
@@ -732,40 +1034,47 @@ static krb5_error_code
 mdb_open(krb5_context context, HDB *db, int flags, mode_t mode)
 {
     char *fn;
+    char *actual_fn;
     krb5_error_code ret;
+    struct stat st;
 
-    asprintf(&fn, "%s.db", db->hdb_name);
-    if (fn == NULL) {
+    if (asprintf(&fn, "%s.db", db->hdb_name) < 0) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
-    db->hdb_db = dbopen(fn, flags, mode, DB_BTREE, NULL);
-    free(fn);
 
+    if (stat(fn, &st) == 0)
+        actual_fn = fn;
+    else
+        actual_fn = db->hdb_name;
+    db->hdb_db = dbopen(actual_fn, flags, mode, DB_BTREE, NULL);
     if (db->hdb_db == NULL) {
 	switch (errno) {
 #ifdef EFTYPE
 	case EFTYPE:
 #endif
 	case EINVAL:
-	    db->hdb_db = dbopen(fn, flags, mode, DB_BTREE, NULL);
+	    db->hdb_db = dbopen(actual_fn, flags, mode, DB_HASH, NULL);
 	}
     }
+    free(fn);
 
-    /* try to open without .db extension */
-    if(db->hdb_db == NULL && errno == ENOENT)
-	db->hdb_db = dbopen(db->hdb_name, flags, mode, DB_BTREE, NULL);
-    if(db->hdb_db == NULL) {
+    if (db->hdb_db == NULL) {
 	ret = errno;
 	krb5_set_error_message(context, ret, "dbopen (%s): %s",
 			      db->hdb_name, strerror(ret));
 	return ret;
     }
-    if((flags & O_ACCMODE) == O_RDONLY)
-	ret = hdb_check_db_format(context, db);
-    else
+#if 0
+    /*
+     * Don't do this -- MIT won't be able to handle the
+     * HDB_DB_FORMAT_ENTRY key.
+     */
+    if ((flags & O_ACCMODE) != O_RDONLY)
 	ret = hdb_init_db(context, db);
-    if(ret == HDB_ERR_NOENTRY) {
+#endif
+    ret = hdb_check_db_format(context, db);
+    if (ret == HDB_ERR_NOENTRY) {
 	krb5_clear_error_message(context);
 	return 0;
     }
@@ -780,8 +1089,8 @@ mdb_open(krb5_context context, HDB *db, int flags, mode_t mode)
 }
 
 krb5_error_code
-hdb_mdb_create(krb5_context context, HDB **db,
-	       const char *filename)
+hdb_mitdb_create(krb5_context context, HDB **db,
+		 const char *filename)
 {
     *db = calloc(1, sizeof(**db));
     if (*db == NULL) {
@@ -818,3 +1127,347 @@ hdb_mdb_create(krb5_context context, HDB **db,
 }
 
 #endif /* HAVE_DB1 */
+
+/*
+can have any number of princ stanzas.
+format is as follows (only \n indicates newlines)
+princ\t%d\t (%d is KRB5_KDB_V1_BASE_LENGTH, always 38)
+%d\t (strlen of principal e.g. shadow/foo@ANDREW.CMU.EDU)
+%d\t (number of tl_data)
+%d\t (number of key data, e.g. how many keys for this user)
+%d\t (extra data length)
+%s\t (principal name)
+%d\t (attributes)
+%d\t (max lifetime, seconds)
+%d\t (max renewable life, seconds)
+%d\t (expiration, seconds since epoch or 2145830400 for never)
+%d\t (password expiration, seconds, 0 for never)
+%d\t (last successful auth, seconds since epoch)
+%d\t (last failed auth, per above)
+%d\t (failed auth count)
+foreach tl_data 0 to number of tl_data - 1 as above
+  %d\t%d\t (data type, data length)
+  foreach tl_data 0 to length-1
+    %02x (tl data contents[element n])
+  except if tl_data length is 0
+    %d (always -1)
+  \t
+foreach key 0 to number of keys - 1 as above
+  %d\t%d\t (key data version, kvno)
+  foreach version 0 to key data version - 1 (a key or a salt)
+    %d\t%d\t(data type for this key, data length for this key)
+    foreach key data length 0 to length-1
+      %02x (key data contents[element n])
+    except if key_data length is 0
+      %d (always -1)
+    \t
+foreach extra data length 0 to length - 1
+  %02x (extra data part)
+unless no extra data
+  %d (always -1)
+;\n
+
+*/
+
+#if 0
+/* Why ever did we loop? */
+static char *
+nexttoken(char **p)
+{
+    char *q;
+    do {
+	q = strsep(p, " \t");
+    } while(q && *q == '\0');
+    return q;
+}
+#endif
+
+static char *
+nexttoken(char **p, size_t len, const char *what)
+{
+    char *q;
+
+    if (*p == NULL)
+        return NULL;
+
+    q = *p;
+    *p += len;
+    /* Must be followed by a delimiter (right?) */
+    if (strsep(p, " \t") != q + len) {
+        warnx("No tokens left in dump entry while looking for %s", what);
+        return NULL;
+    }
+    if (*q == '\0')
+        warnx("Empty last token in dump entry while looking for %s", what);
+    return q;
+}
+
+static size_t
+getdata(char **p, unsigned char *buf, size_t len, const char *what)
+{
+    size_t i;
+    int v;
+    char *q = nexttoken(p, 0, what);
+    if (q == NULL) {
+        warnx("Failed to find hex-encoded binary data (%s) in dump", what);
+        return 0;
+    }
+    i = 0;
+    while (*q && i < len) {
+	if (sscanf(q, "%02x", &v) != 1)
+	    break;
+	buf[i++] = v;
+	q += 2;
+    }
+    return i;
+}
+
+static int
+getint(char **p, const char *what)
+{
+    int val;
+    char *q = nexttoken(p, 0, what);
+    if (!q) {
+        warnx("Failed to find a signed integer (%s) in dump", what);
+        return -1;
+    }
+    if (sscanf(q, "%d", &val) != 1)
+        return -1;
+    return val;
+}
+
+static unsigned int
+getuint(char **p, const char *what)
+{
+    int val;
+    char *q = nexttoken(p, 0, what);
+    if (!q) {
+        warnx("Failed to find an unsigned integer (%s) in dump", what);
+        return 0;
+    }
+    if (sscanf(q, "%u", &val) != 1)
+        return 0;
+    return val;
+}
+
+#define KRB5_KDB_SALTTYPE_NORMAL	0
+#define KRB5_KDB_SALTTYPE_V4		1
+#define KRB5_KDB_SALTTYPE_NOREALM	2
+#define KRB5_KDB_SALTTYPE_ONLYREALM	3
+#define KRB5_KDB_SALTTYPE_SPECIAL	4
+#define KRB5_KDB_SALTTYPE_AFS3		5
+
+#define CHECK_UINT(num)                            \
+        if ((num) < 0 || (num) > INT_MAX) return EINVAL
+#define CHECK_UINT16(num)                          \
+        if ((num) < 0 || (num) > 1<<15) return EINVAL
+#define CHECK_NUM(num, maxv)                     \
+        if ((num) > (maxv)) return EINVAL
+
+/*
+ * This utility function converts an MIT dump entry to an MIT on-disk
+ * encoded entry, which can then be decoded with _hdb_mdb_value2entry().
+ * This allows us to have a single decoding function (_hdb_mdb_value2entry),
+ * which makes the code cleaner (less code duplication), if a bit less
+ * efficient.  It also will allow us to have a function to dump an HDB
+ * entry in MIT format so we can dump HDB into MIT format for rollback
+ * purposes.  And that will allow us to write to MIT KDBs, again
+ * somewhat inefficiently, also for migration/rollback purposes.
+ */
+int
+_hdb_mit_dump2mitdb_entry(krb5_context context, char *line, krb5_storage *sp)
+{
+    krb5_error_code ret = EINVAL;
+    char *p = line, *q;
+    char *princ;
+    ssize_t sz;
+    size_t i;
+    size_t princ_len;
+    unsigned int num_tl_data;
+    size_t num_key_data;
+    unsigned int attributes;
+    int tmp;
+
+    krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_LE);
+
+    q = nexttoken(&p, 0, "record type (princ or policy)");
+    if (strcmp(q, "kdb5_util") == 0 || strcmp(q, "policy") == 0 ||
+        strcmp(q, "princ") != 0) {
+        warnx("Supposed MIT dump entry does not start with 'kdb5_util', "
+              "'policy', nor 'princ'");
+        return -1;
+    }
+    if (getint(&p, "constant '38'") != 38) {
+        warnx("Dump entry does not start with '38<TAB>'");
+        return EINVAL;
+    }
+#define KDB_V1_BASE_LENGTH 38
+    ret = krb5_store_int16(sp, KDB_V1_BASE_LENGTH);
+    if (ret) return ret;
+
+    princ_len = getuint(&p, "principal name length");
+    if (princ_len > (1<<15) - 1) {
+        warnx("Principal name in dump entry too long (%llu)",
+              (unsigned long long)princ_len);
+        return EINVAL;
+    }
+    num_tl_data = getuint(&p, "number of TL data");
+    num_key_data = getuint(&p, "number of key data");
+    getint(&p, "5th field, length of 'extra data'");
+    princ = nexttoken(&p, (int)princ_len, "principal name");
+    if (princ == NULL) {
+        warnx("Failed to read principal name (expected length %llu)",
+              (unsigned long long)princ_len);
+        return -1;
+    }
+
+    attributes = getuint(&p, "attributes");
+    ret = krb5_store_uint32(sp, attributes);
+    if (ret) return ret;
+
+    tmp = getint(&p, "max life");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p, "max renewable life");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p, "expiration");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p, "pw expiration");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p, "last auth");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p, "last failed auth");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    tmp = getint(&p,"fail auth count");
+    CHECK_UINT(tmp);
+    ret = krb5_store_uint32(sp, tmp);
+    if (ret) return ret;
+
+    /* add TL data count */
+    CHECK_NUM(num_tl_data, 1023);
+    ret = krb5_store_uint16(sp, num_tl_data);
+    if (ret) return ret;
+
+    /* add key count */
+    CHECK_NUM(num_key_data, 1023);
+    ret = krb5_store_uint16(sp, num_key_data);
+    if (ret) return ret;
+
+    /* add principal unparsed name length and unparsed name */
+    princ_len = strlen(princ);
+    princ_len++; /* must count and write the NUL in the on-disk encoding */
+    ret = krb5_store_uint16(sp, princ_len);
+    if (ret) return ret;
+    sz = krb5_storage_write(sp, princ, princ_len);
+    if (sz == -1) return ENOMEM;
+
+    /* scan and write TL data */
+    for (i = 0; i < num_tl_data; i++) {
+        char *reading_what;
+        int tl_type, tl_length;
+        unsigned char *buf;
+
+        tl_type = getint(&p, "TL data type");
+        tl_length = getint(&p, "data length");
+
+        if (asprintf(&reading_what, "TL data type %d (length %d)",
+                     tl_type, tl_length) < 0)
+            return ENOMEM;
+
+        /*
+         * XXX Leaking reading_what, but only on ENOMEM cases anyways,
+         * so we don't care.
+         */
+        CHECK_UINT16(tl_type);
+        ret = krb5_store_uint16(sp, tl_type);
+        if (ret) return ret;
+        CHECK_UINT16(tl_length);
+        ret = krb5_store_uint16(sp, tl_length);
+        if (ret) return ret;
+
+        if (tl_length) {
+            buf = malloc(tl_length);
+            if (!buf) return ENOMEM;
+            if (getdata(&p, buf, tl_length, reading_what) != tl_length)
+                return EINVAL;
+            sz = krb5_storage_write(sp, buf, tl_length);
+            free(buf);
+            if (sz == -1) return ENOMEM;
+        } else {
+            if (strcmp(nexttoken(&p, 0, "'-1' field"), "-1") != 0) return EINVAL;
+        }
+        free(reading_what);
+    }
+
+    for (i = 0; i < num_key_data; i++) {
+        unsigned char *buf;
+        int key_versions;
+        int kvno;
+        int keytype;
+        int keylen;
+        size_t k;
+
+        key_versions = getint(&p, "key data 'version'");
+        CHECK_UINT16(key_versions);
+        ret = krb5_store_int16(sp, key_versions);
+        if (ret) return ret;
+
+        kvno = getint(&p, "kvno");
+        CHECK_UINT16(kvno);
+        ret = krb5_store_int16(sp, kvno);
+        if (ret) return ret;
+
+        for (k = 0; k < key_versions; k++) {
+            keytype = getint(&p, "enctype");
+            CHECK_UINT16(keytype);
+            ret = krb5_store_int16(sp, keytype);
+            if (ret) return ret;
+
+            keylen = getint(&p, "encrypted key length");
+            CHECK_UINT16(keylen);
+            ret = krb5_store_int16(sp, keylen);
+            if (ret) return ret;
+
+            if (keylen) {
+                buf = malloc(keylen);
+                if (!buf) return ENOMEM;
+                if (getdata(&p, buf, keylen, "key (or salt) data") != keylen)
+                    return EINVAL;
+                sz = krb5_storage_write(sp, buf, keylen);
+                free(buf);
+                if (sz == -1) return ENOMEM;
+            } else {
+                if (strcmp(nexttoken(&p, 0,
+                                     "'-1' zero-length key/salt field"),
+                           "-1") != 0) {
+                    warnx("Expected '-1' field because key/salt length is 0");
+                    return -1;
+                }
+            }
+        }
+    }
+    /*
+     * The rest is "extra data", but there's never any and we wouldn't
+     * know what to do with it.
+     */
+    /* nexttoken(&p, 0, "extra data"); */
+    return 0;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-sqlite.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-sqlite.c
index 784dfe20f..ecb36220f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-sqlite.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb-sqlite.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb-sqlite.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hdb-sqlite.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -143,15 +143,115 @@ hdb_sqlite_prepare_stmt(krb5_context context,
     }
 
     if (ret != SQLITE_OK) {
-        krb5_set_error_message(context, EINVAL,
+        krb5_set_error_message(context, HDB_ERR_UK_RERROR,
 			       "Failed to prepare stmt %s: %s",
 			       str, sqlite3_errmsg(db));
-        return EINVAL;
+        return HDB_ERR_UK_RERROR;
     }
 
     return 0;
 }
 
+static krb5_error_code
+prep_stmts(krb5_context context, hdb_sqlite_db *hsdb)
+{
+    int ret;
+
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->get_version,
+                                  HDBSQLITE_GET_VERSION);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->fetch,
+                                  HDBSQLITE_FETCH);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->get_ids,
+                                  HDBSQLITE_GET_IDS);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->add_entry,
+                                  HDBSQLITE_ADD_ENTRY);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->add_principal,
+                                  HDBSQLITE_ADD_PRINCIPAL);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->add_alias,
+                                  HDBSQLITE_ADD_ALIAS);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->delete_aliases,
+                                  HDBSQLITE_DELETE_ALIASES);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->update_entry,
+                                  HDBSQLITE_UPDATE_ENTRY);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->remove,
+                                  HDBSQLITE_REMOVE);
+    if (ret)
+        return ret;
+    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
+                                  &hsdb->get_all_entries,
+                                  HDBSQLITE_GET_ALL_ENTRIES);
+    return ret;
+}
+
+static void
+finalize_stmts(krb5_context context, hdb_sqlite_db *hsdb)
+{
+    if (hsdb->get_version != NULL)
+        sqlite3_finalize(hsdb->get_version);
+    hsdb->get_version = NULL;
+
+    if (hsdb->fetch != NULL)
+        sqlite3_finalize(hsdb->fetch);
+    hsdb->fetch = NULL;
+
+    if (hsdb->get_ids != NULL)
+        sqlite3_finalize(hsdb->get_ids);
+    hsdb->get_ids = NULL;
+
+    if (hsdb->add_entry != NULL)
+        sqlite3_finalize(hsdb->add_entry);
+    hsdb->add_entry = NULL;
+
+    if (hsdb->add_principal != NULL)
+        sqlite3_finalize(hsdb->add_principal);
+    hsdb->add_principal = NULL;
+
+    if (hsdb->add_alias != NULL)
+        sqlite3_finalize(hsdb->add_alias);
+    hsdb->add_alias = NULL;
+
+    if (hsdb->delete_aliases != NULL)
+        sqlite3_finalize(hsdb->delete_aliases);
+    hsdb->delete_aliases = NULL;
+
+    if (hsdb->update_entry != NULL)
+        sqlite3_finalize(hsdb->update_entry);
+    hsdb->update_entry = NULL;
+
+    if (hsdb->remove != NULL)
+        sqlite3_finalize(hsdb->remove);
+    hsdb->remove = NULL;
+
+    if (hsdb->get_all_entries != NULL)
+        sqlite3_finalize(hsdb->get_all_entries);
+    hsdb->get_all_entries = NULL;
+}
+
 /**
  * A wrapper around sqlite3_exec.
  *
@@ -164,17 +264,23 @@ hdb_sqlite_prepare_stmt(krb5_context context,
  */
 static krb5_error_code
 hdb_sqlite_exec_stmt(krb5_context context,
-                     sqlite3 *database,
+                     hdb_sqlite_db *hsdb,
                      const char *statement,
                      krb5_error_code error_code)
 {
     int ret;
+    int reinit_stmts = 0;
+    sqlite3 *database = hsdb->db;
 
     ret = sqlite3_exec(database, statement, NULL, NULL, NULL);
 
     while(((ret == SQLITE_BUSY) ||
            (ret == SQLITE_IOERR_BLOCKED) ||
            (ret == SQLITE_LOCKED))) {
+        if (reinit_stmts == 0 && ret == SQLITE_BUSY) {
+            finalize_stmts(context, hsdb);
+            reinit_stmts = 1;
+        }
 	krb5_warnx(context, "hdb-sqlite: exec busy: %d", (int)getpid());
         sleep(1);
         ret = sqlite3_exec(database, statement, NULL, NULL, NULL);
@@ -187,6 +293,28 @@ hdb_sqlite_exec_stmt(krb5_context context,
         return error_code;
     }
 
+    if (reinit_stmts)
+        return prep_stmts(context, hsdb);
+
+    return 0;
+}
+
+/**
+ *
+ */
+
+static krb5_error_code
+bind_principal(krb5_context context, krb5_const_principal principal, sqlite3_stmt *stmt, int key)
+{
+    krb5_error_code ret;
+    char *str = NULL;
+
+    ret = krb5_unparse_name(context, principal, &str);
+    if (ret)
+        return ret;
+
+    sqlite3_bind_text(stmt, key, str, -1, SQLITE_TRANSIENT);
+    free(str);
     return 0;
 }
 
@@ -251,18 +379,15 @@ hdb_sqlite_close_database(krb5_context context, HDB *db)
 {
     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 
-    sqlite3_finalize(hsdb->get_version);
-    sqlite3_finalize(hsdb->fetch);
-    sqlite3_finalize(hsdb->get_ids);
-    sqlite3_finalize(hsdb->add_entry);
-    sqlite3_finalize(hsdb->add_principal);
-    sqlite3_finalize(hsdb->add_alias);
-    sqlite3_finalize(hsdb->delete_aliases);
-    sqlite3_finalize(hsdb->update_entry);
-    sqlite3_finalize(hsdb->remove);
-    sqlite3_finalize(hsdb->get_all_entries);
+    finalize_stmts(context, hsdb);
 
-    sqlite3_close(hsdb->db);
+    /* XXX Use sqlite3_close_v2() when we upgrade SQLite3 */
+    if (sqlite3_close(hsdb->db) != SQLITE_OK) {
+        krb5_set_error_message(context, HDB_ERR_UK_SERROR,
+			       "SQLite BEGIN TRANSACTION failed: %s",
+			       sqlite3_errmsg(hsdb->db));
+        return HDB_ERR_UK_SERROR;
+    }
 
     return 0;
 }
@@ -295,56 +420,18 @@ hdb_sqlite_make_database(krb5_context context, HDB *db, const char *filename)
 
         created_file = 1;
 
-        ret = hdb_sqlite_exec_stmt(context, hsdb->db,
+        ret = hdb_sqlite_exec_stmt(context, hsdb,
                                    HDBSQLITE_CREATE_TABLES,
-                                   EINVAL);
+                                   HDB_ERR_UK_SERROR);
         if (ret) goto out;
 
-        ret = hdb_sqlite_exec_stmt(context, hsdb->db,
+        ret = hdb_sqlite_exec_stmt(context, hsdb,
                                    HDBSQLITE_CREATE_TRIGGERS,
-                                   EINVAL);
+                                   HDB_ERR_UK_SERROR);
         if (ret) goto out;
     }
 
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->get_version,
-                                  HDBSQLITE_GET_VERSION);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->fetch,
-                                  HDBSQLITE_FETCH);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->get_ids,
-                                  HDBSQLITE_GET_IDS);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->add_entry,
-                                  HDBSQLITE_ADD_ENTRY);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->add_principal,
-                                  HDBSQLITE_ADD_PRINCIPAL);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->add_alias,
-                                  HDBSQLITE_ADD_ALIAS);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->delete_aliases,
-                                  HDBSQLITE_DELETE_ALIASES);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->update_entry,
-                                  HDBSQLITE_UPDATE_ENTRY);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->remove,
-                                  HDBSQLITE_REMOVE);
-    if (ret) goto out;
-    ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
-                                  &hsdb->get_all_entries,
-                                  HDBSQLITE_GET_ALL_ENTRIES);
+    ret = prep_stmts(context, hsdb);
     if (ret) goto out;
 
     ret = hdb_sqlite_step(context, hsdb->db, hsdb->get_version);
@@ -355,7 +442,7 @@ hdb_sqlite_make_database(krb5_context context, HDB *db, const char *filename)
     ret = 0;
 
     if(hsdb->version != HDBSQLITE_VERSION) {
-        ret = EINVAL;
+        ret = HDB_ERR_UK_SERROR;
         krb5_set_error_message(context, ret, "HDBSQLITE_VERSION mismatch");
     }
 
@@ -368,6 +455,8 @@ hdb_sqlite_make_database(krb5_context context, HDB *db, const char *filename)
         sqlite3_close(hsdb->db);
     if (created_file)
         unlink(hsdb->db_file);
+    free(hsdb->db_file);
+    hsdb->db_file = NULL;
 
     return ret;
 }
@@ -391,18 +480,30 @@ hdb_sqlite_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal princi
 {
     int sqlite_error;
     krb5_error_code ret;
-    char *principal_string;
     hdb_sqlite_db *hsdb = (hdb_sqlite_db*)(db->hdb_db);
     sqlite3_stmt *fetch = hsdb->fetch;
     krb5_data value;
+    krb5_principal enterprise_principal = NULL;
 
-    ret = krb5_unparse_name(context, principal, &principal_string);
-    if (ret) {
-        free(principal_string);
-        return ret;
+    if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
+	if (principal->name.name_string.len != 1) {
+	    ret = KRB5_PARSE_MALFORMED;
+	    krb5_set_error_message(context, ret, "malformed principal: "
+				   "enterprise name with %d name components",
+				   principal->name.name_string.len);
+	    return ret;
+	}
+	ret = krb5_parse_name(context, principal->name.name_string.val[0],
+			      &enterprise_principal);
+	if (ret)
+	    return ret;
+	principal = enterprise_principal;
     }
 
-    sqlite3_bind_text(fetch, 1, principal_string, -1, SQLITE_STATIC);
+    ret = bind_principal(context, principal, fetch, 1);
+    krb5_free_principal(context, enterprise_principal);
+    if (ret)
+	return ret;
 
     sqlite_error = hdb_sqlite_step(context, hsdb->db, fetch);
     if (sqlite_error != SQLITE_ROW) {
@@ -410,7 +511,7 @@ hdb_sqlite_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal princi
             ret = HDB_ERR_NOENTRY;
             goto out;
         } else {
-            ret = EINVAL;
+            ret = HDB_ERR_UK_RERROR;
             krb5_set_error_message(context, ret,
                                   "sqlite fetch failed: %d",
                                   sqlite_error);
@@ -440,7 +541,6 @@ out:
     sqlite3_clear_bindings(fetch);
     sqlite3_reset(fetch);
 
-    free(principal_string);
 
     return ret;
 }
@@ -486,30 +586,25 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
     int ret;
     int i;
     sqlite_int64 entry_id;
-    char *principal_string = NULL;
-    char *alias_string;
     const HDB_Ext_Aliases *aliases;
 
     hdb_sqlite_db *hsdb = (hdb_sqlite_db *)(db->hdb_db);
     krb5_data value;
     sqlite3_stmt *get_ids = hsdb->get_ids;
 
-    ret = hdb_sqlite_exec_stmt(context, hsdb->db,
-                               "BEGIN IMMEDIATE TRANSACTION", EINVAL);
+    krb5_data_zero(&value);
+
+    ret = hdb_sqlite_exec_stmt(context, hsdb,
+                               "BEGIN IMMEDIATE TRANSACTION",
+                               HDB_ERR_UK_SERROR);
     if(ret != SQLITE_OK) {
-	ret = EINVAL;
+	ret = HDB_ERR_UK_SERROR;
         krb5_set_error_message(context, ret,
 			       "SQLite BEGIN TRANSACTION failed: %s",
 			       sqlite3_errmsg(hsdb->db));
         goto rollback;
     }
 
-    ret = krb5_unparse_name(context,
-                            entry->entry.principal, &principal_string);
-    if (ret) {
-        goto rollback;
-    }
-
     ret = hdb_seal_keys(context, db, &entry->entry);
     if(ret) {
         goto rollback;
@@ -520,7 +615,10 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
         goto rollback;
     }
 
-    sqlite3_bind_text(get_ids, 1, principal_string, -1, SQLITE_STATIC);
+    ret = bind_principal(context, entry->entry.principal, get_ids, 1);
+    if (ret)
+	goto rollback;
+
     ret = hdb_sqlite_step(context, hsdb->db, get_ids);
 
     if(ret == SQLITE_DONE) { /* No such principal */
@@ -530,16 +628,38 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
         ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_entry);
         sqlite3_clear_bindings(hsdb->add_entry);
         sqlite3_reset(hsdb->add_entry);
-        if(ret != SQLITE_DONE)
+        if (ret != SQLITE_DONE && ret != SQLITE_CONSTRAINT) {
+            ret = HDB_ERR_UK_SERROR;
             goto rollback;
+        }
+        if (ret == SQLITE_CONSTRAINT) {
+            ret = HDB_ERR_EXISTS;
+            goto rollback;
+        }
+
+	ret = bind_principal(context, entry->entry.principal, hsdb->add_principal, 1);
+	if (ret)
+	    goto rollback;
 
-        sqlite3_bind_text(hsdb->add_principal, 1,
-                          principal_string, -1, SQLITE_STATIC);
         ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_principal);
         sqlite3_clear_bindings(hsdb->add_principal);
         sqlite3_reset(hsdb->add_principal);
-        if(ret != SQLITE_DONE)
+        if (ret != SQLITE_DONE && ret != SQLITE_CONSTRAINT) {
+            ret = HDB_ERR_UK_SERROR;
             goto rollback;
+        }
+        if (ret == SQLITE_CONSTRAINT) {
+            ret = HDB_ERR_EXISTS;
+            goto rollback;
+        }
+
+        /* Now let's learn what Entry ID we got for the new principal */
+        sqlite3_reset(get_ids);
+        ret = hdb_sqlite_step(context, hsdb->db, get_ids);
+        if (ret != SQLITE_ROW) {
+            ret = HDB_ERR_UK_SERROR;
+            goto rollback;
+        }
 
         entry_id = sqlite3_column_int64(get_ids, 1);
 
@@ -552,18 +672,23 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
 
         sqlite3_bind_int64(hsdb->delete_aliases, 1, entry_id);
         ret = hdb_sqlite_step_once(context, db, hsdb->delete_aliases);
-        if(ret != SQLITE_DONE)
+        if (ret != SQLITE_DONE) {
+            ret = HDB_ERR_UK_SERROR;
             goto rollback;
+        }
 
         sqlite3_bind_blob(hsdb->update_entry, 1,
                           value.data, value.length, SQLITE_STATIC);
         sqlite3_bind_int64(hsdb->update_entry, 2, entry_id);
         ret = hdb_sqlite_step_once(context, db, hsdb->update_entry);
-        if(ret != SQLITE_DONE)
+        if (ret != SQLITE_DONE) {
+            ret = HDB_ERR_UK_SERROR;
             goto rollback;
+        }
 
     } else {
 	/* Error! */
+        ret = HDB_ERR_UK_SERROR;
         goto rollback;
     }
 
@@ -573,51 +698,47 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
 
     for(i = 0; i < aliases->aliases.len; i++) {
 
-        ret = krb5_unparse_name(context, &aliases->aliases.val[i],
-				&alias_string);
-        if (ret) {
-            free(alias_string);
+	ret = bind_principal(context, &aliases->aliases.val[i], hsdb->add_alias, 1);
+        if (ret)
             goto rollback;
-        }
 
-        sqlite3_bind_text(hsdb->add_alias, 1, alias_string,
-                          -1, SQLITE_STATIC);
         sqlite3_bind_int64(hsdb->add_alias, 2, entry_id);
         ret = hdb_sqlite_step_once(context, db, hsdb->add_alias);
-
-        free(alias_string);
-
-        if(ret != SQLITE_DONE)
+        if (ret == SQLITE_CONSTRAINT) {
+            ret = HDB_ERR_EXISTS;
             goto rollback;
+        }
+        if (ret != SQLITE_DONE) {
+            ret = HDB_ERR_UK_SERROR;
+            goto rollback;
+        }
     }
 
-    ret = 0;
-
 commit:
-
-    free(principal_string);
-
     krb5_data_free(&value);
-
     sqlite3_clear_bindings(get_ids);
     sqlite3_reset(get_ids);
 
-    ret = hdb_sqlite_exec_stmt(context, hsdb->db, "COMMIT", EINVAL);
-    if(ret != SQLITE_OK)
-	krb5_warnx(context, "hdb-sqlite: COMMIT problem: %d: %s",
-		   ret, sqlite3_errmsg(hsdb->db));
+    if ((flags & HDB_F_PRECHECK)) {
+        (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
+        return 0;
+    }
 
-    return ret;
+    ret = hdb_sqlite_exec_stmt(context, hsdb, "COMMIT", HDB_ERR_UK_SERROR);
+    if(ret != SQLITE_OK)
+	krb5_warnx(context, "hdb-sqlite: COMMIT problem: %ld: %s",
+		   (long)HDB_ERR_UK_SERROR, sqlite3_errmsg(hsdb->db));
+
+    return ret == SQLITE_OK ? 0 : HDB_ERR_UK_SERROR;
 
 rollback:
-
+    krb5_data_free(&value);
+    sqlite3_clear_bindings(get_ids);
+    sqlite3_reset(get_ids);
     krb5_warnx(context, "hdb-sqlite: store rollback problem: %d: %s",
 	       ret, sqlite3_errmsg(hsdb->db));
 
-    free(principal_string);
-
-    ret = hdb_sqlite_exec_stmt(context, hsdb->db,
-                               "ROLLBACK", EINVAL);
+    (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
     return ret;
 }
 
@@ -668,12 +789,12 @@ hdb_sqlite_open(krb5_context context, HDB *db, int flags, mode_t mode)
 static krb5_error_code
 hdb_sqlite_destroy(krb5_context context, HDB *db)
 {
-    int ret;
+    int ret, ret2;
     hdb_sqlite_db *hsdb;
 
     ret = hdb_clear_master_key(context, db);
 
-    hdb_sqlite_close_database(context, db);
+    ret2 = hdb_sqlite_close_database(context, db);
 
     hsdb = (hdb_sqlite_db*)(db->hdb_db);
 
@@ -681,7 +802,7 @@ hdb_sqlite_destroy(krb5_context context, HDB *db)
     free(db->hdb_db);
     free(db);
 
-    return ret;
+    return ret ? ret : ret2;
 }
 
 /*
@@ -733,8 +854,11 @@ hdb_sqlite_nextkey(krb5_context context, HDB *db, unsigned flags,
         sqlite3_reset(hsdb->get_all_entries);
     }
     else {
-	/* XXX SQLite error. Should be handled in some way. */
-        ret = EINVAL;
+        ret = HDB_ERR_UK_RERROR;
+        krb5_set_error_message(context, HDB_ERR_UK_RERROR,
+                               "SELECT failed after returning one or "
+                               "more rows: %s", sqlite3_errmsg(hsdb->db));
+
     }
 
     return ret;
@@ -766,22 +890,22 @@ hdb_sqlite_firstkey(krb5_context context, HDB *db, unsigned flags,
 static krb5_error_code
 hdb_sqlite_rename(krb5_context context, HDB *db, const char *new_name)
 {
+    krb5_error_code ret, ret2;
     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
-    int ret;
 
     krb5_warnx(context, "hdb_sqlite_rename");
 
     if (strncasecmp(new_name, "sqlite:", 7) == 0)
 	new_name += 7;
 
-    hdb_sqlite_close_database(context, db);
+    ret = hdb_sqlite_close_database(context, db);
+
+    if (rename(hsdb->db_file, new_name) == -1)
+        return errno;
 
-    ret = rename(hsdb->db_file, new_name);
     free(hsdb->db_file);
-
-    hdb_sqlite_make_database(context, db, new_name);
-
-    return ret;
+    ret2 = hdb_sqlite_make_database(context, db, new_name);
+    return ret ? ret : ret2;
 }
 
 /*
@@ -789,34 +913,62 @@ hdb_sqlite_rename(krb5_context context, HDB *db, const char *new_name)
  */
 static krb5_error_code
 hdb_sqlite_remove(krb5_context context, HDB *db,
-                  krb5_const_principal principal)
+                  unsigned flags, krb5_const_principal principal)
 {
     krb5_error_code ret;
-    char *principal_string;
     hdb_sqlite_db *hsdb = (hdb_sqlite_db*)(db->hdb_db);
-    sqlite3_stmt *remove = hsdb->remove;
+    sqlite3_stmt *get_ids = hsdb->get_ids;
+    sqlite3_stmt *rm = hsdb->remove;
 
-    ret = krb5_unparse_name(context, principal, &principal_string);
-    if (ret) {
-        free(principal_string);
+    bind_principal(context, principal, rm, 1);
+
+    ret = hdb_sqlite_exec_stmt(context, hsdb,
+                               "BEGIN IMMEDIATE TRANSACTION",
+                               HDB_ERR_UK_SERROR);
+    if (ret != SQLITE_OK) {
+	ret = HDB_ERR_UK_SERROR;
+        (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
+        krb5_set_error_message(context, ret,
+			       "SQLite BEGIN TRANSACTION failed: %s",
+			       sqlite3_errmsg(hsdb->db));
         return ret;
     }
 
-    sqlite3_bind_text(remove, 1, principal_string, -1, SQLITE_STATIC);
+    if ((flags & HDB_F_PRECHECK)) {
+        ret = bind_principal(context, principal, get_ids, 1);
+        if (ret)
+            return ret;
 
-    ret = hdb_sqlite_step(context, hsdb->db, remove);
+        ret = hdb_sqlite_step(context, hsdb->db, get_ids);
+        sqlite3_clear_bindings(get_ids);
+        sqlite3_reset(get_ids);
+        if (ret == SQLITE_DONE) {
+            (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
+            return HDB_ERR_NOENTRY;
+        }
+    }
+
+    ret = hdb_sqlite_step(context, hsdb->db, rm);
+    sqlite3_clear_bindings(rm);
+    sqlite3_reset(rm);
     if (ret != SQLITE_DONE) {
-	ret = EINVAL;
-        krb5_set_error_message(context, ret,
-                              "sqlite remove failed: %d",
-                              ret);
-    } else
-        ret = 0;
+        (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
+	ret = HDB_ERR_UK_SERROR;
+        krb5_set_error_message(context, ret, "sqlite remove failed: %d", ret);
+        return ret;
+    }
 
-    sqlite3_clear_bindings(remove);
-    sqlite3_reset(remove);
+    if ((flags & HDB_F_PRECHECK)) {
+        (void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
+        return 0;
+    }
 
-    return ret;
+    ret = hdb_sqlite_exec_stmt(context, hsdb, "COMMIT", HDB_ERR_UK_SERROR);
+    if (ret != SQLITE_OK)
+	krb5_warnx(context, "hdb-sqlite: COMMIT problem: %ld: %s",
+		   (long)HDB_ERR_UK_SERROR, sqlite3_errmsg(hsdb->db));
+
+    return 0;
 }
 
 /**
@@ -824,13 +976,13 @@ hdb_sqlite_remove(krb5_context context, HDB *db,
  *
  * @param context A Kerberos 5 context.
  * @param db a returned database handle.
- * @param argument filename
+ * @param filename filename
  *
  * @return        0 on success, an error code if not
  */
 
 krb5_error_code
-hdb_sqlite_create(krb5_context context, HDB **db, const char *argument)
+hdb_sqlite_create(krb5_context context, HDB **db, const char *filename)
 {
     krb5_error_code ret;
     hdb_sqlite_db *hsdb;
@@ -839,8 +991,16 @@ hdb_sqlite_create(krb5_context context, HDB **db, const char *argument)
     if (*db == NULL)
 	return krb5_enomem(context);
 
+    (*db)->hdb_name = strdup(filename);
+    if ((*db)->hdb_name == NULL) {
+        free(*db);
+        *db = NULL;
+        return krb5_enomem(context);
+    }
+
     hsdb = (hdb_sqlite_db*) calloc(1, sizeof (*hsdb));
     if (hsdb == NULL) {
+        free((*db)->hdb_name);
         free(*db);
         *db = NULL;
 	return krb5_enomem(context);
@@ -849,7 +1009,7 @@ hdb_sqlite_create(krb5_context context, HDB **db, const char *argument)
     (*db)->hdb_db = hsdb;
 
     /* XXX make_database should make sure everything else is freed on error */
-    ret = hdb_sqlite_make_database(context, *db, argument);
+    ret = hdb_sqlite_make_database(context, *db, filename);
     if (ret) {
         free((*db)->hdb_db);
         free(*db);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.asn1 b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.asn1
index 3b00083d0..1ff2fb6bd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.asn1
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.asn1
@@ -46,8 +46,10 @@ HDBFlags ::= BIT STRING {
 	trusted-for-delegation(14),	-- Trusted to print forwardabled tickets
 	allow-kerberos4(15),		-- Allow Kerberos 4 requests
 	allow-digest(16),		-- Allow digest requests
-	locked-out(17)			-- Account is locked out,
+	locked-out(17),			-- Account is locked out,
 					-- authentication will be denied
+	require-pwchange(18),		-- require a passwd change
+	do-not-store(31)		-- Not to be modified and stored in HDB
 }
 
 GENERATION ::= SEQUENCE {
@@ -87,6 +89,17 @@ HDB-Ext-Aliases ::= SEQUENCE {
 	aliases[1]		SEQUENCE OF Principal -- all names, inc primary
 }
 
+Keys ::= SEQUENCE OF Key
+
+hdb_keyset ::= SEQUENCE {
+	kvno[0]		INTEGER (0..4294967295),
+	keys[1]		Keys,
+	set-time[2]	KerberosTime OPTIONAL,	-- time this keyset was created/set
+	...
+}
+
+HDB-Ext-KeySet ::= SEQUENCE OF hdb_keyset
+
 
 HDB-extension ::= SEQUENCE {
         mandatory[0]    BOOLEAN,        -- kdc MUST understand this extension,
@@ -102,6 +115,11 @@ HDB-extension ::= SEQUENCE {
 		aliases[6]			HDB-Ext-Aliases,
 		last-pw-change[7]		KerberosTime,
 	        pkinit-cert[8]  		HDB-Ext-PKINIT-cert,
+	        hist-keys[9]			HDB-Ext-KeySet,
+		hist-kvno-diff-clnt[10]		INTEGER (0..4294967295),
+		hist-kvno-diff-svc[11]		INTEGER (0..4294967295),
+	        policy[12]			UTF8String,
+		principal-id[13]		INTEGER(-9223372036854775808..9223372036854775807),
 		...
 	},
 	...
@@ -109,16 +127,11 @@ HDB-extension ::= SEQUENCE {
 
 HDB-extensions ::= SEQUENCE OF HDB-extension
 
-hdb_keyset ::= SEQUENCE {
-	kvno[1]		INTEGER (0..4294967295),
-	keys[0]		SEQUENCE OF Key
-}
-
 hdb_entry ::= SEQUENCE {
 	principal[0]	Principal  OPTIONAL, -- this is optional only 
 					     -- for compatibility with libkrb5
 	kvno[1]		INTEGER (0..4294967295),
-	keys[2]		SEQUENCE OF Key,
+	keys[2]		Keys,
 	created-by[3]	Event,
 	modified-by[4]	Event OPTIONAL,
 	valid-start[5]	KerberosTime OPTIONAL,
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.c b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.c
index 1df2d6a1f..7aa9811de 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: hdb.c,v 1.4 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -66,47 +66,97 @@
 const int hdb_interface_version = HDB_INTERFACE_VERSION;
 
 static struct hdb_method methods[] = {
-#if HAVE_DB1 || HAVE_DB3
-    { HDB_INTERFACE_VERSION, "db:",	hdb_db_create},
+    /* "db:" should be db3 if we have db3, or db1 if we have db1 */
+#if HAVE_DB3
+    { HDB_INTERFACE_VERSION, NULL, NULL, "db:",	hdb_db3_create},
+#elif HAVE_DB1
+    { HDB_INTERFACE_VERSION, NULL, NULL, "db:",	hdb_db1_create},
 #endif
 #if HAVE_DB1
-    { HDB_INTERFACE_VERSION, "mit-db:",	hdb_mdb_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "db1:",	hdb_db1_create},
+#endif
+#if HAVE_DB3
+    { HDB_INTERFACE_VERSION, NULL, NULL, "db3:",	hdb_db3_create},
+#endif
+#if HAVE_DB1
+    { HDB_INTERFACE_VERSION, NULL, NULL, "mit-db:",	hdb_mitdb_create},
+#endif
+#if HAVE_LMDB
+    { HDB_INTERFACE_VERSION, NULL, NULL, "mdb:",	hdb_mdb_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "lmdb:",	hdb_mdb_create},
 #endif
 #if HAVE_NDBM
-    { HDB_INTERFACE_VERSION, "ndbm:",	hdb_ndbm_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "ndbm:",	hdb_ndbm_create},
 #endif
-    { HDB_INTERFACE_VERSION, "keytab:",	hdb_keytab_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "keytab:",	hdb_keytab_create},
 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
-    { HDB_INTERFACE_VERSION, "ldap:",	hdb_ldap_create},
-    { HDB_INTERFACE_VERSION, "ldapi:",	hdb_ldapi_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "ldap:",	hdb_ldap_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "ldapi:",	hdb_ldapi_create},
+#elif defined(OPENLDAP)
+    { HDB_INTERFACE_VERSION, NULL, NULL, "ldap:",	NULL},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "ldapi:",	NULL},
 #endif
 #ifdef HAVE_SQLITE3
-    { HDB_INTERFACE_VERSION, "sqlite:", hdb_sqlite_create},
+    { HDB_INTERFACE_VERSION, NULL, NULL, "sqlite:", hdb_sqlite_create},
 #endif
-    {0, NULL,	NULL}
+    { 0, NULL, NULL, NULL, NULL}
 };
 
-#if HAVE_DB1 || HAVE_DB3
-static struct hdb_method dbmetod =
-    { HDB_INTERFACE_VERSION, "", hdb_db_create };
+/*
+ * It'd be nice if we could try opening an HDB with each supported
+ * backend until one works or all fail.  It may not be possible for all
+ * flavors, but where it's possible we should.
+ */
+#if defined(HAVE_LMDB)
+static struct hdb_method default_dbmethod =
+    { HDB_INTERFACE_VERSION, NULL, NULL, "", hdb_mdb_create };
+#elif defined(HAVE_DB3)
+static struct hdb_method default_dbmethod =
+    { HDB_INTERFACE_VERSION, NULL, NULL, "", hdb_db3_create };
+#elif defined(HAVE_DB1)
+static struct hdb_method default_dbmethod =
+    { HDB_INTERFACE_VERSION, NULL, NULL, "", hdb_db1_create };
 #elif defined(HAVE_NDBM)
-static struct hdb_method dbmetod =
-    { HDB_INTERFACE_VERSION, "", hdb_ndbm_create };
+static struct hdb_method default_dbmethod =
+    { HDB_INTERFACE_VERSION, NULL, NULL, "", hdb_ndbm_create };
 #endif
 
+const Keys *
+hdb_kvno2keys(krb5_context context,
+	      const hdb_entry *e,
+	      krb5_kvno kvno)
+{
+    HDB_Ext_KeySet *hist_keys;
+    HDB_extension *extp;
+    size_t i;
+
+    if (kvno == 0)
+	return &e->keys;
+
+    extp = hdb_find_extension(e, choice_HDB_extension_data_hist_keys);
+    if (extp == NULL)
+	return 0;
+
+    hist_keys = &extp->data.u.hist_keys;
+    for (i = 0; i < hist_keys->len; i++) {
+	if (hist_keys->val[i].kvno == kvno)
+	    return &hist_keys->val[i].keys;
+    }
+
+    return NULL;
+}
 
 krb5_error_code
 hdb_next_enctype2key(krb5_context context,
 		     const hdb_entry *e,
+		     const Keys *keyset,
 		     krb5_enctype enctype,
 		     Key **key)
 {
+    const Keys *keys = keyset ? keyset : &e->keys;
     Key *k;
 
-    for (k = *key ? (*key) + 1 : e->keys.val;
-	 k < e->keys.val + e->keys.len;
-	 k++)
-    {
+    for (k = *key ? (*key) + 1 : keys->val; k < keys->val + keys->len; k++) {
 	if(k->key.keytype == enctype){
 	    *key = k;
 	    return 0;
@@ -121,11 +171,12 @@ hdb_next_enctype2key(krb5_context context,
 krb5_error_code
 hdb_enctype2key(krb5_context context,
 		hdb_entry *e,
+		const Keys *keyset,
 		krb5_enctype enctype,
 		Key **key)
 {
     *key = NULL;
-    return hdb_next_enctype2key(context, e, enctype, key);
+    return hdb_next_enctype2key(context, e, keyset, enctype, key);
 }
 
 void
@@ -170,13 +221,14 @@ hdb_unlock(int fd)
 void
 hdb_free_entry(krb5_context context, hdb_entry_ex *ent)
 {
+    Key *k;
     size_t i;
 
     if (ent->free_entry)
 	(*ent->free_entry)(context, ent);
 
-    for(i = 0; i < ent->entry.keys.len; ++i) {
-	Key *k = &ent->entry.keys.val[i];
+    for(i = 0; i < ent->entry.keys.len; i++) {
+	k = &ent->entry.keys.val[i];
 
 	memset (k->key.keyvalue.data, 0, k->key.keyvalue.length);
     }
@@ -267,100 +319,6 @@ hdb_init_db(krb5_context context, HDB *db)
     return ret2;
 }
 
-#ifdef HAVE_DLOPEN
-
- /*
- * Load a dynamic backend from /usr/heimdal/lib/hdb_NAME.so,
- * looking for the hdb_NAME_create symbol.
- */
-
-static const struct hdb_method *
-find_dynamic_method (krb5_context context,
-		     const char *filename,
-		     const char **rest)
-{
-    static struct hdb_method method;
-    struct hdb_so_method *mso;
-    char *prefix, *path, *symbol;
-    const char *p;
-    void *dl;
-    size_t len;
-
-    p = strchr(filename, ':');
-
-    /* if no prefix, don't know what module to load, just ignore it */
-    if (p == NULL)
-	return NULL;
-
-    len = p - filename;
-    *rest = filename + len + 1;
-
-    prefix = malloc(len + 1);
-    if (prefix == NULL)
-	krb5_errx(context, 1, "out of memory");
-    strlcpy(prefix, filename, len + 1);
-
-    if (asprintf(&path, LIBDIR "/hdb_%s.so", prefix) == -1)
-	krb5_errx(context, 1, "out of memory");
-
-#ifndef RTLD_NOW
-#define RTLD_NOW 0
-#endif
-#ifndef RTLD_GLOBAL
-#define RTLD_GLOBAL 0
-#endif
-
-    dl = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
-    if (dl == NULL) {
-	krb5_warnx(context, "error trying to load dynamic module %s: %s\n",
-		   path, dlerror());
-	free(prefix);
-	free(path);
-	return NULL;
-    }
-
-    if (asprintf(&symbol, "hdb_%s_interface", prefix) == -1)
-	krb5_errx(context, 1, "out of memory");
-
-    mso = (struct hdb_so_method *) dlsym(dl, symbol);
-    if (mso == NULL) {
-	krb5_warnx(context, "error finding symbol %s in %s: %s\n",
-		   symbol, path, dlerror());
-	dlclose(dl);
-	free(symbol);
-	free(prefix);
-	free(path);
-	return NULL;
-    }
-    free(path);
-    free(symbol);
-
-    if (mso->version != HDB_INTERFACE_VERSION) {
-	krb5_warnx(context,
-		   "error wrong version in shared module %s "
-		   "version: %d should have been %d\n",
-		   prefix, mso->version, HDB_INTERFACE_VERSION);
-	dlclose(dl);
-	free(prefix);
-	return NULL;
-    }
-
-    if (mso->create == NULL) {
-	krb5_errx(context, 1,
-		  "no entry point function in shared mod %s ",
-		   prefix);
-	dlclose(dl);
-	free(prefix);
-	return NULL;
-    }
-
-    method.create = mso->create;
-    method.prefix = prefix;
-
-    return &method;
-}
-#endif /* HAVE_DLOPEN */
-
 /*
  * find the relevant method for `filename', returning a pointer to the
  * rest in `rest'.
@@ -378,19 +336,62 @@ find_method (const char *filename, const char **rest)
 	    return h;
 	}
     }
-#if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
-    if (strncmp(filename, "/", 1) == 0
-	|| strncmp(filename, "./", 2) == 0
-	|| strncmp(filename, "../", 3) == 0)
+#if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_LMDB) || defined(HAVE_NDBM)
+    if (strncmp(filename, "/", sizeof("/") - 1) == 0
+	|| strncmp(filename, "./", sizeof("./") - 1) == 0
+	|| strncmp(filename, "../", sizeof("../") - 1) == 0
+#ifdef WIN32
+        || strncmp(filename, "\\\\", sizeof("\\\\") - 1)
+        || (isalpha(filename[0]) && filename[1] == ':')
+#endif
+        )
     {
 	*rest = filename;
-	return &dbmetod;
+	return &default_dbmethod;
     }
 #endif
 
     return NULL;
 }
 
+struct cb_s {
+    const char *residual;
+    const char *filename;
+    const struct hdb_method *h;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+callback(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    const struct hdb_method *h = (const struct hdb_method *)plug;
+    struct cb_s *cb_ctx = (struct cb_s *)userctx;
+
+    if (strncmp(cb_ctx->filename, h->prefix, strlen(h->prefix)) == 0) {
+	cb_ctx->residual = cb_ctx->filename + strlen(h->prefix) + 1;
+	cb_ctx->h = h;
+	return 0;
+    }
+   return KRB5_PLUGIN_NO_HANDLE;
+}
+
+static char *
+make_sym(const char *prefix)
+{
+    char *s, *sym;
+
+    errno = 0;
+    if (prefix == NULL || prefix[0] == '\0')
+        return NULL;
+    if ((s = strdup(prefix)) == NULL)
+        return NULL;
+    if (strchr(s, ':') != NULL)
+        *strchr(s, ':') = '\0';
+    if (asprintf(&sym, "hdb_%s_interface", s) == -1)
+        sym = NULL;
+    free(s);
+    return sym;
+}
+
 krb5_error_code
 hdb_list_builtin(krb5_context context, char **list)
 {
@@ -407,12 +408,35 @@ hdb_list_builtin(krb5_context context, char **list)
     len += 1;
     buf = malloc(len);
     if (buf == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     buf[0] = '\0';
 
     for (h = methods; h->prefix != NULL; ++h) {
+        if (h->create == NULL) {
+            struct cb_s cb_ctx;
+            char *f;
+            char *sym;
+
+            /* Try loading the plugin */
+            if (asprintf(&f, "%sfoo", h->prefix) == -1)
+                f = NULL;
+            if ((sym = make_sym(h->prefix)) == NULL) {
+                free(buf);
+                free(f);
+                return krb5_enomem(context);
+            }
+            cb_ctx.filename = f;
+            cb_ctx.residual = NULL;
+            cb_ctx.h = NULL;
+            (void)_krb5_plugin_run_f(context, "krb5", sym,
+                                     HDB_INTERFACE_VERSION, 0, &cb_ctx,
+                                     callback);
+            free(f);
+            free(sym);
+            if (cb_ctx.h == NULL || cb_ctx.h->create == NULL)
+                continue;
+        }
 	if (h != methods)
 	    strlcat(buf, ", ", len);
 	strlcat(buf, h->prefix, len);
@@ -453,39 +477,25 @@ _hdb_keytab2hdb_entry(krb5_context context,
 krb5_error_code
 hdb_create(krb5_context context, HDB **db, const char *filename)
 {
-    const struct hdb_method *h;
-    const char *residual;
-    krb5_error_code ret;
-    struct krb5_plugin *list = NULL, *e;
+    struct cb_s cb_ctx;
 
-    if(filename == NULL)
+    if (filename == NULL)
 	filename = HDB_DEFAULT_DB;
-    krb5_add_et_list(context, initialize_hdb_error_table_r);
-    h = find_method (filename, &residual);
+    cb_ctx.h = find_method (filename, &cb_ctx.residual);
+    cb_ctx.filename = filename;
 
-    if (h == NULL) {
-	    ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "hdb", &list);
-	    if(ret == 0 && list != NULL) {
-		    for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
-			    h = _krb5_plugin_get_symbol(e);
-			    if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0
-				&& h->interface_version == HDB_INTERFACE_VERSION) {
-				    residual = filename + strlen(h->prefix);
-				    break;
-			    }
-		    }
-		    if (e == NULL) {
-			    h = NULL;
-			    _krb5_plugin_free(list);
-		    }
-	    }
+    if (cb_ctx.h == NULL || cb_ctx.h->create == NULL) {
+        char *sym;
+
+        if ((sym = make_sym(filename)) == NULL)
+            return krb5_enomem(context);
+
+        (void)_krb5_plugin_run_f(context, "krb5", sym, HDB_INTERFACE_VERSION,
+                                 0, &cb_ctx, callback);
+
+        free(sym);
     }
-
-#ifdef HAVE_DLOPEN
-    if (h == NULL)
-	h = find_dynamic_method (context, filename, &residual);
-#endif
-    if (h == NULL)
-	krb5_errx(context, 1, "No database support for %s", filename);
-    return (*h->create)(context, db, residual);
+    if (cb_ctx.h == NULL)
+	krb5_errx(context, 1, "No database support for %s", cb_ctx.filename);
+    return (*cb_ctx.h->create)(context, db, cb_ctx.residual);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h
index 5a63fe225..7aa3f20c7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb.h,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: hdb.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -38,6 +38,8 @@
 #ifndef __HDB_H__
 #define __HDB_H__
 
+#include <stdio.h>
+
 #include <krb5/krb5.h>
 
 #include <krb5/hdb_err.h>
@@ -60,15 +62,18 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
 #define HDB_F_ADMIN_DATA	64	/* want data that kdc don't use  */
 #define HDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */
 #define HDB_F_CURRENT_KVNO	256	/* we want the current KVNO */
-/* 512, 1024, 2048 are reserved for kvno operations that is not part of the 1.5 branch */
+#define HDB_F_LIVE_CLNT_KVNOS	512	/* we want all live keys for pre-auth */
+#define HDB_F_LIVE_SVC_KVNOS	1024	/* we want all live keys for tix */
 #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */
 #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
 #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
+#define HDB_F_PRECHECK		16384	/* check that the operation would succeed */
 
 /* hdb_capability_flags */
 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
 #define HDB_CAP_F_HANDLE_PASSWORDS	2
 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS	4
+#define HDB_CAP_F_SHARED_DIRECTORY      8
 
 /* auth status values */
 #define HDB_AUTH_SUCCESS		0
@@ -101,7 +106,7 @@ typedef struct hdb_entry_ex {
  * query the backend database when talking about principals.
  */
 
-typedef struct HDB{
+typedef struct HDB {
     void *hdb_db;
     void *hdb_dbc; /** don't use, only for DB3 */
     char *hdb_name;
@@ -109,6 +114,8 @@ typedef struct HDB{
     hdb_master_key hdb_master_key;
     int hdb_openp;
     int hdb_capability_flags;
+    int lock_count;
+    int lock_type;
     /**
      * Open (or create) the a Kerberos database.
      *
@@ -151,7 +158,7 @@ typedef struct HDB{
      * Remove an entry from the database.
      */
     krb5_error_code (*hdb_remove)(krb5_context, struct HDB*,
-				  krb5_const_principal);
+				  unsigned, krb5_const_principal);
     /**
      * As part of iteration, fetch one entry
      */
@@ -183,25 +190,33 @@ typedef struct HDB{
     /**
      * Get an hdb_entry from a classical DB backend
      *
-     * If the database is a classical DB (ie BDB, NDBM, GDBM, etc)
-     * backend, this function will take a principal key (krb5_data)
-     * and return all data related to principal in the return
-     * krb5_data. The returned encoded entry is of type hdb_entry or
-     * hdb_entry_alias.
+     * This function takes a principal key (krb5_data) and returns all
+     * data related to principal in the return krb5_data. The returned
+     * encoded entry is of type hdb_entry or hdb_entry_alias.
      */
     krb5_error_code (*hdb__get)(krb5_context, struct HDB*,
 				krb5_data, krb5_data*);
     /**
      * Store an hdb_entry from a classical DB backend
      *
-     * Same discussion as in @ref HDB::hdb__get
+     * This function takes a principal key (krb5_data) and encoded
+     * hdb_entry or hdb_entry_alias as the data to store.
+     *
+     * For a file-based DB, this must synchronize to disk when done.
+     * This is sub-optimal for kadm5_s_rename_principal(), and for
+     * kadm5_s_modify_principal() when using principal aliases; to
+     * improve this so that only one fsync() need be done
+     * per-transaction will require HDB API extensions.
      */
     krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int,
 				krb5_data, krb5_data);
     /**
      * Delete and hdb_entry from a classical DB backend
      *
-     * Same discussion as in @ref HDB::hdb__get
+     * This function takes a principal key (krb5_data) naming the record
+     * to delete.
+     *
+     * Same discussion as in @ref HDB::hdb__put
      */
     krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data);
     /**
@@ -260,23 +275,31 @@ typedef struct HDB{
     krb5_error_code (*hdb_check_s4u2self)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
 }HDB;
 
-#define HDB_INTERFACE_VERSION	7
+#define HDB_INTERFACE_VERSION	9
 
-struct hdb_so_method {
-    int version;
+struct hdb_method {
+    int			version;
+    krb5_error_code	(*init)(krb5_context, void **);
+    void		(*fini)(void *);
     const char *prefix;
     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
 };
 
+/* dump entry format, for hdb_print_entry() */
+typedef enum hdb_dump_format {
+    HDB_DUMP_HEIMDAL = 0,
+    HDB_DUMP_MIT = 1,
+} hdb_dump_format_t;
+
+struct hdb_print_entry_arg {
+    FILE *out;
+    hdb_dump_format_t fmt;
+};
+
 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*,
 					      hdb_entry_ex*, void*);
 extern krb5_kt_ops hdb_kt_ops;
-
-struct hdb_method {
-    int interface_version;
-    const char *prefix;
-    krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
-};
+extern krb5_kt_ops hdb_get_kt_ops;
 
 extern const int hdb_interface_version;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.schema b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.schema
index d550d7f4b..acc033d73 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.schema
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.schema
@@ -113,6 +113,11 @@ attributetype ( 1.3.6.1.4.1.5322.10.1.12
 	EQUALITY octetStringMatch
 	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} )
 
+attributetype ( 1.3.6.1.4.1.5322.10.1.13
+	NAME 'krb5ExtendedAttributes'
+	DESC 'Encoded ASN1 HDB Extension Attributes as an octet string'
+	SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )
+
 # Object class definitions
 
 objectclass ( 1.3.6.1.4.1.5322.10.2.1
@@ -129,7 +134,7 @@ objectclass ( 1.3.6.1.4.1.5322.10.2.2
 	MUST ( krb5KeyVersionNumber )
 	MAY ( krb5ValidStart $ krb5ValidEnd $ krb5PasswordEnd $
               krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $
-              krb5EncryptionType $ krb5Key ) )
+              krb5EncryptionType $ krb5Key $ krb5ExtendedAttributes ) )
 
 objectclass ( 1.3.6.1.4.1.5322.10.2.3
 	NAME 'krb5Realm'
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_err.et b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_err.et
index c188e071b..e399dee23 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_err.et
@@ -26,5 +26,8 @@ error_code NO_MKEY,		"No correct master key"
 error_code MANDATORY_OPTION,	"Entry contains unknown mandatory extension"
 error_code NO_WRITE_SUPPORT,	"HDB backend doesn't contain write support"
 error_code NOT_FOUND_HERE,	"The secret for this entry is not replicated to this database"
+error_code MISUSE,		"Incorrect use of the API"
+error_code KVNO_NOT_FOUND,	"Entry key version number not found"
+error_code WRONG_REALM,		"The principal exists in another realm."
 
 end
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_locl.h b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_locl.h
index 55abe5cd3..916130468 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/hdb_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hdb_locl.h,v 1.1.1.2 2011/04/14 14:08:23 elric Exp $	*/
+/*	$NetBSD: hdb_locl.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
@@ -40,6 +40,9 @@
 
 #include <config.h>
 
+#include <assert.h>
+#include <krb5/heimbase.h>
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/keys.c b/crypto/external/bsd/heimdal/dist/lib/hdb/keys.c
index e5c243b18..162bc089e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/keys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/keys.c
@@ -1,8 +1,7 @@
-/*	$NetBSD: keys.c,v 1.3 2014/11/26 10:12:27 pettai Exp $	*/
-
+/*	$NetBSD: keys.c,v 1.4 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
- * Copyright (c) 1997 - 2001, 2003 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2011 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -36,14 +35,29 @@
 
 #include "hdb_locl.h"
 
+struct hx509_certs_data;
+struct krb5_pk_identity;
+struct krb5_pk_cert;
+struct ContentInfo;
+struct AlgorithmIdentifier;
+struct _krb5_krb_auth_data;
+typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx;
+struct krb5_dh_moduli;
+struct _krb5_key_data;
+struct _krb5_encryption_type;
+struct _krb5_key_type;
+#include <krb5/pkinit_asn1.h>
+#include <krb5/krb5-private.h>
+#include <krb5/base64.h>
+
 /*
  * free all the memory used by (len, keys)
  */
 
 void
-hdb_free_keys (krb5_context context, int len, Key *keys)
+hdb_free_keys(krb5_context context, int len, Key *keys)
 {
-    int i;
+    size_t i;
 
     for (i = 0; i < len; i++) {
 	free(keys[i].mkvno);
@@ -70,15 +84,15 @@ hdb_free_keys (krb5_context context, int len, Key *keys)
  */
 
 static const krb5_enctype des_etypes[] = {
-    ETYPE_DES_CBC_MD5,
-    ETYPE_DES_CBC_MD4,
-    ETYPE_DES_CBC_CRC
+    KRB5_ENCTYPE_DES_CBC_MD5,
+    KRB5_ENCTYPE_DES_CBC_MD4,
+    KRB5_ENCTYPE_DES_CBC_CRC
 };
 
 static const krb5_enctype all_etypes[] = {
-    ETYPE_AES256_CTS_HMAC_SHA1_96,
-    ETYPE_DES3_CBC_SHA1,
-    ETYPE_ARCFOUR_HMAC_MD5
+    KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+    KRB5_ENCTYPE_DES3_CBC_SHA1,
+    KRB5_ENCTYPE_ARCFOUR_HMAC_MD5
 };
 
 static krb5_error_code
@@ -116,7 +130,7 @@ parse_key_set(krb5_context context, const char *key,
 		enctypes = des_etypes;
 		num_enctypes = sizeof(des_etypes)/sizeof(des_etypes[0]);
 	    } else if(strcmp(buf[i], "des3") == 0) {
-		e = ETYPE_DES3_CBC_SHA1;
+		e = KRB5_ENCTYPE_DES3_CBC_SHA1;
 		enctypes = &e;
 		num_enctypes = 1;
 	    } else {
@@ -150,29 +164,30 @@ parse_key_set(krb5_context context, const char *key,
 	    continue;
 	}
 
-	{
-	    /* if there is a final string, use it as the string to
-	       salt with, this is mostly useful with null salt for
-	       v4 compat, and a cell name for afs compat */
-	    salt->saltvalue.data = strdup(buf[i]);
-	    if (salt->saltvalue.data == NULL) {
-		krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-		return ENOMEM;
-	    }
-	    salt->saltvalue.length = strlen(buf[i]);
-	}
+        if (salt->saltvalue.data != NULL)
+            free(salt->saltvalue.data);
+        /* if there is a final string, use it as the string to
+           salt with, this is mostly useful with null salt for
+           v4 compat, and a cell name for afs compat */
+        salt->saltvalue.data = strdup(buf[i]);
+        if (salt->saltvalue.data == NULL)
+            return krb5_enomem(context);
+        salt->saltvalue.length = strlen(buf[i]);
     }
 
     if(enctypes == NULL || salt->salttype == 0) {
+	krb5_free_salt(context, *salt);
 	krb5_set_error_message(context, EINVAL, "bad value for default_keys `%s'", key);
 	return EINVAL;
     }
 
     /* if no salt was specified make up default salt */
     if(salt->saltvalue.data == NULL) {
-	if(salt->salttype == KRB5_PW_SALT)
+	if(salt->salttype == KRB5_PW_SALT) {
 	    ret = krb5_get_pw_salt(context, principal, salt);
-	else if(salt->salttype == KRB5_AFS3_SALT) {
+	    if (ret)
+		return ret;
+	} else if(salt->salttype == KRB5_AFS3_SALT) {
 	    krb5_const_realm realm = krb5_principal_get_realm(context, principal);
 	    salt->saltvalue.data = strdup(realm);
 	    if(salt->saltvalue.data == NULL) {
@@ -198,6 +213,256 @@ parse_key_set(krb5_context context, const char *key,
     return 0;
 }
 
+/**
+ * This function prunes an HDB entry's keys that are too old to have been used
+ * to mint still valid tickets (based on the entry's maximum ticket lifetime).
+ * 
+ * @param context   Context
+ * @param entry	    HDB entry
+ */
+krb5_error_code
+hdb_prune_keys(krb5_context context, hdb_entry *entry)
+{
+    HDB_extension *ext;
+    HDB_Ext_KeySet *keys;
+    size_t nelem;
+
+    ext = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (ext == NULL)
+	return 0;
+    keys = &ext->data.u.hist_keys;
+    nelem = keys->len;
+
+    /* Optionally drop key history for keys older than now - max_life */
+    if (entry->max_life != NULL && nelem > 0
+	&& krb5_config_get_bool_default(context, NULL, FALSE,
+					"kadmin", "prune-key-history", NULL)) {
+	hdb_keyset *elem;
+	time_t ceiling = time(NULL) - *entry->max_life;
+	time_t keep_time = 0;
+	size_t i;
+
+	/*
+	 * Compute most recent key timestamp that predates the current time
+	 * by at least the entry's maximum ticket lifetime.
+	 */
+	for (i = 0; i < nelem; ++i) {
+	    elem = &keys->val[i];
+	    if (elem->set_time && *elem->set_time < ceiling
+		&& (keep_time == 0 || *elem->set_time > keep_time))
+		keep_time = *elem->set_time;
+	}
+
+	/* Drop obsolete entries */
+	if (keep_time) {
+	    for (i = 0; i < nelem; /* see below */) {
+		elem = &keys->val[i];
+		if (elem->set_time && *elem->set_time < keep_time) {
+		    remove_HDB_Ext_KeySet(keys, i);
+		    /*
+		     * Removing the i'th element shifts the tail down, continue
+		     * at same index with reduced upper bound.
+		     */
+		    --nelem;
+		    continue;
+		}
+		++i;
+	    }
+	}
+    }
+
+    return 0;
+}
+
+/**
+ * This function adds an HDB entry's current keyset to the entry's key
+ * history.  The current keyset is left alone; the caller is responsible
+ * for freeing it.
+ *
+ * @param context   Context
+ * @param entry	    HDB entry
+ */
+krb5_error_code
+hdb_add_current_keys_to_history(krb5_context context, hdb_entry *entry)
+{
+    krb5_boolean replace = FALSE;
+    krb5_error_code ret;
+    HDB_extension *ext;
+    HDB_Ext_KeySet *keys;
+    hdb_keyset newkeyset;
+    time_t newtime;
+
+    if (entry->keys.len == 0)
+	return 0; /* nothing to do */
+
+    ext = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (ext == NULL) {
+	replace = TRUE;
+	ext = calloc(1, sizeof (*ext));
+	if (ext == NULL)
+	    return krb5_enomem(context);
+
+	ext->data.element = choice_HDB_extension_data_hist_keys;
+    }
+    keys = &ext->data.u.hist_keys;
+
+    ext->mandatory = FALSE;
+
+    /*
+     * Copy in newest old keyset
+     */
+    ret = hdb_entry_get_pw_change_time(entry, &newtime);
+    if (ret)
+	goto out;
+
+    memset(&newkeyset, 0, sizeof(newkeyset));
+    newkeyset.keys = entry->keys;
+    newkeyset.kvno = entry->kvno;
+    newkeyset.set_time = &newtime;
+
+    ret = add_HDB_Ext_KeySet(keys, &newkeyset);
+    if (ret)
+	goto out;
+
+    if (replace) {
+	/* hdb_replace_extension() deep-copies ext; what a waste */
+	ret = hdb_replace_extension(context, entry, ext);
+	if (ret)
+	    goto out;
+    }
+
+    ret = hdb_prune_keys(context, entry);
+    if (ret)
+	goto out;
+
+ out:
+    if (replace && ext) {
+	free_HDB_extension(ext);
+	free(ext);
+    }
+    return ret;
+}
+
+/**
+ * This function adds a key to an HDB entry's key history.
+ *
+ * @param context   Context
+ * @param entry	    HDB entry
+ * @param kvno	    Key version number of the key to add to the history
+ * @param key	    The Key to add
+ */
+krb5_error_code
+hdb_add_history_key(krb5_context context, hdb_entry *entry, krb5_kvno kvno, Key *key)
+{
+    size_t i;
+    hdb_keyset keyset;
+    HDB_Ext_KeySet *hist_keys;
+    HDB_extension ext;
+    HDB_extension *extp;
+    krb5_error_code ret;
+
+    memset(&keyset, 0, sizeof (keyset));
+    memset(&ext, 0, sizeof (ext));
+
+    extp = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (extp == NULL) {
+	ext.data.element = choice_HDB_extension_data_hist_keys;
+	extp = &ext;
+    }
+
+    extp->mandatory = FALSE;
+    hist_keys = &extp->data.u.hist_keys;
+
+    for (i = 0; i < hist_keys->len; i++) {
+	if (hist_keys->val[i].kvno == kvno) {
+	    ret = add_Keys(&hist_keys->val[i].keys, key);
+	    goto out;
+	}
+    }
+
+    keyset.kvno = kvno;
+    ret = add_Keys(&keyset.keys, key);
+    if (ret)
+	goto out;
+    ret = add_HDB_Ext_KeySet(hist_keys, &keyset);
+    if (ret)
+	goto out;
+    if (extp == &ext) {
+	ret = hdb_replace_extension(context, entry, &ext);
+	if (ret)
+	    goto out;
+    }
+
+out:
+    free_hdb_keyset(&keyset);
+    free_HDB_extension(&ext);
+    return ret;
+}
+
+
+/**
+ * This function changes an hdb_entry's kvno, swapping the current key
+ * set with a historical keyset.  If no historical keys are found then
+ * an error is returned (the caller can still set entry->kvno directly).
+ *
+ * @param context	krb5_context
+ * @param new_kvno	New kvno for the entry
+ * @param entry		hdb_entry to modify
+ */
+krb5_error_code
+hdb_change_kvno(krb5_context context, krb5_kvno new_kvno, hdb_entry *entry)
+{
+    HDB_extension ext;
+    HDB_extension *extp;
+    hdb_keyset keyset;
+    HDB_Ext_KeySet *hist_keys;
+    size_t i;
+    int found = 0;
+    krb5_error_code ret;
+
+    if (entry->kvno == new_kvno)
+	return 0;
+
+    extp = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (extp == NULL) {
+	memset(&ext, 0, sizeof (ext));
+	ext.data.element = choice_HDB_extension_data_hist_keys;
+	extp = &ext;
+    }
+
+    memset(&keyset, 0, sizeof (keyset));
+    hist_keys = &extp->data.u.hist_keys;
+    for (i = 0; i < hist_keys->len; i++) {
+	if (hist_keys->val[i].kvno == new_kvno) {
+	    found = 1;
+	    ret = copy_hdb_keyset(&hist_keys->val[i], &keyset);
+	    if (ret)
+		goto out;
+	    ret = remove_HDB_Ext_KeySet(hist_keys, i);
+	    if (ret)
+		goto out;
+	    break;
+	}
+    }
+
+    if (!found)
+	return HDB_ERR_KVNO_NOT_FOUND;
+
+    ret = hdb_add_current_keys_to_history(context, entry);
+    if (ret)
+	goto out;
+
+    /* Note: we do nothing with keyset.set_time */
+    entry->kvno = new_kvno;
+    entry->keys = keyset.keys; /* shortcut */
+    memset(&keyset.keys, 0, sizeof (keyset.keys));
+
+out:
+    free_hdb_keyset(&keyset);
+    return ret;
+}
+
+
 static krb5_error_code
 add_enctype_to_key_set(Key **key_set, size_t *nkeyset,
 		       krb5_enctype enctype, krb5_salt *salt)
@@ -245,6 +510,122 @@ add_enctype_to_key_set(Key **key_set, size_t *nkeyset,
 }
 
 
+static
+krb5_error_code
+ks_tuple2str(krb5_context context, int n_ks_tuple,
+	     krb5_key_salt_tuple *ks_tuple, char ***ks_tuple_strs)
+{
+	size_t i;
+	char **ksnames;
+	krb5_error_code rc = KRB5_PROG_ETYPE_NOSUPP;
+
+	*ks_tuple_strs = NULL;
+	if (n_ks_tuple < 1)
+		return 0;
+
+	if ((ksnames = calloc(n_ks_tuple + 1, sizeof (*ksnames))) == NULL)
+		return (errno);
+
+	for (i = 0; i < n_ks_tuple; i++) {
+            char *ename, *sname;
+
+	    if (krb5_enctype_to_string(context, ks_tuple[i].ks_enctype, &ename))
+		goto out;
+	    if (krb5_salttype_to_string(context, ks_tuple[i].ks_enctype,
+					ks_tuple[i].ks_salttype, &sname)) {
+                free(ename);
+		goto out;
+            }
+
+	    if (asprintf(&ksnames[i], "%s:%s", ename, sname) == -1) {
+		    rc = errno;
+		    free(ename);
+		    free(sname);
+		    goto out;
+	    }
+	    free(ename);
+	    free(sname);
+	}
+
+	ksnames[i] = NULL;
+	*ks_tuple_strs = ksnames;
+	return 0;
+
+out:
+	for (i = 0; i < n_ks_tuple; i++)
+		free(ksnames[i]);
+	free(ksnames);
+	return (rc);
+}
+
+/*
+ *
+ */
+
+static char **
+glob_rules_keys(krb5_context context, krb5_const_principal principal)
+{
+    const krb5_config_binding *list;
+    krb5_principal pattern;
+    krb5_error_code ret;
+
+    list = krb5_config_get_list(context, NULL, "kadmin",
+				"default_key_rules", NULL);
+    if (list == NULL)
+	return NULL;
+
+    while (list) {
+	if (list->type == krb5_config_string) {
+	    ret = krb5_parse_name(context, list->name, &pattern);
+	    if (ret == 0) {
+		ret = krb5_principal_match(context, principal, pattern);
+		krb5_free_principal(context, pattern);
+		if (ret) {
+		    return krb5_config_get_strings(context, list, 
+						   list->name, NULL);
+		}
+	    }
+	}
+	list = list->next;
+    }
+    return NULL;    
+}
+
+/*
+ * NIST guidance in Section 5.1 of [SP800-132] requires that a portion
+ * of the salt of at least 128 bits shall be randomly generated.
+ */
+static krb5_error_code
+add_random_to_salt(krb5_context context, krb5_salt *in, krb5_salt *out)
+{
+    krb5_error_code ret;
+    char *p;
+    unsigned char random[16];
+    char *s;
+    int slen;
+
+    krb5_generate_random_block(random, sizeof(random));
+
+    slen = rk_base64_encode(random, sizeof(random), &s);
+    if (slen < 0)
+	return ENOMEM;
+
+    ret = krb5_data_alloc(&out->saltvalue, slen + in->saltvalue.length);
+    if (ret) {
+	free(s);
+	return ret;
+    }
+
+    p = out->saltvalue.data;
+    memcpy(p, s, slen);
+    memcpy(&p[slen], in->saltvalue.data, in->saltvalue.length);
+
+    out->salttype = in->salttype;
+    free(s);
+
+    return 0;
+}
+
 /*
  * Generate the `key_set' from the [kadmin]default_keys statement. If
  * `no_salt' is set, salt is not important (and will not be set) since
@@ -253,12 +634,16 @@ add_enctype_to_key_set(Key **key_set, size_t *nkeyset,
 
 krb5_error_code
 hdb_generate_key_set(krb5_context context, krb5_principal principal,
+		     krb5_key_salt_tuple *ks_tuple, int n_ks_tuple,
 		     Key **ret_key_set, size_t *nkeyset, int no_salt)
 {
-    char **ktypes, **kp;
+    char **ktypes = NULL;
+    char **kp;
     krb5_error_code ret;
     Key *k, *key_set;
     size_t i, j;
+    char **ks_tuple_strs;
+    char **config_ktypes = NULL;
     static const char *default_keytypes[] = {
 	"aes256-cts-hmac-sha1-96:pw-salt",
 	"des3-cbc-sha1:pw-salt",
@@ -266,16 +651,24 @@ hdb_generate_key_set(krb5_context context, krb5_principal principal,
 	NULL
     };
 
-    ktypes = krb5_config_get_strings(context, NULL, "kadmin",
-				     "default_keys", NULL);
+    if ((ret = ks_tuple2str(context, n_ks_tuple, ks_tuple, &ks_tuple_strs)))
+	    return ret;
+
+    ktypes = ks_tuple_strs;
+    if (ktypes == NULL) {
+	ktypes = glob_rules_keys(context, principal);
+    }
+    if (ktypes == NULL) {
+	config_ktypes = krb5_config_get_strings(context, NULL, "kadmin",
+						"default_keys", NULL);
+	ktypes = config_ktypes;
+    }
     if (ktypes == NULL)
 	ktypes = (char **)(intptr_t)default_keytypes;
 
     *ret_key_set = key_set = NULL;
     *nkeyset = 0;
 
-    ret = 0;
-
     for(kp = ktypes; kp && *kp; kp++) {
 	const char *p;
 	krb5_salt salt;
@@ -300,10 +693,14 @@ hdb_generate_key_set(krb5_context context, krb5_principal principal,
 	if (ret) {
 	    krb5_warn(context, ret, "bad value for default_keys `%s'", *kp);
 	    ret = 0;
+            krb5_free_salt(context, salt);
 	    continue;
 	}
 
 	for (i = 0; i < num_enctypes; i++) {
+	    krb5_salt *saltp = no_salt ? NULL : &salt;
+	    krb5_salt rsalt;
+
 	    /* find duplicates */
 	    for (j = 0; j < *nkeyset; j++) {
 
@@ -322,14 +719,27 @@ hdb_generate_key_set(krb5_context context, krb5_principal principal,
 		}
 	    }
 	    /* not a duplicate, lets add it */
-	    if (j == *nkeyset) {
+	    if (j < *nkeyset)
+		continue;
+
+	    memset(&rsalt, 0, sizeof(rsalt));
+
+	    /* prepend salt with randomness if required */
+	    if (!no_salt &&
+		_krb5_enctype_requires_random_salt(context, enctypes[i])) {
+		saltp = &rsalt;
+		ret = add_random_to_salt(context, &salt, &rsalt);
+	    }
+
+	    if (ret == 0)
 		ret = add_enctype_to_key_set(&key_set, nkeyset, enctypes[i],
-					     no_salt ? NULL : &salt);
-		if (ret) {
-		    free(enctypes);
-		    krb5_free_salt(context, salt);
-		    goto out;
-		}
+					     saltp);
+	    krb5_free_salt(context, rsalt);
+
+	    if (ret) {
+		free(enctypes);
+		krb5_free_salt(context, salt);
+		goto out;
 	    }
 	}
 	free(enctypes);
@@ -339,8 +749,12 @@ hdb_generate_key_set(krb5_context context, krb5_principal principal,
     *ret_key_set = key_set;
 
  out:
-    if (ktypes != (char **)(intptr_t)default_keytypes)
-	krb5_config_free_strings(ktypes);
+    if (config_ktypes != NULL)
+	krb5_config_free_strings(config_ktypes);
+
+    for(kp = ks_tuple_strs; kp && *kp; kp++)
+	free(*kp);
+    free(ks_tuple_strs);
 
     if (ret) {
 	krb5_warn(context, ret,
@@ -363,29 +777,30 @@ krb5_error_code
 hdb_generate_key_set_password(krb5_context context,
 			      krb5_principal principal,
 			      const char *password,
+			      krb5_key_salt_tuple *ks_tuple, int n_ks_tuple,
 			      Key **keys, size_t *num_keys)
 {
     krb5_error_code ret;
     size_t i;
 
-    ret = hdb_generate_key_set(context, principal,
+    ret = hdb_generate_key_set(context, principal, ks_tuple, n_ks_tuple,
 				keys, num_keys, 0);
     if (ret)
 	return ret;
 
     for (i = 0; i < (*num_keys); i++) {
 	krb5_salt salt;
+	Key *key = &(*keys)[i];
 
-	salt.salttype = (*keys)[i].salt->type;
-	salt.saltvalue.length = (*keys)[i].salt->salt.length;
-	salt.saltvalue.data = (*keys)[i].salt->salt.data;
+	salt.salttype = key->salt->type;
+	salt.saltvalue.length = key->salt->salt.length;
+	salt.saltvalue.data = key->salt->salt.data;
 
 	ret = krb5_string_to_key_salt (context,
-				       (*keys)[i].key.keytype,
+				       key->key.keytype,
 				       password,
 				       salt,
-				       &(*keys)[i].key);
-
+				       &key->key);
 	if(ret)
 	    break;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/keytab.c b/crypto/external/bsd/heimdal/dist/lib/hdb/keytab.c
index 3de17040c..9790932ab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/keytab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/keytab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: keytab.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
@@ -67,7 +67,7 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
     }
     db = name;
     mkey = strstr(name, ":mkey=");
-    if(mkey == NULL || mkey[5] == '\0') {
+    if(mkey == NULL || mkey[6] == '\0') {
 	if(*name == '\0')
 	    d->dbname = NULL;
 	else {
@@ -89,7 +89,7 @@ hdb_resolve(krb5_context context, const char *name, krb5_keytab id)
 	memmove(d->dbname, db, mkey - db);
 	d->dbname[mkey - db] = '\0';
 
-	d->mkey = strdup(mkey + 5);
+	d->mkey = strdup(mkey + 6);
 	if(d->mkey == NULL) {
 	    free(d->dbname);
 	    free(d);
@@ -422,5 +422,23 @@ krb5_kt_ops hdb_kt_ops = {
     hdb_next_entry,
     hdb_end_seq_get,
     NULL,		/* add */
-    NULL		/* remove */
+    NULL,		/* remove */
+    NULL,
+    0
+};
+
+krb5_kt_ops hdb_get_kt_ops = {
+    "HDBGET",
+    hdb_resolve,
+    hdb_get_name,
+    hdb_close,
+    NULL,
+    hdb_get_entry,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    0
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/libhdb-exports.def b/crypto/external/bsd/heimdal/dist/lib/hdb/libhdb-exports.def
index 4a93f7f92..3e3913fbf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/libhdb-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/libhdb-exports.def
@@ -1,6 +1,8 @@
 EXPORTS
 	encode_hdb_keyset
 	hdb_add_master_key
+	hdb_add_current_keys_to_history
+        hdb_change_kvno
 	hdb_check_db_format
 	hdb_clear_extension
 	hdb_clear_master_key
@@ -43,18 +45,21 @@ EXPORTS
 	hdb_init_db
         hdb_interface_version   DATA
 	hdb_key2principal
+	hdb_kvno2keys
 	hdb_list_builtin
 	hdb_lock
 	hdb_next_enctype2key
 	hdb_principal2key
 	hdb_print_entry
 	hdb_process_master_key
+	hdb_prune_keys
 	hdb_read_master_key
 	hdb_replace_extension
 	hdb_seal_key
 	hdb_seal_key_mkey
 	hdb_seal_keys
 	hdb_seal_keys_mkey
+        hdb_set_last_modified_by
 	hdb_set_master_key
 	hdb_set_master_keyfile
 	hdb_unlock
@@ -69,6 +74,11 @@ EXPORTS
         initialize_hdb_error_table_r
 
 	hdb_kt_ops
+	hdb_get_kt_ops
+
+; MIT KDB related entries
+        _hdb_mdb_value2entry
+        _hdb_mit_dump2mitdb_entry
 
 ; some random bits needed for libkadm
 	HDBFlags2int
@@ -76,25 +86,34 @@ EXPORTS
 	copy_Event
 	copy_HDB_extensions
 	copy_Key
+        copy_Keys
 	copy_Salt
 	decode_HDB_Ext_Aliases
 	decode_HDB_Ext_PKINIT_acl
 	decode_HDB_extension
         decode_Key
+        decode_Keys
 	encode_HDB_Ext_Aliases
 	encode_HDB_Ext_PKINIT_acl
 	encode_HDB_extension
         encode_Key
+        encode_Keys
 	free_Event
 	free_HDB_Ext_Aliases
 	free_HDB_Ext_PKINIT_acl
 	free_HDB_extension
 	free_HDB_extensions
 	free_Key
+	free_Keys
         free_Salt
 	free_hdb_entry
+	free_hdb_keyset
 	int2HDBFlags
 	length_HDB_Ext_Aliases
 	length_HDB_Ext_PKINIT_acl
 	length_HDB_extension
         length_Key
+        length_Keys
+	add_Keys
+	add_HDB_Ext_KeySet
+        remove_Keys
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/mkey.c b/crypto/external/bsd/heimdal/dist/lib/hdb/mkey.c
index 626f6fc35..dd28a09d7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/mkey.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/mkey.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mkey.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: mkey.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
@@ -42,6 +42,7 @@ struct hdb_master_key_data {
     krb5_keytab_entry keytab;
     krb5_crypto crypto;
     struct hdb_master_key_data *next;
+    unsigned int key_usage;
 };
 
 void
@@ -70,6 +71,7 @@ hdb_process_master_key(krb5_context context,
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
+    (*mkey)->key_usage = HDB_KU_MKEY;
     (*mkey)->keytab.vno = kvno;
     ret = krb5_parse_name(context, "K/M", &(*mkey)->keytab.principal);
     if(ret)
@@ -119,6 +121,7 @@ read_master_keytab(krb5_context context, const char *filename,
     krb5_keytab_entry entry;
     hdb_master_key p;
 
+    *mkey = NULL;
     ret = krb5_kt_resolve(context, filename, &id);
     if(ret)
 	return ret;
@@ -126,22 +129,26 @@ read_master_keytab(krb5_context context, const char *filename,
     ret = krb5_kt_start_seq_get(context, id, &cursor);
     if(ret)
 	goto out;
-    *mkey = NULL;
     while(krb5_kt_next_entry(context, id, &entry, &cursor) == 0) {
 	p = calloc(1, sizeof(*p));
-	if(p == NULL) {
-	    krb5_kt_end_seq_get(context, id, &cursor);
+	if (p == NULL) {
 	    ret = ENOMEM;
-	    goto out;
+	    break;
 	}
 	p->keytab = entry;
-	ret = krb5_crypto_init(context, &p->keytab.keyblock, 0, &p->crypto);
 	p->next = *mkey;
 	*mkey = p;
+	ret = krb5_crypto_init(context, &p->keytab.keyblock, 0, &p->crypto);
+	if (ret)
+	    break;
     }
     krb5_kt_end_seq_get(context, id, &cursor);
   out:
     krb5_kt_close(context, id);
+    if (ret) {
+	hdb_free_master_key(context, *mkey);
+	*mkey = NULL;
+    }
     return ret;
 }
 
@@ -364,8 +371,17 @@ hdb_write_master_key(krb5_context context, const char *filename,
     return ret;
 }
 
+krb5_error_code
+_hdb_set_master_key_usage(krb5_context context, HDB *db, unsigned int key_usage)
+{
+    if (db->hdb_master_key_set == 0)
+	return HDB_ERR_NO_MKEY;
+    db->hdb_master_key->key_usage = key_usage;
+    return 0;
+}
+
 hdb_master_key
-_hdb_find_master_key(uint32_t *mkvno, hdb_master_key mkey)
+_hdb_find_master_key(unsigned int *mkvno, hdb_master_key mkey)
 {
     hdb_master_key ret = NULL;
     while(mkey) {
@@ -481,6 +497,135 @@ hdb_unseal_keys(krb5_context context, HDB *db, hdb_entry *ent)
     return hdb_unseal_keys_mkey(context, ent, db->hdb_master_key);
 }
 
+/*
+ * Unseal the keys for the given kvno (or all of them) of entry.
+ *
+ * If kvno == 0 -> unseal all.
+ * if kvno != 0 -> unseal the requested kvno and make sure it's the one listed
+ *                 as the current keyset for the entry (swapping it with a
+ *                 historical keyset if need be).
+ */
+krb5_error_code
+hdb_unseal_keys_kvno(krb5_context context, HDB *db, krb5_kvno kvno,
+		     unsigned flags, hdb_entry *ent)
+{
+    krb5_error_code ret = HDB_ERR_NOENTRY;
+    HDB_extension *ext;
+    HDB_Ext_KeySet *hist_keys;
+    Key *tmp_val;
+    time_t tmp_set_time;
+    unsigned int tmp_len;
+    unsigned int kvno_diff = 0;
+    krb5_kvno tmp_kvno;
+    size_t i, k;
+    int exclude_dead = 0;
+    KerberosTime now = 0;
+
+    if (kvno == 0)
+	ret = 0;
+
+    if ((flags & HDB_F_LIVE_CLNT_KVNOS) || (flags & HDB_F_LIVE_SVC_KVNOS)) {
+	exclude_dead = 1;
+	now = time(NULL);
+	if (HDB_F_LIVE_CLNT_KVNOS)
+	    kvno_diff = hdb_entry_get_kvno_diff_clnt(ent);
+	else
+	    kvno_diff = hdb_entry_get_kvno_diff_svc(ent);
+    }
+
+    ext = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
+    if (ext == NULL || (&ext->data.u.hist_keys)->len == 0)
+	return hdb_unseal_keys_mkey(context, ent, db->hdb_master_key);
+
+    /* For swapping; see below */
+    tmp_len = ent->keys.len;
+    tmp_val = ent->keys.val;
+    tmp_kvno = ent->kvno;
+    (void) hdb_entry_get_pw_change_time(ent, &tmp_set_time);
+
+    hist_keys = &ext->data.u.hist_keys;
+
+    for (i = 0; i < hist_keys->len; i++) {
+	if (kvno != 0 && hist_keys->val[i].kvno != kvno)
+	    continue;
+
+	if (exclude_dead &&
+	    ((ent->max_life != NULL &&
+	      hist_keys->val[i].set_time != NULL &&
+	      (*hist_keys->val[i].set_time) < (now - (*ent->max_life))) ||
+	    (hist_keys->val[i].kvno < kvno &&
+	     (kvno - hist_keys->val[i].kvno) > kvno_diff)))
+	    /*
+	     * The KDC may want to to check for this keyset's set_time
+	     * is within the TGS principal's max_life, say.  But we stop
+	     * here.
+	     */
+	    continue;
+
+	/* Either the keys we want, or all the keys */
+	for (k = 0; k < hist_keys->val[i].keys.len; k++) {
+	    ret = hdb_unseal_key_mkey(context,
+				      &hist_keys->val[i].keys.val[k],
+				      db->hdb_master_key);
+	    /*
+	     * If kvno == 0 we might not want to bail here!  E.g., if we
+	     * no longer have the right master key, so just ignore this.
+	     *
+	     * We could filter out keys that we can't decrypt here
+	     * because of HDB_ERR_NO_MKEY.  However, it seems safest to
+	     * filter them out only where necessary, say, in kadm5.
+	     */
+	    if (ret && kvno != 0)
+		return ret;
+	    if (ret && ret != HDB_ERR_NO_MKEY)
+		return (ret);
+	}
+
+	if (kvno == 0)
+	    continue;
+
+	/*
+	 * What follows is a bit of a hack.
+	 *
+	 * This is the keyset we're being asked for, but it's not the
+	 * current keyset.  So we add the current keyset to the history,
+	 * leave the one we were asked for in the history, and pretend
+	 * the one we were asked for is also the current keyset.
+	 *
+	 * This is a bit of a defensive hack in case an entry fetched
+	 * this way ever gets modified then stored: if the keyset is not
+	 * changed we can detect this and put things back, else we won't
+	 * drop any keysets from history by accident.
+	 *
+	 * Note too that we only ever get called with a non-zero kvno
+	 * either in the KDC or in cases where we aren't changing the
+	 * HDB entry anyways, which is why this is just a defensive
+	 * hack.  We also don't fetch specific kvnos in the dump case,
+	 * so there's no danger that we'll dump this entry and load it
+	 * again, repeatedly causing the history to grow boundelessly.
+	 */
+
+	/* Swap key sets */
+	ent->kvno = hist_keys->val[i].kvno;
+	ent->keys.val = hist_keys->val[i].keys.val;
+	ent->keys.len = hist_keys->val[i].keys.len;
+	if (hist_keys->val[i].set_time != NULL)
+	    /* Sloppy, but the callers we expect won't care */
+	    (void) hdb_entry_set_pw_change_time(context, ent,
+						*hist_keys->val[i].set_time);
+	hist_keys->val[i].kvno = tmp_kvno;
+	hist_keys->val[i].keys.val = tmp_val;
+	hist_keys->val[i].keys.len = tmp_len;
+	if (hist_keys->val[i].set_time != NULL)
+	    /* Sloppy, but the callers we expect won't care */
+	    *hist_keys->val[i].set_time = tmp_set_time;
+
+	return 0;
+    }
+
+    return (ret);
+}
+
 krb5_error_code
 hdb_unseal_key(krb5_context context, HDB *db, Key *k)
 {
@@ -528,14 +673,31 @@ hdb_seal_key_mkey(krb5_context context, Key *k, hdb_master_key mkey)
 krb5_error_code
 hdb_seal_keys_mkey(krb5_context context, hdb_entry *ent, hdb_master_key mkey)
 {
-    size_t i;
-    for(i = 0; i < ent->keys.len; i++){
-	krb5_error_code ret;
+    HDB_extension *ext;
+    HDB_Ext_KeySet *hist_keys;
+    size_t i, k;
+    krb5_error_code ret;
 
+    for(i = 0; i < ent->keys.len; i++){
 	ret = hdb_seal_key_mkey(context, &ent->keys.val[i], mkey);
 	if (ret)
 	    return ret;
     }
+
+    ext = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
+    if (ext == NULL)
+	return 0;
+    hist_keys = &ext->data.u.hist_keys;
+
+    for (i = 0; i < hist_keys->len; i++) {
+	for (k = 0; k < hist_keys->val[i].keys.len; k++) {
+	    ret = hdb_seal_key_mkey(context, &hist_keys->val[i].keys.val[k],
+				    mkey);
+	    if (ret)
+		return ret;
+	}
+    }
+
     return 0;
 }
 
@@ -558,9 +720,9 @@ hdb_seal_key(krb5_context context, HDB *db, Key *k)
 }
 
 krb5_error_code
-hdb_set_master_key (krb5_context context,
-		    HDB *db,
-		    krb5_keyblock *key)
+hdb_set_master_key(krb5_context context,
+		   HDB *db,
+		   krb5_keyblock *key)
 {
     krb5_error_code ret;
     hdb_master_key mkey;
@@ -573,6 +735,7 @@ hdb_set_master_key (krb5_context context,
     des_set_random_generator_seed(key.keyvalue.data);
 #endif
     db->hdb_master_key_set = 1;
+    db->hdb_master_key->key_usage = HDB_KU_MKEY;
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/ndbm.c b/crypto/external/bsd/heimdal/dist/lib/hdb/ndbm.c
index 234e50e99..a6e2ea5b9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/ndbm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/ndbm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ndbm.c,v 1.1.1.1 2011/04/13 18:14:42 elric Exp $	*/
+/*	$NetBSD: ndbm.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/print.c b/crypto/external/bsd/heimdal/dist/lib/hdb/print.c
index c2a62b2f5..f8758cfe6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/print.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/print.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: print.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: print.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 1999-2005 Kungliga Tekniska Högskolan
@@ -59,44 +59,57 @@
   generation number
   */
 
-static krb5_error_code
+/*
+ * These utility functions return the number of bytes written or -1, and
+ * they set an error in the context.
+ */
+static ssize_t
 append_string(krb5_context context, krb5_storage *sp, const char *fmt, ...)
 {
-    krb5_error_code ret;
+    ssize_t sz;
     char *s;
+    int rc;
     va_list ap;
     va_start(ap, fmt);
-    vasprintf(&s, fmt, ap);
+    rc = vasprintf(&s, fmt, ap);
     va_end(ap);
-    if(s == NULL) {
+    if(rc < 0) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
+	return -1;
     }
-    ret = krb5_storage_write(sp, s, strlen(s));
+    sz = krb5_storage_write(sp, s, strlen(s));
     free(s);
-    return ret;
+    return sz;
 }
 
 static krb5_error_code
-append_hex(krb5_context context, krb5_storage *sp, krb5_data *data)
+append_hex(krb5_context context, krb5_storage *sp,
+           int always_encode, int lower, krb5_data *data)
 {
+    ssize_t sz;
     int printable = 1;
     size_t i;
     char *p;
 
     p = data->data;
-    for(i = 0; i < data->length; i++)
-	if(!isalnum((unsigned char)p[i]) && p[i] != '.'){
-	    printable = 0;
-	    break;
-	}
-    if(printable)
+    if (!always_encode) {
+        for (i = 0; i < data->length; i++) {
+            if (!isalnum((unsigned char)p[i]) && p[i] != '.'){
+                printable = 0;
+                break;
+            }
+        }
+    }
+    if (printable && !always_encode)
 	return append_string(context, sp, "\"%.*s\"",
 			     data->length, data->data);
-    hex_encode(data->data, data->length, &p);
-    append_string(context, sp, "%s", p);
+    sz = hex_encode(data->data, data->length, &p);
+    if (sz == -1) return sz;
+    if (lower)
+        strlwr(p);
+    sz = append_string(context, sp, "%s", p);
     free(p);
-    return 0;
+    return sz;
 }
 
 static char *
@@ -107,22 +120,99 @@ time2str(time_t t)
     return buf;
 }
 
-static krb5_error_code
+static ssize_t
 append_event(krb5_context context, krb5_storage *sp, Event *ev)
 {
-    char *pr = NULL;
     krb5_error_code ret;
+    ssize_t sz;
+    char *pr = NULL;
     if(ev == NULL)
 	return append_string(context, sp, "- ");
     if (ev->principal != NULL) {
        ret = krb5_unparse_name(context, ev->principal, &pr);
-       if(ret)
-           return ret;
+       if (ret) return -1; /* krb5_unparse_name() sets error info */
     }
-    ret = append_string(context, sp, "%s:%s ",
-			time2str(ev->time), pr ? pr : "UNKNOWN");
+    sz = append_string(context, sp, "%s:%s ", time2str(ev->time),
+                       pr ? pr : "UNKNOWN");
     free(pr);
-    return ret;
+    return sz;
+}
+
+#define KRB5_KDB_SALTTYPE_NORMAL        0
+#define KRB5_KDB_SALTTYPE_V4            1
+#define KRB5_KDB_SALTTYPE_NOREALM       2
+#define KRB5_KDB_SALTTYPE_ONLYREALM     3
+#define KRB5_KDB_SALTTYPE_SPECIAL       4
+#define KRB5_KDB_SALTTYPE_AFS3          5
+
+static ssize_t
+append_mit_key(krb5_context context, krb5_storage *sp,
+               krb5_const_principal princ,
+               unsigned int kvno, Key *key)
+{
+    krb5_error_code ret;
+    krb5_salt k5salt;
+    ssize_t sz;
+    size_t key_versions = key->salt ? 2 : 1;
+    size_t decrypted_key_length;
+    char buf[2];
+    krb5_data keylenbytes;
+    unsigned int salttype;
+
+    sz = append_string(context, sp, "\t%u\t%u\t%d\t%d\t", key_versions, kvno,
+                        key->key.keytype, key->key.keyvalue.length + 2);
+    if (sz == -1) return sz;
+    ret = krb5_enctype_keysize(context, key->key.keytype, &decrypted_key_length);
+    if (ret) return -1; /* XXX we lose the error code */
+    buf[0] = decrypted_key_length & 0xff;
+    buf[1] = (decrypted_key_length & 0xff00) >> 8;
+    keylenbytes.data = buf;
+    keylenbytes.length = sizeof (buf);
+    sz = append_hex(context, sp, 1, 1, &keylenbytes);
+    if (sz == -1) return sz;
+    sz = append_hex(context, sp, 1, 1, &key->key.keyvalue);
+    if (!key->salt)
+        return sz;
+
+    /* Map salt to MIT KDB style */
+    switch (key->salt->type) {
+    case KRB5_PADATA_PW_SALT:
+
+        /*
+         * Compute normal salt and then see whether it matches the stored one
+         */
+        ret = krb5_get_pw_salt(context, princ, &k5salt);
+        if (ret) return -1;
+        if (k5salt.saltvalue.length == key->salt->salt.length &&
+            memcmp(k5salt.saltvalue.data, key->salt->salt.data,
+                   k5salt.saltvalue.length) == 0)
+            salttype = KRB5_KDB_SALTTYPE_NORMAL; /* matches */
+        else if (key->salt->salt.length == strlen(princ->realm) &&
+                 memcmp(key->salt->salt.data, princ->realm,
+                        key->salt->salt.length) == 0)
+            salttype = KRB5_KDB_SALTTYPE_ONLYREALM; /* matches realm */
+        else if (key->salt->salt.length ==
+		 k5salt.saltvalue.length - strlen(princ->realm) &&
+                 memcmp((char *)k5salt.saltvalue.data + strlen(princ->realm),
+                        key->salt->salt.data, key->salt->salt.length) == 0)
+            salttype = KRB5_KDB_SALTTYPE_NOREALM; /* matches w/o realm */
+        else
+            salttype = KRB5_KDB_SALTTYPE_NORMAL;  /* hope for best */
+
+	break;
+
+    case KRB5_PADATA_AFS3_SALT:
+        salttype = KRB5_KDB_SALTTYPE_AFS3;
+	break;
+
+    default:
+	return -1;
+    }
+
+    sz = append_string(context, sp, "\t%u\t%u\t", salttype,
+                       key->salt->salt.length);
+    if (sz == -1) return sz;
+    return append_hex(context, sp, 1, 1, &key->salt->salt);
 }
 
 static krb5_error_code
@@ -151,12 +241,12 @@ entry2string_int (krb5_context context, krb5_storage *sp, hdb_entry *ent)
 	    append_string(context, sp, "::%d:",
 			  ent->keys.val[i].key.keytype);
 	/* --- keydata */
-	append_hex(context, sp, &ent->keys.val[i].key.keyvalue);
+	append_hex(context, sp, 0, 0, &ent->keys.val[i].key.keyvalue);
 	append_string(context, sp, ":");
 	/* --- salt */
 	if(ent->keys.val[i].salt){
 	    append_string(context, sp, "%u/", ent->keys.val[i].salt->type);
-	    append_hex(context, sp, &ent->keys.val[i].salt->salt);
+	    append_hex(context, sp, 0, 0, &ent->keys.val[i].salt->salt);
 	}else
 	    append_string(context, sp, "-");
     }
@@ -236,25 +326,224 @@ entry2string_int (krb5_context context, krb5_storage *sp, hdb_entry *ent)
     } else
 	append_string(context, sp, "-");
 
+    return 0;
+}
 
+#define KRB5_KDB_DISALLOW_POSTDATED     0x00000001
+#define KRB5_KDB_DISALLOW_FORWARDABLE   0x00000002
+#define KRB5_KDB_DISALLOW_TGT_BASED     0x00000004
+#define KRB5_KDB_DISALLOW_RENEWABLE     0x00000008
+#define KRB5_KDB_DISALLOW_PROXIABLE     0x00000010
+#define KRB5_KDB_DISALLOW_DUP_SKEY      0x00000020
+#define KRB5_KDB_DISALLOW_ALL_TIX       0x00000040
+#define KRB5_KDB_REQUIRES_PRE_AUTH      0x00000080
+#define KRB5_KDB_REQUIRES_HW_AUTH       0x00000100
+#define KRB5_KDB_REQUIRES_PWCHANGE      0x00000200
+#define KRB5_KDB_DISALLOW_SVR           0x00001000
+#define KRB5_KDB_PWCHANGE_SERVICE       0x00002000
+#define KRB5_KDB_SUPPORT_DESMD5         0x00004000
+#define KRB5_KDB_NEW_PRINC              0x00008000
+
+static int
+flags_to_attr(HDBFlags flags)
+{
+    int a = 0;
+
+    if (!flags.postdate)
+        a |= KRB5_KDB_DISALLOW_POSTDATED;
+    if (!flags.forwardable)
+        a |= KRB5_KDB_DISALLOW_FORWARDABLE;
+    if (flags.initial)
+        a |= KRB5_KDB_DISALLOW_TGT_BASED;
+    if (!flags.renewable)
+        a |= KRB5_KDB_DISALLOW_RENEWABLE;
+    if (!flags.proxiable)
+        a |= KRB5_KDB_DISALLOW_PROXIABLE;
+    if (flags.invalid)
+        a |= KRB5_KDB_DISALLOW_ALL_TIX;
+    if (flags.require_preauth)
+        a |= KRB5_KDB_REQUIRES_PRE_AUTH;
+    if (flags.require_hwauth)
+        a |= KRB5_KDB_REQUIRES_HW_AUTH;
+    if (!flags.server)
+        a |= KRB5_KDB_DISALLOW_SVR;
+    if (flags.change_pw)
+        a |= KRB5_KDB_PWCHANGE_SERVICE;
+    return a;
+}
+
+krb5_error_code
+entry2mit_string_int(krb5_context context, krb5_storage *sp, hdb_entry *ent)
+{
+    krb5_error_code ret;
+    ssize_t sz;
+    size_t i, k;
+    size_t num_tl_data = 0;
+    size_t num_key_data = 0;
+    char *p;
+    HDB_Ext_KeySet *hist_keys = NULL;
+    HDB_extension *extp;
+    time_t last_pw_chg = 0;
+    time_t exp = 0;
+    time_t pwexp = 0;
+    unsigned int max_life = 0;
+    unsigned int max_renew = 0;
+
+    if (ent->modified_by)
+        num_tl_data++;
+
+    ret = hdb_entry_get_pw_change_time(ent, &last_pw_chg);
+    if (ret) return ret;
+    if (last_pw_chg)
+        num_tl_data++;
+
+    extp = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
+    if (extp)
+        hist_keys = &extp->data.u.hist_keys;
+
+    for (i = 0; i < ent->keys.len;i++) {
+        if (ent->keys.val[i].key.keytype == ETYPE_DES_CBC_MD4 ||
+            ent->keys.val[i].key.keytype == ETYPE_DES_CBC_MD5)
+            continue;
+        num_key_data++;
+    }
+    if (hist_keys) {
+        for (i = 0; i < hist_keys->len; i++) {
+            /*
+             * MIT uses the highest kvno as the current kvno instead of
+             * tracking kvno separately, so we can't dump keysets with kvno
+             * higher than the entry's kvno.
+             */
+            if (hist_keys->val[i].kvno >= ent->kvno)
+                continue;
+            for (k = 0; k < hist_keys->val[i].keys.len; k++) {
+                if (ent->keys.val[k].key.keytype == ETYPE_DES_CBC_MD4 ||
+                    ent->keys.val[k].key.keytype == ETYPE_DES_CBC_MD5)
+                    continue;
+                num_key_data++;
+            }
+        }
+    }
+
+    ret = krb5_unparse_name(context, ent->principal, &p);
+    if (ret) return ret;
+    sz = append_string(context, sp, "princ\t38\t%u\t%u\t%u\t0\t%s\t%d",
+                       strlen(p), num_tl_data, num_key_data, p,
+                       flags_to_attr(ent->flags));
+    free(p);
+    if (sz == -1) return ENOMEM;
+
+    if (ent->max_life)
+        max_life = *ent->max_life;
+    if (ent->max_renew)
+        max_renew = *ent->max_renew;
+    if (ent->valid_end)
+        exp = *ent->valid_end;
+    if (ent->pw_end)
+        pwexp = *ent->pw_end;
+
+    sz = append_string(context, sp, "\t%u\t%u\t%u\t%u\t0\t0\t0",
+                       max_life, max_renew, exp, pwexp);
+    if (sz == -1) return ENOMEM;
+
+    /* Dump TL data we know: last pw chg and modified_by */
+#define mit_KRB5_TL_LAST_PWD_CHANGE     1
+#define mit_KRB5_TL_MOD_PRINC           2
+    if (last_pw_chg) {
+        krb5_data d;
+        time_t val;
+        unsigned char *ptr;
+        
+        ptr = (unsigned char *)&last_pw_chg;
+        val = ptr[0] | (ptr[1] << 8) | (ptr[2] << 16) | (ptr[3] << 24);
+        d.data = &val;
+        d.length = sizeof (last_pw_chg);
+        sz = append_string(context, sp, "\t%u\t%u\t",
+                           mit_KRB5_TL_LAST_PWD_CHANGE, d.length);
+        if (sz == -1) return ENOMEM;
+        sz = append_hex(context, sp, 1, 1, &d);
+        if (sz == -1) return ENOMEM;
+    }
+    if (ent->modified_by) {
+        krb5_data d;
+        unsigned int val;
+        size_t plen;
+        unsigned char *ptr;
+        char *modby_p;
+
+        ptr = (unsigned char *)&ent->modified_by->time;
+        val = ptr[0] | (ptr[1] << 8) | (ptr[2] << 16) | (ptr[3] << 24);
+        d.data = &val;
+        d.length = sizeof (ent->modified_by->time);
+        ret = krb5_unparse_name(context, ent->modified_by->principal, &modby_p);
+        if (ret) return ret;
+        plen = strlen(modby_p);
+        sz = append_string(context, sp, "\t%u\t%u\t",
+                           mit_KRB5_TL_MOD_PRINC,
+                           d.length + plen + 1 /* NULL counted */);
+        if (sz == -1) return ENOMEM;
+        sz = append_hex(context, sp, 1, 1, &d);
+        if (sz == -1) {
+            free(modby_p);
+            return ENOMEM;
+        }
+        d.data = modby_p;
+        d.length = plen + 1;
+        sz = append_hex(context, sp, 1, 1, &d);
+        free(modby_p);
+        if (sz == -1) return ENOMEM;
+    }
+    /*
+     * Dump keys (remembering to not include any with kvno higher than
+     * the entry's because MIT doesn't track entry kvno separately from
+     * the entry's keys -- max kvno is it)
+     */
+    for (i = 0; i < ent->keys.len; i++) {
+        if (ent->keys.val[i].key.keytype == ETYPE_DES_CBC_MD4 ||
+            ent->keys.val[i].key.keytype == ETYPE_DES_CBC_MD5)
+            continue;
+        sz = append_mit_key(context, sp, ent->principal, ent->kvno,
+                            &ent->keys.val[i]);
+        if (sz == -1) return ENOMEM;
+    }
+    for (i = 0; hist_keys && i < ent->kvno; i++) {
+        size_t m;
+
+        /* dump historical keys */
+        for (k = 0; k < hist_keys->len; k++) {
+            if (hist_keys->val[k].kvno != ent->kvno - i)
+                continue;
+            for (m = 0; m < hist_keys->val[k].keys.len; m++) {
+                if (ent->keys.val[k].key.keytype == ETYPE_DES_CBC_MD4 ||
+                    ent->keys.val[k].key.keytype == ETYPE_DES_CBC_MD5)
+                    continue;
+                sz = append_mit_key(context, sp, ent->principal,
+                                    hist_keys->val[k].kvno,
+                                    &hist_keys->val[k].keys.val[m]);
+                if (sz == -1) return ENOMEM;
+            }
+        }
+    }
+    sz = append_string(context, sp, "\t-1;"); /* "extra data" */
+    if (sz == -1) return ENOMEM;
     return 0;
 }
 
 krb5_error_code
-hdb_entry2string (krb5_context context, hdb_entry *ent, char **str)
+hdb_entry2string(krb5_context context, hdb_entry *ent, char **str)
 {
     krb5_error_code ret;
     krb5_data data;
     krb5_storage *sp;
 
     sp = krb5_storage_emem();
-    if(sp == NULL) {
+    if (sp == NULL) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
 
     ret = entry2string_int(context, sp, ent);
-    if(ret) {
+    if (ret) {
 	krb5_storage_free(sp);
 	return ret;
     }
@@ -269,22 +558,31 @@ hdb_entry2string (krb5_context context, hdb_entry *ent, char **str)
 /* print a hdb_entry to (FILE*)data; suitable for hdb_foreach */
 
 krb5_error_code
-hdb_print_entry(krb5_context context, HDB *db, hdb_entry_ex *entry, void *data)
+hdb_print_entry(krb5_context context, HDB *db, hdb_entry_ex *entry,
+                void *data)
 {
+    struct hdb_print_entry_arg *parg = data;
     krb5_error_code ret;
     krb5_storage *sp;
 
-    FILE *f = data;
-
-    fflush(f);
-    sp = krb5_storage_from_fd(fileno(f));
-    if(sp == NULL) {
+    fflush(parg->out);
+    sp = krb5_storage_from_fd(fileno(parg->out));
+    if (sp == NULL) {
 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	return ENOMEM;
     }
 
-    ret = entry2string_int(context, sp, &entry->entry);
-    if(ret) {
+    switch (parg->fmt) {
+    case HDB_DUMP_HEIMDAL:
+        ret = entry2string_int(context, sp, &entry->entry);
+        break;
+    case HDB_DUMP_MIT:
+        ret = entry2mit_string_int(context, sp, &entry->entry);
+        break;
+    default:
+        heim_abort("Only two dump formats supported: Heimdal and MIT");
+    }
+    if (ret) {
 	krb5_storage_free(sp);
 	return ret;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/test_dbinfo.c b/crypto/external/bsd/heimdal/dist/lib/hdb/test_dbinfo.c
index 63c0cfa2c..5b7c1d2b2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/test_dbinfo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/test_dbinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_dbinfo.c,v 1.1.1.1 2011/04/13 18:14:42 elric Exp $	*/
+/*	$NetBSD: test_dbinfo.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -40,8 +40,8 @@ static int help_flag;
 static int version_flag;
 
 struct getargs args[] = {
-    { "help",		'h',	arg_flag,   &help_flag },
-    { "version",	0,	arg_flag,   &version_flag }
+    { "help",		'h',	arg_flag,   &help_flag,    NULL, NULL },
+    { "version",	0,	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbkeys.c b/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbkeys.c
index 6abde16f1..0eaa2cb95 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbkeys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbkeys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_hdbkeys.c,v 1.1.1.1 2011/04/13 18:14:42 elric Exp $	*/
+/*	$NetBSD: test_hdbkeys.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -42,9 +42,9 @@ static int version_flag;
 static int kvno_integer = 1;
 
 struct getargs args[] = {
-    { "kvno",		'd',	arg_integer, &kvno_integer },
-    { "help",		'h',	arg_flag,   &help_flag },
-    { "version",	0,	arg_flag,   &version_flag }
+    { "kvno",		'd',	arg_integer, &kvno_integer, NULL, NULL },
+    { "help",		'h',	arg_flag,    &help_flag,    NULL, NULL },
+    { "version",	0,	arg_flag,    &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
@@ -90,9 +90,13 @@ main(int argc, char **argv)
     memset(&keyset, 0, sizeof(keyset));
 
     keyset.kvno = kvno_integer;
+    keyset.set_time = malloc(sizeof (*keyset.set_time));
+    if (keyset.set_time == NULL)
+	errx(1, "couldn't allocate set_time field of keyset");
+    *keyset.set_time = time(NULL);
 
     ret = hdb_generate_key_set_password(context, principal, password_str,
-					&keyset.keys.val, &len);
+					NULL, 0, &keyset.keys.val, &len);
     if (ret)
 	krb5_err(context, 1, ret, "hdb_generate_key_set_password");
     keyset.keys.len = len;
@@ -110,7 +114,7 @@ main(int argc, char **argv)
 
     krb5_free_context(context);
 
-    ret = base64_encode(data, length, &str);
+    ret = rk_base64_encode(data, length, &str);
     if (ret < 0)
 	errx(1, "base64_encode");
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbplugin.c b/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbplugin.c
new file mode 100644
index 000000000..f04cd4cd3
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/test_hdbplugin.c
@@ -0,0 +1,109 @@
+/*	$NetBSD: test_hdbplugin.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
+
+/*
+ * Copyright (c) 2013 Jeffrey Clark
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "hdb_locl.h"
+
+struct hdb_called {
+    int create;
+    int init;
+    int fini;
+};
+struct hdb_called testresult;
+
+static krb5_error_code
+hdb_test_create(krb5_context context, struct HDB **db, const char *arg)
+{
+	testresult.create = 1;
+	return 0;
+}
+
+static krb5_error_code
+hdb_test_init(krb5_context context, void **ctx)
+{
+	*ctx = NULL;
+	testresult.init = 1;
+	return 0;
+}
+
+static void hdb_test_fini(void *ctx)
+{
+	testresult.fini = 1;
+}
+
+struct hdb_method hdb_test =
+{
+#ifdef WIN32
+	/* Not c99 */
+	HDB_INTERFACE_VERSION,
+	hdb_test_init,
+	hdb_test_fini,
+	"test",
+	hdb_test_create
+#else
+	.version = HDB_INTERFACE_VERSION,
+	.init = hdb_test_init,
+	.fini = hdb_test_fini,
+	.prefix = "test",
+	.create = hdb_test_create
+#endif
+};
+
+int
+main(int argc, char **argv)
+{
+    krb5_error_code ret;
+    krb5_context context;
+    HDB *db;
+
+    setprogname(argv[0]);
+
+    ret = krb5_init_context(&context);
+    if (ret)
+	errx(1, "krb5_init_contex");
+
+    ret = krb5_plugin_register(context,
+		    PLUGIN_TYPE_DATA, "hdb_test_interface",
+		    &hdb_test);
+    if(ret) {
+	    krb5_err(context, 1, ret, "krb5_plugin_register");
+    }
+
+    ret = hdb_create(context, &db, "test:test&1234");
+    if(ret) {
+	    krb5_err(context, 1, ret, "hdb_create");
+    }
+
+    krb5_free_context(context);
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/test_mkey.c b/crypto/external/bsd/heimdal/dist/lib/hdb/test_mkey.c
index 6e0cbfe1e..00045a380 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/test_mkey.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/test_mkey.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_mkey.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $	*/
+/*	$NetBSD: test_mkey.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 
 #include "hdb_locl.h"
@@ -10,9 +10,9 @@ static int help_flag;
 static int version_flag;
 
 struct getargs args[] = {
-    { "mkey-file",	0,      arg_string, &mkey_file },
-    { "help",		'h',	arg_flag,   &help_flag },
-    { "version",	0,	arg_flag,   &version_flag }
+    { "mkey-file",	0,      arg_string, &mkey_file,    NULL, NULL },
+    { "help",		'h',	arg_flag,   &help_flag,    NULL, NULL },
+    { "version",	0,	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hdb/version-script.map b/crypto/external/bsd/heimdal/dist/lib/hdb/version-script.map
index b4437bab8..761ef77e0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hdb/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/hdb/version-script.map
@@ -4,6 +4,8 @@ HEIMDAL_HDB_1.0 {
 	global:
 		encode_hdb_keyset;
 		hdb_add_master_key;
+		hdb_add_current_keys_to_history;
+		hdb_change_kvno;
 		hdb_check_db_format;
 		hdb_clear_extension;
 		hdb_clear_master_key;
@@ -45,18 +47,21 @@ HEIMDAL_HDB_1.0 {
 		hdb_get_dbinfo;
 		hdb_init_db;
 		hdb_key2principal;
+		hdb_kvno2keys;
 		hdb_list_builtin;
 		hdb_lock;
 		hdb_next_enctype2key;
 		hdb_principal2key;
 		hdb_print_entry;
 		hdb_process_master_key;
+		hdb_prune_keys;
 		hdb_read_master_key;
 		hdb_replace_extension;
 		hdb_seal_key;
 		hdb_seal_key_mkey;
 		hdb_seal_keys;
 		hdb_seal_keys_mkey;
+                hdb_set_last_modified_by;
 		hdb_set_master_key;
 		hdb_set_master_keyfile;
 		hdb_unlock;
@@ -71,36 +76,52 @@ HEIMDAL_HDB_1.0 {
 		hdb_interface_version;
 		initialize_hdb_error_table_r;
 
+                # MIT KDB related entries
+                _hdb_mdb_value2entry;
+                _hdb_mit_dump2mitdb_entry;
+
 		hdb_kt_ops;
+		hdb_get_kt_ops;
 
 		# some random bits needed for libkadm
-		HDBFlags2int;
+		add_HDB_Ext_KeySet;
+		add_Keys;
 		asn1_HDBFlags_units;
 		copy_Event;
 		copy_HDB_extensions;
 		copy_Key;
+		copy_Keys;
 		copy_Salt;
 		decode_HDB_Ext_Aliases;
-		decode_HDB_Ext_PKINIT_acl;
 		decode_HDB_extension;
+		decode_HDB_Ext_PKINIT_acl;
 		decode_Key;
+		decode_Keys;
 		encode_HDB_Ext_Aliases;
-		encode_HDB_Ext_PKINIT_acl;
 		encode_HDB_extension;
+		encode_HDB_Ext_PKINIT_acl;
 		encode_Key;
+		encode_Keys;
 		free_Event;
+		free_hdb_entry;
 		free_HDB_Ext_Aliases;
-		free_HDB_Ext_PKINIT_acl;
 		free_HDB_extension;
 		free_HDB_extensions;
+		free_HDB_Ext_PKINIT_acl;
+		free_hdb_keyset;
 		free_Key;
+		free_Keys;
 		free_Salt;
-		free_hdb_entry;
+		HDBFlags2int;
 		int2HDBFlags;
 		length_HDB_Ext_Aliases;
-		length_HDB_Ext_PKINIT_acl;
 		length_HDB_extension;
+		length_HDB_Ext_PKINIT_acl;
 		length_Key;
+		length_Keys;
+		remove_Keys;
+		add_Keys;
+		add_HDB_Ext_KeySet;
 
 	local:
 		*;
diff --git a/crypto/external/bsd/heimdal/dist/lib/heimdal/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/heimdal/NTMakefile
index 833f4ebe2..b206cd3a8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/heimdal/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/heimdal/NTMakefile
@@ -54,6 +54,11 @@ DLLSDKDEPS= \
 	dnsapi.lib      \
         shlwapi.lib
 
+dlllflags=$(dlllflags) /DELAYLOAD:bcrypt.dll
+DLLSDKDEPS=$(DLLSDKDEPS)\
+	bcrypt.lib	\
+	delayimp.lib 
+
 DEF=$(OBJ)\heimdal.def
 
 RES=$(OBJ)\heimdal-version.res
@@ -88,6 +93,3 @@ $(LIBHEIMDAL): $(LIBASN1) $(LIBWIND) $(LIBHCRYPTO) $(LIBHX509) $(LIBKRB5) $(LIBH
 !endif
 
 all:: $(LIBHEIMDAL)
-
-clean::
-	-$(RM) $(LIBHEIMDAL)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ChangeLog b/crypto/external/bsd/heimdal/dist/lib/hx509/ChangeLog
index d00f1f3c7..8185dabe5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ChangeLog
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ChangeLog
@@ -2430,7 +2430,7 @@
 	* ks_p11.c: Implement rsa_private_decrypt and add stubs for public
 	ditto.
 
-	* ks_p11.c: Less printf, less memory leaks.
+	* ks_p11.c: Less __printf__, less memory leaks.
 
 	* ks_p11.c: Implement signing using pkcs11.
 	
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/hx509/Makefile.am
index 53669cb7c..b58deb3e3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/Makefile.am
@@ -1,5 +1,7 @@
 include $(top_srcdir)/Makefile.am.common
 
+AM_CPPFLAGS += $(INCLUDE_openssl_crypto)
+
 lib_LTLIBRARIES = libhx509.la
 libhx509_la_LDFLAGS = -version-info 5:0:0
 
@@ -58,12 +60,11 @@ dist_libhx509_la_SOURCES = \
 	cms.c \
 	collector.c \
 	crypto.c \
+	crypto-ec.c \
 	doxygen.c \
 	error.c \
 	env.c \
 	file.c \
-	hx509-private.h \
-	hx509-protos.h \
 	hx509.h \
 	hx_locl.h \
 	sel.c \
@@ -94,8 +95,10 @@ libhx509_la_DEPENDENCIES = version-script.map
 libhx509_la_LIBADD = \
 	$(LIB_com_err) \
 	$(LIB_hcrypto) \
+	$(LIB_openssl_crypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(top_builddir)/lib/wind/libwind.la \
+	$(top_builddir)/lib/base/libheimbase.la \
 	$(LIBADD_roken) \
 	$(LIB_dlopen)
 
@@ -108,14 +111,15 @@ libhx509_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 $(libhx509_la_OBJECTS): $(srcdir)/version-script.map $(nodist_include_HEADERS) $(priv_headers)
 
-libhx509_la_CPPFLAGS = -I$(srcdir)/ref $(INCLUDE_hcrypto)
 nodist_libhx509_la_SOURCES = $(BUILT_SOURCES)
 
 $(gen_files_ocsp) ocsp_asn1.hx ocsp_asn1-priv.hx: ocsp_asn1_files
 $(gen_files_pkcs10) pkcs10_asn1.hx pkcs10_asn1-priv.hx: pkcs10_asn1_files
 $(gen_files_crmf) crmf_asn1.hx crmf_asn1-priv.hx: crmf_asn1_files
 
-dist_include_HEADERS = hx509.h hx509-protos.h
+dist_include_HEADERS = hx509.h $(srcdir)/hx509-protos.h
+
+noinst_HEADERS = $(srcdir)/hx509-private.h
 
 nodist_include_HEADERS = hx509_err.h
 nodist_include_HEADERS += ocsp_asn1.h
@@ -128,34 +132,40 @@ priv_headers += crmf_asn1-priv.h
 
 
 ocsp_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/ocsp.asn1 $(srcdir)/ocsp.opt
-	$(ASN1_COMPILE) --option-file=$(srcdir)/ocsp.opt $(srcdir)/ocsp.asn1 ocsp_asn1 || (rm -f ocsp_asn1_files ; exit 1)
+	$(heim_verbose)$(ASN1_COMPILE) --option-file=$(srcdir)/ocsp.opt $(srcdir)/ocsp.asn1 ocsp_asn1 || (rm -f ocsp_asn1_files ; exit 1)
 
 pkcs10_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/pkcs10.asn1 $(srcdir)/pkcs10.opt
-	$(ASN1_COMPILE) --option-file=$(srcdir)/pkcs10.opt $(srcdir)/pkcs10.asn1 pkcs10_asn1 || (rm -f pkcs10_asn1_files ; exit 1)
+	$(heim_verbose)$(ASN1_COMPILE) --option-file=$(srcdir)/pkcs10.opt $(srcdir)/pkcs10.asn1 pkcs10_asn1 || (rm -f pkcs10_asn1_files ; exit 1)
 
 crmf_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/crmf.asn1
-	$(ASN1_COMPILE) $(srcdir)/crmf.asn1 crmf_asn1 || (rm -f crmf_asn1_files ; exit 1)
+	$(heim_verbose)$(ASN1_COMPILE) $(srcdir)/crmf.asn1 crmf_asn1 || (rm -f crmf_asn1_files ; exit 1)
 
-$(libhx509_la_OBJECTS): $(srcdir)/hx509-protos.h $(srcdir)/hx509-private.h $(srcdir)/hx_locl.h
+ALL_OBJECTS  = $(libhx509_la_OBJECTS)
+ALL_OBJECTS += $(hxtool_OBJECTS)
+
+HX509_PROTOS = $(srcdir)/hx509-protos.h $(srcdir)/hx509-private.h
+
+$(ALL_OBJECTS): $(HX509_PROTOS)
+
+$(libhx509_la_OBJECTS): $(srcdir)/hx_locl.h
 $(libhx509_la_OBJECTS): ocsp_asn1.h pkcs10_asn1.h
 
-$(srcdir)/hx509-protos.h:
-	cd $(srcdir) && perl ../../cf/make-proto.pl -R '^(_|^C)' -E HX509_LIB -q -P comment -o hx509-protos.h $(dist_libhx509_la_SOURCES) || rm -f hx509-protos.h
+$(srcdir)/hx509-protos.h: $(dist_libhx509_la_SOURCES)
+	$(heim_verbose)cd $(srcdir) && perl ../../cf/make-proto.pl -R '^(_|^C)' -E HX509_LIB -q -P comment -o hx509-protos.h $(dist_libhx509_la_SOURCES) || rm -f hx509-protos.h
 
-$(srcdir)/hx509-private.h:
-	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p hx509-private.h $(dist_libhx509_la_SOURCES) || rm -f hx509-private.h
+$(srcdir)/hx509-private.h: $(dist_libhx509_la_SOURCES)
+	$(heim_verbose)cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p hx509-private.h $(dist_libhx509_la_SOURCES) || rm -f hx509-private.h
 
 bin_PROGRAMS = hxtool
 
 hxtool-commands.c hxtool-commands.h: hxtool-commands.in $(SLC)
-	$(SLC) $(srcdir)/hxtool-commands.in
+	$(heim_verbose)$(SLC) $(srcdir)/hxtool-commands.in
 
 dist_hxtool_SOURCES = hxtool.c
 nodist_hxtool_SOURCES = hxtool-commands.c hxtool-commands.h
 
-$(hxtool_OBJECTS): hxtool-commands.h
+$(hxtool_OBJECTS): hxtool-commands.h hx509_err.h
 
-hxtool_CPPFLAGS = $(INCLUDE_hcrypto)
 hxtool_LDADD = \
 	libhx509.la \
 	$(top_builddir)/lib/asn1/libasn1.la \
@@ -165,11 +175,11 @@ hxtool_LDADD = \
 
 CLEANFILES = $(BUILT_SOURCES) sel-gram.c sel-lex.c \
 	$(gen_files_ocsp) ocsp_asn1_files ocsp_asn1{,-priv}.h* \
-	ocsp_asn1-template.[ch]* \
+	ocsp_asn1-template.[chx]* \
 	$(gen_files_pkcs10) pkcs10_asn1_files pkcs10_asn1{,-priv}.h* \
-	pkcs10_asn1-template.[ch]* \
+	pkcs10_asn1-template.[chx]* \
 	$(gen_files_crmf) crmf_asn1_files crmf_asn1{,-priv}.h* \
-	crmf_asn1-template.[ch]* \
+	crmf_asn1-template.[chx]* \
 	$(TESTS) \
 	hxtool-commands.c hxtool-commands.h *.tmp \
 	request.out \
@@ -198,11 +208,10 @@ check_PROGRAMS = $(PROGRAM_TESTS) test_soft_pkcs11
 
 LDADD = libhx509.la
 
-test_soft_pkcs11_LDADD = libhx509.la
-test_soft_pkcs11_CPPFLAGS = -I$(srcdir)/ref
+test_soft_pkcs11_LDADD = libhx509.la $(top_builddir)/lib/asn1/libasn1.la
 
-test_name_CPPFLAGS = $(INCLUDE_hcrypto)
-test_name_LDADD = libhx509.la $(LIB_roken)
+test_name_LDADD = libhx509.la $(LIB_roken) $(top_builddir)/lib/asn1/libasn1.la
+test_expr_LDADD = libhx509.la $(LIB_roken) $(top_builddir)/lib/asn1/libasn1.la
 
 TESTS = $(SCRIPT_TESTS) $(PROGRAM_TESTS)
 
@@ -226,78 +235,78 @@ SCRIPT_TESTS = 			\
 	test_windows		\
 	test_query
 
-do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
+do_subst = $(heim_verbose)sed -e 's,[@]srcdir[@],$(srcdir),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/lib/hx509,g' \
 	-e 's,[@]egrep[@],$(EGREP),g'
 
 test_ca: test_ca.in Makefile
 	$(do_subst) < $(srcdir)/test_ca.in > test_ca.tmp
-	chmod +x test_ca.tmp
+	$(heim_verbose)chmod +x test_ca.tmp
 	mv test_ca.tmp test_ca
 
 test_cert: test_cert.in Makefile
 	$(do_subst) < $(srcdir)/test_cert.in > test_cert.tmp
-	chmod +x test_cert.tmp
+	$(heim_verbose)chmod +x test_cert.tmp
 	mv test_cert.tmp test_cert
 
 test_chain: test_chain.in Makefile
 	$(do_subst) < $(srcdir)/test_chain.in > test_chain.tmp
-	chmod +x test_chain.tmp
+	$(heim_verbose)chmod +x test_chain.tmp
 	mv test_chain.tmp test_chain
 
 test_cms: test_cms.in Makefile
 	$(do_subst) < $(srcdir)/test_cms.in > test_cms.tmp
-	chmod +x test_cms.tmp
+	$(heim_verbose)chmod +x test_cms.tmp
 	mv test_cms.tmp test_cms
 
 test_crypto: test_crypto.in Makefile
 	$(do_subst) < $(srcdir)/test_crypto.in > test_crypto.tmp
-	chmod +x test_crypto.tmp
+	$(heim_verbose)chmod +x test_crypto.tmp
 	mv test_crypto.tmp test_crypto
 
 test_nist: test_nist.in Makefile
 	$(do_subst) < $(srcdir)/test_nist.in > test_nist.tmp
-	chmod +x test_nist.tmp
+	$(heim_verbose)chmod +x test_nist.tmp
 	mv test_nist.tmp test_nist
 
 test_nist2: test_nist2.in Makefile
 	$(do_subst) < $(srcdir)/test_nist2.in > test_nist2.tmp
-	chmod +x test_nist2.tmp
+	$(heim_verbose)chmod +x test_nist2.tmp
 	mv test_nist2.tmp test_nist2
 
 test_pkcs11: test_pkcs11.in Makefile
 	$(do_subst) < $(srcdir)/test_pkcs11.in > test_pkcs11.tmp
-	chmod +x test_pkcs11.tmp
+	$(heim_verbose)chmod +x test_pkcs11.tmp
 	mv test_pkcs11.tmp test_pkcs11
 
 test_java_pkcs11: test_java_pkcs11.in Makefile
 	$(do_subst) < $(srcdir)/test_java_pkcs11.in > test_java_pkcs11.tmp
-	chmod +x test_java_pkcs11.tmp
+	$(heim_verbose)chmod +x test_java_pkcs11.tmp
 	mv test_java_pkcs11.tmp test_java_pkcs11
 
 test_nist_cert: test_nist_cert.in Makefile
 	$(do_subst) < $(srcdir)/test_nist_cert.in > test_nist_cert.tmp
-	chmod +x test_nist_cert.tmp
+	$(heim_verbose)chmod +x test_nist_cert.tmp
 	mv test_nist_cert.tmp test_nist_cert
 
 test_nist_pkcs12: test_nist_pkcs12.in Makefile
 	$(do_subst) < $(srcdir)/test_nist_pkcs12.in > test_nist_pkcs12.tmp
-	chmod +x test_nist_pkcs12.tmp
+	$(heim_verbose)chmod +x test_nist_pkcs12.tmp
 	mv test_nist_pkcs12.tmp test_nist_pkcs12
 
 test_req: test_req.in Makefile
 	$(do_subst) < $(srcdir)/test_req.in > test_req.tmp
-	chmod +x test_req.tmp
+	$(heim_verbose)chmod +x test_req.tmp
 	mv test_req.tmp test_req
 
 test_windows: test_windows.in Makefile
 	$(do_subst) < $(srcdir)/test_windows.in > test_windows.tmp
-	chmod +x test_windows.tmp
+	$(heim_verbose)chmod +x test_windows.tmp
 	mv test_windows.tmp test_windows
 
 test_query: test_query.in Makefile
 	$(do_subst) < $(srcdir)/test_query.in > test_query.tmp
-	chmod +x test_query.tmp
+	$(heim_verbose)chmod +x test_query.tmp
 	mv test_query.tmp test_query
 
 EXTRA_DIST = \
@@ -338,16 +347,22 @@ EXTRA_DIST = \
 	tst-crypto-select5 \
 	tst-crypto-select6 \
 	tst-crypto-select7 \
+	data/PKITS_data.zip \
+	data/eccurve.pem \
+	data/https.crt \
+	data/https.key \
+	data/mkcert.sh \
+	data/nist-result2 \
 	data/n0ll.pem \
-	data/secp160r1TestCA.cert.pem \
-	data/secp160r1TestCA.key.pem \
-	data/secp160r1TestCA.pem \
-	data/secp160r2TestClient.cert.pem \
-	data/secp160r2TestClient.key.pem \
-	data/secp160r2TestClient.pem \
-	data/secp160r2TestServer.cert.pem \
-	data/secp160r2TestServer.key.pem \
-	data/secp160r2TestServer.pem \
+	data/secp256r1TestCA.cert.pem \
+	data/secp256r1TestCA.key.pem \
+	data/secp256r1TestCA.pem \
+	data/secp256r2TestClient.cert.pem \
+	data/secp256r2TestClient.key.pem \
+	data/secp256r2TestClient.pem \
+	data/secp256r2TestServer.cert.pem \
+	data/secp256r2TestServer.key.pem \
+	data/secp256r2TestServer.pem \
 	data/bleichenbacher-bad.pem \
 	data/bleichenbacher-good.pem \
 	data/bleichenbacher-sf-pad-correct.pem \
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/hx509/NTMakefile
index 99116d76e..871c4ee5a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2009, Secure Endpoints Inc.
+# Copyright (c) 2009-2016, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
 # 
 
 RELDIR=lib\hx509
-intcflags=-I$(SRCDIR)\ref -I$(OBJ)
+intcflags=-I$(OBJ)
 localcflags=-DASN1_LIB
 
 !include ../../windows/NTMakefile.w32
@@ -47,6 +47,7 @@ libhx509_la_OBJS =			\
 	$(OBJ)\cms.obj			\
 	$(OBJ)\collector.obj		\
 	$(OBJ)\crypto.obj		\
+	$(OBJ)\crypto-ec.obj		\
 	$(OBJ)\error.obj		\
 	$(OBJ)\env.obj			\
 	$(OBJ)\file.obj			\
@@ -81,6 +82,7 @@ dist_libhx509_la_SOURCES =	\
 	$(SRCDIR)\cms.c		\
 	$(SRCDIR)\collector.c	\
 	$(SRCDIR)\crypto.c	\
+	$(SRCDIR)\crypto-ec.c	\
 	$(SRCDIR)\doxygen.c	\
 	$(SRCDIR)\error.c	\
 	$(SRCDIR)\env.c		\
@@ -162,7 +164,7 @@ $(OBJ)\hxtool-commands.c $(OBJ)\hxtool-commands.h: hxtool-commands.in $(SLC)
 	cd $(SRCDIR)
 
 $(BINDIR)\hxtool.exe: $(OBJ)\tool\hxtool.obj $(OBJ)\tool\hxtool-commands.obj $(LIBHEIMDAL) $(OBJ)\hxtool-version.res
-	$(EXECONLINK) $(LIBHEIMDAL) $(LIBROKEN) $(LIBSL) $(LIBVERS) $(LIBCOMERR)
+	$(EXECONLINK) $(LIBHEIMDAL) $(LIBROKEN) $(LIBSL) $(LIBVERS) $(LIBCOMERR) $(LIB_openssl_crypto)
 	$(EXEPREP)
 
 $(OBJ)\hx509-protos.h:
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ca.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ca.c
index f2e455b85..a5d17899f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ca.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ca.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ca.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: ca.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2010 Kungliga Tekniska Högskolan
@@ -63,7 +63,7 @@ struct hx509_ca_tbs {
     CRLDistributionPoints crldp;
     heim_bit_string subjectUniqueID;
     heim_bit_string issuerUniqueID;
-
+    AlgorithmIdentifier *sigalg;
 };
 
 /**
@@ -111,6 +111,10 @@ hx509_ca_tbs_free(hx509_ca_tbs *tbs)
     der_free_bit_string(&(*tbs)->subjectUniqueID);
     der_free_bit_string(&(*tbs)->issuerUniqueID);
     hx509_name_free(&(*tbs)->subject);
+    if ((*tbs)->sigalg) {
+	free_AlgorithmIdentifier((*tbs)->sigalg);
+	free((*tbs)->sigalg);
+    }
 
     memset(*tbs, 0, sizeof(**tbs));
     free(*tbs);
@@ -890,7 +894,7 @@ hx509_ca_tbs_set_unique(hx509_context context,
  *
  * @param context A hx509 context.
  * @param tbs object to be signed.
- * @param env enviroment variable to expand variables in the subject
+ * @param env environment variable to expand variables in the subject
  * name, see hx509_env_init().
  *
  * @return An hx509 error code, see hx509_get_error_string().
@@ -906,6 +910,39 @@ hx509_ca_tbs_subject_expand(hx509_context context,
     return hx509_name_expand(context, tbs->subject, env);
 }
 
+/**
+ * Set signature algorithm on the to be signed certificate
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param sigalg signature algorithm to use
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
+int
+hx509_ca_tbs_set_signature_algorithm(hx509_context context,
+				     hx509_ca_tbs tbs,
+				     const AlgorithmIdentifier *sigalg)
+{
+    int ret;
+
+    tbs->sigalg = calloc(1, sizeof(*tbs->sigalg));
+    if (tbs->sigalg == NULL) {
+	hx509_set_error_string(context, 0, ENOMEM, "Out of memory");
+	return ENOMEM;
+    }
+    ret = copy_AlgorithmIdentifier(sigalg, tbs->sigalg);
+    if (ret) {
+	free(tbs->sigalg);
+	tbs->sigalg = NULL;
+	return ret;
+    }
+    return 0;
+}
+
 /*
  *
  */
@@ -967,8 +1004,8 @@ build_proxy_prefix(hx509_context context, const Name *issuer, Name *subject)
     }
 
     t = time(NULL);
-    asprintf(&tstr, "ts-%lu", (unsigned long)t);
-    if (tstr == NULL) {
+    ret = asprintf(&tstr, "ts-%lu", (unsigned long)t);
+    if (ret == -1 || tstr == NULL) {
 	hx509_set_error_string(context, 0, ENOMEM,
 			       "Failed to copy subject name");
 	return ENOMEM;
@@ -989,6 +1026,7 @@ ca_sign(hx509_context context,
 	const Name *issuername,
 	hx509_cert *certificate)
 {
+    heim_error_t error = NULL;
     heim_octet_string data;
     Certificate c;
     TBSCertificate *tbsc;
@@ -999,7 +1037,9 @@ ca_sign(hx509_context context,
     time_t notAfter;
     unsigned key_usage;
 
-    sigalg = _hx509_crypto_default_sig_alg;
+    sigalg = tbs->sigalg;
+    if (sigalg == NULL)
+	sigalg = _hx509_crypto_default_sig_alg;
 
     memset(&c, 0, sizeof(c));
 
@@ -1088,6 +1128,12 @@ ca_sign(hx509_context context,
 	    goto out;
 	}
     } else {
+	/*
+	 * If no explicit serial number is specified, 20 random bytes should be
+	 * sufficiently collision resistant.  Since the serial number must be a
+	 * positive integer, ensure minimal ASN.1 DER form by forcing the high
+	 * bit off and the next bit on (thus avoiding an all zero first octet).
+	 */
 	tbsc->serialNumber.length = 20;
 	tbsc->serialNumber.data = malloc(tbsc->serialNumber.length);
 	if (tbsc->serialNumber.data == NULL){
@@ -1095,9 +1141,9 @@ ca_sign(hx509_context context,
 	    hx509_set_error_string(context, 0, ret, "Out of memory");
 	    goto out;
 	}
-	/* XXX diffrent */
 	RAND_bytes(tbsc->serialNumber.data, tbsc->serialNumber.length);
 	((unsigned char *)tbsc->serialNumber.data)[0] &= 0x7f;
+	((unsigned char *)tbsc->serialNumber.data)[0] |= 0x40;
     }
     /* signature            AlgorithmIdentifier, */
     ret = copy_AlgorithmIdentifier(sigalg, &tbsc->signature);
@@ -1410,9 +1456,12 @@ ca_sign(hx509_context context,
     if (ret)
 	goto out;
 
-    ret = hx509_cert_init(context, &c, certificate);
-    if (ret)
+    *certificate = hx509_cert_init(context, &c, &error);
+    if (*certificate == NULL) {
+	ret = heim_error_get_code(error);
+	heim_release(error);
 	goto out;
+    }
 
     free_Certificate(&c);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/cert.c b/crypto/external/bsd/heimdal/dist/lib/hx509/cert.c
index 006c538be..00176495f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/cert.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/cert.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cert.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: cert.c,v 1.4 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -95,6 +95,14 @@ typedef struct hx509_name_constraints {
 #define GeneralSubtrees_SET(g,var) \
 	(g)->len = (var)->len, (g)->val = (var)->val;
 
+static void
+init_context_once(void *ignored)
+{
+
+    ENGINE_add_conf_module();
+    OpenSSL_add_all_algorithms();
+}
+
 /**
  * Creates a hx509 context that most functions in the library
  * uses. The context is only allowed to be used by one thread at each
@@ -110,10 +118,14 @@ typedef struct hx509_name_constraints {
 int
 hx509_context_init(hx509_context *context)
 {
+    static heim_base_once_t init_context = HEIM_BASE_ONCE_INIT;
+
     *context = calloc(1, sizeof(**context));
     if (*context == NULL)
 	return ENOMEM;
 
+    heim_base_once_f(&init_context, NULL, init_context_once);
+
     _hx509_ks_null_register(*context);
     _hx509_ks_mem_register(*context);
     _hx509_ks_file_register(*context);
@@ -122,9 +134,6 @@ hx509_context_init(hx509_context *context)
     _hx509_ks_dir_register(*context);
     _hx509_ks_keychain_register(*context);
 
-    ENGINE_add_conf_module();
-    OpenSSL_add_all_algorithms();
-
     (*context)->ocsp_time_diff = HX509_DEFAULT_OCSP_TIME_DIFF;
 
     initialize_hx_error_table_r(&(*context)->et_list);
@@ -211,42 +220,48 @@ _hx509_cert_get_version(const Certificate *t)
  *
  * @param context A hx509 context.
  * @param c
- * @param cert
+ * @param error
  *
- * @return Returns an hx509 error code.
+ * @return Returns an hx509 certificate
  *
  * @ingroup hx509_cert
  */
 
-int
-hx509_cert_init(hx509_context context, const Certificate *c, hx509_cert *cert)
+hx509_cert
+hx509_cert_init(hx509_context context, const Certificate *c, heim_error_t *error)
 {
+    hx509_cert cert;
     int ret;
 
-    *cert = malloc(sizeof(**cert));
-    if (*cert == NULL)
-	return ENOMEM;
-    (*cert)->ref = 1;
-    (*cert)->friendlyname = NULL;
-    (*cert)->attrs.len = 0;
-    (*cert)->attrs.val = NULL;
-    (*cert)->private_key = NULL;
-    (*cert)->basename = NULL;
-    (*cert)->release = NULL;
-    (*cert)->ctx = NULL;
+    cert = malloc(sizeof(*cert));
+    if (cert == NULL) {
+	if (error)
+	    *error = heim_error_create_enomem();
+	return NULL;
+    }
+    cert->ref = 1;
+    cert->friendlyname = NULL;
+    cert->attrs.len = 0;
+    cert->attrs.val = NULL;
+    cert->private_key = NULL;
+    cert->basename = NULL;
+    cert->release = NULL;
+    cert->ctx = NULL;
 
-    (*cert)->data = calloc(1, sizeof(*(*cert)->data));
-    if ((*cert)->data == NULL) {
-	free(*cert);
-	return ENOMEM;
+    cert->data = calloc(1, sizeof(*(cert->data)));
+    if (cert->data == NULL) {
+	free(cert);
+	if (error)
+	    *error = heim_error_create_enomem();
+	return NULL;
     }
-    ret = copy_Certificate(c, (*cert)->data);
+    ret = copy_Certificate(c, cert->data);
     if (ret) {
-	free((*cert)->data);
-	free(*cert);
-	*cert = NULL;
+	free(cert->data);
+	free(cert);
+	cert = NULL;
     }
-    return ret;
+    return cert;
 }
 
 /**
@@ -261,39 +276,41 @@ hx509_cert_init(hx509_context context, const Certificate *c, hx509_cert *cert)
  * @param context A hx509 context.
  * @param ptr pointer to memory region containing encoded certificate.
  * @param len length of memory region.
- * @param cert a return pointer to a hx509 certificate object, will
- * contain NULL on error.
+ * @param error possibly returns an error
  *
- * @return An hx509 error code, see hx509_get_error_string().
+ * @return An hx509 certificate
  *
  * @ingroup hx509_cert
  */
 
-int
+hx509_cert
 hx509_cert_init_data(hx509_context context,
 		     const void *ptr,
 		     size_t len,
-		     hx509_cert *cert)
+		     heim_error_t *error)
 {
+    hx509_cert cert;
     Certificate t;
     size_t size;
     int ret;
 
     ret = decode_Certificate(ptr, len, &t, &size);
     if (ret) {
-	hx509_set_error_string(context, 0, ret, "Failed to decode certificate");
-	return ret;
+	if (error)
+	    *error = heim_error_create(ret, "Failed to decode certificate");
+	return NULL;
     }
     if (size != len) {
 	free_Certificate(&t);
-	hx509_set_error_string(context, 0, HX509_EXTRA_DATA_AFTER_STRUCTURE,
-			       "Extra data after certificate");
-	return HX509_EXTRA_DATA_AFTER_STRUCTURE;
+	if (error)
+	    *error = heim_error_create(HX509_EXTRA_DATA_AFTER_STRUCTURE,
+				       "Extra data after certificate");
+	return NULL;
     }
 
-    ret = hx509_cert_init(context, &t, cert);
+    cert = hx509_cert_init(context, &t, error);
     free_Certificate(&t);
-    return ret;
+    return cert;
 }
 
 void
@@ -829,7 +846,8 @@ check_key_usage(hx509_context context, const Certificate *cert,
 	_hx509_unparse_Name(&cert->tbsCertificate.subject, &name);
 	hx509_set_error_string(context, 0, HX509_KU_CERT_MISSING,
 			       "Key usage %s required but missing "
-			       "from certifiate %s", buf, name);
+			       "from certifiate %s", buf,
+                               name ? name : "<unknown>");
 	free(name);
 	return HX509_KU_CERT_MISSING;
     }
@@ -972,7 +990,7 @@ _hx509_cert_is_parent_cmp(const Certificate *subject,
 	if (ai.authorityCertIssuer->val[0].element != choice_GeneralName_directoryName)
 	    return -1;
 
-	name.element =
+	name.element = (enum Name_enum)
 	    ai.authorityCertIssuer->val[0].u.directoryName.element;
 	name.u.rdnSequence =
 	    ai.authorityCertIssuer->val[0].u.directoryName.u.rdnSequence;
@@ -1805,12 +1823,12 @@ match_general_name(const GeneralName *c, const GeneralName *n, int *match)
 
 	c_name._save.data = NULL;
 	c_name._save.length = 0;
-	c_name.element = c->u.directoryName.element;
+	c_name.element = (enum Name_enum)c->u.directoryName.element;
 	c_name.u.rdnSequence = c->u.directoryName.u.rdnSequence;
 
 	n_name._save.data = NULL;
 	n_name._save.length = 0;
-	n_name.element = n->u.directoryName.element;
+	n_name.element = (enum Name_enum)n->u.directoryName.element;
 	n_name.u.rdnSequence = n->u.directoryName.u.rdnSequence;
 
 	ret = match_X501Name(&c_name, &n_name);
@@ -1831,7 +1849,7 @@ match_alt_name(const GeneralName *n, const Certificate *c,
 	       int *same, int *match)
 {
     GeneralNames sa;
-    int ret;
+    int ret = 0;
     size_t i, j;
 
     i = 0;
@@ -1846,7 +1864,7 @@ match_alt_name(const GeneralName *n, const Certificate *c,
 	for (j = 0; j < sa.len; j++) {
 	    if (n->element == sa.val[j].element) {
 		*same = 1;
-		ret = match_general_name(n, &sa.val[j], match);
+		match_general_name(n, &sa.val[j], match);
 	    }
 	}
 	free_GeneralNames(&sa);
@@ -1880,12 +1898,12 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
 
 	    memset(&certname, 0, sizeof(certname));
 	    certname.element = choice_GeneralName_directoryName;
-	    certname.u.directoryName.element =
+	    certname.u.directoryName.element = (enum GeneralName_directoryName_enum)
 		c->tbsCertificate.subject.element;
 	    certname.u.directoryName.u.rdnSequence =
 		c->tbsCertificate.subject.u.rdnSequence;
 
-	    ret = match_general_name(&t->val[i].base, &certname, &name);
+	    match_general_name(&t->val[i].base, &certname, &name);
 	}
 
 	/* Handle subjectAltNames, this is icky since they
@@ -1893,7 +1911,7 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
 	 * same type. So if there have been a match of type, require
 	 * altname to be set.
 	 */
-	ret = match_alt_name(&t->val[i].base, c, &same, &alt_name);
+	match_alt_name(&t->val[i].base, c, &same, &alt_name);
     }
     if (name && (!same || alt_name))
 	*match = 1;
@@ -1987,6 +2005,16 @@ hx509_verify_path(hx509_context context,
 
     memset(&proxy_issuer, 0, sizeof(proxy_issuer));
 
+    if ((ctx->flags & HX509_VERIFY_CTX_F_ALLOW_PROXY_CERTIFICATE) == 0 &&
+	is_proxy_cert(context, cert->data, NULL) == 0)
+    {
+	ret = HX509_PROXY_CERT_INVALID;
+	hx509_set_error_string(context, 0, ret,
+			       "Proxy certificate is not allowed as an EE "
+			       "certificae if proxy certificate is disabled");
+	return ret;
+    }
+
     ret = init_name_constraints(&nc);
     if (ret)
 	return ret;
@@ -2355,20 +2383,12 @@ hx509_verify_path(hx509_context context,
 	    goto out;
 	}
 	/*
-	 * Verify that the sigature algorithm "best-before" date is
-	 * before the creation date of the certificate, do this for
-	 * trust anchors too, since any trust anchor that is created
-	 * after a algorithm is known to be bad deserved to be invalid.
-	 *
-	 * Skip the leaf certificate for now...
+	 * Verify that the sigature algorithm is not weak. Ignore
+	 * trust anchors since they are provisioned by the user.
 	 */
 
-	if (i != 0 && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) {
-	    time_t notBefore =
-		_hx509_Time2time_t(&c->tbsCertificate.validity.notBefore);
-	    ret = _hx509_signature_best_before(context,
-					       &c->signatureAlgorithm,
-					       notBefore);
+	if (i + 1 != path.len && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) {
+	    ret = _hx509_signature_is_weak(context, &c->signatureAlgorithm);
 	    if (ret)
 		goto out;
 	}
@@ -3386,7 +3406,7 @@ hx509_cert_binary(hx509_context context, hx509_cert c, heim_octet_string *os)
 
 void
 _hx509_abort(const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 1, 2)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 1, 2)))
 {
     va_list ap;
     va_start(ap, fmt);
@@ -3427,7 +3447,9 @@ _hx509_cert_to_env(hx509_context context, hx509_cert cert, hx509_env *env)
     *env = NULL;
 
     /* version */
-    asprintf(&buf, "%d", _hx509_cert_get_version(_hx509_get_cert(cert)));
+    ret = asprintf(&buf, "%d", _hx509_cert_get_version(_hx509_get_cert(cert)));
+    if (ret == -1)
+	goto out;
     ret = hx509_env_add(context, &envcert, "version", buf);
     free(buf);
     if (ret)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/char_map.h b/crypto/external/bsd/heimdal/dist/lib/hx509/char_map.h
index b94b38667..62bc62f3a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/char_map.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/char_map.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: char_map.h,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: char_map.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 #define Q_CONTROL_CHAR		1
 #define Q_PRINTABLE		2
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/cms.c b/crypto/external/bsd/heimdal/dist/lib/hx509/cms.c
index b63cda017..11db8d18e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/cms.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/cms.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cms.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: cms.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
@@ -211,7 +211,7 @@ unparse_CMSIdentifier(hx509_context context,
 		      CMSIdentifier *id,
 		      char **str)
 {
-    int ret;
+    int ret = -1;
 
     *str = NULL;
     switch (id->element) {
@@ -229,8 +229,8 @@ unparse_CMSIdentifier(hx509_context context,
 	    free(name);
 	    return ret;
 	}
-	asprintf(str, "certificate issued by %s with serial number %s",
-		 name, serial);
+	ret = asprintf(str, "certificate issued by %s with serial number %s",
+		       name, serial);
 	free(name);
 	free(serial);
 	break;
@@ -244,15 +244,19 @@ unparse_CMSIdentifier(hx509_context context,
 	if (len < 0)
 	    return ENOMEM;
 
-	asprintf(str, "certificate with id %s", keyid);
+	ret = asprintf(str, "certificate with id %s", keyid);
 	free(keyid);
 	break;
     }
     default:
-	asprintf(str, "certificate have unknown CMSidentifier type");
+	ret = asprintf(str, "certificate have unknown CMSidentifier type");
 	break;
     }
-    if (*str == NULL)
+    /*
+     * In the following if, we check ret and *str which should be returned/set
+     * by asprintf(3) in every branch of the switch statement.
+     */
+    if (ret == -1 || *str == NULL)
 	return ENOMEM;
     return 0;
 }
@@ -342,6 +346,8 @@ find_CMSIdentifier(hx509_context context,
  * @param contentType output type oid, should be freed with der_free_oid().
  * @param content the data, free with der_free_octet_string().
  *
+ * @return an hx509 error code.
+ *
  * @ingroup hx509_cms
  */
 
@@ -546,6 +552,8 @@ out:
  * @param content the output of the function,
  * free with der_free_octet_string().
  *
+ * @return an hx509 error code.
+ *
  * @ingroup hx509_cms
  */
 
@@ -728,14 +736,18 @@ any_to_certs(hx509_context context, const SignedData *sd, hx509_certs certs)
 	return 0;
 
     for (i = 0; i < sd->certificates->len; i++) {
+	heim_error_t error;
 	hx509_cert c;
 
-	ret = hx509_cert_init_data(context,
-				   sd->certificates->val[i].data,
-				   sd->certificates->val[i].length,
-				   &c);
-	if (ret)
+	c = hx509_cert_init_data(context,
+				 sd->certificates->val[i].data,
+				 sd->certificates->val[i].length,
+				 &error);
+	if (c == NULL) {
+	    ret = heim_error_get_code(error);
+	    heim_release(error);
 	    return ret;
+	}
 	ret = hx509_certs_add(context, certs, c);
 	hx509_cert_free(c);
 	if (ret)
@@ -774,6 +786,8 @@ find_attribute(const CMSAttributes *attr, const heim_oid *oid)
  * @param signer_certs list of the cerficates used to sign this
  * request, free with hx509_certs_free().
  *
+ * @return an hx509 error code.
+ *
  * @ingroup hx509_cms
  */
 
@@ -857,7 +871,7 @@ hx509_cms_verify_signed(hx509_context context,
     }
 
     for (found_valid_sig = 0, i = 0; i < sd.signerInfos.len; i++) {
-	heim_octet_string signed_data;
+	heim_octet_string signed_data = { 0, 0 };
 	const heim_oid *match_oid;
 	heim_oid decode_oid;
 
@@ -1018,8 +1032,10 @@ hx509_cms_verify_signed(hx509_context context,
 				       "Failed to verify signature in "
 				       "CMS SignedData");
 	}
-        if (signer_info->signedAttrs)
-	    free(signed_data.data);
+        if (signed_data.data != NULL && content->data != signed_data.data) {
+            free(signed_data.data);
+            signed_data.data = NULL;
+        }
 	if (ret)
 	    goto next_sigature;
 
@@ -1139,6 +1155,8 @@ add_one_attribute(Attribute **attr,
  * @param signed_data the output of the function, free with
  * der_free_octet_string().
  *
+ * @return Returns an hx509 error code.
+ *
  * @ingroup hx509_cms
  */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/collector.c b/crypto/external/bsd/heimdal/dist/lib/hx509/collector.c
index 4a191aedc..9a24945c4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/collector.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/collector.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: collector.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: collector.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/crypto-ec.c b/crypto/external/bsd/heimdal/dist/lib/hx509/crypto-ec.c
new file mode 100644
index 000000000..a23a38575
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/crypto-ec.c
@@ -0,0 +1,535 @@
+/*	$NetBSD: crypto-ec.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
+
+/*
+ * Copyright (c) 2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+#include <openssl/ec.h>
+#include <openssl/ecdsa.h>
+#include <openssl/rsa.h>
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#define HEIM_NO_CRYPTO_HDRS
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+#include "hx_locl.h"
+
+extern const AlgorithmIdentifier _hx509_signature_sha512_data;
+extern const AlgorithmIdentifier _hx509_signature_sha384_data;
+extern const AlgorithmIdentifier _hx509_signature_sha256_data;
+extern const AlgorithmIdentifier _hx509_signature_sha1_data;
+
+void
+_hx509_private_eckey_free(void *eckey)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    EC_KEY_free(eckey);
+#endif
+}
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+static int
+heim_oid2ecnid(heim_oid *oid)
+{
+    /*
+     * Now map to openssl OID fun
+     */
+
+    if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP256R1) == 0)
+	return NID_X9_62_prime256v1;
+#ifdef NID_secp521r1
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP521R1) == 0)
+        return NID_secp521r1;
+#endif
+#ifdef NID_secp384r1
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP384R1) == 0)
+        return NID_secp384r1;
+#endif
+#ifdef NID_secp160r1
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R1) == 0)
+	return NID_secp160r1;
+#endif
+#ifdef NID_secp160r2
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R2) == 0)
+	return NID_secp160r2;
+#endif
+
+    return NID_undef;
+}
+
+static int
+parse_ECParameters(hx509_context context,
+		   heim_octet_string *parameters, int *nid)
+{
+    ECParameters ecparam;
+    size_t size;
+    int ret;
+
+    if (parameters == NULL) {
+	ret = HX509_PARSING_KEY_FAILED;
+	hx509_set_error_string(context, 0, ret,
+			       "EC parameters missing");
+	return ret;
+    }
+
+    ret = decode_ECParameters(parameters->data, parameters->length,
+			      &ecparam, &size);
+    if (ret) {
+	hx509_set_error_string(context, 0, ret,
+			       "Failed to decode EC parameters");
+	return ret;
+    }
+
+    if (ecparam.element != choice_ECParameters_namedCurve) {
+	free_ECParameters(&ecparam);
+	hx509_set_error_string(context, 0, ret,
+			       "EC parameters is not a named curve");
+	return HX509_CRYPTO_SIG_INVALID_FORMAT;
+    }
+
+    *nid = heim_oid2ecnid(&ecparam.u.namedCurve);
+    free_ECParameters(&ecparam);
+    if (*nid == NID_undef) {
+	hx509_set_error_string(context, 0, ret,
+			       "Failed to find matcing NID for EC curve");
+	return HX509_CRYPTO_SIG_INVALID_FORMAT;
+    }
+    return 0;
+}
+
+
+/*
+ *
+ */
+
+static int
+ecdsa_verify_signature(hx509_context context,
+		       const struct signature_alg *sig_alg,
+		       const Certificate *signer,
+		       const AlgorithmIdentifier *alg,
+		       const heim_octet_string *data,
+		       const heim_octet_string *sig)
+{
+    const AlgorithmIdentifier *digest_alg;
+    const SubjectPublicKeyInfo *spi;
+    heim_octet_string digest;
+    int ret;
+    EC_KEY *key = NULL;
+    int groupnid;
+    EC_GROUP *group;
+    const unsigned char *p;
+    long len;
+
+    digest_alg = sig_alg->digest_alg;
+
+    ret = _hx509_create_signature(context,
+				  NULL,
+				  digest_alg,
+				  data,
+				  NULL,
+				  &digest);
+    if (ret)
+	return ret;
+
+    /* set up EC KEY */
+    spi = &signer->tbsCertificate.subjectPublicKeyInfo;
+
+    if (der_heim_oid_cmp(&spi->algorithm.algorithm, ASN1_OID_ID_ECPUBLICKEY) != 0)
+	return HX509_CRYPTO_SIG_INVALID_FORMAT;
+
+    /*
+     * Find the group id
+     */
+
+    ret = parse_ECParameters(context, spi->algorithm.parameters, &groupnid);
+    if (ret) {
+	der_free_octet_string(&digest);
+	return ret;
+    }
+
+    /*
+     * Create group, key, parse key
+     */
+
+    key = EC_KEY_new();
+    group = EC_GROUP_new_by_curve_name(groupnid);
+    EC_KEY_set_group(key, group);
+    EC_GROUP_free(group);
+
+    p = spi->subjectPublicKey.data;
+    len = spi->subjectPublicKey.length / 8;
+
+    if (o2i_ECPublicKey(&key, &p, len) == NULL) {
+	EC_KEY_free(key);
+	return HX509_CRYPTO_SIG_INVALID_FORMAT;
+    }
+
+    ret = ECDSA_verify(-1, digest.data, digest.length,
+		       sig->data, sig->length, key);
+    der_free_octet_string(&digest);
+    EC_KEY_free(key);
+    if (ret != 1) {
+	ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
+	return ret;
+    }
+
+    return 0;
+}
+
+static int
+ecdsa_create_signature(hx509_context context,
+		       const struct signature_alg *sig_alg,
+		       const hx509_private_key signer,
+		       const AlgorithmIdentifier *alg,
+		       const heim_octet_string *data,
+		       AlgorithmIdentifier *signatureAlgorithm,
+		       heim_octet_string *sig)
+{
+    const AlgorithmIdentifier *digest_alg;
+    heim_octet_string indata;
+    const heim_oid *sig_oid;
+    unsigned int siglen;
+    int ret;
+
+    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) != 0)
+	_hx509_abort("internal error passing private key to wrong ops");
+
+    sig_oid = sig_alg->sig_oid;
+    digest_alg = sig_alg->digest_alg;
+
+    if (signatureAlgorithm) {
+        ret = _hx509_set_digest_alg(signatureAlgorithm, sig_oid,
+                                    "\x05\x00", 2);
+	if (ret) {
+	    hx509_clear_error_string(context);
+	    return ret;
+	}
+    }
+
+    ret = _hx509_create_signature(context,
+				  NULL,
+				  digest_alg,
+				  data,
+				  NULL,
+				  &indata);
+    if (ret)
+	goto error;
+
+    sig->length = ECDSA_size(signer->private_key.ecdsa);
+    sig->data = malloc(sig->length);
+    if (sig->data == NULL) {
+	der_free_octet_string(&indata);
+	ret = ENOMEM;
+	hx509_set_error_string(context, 0, ret, "out of memory");
+	goto error;
+    }
+
+    siglen = sig->length;
+
+    ret = ECDSA_sign(-1, indata.data, indata.length,
+		     sig->data, &siglen, signer->private_key.ecdsa);
+    der_free_octet_string(&indata);
+    if (ret != 1) {
+	ret = HX509_CMS_FAILED_CREATE_SIGATURE;
+	hx509_set_error_string(context, 0, ret,
+			       "ECDSA sign failed: %d", ret);
+	goto error;
+    }
+    if (siglen > sig->length)
+	_hx509_abort("ECDSA signature prelen longer the output len");
+
+    sig->length = siglen;
+
+    return 0;
+ error:
+    if (signatureAlgorithm)
+	free_AlgorithmIdentifier(signatureAlgorithm);
+    return ret;
+}
+
+static int
+ecdsa_available(const hx509_private_key signer,
+		const AlgorithmIdentifier *sig_alg)
+{
+    const struct signature_alg *sig;
+    const EC_GROUP *group;
+    BN_CTX *bnctx = NULL;
+    BIGNUM *order = NULL;
+    int ret = 0;
+
+    if (der_heim_oid_cmp(signer->ops->key_oid, &asn1_oid_id_ecPublicKey) != 0)
+	_hx509_abort("internal error passing private key to wrong ops");
+
+    sig = _hx509_find_sig_alg(&sig_alg->algorithm);
+
+    if (sig == NULL || sig->digest_size == 0)
+	return 0;
+
+    group = EC_KEY_get0_group(signer->private_key.ecdsa);
+    if (group == NULL)
+	return 0;
+
+    bnctx = BN_CTX_new();
+    order = BN_new();
+    if (order == NULL)
+	goto err;
+
+    if (EC_GROUP_get_order(group, order, bnctx) != 1)
+	goto err;
+
+#if 0
+    /* If anything, require a digest at least as wide as the EC key size */
+    if (BN_num_bytes(order) > sig->digest_size)
+#endif
+	ret = 1;
+ err:
+    if (bnctx)
+	BN_CTX_free(bnctx);
+    if (order)
+	BN_clear_free(order);
+
+    return ret;
+}
+
+static int
+ecdsa_private_key2SPKI(hx509_context context,
+		       hx509_private_key private_key,
+		       SubjectPublicKeyInfo *spki)
+{
+    memset(spki, 0, sizeof(*spki));
+    return ENOMEM;
+}
+
+static int
+ecdsa_private_key_export(hx509_context context,
+			 const hx509_private_key key,
+			 hx509_key_format_t format,
+			 heim_octet_string *data)
+{
+    return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
+}
+
+static int
+ecdsa_private_key_import(hx509_context context,
+			 const AlgorithmIdentifier *keyai,
+			 const void *data,
+			 size_t len,
+			 hx509_key_format_t format,
+			 hx509_private_key private_key)
+{
+    const unsigned char *p = data;
+    EC_KEY **pkey = NULL;
+    EC_KEY *key;
+
+    if (keyai->parameters) {
+	EC_GROUP *group;
+	int groupnid;
+	int ret;
+
+	ret = parse_ECParameters(context, keyai->parameters, &groupnid);
+	if (ret)
+	    return ret;
+
+	key = EC_KEY_new();
+	if (key == NULL)
+	    return ENOMEM;
+
+	group = EC_GROUP_new_by_curve_name(groupnid);
+	if (group == NULL) {
+	    EC_KEY_free(key);
+	    return ENOMEM;
+	}
+	EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
+	if (EC_KEY_set_group(key, group) == 0) {
+	    EC_KEY_free(key);
+	    EC_GROUP_free(group);
+	    return ENOMEM;
+	}
+	EC_GROUP_free(group);
+	pkey = &key;
+    }
+
+    switch (format) {
+    case HX509_KEY_FORMAT_DER:
+
+	private_key->private_key.ecdsa = d2i_ECPrivateKey(pkey, &p, len);
+	if (private_key->private_key.ecdsa == NULL) {
+	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
+				   "Failed to parse EC private key");
+	    return HX509_PARSING_KEY_FAILED;
+	}
+	private_key->signature_alg = ASN1_OID_ID_ECDSA_WITH_SHA256;
+	break;
+
+    default:
+	return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
+    }
+
+    return 0;
+}
+
+static int
+ecdsa_generate_private_key(hx509_context context,
+			   struct hx509_generate_private_context *ctx,
+			   hx509_private_key private_key)
+{
+    return ENOMEM;
+}
+
+static BIGNUM *
+ecdsa_get_internal(hx509_context context,
+		   hx509_private_key key,
+		   const char *type)
+{
+    return NULL;
+}
+
+static const unsigned ecPublicKey[] ={ 1, 2, 840, 10045, 2, 1 };
+const AlgorithmIdentifier _hx509_signature_ecPublicKey = {
+    { 6, rk_UNCONST(ecPublicKey) }, NULL
+};
+
+static const unsigned ecdsa_with_sha256_oid[] ={ 1, 2, 840, 10045, 4, 3, 2 };
+const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha256_data = {
+    { 7, rk_UNCONST(ecdsa_with_sha256_oid) }, NULL
+};
+
+static const unsigned ecdsa_with_sha384_oid[] ={ 1, 2, 840, 10045, 4, 3, 3 };
+const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha384_data = {
+    { 7, rk_UNCONST(ecdsa_with_sha384_oid) }, NULL
+};
+
+static const unsigned ecdsa_with_sha512_oid[] ={ 1, 2, 840, 10045, 4, 3, 4 };
+const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha512_data = {
+    { 7, rk_UNCONST(ecdsa_with_sha512_oid) }, NULL
+};
+
+static const unsigned ecdsa_with_sha1_oid[] ={ 1, 2, 840, 10045, 4, 1 };
+const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha1_data = {
+    { 6, rk_UNCONST(ecdsa_with_sha1_oid) }, NULL
+};
+
+hx509_private_key_ops ecdsa_private_key_ops = {
+    "EC PRIVATE KEY",
+    ASN1_OID_ID_ECPUBLICKEY,
+    ecdsa_available,
+    ecdsa_private_key2SPKI,
+    ecdsa_private_key_export,
+    ecdsa_private_key_import,
+    ecdsa_generate_private_key,
+    ecdsa_get_internal
+};
+
+const struct signature_alg ecdsa_with_sha512_alg = {
+    "ecdsa-with-sha512",
+    ASN1_OID_ID_ECDSA_WITH_SHA512,
+    &_hx509_signature_ecdsa_with_sha512_data,
+    ASN1_OID_ID_ECPUBLICKEY,
+    &_hx509_signature_sha512_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|
+        SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    ecdsa_verify_signature,
+    ecdsa_create_signature,
+    64
+};
+
+const struct signature_alg ecdsa_with_sha384_alg = {
+    "ecdsa-with-sha384",
+    ASN1_OID_ID_ECDSA_WITH_SHA384,
+    &_hx509_signature_ecdsa_with_sha384_data,
+    ASN1_OID_ID_ECPUBLICKEY,
+    &_hx509_signature_sha384_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|
+        SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    ecdsa_verify_signature,
+    ecdsa_create_signature,
+    48
+};
+
+const struct signature_alg ecdsa_with_sha256_alg = {
+    "ecdsa-with-sha256",
+    ASN1_OID_ID_ECDSA_WITH_SHA256,
+    &_hx509_signature_ecdsa_with_sha256_data,
+    ASN1_OID_ID_ECPUBLICKEY,
+    &_hx509_signature_sha256_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|
+        SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    ecdsa_verify_signature,
+    ecdsa_create_signature,
+    32
+};
+
+const struct signature_alg ecdsa_with_sha1_alg = {
+    "ecdsa-with-sha1",
+    ASN1_OID_ID_ECDSA_WITH_SHA1,
+    &_hx509_signature_ecdsa_with_sha1_data,
+    ASN1_OID_ID_ECPUBLICKEY,
+    &_hx509_signature_sha1_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|
+        SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    ecdsa_verify_signature,
+    ecdsa_create_signature,
+    20
+};
+
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+
+const AlgorithmIdentifier *
+hx509_signature_ecPublicKey(void)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    return &_hx509_signature_ecPublicKey;
+#else
+    return NULL;
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+}
+
+const AlgorithmIdentifier *
+hx509_signature_ecdsa_with_sha256(void)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    return &_hx509_signature_ecdsa_with_sha256_data;
+#else
+    return NULL;
+#endif /* HAVE_HCRYPTO_W_OPENSSL */
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/crypto.c b/crypto/external/bsd/heimdal/dist/lib/hx509/crypto.c
index 3482dd22d..a02d4591f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/crypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/crypto.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: crypto.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: crypto.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
- * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -35,95 +35,12 @@
 
 #include "hx_locl.h"
 
-struct hx509_crypto;
-
-struct signature_alg;
-
-struct hx509_generate_private_context {
-    const heim_oid *key_oid;
-    int isCA;
-    unsigned long num_bits;
-};
-
-struct hx509_private_key_ops {
-    const char *pemtype;
-    const heim_oid *key_oid;
-    int (*available)(const hx509_private_key,
-		     const AlgorithmIdentifier *);
-    int (*get_spki)(hx509_context,
-		    const hx509_private_key,
-		    SubjectPublicKeyInfo *);
-    int (*export)(hx509_context context,
-		  const hx509_private_key,
-		  hx509_key_format_t,
-		  heim_octet_string *);
-    int (*import)(hx509_context, const AlgorithmIdentifier *,
-		  const void *, size_t, hx509_key_format_t,
-		  hx509_private_key);
-    int (*generate_private_key)(hx509_context,
-				struct hx509_generate_private_context *,
-				hx509_private_key);
-    BIGNUM *(*get_internal)(hx509_context, hx509_private_key, const char *);
-};
-
-struct hx509_private_key {
-    unsigned int ref;
-    const struct signature_alg *md;
-    const heim_oid *signature_alg;
-    union {
-	RSA *rsa;
-	void *keydata;
-#ifdef HAVE_OPENSSL
-	EC_KEY *ecdsa;
-#endif
-    } private_key;
-    hx509_private_key_ops *ops;
-};
-
-/*
- *
- */
-
-struct signature_alg {
-    const char *name;
-    const heim_oid *sig_oid;
-    const AlgorithmIdentifier *sig_alg;
-    const heim_oid *key_oid;
-    const AlgorithmIdentifier *digest_alg;
-    int flags;
-#define PROVIDE_CONF	0x1
-#define REQUIRE_SIGNER	0x2
-#define SELF_SIGNED_OK	0x4
-
-#define SIG_DIGEST	0x100
-#define SIG_PUBLIC_SIG	0x200
-#define SIG_SECRET	0x400
-
-#define RA_RSA_USES_DIGEST_INFO 0x1000000
-
-    time_t best_before; /* refuse signature made after best before date */
-    const EVP_MD *(*evp_md)(void);
-    int (*verify_signature)(hx509_context context,
-			    const struct signature_alg *,
-			    const Certificate *,
-			    const AlgorithmIdentifier *,
-			    const heim_octet_string *,
-			    const heim_octet_string *);
-    int (*create_signature)(hx509_context,
-			    const struct signature_alg *,
-			    const hx509_private_key,
-			    const AlgorithmIdentifier *,
-			    const heim_octet_string *,
-			    AlgorithmIdentifier *,
-			    heim_octet_string *);
-    int digest_size;
-};
-
-static const struct signature_alg *
-find_sig_alg(const heim_oid *oid);
-
-/*
+/*-
+ * RFC5758 specifies no parameters for ecdsa-with-SHA<N> signatures
+ * RFC5754 specifies NULL parameters for sha<N>WithRSAEncryption signatures
  *
+ * XXX: Make sure that the parameters are either NULL in both the tbs and the
+ * signature, or absent from both the tbs and the signature.
  */
 
 static const heim_octet_string null_entry_oid = { 2, rk_UNCONST("\x05\x00") };
@@ -153,44 +70,29 @@ const AlgorithmIdentifier _hx509_signature_md5_data = {
     { 6, rk_UNCONST(md5_oid_tree) }, rk_UNCONST(&null_entry_oid)
 };
 
-static const unsigned ecPublicKey[] ={ 1, 2, 840, 10045, 2, 1 };
-const AlgorithmIdentifier _hx509_signature_ecPublicKey = {
-    { 6, rk_UNCONST(ecPublicKey) }, NULL
-};
-
-static const unsigned ecdsa_with_sha256_oid[] ={ 1, 2, 840, 10045, 4, 3, 2 };
-const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha256_data = {
-    { 7, rk_UNCONST(ecdsa_with_sha256_oid) }, NULL
-};
-
-static const unsigned ecdsa_with_sha1_oid[] ={ 1, 2, 840, 10045, 4, 1 };
-const AlgorithmIdentifier _hx509_signature_ecdsa_with_sha1_data = {
-    { 6, rk_UNCONST(ecdsa_with_sha1_oid) }, NULL
-};
-
 static const unsigned rsa_with_sha512_oid[] ={ 1, 2, 840, 113549, 1, 1, 13 };
 const AlgorithmIdentifier _hx509_signature_rsa_with_sha512_data = {
-    { 7, rk_UNCONST(rsa_with_sha512_oid) }, NULL
+    { 7, rk_UNCONST(rsa_with_sha512_oid) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned rsa_with_sha384_oid[] ={ 1, 2, 840, 113549, 1, 1, 12 };
 const AlgorithmIdentifier _hx509_signature_rsa_with_sha384_data = {
-    { 7, rk_UNCONST(rsa_with_sha384_oid) }, NULL
+    { 7, rk_UNCONST(rsa_with_sha384_oid) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned rsa_with_sha256_oid[] ={ 1, 2, 840, 113549, 1, 1, 11 };
 const AlgorithmIdentifier _hx509_signature_rsa_with_sha256_data = {
-    { 7, rk_UNCONST(rsa_with_sha256_oid) }, NULL
+    { 7, rk_UNCONST(rsa_with_sha256_oid) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned rsa_with_sha1_oid[] ={ 1, 2, 840, 113549, 1, 1, 5 };
 const AlgorithmIdentifier _hx509_signature_rsa_with_sha1_data = {
-    { 7, rk_UNCONST(rsa_with_sha1_oid) }, NULL
+    { 7, rk_UNCONST(rsa_with_sha1_oid) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned rsa_with_md5_oid[] ={ 1, 2, 840, 113549, 1, 1, 4 };
 const AlgorithmIdentifier _hx509_signature_rsa_with_md5_data = {
-    { 7, rk_UNCONST(rsa_with_md5_oid) }, NULL
+    { 7, rk_UNCONST(rsa_with_md5_oid) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned rsa_oid[] ={ 1, 2, 840, 113549, 1, 1, 1 };
@@ -236,10 +138,10 @@ heim_int2BN(const heim_integer *i)
  *
  */
 
-static int
-set_digest_alg(DigestAlgorithmIdentifier *id,
-	       const heim_oid *oid,
-	       const void *param, size_t length)
+int
+_hx509_set_digest_alg(DigestAlgorithmIdentifier *id,
+                      const heim_oid *oid,
+                      const void *param, size_t length)
 {
     int ret;
     if (param) {
@@ -268,265 +170,6 @@ set_digest_alg(DigestAlgorithmIdentifier *id,
     return 0;
 }
 
-#ifdef HAVE_OPENSSL
-
-static int
-heim_oid2ecnid(heim_oid *oid)
-{
-    /*
-     * Now map to openssl OID fun
-     */
-
-    if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP256R1) == 0)
-	return NID_X9_62_prime256v1;
-    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R1) == 0)
-	return NID_secp160r1;
-    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R2) == 0)
-	return NID_secp160r2;
-
-    return -1;
-}
-
-static int
-parse_ECParameters(hx509_context context,
-		   heim_octet_string *parameters, int *nid)
-{
-    ECParameters ecparam;
-    size_t size;
-    int ret;
-
-    if (parameters == NULL) {
-	ret = HX509_PARSING_KEY_FAILED;
-	hx509_set_error_string(context, 0, ret,
-			       "EC parameters missing");
-	return ret;
-    }
-
-    ret = decode_ECParameters(parameters->data, parameters->length,
-			      &ecparam, &size);
-    if (ret) {
-	hx509_set_error_string(context, 0, ret,
-			       "Failed to decode EC parameters");
-	return ret;
-    }
-
-    if (ecparam.element != choice_ECParameters_namedCurve) {
-	free_ECParameters(&ecparam);
-	hx509_set_error_string(context, 0, ret,
-			       "EC parameters is not a named curve");
-	return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-
-    *nid = heim_oid2ecnid(&ecparam.u.namedCurve);
-    free_ECParameters(&ecparam);
-    if (*nid == -1) {
-	hx509_set_error_string(context, 0, ret,
-			       "Failed to find matcing NID for EC curve");
-	return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-    return 0;
-}
-
-
-/*
- *
- */
-
-static int
-ecdsa_verify_signature(hx509_context context,
-		       const struct signature_alg *sig_alg,
-		       const Certificate *signer,
-		       const AlgorithmIdentifier *alg,
-		       const heim_octet_string *data,
-		       const heim_octet_string *sig)
-{
-    const AlgorithmIdentifier *digest_alg;
-    const SubjectPublicKeyInfo *spi;
-    heim_octet_string digest;
-    int ret;
-    EC_KEY *key = NULL;
-    int groupnid;
-    EC_GROUP *group;
-    const unsigned char *p;
-    long len;
-
-    digest_alg = sig_alg->digest_alg;
-
-    ret = _hx509_create_signature(context,
-				  NULL,
-				  digest_alg,
-				  data,
-				  NULL,
-				  &digest);
-    if (ret)
-	return ret;
-
-    /* set up EC KEY */
-    spi = &signer->tbsCertificate.subjectPublicKeyInfo;
-
-    if (der_heim_oid_cmp(&spi->algorithm.algorithm, ASN1_OID_ID_ECPUBLICKEY) != 0)
-	return HX509_CRYPTO_SIG_INVALID_FORMAT;
-
-#ifdef HAVE_OPENSSL
-    /*
-     * Find the group id
-     */
-
-    ret = parse_ECParameters(context, spi->algorithm.parameters, &groupnid);
-    if (ret) {
-	der_free_octet_string(&digest);
-	return ret;
-    }
-
-    /*
-     * Create group, key, parse key
-     */
-
-    key = EC_KEY_new();
-    group = EC_GROUP_new_by_curve_name(groupnid);
-    EC_KEY_set_group(key, group);
-    EC_GROUP_free(group);
-
-    p = spi->subjectPublicKey.data;
-    len = spi->subjectPublicKey.length / 8;
-
-    if (o2i_ECPublicKey(&key, &p, len) == NULL) {
-	EC_KEY_free(key);
-	return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-#else
-    key = SubjectPublicKeyInfo2EC_KEY(spi);
-#endif
-
-    ret = ECDSA_verify(-1, digest.data, digest.length,
-		       sig->data, sig->length, key);
-    der_free_octet_string(&digest);
-    EC_KEY_free(key);
-    if (ret != 1) {
-	ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
-	return ret;
-    }
-
-    return 0;
-}
-
-static int
-ecdsa_create_signature(hx509_context context,
-		       const struct signature_alg *sig_alg,
-		       const hx509_private_key signer,
-		       const AlgorithmIdentifier *alg,
-		       const heim_octet_string *data,
-		       AlgorithmIdentifier *signatureAlgorithm,
-		       heim_octet_string *sig)
-{
-    const AlgorithmIdentifier *digest_alg;
-    heim_octet_string indata;
-    const heim_oid *sig_oid;
-    unsigned int siglen;
-    int ret;
-
-    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) != 0)
-	_hx509_abort("internal error passing private key to wrong ops");
-
-    sig_oid = sig_alg->sig_oid;
-    digest_alg = sig_alg->digest_alg;
-
-    if (signatureAlgorithm) {
-	ret = set_digest_alg(signatureAlgorithm, sig_oid, "\x05\x00", 2);
-	if (ret) {
-	    hx509_clear_error_string(context);
-	    goto error;
-	}
-    }
-
-    ret = _hx509_create_signature(context,
-				  NULL,
-				  digest_alg,
-				  data,
-				  NULL,
-				  &indata);
-    if (ret) {
-	if (signatureAlgorithm)
-	    free_AlgorithmIdentifier(signatureAlgorithm);
-	goto error;
-    }
-
-    sig->length = ECDSA_size(signer->private_key.ecdsa);
-    sig->data = malloc(sig->length);
-    if (sig->data == NULL) {
-	der_free_octet_string(&indata);
-	ret = ENOMEM;
-	hx509_set_error_string(context, 0, ret, "out of memory");
-	goto error;
-    }
-
-    siglen = sig->length;
-
-    ret = ECDSA_sign(-1, indata.data, indata.length,
-		     sig->data, &siglen, signer->private_key.ecdsa);
-    der_free_octet_string(&indata);
-    if (ret != 1) {
-	ret = HX509_CMS_FAILED_CREATE_SIGATURE;
-	hx509_set_error_string(context, 0, ret,
-			       "ECDSA sign failed: %d", ret);
-	goto error;
-    }
-    if (siglen > sig->length)
-	_hx509_abort("ECDSA signature prelen longer the output len");
-
-    sig->length = siglen;
-
-    return 0;
- error:
-    if (signatureAlgorithm)
-	free_AlgorithmIdentifier(signatureAlgorithm);
-    return ret;
-}
-
-static int
-ecdsa_available(const hx509_private_key signer,
-		const AlgorithmIdentifier *sig_alg)
-{
-    const struct signature_alg *sig;
-    const EC_GROUP *group;
-    BN_CTX *bnctx = NULL;
-    BIGNUM *order = NULL;
-    int ret = 0;
-
-    if (der_heim_oid_cmp(signer->ops->key_oid, &asn1_oid_id_ecPublicKey) != 0)
-	_hx509_abort("internal error passing private key to wrong ops");
-
-    sig = find_sig_alg(&sig_alg->algorithm);
-
-    if (sig == NULL || sig->digest_size == 0)
-	return 0;
-
-    group = EC_KEY_get0_group(signer->private_key.ecdsa);
-    if (group == NULL)
-	return 0;
-
-    bnctx = BN_CTX_new();
-    order = BN_new();
-    if (order == NULL)
-	goto err;
-
-    if (EC_GROUP_get_order(group, order, bnctx) != 1)
-	goto err;
-
-    if (BN_num_bytes(order) > sig->digest_size)
-	ret = 1;
- err:
-    if (bnctx)
-	BN_CTX_free(bnctx);
-    if (order)
-	BN_clear_free(order);
-
-    return ret;
-}
-
-
-#endif /* HAVE_OPENSSL */
-
 /*
  *
  */
@@ -621,6 +264,9 @@ rsa_verify_signature(hx509_context context,
 				      &di.digestAlgorithm,
 				      data,
 				      &di.digest);
+	if (ret)
+	    goto out;
+
     } else {
 	if ((size_t)retsize != data->length ||
 	    ct_memcmp(to, data->data, retsize) != 0)
@@ -630,8 +276,8 @@ rsa_verify_signature(hx509_context context,
 	    goto out;
 	}
 	free(to);
+	ret = 0;
     }
-    ret = 0;
 
  out:
     free_DigestInfo(&di);
@@ -685,7 +331,8 @@ rsa_create_signature(hx509_context context,
 	return HX509_ALG_NOT_SUPP;
 
     if (signatureAlgorithm) {
-	ret = set_digest_alg(signatureAlgorithm, sig_oid, "\x05\x00", 2);
+        ret = _hx509_set_digest_alg(signatureAlgorithm, sig_oid,
+                                    "\x05\x00", 2);
 	if (ret) {
 	    hx509_clear_error_string(context);
 	    return ret;
@@ -741,11 +388,13 @@ rsa_create_signature(hx509_context context,
 			       "RSA private encrypt failed: %d", ret);
 	return ret;
     }
-    if ((size_t)ret > sig->length)
+    if (sig->length > (size_t)ret) {
+	size = sig->length - ret;
+	memmove((uint8_t *)sig->data + size, sig->data, ret);
+	memset(sig->data, 0, size);
+    } else if (sig->length < (size_t)ret)
 	_hx509_abort("RSA signature prelen longer the output len");
 
-    sig->length = ret;
-
     return 0;
 }
 
@@ -797,8 +446,9 @@ rsa_private_key2SPKI(hx509_context context,
     }
     spki->subjectPublicKey.length = len * 8;
 
-    ret = set_digest_alg(&spki->algorithm, ASN1_OID_ID_PKCS1_RSAENCRYPTION,
-			 "\x05\x00", 2);
+    ret = _hx509_set_digest_alg(&spki->algorithm,
+                                ASN1_OID_ID_PKCS1_RSAENCRYPTION,
+                                "\x05\x00", 2);
     if (ret) {
 	hx509_set_error_string(context, 0, ret, "malloc - out of memory");
 	free(spki->subjectPublicKey.data);
@@ -922,115 +572,6 @@ static hx509_private_key_ops rsa_private_key_ops = {
     rsa_get_internal
 };
 
-#ifdef HAVE_OPENSSL
-
-static int
-ecdsa_private_key2SPKI(hx509_context context,
-		       hx509_private_key private_key,
-		       SubjectPublicKeyInfo *spki)
-{
-    memset(spki, 0, sizeof(*spki));
-    return ENOMEM;
-}
-
-static int
-ecdsa_private_key_export(hx509_context context,
-			 const hx509_private_key key,
-			 hx509_key_format_t format,
-			 heim_octet_string *data)
-{
-    return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
-}
-
-static int
-ecdsa_private_key_import(hx509_context context,
-			 const AlgorithmIdentifier *keyai,
-			 const void *data,
-			 size_t len,
-			 hx509_key_format_t format,
-			 hx509_private_key private_key)
-{
-    const unsigned char *p = data;
-    EC_KEY **pkey = NULL;
-
-    if (keyai->parameters) {
-	EC_GROUP *group;
-	int groupnid;
-	EC_KEY *key;
-	int ret;
-
-	ret = parse_ECParameters(context, keyai->parameters, &groupnid);
-	if (ret)
-	    return ret;
-
-	key = EC_KEY_new();
-	if (key == NULL)
-	    return ENOMEM;
-
-	group = EC_GROUP_new_by_curve_name(groupnid);
-	if (group == NULL) {
-	    EC_KEY_free(key);
-	    return ENOMEM;
-	}
-	EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
-	if (EC_KEY_set_group(key, group) == 0) {
-	    EC_KEY_free(key);
-	    EC_GROUP_free(group);
-	    return ENOMEM;
-	}
-	EC_GROUP_free(group);
-	pkey = &key;
-    }
-
-    switch (format) {
-    case HX509_KEY_FORMAT_DER:
-
-	private_key->private_key.ecdsa = d2i_ECPrivateKey(pkey, &p, len);
-	if (private_key->private_key.ecdsa == NULL) {
-	    hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
-				   "Failed to parse EC private key");
-	    return HX509_PARSING_KEY_FAILED;
-	}
-	private_key->signature_alg = ASN1_OID_ID_ECDSA_WITH_SHA256;
-	break;
-
-    default:
-	return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
-    }
-
-    return 0;
-}
-
-static int
-ecdsa_generate_private_key(hx509_context context,
-			   struct hx509_generate_private_context *ctx,
-			   hx509_private_key private_key)
-{
-    return ENOMEM;
-}
-
-static BIGNUM *
-ecdsa_get_internal(hx509_context context,
-		   hx509_private_key key,
-		   const char *type)
-{
-    return NULL;
-}
-
-
-static hx509_private_key_ops ecdsa_private_key_ops = {
-    "EC PRIVATE KEY",
-    ASN1_OID_ID_ECPUBLICKEY,
-    ecdsa_available,
-    ecdsa_private_key2SPKI,
-    ecdsa_private_key_export,
-    ecdsa_private_key_import,
-    ecdsa_generate_private_key,
-    ecdsa_get_internal
-};
-
-#endif /* HAVE_OPENSSL */
-
 /*
  *
  */
@@ -1159,8 +700,8 @@ evp_md_create_signature(hx509_context context,
 
     if (signatureAlgorithm) {
 	int ret;
-	ret = set_digest_alg(signatureAlgorithm, sig_alg->sig_oid,
-			     "\x05\x00", 2);
+        ret = _hx509_set_digest_alg(signatureAlgorithm,
+                                    sig_alg->sig_oid, "\x05\x00", 2);
 	if (ret)
 	    return ret;
     }
@@ -1216,36 +757,11 @@ evp_md_verify_signature(hx509_context context,
     return 0;
 }
 
-#ifdef HAVE_OPENSSL
-
-static const struct signature_alg ecdsa_with_sha256_alg = {
-    "ecdsa-with-sha256",
-    ASN1_OID_ID_ECDSA_WITH_SHA256,
-    &_hx509_signature_ecdsa_with_sha256_data,
-    ASN1_OID_ID_ECPUBLICKEY,
-    &_hx509_signature_sha256_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
-    0,
-    NULL,
-    ecdsa_verify_signature,
-    ecdsa_create_signature,
-    32
-};
-
-static const struct signature_alg ecdsa_with_sha1_alg = {
-    "ecdsa-with-sha1",
-    ASN1_OID_ID_ECDSA_WITH_SHA1,
-    &_hx509_signature_ecdsa_with_sha1_data,
-    ASN1_OID_ID_ECPUBLICKEY,
-    &_hx509_signature_sha1_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
-    0,
-    NULL,
-    ecdsa_verify_signature,
-    ecdsa_create_signature,
-    20
-};
-
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+extern const struct signature_alg ecdsa_with_sha512_alg;
+extern const struct signature_alg ecdsa_with_sha384_alg;
+extern const struct signature_alg ecdsa_with_sha256_alg;
+extern const struct signature_alg ecdsa_with_sha1_alg;
 #endif
 
 static const struct signature_alg heim_rsa_pkcs1_x509 = {
@@ -1352,7 +868,7 @@ static const struct signature_alg rsa_with_md5_alg = {
     &_hx509_signature_rsa_with_md5_data,
     ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     &_hx509_signature_md5_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|WEAK_SIG_ALG,
     1230739889,
     NULL,
     rsa_verify_signature,
@@ -1436,7 +952,7 @@ static const struct signature_alg md5_alg = {
     &_hx509_signature_md5_data,
     NULL,
     NULL,
-    SIG_DIGEST,
+    SIG_DIGEST|WEAK_SIG_ALG,
     0,
     EVP_md5,
     evp_md_verify_signature,
@@ -1450,7 +966,9 @@ static const struct signature_alg md5_alg = {
  */
 
 static const struct signature_alg *sig_algs[] = {
-#ifdef HAVE_OPENSSL
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    &ecdsa_with_sha512_alg,
+    &ecdsa_with_sha384_alg,
     &ecdsa_with_sha256_alg,
     &ecdsa_with_sha1_alg,
 #endif
@@ -1471,8 +989,8 @@ static const struct signature_alg *sig_algs[] = {
     NULL
 };
 
-static const struct signature_alg *
-find_sig_alg(const heim_oid *oid)
+const struct signature_alg *
+_hx509_find_sig_alg(const heim_oid *oid)
 {
     unsigned int i;
     for (i = 0; sig_algs[i]; i++)
@@ -1513,10 +1031,13 @@ alg_for_privatekey(const hx509_private_key pk, int type)
 /*
  *
  */
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+extern hx509_private_key_ops ecdsa_private_key_ops;
+#endif
 
 static struct hx509_private_key_ops *private_algs[] = {
     &rsa_private_key_ops,
-#ifdef HAVE_OPENSSL
+#ifdef HAVE_HCRYPTO_W_OPENSSL
     &ecdsa_private_key_ops,
 #endif
     NULL
@@ -1541,21 +1062,18 @@ hx509_find_private_alg(const heim_oid *oid)
  */
 
 int
-_hx509_signature_best_before(hx509_context context,
-			     const AlgorithmIdentifier *alg,
-			     time_t t)
+_hx509_signature_is_weak(hx509_context context, const AlgorithmIdentifier *alg)
 {
     const struct signature_alg *md;
 
-    md = find_sig_alg(&alg->algorithm);
+    md = _hx509_find_sig_alg(&alg->algorithm);
     if (md == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_SIG_ALG_NO_SUPPORTED;
     }
-    if (md->best_before && md->best_before < t) {
+    if (md->flags & WEAK_SIG_ALG) {
 	hx509_set_error_string(context, 0, HX509_CRYPTO_ALGORITHM_BEST_BEFORE,
-			       "Algorithm %s has passed it best before date",
-			       md->name);
+			       "Algorithm %s is weak", md->name);
 	return HX509_CRYPTO_ALGORITHM_BEST_BEFORE;
     }
     return 0;
@@ -1567,7 +1085,7 @@ _hx509_self_signed_valid(hx509_context context,
 {
     const struct signature_alg *md;
 
-    md = find_sig_alg(&alg->algorithm);
+    md = _hx509_find_sig_alg(&alg->algorithm);
     if (md == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_SIG_ALG_NO_SUPPORTED;
@@ -1595,7 +1113,7 @@ _hx509_verify_signature(hx509_context context,
     if (cert)
 	signer = _hx509_get_cert(cert);
 
-    md = find_sig_alg(&alg->algorithm);
+    md = _hx509_find_sig_alg(&alg->algorithm);
     if (md == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_SIG_ALG_NO_SUPPORTED;
@@ -1630,7 +1148,7 @@ _hx509_create_signature(hx509_context context,
 {
     const struct signature_alg *md;
 
-    md = find_sig_alg(&alg->algorithm);
+    md = _hx509_find_sig_alg(&alg->algorithm);
     if (md == NULL) {
 	hx509_set_error_string(context, 0, HX509_SIG_ALG_NO_SUPPORTED,
 	    "algorithm no supported");
@@ -1924,18 +1442,6 @@ const AlgorithmIdentifier *
 hx509_signature_md5(void)
 { return &_hx509_signature_md5_data; }
 
-const AlgorithmIdentifier *
-hx509_signature_ecPublicKey(void)
-{ return &_hx509_signature_ecPublicKey; }
-
-const AlgorithmIdentifier *
-hx509_signature_ecdsa_with_sha256(void)
-{ return &_hx509_signature_ecdsa_with_sha256_data; }
-
-const AlgorithmIdentifier *
-hx509_signature_ecdsa_with_sha1(void)
-{ return &_hx509_signature_ecdsa_with_sha1_data; }
-
 const AlgorithmIdentifier *
 hx509_signature_rsa_with_sha512(void)
 { return &_hx509_signature_rsa_with_sha512_data; }
@@ -2036,11 +1542,10 @@ hx509_private_key_free(hx509_private_key *key)
     if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) == 0) {
 	if ((*key)->private_key.rsa)
 	    RSA_free((*key)->private_key.rsa);
-#ifdef HAVE_OPENSSL
-    } else if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) == 0) {
-	if ((*key)->private_key.ecdsa)
-	    EC_KEY_free((*key)->private_key.ecdsa);
-#endif
+    } else if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid,
+                                               ASN1_OID_ID_ECPUBLICKEY) == 0 &&
+               (*key)->private_key.ecdsa != NULL) {
+      _hx509_private_eckey_free((*key)->private_key.ecdsa);
     }
     (*key)->private_key.rsa = NULL;
     free(*key);
@@ -2808,29 +2313,49 @@ find_string2key(const heim_oid *oid,
 {
     if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND40BITRC2_CBC) == 0) {
 	*c = EVP_rc2_40_cbc();
+        if (*c == NULL)
+            return NULL;
 	*md = EVP_sha1();
+        if (*md == NULL)
+            return NULL;
 	*s2k = PBE_string2key;
 	return &asn1_oid_private_rc2_40;
     } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND128BITRC2_CBC) == 0) {
 	*c = EVP_rc2_cbc();
+        if (*c == NULL)
+            return NULL;
 	*md = EVP_sha1();
+        if (*md == NULL)
+            return NULL;
 	*s2k = PBE_string2key;
 	return ASN1_OID_ID_PKCS3_RC2_CBC;
 #if 0
     } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND40BITRC4) == 0) {
 	*c = EVP_rc4_40();
+        if (*c == NULL)
+            return NULL;
 	*md = EVP_sha1();
+        if (*md == NULL)
+            return NULL;
 	*s2k = PBE_string2key;
 	return NULL;
     } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND128BITRC4) == 0) {
 	*c = EVP_rc4();
+        if (*c == NULL)
+            return NULL;
 	*md = EVP_sha1();
+        if (*md == NULL)
+            return NULL;
 	*s2k = PBE_string2key;
 	return ASN1_OID_ID_PKCS3_RC4;
 #endif
     } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND3_KEYTRIPLEDES_CBC) == 0) {
 	*c = EVP_des_ede3_cbc();
+        if (*c == NULL)
+            return NULL;
 	*md = EVP_sha1();
+        if (*md == NULL)
+            return NULL;
 	*s2k = PBE_string2key;
 	return ASN1_OID_ID_PKCS3_DES_EDE3_CBC;
     }
@@ -3010,6 +2535,8 @@ match_keys_ec(hx509_cert c, hx509_private_key private_key)
 int
 _hx509_match_keys(hx509_cert c, hx509_private_key key)
 {
+    if (!key->ops)
+	return 0;
     if (der_heim_oid_cmp(key->ops->key_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) == 0)
 	return match_keys_rsa(c, key);
     if (der_heim_oid_cmp(key->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) == 0)
@@ -3027,7 +2554,7 @@ find_keytype(const hx509_private_key key)
     if (key == NULL)
 	return NULL;
 
-    md = find_sig_alg(key->signature_alg);
+    md = _hx509_find_sig_alg(key->signature_alg);
     if (md == NULL)
 	return NULL;
     return md->key_oid;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/mkcert.sh b/crypto/external/bsd/heimdal/dist/lib/hx509/data/mkcert.sh
new file mode 100755
index 000000000..5faa57120
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/mkcert.sh
@@ -0,0 +1,84 @@
+#! /bin/bash
+
+set -e
+
+# For now, avoid going past the 2038 32-bit clock rollover
+DAYS=$(( ( 0x7fffffff - $(date +%s) ) / 86400 - 1 ))
+
+key() {
+    local key=$1; shift
+
+    if [ ! -f "${key}.pem" ]; then
+	openssl genpkey \
+	    -paramfile <(openssl ecparam -name prime256v1) \
+	    -out "${key}.pem"
+    fi
+}
+
+req() {
+    local key=$1; shift
+    local dn=$1; shift
+
+    openssl req -new -sha256 -key "${key}.pem" \
+	-config <(printf "[req]\n%s\n%s\n[dn]\nCN_default=foo\n" \
+		   "prompt = yes" "distinguished_name = dn") \
+	-subj "${dn}"
+}
+
+cert() {
+    local cert=$1; shift
+    local exts=$1; shift
+
+    openssl x509 -req -sha256 -out "${cert}.pem" \
+	-extfile <(printf "%s\n" "$exts") "$@"
+}
+
+genroot() {
+    local dn=$1; shift
+    local key=$1; shift
+    local cert=$1; shift
+
+    exts=$(printf "%s\n%s\n%s\n%s\n" \
+	   "subjectKeyIdentifier = hash" \
+	   "authorityKeyIdentifier  = keyid" \
+	   "basicConstraints = CA:true" \
+	   "keyUsage = keyCertSign, cRLSign" )
+    key "$key"; req "$key" "$dn" |
+	cert "$cert" "$exts" -signkey "${key}.pem" \
+	    -set_serial 1 -days "${DAYS}"
+}
+
+genee() {
+    local dn=$1; shift
+    local key=$1; shift
+    local cert=$1; shift
+    local cakey=$1; shift
+    local cacert=$1; shift
+
+    exts=$(printf "%s\n%s\n%s\n%s\n" \
+	    "subjectKeyIdentifier = hash" \
+	    "authorityKeyIdentifier = keyid, issuer" \
+	    "basicConstraints = CA:false" \
+	    "keyUsage = digitalSignature, keyEncipherment, dataEncipherment" \
+	)
+    key "$key"; req "$key" "$dn" |
+	cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
+	    -set_serial 2 -days "${DAYS}" "$@"
+}
+
+
+genroot "/C=SE/O=Heimdal/CN=CA secp256r1" \
+	secp256r1TestCA.key secp256r1TestCA.cert
+genee "/C=SE/O=Heimdal/CN=Server" \
+	secp256r2TestServer.key secp256r2TestServer.cert \
+	secp256r1TestCA.key secp256r1TestCA.cert
+genee "/C=SE/O=Heimdal/CN=Client" \
+	secp256r2TestClient.key secp256r2TestClient.cert \
+	secp256r1TestCA.key secp256r1TestCA.cert
+
+cat secp256r1TestCA.key.pem secp256r1TestCA.cert.pem > \
+	secp256r1TestCA.pem
+cat secp256r2TestClient.cert.pem secp256r2TestClient.key.pem > \
+	secp256r2TestClient.pem
+cat secp256r2TestServer.cert.pem secp256r2TestServer.key.pem > \
+	secp256r2TestServer.pem
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/openssl.cnf b/crypto/external/bsd/heimdal/dist/lib/hx509/data/openssl.cnf
index a6054009d..b01465645 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/openssl.cnf
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/openssl.cnf
@@ -82,7 +82,7 @@ certs		= .
 
 [req]
 distinguished_name	= req_distinguished_name
-x509_extensions		= v3_ca	# The extentions to add to the self signed cert
+x509_extensions		= v3_ca	# The extensions to add to the self signed cert
 
 string_mask = utf8only
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.cert.pem
deleted file mode 100644
index 2d30fab2c..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.cert.pem
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBxjCCAYagAwIBAgIJAKjMYS/6EOLdMAkGByqGSM49BAEwNjELMAkGA1UEBhMC
-U0UxEDAOBgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0w
-OTAyMTQxNzUwMDRaFw0yMDAxMjgxNzUwMDRaMDYxCzAJBgNVBAYTAlNFMRAwDgYD
-VQQKEwdIZWltZGFsMRUwEwYDVQQDEwxDQSBzZWNwMTYwcjEwPjAQBgcqhkjOPQIB
-BgUrgQQACAMqAASMHokF13aCVrlhMSr9Vgofj7loM2a7ZrU3h8/j1n/cO24ceyN/
-DpsOo4GYMIGVMB0GA1UdDgQWBBS58EWwgNdBwkYVhUSNzwIehHhEDzBmBgNVHSME
-XzBdgBS58EWwgNdBwkYVhUSNzwIehHhED6E6pDgwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMYIJAKjMYS/6EOLd
-MAwGA1UdEwQFMAMBAf8wCQYHKoZIzj0EAQMvADAsAhRZPKbqMYDATJasRcXQfEh5
-8oHCywIUGZ0h6FqSvPgpkZ7hoU+ZEFJ/D88=
------END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.key.pem
deleted file mode 100644
index f0ce773cf..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.key.pem
+++ /dev/null
@@ -1,4 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFHegiSlX0311KSBjNrbzq6HrKjkYoAcGBSuBBAAIoSwDKgAEjB6JBdd2
-gla5YTEq/VYKH4+5aDNmu2a1N4fP49Z/3DtuHHsjfw6bDg==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.pem
deleted file mode 100644
index a6f068d54..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r1TestCA.pem
+++ /dev/null
@@ -1,18 +0,0 @@
-issuer= /C=SE/O=Heimdal/CN=CA secp160r1
-subject= /C=SE/O=Heimdal/CN=CA secp160r1
------BEGIN CERTIFICATE-----
-MIIBxjCCAYagAwIBAgIJAKjMYS/6EOLdMAkGByqGSM49BAEwNjELMAkGA1UEBhMC
-U0UxEDAOBgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0w
-OTAyMTQxNzUwMDRaFw0yMDAxMjgxNzUwMDRaMDYxCzAJBgNVBAYTAlNFMRAwDgYD
-VQQKEwdIZWltZGFsMRUwEwYDVQQDEwxDQSBzZWNwMTYwcjEwPjAQBgcqhkjOPQIB
-BgUrgQQACAMqAASMHokF13aCVrlhMSr9Vgofj7loM2a7ZrU3h8/j1n/cO24ceyN/
-DpsOo4GYMIGVMB0GA1UdDgQWBBS58EWwgNdBwkYVhUSNzwIehHhEDzBmBgNVHSME
-XzBdgBS58EWwgNdBwkYVhUSNzwIehHhED6E6pDgwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMYIJAKjMYS/6EOLd
-MAwGA1UdEwQFMAMBAf8wCQYHKoZIzj0EAQMvADAsAhRZPKbqMYDATJasRcXQfEh5
-8oHCywIUGZ0h6FqSvPgpkZ7hoU+ZEFJ/D88=
------END CERTIFICATE-----
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFHegiSlX0311KSBjNrbzq6HrKjkYoAcGBSuBBAAIoSwDKgAEjB6JBdd2
-gla5YTEq/VYKH4+5aDNmu2a1N4fP49Z/3DtuHHsjfw6bDg==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.cert.pem
deleted file mode 100644
index 716395bf8..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.cert.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBIDCB4AIJAN1XzNknE3lDMAkGByqGSM49BAEwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0wOTAyMTQx
-NzUwMDRaFw0yMDAxMjgxNzUwMDRaMDAxCzAJBgNVBAYTAlNFMRAwDgYDVQQKEwdI
-ZWltZGFsMQ8wDQYDVQQDEwZDbGllbnQwPjAQBgcqhkjOPQIBBgUrgQQAHgMqAASA
-oVzj3A0W1FaSmc0NwTRdX4A8eCbDb6pf07vMpUcOqvdXVGwWN3HhMAkGByqGSM49
-BAEDMAAwLQIURJ9Jdesm0rqwpOAn8K23GdWlCkYCFQDmJtqiOLs4jjUUP6T7O17M
-Iwyrvg==
------END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.key.pem
deleted file mode 100644
index e5a2fef79..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.key.pem
+++ /dev/null
@@ -1,4 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFNz0QJPbDlTBMSOfUoxNSzOOpRKyoAcGBSuBBAAeoSwDKgAEgKFc49wN
-FtRWkpnNDcE0XV+APHgmw2+qX9O7zKVHDqr3V1RsFjdx4Q==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.pem
deleted file mode 100644
index ca4bb331d..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestClient.pem
+++ /dev/null
@@ -1,15 +0,0 @@
-issuer= /C=SE/O=Heimdal/CN=CA secp160r1
-subject= /C=SE/O=Heimdal/CN=Client
------BEGIN CERTIFICATE-----
-MIIBIDCB4AIJAN1XzNknE3lDMAkGByqGSM49BAEwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0wOTAyMTQx
-NzUwMDRaFw0yMDAxMjgxNzUwMDRaMDAxCzAJBgNVBAYTAlNFMRAwDgYDVQQKEwdI
-ZWltZGFsMQ8wDQYDVQQDEwZDbGllbnQwPjAQBgcqhkjOPQIBBgUrgQQAHgMqAASA
-oVzj3A0W1FaSmc0NwTRdX4A8eCbDb6pf07vMpUcOqvdXVGwWN3HhMAkGByqGSM49
-BAEDMAAwLQIURJ9Jdesm0rqwpOAn8K23GdWlCkYCFQDmJtqiOLs4jjUUP6T7O17M
-Iwyrvg==
------END CERTIFICATE-----
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFNz0QJPbDlTBMSOfUoxNSzOOpRKyoAcGBSuBBAAeoSwDKgAEgKFc49wN
-FtRWkpnNDcE0XV+APHgmw2+qX9O7zKVHDqr3V1RsFjdx4Q==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.cert.pem
deleted file mode 100644
index 6b5603658..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.cert.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBIDCB4AIJAN1XzNknE3lCMAkGByqGSM49BAEwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0wOTAyMTQx
-NzUwMDRaFw0yMDAxMjgxNzUwMDRaMDAxCzAJBgNVBAYTAlNFMRAwDgYDVQQKEwdI
-ZWltZGFsMQ8wDQYDVQQDEwZTZXJ2ZXIwPjAQBgcqhkjOPQIBBgUrgQQAHgMqAARA
-IUAwnwABnZAs378hcEgnk8efxE35RF6B+MmxSq1Twhp2C1ophD6yMAkGByqGSM49
-BAEDMAAwLQIVAO0hl59KWXRMBaJ2iKsiu/j73/bPAhRfsTT6SIBL5+3gjLhl7SqK
-1kTMQw==
------END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.key.pem
deleted file mode 100644
index a903d0f76..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.key.pem
+++ /dev/null
@@ -1,4 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFBR1r2nPL1Ln1U5Nk1kW9XtNEkk1oAcGBSuBBAAeoSwDKgAEQCFAMJ8A
-AZ2QLN+/IXBIJ5PHn8RN+URegfjJsUqtU8IadgtaKYQ+sg==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.pem
deleted file mode 100644
index 329d87153..000000000
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp160r2TestServer.pem
+++ /dev/null
@@ -1,15 +0,0 @@
-issuer= /C=SE/O=Heimdal/CN=CA secp160r1
-subject= /C=SE/O=Heimdal/CN=Server
------BEGIN CERTIFICATE-----
-MIIBIDCB4AIJAN1XzNknE3lCMAkGByqGSM49BAEwNjELMAkGA1UEBhMCU0UxEDAO
-BgNVBAoTB0hlaW1kYWwxFTATBgNVBAMTDENBIHNlY3AxNjByMTAeFw0wOTAyMTQx
-NzUwMDRaFw0yMDAxMjgxNzUwMDRaMDAxCzAJBgNVBAYTAlNFMRAwDgYDVQQKEwdI
-ZWltZGFsMQ8wDQYDVQQDEwZTZXJ2ZXIwPjAQBgcqhkjOPQIBBgUrgQQAHgMqAARA
-IUAwnwABnZAs378hcEgnk8efxE35RF6B+MmxSq1Twhp2C1ophD6yMAkGByqGSM49
-BAEDMAAwLQIVAO0hl59KWXRMBaJ2iKsiu/j73/bPAhRfsTT6SIBL5+3gjLhl7SqK
-1kTMQw==
------END CERTIFICATE-----
------BEGIN EC PRIVATE KEY-----
-MFACAQEEFBR1r2nPL1Ln1U5Nk1kW9XtNEkk1oAcGBSuBBAAeoSwDKgAEQCFAMJ8A
-AZ2QLN+/IXBIJ5PHn8RN+URegfjJsUqtU8IadgtaKYQ+sg==
------END EC PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.cert.pem
new file mode 100644
index 000000000..6cac58ee1
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBuDCCAV6gAwIBAgIBATAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owNjELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxFTATBgNVBAMTDENBIHNlY3AyNTZyMTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABOUrhSvioYJaKUK9WjI5eGRAWsOB2DNslTkcgTkFsd3vD4/dGxaHBOIM
+kuD9ldGK2sQArEIDKfrOHvP+oFz3jLajXTBbMB0GA1UdDgQWBBTrUd8AqGhfZvHV
+spcznXeb328JgzAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAMBgNV
+HRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNIADBFAiBd6J2N4B6L
+mtn0ZP/6vOyPkA7YMq2EwbVyTGlnBTwYsQIhALjsLWHQVSkt08rly48ns93DeSbM
+XejBzmT8QXEdib+1
+-----END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.key.pem
new file mode 100644
index 000000000..388826621
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgL2N0gdHhAjBGcJ40
+gHePPMwGKygIVDXTfjysn9zPiSOhRANCAATlK4Ur4qGCWilCvVoyOXhkQFrDgdgz
+bJU5HIE5BbHd7w+P3RsWhwTiDJLg/ZXRitrEAKxCAyn6zh7z/qBc94y2
+-----END PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.pem
new file mode 100644
index 000000000..d0c743188
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r1TestCA.pem
@@ -0,0 +1,17 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgL2N0gdHhAjBGcJ40
+gHePPMwGKygIVDXTfjysn9zPiSOhRANCAATlK4Ur4qGCWilCvVoyOXhkQFrDgdgz
+bJU5HIE5BbHd7w+P3RsWhwTiDJLg/ZXRitrEAKxCAyn6zh7z/qBc94y2
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBuDCCAV6gAwIBAgIBATAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owNjELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxFTATBgNVBAMTDENBIHNlY3AyNTZyMTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABOUrhSvioYJaKUK9WjI5eGRAWsOB2DNslTkcgTkFsd3vD4/dGxaHBOIM
+kuD9ldGK2sQArEIDKfrOHvP+oFz3jLajXTBbMB0GA1UdDgQWBBTrUd8AqGhfZvHV
+spcznXeb328JgzAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAMBgNV
+HRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNIADBFAiBd6J2N4B6L
+mtn0ZP/6vOyPkA7YMq2EwbVyTGlnBTwYsQIhALjsLWHQVSkt08rly48ns93DeSbM
+XejBzmT8QXEdib+1
+-----END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.cert.pem
new file mode 100644
index 000000000..f0f3a2445
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBrzCCAVWgAwIBAgIBAjAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owMDELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxDzANBgNVBAMTBkNsaWVudDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BO7/MCIBHf8gQLQ5ltp1uyCOCAw8uylZZ7+v/rB3oKHuAIyL6q/QjZXZH3FR5VcI
+zANavN5SAfx9CFJpPk+pUISjWjBYMB0GA1UdDgQWBBSjXg4X3fs5xOQgTumjZQwF
+I13RejAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAJBgNVHRMEAjAA
+MAsGA1UdDwQEAwIEsDAKBggqhkjOPQQDAgNIADBFAiAa9d6aCxlioep3ViYqujWv
+A28/16yXOrmLY1a2wcj3awIhAMeVjMiUTP/U4yXfb3uJjJmq8hfyNZ/CAiTQKORx
+JjIt
+-----END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.key.pem
new file mode 100644
index 000000000..36c67f9db
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg6oD5CbNzN7oAWqcq
+dKJKw2WU5EwnUV05+7S9gXgeW/qhRANCAATu/zAiAR3/IEC0OZbadbsgjggMPLsp
+WWe/r/6wd6Ch7gCMi+qv0I2V2R9xUeVXCMwDWrzeUgH8fQhSaT5PqVCE
+-----END PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.pem
new file mode 100644
index 000000000..acf11b041
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestClient.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIIBrzCCAVWgAwIBAgIBAjAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owMDELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxDzANBgNVBAMTBkNsaWVudDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BO7/MCIBHf8gQLQ5ltp1uyCOCAw8uylZZ7+v/rB3oKHuAIyL6q/QjZXZH3FR5VcI
+zANavN5SAfx9CFJpPk+pUISjWjBYMB0GA1UdDgQWBBSjXg4X3fs5xOQgTumjZQwF
+I13RejAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAJBgNVHRMEAjAA
+MAsGA1UdDwQEAwIEsDAKBggqhkjOPQQDAgNIADBFAiAa9d6aCxlioep3ViYqujWv
+A28/16yXOrmLY1a2wcj3awIhAMeVjMiUTP/U4yXfb3uJjJmq8hfyNZ/CAiTQKORx
+JjIt
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg6oD5CbNzN7oAWqcq
+dKJKw2WU5EwnUV05+7S9gXgeW/qhRANCAATu/zAiAR3/IEC0OZbadbsgjggMPLsp
+WWe/r/6wd6Ch7gCMi+qv0I2V2R9xUeVXCMwDWrzeUgH8fQhSaT5PqVCE
+-----END PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.cert.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.cert.pem
new file mode 100644
index 000000000..91acde8f6
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBsDCCAVWgAwIBAgIBAjAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owMDELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxDzANBgNVBAMTBlNlcnZlcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BItZgn1C8ZBvKkkNoEofWL0JLCTaHT2lJj7d9jRtSKiR2PlOtd5HhteDqP78K4eg
+lRMk5nqsmEooalfbNsFBy8SjWjBYMB0GA1UdDgQWBBTqMDTOezcRsax6lf6E/Xk+
+QzPorjAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAJBgNVHRMEAjAA
+MAsGA1UdDwQEAwIEsDAKBggqhkjOPQQDAgNJADBGAiEAsvf//YdUWCD6OLZesENa
+1mH8+b+kZDR6jx1JchRXAEQCIQDkTvTZrlmmxUaWEsf08/4xbxkYbrPAg4+VX2uI
+QcEwUA==
+-----END CERTIFICATE-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.key.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.key.pem
new file mode 100644
index 000000000..fb57e798c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKo/47DaveCl90GxH
+LCE7IGBua2XsE+jI4RUWZrqjhBGhRANCAASLWYJ9QvGQbypJDaBKH1i9CSwk2h09
+pSY+3fY0bUiokdj5TrXeR4bXg6j+/CuHoJUTJOZ6rJhKKGpX2zbBQcvE
+-----END PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.pem b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.pem
new file mode 100644
index 000000000..0e9edd782
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/data/secp256r2TestServer.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIIBsDCCAVWgAwIBAgIBAjAKBggqhkjOPQQDAjA2MQswCQYDVQQGEwJTRTEQMA4G
+A1UEChMHSGVpbWRhbDEVMBMGA1UEAxMMQ0Egc2VjcDI1NnIxMB4XDTE0MDMxMDE5
+NDAyM1oXDTM4MDExNzE5NDAyM1owMDELMAkGA1UEBhMCU0UxEDAOBgNVBAoTB0hl
+aW1kYWwxDzANBgNVBAMTBlNlcnZlcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BItZgn1C8ZBvKkkNoEofWL0JLCTaHT2lJj7d9jRtSKiR2PlOtd5HhteDqP78K4eg
+lRMk5nqsmEooalfbNsFBy8SjWjBYMB0GA1UdDgQWBBTqMDTOezcRsax6lf6E/Xk+
+QzPorjAfBgNVHSMEGDAWgBTrUd8AqGhfZvHVspcznXeb328JgzAJBgNVHRMEAjAA
+MAsGA1UdDwQEAwIEsDAKBggqhkjOPQQDAgNJADBGAiEAsvf//YdUWCD6OLZesENa
+1mH8+b+kZDR6jx1JchRXAEQCIQDkTvTZrlmmxUaWEsf08/4xbxkYbrPAg4+VX2uI
+QcEwUA==
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKo/47DaveCl90GxH
+LCE7IGBua2XsE+jI4RUWZrqjhBGhRANCAASLWYJ9QvGQbypJDaBKH1i9CSwk2h09
+pSY+3fY0bUiokdj5TrXeR4bXg6j+/CuHoJUTJOZ6rJhKKGpX2zbBQcvE
+-----END PRIVATE KEY-----
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/hx509/doxygen.c
index 9aa8ef5fa..b276a231d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:15:10 elric Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -84,4 +84,4 @@
  * See the @ref page_ca for description and examples. */
 /** @defgroup hx509_peer hx509 certificate selecting functions */
 /** @defgroup hx509_print hx509 printing functions */
-/** @defgroup hx509_env hx509 enviroment functions */
+/** @defgroup hx509_env hx509 environment functions */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/env.c b/crypto/external/bsd/heimdal/dist/lib/hx509/env.c
index 2b891b222..1dda9eb11 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/env.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/env.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: env.c,v 1.1.1.1 2011/04/13 18:15:10 elric Exp $	*/
+/*	$NetBSD: env.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 - 2008 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "hx_locl.h"
 
 /**
- * @page page_env Hx509 enviroment functions
+ * @page page_env Hx509 environment functions
  *
  * See the library functions here: @ref hx509_env
  */
@@ -45,7 +45,7 @@
  * Add a new key/value pair to the hx509_env.
  *
  * @param context A hx509 context.
- * @param env enviroment to add the enviroment variable too.
+ * @param env environment to add the environment variable too.
  * @param key key to add
  * @param value value to add
  *
@@ -96,7 +96,7 @@ hx509_env_add(hx509_context context, hx509_env *env,
  * Add a new key/binding pair to the hx509_env.
  *
  * @param context A hx509 context.
- * @param env enviroment to add the enviroment variable too.
+ * @param env environment to add the environment variable too.
  * @param key key to add
  * @param list binding list to add
  *
@@ -143,7 +143,7 @@ hx509_env_add_binding(hx509_context context, hx509_env *env,
  * Search the hx509_env for a length based key.
  *
  * @param context A hx509 context.
- * @param env enviroment to add the enviroment variable too.
+ * @param env environment to add the environment variable too.
  * @param key key to search for.
  * @param len length of key.
  *
@@ -169,7 +169,7 @@ hx509_env_lfind(hx509_context context, hx509_env env,
  * Search the hx509_env for a key.
  *
  * @param context A hx509 context.
- * @param env enviroment to add the enviroment variable too.
+ * @param env environment to add the environment variable too.
  * @param key key to search for.
  *
  * @return the value if the key is found, NULL otherwise.
@@ -192,7 +192,7 @@ hx509_env_find(hx509_context context, hx509_env env, const char *key)
  * Search the hx509_env for a binding.
  *
  * @param context A hx509 context.
- * @param env enviroment to add the enviroment variable too.
+ * @param env environment to add the environment variable too.
  * @param key key to search for.
  *
  * @return the binding if the key is found, NULL if not found.
@@ -231,9 +231,9 @@ env_free(hx509_env b)
 }
 
 /**
- * Free an hx509_env enviroment context.
+ * Free an hx509_env environment context.
  *
- * @param env the enviroment to free.
+ * @param env the environment to free.
  *
  * @ingroup hx509_env
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/error.c b/crypto/external/bsd/heimdal/dist/lib/hx509/error.c
index 91d0470cb..7a48b48ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: error.c,v 1.1.1.1 2011/04/13 18:15:10 elric Exp $	*/
+/*	$NetBSD: error.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -47,17 +47,6 @@ struct hx509_error_data {
     char *msg;
 };
 
-static void
-free_error_string(hx509_error msg)
-{
-    while(msg) {
-	hx509_error m2 = msg->next;
-	free(msg->msg);
-	free(msg);
-	msg = m2;
-    }
-}
-
 /**
  * Resets the error strings the hx509 context.
  *
@@ -70,7 +59,7 @@ void
 hx509_clear_error_string(hx509_context context)
 {
     if (context) {
-	free_error_string(context->error);
+	heim_release(context->error);
 	context->error = NULL;
     }
 }
@@ -93,31 +82,18 @@ void
 hx509_set_error_stringv(hx509_context context, int flags, int code,
 			const char *fmt, va_list ap)
 {
-    hx509_error msg;
+    heim_error_t msg;
 
     if (context == NULL)
 	return;
 
-    msg = calloc(1, sizeof(*msg));
-    if (msg == NULL) {
-	hx509_clear_error_string(context);
-	return;
-    }
-
-    if (vasprintf(&msg->msg, fmt, ap) == -1) {
-	hx509_clear_error_string(context);
-	free(msg);
-	return;
-    }
-    msg->code = code;
-
-    if (flags & HX509_ERROR_APPEND) {
-	msg->next = context->error;
-	context->error = msg;
-    } else  {
-	free_error_string(context->error);
-	context->error = msg;
+    msg = heim_error_createv(code, fmt, ap);
+    if (msg) {
+	if (flags & HX509_ERROR_APPEND)
+	    heim_error_append(msg, context->error);
+	heim_release(context->error);
     }
+    context->error = msg;
 }
 
 /**
@@ -159,12 +135,12 @@ hx509_set_error_string(hx509_context context, int flags, int code,
 char *
 hx509_get_error_string(hx509_context context, int error_code)
 {
-    struct rk_strpool *p = NULL;
-    hx509_error msg = context->error;
+    heim_error_t msg = context->error;
+    heim_string_t s;
+    char *str = NULL;
 
-    if (msg == NULL || msg->code != error_code) {
+    if (msg == NULL || heim_error_get_code(msg) != error_code) {
 	const char *cstr;
-	char *str;
 
 	cstr = com_right(context->et_list, error_code);
 	if (cstr)
@@ -177,11 +153,14 @@ hx509_get_error_string(hx509_context context, int error_code)
 	return str;
     }
 
-    for (msg = context->error; msg; msg = msg->next)
-	p = rk_strpoolprintf(p, "%s%s", msg->msg,
-			     msg->next != NULL ? "; " : "");
-
-    return rk_strpoolcollect(p);
+    s = heim_error_copy_string(msg);
+    if (s) {
+	const char *cstr = heim_string_get_utf8(s);
+	if (cstr)
+	    str = strdup(cstr);
+	heim_release(s);
+    }
+    return str;
 }
 
 /**
@@ -217,13 +196,14 @@ hx509_err(hx509_context context, int exit_code,
     va_list ap;
     const char *msg;
     char *str;
+    int ret;
 
     va_start(ap, fmt);
-    vasprintf(&str, fmt, ap);
+    ret = vasprintf(&str, fmt, ap);
     va_end(ap);
     msg = hx509_get_error_string(context, error_code);
     if (msg == NULL)
 	msg = "no error";
 
-    errx(exit_code, "%s: %s", str, msg);
+    errx(exit_code, "%s: %s", ret != -1 ? str : "ENOMEM", msg);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/file.c b/crypto/external/bsd/heimdal/dist/lib/hx509/file.c
index 57fd2aa02..af6084de7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/file.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/file.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: file.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: file.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 - 2006 Kungliga Tekniska Högskolan
@@ -100,7 +100,7 @@ hx509_pem_write(hx509_context context, const char *type,
 	if (length > ENCODE_LINE_LENGTH)
 	    length = ENCODE_LINE_LENGTH;
 
-	l = base64_encode(p, length, &line);
+	l = rk_base64_encode(p, length, &line);
 	if (l < 0) {
 	    hx509_set_error_string(context, 0, ENOMEM,
 				   "malloc - out of memory");
@@ -257,7 +257,7 @@ hx509_pem_read(hx509_context context,
 	    }
 
 	    p = emalloc(i);
-	    i = base64_decode(buf, p);
+	    i = rk_base64_decode(buf, p);
 	    if (i < 0) {
 		free(p);
 		goto out;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/hx509.h b/crypto/external/bsd/heimdal/dist/lib/hx509/hx509.h
index 7a0eca246..d8abbbd1a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/hx509.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/hx509.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hx509.h,v 1.1.1.2 2011/04/14 14:08:56 elric Exp $	*/
+/*	$NetBSD: hx509.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -41,6 +41,7 @@
 #include <krb5/rfc2459_asn1.h>
 #include <stdarg.h>
 #include <stdio.h>
+#include <krb5/heimbase.h>
 
 typedef struct hx509_cert_attribute_data *hx509_cert_attribute;
 typedef struct hx509_cert_data *hx509_cert;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/hx509_err.et b/crypto/external/bsd/heimdal/dist/lib/hx509/hx509_err.et
index fcfccfe82..8c52c785a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/hx509_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/hx509_err.et
@@ -8,7 +8,7 @@ id "Id"
 error_table hx
 prefix HX509
 
-# path validateion and construction related errors
+# path validation and construction related errors
 error_code BAD_TIMEFORMAT,	"ASN.1 failed call to system time library"
 error_code EXTENSION_NOT_FOUND,	"Extension not found"
 error_code NO_PATH,		"Certification path not found"
@@ -21,9 +21,9 @@ error_code CERT_USED_AFTER_TIME, "Certificate used after it became invalid"
 error_code PRIVATE_KEY_MISSING,	"Private key required for the operation is missing"
 error_code ALG_NOT_SUPP, 	"Algorithm not supported"
 error_code ISSUER_NOT_FOUND, 	"Issuer couldn't be found"
-error_code VERIFY_CONSTRAINTS,	"Error verifing constraints"
+error_code VERIFY_CONSTRAINTS,	"Error verifying constraints"
 error_code RANGE,		"Number too large"
-error_code NAME_CONSTRAINT_ERROR, "Error while verifing name constraints"
+error_code NAME_CONSTRAINT_ERROR, "Error while verifying name constraints"
 error_code PATH_TOO_LONG, "Path is too long, failed to find valid anchor"
 error_code KU_CERT_MISSING, "Required keyusage for this certificate is missing"
 error_code CERT_NOT_FOUND, "Certificate not found"
@@ -32,10 +32,10 @@ error_code PARENT_IS_CA, "Parent certificate is a CA"
 error_code EXTRA_DATA_AFTER_STRUCTURE, "Extra data was found after the structure"
 error_code PROXY_CERT_INVALID, "Proxy certificate is invalid"
 error_code PROXY_CERT_NAME_WRONG, "Proxy certificate name is wrong"
-error_code NAME_MALFORMED, "Name is malformated"
-error_code CERTIFICATE_MALFORMED, "Certificate is malformated"
+error_code NAME_MALFORMED, "Name is malformed"
+error_code CERTIFICATE_MALFORMED, "Certificate is malformed"
 error_code CERTIFICATE_MISSING_EKU, "Certificate is missing a required EKU"
-error_code PROXY_CERTIFICATE_NOT_CANONICALIZED, "Proxy certificate not canonicalize" 
+error_code PROXY_CERTIFICATE_NOT_CANONICALIZED, "Proxy certificate not canonicalized"
 
 # cms related errors
 index 32
@@ -58,9 +58,9 @@ error_code SIGNATURE_MISSING, "Signature missing for data"
 error_code BAD_SIGNATURE, "Signature is not valid"
 error_code SIG_NO_CONF, "Sigature doesn't provide confidentiality"
 error_code SIG_INVALID_FORMAT, "Invalid format on signature"
-error_code OID_MISMATCH, "Mismatch bewteen oids"
+error_code OID_MISMATCH, "Mismatch between oids"
 error_code NO_PROMPTER, "No prompter function defined"
-error_code SIGNATURE_WITHOUT_SIGNER, "Signature require signer, but non available"
+error_code SIGNATURE_WITHOUT_SIGNER, "Signature requires signer, but none available"
 error_code RSA_PUBLIC_ENCRYPT, "RSA public encyption failed"
 error_code RSA_PRIVATE_ENCRYPT, "RSA private encyption failed"
 error_code RSA_PUBLIC_DECRYPT, "RSA public decryption failed"
@@ -100,4 +100,10 @@ error_code OPEN_SESSION,  "Failed to open session to slot"
 error_code LOGIN,  "Failed to login to slot"
 error_code LOAD,  "Failed to load PKCS module"
 
+# pkinit related errors
+error_code PIN_INCORRECT, "Incorrect User PIN"
+error_code PIN_LOCKED, "User PIN locked"
+error_code PIN_NOT_INITIALIZED, "User PIN not initialized"
+error_code PIN_EXPIRED, "User PIN expired"
+
 end
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/hx_locl.h b/crypto/external/bsd/heimdal/dist/lib/hx509/hx_locl.h
index 220ad225c..f2428ffda 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/hx_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/hx_locl.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: hx_locl.h,v 1.1.1.2 2011/04/14 14:08:56 elric Exp $	*/
+/*	$NetBSD: hx_locl.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
- * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -72,14 +72,24 @@
 
 #include <krb5/der.h>
 
+/*
+ * We use OpenSSL for EC, but to do this we need to disable cross-references
+ * between OpenSSL and hcrypto bn.h and such.  Source files that use OpenSSL EC
+ * must define HEIM_NO_CRYPTO_HDRS before including this file.
+ */
+
 #define HC_DEPRECATED_CRYPTO
+#ifndef HEIM_NO_CRYPTO_HDRS
 #include "crypto-headers.h"
+#endif
 
 struct hx509_keyset_ops;
 struct hx509_collector;
 struct hx509_generate_private_context;
 typedef struct hx509_path hx509_path;
 
+#include <krb5/heimbase.h>
+
 #include <krb5/hx509.h>
 
 typedef void (*_hx509_cert_release_func)(struct hx509_cert_data *, void *);
@@ -188,7 +198,7 @@ struct hx509_context_data {
 #define HX509_CTX_VERIFY_MISSING_OK	1
     int ocsp_time_diff;
 #define HX509_DEFAULT_OCSP_TIME_DIFF	(5*60)
-    hx509_error error;
+    heim_error_t error;
     struct et_list *et_list;
     char *querystat;
     hx509_certs default_trust_anchors;
@@ -213,6 +223,95 @@ extern const AlgorithmIdentifier * _hx509_crypto_default_sig_alg;
 extern const AlgorithmIdentifier * _hx509_crypto_default_digest_alg;
 extern const AlgorithmIdentifier * _hx509_crypto_default_secret_alg;
 
+/*
+ * Private bits from crypto.c, so crypto-ec.c can also see them.
+ *
+ * This is part of the use-OpenSSL-for-EC hack.
+ */
+
+struct hx509_crypto;
+
+struct signature_alg;
+
+struct hx509_generate_private_context {
+    const heim_oid *key_oid;
+    int isCA;
+    unsigned long num_bits;
+};
+
+struct hx509_private_key_ops {
+    const char *pemtype;
+    const heim_oid *key_oid;
+    int (*available)(const hx509_private_key,
+		     const AlgorithmIdentifier *);
+    int (*get_spki)(hx509_context,
+		    const hx509_private_key,
+		    SubjectPublicKeyInfo *);
+    int (*export)(hx509_context context,
+		  const hx509_private_key,
+		  hx509_key_format_t,
+		  heim_octet_string *);
+    int (*import)(hx509_context, const AlgorithmIdentifier *,
+		  const void *, size_t, hx509_key_format_t,
+		  hx509_private_key);
+    int (*generate_private_key)(hx509_context,
+				struct hx509_generate_private_context *,
+				hx509_private_key);
+    BIGNUM *(*get_internal)(hx509_context, hx509_private_key, const char *);
+};
+
+struct hx509_private_key {
+    unsigned int ref;
+    const struct signature_alg *md;
+    const heim_oid *signature_alg;
+    union {
+	RSA *rsa;
+	void *keydata;
+        void *ecdsa; /* EC_KEY */
+    } private_key;
+    hx509_private_key_ops *ops;
+};
+
+/*
+ *
+ */
+
+struct signature_alg {
+    const char *name;
+    const heim_oid *sig_oid;
+    const AlgorithmIdentifier *sig_alg;
+    const heim_oid *key_oid;
+    const AlgorithmIdentifier *digest_alg;
+    int flags;
+#define PROVIDE_CONF	0x1
+#define REQUIRE_SIGNER	0x2
+#define SELF_SIGNED_OK	0x4
+#define WEAK_SIG_ALG	0x8
+
+#define SIG_DIGEST	0x100
+#define SIG_PUBLIC_SIG	0x200
+#define SIG_SECRET	0x400
+
+#define RA_RSA_USES_DIGEST_INFO 0x1000000
+
+    time_t best_before; /* refuse signature made after best before date */
+    const EVP_MD *(*evp_md)(void);
+    int (*verify_signature)(hx509_context context,
+			    const struct signature_alg *,
+			    const Certificate *,
+			    const AlgorithmIdentifier *,
+			    const heim_octet_string *,
+			    const heim_octet_string *);
+    int (*create_signature)(hx509_context,
+			    const struct signature_alg *,
+			    const hx509_private_key,
+			    const AlgorithmIdentifier *,
+			    const heim_octet_string *,
+			    AlgorithmIdentifier *,
+			    heim_octet_string *);
+    int digest_size;
+};
+
 /*
  * Configurable options
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool-commands.in b/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool-commands.in
index d5cc72b31..d3f88e05d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool-commands.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool-commands.in
@@ -107,7 +107,7 @@ command = {
 	option = {
 		long = "embedded-certs"
 		type = "-flag"
-		help = "dont embedded certficiates"
+		help = "don't embed certificates"
 	}
 	option = {
 		long = "embed-leaf-only"
@@ -408,6 +408,17 @@ command = {
 	argument="ocsp-response-file ..."
 	help = "Print the OCSP responses"
 }
+command = {
+	name = "revoke-print"
+	option = {
+		long = "verbose"
+		type = "flag"
+		help = "verbose"
+	}
+	min_args="1"
+	argument="ocsp/crl files"
+	help = "Print the OCSP/CRL files"
+}
 command = {
 	name = "request-create"
 	option = {
@@ -623,6 +634,11 @@ command = {
 		type = "string"
 		help = "Lifetime of certificate"
 	}
+	option = {
+		long = "signature-algorithm"
+		type = "string"
+		help = "Signature algorithm to use"
+	}
 	option = {
 		long = "serial-number"
 		type = "string"
@@ -646,7 +662,7 @@ command = {
 	}
 	option = {
 		long = "pk-init-principal"
-		type = "string"
+		type = "strings"
 		help = "PK-INIT principal (for SAN)"
 	}
 	option = {
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool.c b/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool.c
index e9e2c7f7c..dacde6938 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/hxtool.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: hxtool.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: hxtool.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
- * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -374,9 +374,9 @@ cms_create_sd(struct cms_create_sd_options *opt, int argc, char **argv)
     infile = argv[0];
 
     if (argc < 2) {
-	asprintf(&outfile, "%s.%s", infile,
-		 opt->pem_flag ? "pem" : "cms-signeddata");
-	if (outfile == NULL)
+	ret = asprintf(&outfile, "%s.%s", infile,
+		       opt->pem_flag ? "pem" : "cms-signeddata");
+	if (ret == -1 || outfile == NULL)
 	    errx(1, "out of memory");
     } else
 	outfile = argv[1];
@@ -1137,6 +1137,45 @@ ocsp_print(struct ocsp_print_options *opt, int argc, char **argv)
     return 0;
 }
 
+int
+revoke_print(struct revoke_print_options *opt, int argc, char **argv)
+{
+    hx509_revoke_ctx revoke_ctx;
+    int ret;
+
+    ret = hx509_revoke_init(context, &revoke_ctx);
+    if (ret)
+	errx(1, "hx509_revoke_init: %d", ret);
+
+    while(argc--) {
+	char *s = *argv++;
+
+	if (strncmp(s, "crl:", 4) == 0) {
+	    s += 4;
+
+	    ret = hx509_revoke_add_crl(context, revoke_ctx, s);
+	    if (ret)
+		errx(1, "hx509_revoke_add_crl: %s: %d", s, ret);
+
+	} else if (strncmp(s, "ocsp:", 4) == 0) {
+	    s += 5;
+
+	    ret = hx509_revoke_add_ocsp(context, revoke_ctx, s);
+	    if (ret)
+		errx(1, "hx509_revoke_add_ocsp: %s: %d", s, ret);
+
+	} else {
+	    errx(1, "unknown option to verify: `%s'\n", s);
+	}
+    }
+
+    ret = hx509_revoke_print(context, revoke_ctx, stdout);
+    if (ret)
+	warnx("hx509_revoke_print: %d", ret);
+
+    return ret;
+}
+
 /*
  *
  */
@@ -1396,7 +1435,7 @@ info(void *opt, int argc, char **argv)
 	if (m != NULL)
 	    printf("dh: %s\n", m->name);
     }
-#ifdef HAVE_OPENSSL
+#ifdef HAVE_HCRYPTO_W_OPENSSL
     {
 	printf("ecdsa: ECDSA_METHOD-not-export\n");
     }
@@ -1694,12 +1733,13 @@ eval_types(hx509_context contextp,
 	}
     }
 
-    if (opt->pk_init_principal_string) {
+    for (i = 0; i < opt->pk_init_principal_strings.num_strings; i++) {
+	const char *pk_init_princ = opt->pk_init_principal_strings.strings[i];
+
 	if (!ctopt.pkinit)
 	    errx(1, "pk-init principal given but no pk-init oid");
 
-	ret = hx509_ca_tbs_add_san_pkinit(contextp, tbs,
-					  opt->pk_init_principal_string);
+	ret = hx509_ca_tbs_add_san_pkinit(contextp, tbs, pk_init_princ);
 	if (ret)
 	    hx509_err(contextp, 1, ret, "hx509_ca_tbs_add_san_pkinit");
     }
@@ -1890,6 +1930,17 @@ hxtool_ca(struct certificate_sign_options *opt, int argc, char **argv)
     if (ret)
 	hx509_err(context, 1, ret, "hx509_ca_tbs_init");
 
+    if (opt->signature_algorithm_string) {
+	const AlgorithmIdentifier *sigalg;
+	if (strcasecmp(opt->signature_algorithm_string, "rsa-with-sha1") == 0)
+	    sigalg = hx509_signature_rsa_with_sha1();
+	else if (strcasecmp(opt->signature_algorithm_string, "rsa-with-sha256") == 0)
+	    sigalg = hx509_signature_rsa_with_sha256();
+	else
+	    errx(1, "unsupported sigature algorithm");
+	hx509_ca_tbs_set_signature_algorithm(context, tbs, sigalg);
+    }
+
     if (opt->template_certificate_string) {
 	hx509_cert template;
 	hx509_certs tcerts;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/keyset.c b/crypto/external/bsd/heimdal/dist/lib/hx509/keyset.c
index 83835b902..b78660776 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/keyset.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/keyset.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keyset.c,v 1.1.1.1 2011/04/13 18:15:11 elric Exp $	*/
+/*	$NetBSD: keyset.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -109,6 +109,8 @@ _hx509_ks_register(hx509_context context, struct hx509_keyset_ops *ops)
  * select no password/certifictes/prompt lock (see @ref page_lock).
  * @param certs return pointer, free with hx509_certs_free().
  *
+ * @return Returns an hx509 error code.
+ *
  * @ingroup hx509_keyset
  */
 
@@ -320,8 +322,8 @@ hx509_certs_end_seq(hx509_context context,
 }
 
 /**
- * Iterate over all certificates in a keystore and call an function
- * for each fo them.
+ * Iterate over all certificates in a keystore and call a function
+ * for each of them.
  *
  * @param context a hx509 context.
  * @param certs certificate store to iterate over.
@@ -368,21 +370,6 @@ hx509_certs_iter_f(hx509_context context,
     return ret;
 }
 
-/**
- * Iterate over all certificates in a keystore and call an function
- * for each fo them.
- *
- * @param context a hx509 context.
- * @param certs certificate store to iterate over.
- * @param func function to call for each certificate. The function
- * should return non-zero to abort the iteration, that value is passed
- * back to the caller of hx509_certs_iter().
- *
- * @return Returns an hx509 error code.
- *
- * @ingroup hx509_keyset
- */
-
 #ifdef __BLOCKS__
 
 static int
@@ -393,8 +380,8 @@ certs_iter(hx509_context context, void *ctx, hx509_cert cert)
 }
 
 /**
- * Iterate over all certificates in a keystore and call an block
- * for each fo them.
+ * Iterate over all certificates in a keystore and call a block
+ * for each of them.
  *
  * @param context a hx509 context.
  * @param certs certificate store to iterate over.
@@ -754,11 +741,12 @@ _hx509_pi_printf(int (*func)(void *, const char *), void *ctx,
 {
     va_list ap;
     char *str;
+    int ret;
 
     va_start(ap, fmt);
-    vasprintf(&str, fmt, ap);
+    ret = vasprintf(&str, fmt, ap);
     va_end(ap);
-    if (str == NULL)
+    if (ret == -1 || str == NULL)
 	return;
     (*func)(ctx, str);
     free(str);
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_dir.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_dir.c
index 5112289c6..3205f8a37 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_dir.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_dir.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_dir.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: ks_dir.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -213,7 +213,10 @@ static struct hx509_keyset_ops keyset_dir = {
     NULL,
     dir_iter_start,
     dir_iter,
-    dir_iter_end
+    dir_iter_end,
+    NULL,
+    NULL,
+    NULL
 };
 
 void
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_file.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_file.c
index f95a35924..d8e155d52 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_file.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_file.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_file.c,v 1.1.1.2 2014/04/24 12:45:41 pettai Exp $	*/
+/*	$NetBSD: ks_file.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 - 2007 Kungliga Tekniska Högskolan
@@ -54,12 +54,16 @@ parse_certificate(hx509_context context, const char *fn,
 		  const void *data, size_t len,
 		  const AlgorithmIdentifier *ai)
 {
+    heim_error_t error = NULL;
     hx509_cert cert;
     int ret;
 
-    ret = hx509_cert_init_data(context, data, len, &cert);
-    if (ret)
+    cert = hx509_cert_init_data(context, data, len, &error);
+    if (cert == NULL) {
+	ret = heim_error_get_code(error);
+	heim_release(error);
 	return ret;
+    }
 
     ret = _hx509_collector_certs_add(context, c, cert);
     hx509_cert_free(cert);
@@ -94,9 +98,10 @@ try_decrypt(hx509_context context,
 			 password, passwordlen,
 			 1, key, NULL);
     if (ret <= 0) {
-	hx509_set_error_string(context, 0, HX509_CRYPTO_INTERNAL_ERROR,
+	ret = HX509_CRYPTO_INTERNAL_ERROR;
+	hx509_set_error_string(context, 0, ret,
 			       "Failed to do string2key for private key");
-	return HX509_CRYPTO_INTERNAL_ERROR;
+        goto out;
     }
 
     clear.data = malloc(len);
@@ -317,7 +322,9 @@ struct pem_formats {
     { "CERTIFICATE", parse_certificate, NULL },
     { "PRIVATE KEY", parse_pkcs8_private_key, NULL },
     { "RSA PRIVATE KEY", parse_pem_private_key, hx509_signature_rsa },
+#ifdef HAVE_HCRYPTO_W_OPENSSL
     { "EC PRIVATE KEY", parse_pem_private_key, hx509_signature_ecPublicKey }
+#endif
 };
 
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_keychain.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_keychain.c
index c0bd5d07b..e967253b5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_keychain.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_keychain.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_keychain.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: ks_keychain.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
@@ -37,6 +37,9 @@
 
 #ifdef HAVE_FRAMEWORK_SECURITY
 
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+
 #include <Security/Security.h>
 
 /* Missing function decls in pre Leopard */
@@ -248,6 +251,7 @@ static const RSA_METHOD kc_rsa_pkcs1_method = {
     0,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
@@ -342,11 +346,13 @@ keychain_init(hx509_context context,
 	    if (ret != noErr) {
 		hx509_set_error_string(context, 0, ENOENT,
 				       "Failed to open %s", residue);
+		free(ctx);
 		return ENOENT;
 	    }
 	} else {
 	    hx509_set_error_string(context, 0, ENOENT,
 				   "Unknown subtype %s", residue);
+	    free(ctx);
 	    return ENOENT;
 	}
     }
@@ -422,8 +428,8 @@ keychain_iter_start(hx509_context context,
 
 	    SecCertificateGetData(cr, &cssm);
 
-	    ret = hx509_cert_init_data(context, cssm.Data, cssm.Length, &cert);
-	    if (ret)
+	    cert = hx509_cert_init_data(context, cssm.Data, cssm.Length, NULL);
+	    if (cert == NULL)
 		continue;
 
 	    ret = hx509_certs_add(context, iter->certs, cert);
@@ -472,6 +478,7 @@ keychain_iter(hx509_context context,
     UInt32 attrFormat[1] = { 0 };
     SecKeychainItemRef itemRef;
     SecItemAttr item[1];
+    heim_error_t error = NULL;
     struct iter *iter = cursor;
     OSStatus ret;
     UInt32 len;
@@ -503,9 +510,12 @@ keychain_iter(hx509_context context,
     if (ret)
 	return EINVAL;
 
-    ret = hx509_cert_init_data(context, ptr, len, cert);
-    if (ret)
+    *cert = hx509_cert_init_data(context, ptr, len, &error);
+    if (*cert == NULL) {
+	ret = heim_error_get_code(error);
+	heim_release(error);
 	goto out;
+    }
 
     /*
      * Find related private key if there is one by looking at
@@ -588,9 +598,14 @@ struct hx509_keyset_ops keyset_keychain = {
     NULL,
     keychain_iter_start,
     keychain_iter,
-    keychain_iter_end
+    keychain_iter_end,
+    NULL,
+    NULL,
+    NULL
 };
 
+#pragma clang diagnostic pop
+
 #endif /* HAVE_FRAMEWORK_SECURITY */
 
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_mem.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_mem.c
index 5ea8c2a74..4d59e4023 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_mem.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_mem.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_mem.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: ks_mem.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 - 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_null.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_null.c
index 7a233ab7b..79c9b63ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_null.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_null.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_null.c,v 1.1.1.1 2011/04/13 18:15:11 elric Exp $	*/
+/*	$NetBSD: ks_null.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 - 2006 Kungliga Tekniska Högskolan
@@ -89,7 +89,10 @@ struct hx509_keyset_ops keyset_null = {
     NULL,
     null_iter_start,
     null_iter,
-    null_iter_end
+    null_iter_end,
+    NULL,
+    NULL,
+    NULL
 };
 
 void
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p11.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p11.c
index 605b4adb7..ebe4a72d4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p11.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p11.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_p11.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: ks_p11.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2008 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 
 #ifdef HAVE_DLOPEN
 
-#include "pkcs11.h"
+#include "ref/pkcs11.h"
 
 struct p11_slot {
     int flags;
@@ -67,6 +67,7 @@ struct p11_module {
     CK_FUNCTION_LIST_PTR funcs;
     CK_ULONG num_slots;
     unsigned int ref;
+    unsigned int selected_slot;
     struct p11_slot *slot;
 };
 
@@ -228,6 +229,7 @@ static const RSA_METHOD p11_rsa_pkcs1_method = {
     0,
     NULL,
     NULL,
+    NULL,
     NULL
 };
 
@@ -332,8 +334,10 @@ p11_init_slot(hx509_context context,
 	break;
     }
 
-    asprintf(&slot->name, "%.*s",
-	     (int)i, slot_info.slotDescription);
+    ret = asprintf(&slot->name, "%.*s", (int)i,
+		   slot_info.slotDescription);
+    if (ret == -1)
+	return ENOMEM;
 
     if ((slot_info.flags & CKF_TOKEN_PRESENT) == 0)
 	return 0;
@@ -342,7 +346,7 @@ p11_init_slot(hx509_context context,
     if (ret) {
 	hx509_set_error_string(context, 0, HX509_PKCS11_NO_TOKEN,
 			       "Failed to init PKCS11 slot %d "
-			       "with error 0x08x",
+			       "with error 0x%08x",
 			       num, ret);
 	return HX509_PKCS11_NO_TOKEN;
     }
@@ -424,7 +428,12 @@ p11_get_session(hx509_context context,
 
 	    memset(&prompt, 0, sizeof(prompt));
 
-	    asprintf(&str, "PIN code for %s: ", slot->name);
+	    ret = asprintf(&str, "PIN code for %s: ", slot->name);
+	    if (ret == -1 || str == NULL) {
+		if (context)
+		    hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+		return ENOMEM;
+	    }
 	    prompt.prompt = str;
 	    prompt.type = HX509_PROMPT_TYPE_PASSWORD;
 	    prompt.reply.data = pin;
@@ -453,7 +462,18 @@ p11_get_session(hx509_context context,
 				       "Failed to login on slot id %d "
 				       "with error: 0x%08x",
 				       (int)slot->id, ret);
-	    return HX509_PKCS11_LOGIN;
+	    switch(ret) {
+	        case CKR_PIN_LOCKED:
+	            return HX509_PKCS11_PIN_LOCKED;
+	        case CKR_PIN_EXPIRED:
+	            return HX509_PKCS11_PIN_EXPIRED;
+	        case CKR_PIN_INCORRECT:
+	            return HX509_PKCS11_PIN_INCORRECT;
+	        case CKR_USER_PIN_NOT_INITIALIZED:
+	            return HX509_PKCS11_PIN_NOT_INITIALIZED;
+	        default:
+	            return HX509_PKCS11_LOGIN;
+	    }
 	} else
 	    slot->flags |= P11_LOGIN_DONE;
 
@@ -682,6 +702,7 @@ collect_cert(hx509_context context,
 	     void *ptr, CK_ATTRIBUTE *query, int num_query)
 {
     struct hx509_collector *collector = ptr;
+    heim_error_t error = NULL;
     hx509_cert cert;
     int ret;
 
@@ -691,10 +712,13 @@ collect_cert(hx509_context context,
 	return 0;
     }
 
-    ret = hx509_cert_init_data(context, query[1].pValue,
-			       query[1].ulValueLen, &cert);
-    if (ret)
+    cert = hx509_cert_init_data(context, query[1].pValue,
+			       query[1].ulValueLen, &error);
+    if (cert == NULL) {
+	ret = heim_error_get_code(error);
+	heim_release(error);
 	return ret;
+    }
 
     if (p->ref == 0)
 	_hx509_abort("pkcs11 ref == 0 on alloc");
@@ -719,9 +743,9 @@ collect_cert(hx509_context context,
     if ((CK_LONG)query[2].ulValueLen != -1) {
 	char *str;
 
-	asprintf(&str, "%.*s",
-		 (int)query[2].ulValueLen, (char *)query[2].pValue);
-	if (str) {
+	ret = asprintf(&str, "%.*s",
+		       (int)query[2].ulValueLen, (char *)query[2].pValue);
+	if (ret != -1 && str) {
 	    hx509_cert_set_friendly_name(cert, str);
 	    free(str);
 	}
@@ -812,6 +836,7 @@ p11_init(hx509_context context,
     }
 
     p->ref = 1;
+    p->selected_slot = 0;
 
     str = strchr(list, ',');
     if (str)
@@ -821,15 +846,12 @@ p11_init(hx509_context context,
 	strnext = strchr(str, ',');
 	if (strnext)
 	    *strnext++ = '\0';
-#if 0
 	if (strncasecmp(str, "slot=", 5) == 0)
 	    p->selected_slot = atoi(str + 5);
-#endif
 	str = strnext;
     }
 
     p->dl_handle = dlopen(list, RTLD_NOW);
-    free(list);
     if (p->dl_handle == NULL) {
 	ret = HX509_PKCS11_LOAD;
 	hx509_set_error_string(context, 0, ret,
@@ -910,11 +932,13 @@ p11_init(hx509_context context,
 	}
 
 	for (i = 0; i < p->num_slots; i++) {
+	    if ((p->selected_slot != 0) && (slot_ids[i] != (p->selected_slot - 1)))
+		continue;
 	    ret = p11_init_slot(context, p, lock, slot_ids[i], i, &p->slot[i]);
-	    if (ret)
-		break;
-	    if (p->slot[i].flags & P11_TOKEN_PRESENT)
-		num_tokens++;
+	    if (!ret) {
+	        if (p->slot[i].flags & P11_TOKEN_PRESENT)
+	            num_tokens++;
+	    }
 	}
 	free(slot_ids);
 	if (ret)
@@ -925,10 +949,14 @@ p11_init(hx509_context context,
 	}
     }
 
+    free(list);
+
     *data = p;
 
     return 0;
  out:
+    if (list)
+	free(list);
     p11_release_module(p);
     return ret;
 }
@@ -1178,7 +1206,9 @@ static struct hx509_keyset_ops keyset_pkcs11 = {
     p11_iter_start,
     p11_iter,
     p11_iter_end,
-    p11_printinfo
+    p11_printinfo,
+    NULL,
+    NULL
 };
 
 #endif /* HAVE_DLOPEN */
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p12.c b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p12.c
index 61ec64911..eac4d3518 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p12.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ks_p12.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ks_p12.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: ks_p12.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -132,6 +132,7 @@ certBag_parser(hx509_context context,
 	       const void *data, size_t length,
 	       const PKCS12_Attributes *attrs)
 {
+    heim_error_t error = NULL;
     heim_octet_string os;
     hx509_cert cert;
     PKCS12_CertBag cb;
@@ -154,10 +155,13 @@ certBag_parser(hx509_context context,
     if (ret)
 	return ret;
 
-    ret = hx509_cert_init_data(context, os.data, os.length, &cert);
+    cert = hx509_cert_init_data(context, os.data, os.length, &error);
     der_free_octet_string(&os);
-    if (ret)
+    if (cert == NULL) {
+	ret = heim_error_get_code(error);
+	heim_release(error);
 	return ret;
+    }
 
     ret = _hx509_collector_certs_add(context, c, cert);
     if (ret) {
@@ -699,7 +703,10 @@ static struct hx509_keyset_ops keyset_pkcs12 = {
     NULL,
     p12_iter_start,
     p12_iter,
-    p12_iter_end
+    p12_iter_end,
+    NULL,
+    NULL,
+    NULL
 };
 
 void
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/libhx509-exports.def b/crypto/external/bsd/heimdal/dist/lib/hx509/libhx509-exports.def
index f8973a091..f44177301 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/libhx509-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/libhx509-exports.def
@@ -1,3 +1,4 @@
+
 EXPORTS
 	_hx509_cert_assign_key
 	_hx509_cert_private_key
@@ -51,6 +52,7 @@ EXPORTS
 	hx509_ca_tbs_set_notBefore
 	hx509_ca_tbs_set_proxy
 	hx509_ca_tbs_set_serialnumber
+	hx509_ca_tbs_set_signature_algorithm
 	hx509_ca_tbs_set_spki
 	hx509_ca_tbs_set_subject
 	hx509_ca_tbs_set_template
@@ -196,6 +198,7 @@ EXPORTS
 	hx509_revoke_free
 	hx509_revoke_init
 	hx509_revoke_ocsp_print
+	hx509_revoke_print
 	hx509_revoke_verify
 	hx509_set_error_string
 	hx509_set_error_stringv
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/lock.c b/crypto/external/bsd/heimdal/dist/lib/hx509/lock.c
index 4ce238221..1c735db33 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/lock.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/lock.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: lock.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: lock.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 - 2006 Kungliga Tekniska Högskolan
@@ -49,7 +49,10 @@ struct hx509_lock_data {
 };
 
 static struct hx509_lock_data empty_lock_data = {
-    { 0, NULL }
+    { 0, NULL },
+    NULL,
+    NULL,
+    NULL
 };
 
 hx509_lock _hx509_empty_lock = &empty_lock_data;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/name.c b/crypto/external/bsd/heimdal/dist/lib/hx509/name.c
index 032fe067b..40e1e4b72 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: name.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: name.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2009 Kungliga Tekniska Högskolan
@@ -240,15 +240,22 @@ _hx509_Name_to_string(const Name *n, char **str)
 		size_t k;
 
 		ret = wind_ucs2utf8_length(bmp, bmplen, &k);
-		if (ret)
+		if (ret) {
+                    free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
+                }
 
 		ss = malloc(k + 1);
 		if (ss == NULL)
 		    _hx509_abort("allocation failure"); /* XXX */
 		ret = wind_ucs2utf8(bmp, bmplen, ss, NULL);
 		if (ret) {
+                    free(oidname);
 		    free(ss);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
 		}
 		ss[k] = '\0';
@@ -265,8 +272,12 @@ _hx509_Name_to_string(const Name *n, char **str)
 		size_t k;
 
 		ret = wind_ucs4utf8_length(uni, unilen, &k);
-		if (ret)
+		if (ret) {
+                    free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
+                }
 
 		ss = malloc(k + 1);
 		if (ss == NULL)
@@ -274,6 +285,9 @@ _hx509_Name_to_string(const Name *n, char **str)
 		ret = wind_ucs4utf8(uni, unilen, ss, NULL);
 		if (ret) {
 		    free(ss);
+                    free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
 		}
 		ss[k] = '\0';
@@ -968,7 +982,7 @@ hx509_general_name_unparse(GeneralName *name, char **str)
 	char *s;
 	int ret;
 	memset(&dir, 0, sizeof(dir));
-	dir.element = name->u.directoryName.element;
+	dir.element = (enum Name_enum)name->u.directoryName.element;
 	dir.u.rdnSequence = name->u.directoryName.u.rdnSequence;
 	ret = _hx509_unparse_Name(&dir, &s);
 	if (ret)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/peer.c b/crypto/external/bsd/heimdal/dist/lib/hx509/peer.c
index 8f72c61be..d9bcd8c72 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/peer.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/peer.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: peer.c,v 1.1.1.1 2011/04/13 18:15:12 elric Exp $	*/
+/*	$NetBSD: peer.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/print.c b/crypto/external/bsd/heimdal/dist/lib/hx509/print.c
index 9526e3977..5f346eb57 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/print.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/print.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: print.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: print.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -971,7 +971,7 @@ hx509_validate_cert(hx509_context context,
 	    }
 	    validate_print(ctx,
 			   HX509_VALIDATE_F_VALIDATE|HX509_VALIDATE_F_VERBOSE,
-			   "checking extention: %s\n",
+			   "checking extension: %s\n",
 			   check_extension[j].name);
 	    (*check_extension[j].func)(ctx,
 				       &status,
@@ -979,7 +979,7 @@ hx509_validate_cert(hx509_context context,
 				       &t->extensions->val[i]);
 	}
     } else
-	validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "no extentions\n");
+	validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "no extensions\n");
 
     if (status.isca) {
 	if (!status.haveSKI)
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/ref/pkcs11.h b/crypto/external/bsd/heimdal/dist/lib/hx509/ref/pkcs11.h
index 7dd812d53..a0f44bb22 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/ref/pkcs11.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/ref/pkcs11.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: pkcs11.h,v 1.1.1.1 2011/04/13 18:15:28 elric Exp $	*/
+/*	$NetBSD: pkcs11.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /* pkcs11.h
    Copyright 2006, 2007 g10 Code GmbH
@@ -66,8 +66,9 @@ extern "C" {
    (you may use a macro with a different name to keep track of your
    versions).  */
 #define CRYPTOKI_VERSION_MAJOR		2
-#define CRYPTOKI_VERSION_MINOR		20
-#define CRYPTOKI_VERSION_REVISION	6
+#define CRYPTOKI_VERSION_MINOR		30
+#define CRYPTOKI_VERSION_REVISION	0
+#define CRYPTOKI_VERSION_AMENDMENT	0
 
 
 /* Compatibility interface is default, unless CRYPTOKI_GNU is
@@ -93,7 +94,11 @@ extern "C" {
 
 #else
 
+#if defined(CRYPTOKI_VISIBILITY) && defined(CRYPTOKI_EXPORTS)
+#define CK_SPEC __attribute__((visibility("default")))
+#else
 #define CK_SPEC
+#endif
 
 #endif
 
@@ -164,6 +169,34 @@ extern "C" {
 #define min_key_size ulMinKeySize
 #define max_key_size ulMaxKeySize
 
+#define hash_alg hashAlg
+#define source_data pSourceData
+#define source_data_len ulSourceDataLen
+
+#define slen sLen
+
+#define ck_ec_kdf_type_t CK_EC_KDF_TYPE
+
+#define shared_data_len ulSharedDataLen
+#define shared_data pSharedData
+#define public_data_len ulPublicDataLen
+#define public_data pPublicData
+
+#define private_data_len ulPrivateDataLen
+#define private_data hPrivateData
+#define public_data_len2 ulPublicDataLen2
+#define public_data2 pPublicData2
+
+#define public_key publicKey
+
+#define ck_x9_42_dh_kdf_type_t CK_X9_42_DH_KDF_TYPE
+
+#define other_info_len ulOtherInfoLen
+#define other_info pOtherInfo
+
+#define data pData
+#define len ulLen
+
 #define ck_rv_t CK_RV
 #define ck_notify_t CK_NOTIFY
 
@@ -207,7 +240,7 @@ struct ck_info
 typedef unsigned long ck_notification_t;
 
 #define CKN_SURRENDER	(0)
-
+#define CKN_OTP_CHANGED	(1)
 
 typedef unsigned long ck_slot_id_t;
 
@@ -269,6 +302,7 @@ struct ck_token_info
 #define CKF_SO_PIN_FINAL_TRY			(1 << 21)
 #define CKF_SO_PIN_LOCKED			(1 << 22)
 #define CKF_SO_PIN_TO_BE_CHANGED		(1 << 23)
+#define CKF_ERROR_STATE				(1 << 24)
 
 #define CK_UNAVAILABLE_INFORMATION	((unsigned long) -1)
 #define CK_EFFECTIVELY_INFINITE		(0)
@@ -320,7 +354,8 @@ typedef unsigned long ck_object_class_t;
 #define CKO_HW_FEATURE		(5)
 #define CKO_DOMAIN_PARAMETERS	(6)
 #define CKO_MECHANISM		(7)
-#define CKO_VENDOR_DEFINED	((unsigned long) (1 << 31))
+#define CKO_OTP_KEY		(8)
+#define CKO_VENDOR_DEFINED	((unsigned long) (1ul << 31))
 
 
 typedef unsigned long ck_hw_feature_type_t;
@@ -328,7 +363,7 @@ typedef unsigned long ck_hw_feature_type_t;
 #define CKH_MONOTONIC_COUNTER	(1)
 #define CKH_CLOCK		(2)
 #define CKH_USER_INTERFACE	(3)
-#define CKH_VENDOR_DEFINED	((unsigned long) (1 << 31))
+#define CKH_VENDOR_DEFINED	((unsigned long) (1ul << 31))
 
 
 typedef unsigned long ck_key_type_t;
@@ -348,6 +383,7 @@ typedef unsigned long ck_key_type_t;
 #define CKK_DES3		(0x15)
 #define CKK_CAST		(0x16)
 #define CKK_CAST3		(0x17)
+#define CKK_CAST5		(0x18)
 #define CKK_CAST128		(0x18)
 #define CKK_RC5			(0x19)
 #define CKK_IDEA		(0x1a)
@@ -358,7 +394,24 @@ typedef unsigned long ck_key_type_t;
 #define CKK_AES			(0x1f)
 #define CKK_BLOWFISH		(0x20)
 #define CKK_TWOFISH		(0x21)
-#define CKK_VENDOR_DEFINED	((unsigned long) (1 << 31))
+#define CKK_SECURID		(0x22)
+#define CKK_HOTP		(0x23)
+#define CKK_ACTI		(0x24)
+#define CKK_CAMELLIA		(0x25)
+#define CKK_ARIA		(0x26)
+#define CKK_MD5_HMAC		(0x27)
+#define CKK_SHA_1_HMAC		(0x28)
+#define CKK_RIPEMD128_HMAC	(0x29)
+#define CKK_RIPEMD160_HMAC	(0x2A)
+#define CKK_SHA256_HMAC		(0x2B)
+#define CKK_SHA384_HMAC		(0x2C)
+#define CKK_SHA512_HMAC		(0x2D)
+#define CKK_SHA224_HMAC		(0x2E)
+#define CKK_SEED		(0x2F)
+#define CKK_GOSTR3410		(0x30)
+#define CKK_GOSTR3411		(0x31)
+#define CKK_GOST28147		(0x32)
+#define CKK_VENDOR_DEFINED	((unsigned long) (1ul << 31))
 
 
 typedef unsigned long ck_certificate_type_t;
@@ -366,8 +419,17 @@ typedef unsigned long ck_certificate_type_t;
 #define CKC_X_509		(0)
 #define CKC_X_509_ATTR_CERT	(1)
 #define CKC_WTLS		(2)
-#define CKC_VENDOR_DEFINED	((unsigned long) (1 << 31))
+#define CKC_VENDOR_DEFINED	((unsigned long) (1ul << 31))
+#define CKC_OPENPGP		(CKC_VENDOR_DEFINED|0x00504750)
 
+#define CK_OTP_FORMAT_DECIMAL		(0)
+#define CK_OTP_FORMAT_HEXADECIMAL	(1)
+#define CK_OTP_FORMAT_ALPHANUMERIC	(2)
+#define CK_OTP_FORMAT_BINARY		(3)
+
+#define CK_OTP_PARAM_IGNORED		(0)
+#define CK_OTP_PARAM_OPTIONAL		(1)
+#define CK_OTP_PARAM_MANDATORY		(2)
 
 typedef unsigned long ck_attribute_type_t;
 
@@ -390,6 +452,7 @@ typedef unsigned long ck_attribute_type_t;
 #define CKA_URL				(0x89)
 #define CKA_HASH_OF_SUBJECT_PUBLIC_KEY	(0x8a)
 #define CKA_HASH_OF_ISSUER_PUBLIC_KEY	(0x8b)
+#define CKA_NAME_HASH_ALGORITHM		(0x8c)
 #define CKA_CHECK_VALUE			(0x90)
 #define CKA_KEY_TYPE			(0x100)
 #define CKA_SUBJECT			(0x101)
@@ -420,6 +483,7 @@ typedef unsigned long ck_attribute_type_t;
 #define CKA_BASE			(0x132)
 #define CKA_PRIME_BITS			(0x133)
 #define CKA_SUB_PRIME_BITS		(0x134)
+#define CKA_SUBPRIME_BITS		(0x134)
 #define CKA_VALUE_BITS			(0x160)
 #define CKA_VALUE_LEN			(0x161)
 #define CKA_EXTRACTABLE			(0x162)
@@ -428,6 +492,7 @@ typedef unsigned long ck_attribute_type_t;
 #define CKA_ALWAYS_SENSITIVE		(0x165)
 #define CKA_KEY_GEN_MECHANISM		(0x166)
 #define CKA_MODIFIABLE			(0x170)
+#define CKA_COPYABLE			(0x171)
 #define CKA_ECDSA_PARAMS		(0x180)
 #define CKA_EC_PARAMS			(0x180)
 #define CKA_EC_POINT			(0x181)
@@ -435,6 +500,23 @@ typedef unsigned long ck_attribute_type_t;
 #define CKA_AUTH_PIN_FLAGS		(0x201)
 #define CKA_ALWAYS_AUTHENTICATE		(0x202)
 #define CKA_WRAP_WITH_TRUSTED		(0x210)
+#define CKA_OTP_FORMAT			(0x220)
+#define CKA_OTP_LENGTH			(0x221)
+#define CKA_OTP_TIME_INTERVAL		(0x222)
+#define CKA_OTP_USER_FRIENDLY_MODE	(0x223)
+#define CKA_OTP_CHALLENGE_REQUIREMENT	(0x224)
+#define CKA_OTP_TIME_REQUIREMENT	(0x225)
+#define CKA_OTP_COUNTER_REQUIREMENT	(0x226)
+#define CKA_OTP_PIN_REQUIREMENT		(0x227)
+#define CKA_OTP_COUNTER			(0x22E)
+#define CKA_OTP_TIME			(0x22F)
+#define CKA_OTP_USER_IDENTIFIER		(0x22A)
+#define CKA_OTP_SERVICE_IDENTIFIER	(0x22B)
+#define CKA_OTP_SERVICE_LOGO		(0x22C)
+#define CKA_OTP_SERVICE_LOGO_TYPE	(0x22D)
+#define CKA_GOSTR3410_PARAMS		(0x250)
+#define CKA_GOSTR3411_PARAMS		(0x251)
+#define CKA_GOST28147_PARAMS		(0x252)
 #define CKA_HW_FEATURE_TYPE		(0x300)
 #define CKA_RESET_ON_INIT		(0x301)
 #define CKA_HAS_RESET			(0x302)
@@ -454,8 +536,9 @@ typedef unsigned long ck_attribute_type_t;
 #define CKA_SUPPORTED_CMS_ATTRIBUTES	(0x503)
 #define CKA_WRAP_TEMPLATE		(CKF_ARRAY_ATTRIBUTE | 0x211)
 #define CKA_UNWRAP_TEMPLATE		(CKF_ARRAY_ATTRIBUTE | 0x212)
+#define CKA_DERIVE_TEMPLATE		(CKF_ARRAY_ATTRIBUTE | 0x213)
 #define CKA_ALLOWED_MECHANISMS		(CKF_ARRAY_ATTRIBUTE | 0x600)
-#define CKA_VENDOR_DEFINED		((unsigned long) (1 << 31))
+#define CKA_VENDOR_DEFINED		((unsigned long) (1ul << 31))
 
 
 struct ck_attribute
@@ -494,6 +577,10 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_DSA_KEY_PAIR_GEN		(0x10)
 #define	CKM_DSA				(0x11)
 #define CKM_DSA_SHA1			(0x12)
+#define CKM_DSA_SHA224			(0x13)
+#define CKM_DSA_SHA256			(0x14)
+#define CKM_DSA_SHA384			(0x15)
+#define CKM_DSA_SHA512			(0x16)
 #define CKM_DH_PKCS_KEY_PAIR_GEN	(0x20)
 #define CKM_DH_PKCS_DERIVE		(0x21)
 #define	CKM_X9_42_DH_KEY_PAIR_GEN	(0x30)
@@ -506,6 +593,8 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_SHA256_RSA_PKCS_PSS		(0x43)
 #define CKM_SHA384_RSA_PKCS_PSS		(0x44)
 #define CKM_SHA512_RSA_PKCS_PSS		(0x45)
+#define CKM_SHA224_RSA_PKCS		(0x46)
+#define CKM_SHA224_RSA_PKCS_PSS		(0x47)
 #define CKM_RC2_KEY_GEN			(0x100)
 #define CKM_RC2_ECB			(0x101)
 #define	CKM_RC2_CBC			(0x102)
@@ -527,12 +616,18 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_DES3_MAC			(0x134)
 #define CKM_DES3_MAC_GENERAL		(0x135)
 #define CKM_DES3_CBC_PAD		(0x136)
+#define CKM_DES3_CMAC_GENERAL		(0x137)
+#define CKM_DES3_CMAC			(0x138)
 #define CKM_CDMF_KEY_GEN		(0x140)
 #define CKM_CDMF_ECB			(0x141)
 #define CKM_CDMF_CBC			(0x142)
 #define CKM_CDMF_MAC			(0x143)
 #define CKM_CDMF_MAC_GENERAL		(0x144)
 #define CKM_CDMF_CBC_PAD		(0x145)
+#define CKM_DES_OFB64			(0x150)
+#define CKM_DES_OFB8			(0x151)
+#define CKM_DES_CFB64			(0x152)
+#define CKM_DES_CFB8			(0x153)
 #define CKM_MD2				(0x200)
 #define CKM_MD2_HMAC			(0x201)
 #define CKM_MD2_HMAC_GENERAL		(0x202)
@@ -551,12 +646,21 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_SHA256			(0x250)
 #define CKM_SHA256_HMAC			(0x251)
 #define CKM_SHA256_HMAC_GENERAL		(0x252)
+#define CKM_SHA224			(0x255)
+#define CKM_SHA224_HMAC			(0x256)
+#define CKM_SHA224_HMAC_GENERAL		(0x257)
 #define CKM_SHA384			(0x260)
 #define CKM_SHA384_HMAC			(0x261)
 #define CKM_SHA384_HMAC_GENERAL		(0x262)
 #define CKM_SHA512			(0x270)
 #define CKM_SHA512_HMAC			(0x271)
 #define CKM_SHA512_HMAC_GENERAL		(0x272)
+#define CKM_SECURID_KEY_GEN		(0x280)
+#define CKM_SECURID			(0x282)
+#define CKM_HOTP_KEY_GEN		(0x290)
+#define CKM_HOTP			(0x291)
+#define CKM_ACTI			(0x2A0)
+#define CKM_ACTI_KEY_GEN		(0x2A1)
 #define CKM_CAST_KEY_GEN		(0x300)
 #define CKM_CAST_ECB			(0x301)
 #define CKM_CAST_CBC			(0x302)
@@ -607,11 +711,16 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_TLS_MASTER_KEY_DERIVE	(0x375)
 #define CKM_TLS_KEY_AND_MAC_DERIVE	(0x376)
 #define CKM_TLS_MASTER_KEY_DERIVE_DH	(0x377)
+#define CKM_TLS_PRF			(0x378)
 #define CKM_SSL3_MD5_MAC		(0x380)
 #define CKM_SSL3_SHA1_MAC		(0x381)
 #define CKM_MD5_KEY_DERIVATION		(0x390)
 #define CKM_MD2_KEY_DERIVATION		(0x391)
 #define CKM_SHA1_KEY_DERIVATION		(0x392)
+#define CKM_SHA256_KEY_DERIVATION	(0x393)
+#define CKM_SHA384_KEY_DERIVATION	(0x394)
+#define CKM_SHA512_KEY_DERIVATION	(0x395)
+#define CKM_SHA224_KEY_DERIVATION	(0x396)
 #define CKM_PBE_MD2_DES_CBC		(0x3a0)
 #define CKM_PBE_MD5_DES_CBC		(0x3a1)
 #define CKM_PBE_MD5_CAST_CBC		(0x3a2)
@@ -628,8 +737,43 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_PBE_SHA1_RC2_40_CBC		(0x3ab)
 #define CKM_PKCS5_PBKD2			(0x3b0)
 #define CKM_PBA_SHA1_WITH_SHA1_HMAC	(0x3c0)
+#define CKM_WTLS_PRE_MASTER_KEY_GEN	(0x3d0)
+#define CKM_WTLS_MASTER_KEY_DERIVE	(0x3d1)
+#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC (0x3d2)
+#define CKM_WTLS_PRF			(0x3d3)
+#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE (0x3d4)
+#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE (0x3d5)
 #define CKM_KEY_WRAP_LYNKS		(0x400)
 #define CKM_KEY_WRAP_SET_OAEP		(0x401)
+#define CKM_CMS_SIG			(0x500)
+#define CKM_KIP_DERIVE			(0x510)
+#define CKM_KIP_WRAP			(0x511)
+#define CKM_KIP_MAC			(0x512)
+#define CKM_CAMELLIA_KEY_GEN		(0x550)
+#define CKM_CAMELLIA_ECB		(0x551)
+#define CKM_CAMELLIA_CBC		(0x552)
+#define CKM_CAMELLIA_MAC		(0x553)
+#define CKM_CAMELLIA_MAC_GENERAL	(0x554)
+#define CKM_CAMELLIA_CBC_PAD		(0x555)
+#define CKM_CAMELLIA_ECB_ENCRYPT_DATA	(0x556)
+#define CKM_CAMELLIA_CBC_ENCRYPT_DATA	(0x557)
+#define CKM_CAMELLIA_CTR		(0x558)
+#define CKM_ARIA_KEY_GEN		(0x560)
+#define CKM_ARIA_ECB			(0x561)
+#define CKM_ARIA_CBC			(0x562)
+#define CKM_ARIA_MAC			(0x563)
+#define CKM_ARIA_MAC_GENERAL		(0x564)
+#define CKM_ARIA_CBC_PAD		(0x565)
+#define CKM_ARIA_ECB_ENCRYPT_DATA	(0x566)
+#define CKM_ARIA_CBC_ENCRYPT_DATA	(0x567)
+#define CKM_SEED_KEY_GEN		(0x650)
+#define CKM_SEED_ECB			(0x651)
+#define CKM_SEED_CBC			(0x652)
+#define CKM_SEED_MAC			(0x653)
+#define CKM_SEED_MAC_GENERAL		(0x654)
+#define CKM_SEED_CBC_PAD		(0x655)
+#define CKM_SEED_ECB_ENCRYPT_DATA	(0x656)
+#define CKM_SEED_CBC_ENCRYPT_DATA	(0x657)
 #define CKM_SKIPJACK_KEY_GEN		(0x1000)
 #define CKM_SKIPJACK_ECB64		(0x1001)
 #define CKM_SKIPJACK_CBC64		(0x1002)
@@ -655,6 +799,10 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_EC_KEY_PAIR_GEN		(0x1040)
 #define CKM_ECDSA			(0x1041)
 #define CKM_ECDSA_SHA1			(0x1042)
+#define CKM_ECDSA_SHA224		(0x1043)
+#define CKM_ECDSA_SHA256		(0x1044)
+#define CKM_ECDSA_SHA384		(0x1045)
+#define CKM_ECDSA_SHA512		(0x1046)
 #define CKM_ECDH1_DERIVE		(0x1050)
 #define CKM_ECDH1_COFACTOR_DERIVE	(0x1051)
 #define CKM_ECMQV_DERIVE		(0x1052)
@@ -671,10 +819,48 @@ typedef unsigned long ck_mechanism_type_t;
 #define CKM_AES_MAC			(0x1083)
 #define CKM_AES_MAC_GENERAL		(0x1084)
 #define CKM_AES_CBC_PAD			(0x1085)
+#define CKM_AES_CTR			(0x1086)
+#define CKM_AES_GCM			(0x1087)
+#define CKM_AES_CCM			(0x1088)
+#define CKM_AES_CTS			(0x1089)
+#define CKM_AES_CMAC			(0x108a)
+#define CKM_AES_CMAC_GENERAL		(0x108b)
+#define CKM_BLOWFISH_KEY_GEN		(0x1090)
+#define CKM_BLOWFISH_CBC		(0x1091)
+#define CKM_TWOFISH_KEY_GEN		(0x1092)
+#define CKM_TWOFISH_CBC			(0x1093)
+#define CKM_BLOWFISH_CBC_PAD		(0x1094)
+#define CKM_TWOFISH_CBC_PAD		(0x1095)
+#define CKM_DES_ECB_ENCRYPT_DATA	(0x1100)
+#define CKM_DES_CBC_ENCRYPT_DATA	(0x1101)
+#define CKM_DES3_ECB_ENCRYPT_DATA	(0x1102)
+#define CKM_DES3_CBC_ENCRYPT_DATA	(0x1103)
+#define CKM_AES_ECB_ENCRYPT_DATA	(0x1104)
+#define CKM_AES_CBC_ENCRYPT_DATA	(0x1105)
+#define CKM_GOSTR3410_KEY_PAIR_GEN	(0x1200)
+#define CKM_GOSTR3410			(0x1201)
+#define CKM_GOSTR3410_WITH_GOSTR3411	(0x1202)
+#define CKM_GOSTR3410_KEY_WRAP		(0x1203)
+#define CKM_GOSTR3410_DERIVE		(0x1204)
+#define CKM_GOSTR3411			(0x1210)
+#define CKM_GOSTR3411_HMAC		(0x1211)
+#define CKM_GOST28147_KEY_GEN		(0x1220)
+#define CKM_GOST28147_ECB		(0x1221)
+#define CKM_GOST28147			(0x1222)
+#define CKM_GOST28147_MAC		(0x1223)
+#define CKM_GOST28147_KEY_WRAP		(0x1224)
 #define CKM_DSA_PARAMETER_GEN		(0x2000)
 #define CKM_DH_PKCS_PARAMETER_GEN	(0x2001)
 #define CKM_X9_42_DH_PARAMETER_GEN	(0x2002)
-#define CKM_VENDOR_DEFINED		((unsigned long) (1 << 31))
+#define CKM_AES_OFB			(0x2104)
+#define CKM_AES_CFB64			(0x2105)
+#define CKM_AES_CFB8			(0x2106)
+#define CKM_AES_CFB128			(0x2107)
+#define CKM_AES_KEY_WRAP		(0x2109)
+#define CKM_AES_KEY_WRAP_PAD		(0x210a)
+#define CKM_RSA_PKCS_TPM_1_1		(0x4001)
+#define CKM_RSA_PKCS_OAEPTPM_1_1	(0x4002)
+#define CKM_VENDOR_DEFINED		((unsigned long) (1ul << 31))
 
 
 struct ck_mechanism
@@ -705,9 +891,138 @@ struct ck_mechanism_info
 #define CKF_WRAP		(1 << 17)
 #define CKF_UNWRAP		(1 << 18)
 #define CKF_DERIVE		(1 << 19)
-#define CKF_EXTENSION		((unsigned long) (1 << 31))
+#define CKF_EC_F_P		(1 << 20)
+#define CKF_EC_F_2M		(1 << 21)
+#define CKF_EC_ECPARAMETERS	(1 << 22)
+#define CKF_EC_NAMEDCURVE	(1 << 23)
+#define CKF_EC_UNCOMPRESS	(1 << 24)
+#define CKF_EC_COMPRESS		(1 << 25)
+#define CKF_EXTENSION		((unsigned long) (1ul << 31))
 
 
+/* The following MGFs are defined */
+#define CKG_MGF1_SHA1         (0x00000001)
+#define CKG_MGF1_SHA256       (0x00000002)
+#define CKG_MGF1_SHA384       (0x00000003)
+#define CKG_MGF1_SHA512       (0x00000004)
+#define CKG_MGF1_SHA224       (0x00000005)
+
+#define CKZ_DATA_SPECIFIED    (0x00000001)
+
+struct ck_rsa_pkcs_oaep_params {
+  ck_mechanism_type_t hash_alg;
+  unsigned long mgf;
+  unsigned long source;
+  void *source_data;
+  unsigned long source_data_len;
+};
+
+struct ck_rsa_pkcs_pss_params {
+  ck_mechanism_type_t hash_alg;
+  unsigned long mgf;
+  unsigned long slen;
+};
+
+typedef unsigned long ck_ec_kdf_type_t;
+
+/* The following EC Key Derivation Functions are defined */
+#define CKD_NULL                       (0x00000001)
+#define CKD_SHA1_KDF                   (0x00000002)
+
+struct ck_ecdh1_derive_params {
+  ck_ec_kdf_type_t kdf;
+  unsigned long shared_data_len;
+  unsigned char *shared_data;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+};
+
+struct ck_ecdh2_derive_params {
+  ck_ec_kdf_type_t kdf;
+  unsigned long shared_data_len;
+  unsigned char *shared_data;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+  unsigned long private_data_len;
+  ck_object_handle_t private_data;
+  unsigned long public_data_len2;
+  unsigned char *public_data2;
+};
+
+struct ck_ecmqv_derive_params {
+  ck_ec_kdf_type_t kdf;
+  unsigned long shared_data_len;
+  unsigned char *shared_data;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+  unsigned long private_data_len;
+  ck_object_handle_t private_data;
+  unsigned long public_data_len2;
+  unsigned char *public_data2;
+  ck_object_handle_t public_key;
+};
+
+typedef unsigned long ck_x9_42_dh_kdf_type_t;
+
+/* The following X9.42 DH key derivation functions are defined */
+#define CKD_SHA1_KDF_ASN1              (0x00000003)
+#define CKD_SHA1_KDF_CONCATENATE       (0x00000004)
+#define CKD_SHA224_KDF                 (0x00000005)
+#define CKD_SHA256_KDF                 (0x00000006)
+#define CKD_SHA384_KDF                 (0x00000007)
+#define CKD_SHA512_KDF                 (0x00000008)
+#define CKD_CPDIVERSIFY_KDF            (0x00000009)
+
+struct ck_x9_42_dh1_derive_params {
+  ck_x9_42_dh_kdf_type_t kdf;
+  unsigned long other_info_len;
+  unsigned char *other_info;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+};
+
+struct ck_x9_42_dh2_derive_params {
+  ck_x9_42_dh_kdf_type_t kdf;
+  unsigned long other_info_len;
+  unsigned char *other_info;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+  unsigned long private_data_len;
+  ck_object_handle_t private_data;
+  unsigned long public_data_len2;
+  unsigned char *public_data2;
+};
+
+struct ck_x9_42_mqv_derive_params {
+  ck_x9_42_dh_kdf_type_t kdf;
+  unsigned long other_info_len;
+  unsigned char *other_info;
+  unsigned long public_data_len;
+  unsigned char *public_data;
+  unsigned long private_data_len;
+  ck_object_handle_t private_data;
+  unsigned long public_data_len2;
+  unsigned char *public_data2;
+  ck_object_handle_t public_key;
+};
+
+struct ck_des_cbc_encrypt_data_params {
+  unsigned char iv[8];
+  unsigned char *data;
+  unsigned long length;
+};
+
+struct ck_aes_cbc_encrypt_data_params {
+  unsigned char iv[16];
+  unsigned char *data;
+  unsigned long length;
+};
+
+struct ck_key_derivation_string_data {
+  unsigned char *data;
+  unsigned long len;
+};
+
 /* Flags for C_WaitForSlotEvent.  */
 #define CKF_DONT_BLOCK				(1)
 
@@ -1110,6 +1425,7 @@ struct ck_c_initialize_args
 #define CKR_ATTRIBUTE_SENSITIVE			(0x11)
 #define CKR_ATTRIBUTE_TYPE_INVALID		(0x12)
 #define CKR_ATTRIBUTE_VALUE_INVALID		(0x13)
+#define CKR_COPY_PROHIBITED			(0x1A)
 #define CKR_DATA_INVALID			(0x20)
 #define CKR_DATA_LEN_RANGE			(0x21)
 #define CKR_DEVICE_ERROR			(0x30)
@@ -1180,8 +1496,15 @@ struct ck_c_initialize_args
 #define CKR_CRYPTOKI_ALREADY_INITIALIZED	(0x191)
 #define CKR_MUTEX_BAD				(0x1a0)
 #define CKR_MUTEX_NOT_LOCKED			(0x1a1)
+#define CKR_NEW_PIN_MODE			(0x1b0)
+#define CKR_NEXT_OTP				(0x1b1)
+#define CKR_EXCEEDED_MAX_ITERATIONS		(0x1b5)
+#define CKR_FIPS_SELF_TEST_FAILED		(0x1b6)
+#define CKR_LIBRARY_LOAD_FAILED			(0x1b7)
+#define CKR_PIN_TOO_WEAK			(0x1b8)
+#define CKR_PUBLIC_KEY_INVALID			(0x1b9)
 #define CKR_FUNCTION_REJECTED			(0x200)
-#define CKR_VENDOR_DEFINED			((unsigned long) (1 << 31))
+#define CKR_VENDOR_DEFINED			((unsigned long) (1ul << 31))
 
 
 
@@ -1255,6 +1578,24 @@ typedef struct ck_mechanism *CK_MECHANISM_PTR;
 typedef struct ck_mechanism_info CK_MECHANISM_INFO;
 typedef struct ck_mechanism_info *CK_MECHANISM_INFO_PTR;
 
+typedef struct ck_rsa_pkcs_oaep_params CK_RSA_PKCS_OAEP_PARAMS;
+typedef struct ck_rsa_pkcs_oaep_params *CK_RSA_PKCS_OAEP_PARAMS_PTR;
+
+typedef struct ck_rsa_pkcs_pss_params CK_RSA_PKCS_PSS_PARAMS;
+typedef struct ck_rsa_pkcs_pss_params *CK_RSA_PKCS_PSS_PARAMS_PTR;
+
+typedef struct ck_ecdh1_derive_params CK_ECDH1_DERIVE_PARAMS;
+typedef struct ck_ecdh1_derive_params *CK_ECDH1_DERIVE_PARAMS_PTR;
+
+typedef struct ck_des_cbc_encrypt_data_params CK_DES_CBC_ENCRYPT_DATA_PARAMS;
+typedef struct ck_des_cbc_encrypt_data_params *CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct ck_aes_cbc_encrypt_data_params CK_AES_CBC_ENCRYPT_DATA_PARAMS;
+typedef struct ck_aes_cbc_encrypt_data_params *CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct ck_key_derivation_string_data CK_KEY_DERIVATION_STRING_DATA;
+typedef struct ck_key_derivation_string_data *CK_KEY_DERIVATION_STRING_DATA_PTR;
+
 typedef struct ck_function_list CK_FUNCTION_LIST;
 typedef struct ck_function_list *CK_FUNCTION_LIST_PTR;
 typedef struct ck_function_list **CK_FUNCTION_LIST_PTR_PTR;
@@ -1327,6 +1668,30 @@ typedef struct ck_c_initialize_args *CK_C_INITIALIZE_ARGS_PTR;
 #undef min_key_size
 #undef max_key_size
 
+#undef ck_rsa_pkcs_oaep_params
+#undef hash_alg
+#undef source_data
+#undef source_data_len
+#undef slen
+
+#undef ck_ec_kdf_type_t
+#undef shared_data_len
+#undef shared_data
+#undef public_data_len
+#undef public_data
+#undef private_data_len
+#undef private_data
+#undef public_data_len2
+#undef public_data2
+#undef public_key
+
+#undef ck_x9_42_dh_kdf_type_t
+#undef other_info_len
+#undef other_info
+
+#undef data
+#undef len
+
 #undef ck_rv_t
 #undef ck_notify_t
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/req.c b/crypto/external/bsd/heimdal/dist/lib/hx509/req.c
index bd9d68c9c..f2bf1f21c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/req.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/req.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: req.c,v 1.1.1.1 2011/04/13 18:15:12 elric Exp $	*/
+/*	$NetBSD: req.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/revoke.c b/crypto/external/bsd/heimdal/dist/lib/hx509/revoke.c
index 6883c46f9..aa8f09346 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/revoke.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/revoke.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: revoke.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: revoke.c,v 1.4 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -339,8 +339,10 @@ load_ocsp(hx509_context context, struct revoke_ocsp *ocsp)
 	return ret;
 
     ret = stat(ocsp->path, &sb);
-    if (ret)
+    if (ret) {
+        rk_xfree(data);
 	return errno;
+    }
 
     ret = parse_ocsp_basic(data, length, &basic);
     rk_xfree(data);
@@ -363,8 +365,8 @@ load_ocsp(hx509_context context, struct revoke_ocsp *ocsp)
 	for (i = 0; i < basic.certs->len; i++) {
 	    hx509_cert c;
 
-	    ret = hx509_cert_init(context, &basic.certs->val[i], &c);
-	    if (ret)
+	    c = hx509_cert_init(context, &basic.certs->val[i], NULL);
+	    if (c == NULL)
 		continue;
 
 	    ret = hx509_certs_add(context, certs, c);
@@ -563,27 +565,18 @@ out:
 }
 
 static int
-load_crl(const char *path, time_t *t, CRLCertificateList *crl)
+crl_parser(hx509_context context, const char *type,
+	   const hx509_pem_header *header,
+	   const void *data, size_t len, void *ctx)
 {
-    size_t length, size;
-    struct stat sb;
-    void *data;
+    CRLCertificateList *crl = (CRLCertificateList *)ctx;
+    size_t size;
     int ret;
 
-    memset(crl, 0, sizeof(*crl));
+    if (strcasecmp("X509 CRL", type) != 0)
+	return HX509_CRYPTO_SIG_INVALID_FORMAT;
 
-    ret = rk_undumpdata(path, &data, &length);
-    if (ret)
-	return ret;
-
-    ret = stat(path, &sb);
-    if (ret)
-	return errno;
-
-    *t = sb.st_mtime;
-
-    ret = decode_CRLCertificateList(data, length, crl, &size);
-    rk_xfree(data);
+    ret = decode_CRLCertificateList(data, len, crl, &size);
     if (ret)
 	return ret;
 
@@ -592,9 +585,47 @@ load_crl(const char *path, time_t *t, CRLCertificateList *crl)
 	free_CRLCertificateList(crl);
 	return HX509_CRYPTO_SIG_INVALID_FORMAT;
     }
+
     return 0;
 }
 
+static int
+load_crl(hx509_context context, const char *path, time_t *t, CRLCertificateList *crl)
+{
+    struct stat sb;
+    size_t length;
+    void *data;
+    FILE *f;
+    int ret;
+
+    memset(crl, 0, sizeof(*crl));
+
+    ret = stat(path, &sb);
+    if (ret)
+	return errno;
+    
+    *t = sb.st_mtime;
+	
+    if ((f = fopen(path, "r")) == NULL)
+	return errno;
+
+    rk_cloexec_file(f);
+
+    ret = hx509_pem_read(context, f, crl_parser, crl);
+    fclose(f);
+
+    if (ret == HX509_PARSING_KEY_FAILED) {
+
+	ret = rk_undumpdata(path, &data, &length);
+	if (ret)
+	    return ret;
+
+	ret = crl_parser(context, "X509 CRL", NULL, data, length, crl);
+	rk_xfree(data);
+    }
+    return ret;
+}
+
 /**
  * Add a CRL file to the revokation context.
  *
@@ -646,7 +677,8 @@ hx509_revoke_add_crl(hx509_context context,
 	return ENOMEM;
     }
 
-    ret = load_crl(path,
+    ret = load_crl(context,
+		   path,
 		   &ctx->crls.val[ctx->crls.len].last_modfied,
 		   &ctx->crls.val[ctx->crls.len].crl);
     if (ret) {
@@ -676,7 +708,6 @@ hx509_revoke_add_crl(hx509_context context,
  * @ingroup hx509_revoke
  */
 
-
 int
 hx509_revoke_verify(hx509_context context,
 		    hx509_revoke_ctx ctx,
@@ -783,7 +814,7 @@ hx509_revoke_verify(hx509_context context,
 	if (ret == 0 && crl->last_modfied != sb.st_mtime) {
 	    CRLCertificateList cl;
 
-	    ret = load_crl(crl->path, &crl->last_modfied, &cl);
+	    ret = load_crl(context, crl->path, &crl->last_modfied, &cl);
 	    if (ret == 0) {
 		free_CRLCertificateList(&crl->crl);
 		crl->crl = cl;
@@ -1066,6 +1097,140 @@ printable_time(time_t t)
     return s;
 }
 
+/*
+ *
+ */
+
+static int
+print_ocsp(hx509_context context, struct revoke_ocsp *ocsp, FILE *out)
+{
+    int ret = 0;
+    size_t i;
+
+    fprintf(out, "signer: ");
+
+    switch(ocsp->ocsp.tbsResponseData.responderID.element) {
+    case choice_OCSPResponderID_byName: {
+	hx509_name n;
+	char *s;
+	_hx509_name_from_Name(&ocsp->ocsp.tbsResponseData.responderID.u.byName, &n);
+	hx509_name_to_string(n, &s);
+	hx509_name_free(&n);
+	fprintf(out, " byName: %s\n", s);
+	free(s);
+	break;
+    }
+    case choice_OCSPResponderID_byKey: {
+	char *s;
+	hex_encode(ocsp->ocsp.tbsResponseData.responderID.u.byKey.data,
+		   ocsp->ocsp.tbsResponseData.responderID.u.byKey.length,
+		   &s);
+	fprintf(out, " byKey: %s\n", s);
+	free(s);
+	break;
+    }
+    default:
+	_hx509_abort("choice_OCSPResponderID unknown");
+	break;
+    }
+
+    fprintf(out, "producedAt: %s\n",
+	    printable_time(ocsp->ocsp.tbsResponseData.producedAt));
+
+    fprintf(out, "replies: %d\n", ocsp->ocsp.tbsResponseData.responses.len);
+
+    for (i = 0; i < ocsp->ocsp.tbsResponseData.responses.len; i++) {
+	const char *status;
+	switch (ocsp->ocsp.tbsResponseData.responses.val[i].certStatus.element) {
+	case choice_OCSPCertStatus_good:
+	    status = "good";
+	    break;
+	case choice_OCSPCertStatus_revoked:
+	    status = "revoked";
+	    break;
+	case choice_OCSPCertStatus_unknown:
+	    status = "unknown";
+	    break;
+	default:
+	    status = "element unknown";
+	}
+
+	fprintf(out, "\t%llu. status: %s\n", (unsigned long long)i, status);
+
+	fprintf(out, "\tthisUpdate: %s\n",
+		printable_time(ocsp->ocsp.tbsResponseData.responses.val[i].thisUpdate));
+	if (ocsp->ocsp.tbsResponseData.responses.val[i].nextUpdate)
+	    fprintf(out, "\tproducedAt: %s\n",
+		    printable_time(ocsp->ocsp.tbsResponseData.responses.val[i].thisUpdate));
+
+    }
+
+    fprintf(out, "appended certs:\n");
+    if (ocsp->certs)
+	ret = hx509_certs_iter_f(context, ocsp->certs, hx509_ci_print_names, out);
+
+    return ret;
+}
+	   
+static int
+print_crl(hx509_context context, struct revoke_crl *crl, FILE *out)
+{
+    {
+	hx509_name n;
+	char *s;
+	_hx509_name_from_Name(&crl->crl.tbsCertList.issuer, &n);
+	hx509_name_to_string(n, &s);
+	hx509_name_free(&n);
+	fprintf(out, " issuer: %s\n", s);
+	free(s);
+    }
+
+    fprintf(out, " thisUpdate: %s\n", 
+	    printable_time(_hx509_Time2time_t(&crl->crl.tbsCertList.thisUpdate)));
+
+    return 0;
+}
+
+
+/*
+ *
+ */
+
+int
+hx509_revoke_print(hx509_context context,
+		   hx509_revoke_ctx ctx,
+		   FILE *out)
+{
+    int saved_ret = 0, ret;
+    size_t n;
+
+    for (n = 0; n < ctx->ocsps.len; n++) {
+	struct revoke_ocsp *ocsp = &ctx->ocsps.val[n];
+
+	fprintf(out, "OCSP %s\n", ocsp->path);
+
+	ret = print_ocsp(context, ocsp, out);
+	if (ret) {
+	    fprintf(out, "failure printing OCSP: %d\n", ret);
+	    saved_ret = ret;
+	}
+    }
+
+    for (n = 0; n < ctx->crls.len; n++) {
+	struct revoke_crl *crl = &ctx->crls.val[n];
+
+	fprintf(out, "CRL %s\n", crl->path);
+
+	ret = print_crl(context, crl, out);
+	if (ret) {
+	    fprintf(out, "failure printing CRL: %d\n", ret);
+	    saved_ret = ret;
+	}
+    }
+    return saved_ret;
+
+}
+
 /**
  * Print the OCSP reply stored in a file.
  *
@@ -1083,7 +1248,6 @@ hx509_revoke_ocsp_print(hx509_context context, const char *path, FILE *out)
 {
     struct revoke_ocsp ocsp;
     int ret;
-    size_t i;
 
     if (out == NULL)
 	out = stdout;
@@ -1100,67 +1264,7 @@ hx509_revoke_ocsp_print(hx509_context context, const char *path, FILE *out)
 	return ret;
     }
 
-    fprintf(out, "signer: ");
-
-    switch(ocsp.ocsp.tbsResponseData.responderID.element) {
-    case choice_OCSPResponderID_byName: {
-	hx509_name n;
-	char *s;
-	_hx509_name_from_Name(&ocsp.ocsp.tbsResponseData.responderID.u.byName, &n);
-	hx509_name_to_string(n, &s);
-	hx509_name_free(&n);
-	fprintf(out, " byName: %s\n", s);
-	free(s);
-	break;
-    }
-    case choice_OCSPResponderID_byKey: {
-	char *s;
-	hex_encode(ocsp.ocsp.tbsResponseData.responderID.u.byKey.data,
-		   ocsp.ocsp.tbsResponseData.responderID.u.byKey.length,
-		   &s);
-	fprintf(out, " byKey: %s\n", s);
-	free(s);
-	break;
-    }
-    default:
-	_hx509_abort("choice_OCSPResponderID unknown");
-	break;
-    }
-
-    fprintf(out, "producedAt: %s\n",
-	    printable_time(ocsp.ocsp.tbsResponseData.producedAt));
-
-    fprintf(out, "replies: %d\n", ocsp.ocsp.tbsResponseData.responses.len);
-
-    for (i = 0; i < ocsp.ocsp.tbsResponseData.responses.len; i++) {
-	const char *status;
-	switch (ocsp.ocsp.tbsResponseData.responses.val[i].certStatus.element) {
-	case choice_OCSPCertStatus_good:
-	    status = "good";
-	    break;
-	case choice_OCSPCertStatus_revoked:
-	    status = "revoked";
-	    break;
-	case choice_OCSPCertStatus_unknown:
-	    status = "unknown";
-	    break;
-	default:
-	    status = "element unknown";
-	}
-
-	fprintf(out, "\t%zu. status: %s\n", i, status);
-
-	fprintf(out, "\tthisUpdate: %s\n",
-		printable_time(ocsp.ocsp.tbsResponseData.responses.val[i].thisUpdate));
-	if (ocsp.ocsp.tbsResponseData.responses.val[i].nextUpdate)
-	    fprintf(out, "\tproducedAt: %s\n",
-		    printable_time(ocsp.ocsp.tbsResponseData.responses.val[i].thisUpdate));
-
-    }
-
-    fprintf(out, "appended certs:\n");
-    if (ocsp.certs)
-	ret = hx509_certs_iter_f(context, ocsp.certs, hx509_ci_print_names, out);
+    ret = print_ocsp(context, &ocsp, out);
 
     free_ocsp(&ocsp);
     return ret;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/sel-gram.y b/crypto/external/bsd/heimdal/dist/lib/hx509/sel-gram.y
index 0792531af..0acb0beea 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/sel-gram.y
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/sel-gram.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: sel-gram.y,v 1.1.1.1 2011/04/13 18:15:12 elric Exp $	*/
+/*	$NetBSD: sel-gram.y,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/sel-lex.l b/crypto/external/bsd/heimdal/dist/lib/hx509/sel-lex.l
index a52bf8b88..b188f0e3b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/sel-lex.l
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/sel-lex.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: sel-lex.l,v 1.1.1.3 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: sel-lex.l,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 %{
 /*
@@ -36,6 +36,11 @@
 
 /* Id */
 
+#ifdef __GNUC__
+#pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
@@ -52,7 +57,6 @@ unsigned lineno = 1;
 
 static char * handle_string(void);
 static int lex_input(char *, int);
-static int lex_classic_input(void);
 
 struct hx_expr_input _hx509_expr_input;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/sel.c b/crypto/external/bsd/heimdal/dist/lib/hx509/sel.c
index 4d1febbaf..aebebf2b3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/sel.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/sel.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sel.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: sel.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/sel.h b/crypto/external/bsd/heimdal/dist/lib/hx509/sel.h
index ee92545d6..55ebd13b4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/sel.h
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/sel.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sel.h,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: sel.h,v 1.4 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/softp11.c b/crypto/external/bsd/heimdal/dist/lib/hx509/softp11.c
index 541a48de2..3fab05d01 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/softp11.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/softp11.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: softp11.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: softp11.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2008 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #define CRYPTOKI_EXPORTS 1
 
 #include "hx_locl.h"
-#include "pkcs11.h"
+#include "ref/pkcs11.h"
 
 #define OBJECT_ID_MASK		0xfff
 #define HANDLE_OBJECT_ID(h)	((h) & OBJECT_ID_MASK)
@@ -545,6 +545,8 @@ add_cert(hx509_context hxctx, void *ctx, hx509_cert cert)
 	CK_FLAGS flags;
 
 	type = CKO_PRIVATE_KEY;
+
+        /* Note to static analyzers: `o' is still referred to via globals */
 	o = add_st_object();
 	if (o == NULL) {
 	    ret = CKR_DEVICE_MEMORY;
@@ -595,6 +597,7 @@ add_cert(hx509_context hxctx, void *ctx, hx509_cert cert)
     hx509_xfree(issuer_data.data);
     hx509_xfree(subject_data.data);
 
+    /* Note to static analyzers: `o' is still referred to via globals */
     return 0;
 }
 
@@ -617,7 +620,11 @@ add_certificate(const char *cert_file,
 
     if (pin) {
 	char *str;
-	asprintf(&str, "PASS:%s", pin);
+	ret = asprintf(&str, "PASS:%s", pin);
+	if (ret == -1 || !str) {
+	    st_logf("failed to allocate memory\n");
+	    return CKR_GENERAL_ERROR;
+	}
 
 	hx509_lock_init(context, &lock);
 	hx509_lock_command_string(lock, str);
@@ -817,6 +824,7 @@ get_config_file_for_user(void)
 
 #ifndef _WIN32
     char *home = NULL;
+    int ret;
 
     if (!issuid()) {
         fn = getenv("SOFTPKCS11RC");
@@ -825,14 +833,18 @@ get_config_file_for_user(void)
         home = getenv("HOME");
     }
     if (fn == NULL && home == NULL) {
-        struct passwd *pw = getpwuid(getuid());
-        if(pw != NULL)
-            home = pw->pw_dir;
+	struct passwd pw, *pwd = NULL;
+	char pwbuf[2048];
+
+	if (rk_getpwuid_r(getuid(), &pw, pwbuf, sizeof(pwbuf), &pwd) == 0)
+            home = pwd->pw_dir;
     }
     if (fn == NULL) {
-        if (home)
-            asprintf(&fn, "%s/.soft-token.rc", home);
-        else
+        if (home) {
+            ret = asprintf(&fn, "%s/.soft-token.rc", home);
+	    if (ret == -1)
+		fn = NULL;
+        } else
             fn = strdup("/etc/soft-token.rc");
     }
 #else  /* Windows */
@@ -1207,8 +1219,13 @@ C_Login(CK_SESSION_HANDLE hSession,
     VERIFY_SESSION_HANDLE(hSession, NULL);
 
     if (pPin != NULL_PTR) {
-	asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
-	st_logf("type: %d password: %s\n", (int)userType, pin);
+	int aret;
+
+	aret = asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
+	if (aret != -1 && pin)
+		st_logf("type: %d password: %s\n", (int)userType, pin);
+	else
+		st_logf("memory error: asprintf failed\n");
     }
 
     /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_ca.in b/crypto/external/bsd/heimdal/dist/lib/hx509/test_ca.in
index 864c133ab..bfff61f3d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_ca.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_ca.in
@@ -421,4 +421,32 @@ ${hxtool} verify --missing-revoke \
 	cert:FILE:cert-ee.pem \
 	anchor:FILE:cert-ca.pem > /dev/null || exit 1
 
+echo "+++++++++++ test sigalg"
+
+echo "issue cert with sha256"
+${hxtool} issue-certificate \
+	  --ca-certificate=FILE:cert-ca.pem \
+          --signature-algorithm=rsa-with-sha256 \
+	  --subject="cn=foo" \
+	  --req="PKCS10:pkcs10-request.der" \
+	  --certificate="FILE:cert-ee.pem" || exit 1
+
+echo "verify certificate"
+${hxtool} verify --missing-revoke \
+	cert:FILE:cert-ee.pem \
+	anchor:FILE:cert-ca.pem > /dev/null || exit 1
+
+echo "issue cert with sha1"
+${hxtool} issue-certificate \
+	  --ca-certificate=FILE:cert-ca.pem \
+          --signature-algorithm=rsa-with-sha1 \
+	  --subject="cn=foo" \
+	  --req="PKCS10:pkcs10-request.der" \
+	  --certificate="FILE:cert-ee.pem" || exit 1
+
+echo "verify certificate"
+${hxtool} verify --missing-revoke \
+	cert:FILE:cert-ee.pem \
+	anchor:FILE:cert-ca.pem > /dev/null || exit 1
+
 exit 0
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_cert.in b/crypto/external/bsd/heimdal/dist/lib/hx509/test_cert.in
index d2b6d633b..f7deed35a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_cert.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_cert.in
@@ -46,7 +46,7 @@ if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
 fi
 
 echo "print DIR"
-${hxtool} print --content DIR:$srcdir/data > /dev/null || exit 1
+${hxtool} print --content DIR:$srcdir/data > /dev/null 2>/dev/null || exit 1
 
 echo "print FILE"
 for a in $srcdir/data/*.crt; do 
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_chain.in b/crypto/external/bsd/heimdal/dist/lib/hx509/test_chain.in
index 13e27b252..a93e8bc68 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_chain.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_chain.in
@@ -192,13 +192,13 @@ if ${hxtool} info | grep 'ecdsa: hcrypto null' > /dev/null ; then
 else
     echo "eccert -> root"
     ${hxtool} verify --missing-revoke \
-    	cert:FILE:$srcdir/data/secp160r2TestServer.cert.pem \
-    	anchor:FILE:$srcdir/data/secp160r1TestCA.cert.pem > /dev/null || exit 1
+	cert:FILE:$srcdir/data/secp256r2TestServer.cert.pem \
+	anchor:FILE:$srcdir/data/secp256r1TestCA.cert.pem > /dev/null || exit 1
     
     echo "eccert -> root"
     ${hxtool} verify --missing-revoke \
-    	cert:FILE:$srcdir/data/secp160r2TestClient.cert.pem \
-    	anchor:FILE:$srcdir/data/secp160r1TestCA.cert.pem > /dev/null || exit 1
+	cert:FILE:$srcdir/data/secp256r2TestClient.cert.pem \
+	anchor:FILE:$srcdir/data/secp256r1TestCA.cert.pem > /dev/null || exit 1
 fi
 
 echo "proxy cert"
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_cms.in b/crypto/external/bsd/heimdal/dist/lib/hx509/test_cms.in
index 3e5aa8e2a..08fdef70f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_cms.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_cms.in
@@ -53,15 +53,15 @@ if ${hxtool} info | grep 'ecdsa: hcrypto null' > /dev/null ; then
 else
     echo "create signed data (ec)"
     ${hxtool} cms-create-sd \
-    	--certificate=FILE:$srcdir/data/secp160r2TestClient.pem \
-    	"$srcdir/test_chain.in" \
-    	sd.data > /dev/null || exit 1
+	--certificate=FILE:$srcdir/data/secp256r2TestClient.pem \
+	"$srcdir/test_chain.in" \
+	sd.data > /dev/null || exit 1
     
     echo "verify signed data (ec)"
     ${hxtool} cms-verify-sd \
-    	--missing-revoke \
-    	--anchors=FILE:$srcdir/data/secp160r1TestCA.cert.pem \
-    	sd.data sd.data.out > /dev/null || exit 1
+	--missing-revoke \
+	--anchors=FILE:$srcdir/data/secp256r1TestCA.cert.pem \
+	sd.data sd.data.out > /dev/null || exit 1
     cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 fi
     
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_expr.c b/crypto/external/bsd/heimdal/dist/lib/hx509/test_expr.c
index 02f4f1f92..100eb65df 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_expr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_expr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_expr.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: test_expr.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 
 #include "hx_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_name.c b/crypto/external/bsd/heimdal/dist/lib/hx509/test_name.c
index 58774e339..50e73b3bc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_name.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_name.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_name.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: test_name.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -321,14 +321,14 @@ test_compare(hx509_context context)
 
     /* check transative properties of name compare function */
 
-    ret = hx509_cert_init_data(context, certdata1, sizeof(certdata1) - 1, &c1);
-    if (ret) return 1;
+    c1 = hx509_cert_init_data(context, certdata1, sizeof(certdata1) - 1, NULL);
+    if (c1 == NULL) return 1;
 
-    ret = hx509_cert_init_data(context, certdata2, sizeof(certdata2) - 1, &c2);
-    if (ret) return 1;
-
-    ret = hx509_cert_init_data(context, certdata3, sizeof(certdata3) - 1, &c3);
-    if (ret) return 1;
+    c2 = hx509_cert_init_data(context, certdata2, sizeof(certdata2) - 1, NULL);
+    if (c2 == NULL) return 1;
+    
+    c3 = hx509_cert_init_data(context, certdata3, sizeof(certdata3) - 1, NULL);
+    if (c3 == NULL) return 1;
 
     ret = compare_subject(c1, c1, &l0);
     if (ret) return 1;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_nist_pkcs12.in b/crypto/external/bsd/heimdal/dist/lib/hx509/test_nist_pkcs12.in
index f8a0f8ab7..fb554e478 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_nist_pkcs12.in
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_nist_pkcs12.in
@@ -74,4 +74,4 @@ done
 
 echo "done!"
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/test_soft_pkcs11.c b/crypto/external/bsd/heimdal/dist/lib/hx509/test_soft_pkcs11.c
index 90e9abeff..c73a3dbaf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/test_soft_pkcs11.c
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/test_soft_pkcs11.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_soft_pkcs11.c,v 1.1.1.2 2014/04/24 12:45:42 pettai Exp $	*/
+/*	$NetBSD: test_soft_pkcs11.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
  */
 
 #include "hx_locl.h"
-#include "pkcs11.h"
+#include "ref/pkcs11.h"
 #include <err.h>
 
 static CK_FUNCTION_LIST_PTR func;
diff --git a/crypto/external/bsd/heimdal/dist/lib/hx509/version-script.map b/crypto/external/bsd/heimdal/dist/lib/hx509/version-script.map
index a35691338..7d55e1adc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hx509/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/hx509/version-script.map
@@ -23,7 +23,6 @@ HEIMDAL_X509_1.2 {
 		_hx509_request_print;
 		_hx509_request_set_email;
 		_hx509_request_to_pkcs10;
-		_hx509_request_to_pkcs10;
 		_hx509_unmap_file_os;
 		_hx509_write_file;
 		hx509_bitstring_print;
@@ -209,6 +208,7 @@ HEIMDAL_X509_1.2 {
 		hx509_revoke_init;
 		hx509_revoke_ocsp_print;
 		hx509_revoke_verify;
+		hx509_revoke_print;
 		hx509_set_error_string;
 		hx509_set_error_stringv;
 		hx509_signature_md5;
@@ -248,3 +248,8 @@ HEIMDAL_X509_1.2 {
 		*;
 };
 
+HEIMDAL_X509_1.3 {
+	global:
+		hx509_ca_tbs_set_signature_algorithm;
+};
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/ipc/Makefile.am
index fc3ba469d..9338b141e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/Makefile.am
@@ -33,10 +33,11 @@ ts_LDADD = libheim-ipcs.la $(LIB_roken)
 ts_http_LDADD = $(ts_LDADD)
 tc_LDADD = libheim-ipcc.la $(LIB_roken)
 
-if have_gcd
 
 EXTRA_DIST = heim_ipc.defs heim_ipc_async.defs heim_ipc_reply.defs
 
+if have_gcd
+
 heim_ipc.h heim_ipcUser.c heim_ipcServer.c heim_ipcServer.h: heim_ipc.defs
 	mig -header heim_ipc.h -user heim_ipcUser.c -sheader heim_ipcServer.h -server heim_ipcServer.c -I$(srcdir) $(srcdir)/heim_ipc.defs
 
@@ -64,4 +65,4 @@ CLEANFILES = $(built_ipcc) $(built_ipcs)
 $(srcdir)/client.c: $(built_ipcc)
 $(srcdir)/server.c: $(built_ipcs)
 
-endif
\ No newline at end of file
+endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/client.c b/crypto/external/bsd/heimdal/dist/lib/ipc/client.c
index f09722e51..ddac83e49 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/client.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/client.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: client.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: client.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -354,10 +354,12 @@ common_path_init(const char *service,
 	return ENOMEM;
     s->fd = -1;
 
-    asprintf(&s->path, "/var/run/.heim_%s-%s", service, file);
+    if (asprintf(&s->path, "/var/run/.heim_%s-%s", service, file) == -1) {
+	free(s);
+	return ENOMEM;
+    }
 
     *ctx = s;
-
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/common.c b/crypto/external/bsd/heimdal/dist/lib/ipc/common.c
index 190d82fd1..5e1784a9d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: common.c,v 1.1.1.1 2011/04/13 18:15:28 elric Exp $	*/
+/*	$NetBSD: common.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/heim-ipc.h b/crypto/external/bsd/heimdal/dist/lib/ipc/heim-ipc.h
index 1855b7103..a82077e53 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/heim-ipc.h
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/heim-ipc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heim-ipc.h,v 1.1.1.1 2011/04/13 18:15:28 elric Exp $	*/
+/*	$NetBSD: heim-ipc.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -41,7 +41,7 @@ typedef struct heim_ipc *heim_ipc;
 typedef struct heim_sipc *heim_sipc;
 typedef struct heim_icred *heim_icred;
 typedef struct heim_isemaphore *heim_isemaphore;
-typedef struct heim_octet_string heim_idata;
+typedef struct heim_base_data heim_idata;
 typedef struct heim_sipc_call *heim_sipc_call;
 
 /* common */
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/heim_ipc_types.h b/crypto/external/bsd/heimdal/dist/lib/ipc/heim_ipc_types.h
index 7532400ea..baa3ac646 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/heim_ipc_types.h
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/heim_ipc_types.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heim_ipc_types.h,v 1.1.1.1 2011/04/13 18:15:28 elric Exp $	*/
+/*	$NetBSD: heim_ipc_types.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/hi_locl.h b/crypto/external/bsd/heimdal/dist/lib/ipc/hi_locl.h
index df726aaca..142867547 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/hi_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/hi_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hi_locl.h,v 1.1.1.1 2011/04/13 18:15:28 elric Exp $	*/
+/*	$NetBSD: hi_locl.h,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/server.c b/crypto/external/bsd/heimdal/dist/lib/ipc/server.c
index 9c0445ff2..b8e2a3103 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/server.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/server.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: server.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: server.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -37,6 +37,7 @@
 
 #include "hi_locl.h"
 #include <assert.h>
+#include <err.h>
 
 #define MAX_PACKET_SIZE (128 * 1024)
 
@@ -338,14 +339,14 @@ mach_init(const char *service, mach_port_t sport, heim_sipc ctx)
 	});
 
     dispatch_source_set_cancel_handler(s->source, ^{
-	    heim_sipc ctx = dispatch_get_context(dispatch_get_current_queue());
-	    struct mach_service *st = ctx->mech;
+	    heim_sipc sctx = dispatch_get_context(dispatch_get_current_queue());
+	    struct mach_service *st = sctx->mech;
 	    mach_port_mod_refs(mach_task_self(), st->sport,
 			       MACH_PORT_RIGHT_RECEIVE, -1);
 	    dispatch_release(st->queue);
 	    dispatch_release(st->source);
 	    free(st);
-	    free(ctx);
+	    free(sctx);
 	});
 
     dispatch_resume(s->source);
@@ -824,7 +825,7 @@ handle_http_tcp(struct client *c)
 	free(data);
 	return NULL;
     }
-    len = base64_decode(t, data);
+    len = rk_base64_decode(t, data);
     if(len <= 0){
 	const char *msg =
 	    " 404 Not found\r\n"
@@ -982,7 +983,7 @@ process_loop(void)
     unsigned n;
     unsigned num_fds;
 
-    while(num_clients > 0) {
+    while (num_clients > 0) {
 
 	fds = malloc(num_clients * sizeof(fds[0]));
 	if(fds == NULL)
@@ -1001,7 +1002,11 @@ process_loop(void)
 	    fds[n].revents = 0;
 	}
 
-	poll(fds, num_fds, -1);
+	while (poll(fds, num_fds, -1) == -1) {
+            if (errno == EINTR || errno == EAGAIN)
+                continue;
+            err(1, "poll(2) failed");
+        }
 
 	for (n = 0 ; n < num_fds; n++) {
 	    if (clients[n] == NULL)
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/tc.c b/crypto/external/bsd/heimdal/dist/lib/ipc/tc.c
index e74d75fa3..1287a5dd4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/tc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/tc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tc.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: tc.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -48,8 +48,8 @@ static int help_flag;
 static int version_flag;
 
 static struct getargs args[] = {
-    {	"help",		'h',	arg_flag,   &help_flag },
-    {	"version",	'v',	arg_flag,   &version_flag }
+    {	"help",		'h',	arg_flag,   &help_flag,    NULL, NULL },
+    {	"version",	'v',	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
@@ -62,7 +62,7 @@ usage(int ret)
 }
 
 static void
-reply(void *ctx, int errorcode, heim_idata *reply, heim_icred cred)
+reply(void *ctx, int errorcode, heim_idata *rep, heim_icred cred)
 {
     printf("got reply\n");
     heim_ipc_semaphore_signal((heim_isemaphore)ctx); /* tell caller we are done */
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/ts-http.c b/crypto/external/bsd/heimdal/dist/lib/ipc/ts-http.c
index 489424f59..881b9167f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/ts-http.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/ts-http.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ts-http.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ts-http.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -46,8 +46,8 @@ static int help_flag;
 static int version_flag;
 
 static struct getargs args[] = {
-    {	"help",		'h',	arg_flag,   &help_flag },
-    {	"version",	'v',	arg_flag,   &version_flag }
+    {	"help",		'h',	arg_flag,   &help_flag,    NULL, NULL },
+    {	"version",	'v',	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/ipc/ts.c b/crypto/external/bsd/heimdal/dist/lib/ipc/ts.c
index c5dfd2679..df38be1a5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ipc/ts.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ipc/ts.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ts.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ts.c,v 1.2 2017/01/28 21:31:48 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -46,8 +46,8 @@ static int help_flag;
 static int version_flag;
 
 static struct getargs args[] = {
-    {	"help",		'h',	arg_flag,   &help_flag },
-    {	"version",	'v',	arg_flag,   &version_flag }
+    {	"help",		'h',	arg_flag,   &help_flag,    NULL, NULL },
+    {	"version",	'v',	arg_flag,   &version_flag, NULL, NULL }
 };
 
 static int num_args = sizeof(args) / sizeof(args[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/kadm5/Makefile.am
index accbff93a..39ff287bf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/Makefile.am
@@ -2,11 +2,14 @@
 
 include $(top_srcdir)/Makefile.am.common
 
+libkadm5srv_la_CPPFLAGS = -I$(srcdir)/../krb5
+
 lib_LTLIBRARIES = libkadm5srv.la libkadm5clnt.la
 libkadm5srv_la_LDFLAGS = -version-info 8:1:0
 libkadm5clnt_la_LDFLAGS = -version-info 7:1:0
 
 if versionscript
+libkadm5clnt_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script-client.map
 libkadm5srv_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 
@@ -33,7 +36,7 @@ kadm5includedir = $(includedir)/kadm5
 buildkadm5include = $(buildinclude)/kadm5
 
 dist_kadm5include_HEADERS = admin.h private.h kadm5-pwcheck.h
-dist_kadm5include_HEADERS += kadm5-protos.h kadm5-private.h
+dist_kadm5include_HEADERS += $(srcdir)/kadm5-protos.h $(srcdir)/kadm5-private.h
 
 nodist_kadm5include_HEADERS = kadm5_err.h
 
@@ -105,6 +108,7 @@ dist_libkadm5srv_la_SOURCES =			\
 	randkey_s.c				\
 	rename_s.c				\
 	server_glue.c				\
+	setkey3_s.c				\
 	set_keys.c				\
 	set_modifier.c				\
 	admin.h
@@ -132,7 +136,7 @@ LDADD = \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(LIB_hcrypto) \
 	$(LIB_roken) \
-	$(DBLIB) \
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB) \
 	$(LIB_dlopen) \
 	$(LIB_pidfile)
 
@@ -145,7 +149,7 @@ iprop_log_LDADD = \
 	$(top_builddir)/lib/sl/libsl.la \
 	$(LIB_readline) \
 	$(LIB_roken) \
-	$(DBLIB) \
+	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB) \
 	$(LIB_dlopen) \
 	$(LIB_pidfile)
 
@@ -154,6 +158,7 @@ iprop-commands.c iprop-commands.h: iprop-commands.in
 	$(SLC) $(srcdir)/iprop-commands.in
 
 $(libkadm5srv_la_OBJECTS): kadm5_err.h
+$(libkadm5clnt_la_OBJECTS): kadm5_err.h
 $(iprop_log_OBJECTS): iprop-commands.h
 
 client_glue.lo server_glue.lo: $(srcdir)/common_glue.c
@@ -164,17 +169,30 @@ CLEANFILES = kadm5_err.c kadm5_err.h iprop-commands.h iprop-commands.c
 
 kadm5_err.h: kadm5_err.et
 
-$(libkadm5clnt_la_OBJECTS) $(libkadm5srv_la_OBJECTS): $(srcdir)/kadm5-protos.h $(srcdir)/kadm5-private.h
+ALL_OBJECTS  = $(libkadm5clnt_la_OBJECTS)
+ALL_OBJECTS += $(libkadm5srv_la_OBJECTS)
+ALL_OBJECTS += $(ipropd_master_OBJECTS)
+ALL_OBJECTS += $(ipropd_slave_OBJECTS)
+ALL_OBJECTS += $(iprop_log_OBJECTS)
+ALL_OBJECTS += $(test_pw_quality_OBJECTS)
+ALL_OBJECTS += $(sample_passwd_check_la_OBJECTS)
+ALL_OBJECTS += $(default_keys_OBJECTS)
+
+$(ALL_OBJECTS): $(srcdir)/kadm5-protos.h $(srcdir)/kadm5-private.h
+$(ALL_OBJECTS): kadm5_err.h
+
+KADM5_PROTOS_SRCS  = $(dist_libkadm5clnt_la_SOURCES)
+KADM5_PROTOS_SRCS += $(dist_libkadm5srv_la_SOURCES)
 
 proto_opts = -q -R '^(_|kadm5_c_|kadm5_s_|kadm5_log)' -P comment
-$(srcdir)/kadm5-protos.h:
+$(srcdir)/kadm5-protos.h: $(KADM5_PROTOS_SRCS)
 	cd $(srcdir); perl ../../cf/make-proto.pl $(proto_opts) \
 		-o kadm5-protos.h \
 		$(dist_libkadm5clnt_la_SOURCES) \
 		$(dist_libkadm5srv_la_SOURCES) \
 		|| rm -f kadm5-protos.h
 
-$(srcdir)/kadm5-private.h:
+$(srcdir)/kadm5-private.h: $(KADM5_PROTOS_SRCS)
 	cd $(srcdir); perl ../../cf/make-proto.pl $(proto_opts) \
 		-p kadm5-private.h \
 		$(dist_libkadm5clnt_la_SOURCES) \
@@ -194,4 +212,5 @@ EXTRA_DIST = \
 	check-cracklib.pl \
 	flush.c \
 	sample_passwd_check.c \
-	version-script.map
+	version-script.map \
+	version-script-client.map
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/kadm5/NTMakefile
index 3afe8e899..392a88438 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/NTMakefile
@@ -86,6 +86,7 @@ dist_libkadm5srv_la_SOURCES =	\
 	rename_s.c		\
 	server_glue.c		\
 	set_keys.c		\
+	setkey3_s.c		\
 	set_modifier.c		\
 	kadm5-pwcheck.h		\
 	admin.h
@@ -137,6 +138,7 @@ LIBKADM5SRV_OBJS=		    \
 	$(OBJ)\rename_s.obj	    \
 	$(OBJ)\server_glue.obj	    \
 	$(OBJ)\set_keys.obj	    \
+	$(OBJ)\setkey3_s.obj	    \
 	$(OBJ)\set_modifier.obj	    \
 	$(OBJ)\kadm5_err.obj
 
@@ -216,9 +218,9 @@ LIBKADM5SRVRES=$(OBJ)\libkadm5srv-version.res
 
 $(LIBKADM5SRV): $(BINDIR)\libkadm5srv.dll
 
-$(BINDIR)\libkadm5srv.dll: $(LIBKADM5SRV_OBJS) $(LIBHEIMDAL) $(LIBROKEN) $(LIBHDB) $(LIBCOMERR) $(LIBSQLITE) $(LIBKADM5SRVRES)
+$(BINDIR)\libkadm5srv.dll: $(LIBKADM5SRV_OBJS) $(LIBHEIMDAL) $(LIBROKEN) $(LIBHDB) $(LIBCOMERR) $(LIBSQLITE) $(LIBKADM5SRVRES) $(LIBHEIMBASE)
 	$(DLLGUILINK) -implib:$(LIBKADM5SRV) -def:libkadm5srv-exports.def
-	$(DLLPREP)
+	$(DLLPREP_NODIST)
 
 all:: $(INCFILES) $(LIBKADM5SRV) $(LIBKADM5CLNT)
 
@@ -257,6 +259,10 @@ EXPORTS
 	$(DLLPREP_NODIST)
 
 test-run:
+	cd $(OBJ)
+	-default_keys.exe
+	-test_pw_quality.exe
+	cd $(SRCDIR)
 
 {$(OBJ)}.h{$(KADM5INCDIR)}.h:
 	$(CP) $< $@
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/acl.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/acl.c
index 4e532c792..a4716c931 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/acl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/acl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acl.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: acl.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: acl.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static struct units acl_units[] = {
     { "all",		KADM5_PRIV_ALL },
@@ -46,6 +46,7 @@ static struct units acl_units[] = {
     { "modify",		KADM5_PRIV_MODIFY },
     { "add",		KADM5_PRIV_ADD },
     { "get", 		KADM5_PRIV_GET },
+    { "get-keys",	KADM5_PRIV_GET_KEYS },
     { NULL,		0 }
 };
 
@@ -179,6 +180,8 @@ check_flags (unsigned op,
 
     if(res & KADM5_PRIV_GET)
 	return KADM5_AUTH_GET;
+    if(res & KADM5_PRIV_GET_KEYS)
+	return KADM5_AUTH_GET_KEYS;
     if(res & KADM5_PRIV_ADD)
 	return KADM5_AUTH_ADD;
     if(res & KADM5_PRIV_MODIFY)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/ad.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/ad.c
index 05557ee5f..b235ad73b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/ad.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/ad.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ad.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: ad.c,v 1.4 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -49,7 +49,7 @@
 #include <krb5/base64.h>
 #endif
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: ad.c,v 1.4 2017/01/28 21:31:49 christos Exp $");
 
 #ifdef OPENLDAP
 
@@ -486,13 +486,14 @@ ad_get_cred(kadm5_ad_context *context, const char *password)
     kadm5_ret_t ret;
     krb5_ccache cc;
     char *service;
+    int aret;
 
     if (context->ccache)
 	return 0;
 
-    asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
-	     context->realm, context->realm);
-    if (service == NULL)
+    aret = asprintf(&service, "%s/%s@%s", KRB5_TGS_NAME,
+		    context->realm, context->realm);
+    if (aret == -1 || service == NULL)
 	return ENOMEM;
 
     ret = _kadm5_c_get_cred_cache(context->context,
@@ -510,6 +511,9 @@ ad_get_cred(kadm5_ad_context *context, const char *password)
 static kadm5_ret_t
 kadm5_ad_chpass_principal(void *server_handle,
 			  krb5_principal principal,
+			  int keepold,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
 			  const char *password)
 {
     kadm5_ad_context *context = server_handle;
@@ -517,6 +521,12 @@ kadm5_ad_chpass_principal(void *server_handle,
     int result_code;
     kadm5_ret_t ret;
 
+    if (keepold)
+	return KADM5_KEEPOLD_NOSUPP;
+
+    if (n_ks_tuple > 0)
+       return KADM5_KS_TUPLE_NOSUPP;
+
     ret = ad_get_cred(context, NULL);
     if (ret)
 	return ret;
@@ -564,6 +574,8 @@ static kadm5_ret_t
 kadm5_ad_create_principal(void *server_handle,
 			  kadm5_principal_ent_t entry,
 			  uint32_t mask,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
 			  const char *password)
 {
     kadm5_ad_context *context = server_handle;
@@ -589,6 +601,14 @@ kadm5_ad_create_principal(void *server_handle,
     if ((mask & KADM5_PRINCIPAL) == 0)
 	return KADM5_BAD_MASK;
 
+    /*
+     * We should get around to implementing this...  At the moment, the
+     * the server side API is implemented but the wire protocol has not
+     * been updated.
+     */
+    if (n_ks_tuple > 0)
+       return KADM5_KS_TUPLE_NOSUPP;
+
     for (i = 0; i < sizeof(rattrs)/sizeof(rattrs[0]); i++)
 	attrs[i] = &rattrs[i];
     attrs[i] = NULL;
@@ -1226,14 +1246,21 @@ kadm5_ad_modify_principal(void *server_handle,
 #endif
 }
 
+/*ARGSUSED*/
 static kadm5_ret_t
 kadm5_ad_randkey_principal(void *server_handle,
 			   krb5_principal principal,
+			   krb5_boolean keepold,
+			   int n_ks_tuple,
+			   krb5_key_salt_tuple *ks_tuple,
 			   krb5_keyblock **keys,
 			   int *n_keys)
 {
     kadm5_ad_context *context = server_handle;
 
+    if (keepold)
+	return KADM5_KEEPOLD_NOSUPP;
+
     /*
      * random key
      */
@@ -1250,7 +1277,7 @@ kadm5_ad_randkey_principal(void *server_handle,
     {
 	char p[64];
 	krb5_generate_random_block(p, sizeof(p));
-	plen = base64_encode(p, sizeof(p), &password);
+	plen = rk_base64_encode(p, sizeof(p), &password);
 	if (plen < 0)
 	    return ENOMEM;
     }
@@ -1323,6 +1350,7 @@ kadm5_ad_rename_principal(void *server_handle,
 static kadm5_ret_t
 kadm5_ad_chpass_principal_with_key(void *server_handle,
 				   krb5_principal princ,
+				   int keepold,
 				   int n_key_data,
 				   krb5_key_data *key_data)
 {
@@ -1331,10 +1359,23 @@ kadm5_ad_chpass_principal_with_key(void *server_handle,
     return KADM5_RPC_ERROR;
 }
 
+static kadm5_ret_t
+kadm5_ad_lock(void *server_handle)
+{
+    return ENOTSUP;
+}
+
+static kadm5_ret_t
+kadm5_ad_unlock(void *server_handle)
+{
+    return ENOTSUP;
+}
+
 static void
 set_funcs(kadm5_ad_context *c)
 {
 #define SET(C, F) (C)->funcs.F = kadm5_ad_ ## F
+#define SETNOTIMP(C, F) (C)->funcs.F = 0
     SET(c, chpass_principal);
     SET(c, chpass_principal_with_key);
     SET(c, create_principal);
@@ -1347,6 +1388,9 @@ set_funcs(kadm5_ad_context *c)
     SET(c, modify_principal);
     SET(c, randkey_principal);
     SET(c, rename_principal);
+    SET(c, lock);
+    SET(c, unlock);
+    SETNOTIMP(c, setkey_principal_3);
 }
 
 kadm5_ret_t
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/admin.h b/crypto/external/bsd/heimdal/dist/lib/kadm5/admin.h
index a96603e6a..e86e09a0b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/admin.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/admin.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: admin.h,v 1.1.1.2 2011/04/14 14:09:16 elric Exp $	*/
+/*	$NetBSD: admin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
@@ -50,6 +50,11 @@
 
 #define KADM5_STRUCT_VERSION 0
 
+/* For kadm5_log_get_version_fd() */
+#define LOG_VERSION_LAST -1
+#define LOG_VERSION_FIRST 1
+#define LOG_VERSION_UBER  0
+
 #include <krb5/krb5.h>
 
 #define KRB5_KDB_DISALLOW_POSTDATED	0x00000001
@@ -114,6 +119,11 @@ typedef struct {
     void*   key_data_contents[2];/* Array of pointers */
 } krb5_key_data;
 
+typedef struct _krb5_keysalt {
+    int16_t               type;
+    krb5_data             data;                 /* Length, data */
+} krb5_keysalt;
+
 typedef struct _krb5_tl_data {
     struct _krb5_tl_data* tl_data_next;
     int16_t tl_data_type;
@@ -131,6 +141,8 @@ typedef struct _krb5_tl_data {
 #define KRB5_TL_EXTENSION           	0x0008
 #define KRB5_TL_PKINIT_ACL           	0x0009
 #define KRB5_TL_ALIASES           	0x000a
+#define KRB5_TL_HIST_KVNO_DIFF_CLNT	0x000b
+#define KRB5_TL_HIST_KVNO_DIFF_SVC	0x000c
 
 typedef struct _kadm5_principal_ent_t {
     krb5_principal principal;
@@ -195,11 +207,12 @@ typedef struct _kadm5_policy_ent_t {
 #define KADM5_PRIV_DELETE	(1 << 3)
 #define KADM5_PRIV_LIST		(1 << 4)
 #define KADM5_PRIV_CPW		(1 << 5)
+#define KADM5_PRIV_GET_KEYS	(1 << 6)
+
+/* Note: KADM5_PRIV_GET_KEYS not included */
 #define KADM5_PRIV_ALL		(KADM5_PRIV_GET | KADM5_PRIV_ADD | KADM5_PRIV_MODIFY | KADM5_PRIV_DELETE | KADM5_PRIV_LIST | KADM5_PRIV_CPW)
 
-typedef struct {
-    int XXX;
-}krb5_key_salt_tuple;
+#define KADM5_BOGUS_KEY_DATA    "\xe5\xe5\xe5\xe5"
 
 typedef struct _kadm5_config_params {
     uint32_t mask;
@@ -223,38 +236,4 @@ typedef krb5_error_code kadm5_ret_t;
 
 #include "kadm5-protos.h"
 
-#if 0
-/* unimplemented functions */
-kadm5_ret_t
-kadm5_decrypt_key(void *server_handle,
-		  kadm5_principal_ent_t entry, int32_t
-		  ktype, int32_t stype, int32_t
-		  kvno, krb5_keyblock *keyblock,
-		  krb5_keysalt *keysalt, int *kvnop);
-
-kadm5_ret_t
-kadm5_create_policy(void *server_handle,
-		    kadm5_policy_ent_t policy, uint32_t mask);
-
-kadm5_ret_t
-kadm5_delete_policy(void *server_handle, char *policy);
-
-
-kadm5_ret_t
-kadm5_modify_policy(void *server_handle,
-		    kadm5_policy_ent_t policy,
-		    uint32_t mask);
-
-kadm5_ret_t
-kadm5_get_policy(void *server_handle, char *policy, kadm5_policy_ent_t ent);
-
-kadm5_ret_t
-kadm5_get_policies(void *server_handle, char *exp,
-		   char ***pols, int *count);
-
-void
-kadm5_free_policy_ent(kadm5_policy_ent_t policy);
-
-#endif
-
 #endif /* __KADM5_ADMIN_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/bump_pw_expire.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/bump_pw_expire.c
index 449f2123b..4eee3729e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/bump_pw_expire.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/bump_pw_expire.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bump_pw_expire.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: bump_pw_expire.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: bump_pw_expire.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
  * extend password_expiration if it's defined
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_c.c
index 13f2f82ce..ae4622766 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: chpass_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: chpass_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000, 2005-2006 Kungliga Tekniska Högskolan
@@ -35,11 +35,14 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: chpass_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_chpass_principal(void *server_handle,
 			 krb5_principal princ,
+			 int keepold,
+			 int n_ks_tuple,
+			 krb5_key_salt_tuple *ks_tuple,
 			 const char *password)
 {
     kadm5_client_context *context = server_handle;
@@ -49,6 +52,14 @@ kadm5_c_chpass_principal(void *server_handle,
     int32_t tmp;
     krb5_data reply;
 
+    /*
+     * We should get around to implementing this...  At the moment, the
+     * the server side API is implemented but the wire protocol has not
+     * been updated.
+     */
+    if (n_ks_tuple > 0)
+       return KADM5_KS_TUPLE_NOSUPP;
+
     ret = _kadm5_connect(server_handle);
     if(ret)
 	return ret;
@@ -61,6 +72,7 @@ kadm5_c_chpass_principal(void *server_handle,
     krb5_store_int32(sp, kadm_chpass);
     krb5_store_principal(sp, princ);
     krb5_store_string(sp, password);
+    krb5_store_int32(sp, keepold); /* extension */
     ret = _kadm5_client_send(context, sp);
     krb5_storage_free(sp);
     if (ret)
@@ -84,6 +96,7 @@ kadm5_c_chpass_principal(void *server_handle,
 kadm5_ret_t
 kadm5_c_chpass_principal_with_key(void *server_handle,
 				  krb5_principal princ,
+				  int keepold,
 				  int n_key_data,
 				  krb5_key_data *key_data)
 {
@@ -109,6 +122,7 @@ kadm5_c_chpass_principal_with_key(void *server_handle,
     krb5_store_int32(sp, n_key_data);
     for (i = 0; i < n_key_data; ++i)
 	kadm5_store_key_data (sp, &key_data[i]);
+    krb5_store_int32(sp, keepold); /* extension */
     ret = _kadm5_client_send(context, sp);
     krb5_storage_free(sp);
     if (ret)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c
index a5ae18a1a..25960e51c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: chpass_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: chpass_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
@@ -35,11 +35,14 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: chpass_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static kadm5_ret_t
 change(void *server_handle,
        krb5_principal princ,
+       int keepold,
+       int n_ks_tuple,
+       krb5_key_salt_tuple *ks_tuple,
        const char *password,
        int cond)
 {
@@ -51,20 +54,36 @@ change(void *server_handle,
     int existsp = 0;
 
     memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret)
+	    return ret;
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
 
     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
 				      HDB_F_DECRYPT|HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
-    if(ret)
-	goto out;
+    if (ret)
+	goto out2;
+
+    if (keepold || cond) {
+	/*
+	 * We save these for now so we can handle password history checking;
+	 * we handle keepold further below.
+	 */
+	ret = hdb_add_current_keys_to_history(context->context, &ent.entry);
+	if (ret)
+	    goto out3;
+    }
 
     if (context->db->hdb_capability_flags & HDB_CAP_F_HANDLE_PASSWORDS) {
 	ret = context->db->hdb_password(context->context, context->db,
 					&ent, password, cond);
 	if (ret)
-	    goto out2;
+	    goto out3;
     } else {
 
 	num_keys = ent.entry.keys.len;
@@ -73,54 +92,76 @@ change(void *server_handle,
 	ent.entry.keys.len = 0;
 	ent.entry.keys.val = NULL;
 
-	ret = _kadm5_set_keys(context, &ent.entry, password);
+	ret = _kadm5_set_keys(context, &ent.entry, n_ks_tuple, ks_tuple,
+			      password);
 	if(ret) {
-	    _kadm5_free_keys (context->context, num_keys, keys);
-	    goto out2;
+	    _kadm5_free_keys(context->context, num_keys, keys);
+	    goto out3;
 	}
+	_kadm5_free_keys(context->context, num_keys, keys);
 
-	if (cond)
-	    existsp = _kadm5_exists_keys (ent.entry.keys.val,
-					  ent.entry.keys.len,
-					  keys, num_keys);
-	_kadm5_free_keys (context->context, num_keys, keys);
+	if (cond) {
+	    HDB_extension *ext;
+
+	    ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_hist_keys);
+	    if (ext != NULL)
+		existsp = _kadm5_exists_keys_hist(ent.entry.keys.val,
+						  ent.entry.keys.len,
+						  &ext->data.u.hist_keys);
+	}
 
 	if (existsp) {
 	    ret = KADM5_PASS_REUSE;
 	    krb5_set_error_message(context->context, ret,
 				   "Password reuse forbidden");
-	    goto out2;
+	    goto out3;
 	}
-
-	ret = hdb_seal_keys(context->context, context->db, &ent.entry);
-	if (ret)
-	    goto out2;
     }
     ent.entry.kvno++;
 
+    ent.entry.flags.require_pwchange = 0;
+
+    if (!keepold) {
+	HDB_extension ext;
+
+	memset(&ext, 0, sizeof (ext));
+        ext.mandatory = FALSE;
+	ext.data.element = choice_HDB_extension_data_hist_keys;
+	ret = hdb_replace_extension(context->context, &ent.entry, &ext);
+	if (ret)
+	    goto out3;
+    }
+
+    ret = hdb_seal_keys(context->context, context->db, &ent.entry);
+    if (ret)
+        goto out3;
+
     ret = _kadm5_set_modifier(context, &ent.entry);
     if(ret)
-	goto out2;
+	goto out3;
 
     ret = _kadm5_bump_pw_expire(context, &ent.entry);
     if (ret)
-	goto out2;
+	goto out3;
 
-    ret = context->db->hdb_store(context->context, context->db,
-				 HDB_F_REPLACE, &ent);
-    if (ret)
-	goto out2;
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_modify(context, &ent.entry,
+                           KADM5_ATTRIBUTES | KADM5_PRINCIPAL |
+                           KADM5_MOD_NAME | KADM5_MOD_TIME |
+                           KADM5_KEY_DATA | KADM5_KVNO |
+                           KADM5_PW_EXPIRATION | KADM5_TL_DATA);
 
-    kadm5_log_modify (context,
-		      &ent.entry,
-		      KADM5_PRINCIPAL | KADM5_MOD_NAME | KADM5_MOD_TIME |
-		      KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION |
-		      KADM5_TL_DATA);
-
-out2:
+ out3:
     hdb_free_entry(context->context, &ent);
-out:
-    context->db->hdb_close(context->context, context->db);
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
 
@@ -133,9 +174,10 @@ out:
 kadm5_ret_t
 kadm5_s_chpass_principal_cond(void *server_handle,
 			      krb5_principal princ,
+			      int keepold,
 			      const char *password)
 {
-    return change (server_handle, princ, password, 1);
+    return change (server_handle, princ, keepold, 0, NULL, password, 1);
 }
 
 /*
@@ -145,9 +187,13 @@ kadm5_s_chpass_principal_cond(void *server_handle,
 kadm5_ret_t
 kadm5_s_chpass_principal(void *server_handle,
 			 krb5_principal princ,
+			 int keepold,
+			 int n_ks_tuple,
+			 krb5_key_salt_tuple *ks_tuple,
 			 const char *password)
 {
-    return change (server_handle, princ, password, 0);
+    return change (server_handle, princ, keepold,
+	n_ks_tuple, ks_tuple, password, 0);
 }
 
 /*
@@ -157,6 +203,7 @@ kadm5_s_chpass_principal(void *server_handle,
 kadm5_ret_t
 kadm5_s_chpass_principal_with_key(void *server_handle,
 				  krb5_principal princ,
+				  int keepold,
 				  int n_key_data,
 				  krb5_key_data *key_data)
 {
@@ -165,42 +212,67 @@ kadm5_s_chpass_principal_with_key(void *server_handle,
     kadm5_ret_t ret;
 
     memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret)
+	    return ret;
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ, 0,
 				      HDB_F_GET_ANY|HDB_F_ADMIN_DATA, &ent);
-    if(ret == HDB_ERR_NOENTRY)
-	goto out;
-    ret = _kadm5_set_keys2(context, &ent.entry, n_key_data, key_data);
-    if(ret)
+    if (ret == HDB_ERR_NOENTRY)
 	goto out2;
+    if (keepold) {
+	ret = hdb_add_current_keys_to_history(context->context, &ent.entry);
+	if (ret)
+	    goto out3;
+    }
+    ret = _kadm5_set_keys2(context, &ent.entry, n_key_data, key_data);
+    if (ret)
+	goto out3;
     ent.entry.kvno++;
     ret = _kadm5_set_modifier(context, &ent.entry);
-    if(ret)
-	goto out2;
+    if (ret)
+	goto out3;
     ret = _kadm5_bump_pw_expire(context, &ent.entry);
     if (ret)
-	goto out2;
+	goto out3;
 
-    ret = hdb_seal_keys(context->context, context->db, &ent.entry);
-    if (ret)
-	goto out2;
+    if (keepold) {
+	ret = hdb_seal_keys(context->context, context->db, &ent.entry);
+	if (ret)
+	    goto out3;
+    } else {
+	HDB_extension ext;
 
-    ret = context->db->hdb_store(context->context, context->db,
-				 HDB_F_REPLACE, &ent);
-    if (ret)
-	goto out2;
+	memset(&ext, 0, sizeof (ext));
+	ext.mandatory = FALSE;
+	ext.data.element = choice_HDB_extension_data_hist_keys;
+	ext.data.u.hist_keys.len = 0;
+	ext.data.u.hist_keys.val = NULL;
+	hdb_replace_extension(context->context, &ent.entry, &ext);
+    }
 
-    kadm5_log_modify (context,
-		      &ent.entry,
-		      KADM5_PRINCIPAL | KADM5_MOD_NAME | KADM5_MOD_TIME |
-		      KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION |
-		      KADM5_TL_DATA);
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_modify(context, &ent.entry,
+                           KADM5_PRINCIPAL | KADM5_MOD_NAME |
+                           KADM5_MOD_TIME | KADM5_KEY_DATA | KADM5_KVNO |
+                           KADM5_PW_EXPIRATION | KADM5_TL_DATA);
 
-out2:
+ out3:
     hdb_free_entry(context->context, &ent);
-out:
-    context->db->hdb_close(context->context, context->db);
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/client_glue.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/client_glue.c
index a96ad08a0..0c9617b85 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/client_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/client_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: client_glue.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: client_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: client_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_init_with_password(const char *client_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/common_glue.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/common_glue.c
index bdf34e28d..5403d40f0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/common_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/common_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: common_glue.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: common_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -35,16 +35,30 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: common_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
-#define __CALL(F, P) (*((kadm5_common_context*)server_handle)->funcs.F)P;
+#define __CALL(F, P) (*((kadm5_common_context*)server_handle)->funcs.F)P
+#define __CALLABLE(F) (((kadm5_common_context*)server_handle)->funcs.F != 0)
 
 kadm5_ret_t
 kadm5_chpass_principal(void *server_handle,
 		       krb5_principal princ,
 		       const char *password)
 {
-    return __CALL(chpass_principal, (server_handle, princ, password));
+    return __CALL(chpass_principal, (server_handle, princ, 0,
+		  0, NULL, password));
+}
+
+kadm5_ret_t
+kadm5_chpass_principal_3(void *server_handle,
+		         krb5_principal princ,
+		         krb5_boolean keepold,
+		         int n_ks_tuple,
+		         krb5_key_salt_tuple *ks_tuple,
+		         const char *password)
+{
+    return __CALL(chpass_principal, (server_handle, princ, keepold,
+		  n_ks_tuple, ks_tuple, password));
 }
 
 kadm5_ret_t
@@ -54,7 +68,30 @@ kadm5_chpass_principal_with_key(void *server_handle,
 				krb5_key_data *key_data)
 {
     return __CALL(chpass_principal_with_key,
-		  (server_handle, princ, n_key_data, key_data));
+		  (server_handle, princ, 0, n_key_data, key_data));
+}
+
+kadm5_ret_t
+kadm5_chpass_principal_with_key_3(void *server_handle,
+				  krb5_principal princ,
+				  int keepold,
+				  int n_key_data,
+				  krb5_key_data *key_data)
+{
+    return __CALL(chpass_principal_with_key,
+		  (server_handle, princ, keepold, n_key_data, key_data));
+}
+
+kadm5_ret_t
+kadm5_create_principal_3(void *server_handle,
+			 kadm5_principal_ent_t princ,
+			 uint32_t mask,
+			 int n_ks_tuple,
+			 krb5_key_salt_tuple *ks_tuple,
+			 char *password)
+{
+    return __CALL(create_principal,
+		  (server_handle, princ, mask, n_ks_tuple, ks_tuple, password));
 }
 
 kadm5_ret_t
@@ -63,7 +100,8 @@ kadm5_create_principal(void *server_handle,
 		       uint32_t mask,
 		       const char *password)
 {
-    return __CALL(create_principal, (server_handle, princ, mask, password));
+    return __CALL(create_principal,
+		  (server_handle, princ, mask, 0, NULL, password));
 }
 
 kadm5_ret_t
@@ -94,6 +132,49 @@ kadm5_get_principal(void *server_handle,
     return __CALL(get_principal, (server_handle, princ, out, mask));
 }
 
+/**
+ * Extract decrypted keys from kadm5_principal_ent_t object.  Mostly a
+ * no-op for Heimdal because we fetch the entry with decrypted keys.
+ * Sadly this is not fully a no-op, as we have to allocate a copy.
+ *
+ * @server_handle is the kadm5 handle
+ * @entry is the HDB entry for the principal in question
+ * @ktype is the enctype to get a key for, or -1 to get the first one
+ * @stype is the salttype to get a key for, or -1 to get the first match
+ * @kvno is the kvno to search for, or -1 to get the first match (highest kvno)
+ * @keyblock is where the key will be placed
+ * @keysalt, if not NULL, is where the salt will be placed
+ * @kvnop, if not NULL, is where the selected kvno will be placed
+ */
+kadm5_ret_t
+kadm5_decrypt_key(void *server_handle,
+                  kadm5_principal_ent_t entry,
+		  int32_t ktype, int32_t stype,
+		  int32_t kvno, krb5_keyblock *keyblock,
+                  krb5_keysalt *keysalt, int *kvnop)
+{
+    size_t i;
+
+    if (kvno < 1 || stype != -1)
+	return KADM5_DECRYPT_USAGE_NOSUPP;
+
+    for (i = 0; i < entry->n_key_data; i++) {
+	if (ktype != entry->key_data[i].key_data_kvno)
+	    continue;
+
+	keyblock->keytype = ktype;
+	keyblock->keyvalue.length = entry->key_data[i].key_data_length[0];
+	keyblock->keyvalue.data = malloc(keyblock->keyvalue.length);
+	if (keyblock->keyvalue.data == NULL)
+	    return ENOMEM;
+	memcpy(keyblock->keyvalue.data,
+	       entry->key_data[i].key_data_contents[0],
+	       keyblock->keyvalue.length);
+    }
+
+    return 0;
+}
+
 kadm5_ret_t
 kadm5_modify_principal(void *server_handle,
 		       kadm5_principal_ent_t princ,
@@ -108,7 +189,21 @@ kadm5_randkey_principal(void *server_handle,
 			krb5_keyblock **new_keys,
 			int *n_keys)
 {
-    return __CALL(randkey_principal, (server_handle, princ, new_keys, n_keys));
+    return __CALL(randkey_principal, (server_handle, princ, FALSE, 0, NULL,
+		  new_keys, n_keys));
+}
+
+kadm5_ret_t
+kadm5_randkey_principal_3(void *server_handle,
+			  krb5_principal princ,
+			  krb5_boolean keepold,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
+			  krb5_keyblock **new_keys,
+			  int *n_keys)
+{
+    return __CALL(randkey_principal, (server_handle, princ, keepold,
+				      n_ks_tuple, ks_tuple, new_keys, n_keys));
 }
 
 kadm5_ret_t
@@ -134,3 +229,202 @@ kadm5_get_privs(void *server_handle,
 {
     return __CALL(get_privs, (server_handle, privs));
 }
+
+
+/**
+ * This function is allows the caller to set new keys for a principal.
+ * This is a trivial wrapper around kadm5_setkey_principal_3().
+ */
+kadm5_ret_t
+kadm5_setkey_principal(void *server_handle,
+                       krb5_principal princ,
+                       krb5_keyblock *new_keys,
+                       int n_keys)
+{
+    return kadm5_setkey_principal_3(server_handle, princ, 0, 0, NULL,
+				    new_keys, n_keys);
+}
+
+/**
+ * This function is allows the caller to set new keys for a principal.
+ * This is a simple wrapper around kadm5_get_principal() and
+ * kadm5_modify_principal().
+ */
+kadm5_ret_t
+kadm5_setkey_principal_3(void *server_handle,
+                         krb5_principal princ,
+                         krb5_boolean keepold,
+                         int n_ks_tuple, krb5_key_salt_tuple *ks_tuple,
+                         krb5_keyblock *keyblocks,
+                         int n_keys)
+{
+    kadm5_principal_ent_rec princ_ent;
+    kadm5_ret_t ret;
+    krb5_key_data *new_key_data = NULL;
+    size_t i;
+
+    if (n_keys < 1)
+	return EINVAL;
+    if (n_ks_tuple > 0 && n_ks_tuple != n_keys)
+	return KADM5_SETKEY3_ETYPE_MISMATCH;
+
+    /*
+     * If setkey_principal_3 is defined in the server handle, use that.
+     */
+    if (__CALLABLE(setkey_principal_3))
+	return __CALL(setkey_principal_3,
+		      (server_handle, princ, keepold, n_ks_tuple, ks_tuple,
+		       keyblocks, n_keys));
+
+    /*
+     * Otherwise, simulate it via a get, update, modify sequence.
+     */
+    ret = kadm5_get_principal(server_handle, princ, &princ_ent,
+                              KADM5_KVNO | KADM5_PRINCIPAL | KADM5_KEY_DATA);
+    if (ret)
+	return ret;
+
+    if (keepold) {
+        new_key_data = calloc((n_keys + princ_ent.n_key_data),
+                              sizeof(*new_key_data));
+	if (new_key_data == NULL) {
+	    ret = ENOMEM;
+	    goto out;
+	}
+
+	memcpy(&new_key_data[n_keys], &princ_ent.key_data[0],
+		princ_ent.n_key_data * sizeof (princ_ent.key_data[0]));
+    } else {
+	new_key_data = calloc(n_keys, sizeof(*new_key_data));
+	if (new_key_data == NULL) {
+	    ret = ENOMEM;
+	    goto out;
+	}
+    }
+
+    princ_ent.kvno++;
+    for (i = 0; i < n_keys; i++) {
+	new_key_data[i].key_data_ver = 2;
+
+	/* Key */
+	new_key_data[i].key_data_kvno = princ_ent.kvno;
+	new_key_data[i].key_data_type[0] = keyblocks[i].keytype;
+	new_key_data[i].key_data_length[0] = keyblocks[i].keyvalue.length;
+	new_key_data[i].key_data_contents[0] =
+	    malloc(keyblocks[i].keyvalue.length);
+	if (new_key_data[i].key_data_contents[0] == NULL) {
+	    ret = ENOMEM;
+	    goto out;
+	}
+	memcpy(new_key_data[i].key_data_contents[0],
+	       keyblocks[i].keyvalue.data,
+	       keyblocks[i].keyvalue.length);
+
+	/*
+	 * Salt (but there's no salt, just salttype, which is kinda
+	 * silly -- what's the point of setkey_3() then, besides
+	 * keepold?!)
+	 */
+	new_key_data[i].key_data_type[1] = 0;
+	if (n_ks_tuple > 0) {
+	    if (ks_tuple[i].ks_enctype != keyblocks[i].keytype) {
+		ret = KADM5_SETKEY3_ETYPE_MISMATCH;
+                goto out;
+            }
+	    new_key_data[i].key_data_type[1] = ks_tuple[i].ks_salttype;
+	}
+	new_key_data[i].key_data_length[1] = 0;
+	new_key_data[i].key_data_contents[1] = NULL;
+    }
+
+    /* Free old keys */
+    if (!keepold) {
+	for (i = 0; i < princ_ent.n_key_data; i++) {
+	    free(princ_ent.key_data[i].key_data_contents[0]);
+	    free(princ_ent.key_data[i].key_data_contents[1]);
+	}
+    }
+    free(princ_ent.key_data);
+    princ_ent.key_data = new_key_data;
+    princ_ent.n_key_data = n_keys + (keepold ? princ_ent.n_key_data : 0);
+    new_key_data = NULL;
+
+    /* Modify the principal */
+    ret = kadm5_modify_principal(server_handle, &princ_ent, KADM5_KVNO | KADM5_KEY_DATA);
+
+out:
+    if (new_key_data != NULL) {
+	for (i = 0; i < n_keys; i++) {
+	    free(new_key_data[i].key_data_contents[0]);
+	    free(new_key_data[i].key_data_contents[1]);
+	}
+	free(new_key_data);
+    }
+    kadm5_free_principal_ent(server_handle, &princ_ent);
+    return ret;
+}
+
+
+kadm5_ret_t
+kadm5_lock(void *server_handle)
+{
+    return __CALL(lock, (server_handle));
+}
+
+kadm5_ret_t
+kadm5_unlock(void *server_handle)
+{
+    return __CALL(unlock, (server_handle));
+}
+
+
+kadm5_ret_t
+kadm5_create_policy(void *server_handle,
+	                         kadm5_policy_ent_t policy, long mask)
+{
+    return KADM5_POLICY_OP_NOSUPP;
+}
+
+kadm5_ret_t
+kadm5_delete_policy(void *server_handle, char *name)
+{
+    return KADM5_POLICY_OP_NOSUPP;
+}
+
+
+kadm5_ret_t
+kadm5_modify_policy(void *server_handle, kadm5_policy_ent_t policy,
+		    uint32_t mask)
+{
+    return KADM5_POLICY_OP_NOSUPP;
+}
+
+kadm5_ret_t
+kadm5_get_policy(void *server_handle, char *policy, kadm5_policy_ent_t ent)
+{
+    memset(ent, 0, sizeof (*ent));
+    return KADM5_POLICY_OP_NOSUPP;
+}
+
+
+kadm5_ret_t
+kadm5_get_policies(void *server_handle, char *exp, char ***pols, int *count)
+{
+    *count = 0;
+    *pols = NULL;
+
+    return KADM5_POLICY_OP_NOSUPP;
+}
+
+kadm5_ret_t
+kadm5_free_policy_ent(kadm5_policy_ent_t ent)
+{
+    if (ent->policy)
+	free(ent->policy);
+    /*
+     * Not clear if we should free ent or not.  It might be an automatic
+     * struct, so we don't free it for now, just in case.
+     */
+    return 0;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/context_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/context_s.c
index f60d04123..37b44721b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/context_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/context_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: context_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -35,7 +35,64 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: context_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
+
+static kadm5_ret_t
+kadm5_s_lock(void *server_handle)
+{
+    kadm5_server_context *context = server_handle;
+    kadm5_ret_t ret;
+
+    if (context->keep_open) {
+	/*
+	 * We open/close around every operation, but we retain the DB
+	 * open if the DB was locked with a prior call to kadm5_lock(),
+	 * so if it's open here that must be because the DB is locked.
+	 */
+	heim_assert(context->db->lock_count > 0,
+		    "Internal error in tracking HDB locks");
+	return KADM5_ALREADY_LOCKED;
+    }
+
+    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+    if (ret)
+	return ret;
+
+    ret = context->db->hdb_lock(context->context, context->db, HDB_WLOCK);
+    if (ret) {
+        (void) context->db->hdb_close(context->context, context->db);
+	return ret;
+    }
+
+    /*
+     * Attempt to recover the log.  This will generally fail on slaves,
+     * and we can't tell if we're on a slave here.
+     *
+     * Perhaps we could set a flag in the kadm5_server_context to
+     * indicate whether a read has been done without recovering the log,
+     * in which case we could fail any subsequent writes.
+     */
+    if (kadm5_log_init(context) == 0)
+        (void) kadm5_log_end(context);
+
+    context->keep_open = 1;
+    return 0;
+}
+
+static kadm5_ret_t
+kadm5_s_unlock(void *server_handle)
+{
+    kadm5_server_context *context = server_handle;
+    kadm5_ret_t ret;
+
+    if (!context->keep_open)
+	return KADM5_NOT_LOCKED;
+
+    context->keep_open = 0;
+    ret = context->db->hdb_unlock(context->context, context->db);
+    (void) context->db->hdb_close(context->context, context->db);
+    return ret;
+}
 
 static void
 set_funcs(kadm5_server_context *c)
@@ -53,6 +110,9 @@ set_funcs(kadm5_server_context *c)
     SET(c, modify_principal);
     SET(c, randkey_principal);
     SET(c, rename_principal);
+    SET(c, lock);
+    SET(c, unlock);
+    SET(c, setkey_principal_3);
 }
 
 #ifndef NO_UNIX_SOCKETS
@@ -83,6 +143,7 @@ find_db_spec(kadm5_server_context *ctx)
     krb5_context context = ctx->context;
     struct hdb_dbinfo *info, *d;
     krb5_error_code ret;
+    int aret;
 
     if (ctx->config.realm) {
 	/* fetch the databases */
@@ -99,20 +160,32 @@ find_db_spec(kadm5_server_context *ctx)
 		continue;
 
 	    p = hdb_dbinfo_get_dbname(context, d);
-	    if (p)
+	    if (p) {
 		ctx->config.dbname = strdup(p);
+                if (ctx->config.dbname == NULL)
+                    return ENOMEM;
+            }
 
 	    p = hdb_dbinfo_get_acl_file(context, d);
-	    if (p)
+	    if (p) {
 		ctx->config.acl_file = strdup(p);
+                if (ctx->config.acl_file == NULL)
+                    return ENOMEM;
+            }
 
 	    p = hdb_dbinfo_get_mkey_file(context, d);
-	    if (p)
+	    if (p) {
 		ctx->config.stash_file = strdup(p);
+                if (ctx->config.stash_file == NULL)
+                    return ENOMEM;
+            }
 
 	    p = hdb_dbinfo_get_log_file(context, d);
-	    if (p)
+	    if (p) {
 		ctx->log_context.log_file = strdup(p);
+                if (ctx->log_context.log_file == NULL)
+                    return ENOMEM;
+            }
 	    break;
 	}
 	hdb_free_dbinfo(context, &info);
@@ -120,14 +193,29 @@ find_db_spec(kadm5_server_context *ctx)
 
     /* If any of the values was unset, pick up the default value */
 
-    if (ctx->config.dbname == NULL)
+    if (ctx->config.dbname == NULL) {
 	ctx->config.dbname = strdup(hdb_default_db(context));
-    if (ctx->config.acl_file == NULL)
-	asprintf(&ctx->config.acl_file, "%s/kadmind.acl", hdb_db_dir(context));
-    if (ctx->config.stash_file == NULL)
-	asprintf(&ctx->config.stash_file, "%s/m-key", hdb_db_dir(context));
-    if (ctx->log_context.log_file == NULL)
-	asprintf(&ctx->log_context.log_file, "%s/log", hdb_db_dir(context));
+        if (ctx->config.dbname == NULL)
+            return ENOMEM;
+    }
+    if (ctx->config.acl_file == NULL) {
+	aret = asprintf(&ctx->config.acl_file, "%s/kadmind.acl",
+			hdb_db_dir(context));
+	if (aret == -1)
+	    return ENOMEM;
+    }
+    if (ctx->config.stash_file == NULL) {
+	aret = asprintf(&ctx->config.stash_file, "%s/m-key",
+			hdb_db_dir(context));
+	if (aret == -1)
+	    return ENOMEM;
+    }
+    if (ctx->log_context.log_file == NULL) {
+	aret = asprintf(&ctx->log_context.log_file, "%s/log",
+			hdb_db_dir(context));
+	if (aret == -1)
+	    return ENOMEM;
+    }
 
 #ifndef NO_UNIX_SOCKETS
     set_socket_name(context, &ctx->log_context.socket_name);
@@ -143,24 +231,42 @@ _kadm5_s_init_context(kadm5_server_context **ctx,
 		      kadm5_config_params *params,
 		      krb5_context context)
 {
-    *ctx = malloc(sizeof(**ctx));
-    if(*ctx == NULL)
+    kadm5_ret_t ret = 0;
+
+    *ctx = calloc(1, sizeof(**ctx));
+    if (*ctx == NULL)
 	return ENOMEM;
-    memset(*ctx, 0, sizeof(**ctx));
+    (*ctx)->log_context.socket_fd = rk_INVALID_SOCKET;
+
     set_funcs(*ctx);
     (*ctx)->context = context;
     krb5_add_et_list (context, initialize_kadm5_error_table_r);
+
 #define is_set(M) (params && params->mask & KADM5_CONFIG_ ## M)
-    if(is_set(REALM))
+    if (is_set(REALM)) {
 	(*ctx)->config.realm = strdup(params->realm);
-    else
-	krb5_get_default_realm(context, &(*ctx)->config.realm);
-    if(is_set(DBNAME))
+        if ((*ctx)->config.realm == NULL)
+            return ENOMEM;
+    } else {
+	ret = krb5_get_default_realm(context, &(*ctx)->config.realm);
+        if (ret)
+            return ret;
+    }
+    if (is_set(DBNAME)) {
 	(*ctx)->config.dbname = strdup(params->dbname);
-    if(is_set(ACL_FILE))
+        if ((*ctx)->config.dbname == NULL)
+            return ENOMEM;
+    }
+    if (is_set(ACL_FILE)) {
 	(*ctx)->config.acl_file = strdup(params->acl_file);
-    if(is_set(STASH_FILE))
+        if ((*ctx)->config.acl_file == NULL)
+            return ENOMEM;
+    }
+    if (is_set(STASH_FILE)) {
 	(*ctx)->config.stash_file = strdup(params->stash_file);
+        if ((*ctx)->config.stash_file == NULL)
+            return ENOMEM;
+    }
 
     find_db_spec(*ctx);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/create_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/create_c.c
index c52b99d92..823d04a44 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/create_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/create_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: create_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: create_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000, 2005-2006 Kungliga Tekniska Högskolan
@@ -35,12 +35,14 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: create_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_create_principal(void *server_handle,
 			 kadm5_principal_ent_t princ,
 			 uint32_t mask,
+			 int n_ks_tuple,
+			 krb5_key_salt_tuple *ks_tuple,
 			 const char *password)
 {
     kadm5_client_context *context = server_handle;
@@ -50,6 +52,14 @@ kadm5_c_create_principal(void *server_handle,
     int32_t tmp;
     krb5_data reply;
 
+    /*
+     * We should get around to implementing this...  At the moment, the
+     * the server side API is implemented but the wire protocol has not
+     * been updated.
+     */
+    if (n_ks_tuple > 0)
+	return KADM5_KS_TUPLE_NOSUPP;
+
     ret = _kadm5_connect(server_handle);
     if(ret)
 	return ret;
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/create_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/create_s.c
index 3d139bf76..16d5694f7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/create_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/create_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: create_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: create_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: create_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static kadm5_ret_t
 get_default(kadm5_server_context *context, krb5_principal princ,
@@ -67,6 +67,7 @@ create_principal(kadm5_server_context *context,
     kadm5_principal_ent_rec defrec, *defent;
     uint32_t def_mask;
 
+    memset(ent, 0, sizeof(*ent));
     if((mask & required_mask) != required_mask)
 	return KADM5_BAD_MASK;
     if((mask & forbidden_mask))
@@ -74,7 +75,6 @@ create_principal(kadm5_server_context *context,
     if((mask & KADM5_POLICY) && strcmp(princ->policy, "default"))
 	/* XXX no real policies for now */
 	return KADM5_UNK_POLICY;
-    memset(ent, 0, sizeof(*ent));
     ret  = krb5_copy_principal(context->context, princ->principal,
 			       &ent->entry.principal);
     if(ret)
@@ -113,6 +113,12 @@ kadm5_s_create_principal_with_key(void *server_handle,
     hdb_entry_ex ent;
     kadm5_server_context *context = server_handle;
 
+    if ((mask & KADM5_KVNO) == 0) {
+	/* create_principal() through _kadm5_setup_entry(), will need this */
+	princ->kvno = 1;
+	mask |= KADM5_KVNO;
+    }
+
     ret = create_principal(context, princ, mask, &ent,
 			   KADM5_PRINCIPAL | KADM5_KEY_DATA,
 			   KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME
@@ -120,26 +126,37 @@ kadm5_s_create_principal_with_key(void *server_handle,
 			   | KADM5_AUX_ATTRIBUTES
 			   | KADM5_POLICY_CLR | KADM5_LAST_SUCCESS
 			   | KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT);
-    if(ret)
-	goto out;
+    if (ret)
+        return ret;
 
-    if ((mask & KADM5_KVNO) == 0)
-	ent.entry.kvno = 1;
+    if (!context->keep_open) {
+        ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+        if (ret) {
+            hdb_free_entry(context->context, &ent);
+            return ret;
+        }
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
 
     ret = hdb_seal_keys(context->context, context->db, &ent.entry);
     if (ret)
-	goto out;
+	goto out2;
 
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	goto out;
-    ret = context->db->hdb_store(context->context, context->db, 0, &ent);
-    context->db->hdb_close(context->context, context->db);
-    if (ret)
-	goto out;
-    kadm5_log_create (context, &ent.entry);
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_create(context, &ent.entry);
 
-out:
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     hdb_free_entry(context->context, &ent);
     return _kadm5_error_code(ret);
 }
@@ -149,12 +166,20 @@ kadm5_ret_t
 kadm5_s_create_principal(void *server_handle,
 			 kadm5_principal_ent_t princ,
 			 uint32_t mask,
+			 int n_ks_tuple,
+			 krb5_key_salt_tuple *ks_tuple,
 			 const char *password)
 {
     kadm5_ret_t ret;
     hdb_entry_ex ent;
     kadm5_server_context *context = server_handle;
 
+    if ((mask & KADM5_KVNO) == 0) {
+	/* create_principal() through _kadm5_setup_entry(), will need this */
+	princ->kvno = 1;
+	mask |= KADM5_KVNO;
+    }
+
     ret = create_principal(context, princ, mask, &ent,
 			   KADM5_PRINCIPAL,
 			   KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME
@@ -162,34 +187,44 @@ kadm5_s_create_principal(void *server_handle,
 			   | KADM5_AUX_ATTRIBUTES | KADM5_KEY_DATA
 			   | KADM5_POLICY_CLR | KADM5_LAST_SUCCESS
 			   | KADM5_LAST_FAILED | KADM5_FAIL_AUTH_COUNT);
-    if(ret)
-	goto out;
+    if (ret)
+        return ret;
 
-    if ((mask & KADM5_KVNO) == 0)
-	ent.entry.kvno = 1;
+    if (!context->keep_open) {
+        ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+        if (ret) {
+            hdb_free_entry(context->context, &ent);
+            return ret;
+        }
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
 
     ent.entry.keys.len = 0;
     ent.entry.keys.val = NULL;
 
-    ret = _kadm5_set_keys(context, &ent.entry, password);
+    ret = _kadm5_set_keys(context, &ent.entry, n_ks_tuple, ks_tuple, password);
     if (ret)
-	goto out;
+	goto out2;
 
     ret = hdb_seal_keys(context->context, context->db, &ent.entry);
     if (ret)
-	goto out;
+	goto out2;
 
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	goto out;
-    ret = context->db->hdb_store(context->context, context->db, 0, &ent);
-    context->db->hdb_close(context->context, context->db);
-    if (ret)
-	goto out;
-
-    kadm5_log_create (context, &ent.entry);
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_create(context, &ent.entry);
 
+ out2:
+    (void) kadm5_log_end(context);
  out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     hdb_free_entry(context->context, &ent);
     return _kadm5_error_code(ret);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/default_keys.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/default_keys.c
index c48bddb01..b0b2f8aff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/default_keys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/default_keys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: default_keys.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: default_keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "kadm5_locl.h"
 #include <err.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: default_keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static void
 print_keys(krb5_context context, Key *keys, size_t nkeys)
@@ -87,7 +87,8 @@ parse_file(krb5_context context, krb5_principal principal, int no_salt)
     size_t nkeys;
     Key *keys;
 
-    ret = hdb_generate_key_set(context, principal, &keys, &nkeys, no_salt);
+    ret = hdb_generate_key_set(context, principal, NULL, 0, &keys, &nkeys,
+			       no_salt);
     if (ret)
 	krb5_err(context, 1, ret, "hdb_generate_key_set");
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_c.c
index f82a6e456..983409d9a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: delete_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: delete_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: delete_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_delete_principal(void *server_handle, krb5_principal princ)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_s.c
index 9b7aa0ee9..e0ab00a33 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/delete_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: delete_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: delete_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003, 2005 - 2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: delete_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_s_delete_principal(void *server_handle, krb5_principal princ)
@@ -45,33 +45,44 @@ kadm5_s_delete_principal(void *server_handle, krb5_principal princ)
     hdb_entry_ex ent;
 
     memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret) {
-	krb5_warn(context->context, ret, "opening database");
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret) {
+	    krb5_warn(context->context, ret, "opening database");
+	    return ret;
+	}
     }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
 				      HDB_F_DECRYPT|HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
-    if(ret == HDB_ERR_NOENTRY)
-	goto out;
-    if(ent.entry.flags.immutable) {
-	ret = KADM5_PROTECT_PRINCIPAL;
+    if (ret == HDB_ERR_NOENTRY)
 	goto out2;
+    if (ent.entry.flags.immutable) {
+	ret = KADM5_PROTECT_PRINCIPAL;
+	goto out3;
     }
 
     ret = hdb_seal_keys(context->context, context->db, &ent.entry);
     if (ret)
-	goto out2;
+	goto out3;
 
-    ret = context->db->hdb_remove(context->context, context->db, princ);
-    if (ret)
-	goto out2;
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_delete(context, princ);
 
-    kadm5_log_delete (context, princ);
-
-out2:
+ out3:
     hdb_free_entry(context->context, &ent);
-out:
-    context->db->hdb_close(context->context, context->db);
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_c.c
index fdc7e2307..b8db1b9e8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: destroy_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: destroy_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: destroy_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_destroy(void *server_handle)
@@ -44,7 +44,7 @@ kadm5_c_destroy(void *server_handle)
 
     free(context->realm);
     free(context->admin_server);
-    close(context->sock);
+    rk_closesocket(context->sock);
     if (context->client_name)
 	free(context->client_name);
     if (context->service_name)
@@ -53,5 +53,6 @@ kadm5_c_destroy(void *server_handle)
 	krb5_auth_con_free(context->context, context->ac);
     if(context->my_context)
 	krb5_free_context(context->context);
+    free(context);
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_s.c
index ee1740154..aad71440f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/destroy_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: destroy_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: destroy_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: destroy_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
  * dealloc a `kadm5_config_params'
@@ -57,8 +57,9 @@ destroy_config (kadm5_config_params *c)
 static void
 destroy_kadm5_log_context (kadm5_log_context *c)
 {
-    free (c->log_file);
-    rk_closesocket (c->socket_fd);
+    free(c->log_file);
+    if (c->socket_fd != rk_INVALID_SOCKET)
+        rk_closesocket(c->socket_fd);
 #ifdef NO_UNIX_SOCKETS
     if (c->socket_info) {
 	freeaddrinfo(c->socket_info);
@@ -74,16 +75,18 @@ destroy_kadm5_log_context (kadm5_log_context *c)
 kadm5_ret_t
 kadm5_s_destroy(void *server_handle)
 {
-    kadm5_ret_t ret;
+    kadm5_ret_t ret = 0;
     kadm5_server_context *context = server_handle;
     krb5_context kcontext = context->context;
 
-    ret = context->db->hdb_destroy(kcontext, context->db);
-    destroy_kadm5_log_context (&context->log_context);
-    destroy_config (&context->config);
-    krb5_free_principal (kcontext, context->caller);
-    if(context->my_context)
+    if (context->db != NULL)
+        ret = context->db->hdb_destroy(kcontext, context->db);
+    destroy_kadm5_log_context(&context->log_context);
+    destroy_config(&context->config);
+    krb5_free_principal(kcontext, context->caller);
+    if (context->my_context)
 	krb5_free_context(kcontext);
-    free (context);
+    free(context);
+
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/ent_setup.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/ent_setup.c
index 50d35fbc6..5dee18a93 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/ent_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/ent_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ent_setup.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ent_setup.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: ent_setup.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 #define set_value(X, V) do { if((X) == NULL) (X) = malloc(sizeof(*(X))); *(X) = V; } while(0)
 #define set_null(X)     do { if((X) != NULL) free((X)); (X) = NULL; } while (0)
@@ -53,6 +53,7 @@ attr_to_flags(unsigned attr, HDBFlags *flags)
     /* DUP_SKEY */
     flags->invalid =	       !!(attr & KRB5_KDB_DISALLOW_ALL_TIX);
     flags->require_preauth =   !!(attr & KRB5_KDB_REQUIRES_PRE_AUTH);
+    flags->require_pwchange =  !!(attr & KRB5_KDB_REQUIRES_PWCHANGE);
     /* HW_AUTH */
     flags->server =		!(attr & KRB5_KDB_DISALLOW_SVR);
     flags->change_pw = 	       !!(attr & KRB5_KDB_PWCHANGE_SERVICE);
@@ -180,8 +181,14 @@ _kadm5_setup_entry(kadm5_server_context *context,
 	}
     }
     if(mask & KADM5_KVNO
-       && princ_mask & KADM5_KVNO)
-	ent->entry.kvno = princ->kvno;
+       && (princ_mask & KADM5_KVNO)) {
+	krb5_error_code ret;
+
+	ret = hdb_change_kvno(context->context, princ->kvno, &ent->entry);
+	if (ret && ret != HDB_ERR_KVNO_NOT_FOUND)
+	    return ret;
+	ent->entry.kvno = princ->kvno; /* force it */
+    }
     if(mask & KADM5_MAX_RLIFE) {
 	if(princ_mask & KADM5_MAX_RLIFE) {
 	  if(princ->max_renewable_life)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/error.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/error.c
index f5d6105f2..b47084f17 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: error.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: error.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: error.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 _kadm5_error_code(kadm5_ret_t code)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush.c
index ecc093811..37cf49b12 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: flush.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: flush.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: flush.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_s_flush(void *server_handle)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_c.c
index 456e50361..b1535385d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: flush_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: flush_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: flush_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_flush(void *server_handle)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_s.c
index 92ae7f50a..c99c5c5e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/flush_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: flush_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: flush_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -34,7 +34,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: flush_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_s_flush(void *server_handle)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/free.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/free.c
index a888a6294..553ee75fd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/free.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/free.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: free.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: free.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: free.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 void
 kadm5_free_key_data(void *server_handle,
@@ -62,12 +62,13 @@ kadm5_free_principal_ent(void *server_handle,
 			 kadm5_principal_ent_t princ)
 {
     kadm5_server_context *context = server_handle;
-    if(princ->principal)
+
+    if (princ->principal)
 	krb5_free_principal(context->context, princ->principal);
-    if(princ->mod_name)
+    if (princ->mod_name)
 	krb5_free_principal(context->context, princ->mod_name);
     kadm5_free_key_data(server_handle, &princ->n_key_data, princ->key_data);
-    while(princ->n_tl_data && princ->tl_data) {
+    while (princ->n_tl_data && princ->tl_data) {
 	krb5_tl_data *tp;
 	tp = princ->tl_data;
 	princ->tl_data = tp->tl_data_next;
@@ -76,8 +77,8 @@ kadm5_free_principal_ent(void *server_handle,
 	free(tp->tl_data_contents);
 	free(tp);
     }
-    if (princ->key_data != NULL)
-	free (princ->key_data);
+    free(princ->key_data);
+    free(princ->policy);
 }
 
 void
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_c.c
index 86d19d319..7783a47aa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: get_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000, 2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: get_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_get_principal(void *server_handle,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_c.c
index f206a3541..f991d3e6a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_princs_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: get_princs_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: get_princs_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_get_principals(void *server_handle,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_s.c
index 312c2f738..91e5737ca 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_princs_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_princs_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: get_princs_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: get_princs_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 struct foreach_data {
     const char *exp;
@@ -87,29 +87,41 @@ kadm5_s_get_principals(void *server_handle,
     struct foreach_data d;
     kadm5_server_context *context = server_handle;
     kadm5_ret_t ret;
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret) {
-	krb5_warn(context->context, ret, "opening database");
-	return ret;
+
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDONLY, 0);
+	if (ret) {
+	    krb5_warn(context->context, ret, "opening database");
+	    return ret;
+	}
     }
     d.exp = expression;
     {
 	krb5_realm r;
+	int aret;
+
 	krb5_get_default_realm(context->context, &r);
-	asprintf(&d.exp2, "%s@%s", expression, r);
+	aret = asprintf(&d.exp2, "%s@%s", expression, r);
 	free(r);
+	if (aret == -1 || d.exp2 == NULL) {
+	    ret = ENOMEM;
+            goto out;
+	}
     }
     d.princs = NULL;
     d.count = 0;
     ret = hdb_foreach(context->context, context->db, HDB_F_ADMIN_DATA, foreach, &d);
-    context->db->hdb_close(context->context, context->db);
-    if(ret == 0)
+
+    if (ret == 0)
 	ret = add_princ(&d, NULL);
-    if(ret == 0){
+    if (ret == 0){
 	*princs = d.princs;
 	*count = d.count - 1;
-    }else
+    } else
 	kadm5_free_name_list(context, d.princs, &d.count);
     free(d.exp2);
+ out:
+    if (!context->keep_open)
+	context->db->hdb_close(context->context, context->db);
     return _kadm5_error_code(ret);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_s.c
index 39421a735..f528c4dd0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/get_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/get_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: get_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -33,9 +33,11 @@
  * SUCH DAMAGE.
  */
 
+#include <krb5_locl.h>
 #include "kadm5_locl.h"
+#include <assert.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: get_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static kadm5_ret_t
 add_tl_data(kadm5_principal_ent_t ent, int16_t type,
@@ -63,8 +65,56 @@ add_tl_data(kadm5_principal_ent_t ent, int16_t type,
     return 0;
 }
 
-KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
-_krb5_put_int(void *buffer, unsigned long value, size_t size); /* XXX */
+static
+krb5_error_code
+copy_keyset_to_kadm5(kadm5_server_context *context, krb5_kvno kvno,
+		     size_t n_keys, Key *keys, krb5_salt *salt,
+		     kadm5_principal_ent_t out)
+{
+    size_t i;
+    Key *key;
+    krb5_key_data *kd;
+    krb5_data *sp;
+    krb5_error_code ret = 0;
+
+    for (i = 0; i < n_keys; i++) {
+	key = &keys[i];
+	kd = &out->key_data[out->n_key_data];
+	kd->key_data_ver = 2;
+	kd->key_data_kvno = kvno;
+	kd->key_data_type[0] = key->key.keytype;
+	if(key->salt)
+	    kd->key_data_type[1] = key->salt->type;
+	else
+	    kd->key_data_type[1] = KRB5_PADATA_PW_SALT;
+	/* setup key */
+	kd->key_data_length[0] = key->key.keyvalue.length;
+	kd->key_data_contents[0] = malloc(kd->key_data_length[0]);
+	if(kd->key_data_contents[0] == NULL && kd->key_data_length[0] != 0){
+	    ret = ENOMEM;
+	    break;
+	}
+	memcpy(kd->key_data_contents[0], key->key.keyvalue.data,
+	       kd->key_data_length[0]);
+	/* setup salt */
+	if(key->salt)
+	    sp = &key->salt->salt;
+	else
+	    sp = &salt->saltvalue;
+	kd->key_data_length[1] = sp->length;
+	kd->key_data_contents[1] = malloc(kd->key_data_length[1]);
+	if(kd->key_data_length[1] != 0
+	   && kd->key_data_contents[1] == NULL) {
+	    memset(kd->key_data_contents[0], 0, kd->key_data_length[0]);
+	    ret = ENOMEM;
+	    break;
+	}
+	memcpy(kd->key_data_contents[1], sp->data, kd->key_data_length[1]);
+	out->n_key_data++;
+    }
+
+    return ret;
+}
 
 kadm5_ret_t
 kadm5_s_get_principal(void *server_handle,
@@ -75,18 +125,41 @@ kadm5_s_get_principal(void *server_handle,
     kadm5_server_context *context = server_handle;
     kadm5_ret_t ret;
     hdb_entry_ex ent;
+    int hdb_is_rw = 1;
 
     memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDONLY, 0);
-    if(ret)
-	return ret;
+    memset(out, 0, sizeof(*out));
+
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+        if (ret == EPERM || ret == EACCES) {
+            ret = context->db->hdb_open(context->context, context->db, O_RDONLY, 0);
+            hdb_is_rw = 0;
+        }
+	if (ret)
+	    return ret;
+    }
+
+    /*
+     * Attempt to recover the log.  This will generally fail on slaves,
+     * and we can't tell if we're on a slave here.
+     *
+     * Perhaps we could set a flag in the kadm5_server_context to
+     * indicate whether a read has been done without recovering the log,
+     * in which case we could fail any subsequent writes.
+     */
+    if (hdb_is_rw && kadm5_log_init_nb(context) == 0)
+        (void) kadm5_log_end(context);
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
-				      HDB_F_DECRYPT|HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
-    context->db->hdb_close(context->context, context->db);
+				      HDB_F_DECRYPT|HDB_F_ALL_KVNOS|
+				      HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
+
+    if (!context->keep_open)
+	context->db->hdb_close(context->context, context->db);
     if(ret)
 	return _kadm5_error_code(ret);
 
-    memset(out, 0, sizeof(*out));
     if(mask & KADM5_PRINCIPAL)
 	ret  = krb5_copy_principal(context->context, ent.entry.principal,
 				   &out->principal);
@@ -106,6 +179,7 @@ kadm5_s_get_principal(void *server_handle,
 	out->attributes |= ent.entry.flags.proxiable ? 0 : KRB5_KDB_DISALLOW_PROXIABLE;
 	out->attributes |= ent.entry.flags.invalid ? KRB5_KDB_DISALLOW_ALL_TIX : 0;
 	out->attributes |= ent.entry.flags.require_preauth ? KRB5_KDB_REQUIRES_PRE_AUTH : 0;
+	out->attributes |= ent.entry.flags.require_pwchange ? KRB5_KDB_REQUIRES_PWCHANGE : 0;
 	out->attributes |= ent.entry.flags.server ? 0 : KRB5_KDB_DISALLOW_SVR;
 	out->attributes |= ent.entry.flags.change_pw ? KRB5_KDB_PWCHANGE_SERVICE : 0;
 	out->attributes |= ent.entry.flags.ok_as_delegate ? KRB5_KDB_OK_AS_DELEGATE : 0;
@@ -162,8 +236,21 @@ kadm5_s_get_principal(void *server_handle,
     if(mask & KADM5_FAIL_AUTH_COUNT)
 	;
 #endif
-    if(mask & KADM5_POLICY)
-	out->policy = NULL;
+    if(mask & KADM5_POLICY) {
+	HDB_extension *ext;
+
+	ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_policy);
+	if (ext == NULL) {
+	    out->policy = strdup("default");
+	    /* It's OK if we retun NULL instead of "default" */
+	} else {
+	    out->policy = strdup(ext->data.u.policy);
+	    if (out->policy == NULL) {
+		ret = ENOMEM;
+		goto out;
+	    }
+	}
+    }
     if(mask & KADM5_MAX_RLIFE) {
 	if(ent.entry.max_renew)
 	    out->max_renewable_life = *ent.entry.max_renew;
@@ -172,57 +259,45 @@ kadm5_s_get_principal(void *server_handle,
     }
     if(mask & KADM5_KEY_DATA){
 	size_t i;
-	Key *key;
-	krb5_key_data *kd;
+	size_t n_keys = ent.entry.keys.len;
 	krb5_salt salt;
-	krb5_data *sp;
+	HDB_extension *ext;
+	HDB_Ext_KeySet *hist_keys = NULL;
+
+	/* Don't return stale keys to kadm5 clients */
+	ret = hdb_prune_keys(context->context, &ent.entry);
+	if (ret)
+	    goto out;
+	ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_hist_keys);
+	if (ext != NULL)
+	    hist_keys = &ext->data.u.hist_keys;
+
 	krb5_get_pw_salt(context->context, ent.entry.principal, &salt);
-	out->key_data = malloc(ent.entry.keys.len * sizeof(*out->key_data));
-	if (out->key_data == NULL && ent.entry.keys.len != 0) {
+	for (i = 0; hist_keys != NULL && i < hist_keys->len; i++)
+	    n_keys += hist_keys->val[i].keys.len;
+	out->key_data = malloc(n_keys * sizeof(*out->key_data));
+	if (out->key_data == NULL && n_keys != 0) {
 	    ret = ENOMEM;
 	    goto out;
 	}
-	for(i = 0; i < ent.entry.keys.len; i++){
-	    key = &ent.entry.keys.val[i];
-	    kd = &out->key_data[i];
-	    kd->key_data_ver = 2;
-	    kd->key_data_kvno = ent.entry.kvno;
-	    kd->key_data_type[0] = key->key.keytype;
-	    if(key->salt)
-		kd->key_data_type[1] = key->salt->type;
-	    else
-		kd->key_data_type[1] = KRB5_PADATA_PW_SALT;
-	    /* setup key */
-	    kd->key_data_length[0] = key->key.keyvalue.length;
-	    kd->key_data_contents[0] = malloc(kd->key_data_length[0]);
-	    if(kd->key_data_contents[0] == NULL && kd->key_data_length[0] != 0){
-		ret = ENOMEM;
-		break;
-	    }
-	    memcpy(kd->key_data_contents[0], key->key.keyvalue.data,
-		   kd->key_data_length[0]);
-	    /* setup salt */
-	    if(key->salt)
-		sp = &key->salt->salt;
-	    else
-		sp = &salt.saltvalue;
-	    kd->key_data_length[1] = sp->length;
-	    kd->key_data_contents[1] = malloc(kd->key_data_length[1]);
-	    if(kd->key_data_length[1] != 0
-	       && kd->key_data_contents[1] == NULL) {
-		memset(kd->key_data_contents[0], 0, kd->key_data_length[0]);
-		ret = ENOMEM;
-		break;
-	    }
-	    memcpy(kd->key_data_contents[1], sp->data, kd->key_data_length[1]);
-	    out->n_key_data = i + 1;
+	out->n_key_data = 0;
+	ret = copy_keyset_to_kadm5(context, ent.entry.kvno, ent.entry.keys.len,
+				   ent.entry.keys.val, &salt, out);
+	if (ret)
+	    goto out;
+	for (i = 0; hist_keys != NULL && i < hist_keys->len; i++) {
+	    ret = copy_keyset_to_kadm5(context, hist_keys->val[i].kvno,
+				       hist_keys->val[i].keys.len,
+				       hist_keys->val[i].keys.val,
+				       &salt, out);
+	    if (ret)
+		goto out;
 	}
 	krb5_free_salt(context->context, salt);
+	assert( out->n_key_data == n_keys );
     }
-    if(ret){
-	kadm5_free_principal_ent(context, out);
+    if (ret)
 	goto out;
-    }
     if(mask & KADM5_TL_DATA) {
 	time_t last_pw_expire;
 	const HDB_Ext_PKINIT_acl *acl;
@@ -234,15 +309,13 @@ kadm5_s_get_principal(void *server_handle,
 	    _krb5_put_int(buf, last_pw_expire, sizeof(buf));
 	    ret = add_tl_data(out, KRB5_TL_LAST_PWD_CHANGE, buf, sizeof(buf));
 	}
-	if(ret){
-	    kadm5_free_principal_ent(context, out);
+	if (ret)
 	    goto out;
-	}
 	/*
 	 * If the client was allowed to get key data, let it have the
 	 * password too.
 	 */
-	if(mask & KADM5_KEY_DATA) {
+	if (mask & KADM5_KEY_DATA) {
 	    heim_utf8_string pw;
 
 	    ret = hdb_entry_get_password(context->context,
@@ -261,24 +334,18 @@ kadm5_s_get_principal(void *server_handle,
 
 	    ASN1_MALLOC_ENCODE(HDB_Ext_PKINIT_acl, buf.data, buf.length,
 				acl, &len, ret);
-	    if (ret) {
-		kadm5_free_principal_ent(context, out);
+	    if (ret)
 		goto out;
-	    }
 	    if (len != buf.length)
 		krb5_abortx(context->context,
 			    "internal ASN.1 encoder error");
 	    ret = add_tl_data(out, KRB5_TL_PKINIT_ACL, buf.data, buf.length);
 	    free(buf.data);
-	    if (ret) {
-		kadm5_free_principal_ent(context, out);
+	    if (ret)
 		goto out;
-	    }
 	}
-	if(ret){
-	    kadm5_free_principal_ent(context, out);
+	if (ret)
 	    goto out;
-	}
 
 	ret = hdb_entry_get_aliases(&ent.entry, &aliases);
 	if (ret == 0 && aliases) {
@@ -287,27 +354,23 @@ kadm5_s_get_principal(void *server_handle,
 
 	    ASN1_MALLOC_ENCODE(HDB_Ext_Aliases, buf.data, buf.length,
 			       aliases, &len, ret);
-	    if (ret) {
-		kadm5_free_principal_ent(context, out);
+	    if (ret)
 		goto out;
-	    }
 	    if (len != buf.length)
 		krb5_abortx(context->context,
 			    "internal ASN.1 encoder error");
 	    ret = add_tl_data(out, KRB5_TL_ALIASES, buf.data, buf.length);
 	    free(buf.data);
-	    if (ret) {
-		kadm5_free_principal_ent(context, out);
+	    if (ret)
 		goto out;
-	    }
 	}
-	if(ret){
-	    kadm5_free_principal_ent(context, out);
+	if (ret)
 	    goto out;
-	}
-
     }
-out:
+
+ out:
+    if (ret)
+        kadm5_free_principal_ent(context, out);
     hdb_free_entry(context->context, &ent);
 
     return _kadm5_error_code(ret);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/init_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/init_c.c
index 66e539455..d5652d297 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/init_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/init_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_c.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: init_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -45,12 +45,25 @@
 #include <netdb.h>
 #endif
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: init_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
+
+static kadm5_ret_t
+kadm5_c_lock(void *server_handle)
+{
+    return ENOTSUP;
+}
+
+static kadm5_ret_t
+kadm5_c_unlock(void *server_handle)
+{
+    return ENOTSUP;
+}
 
 static void
 set_funcs(kadm5_client_context *c)
 {
 #define SET(C, F) (C)->funcs.F = kadm5 ## _c_ ## F
+#define SETNOTIMP(C, F) (C)->funcs.F = 0
     SET(c, chpass_principal);
     SET(c, chpass_principal_with_key);
     SET(c, create_principal);
@@ -63,6 +76,9 @@ set_funcs(kadm5_client_context *c)
     SET(c, modify_principal);
     SET(c, randkey_principal);
     SET(c, rename_principal);
+    SET(c, lock);
+    SET(c, unlock);
+    SETNOTIMP(c, setkey_principal_3);
 }
 
 kadm5_ret_t
@@ -467,11 +483,12 @@ kadm_connect(kadm5_client_context *ctx)
     }
 
     if (ctx->realm)
-	asprintf(&service_name, "%s@%s", KADM5_ADMIN_SERVICE, ctx->realm);
+	error = asprintf(&service_name, "%s@%s", KADM5_ADMIN_SERVICE,
+			 ctx->realm);
     else
-	asprintf(&service_name, "%s", KADM5_ADMIN_SERVICE);
+	error = asprintf(&service_name, "%s", KADM5_ADMIN_SERVICE);
 
-    if (service_name == NULL) {
+    if (error == -1 || service_name == NULL) {
 	freeaddrinfo (ai);
 	rk_closesocket(s);
 	krb5_clear_error_message(context);
@@ -573,16 +590,18 @@ kadm5_c_init_with_context(krb5_context context,
     krb5_ccache cc;
 
     ret = _kadm5_c_init_context(&ctx, realm_params, context);
-    if(ret)
+    if (ret)
 	return ret;
 
-    if(password != NULL && *password != '\0') {
+    if (password != NULL && *password != '\0') {
 	ret = _kadm5_c_get_cred_cache(context,
 				      client_name,
 				      service_name,
 				      password, prompter, keytab, ccache, &cc);
-	if(ret)
-	    return ret; /* XXX */
+	if (ret) {
+            kadm5_c_destroy(ctx);
+	    return ret;
+        }
 	ccache = cc;
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/init_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/init_s.c
index ad3463501..917553426 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/init_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/init_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_s.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: init_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -34,8 +34,7 @@
  */
 
 #include "kadm5_locl.h"
-
-__RCSID("NetBSD");
+#include <fcntl.h>
 
 
 static kadm5_ret_t
@@ -49,12 +48,26 @@ kadm5_s_init_with_context(krb5_context context,
 {
     kadm5_ret_t ret;
     kadm5_server_context *ctx;
+    char *dbname;
+    char *stash_file;
+
+    *server_handle = NULL;
     ret = _kadm5_s_init_context(&ctx, realm_params, context);
-    if(ret)
+    if (ret)
 	return ret;
 
-    assert(ctx->config.dbname != NULL);
-    assert(ctx->config.stash_file != NULL);
+    if (realm_params->mask & KADM5_CONFIG_DBNAME)
+	dbname = realm_params->dbname;
+    else
+	dbname = ctx->config.dbname;
+
+    if (realm_params->mask & KADM5_CONFIG_STASH_FILE)
+	stash_file = realm_params->stash_file;
+    else
+	stash_file = ctx->config.stash_file;
+
+    assert(dbname != NULL);
+    assert(stash_file != NULL);
     assert(ctx->config.acl_file != NULL);
     assert(ctx->log_context.log_file != NULL);
 #ifndef NO_UNIX_SOCKETS
@@ -63,33 +76,35 @@ kadm5_s_init_with_context(krb5_context context,
     assert(ctx->log_context.socket_info != NULL);
 #endif
 
-    ret = hdb_create(ctx->context, &ctx->db, ctx->config.dbname);
-    if(ret)
-	return ret;
-    ret = hdb_set_master_keyfile (ctx->context,
-				  ctx->db, ctx->config.stash_file);
-    if(ret)
+    ret = hdb_create(ctx->context, &ctx->db, dbname);
+    if (ret == 0)
+        ret = hdb_set_master_keyfile(ctx->context,
+                                     ctx->db, stash_file);
+    if (ret) {
+        kadm5_s_destroy(ctx);
 	return ret;
+    }
 
-    ctx->log_context.log_fd   = -1;
+    ctx->log_context.log_fd = -1;
 
 #ifndef NO_UNIX_SOCKETS
-    ctx->log_context.socket_fd = socket (AF_UNIX, SOCK_DGRAM, 0);
+    ctx->log_context.socket_fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 #else
-    ctx->log_context.socket_fd = socket (ctx->log_context.socket_info->ai_family,
-					 ctx->log_context.socket_info->ai_socktype,
-					 ctx->log_context.socket_info->ai_protocol);
+    ctx->log_context.socket_fd = socket(ctx->log_context.socket_info->ai_family,
+					ctx->log_context.socket_info->ai_socktype,
+					ctx->log_context.socket_info->ai_protocol);
 #endif
 
+    if (ctx->log_context.socket_fd != rk_INVALID_SOCKET)
+        socket_set_nonblocking(ctx->log_context.socket_fd, 1);
+
     ret = krb5_parse_name(ctx->context, client_name, &ctx->caller);
-    if(ret)
-	return ret;
-
-    ret = _kadm5_acl_init(ctx);
-    if(ret)
-	return ret;
-
-    *server_handle = ctx;
+    if (ret == 0)
+        ret = _kadm5_acl_init(ctx);
+    if (ret)
+        kadm5_s_destroy(ctx);
+    else
+        *server_handle = ctx;
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-commands.in b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-commands.in
index 5d485ec14..8057d6c5a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-commands.in
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-commands.in
@@ -41,6 +41,18 @@ command = {
 		help = "configuration file"
 		argument = "file"
 	}
+	option = {
+		long = "no-lock"
+		short = "n"
+		type = "flag"
+		help = "don't lock iprop log"
+	}
+	option = {
+		long = "reverse"
+		short = "R"
+		type = "flag"
+		help = "dump the log in reverse order"
+	}
 	option = {
 		long = "realm"
 		short = "r"
@@ -49,7 +61,7 @@ command = {
 	}
 	function = "iprop_dump"
 	help = "Prints the iprop transaction log in text."
-	max_args = "0"
+	max_args = "1"
 }
 command = {
 	name = "truncate"
@@ -66,9 +78,30 @@ command = {
 		type = "string"
 		help = "realm"
 	}
+	option = {
+		long = "keep-entries"
+		short = "K"
+		type = "integer"
+		help = "number of entries to keep"
+                default = "-1"
+	}
+	option = {
+		long = "max-bytes"
+		short = "B"
+		type = "integer"
+		help = "keep entries that fit in the given number of bytes"
+                default = "-1"
+	}
+        option = {
+                long = "reset"
+                short = "R"
+                type = "flag"
+                help = "reset the log to version 1; forces full propagation"
+                default = "0";
+        }
 	function = "iprop_truncate"
-	help = "Truncate the log, preserve the version number."
-	max_args = "0"
+	help = "Truncate the log, preserve the version number.  Keeps 100 entries by default."
+	max_args = "1"
 }
 command = {
 	name = "replay"
@@ -101,7 +134,7 @@ command = {
 	}
 	function = "iprop_replay"
 	help = "Replay the log on the database."
-	max_args = "0"
+	max_args = "1"
 }
 command = {
 	name = "last-version"
@@ -112,13 +145,37 @@ command = {
 		help = "configuration file"
 		argument = "file"
 	}
+	option = {
+		long = "no-lock"
+		short = "n"
+		type = "flag"
+		help = "don't lock iprop log"
+	}
+	option = {
+		long = "realm"
+		short = "r"
+		type = "string"
+		help = "realm"
+	}
+	function = "last_version"
+	help = "Print the last version of the log-file."
+}
+command = {
+	name = "signal"
+	option = {
+		long = "config-file"
+		short = "c"
+		type = "string"
+		help = "configuration file"
+		argument = "file"
+	}
 	option = {
 		long = "realm"
 		short = "r"
 		type = "string"
 		help = "realm"
 	}
-	function = "last_version"
+	function = "signal_master"
 	help = "Print the last version of the log-file."
 	max_args = "0"
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.8 b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.8
index 63f6820ca..e6a776e09 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.8
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: iprop-log.8,v 1.5 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: iprop-log.8,v 1.6 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Id
 .\"
@@ -40,7 +40,7 @@
 .Os
 .Sh NAME
 .Nm iprop-log
-.Nd maintain the iprop log file
+.Nd examine and maintain the iprop log file
 .Sh SYNOPSIS
 .Nm
 .Op Fl Fl version
@@ -56,7 +56,20 @@
 .Fl Fl realm= Ns Ar string
 .Xc
 .Oc
+.Oo Fl K Ar integer \*(Ba Xo
+.Fl Fl keep-entries= Ns Ar integer
+.Xc
+.Oc
+.Oo Fl B Ar integer \*(Ba Xo
+.Fl Fl max-bytes= Ns Ar integer
+.Xc
+.Oc
+.Oo Fl R \*(Ba Xo
+.Fl Fl reset
+.Xc
+.Oc
 .Op Fl h | Fl Fl help
+.Op Ar log-file
 .Pp
 .Nm iprop-log dump
 .Oo Fl c Ar file \*(Ba Xo
@@ -67,7 +80,16 @@
 .Fl Fl realm= Ns Ar string
 .Xc
 .Oc
+.Oo Fl n \*(Ba Xo
+.Fl Fl no-lock
+.Xc
+.Oc
+.Oo Fl R \*(Ba Xo
+.Fl Fl reverse
+.Xc
+.Oc
 .Op Fl h | Fl Fl help
+.Op Ar log-file
 .Pp
 .Nm iprop-log replay
 .Op Fl Fl start-version= Ns Ar version-number
@@ -81,6 +103,35 @@
 .Xc
 .Oc
 .Op Fl h | Fl Fl help
+.Op Ar log-file
+.Pp
+.Nm iprop-log last-version
+.Oo Fl c Ar file \*(Ba Xo
+.Fl Fl config-file= Ns Ar file
+.Xc
+.Oc
+.Oo Fl r Ar string \*(Ba Xo
+.Fl Fl realm= Ns Ar string
+.Xc
+.Oc
+.Oo Fl n \*(Ba Xo
+.Fl Fl no-lock
+.Xc
+.Oc
+.Op Fl h | Fl Fl help
+.Op Ar log-files
+.Pp
+.Nm iprop-log signal
+.Oo Fl c Ar file \*(Ba Xo
+.Fl Fl config-file= Ns Ar file
+.Xc
+.Oc
+.Oo Fl r Ar string \*(Ba Xo
+.Fl Fl realm= Ns Ar string
+.Xc
+.Oc
+.Op Fl h | Fl Fl help
+.Pp
 .Sh DESCRIPTION
 Supported options:
 .Bl -tag -width Ds
@@ -96,11 +147,42 @@ command can be one of the following:
 configuration file
 .It Fl r Ar string , Fl Fl realm= Ns Ar string
 realm
+.It Xo
+.Fl K Ar integer ,
+.Fl Fl keep-entries= Ns Ar integer
+.Xc
+.It Xo
+.Fl B Ar integer ,
+.Fl Fl max-bytes= Ns Ar integer
+.Xc
+.It Xo
+.Fl R ,
+.Fl Fl reset
+.Xc
 .El
 .Pp
-Truncates the log. Sets the new logs version number for the to the
-last entry of the old log.  If the log is truncted by emptying the
-file, the log will start over at the first version (0).
+If
+.Fl Fl reset
+is given, then the given, configured, or default log file will be
+truncated and will start at version 1.  This forces full propagations to
+all slave KDCs.
+.Pp
+Otherwise the log will be truncated but some entries will be preserved,
+as specified by the
+.Fl Fl keep-entries
+and/or
+.Fl Fl max-bytes
+options.  The largest number of
+.Fl Fl keep-entries
+entries that are available and fit in the given
+.Fl Fl max-bytes
+option will be used.  The
+.Fl Fl keep-entries option defaults to 100, and the
+.Fl Fl max-bytes
+option defaults to the
+.Ar log-max-size
+parameter in the configuration.
+.Pp
 .It dump
 .Bl -tag -width Ds
 .It Fl c Ar file , Fl Fl config-file= Ns Ar file
@@ -110,9 +192,23 @@ configuration file
 .Fl Fl realm= Ns Ar string
 .Xc
 realm
+.It Xo
+.Fl n Ar string ,
+.Fl Fl no-lock
+.Xc
+.It Xo
+.Fl R Ar string ,
+.Fl Fl reverse
+.Xc
 .El
 .Pp
-Print out all entries in the log to standard output.
+Print out all entries in the given, configured, or default log file to
+standard output.  If the
+.Fl n
+option is used then don't lock the iprop log file.  If the
+.Fl R
+option is used, then print the entries in reverse order
+(this can be useful when the log is very large).
 .It replay
 .Bl -tag -width Ds
 .It Fl Fl start-version= Ns Ar version-number
@@ -127,17 +223,34 @@ configuration file
 realm
 .El
 .Pp
-Replay the changes from specified entries (or all if none is
-specified) in the transaction log to the database.
+Replay the changes from specified entries (or all if none is specified)
+in the given, configured, or default transaction log file to the
+database.
 .It last-version
 .Bl -tag -width Ds
 .It Fl c Ar file , Fl Fl config-file= Ns Ar file
 configuration file
 .It Fl r Ar string , Fl Fl realm= Ns Ar string
 realm
+.It Xo
+.Fl n Ar string ,
+.Fl Fl no-lock
+.Xc
+.El
+.Pp
+prints the version of the last record in each of the given log files, or
+the configured, or the default log file if none is given.
+.It signal
+.Bl -tag -width Ds
+.It Fl c Ar file , Fl Fl config-file= Ns Ar file
+configuration file
+.It Fl r Ar string , Fl Fl realm= Ns Ar string
+realm
 .El
 .Pp
-prints the version of the last log entry.
+Signals the ipropd-master daemon to send updates to slaves.  Normally
+kadmin does this every time it writes to the database, so this should
+rarely be needed.
 .El
 .Sh SEE ALSO
 .Xr iprop 8
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.c
index ef7c38633..d6be26945 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop-log.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: iprop-log.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: iprop-log.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 #include <krb5/parse_time.h>
 #include "iprop-commands.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: iprop-log.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static krb5_context context;
 
@@ -48,17 +48,19 @@ get_kadmin_context(const char *config_file, char *realm)
     kadm5_config_params conf;
     krb5_error_code ret;
     void *kadm_handle;
+    char *file = NULL;
     char **files;
+    int aret;
 
     if (config_file == NULL) {
-	char *file;
-	asprintf(&file, "%s/kdc.conf", hdb_db_dir(context));
-	if (file == NULL)
+	aret = asprintf(&file, "%s/kdc.conf", hdb_db_dir(context));
+	if (aret == -1 || file == NULL)
 	    errx(1, "out of memory");
 	config_file = file;
     }
 
     ret = krb5_prepend_config_files_default(config_file, &files);
+    free(file);
     if (ret)
 	krb5_err(context, 1, ret, "getting configuration files");
 
@@ -103,7 +105,7 @@ static const char *op_names[] = {
     "nop"
 };
 
-static void
+static kadm5_ret_t
 print_entry(kadm5_server_context *server_context,
 	    uint32_t ver,
 	    time_t timestamp,
@@ -113,27 +115,28 @@ print_entry(kadm5_server_context *server_context,
 	    void *ctx)
 {
     char t[256];
+    const char *entry_kind = ctx;
     int32_t mask;
+    int32_t nop_time;
+    uint32_t nop_ver;
     hdb_entry ent;
     krb5_principal source;
     char *name1, *name2;
     krb5_data data;
     krb5_context scontext = server_context->context;
-
-    off_t end = krb5_storage_seek(sp, 0, SEEK_CUR) + len;
-
     krb5_error_code ret;
 
+    krb5_data_zero(&data);
+
     strftime(t, sizeof(t), "%Y-%m-%d %H:%M:%S", localtime(&timestamp));
 
     if((int)op < (int)kadm_get || (int)op > (int)kadm_nop) {
 	printf("unknown op: %d\n", op);
-	krb5_storage_seek(sp, end, SEEK_SET);
-	return;
+	return 0;
     }
 
-    printf ("%s: ver = %u, timestamp = %s, len = %u\n",
-	    op_names[op], ver, t, len);
+    printf ("%s%s: ver = %u, timestamp = %s, len = %u\n",
+	    entry_kind, op_names[op], ver, t, len);
     switch(op) {
     case kadm_delete:
 	krb5_ret_principal(sp, &source);
@@ -260,11 +263,29 @@ print_entry(kadm5_server_context *server_context,
 	free_hdb_entry(&ent);
 	break;
     case kadm_nop :
+        if (len == 16) {
+            uint64_t off;
+            krb5_ret_uint64(sp, &off);
+            printf("uberblock offset %llu ", (unsigned long long)off);
+        } else {
+            printf("nop");
+        }
+        if (len == 16 || len == 8) {
+            krb5_ret_int32(sp, &nop_time);
+            krb5_ret_uint32(sp, &nop_ver);
+
+            timestamp = nop_time;
+            strftime(t, sizeof(t), "%Y-%m-%d %H:%M:%S", localtime(&timestamp));
+            printf("timestamp %s version %u", t, nop_ver);
+        }
+        printf("\n");
 	break;
     default:
 	abort();
     }
-    krb5_storage_seek(sp, end, SEEK_SET);
+    krb5_data_free(&data);
+
+    return 0;
 }
 
 int
@@ -272,21 +293,61 @@ iprop_dump(struct dump_options *opt, int argc, char **argv)
 {
     kadm5_server_context *server_context;
     krb5_error_code ret;
+    enum kadm_iter_opts iter_opts_1st = 0;
+    enum kadm_iter_opts iter_opts_2nd = 0;
+    char *desc_1st = "";
+    char *desc_2nd = "";
 
     server_context = get_kadmin_context(opt->config_file_string,
 					opt->realm_string);
 
-    ret = kadm5_log_init (server_context);
-    if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_init");
+    if (argc > 0) {
+        free(server_context->log_context.log_file);
+        server_context->log_context.log_file = strdup(argv[0]);
+        if (server_context->log_context.log_file == NULL)
+            krb5_err(context, 1, errno, "strdup");
+    }
 
-    ret = kadm5_log_foreach (server_context, print_entry, NULL);
-    if(ret)
+    if (opt->reverse_flag) {
+        iter_opts_1st = kadm_backward | kadm_unconfirmed;
+        iter_opts_2nd = kadm_backward | kadm_confirmed;
+        desc_1st = "unconfirmed ";
+    } else {
+        iter_opts_1st = kadm_forward | kadm_confirmed;
+        iter_opts_2nd = kadm_forward | kadm_unconfirmed;
+        desc_2nd = "unconfirmed";
+    }
+
+    if (opt->no_lock_flag) {
+        ret = kadm5_log_init_sharedlock(server_context, LOCK_NB);
+        if (ret == EAGAIN || ret == EWOULDBLOCK) {
+            warnx("Not locking the iprop log");
+            ret = kadm5_log_init_nolock(server_context);
+            if (ret)
+                krb5_err(context, 1, ret, "kadm5_log_init_nolock");
+        }
+    } else {
+        warnx("If this command appears to block, try the --no-lock option");
+        ret = kadm5_log_init_sharedlock(server_context, 0);
+        if (ret)
+            krb5_err(context, 1, ret, "kadm5_log_init_sharedlock");
+    }
+
+    ret = kadm5_log_foreach(server_context, iter_opts_1st,
+                            NULL, print_entry, desc_1st);
+    if (ret)
+	krb5_warn(context, ret, "kadm5_log_foreach");
+
+    ret = kadm5_log_foreach(server_context, iter_opts_2nd,
+                            NULL, print_entry, desc_2nd);
+    if (ret)
 	krb5_warn(context, ret, "kadm5_log_foreach");
 
     ret = kadm5_log_end (server_context);
     if (ret)
 	krb5_warn(context, ret, "kadm5_log_end");
+
+    kadm5_destroy(server_context);
     return 0;
 }
 
@@ -299,10 +360,41 @@ iprop_truncate(struct truncate_options *opt, int argc, char **argv)
     server_context = get_kadmin_context(opt->config_file_string,
 					opt->realm_string);
 
-    ret = kadm5_log_truncate (server_context);
-    if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_truncate");
+    if (argc > 0) {
+        free(server_context->log_context.log_file);
+        server_context->log_context.log_file = strdup(argv[0]);
+        if (server_context->log_context.log_file == NULL)
+            krb5_err(context, 1, errno, "strdup");
+    }
 
+    if (opt->keep_entries_integer < 0 &&
+        opt->max_bytes_integer < 0) {
+        opt->keep_entries_integer = 100;
+        opt->max_bytes_integer = 0;
+    }
+    if (opt->keep_entries_integer < 0)
+        opt->keep_entries_integer = 0;
+    if (opt->max_bytes_integer < 0)
+        opt->max_bytes_integer = 0;
+
+    if (opt->reset_flag) {
+        /* First recover unconfirmed records */
+        ret = kadm5_log_init(server_context);
+        if (ret == 0)
+            ret = kadm5_log_reinit(server_context, 0);
+    } else {
+        ret = kadm5_log_init(server_context);
+        if (ret)
+            krb5_err(context, 1, ret, "kadm5_log_init");
+        ret = kadm5_log_truncate(server_context, opt->keep_entries_integer,
+                                 opt->max_bytes_integer);
+    }
+    if (ret)
+	krb5_err(context, 1, ret, "kadm5_log_truncate");
+
+    kadm5_log_signal_master(server_context);
+
+    kadm5_destroy(server_context);
     return 0;
 }
 
@@ -310,26 +402,71 @@ int
 last_version(struct last_version_options *opt, int argc, char **argv)
 {
     kadm5_server_context *server_context;
+    char *alt_argv[2] = { NULL, NULL };
     krb5_error_code ret;
     uint32_t version;
+    size_t i;
 
     server_context = get_kadmin_context(opt->config_file_string,
 					opt->realm_string);
 
-    ret = kadm5_log_init (server_context);
-    if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_init");
+    if (argc == 0) {
+        alt_argv[0] = strdup(server_context->log_context.log_file);
+        if (alt_argv[0] == NULL)
+            krb5_err(context, 1, errno, "strdup");
+        argv = alt_argv;
+        argc = 1;
+    }
 
-    ret = kadm5_log_get_version (server_context, &version);
-    if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_get_version");
+    for (i = 0; i < argc; i++) {
+        free(server_context->log_context.log_file);
+        server_context->log_context.log_file = strdup(argv[i]);
+        if (server_context->log_context.log_file == NULL)
+            krb5_err(context, 1, errno, "strdup");
 
-    ret = kadm5_log_end (server_context);
-    if (ret)
-	krb5_warn(context, ret, "kadm5_log_end");
+        if (opt->no_lock_flag) {
+            ret = kadm5_log_init_sharedlock(server_context, LOCK_NB);
+            if (ret == EAGAIN || ret == EWOULDBLOCK) {
+                warnx("Not locking the iprop log");
+                ret = kadm5_log_init_nolock(server_context);
+                if (ret)
+                    krb5_err(context, 1, ret, "kadm5_log_init_nolock");
+            }
+        } else {
+            warnx("If this command appears to block, try the "
+                  "--no-lock option");
+            ret = kadm5_log_init_sharedlock(server_context, 0);
+            if (ret)
+                krb5_err(context, 1, ret, "kadm5_log_init_sharedlock");
+        }
 
-    printf("version: %lu\n", (unsigned long)version);
+        ret = kadm5_log_get_version (server_context, &version);
+        if (ret)
+            krb5_err (context, 1, ret, "kadm5_log_get_version");
 
+        ret = kadm5_log_end (server_context);
+        if (ret)
+            krb5_warn(context, ret, "kadm5_log_end");
+
+        printf("version: %lu\n", (unsigned long)version);
+    }
+
+    kadm5_destroy(server_context);
+    free(alt_argv[0]);
+    return 0;
+}
+
+int
+signal_master(struct signal_options *opt, int argc, char **argv)
+{
+    kadm5_server_context *server_context;
+
+    server_context = get_kadmin_context(opt->config_file_string,
+					opt->realm_string);
+
+    kadm5_log_signal_master(server_context);
+
+    kadm5_destroy(server_context);
     return 0;
 }
 
@@ -340,7 +477,7 @@ last_version(struct last_version_options *opt, int argc, char **argv)
 int start_version = -1;
 int end_version = -1;
 
-static void
+static kadm5_ret_t
 apply_entry(kadm5_server_context *server_context,
 	    uint32_t ver,
 	    time_t timestamp,
@@ -355,18 +492,18 @@ apply_entry(kadm5_server_context *server_context,
     if((opt->start_version_integer != -1 && ver < (uint32_t)opt->start_version_integer) ||
        (opt->end_version_integer != -1 && ver > (uint32_t)opt->end_version_integer)) {
 	/* XXX skip this entry */
-	krb5_storage_seek(sp, len, SEEK_CUR);
-	return;
+	return 0;
     }
     printf ("ver %u... ", ver);
     fflush (stdout);
 
-    ret = kadm5_log_replay (server_context,
-			    op, ver, len, sp);
+    ret = kadm5_log_replay(server_context, op, ver, len, sp);
     if (ret)
 	krb5_warn (server_context->context, ret, "kadm5_log_replay");
 
     printf ("done\n");
+
+    return 0;
 }
 
 int
@@ -378,6 +515,13 @@ iprop_replay(struct replay_options *opt, int argc, char **argv)
     server_context = get_kadmin_context(opt->config_file_string,
 					opt->realm_string);
 
+    if (argc > 0) {
+        free(server_context->log_context.log_file);
+        server_context->log_context.log_file = strdup(argv[0]);
+        if (server_context->log_context.log_file == NULL)
+            krb5_err(context, 1, errno, "strdup");
+    }
+
     ret = server_context->db->hdb_open(context,
 				       server_context->db,
 				       O_RDWR | O_CREAT, 0600);
@@ -388,7 +532,9 @@ iprop_replay(struct replay_options *opt, int argc, char **argv)
     if (ret)
 	krb5_err (context, 1, ret, "kadm5_log_init");
 
-    ret = kadm5_log_foreach (server_context, apply_entry, opt);
+    ret = kadm5_log_foreach(server_context,
+                            kadm_forward | kadm_confirmed | kadm_unconfirmed,
+                            NULL, apply_entry, opt);
     if(ret)
 	krb5_warn(context, ret, "kadm5_log_foreach");
     ret = kadm5_log_end (server_context);
@@ -398,6 +544,7 @@ iprop_replay(struct replay_options *opt, int argc, char **argv)
     if (ret)
 	krb5_err (context, 1, ret, "db->close");
 
+    kadm5_destroy(server_context);
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.8 b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.8
index a10152f1f..4aac3538f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.8
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: iprop.8,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: iprop.8,v 1.5 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Id
 .\"
@@ -40,7 +40,7 @@
 .Nm iprop ,
 .Nm ipropd-master ,
 .Nm ipropd-slave
-.Nd propagate changes to a Heimdal Kerberos master KDC to slave KDCs
+.Nd propagate transactions from a Heimdal Kerberos master KDC to slave KDCs
 .Sh SYNOPSIS
 .Nm ipropd-master
 .Oo Fl c Ar string \*(Ba Xo
@@ -112,13 +112,18 @@ which sends the whole database to the slaves regularly,
 .Nm
 normally sends only the changes as they happen on the master.
 The master keeps track of all the changes by assigning a version
-number to every change to the database.
+number to every transaction to the database.
 The slaves know which was the latest version they saw, and in this
 way it can be determined if they are in sync or not.
-A log of all the changes is kept on the master.
+A log of all the transactions is kept on the master.
 When a slave is at an older version than the oldest one in the log,
 the whole database has to be sent.
 .Pp
+The log of transactions is also used to implement a two-phase commit
+(with roll-forward for recovery) method of updating the HDB.
+Transactions are first recorded in the log, then in the HDB, then
+the log is updated to mark the transaction as committed.
+.Pp
 The changes are propagated over a secure channel (on port 2121 by
 default).
 This should normally be defined as
@@ -177,6 +182,11 @@ like 5 min, 300 s, or simply a number of seconds.
 .Pa slaves ,
 .Pa slave-stats
 in the database directory.
+.Pa ipropd-master.pid ,
+.Pa ipropd-slave.pid
+in the database directory, or in the directory named by the
+.Ev HEIM_PIDFILE_DIR
+environment variable.
 .Sh SEE ALSO
 .Xr krb5.conf 5 ,
 .Xr hprop 8 ,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.h b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.h
index 241cdbae8..20dd76614 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/iprop.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: iprop.h,v 1.1.1.2 2011/04/14 14:09:16 elric Exp $	*/
+/*	$NetBSD: iprop.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1998-2003 Kungliga Tekniska Högskolan
@@ -63,10 +63,20 @@ enum iprop_cmd { I_HAVE = 1,
 		 ONE_PRINC = 4,
 		 NOW_YOU_HAVE = 5,
 		 ARE_YOU_THERE = 6,
-		 I_AM_HERE = 7
+		 I_AM_HERE = 7,
+		 YOU_HAVE_LAST_VERSION = 8
 };
 
 extern sig_atomic_t exit_flag;
 void setup_signal(void);
 
+enum ipropd_exit_code {
+    IPROPD_DONE = 0,
+    IPROPD_RESTART = 1,
+    IPROPD_RESTART_SLOW = 2,
+    IPROPD_FATAL = 3,
+};
+
+int restarter(krb5_context, size_t *);
+
 #endif /* __IPROP_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_common.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_common.c
index 26f018761..5be44000e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipropd_common.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ipropd_common.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -34,7 +34,11 @@
  */
 
 #include "iprop.h"
-__RCSID("NetBSD");
+
+#if defined(HAVE_FORK) && defined(HAVE_WAITPID)
+#include <sys/types.h>
+#include <sys/wait.h>
+#endif
 
 sig_atomic_t exit_flag;
 
@@ -73,3 +77,191 @@ setup_signal(void)
 #endif
 #endif
 }
+
+/*
+ * Fork a child to run the service, and restart it if it dies.
+ *
+ * Returns -1 if not supported, else a file descriptor that the service
+ * should select() for.  Any events on that file descriptor should cause
+ * the caller to exit immediately, as that means that the restarter
+ * exited.
+ *
+ * The service's normal exit status values should be should be taken
+ * from enum ipropd_exit_code.  IPROPD_FATAL causes the restarter to
+ * stop restarting the service and to exit.
+ *
+ * A count of restarts is output via the `countp' argument, if it is
+ * non-NULL.  This is useful for testing this function (e.g., kill the
+ * restarter after N restarts and check that the child gets the signal
+ * sent to it).
+ *
+ * This requires fork() and waitpid() (otherwise returns -1).  Ignoring
+ * SIGCHLD, of course, would be bad.
+ *
+ * We could support this on Windows by spawning a child with mostly the
+ * same arguments as the restarter process.
+ */
+int
+restarter(krb5_context context, size_t *countp)
+{
+#if defined(HAVE_FORK) && defined(HAVE_WAITPID)
+    struct timeval tmout;
+    pid_t pid = -1;
+    pid_t wpid = -1;
+    int status;
+    int fds[2];
+    int fds2[2];
+    size_t count = 0;
+    fd_set readset;
+
+    fds[0] = -1;
+    fds[1] = -1;
+    fds2[0] = -1;
+    fds2[1] = -1;
+
+    signal(SIGCHLD, SIG_DFL);
+
+    while (!exit_flag) {
+        /* Close the pipe ends we keep open */
+        if (fds[1] != -1)
+            (void) close(fds[1]);
+        if (fds2[0] != -1)
+            (void) close(fds2[1]);
+
+        /* A pipe so the child can detect the parent's death */
+        if (pipe(fds) == -1) {
+            krb5_err(context, 1, errno,
+                     "Could not setup pipes in service restarter");
+        }
+
+        /* A pipe so the parent can detect the child's death */
+        if (pipe(fds2) == -1) {
+            krb5_err(context, 1, errno,
+                     "Could not setup pipes in service restarter");
+        }
+
+        fflush(stdout);
+        fflush(stderr);
+
+        pid = fork();
+        if (pid == -1)
+            krb5_err(context, 1, errno, "Could not fork in service restarter");
+        if (pid == 0) {
+            if (countp != NULL)
+                *countp = count;
+            (void) close(fds[1]);
+            (void) close(fds2[0]);
+            return fds[0];
+        }
+
+        count++;
+
+        (void) close(fds[0]);
+        (void) close(fds2[1]);
+
+        do {
+            wpid = waitpid(pid, &status, 0);
+        } while (wpid == -1 && errno == EINTR && !exit_flag);
+        if (wpid == -1 && errno == EINTR)
+            break; /* We were signaled; gotta kill the child and exit */
+        if (wpid == -1) {
+            if (errno != ECHILD) {
+                warn("waitpid() failed; killing restarter's child process");
+                kill(pid, SIGTERM);
+            }
+            krb5_err(context, 1, errno, "restarter failed waiting for child");
+        }
+
+        assert(wpid == pid);
+        wpid = -1;
+        pid = -1;
+        if (WIFEXITED(status)) {
+            switch (WEXITSTATUS(status)) {
+            case IPROPD_DONE:
+                exit(0);
+            case IPROPD_RESTART_SLOW:
+                if (exit_flag)
+                    exit(1);
+                krb5_warnx(context, "Waiting 2 minutes to restart");
+                sleep(120);
+                continue;
+            case IPROPD_FATAL:
+                krb5_errx(context, WEXITSTATUS(status),
+                         "Sockets and pipes not supported for "
+                         "iprop log files");
+            case IPROPD_RESTART:
+            default:
+                if (exit_flag)
+                    exit(1);
+                /* Add exponential backoff (with max backoff)? */
+                krb5_warnx(context, "Waiting 30 seconds to restart");
+                sleep(30);
+                continue;
+            }
+        }
+        /* else */
+        krb5_warnx(context, "Child was killed; waiting 30 seconds to restart");
+        sleep(30);
+    }
+
+    if (pid == -1)
+        exit(0); /* No dead child to reap; done */
+
+    assert(pid > 0);
+    if (wpid != pid) {
+        warnx("Interrupted; killing child (pid %ld) with %d",
+              (long)pid, exit_flag);
+        krb5_warnx(context, "Interrupted; killing child (pid %ld) with %d",
+                   (long)pid, exit_flag);
+        kill(pid, exit_flag);
+
+        /* Wait up to one second for the child */
+        tmout.tv_sec = 1;
+        tmout.tv_usec = 0;
+        FD_ZERO(&readset);
+        FD_SET(fds2[0], &readset);
+        /* We don't care why select() returns */
+        (void) select(fds2[0] + 1, &readset, NULL, NULL, &tmout);
+        /*
+         * We haven't reaped the child yet; if it's a zombie, then
+         * SIGKILLing it won't hurt.  If it's not a zombie yet, well,
+         * we're out of patience.
+         */
+        kill(pid, SIGKILL);
+        do {
+            wpid = waitpid(pid, &status, 0);
+        } while (wpid != pid && errno == EINTR);
+        if (wpid == -1)
+            krb5_err(context, 1, errno, "restarter failed waiting for child");
+    }
+
+    /* Finally, the child is dead and reaped */
+    if (WIFEXITED(status))
+        exit(WEXITSTATUS(status));
+    if (WIFSIGNALED(status)) {
+        switch (WTERMSIG(status)) {
+        case SIGTERM:
+        case SIGXCPU:
+        case SIGINT:
+            exit(0);
+        default:
+            /*
+             * Attempt to set the same exit status for the parent as for
+             * the child.
+             */
+            kill(getpid(), WTERMSIG(status));
+            /*
+             * We can get past the self-kill if we inherited a SIG_IGN
+             * disposition that the child reset to SIG_DFL.
+             */
+        }
+    }
+    exit(1);
+#else
+    if (countp != NULL)
+        *countp = 0;
+    errno = ENOTSUP;
+    return -1;
+#endif
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_master.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_master.c
index 8c29dd877..5378f1ebd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_master.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_master.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipropd_master.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ipropd_master.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -38,6 +38,8 @@
 
 static krb5_log_facility *log_facility;
 
+static int verbose;
+
 const char *slave_stats_file;
 const char *slave_time_missing = "2 min";
 const char *slave_time_gone = "5 min";
@@ -127,6 +129,7 @@ struct slave {
     char *name;
     krb5_auth_context ac;
     uint32_t version;
+    uint32_t version_tstamp;
     time_t seen;
     unsigned long flags;
 #define SLAVE_F_DEAD	0x1
@@ -312,44 +315,40 @@ error:
     remove_slave(context, s, root);
 }
 
-struct prop_context {
-    krb5_auth_context auth_context;
-    krb5_socket_t fd;
-};
-
 static int
-prop_one (krb5_context context, HDB *db, hdb_entry_ex *entry, void *v)
+dump_one (krb5_context context, HDB *db, hdb_entry_ex *entry, void *v)
 {
     krb5_error_code ret;
+    krb5_storage *dump = (krb5_storage *)v;
     krb5_storage *sp;
     krb5_data data;
-    struct slave *s = (struct slave *)v;
 
     ret = hdb_entry2value (context, &entry->entry, &data);
     if (ret)
 	return ret;
     ret = krb5_data_realloc (&data, data.length + 4);
-    if (ret) {
-	krb5_data_free (&data);
-	return ret;
-    }
+    if (ret)
+	goto done;
     memmove ((char *)data.data + 4, data.data, data.length - 4);
     sp = krb5_storage_from_data(&data);
     if (sp == NULL) {
-	krb5_data_free (&data);
-	return ENOMEM;
+	ret = ENOMEM;
+	goto done;
     }
-    krb5_store_int32(sp, ONE_PRINC);
+    ret = krb5_store_uint32(sp, ONE_PRINC);
     krb5_storage_free(sp);
 
-    ret = krb5_write_priv_message (context, s->ac, &s->fd, &data);
+    if (ret == 0)
+        ret = krb5_store_data(dump, data);
+
+done:
     krb5_data_free (&data);
     return ret;
 }
 
 static int
-send_complete (krb5_context context, slave *s,
-	       const char *database, uint32_t current_version)
+write_dump (krb5_context context, krb5_storage *dump,
+	    const char *database, uint32_t current_version)
 {
     krb5_error_code ret;
     krb5_storage *sp;
@@ -357,34 +356,50 @@ send_complete (krb5_context context, slave *s,
     krb5_data data;
     char buf[8];
 
+    /* we assume that the caller has obtained an exclusive lock */
+
+    ret = krb5_storage_truncate(dump, 0);
+    if (ret)
+	return ret;
+
+    if (krb5_storage_seek(dump, 0, SEEK_SET) != 0)
+        return errno;
+
+    /*
+     * First we store zero as the HDB version, this will indicate to a
+     * later reader that the dumpfile is invalid.  We later write the
+     * correct version in the file after we have written all of the
+     * messages.  A dump with a zero version will not be considered
+     * to be valid.
+     */
+
+    ret = krb5_store_uint32(dump, 0);
+
     ret = hdb_create (context, &db, database);
     if (ret)
-	krb5_err (context, 1, ret, "hdb_create: %s", database);
+	krb5_err (context, IPROPD_RESTART, ret, "hdb_create: %s", database);
     ret = db->hdb_open (context, db, O_RDONLY, 0);
     if (ret)
-	krb5_err (context, 1, ret, "db->open");
+	krb5_err (context, IPROPD_RESTART, ret, "db->open");
 
     sp = krb5_storage_from_mem (buf, 4);
     if (sp == NULL)
-	krb5_errx (context, 1, "krb5_storage_from_mem");
-    krb5_store_int32 (sp, TELL_YOU_EVERYTHING);
+	krb5_errx (context, IPROPD_RESTART, "krb5_storage_from_mem");
+    krb5_store_uint32 (sp, TELL_YOU_EVERYTHING);
     krb5_storage_free (sp);
 
     data.data   = buf;
     data.length = 4;
 
-    ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
-
+    ret = krb5_store_data(dump, data);
     if (ret) {
-	krb5_warn (context, ret, "krb5_write_priv_message");
-	slave_dead(context, s);
+	krb5_warn (context, ret, "write_dump");
 	return ret;
     }
 
-    ret = hdb_foreach (context, db, HDB_F_ADMIN_DATA, prop_one, s);
+    ret = hdb_foreach (context, db, HDB_F_ADMIN_DATA, dump_one, dump);
     if (ret) {
-	krb5_warn (context, ret, "hdb_foreach");
-	slave_dead(context, s);
+	krb5_warn (context, ret, "write_dump: hdb_foreach");
 	return ret;
     }
 
@@ -393,25 +408,220 @@ send_complete (krb5_context context, slave *s,
 
     sp = krb5_storage_from_mem (buf, 8);
     if (sp == NULL)
-	krb5_errx (context, 1, "krb5_storage_from_mem");
-    krb5_store_int32 (sp, NOW_YOU_HAVE);
-    krb5_store_int32 (sp, current_version);
+	krb5_errx (context, IPROPD_RESTART, "krb5_storage_from_mem");
+    ret = krb5_store_uint32(sp, NOW_YOU_HAVE);
+    if (ret == 0)
+      krb5_store_uint32(sp, current_version);
     krb5_storage_free (sp);
 
     data.length = 8;
 
-    s->version = current_version;
+    if (ret == 0)
+        ret = krb5_store_data(dump, data);
 
-    ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
-    if (ret) {
-	slave_dead(context, s);
-	krb5_warn (context, ret, "krb5_write_priv_message");
-	return ret;
+    /*
+     * We must ensure that the entire valid dump is written to disk
+     * before we write the current version at the front thus making
+     * it a valid dump file.  If we crash around here, this can be
+     * important upon reboot.
+     */
+
+    if (ret == 0)
+        ret = krb5_storage_fsync(dump);
+
+    if (ret == 0 && krb5_storage_seek(dump, 0, SEEK_SET) == -1)
+	ret = errno;
+
+    /* Write current version at the front making the dump valid */
+
+    if (ret == 0)
+        ret = krb5_store_uint32(dump, current_version);
+
+    /*
+     * We don't need to fsync(2) after the real version is written as
+     * it is not a disaster if it doesn't make it to disk if we crash.
+     * After all, we'll just create a new dumpfile.
+     */
+
+    if (ret == 0)
+        krb5_warnx(context, "wrote new dumpfile (version %u)",
+                   current_version);
+    else
+        krb5_warn(context, ret, "failed to write new dumpfile (version %u)",
+                  current_version);
+
+    return ret;
+}
+
+static int
+send_complete (krb5_context context, slave *s, const char *database,
+	       uint32_t current_version, uint32_t oldest_version,
+	       uint32_t initial_log_tstamp)
+{
+    krb5_error_code ret;
+    krb5_storage *dump = NULL;
+    uint32_t vno = 0;
+    krb5_data data;
+    int fd = -1;
+    struct stat st;
+    char *dfn;
+
+    ret = asprintf(&dfn, "%s/ipropd.dumpfile", hdb_db_dir(context));
+    if (ret == -1 || !dfn) {
+	krb5_warn(context, ENOMEM, "Cannot allocate memory");
+	return ENOMEM;
     }
 
-    slave_seen(s);
+    fd = open(dfn, O_CREAT|O_RDWR, 0600);
+    if (fd == -1) {
+	ret = errno;
+	krb5_warn(context, ret, "Cannot open/create iprop dumpfile %s", dfn);
+	free(dfn);
+        return ret;
+    }
+    free(dfn);
 
-    return 0;
+    dump = krb5_storage_from_fd(fd);
+    if (!dump) {
+	ret = errno;
+	krb5_warn(context, ret, "krb5_storage_from_fd");
+	goto done;
+    }
+
+    for (;;) {
+	ret = flock(fd, LOCK_SH);
+	if (ret == -1) {
+	    ret = errno;
+	    krb5_warn(context, ret, "flock(fd, LOCK_SH)");
+	    goto done;
+	}
+
+	if (krb5_storage_seek(dump, 0, SEEK_SET) == (off_t)-1) {
+	    ret = errno;
+	    krb5_warn(context, ret, "krb5_storage_seek(dump, 0, SEEK_SET)");
+	    goto done;
+	}
+
+	vno = 0;
+	ret = krb5_ret_uint32(dump, &vno);
+	if (ret && ret != HEIM_ERR_EOF) {
+	    krb5_warn(context, ret, "krb5_ret_uint32(dump, &vno)");
+	    goto done;
+	}
+
+        if (fstat(fd, &st) == -1) {
+            ret = errno;
+            krb5_warn(context, ret, "send_complete: could not stat dump file");
+            goto done;
+        }
+
+	/*
+	 * If the current dump has an appropriate version, then we can
+	 * break out of the loop and send the file below.
+	 */
+
+	if (ret == 0 && vno != 0 && st.st_mtime > initial_log_tstamp &&
+            vno >= oldest_version && vno <= current_version)
+	    break;
+
+        if (verbose)
+            krb5_warnx(context, "send_complete: dumping HDB");
+
+	/*
+	 * Otherwise, we may need to write a new dump file.  We
+	 * obtain an exclusive lock on the fd.  Because this is
+	 * not guaranteed to be an upgrade of our existing shared
+	 * lock, someone else may have written a new dumpfile while
+	 * we were waiting and so we must first check the vno of
+	 * the dump to see if that happened.  If it did, we need
+	 * to go back to the top of the loop so that we can downgrade
+	 * our lock to a shared one.
+	 */
+
+	ret = flock(fd, LOCK_EX);
+	if (ret == -1) {
+	    ret = errno;
+	    krb5_warn(context, ret, "flock(fd, LOCK_EX)");
+	    goto done;
+	}
+
+	ret = krb5_storage_seek(dump, 0, SEEK_SET);
+	if (ret == -1) {
+	    ret = errno;
+	    krb5_warn(context, ret, "krb5_storage_seek(dump, 0, SEEK_SET)");
+	    goto done;
+	}
+
+	vno = 0;
+	ret = krb5_ret_uint32(dump, &vno);
+	if (ret && ret != HEIM_ERR_EOF) {
+	    krb5_warn(context, ret, "krb5_ret_uint32(dump, &vno)");
+	    goto done;
+	}
+
+        if (fstat(fd, &st) == -1) {
+            ret = errno;
+            krb5_warn(context, ret, "send_complete: could not stat dump file");
+            goto done;
+        }
+
+	/* check if someone wrote a better version for us */
+        if (ret == 0 && vno != 0 && st.st_mtime > initial_log_tstamp &&
+            vno >= oldest_version && vno <= current_version)
+	    continue;
+
+	/* Now, we know that we must write a new dump file.  */
+
+	ret = write_dump(context, dump, database, current_version);
+	if (ret)
+	    goto done;
+
+	/*
+	 * And we must continue to the top of the loop so that we can
+	 * downgrade to a shared lock.
+	 */
+    }
+
+    /*
+     * Leaving the above loop, dump should have a ptr right after the initial
+     * 4 byte DB version number and we should have a shared lock on the file
+     * (which we may have just created), so we are reading to simply blast
+     * the data down the wire.
+     */
+
+    for (;;) {
+	ret = krb5_ret_data(dump, &data);
+	if (ret == HEIM_ERR_EOF) {
+	    ret = 0;	/* EOF is not an error, it's success */
+	    goto done;
+	}
+
+	if (ret) {
+	    krb5_warn(context, ret, "krb5_ret_data(dump, &data)");
+	    slave_dead(context, s);
+	    goto done;
+	}
+
+	ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
+	krb5_data_free(&data);
+
+	if (ret) {
+	    krb5_warn (context, ret, "krb5_write_priv_message");
+	    slave_dead(context, s);
+	    goto done;
+	}
+    }
+
+done:
+    if (!ret) {
+	s->version = vno;
+	slave_seen(s);
+    }
+    if (fd != -1)
+	close(fd);
+    if (dump)
+	krb5_storage_free(dump);
+    return ret;
 }
 
 static int
@@ -438,71 +648,152 @@ send_are_you_there (krb5_context context, slave *s)
 	slave_dead(context, s);
 	return 1;
     }
-    krb5_store_int32 (sp, ARE_YOU_THERE);
+    ret = krb5_store_uint32(sp, ARE_YOU_THERE);
     krb5_storage_free (sp);
 
-    ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
+    if (ret == 0) {
+        ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
 
-    if (ret) {
-	krb5_warn (context, ret, "are_you_there: krb5_write_priv_message");
-	slave_dead(context, s);
-	return 1;
+        if (ret) {
+            krb5_warn(context, ret, "are_you_there: krb5_write_priv_message");
+            slave_dead(context, s);
+            return 1;
+        }
     }
 
     return 0;
 }
 
 static int
-send_diffs (krb5_context context, slave *s, int log_fd,
-	    const char *database, uint32_t current_version)
+send_diffs (kadm5_server_context *server_context, slave *s, int log_fd,
+	    const char *database, uint32_t current_version,
+	    uint32_t current_tstamp)
 {
+    krb5_context context = server_context->context;
     krb5_storage *sp;
-    uint32_t ver;
-    time_t timestamp;
+    uint32_t ver, initial_version, initial_version2;
+    uint32_t initial_tstamp, initial_tstamp2;
     enum kadm_ops op;
     uint32_t len;
     off_t right, left;
+    krb5_ssize_t bytes;
     krb5_data data;
     int ret = 0;
 
+    if (s->flags & SLAVE_F_DEAD) {
+        krb5_warnx(context, "not sending diffs to dead slave %s", s->name);
+        return 0;
+    }
+
     if (s->version == current_version) {
-	krb5_warnx(context, "slave %s in sync already at version %ld",
-		   s->name, (long)s->version);
-	return 0;
+	char buf[4];
+
+	sp = krb5_storage_from_mem(buf, 4);
+	if (sp == NULL)
+	    krb5_errx(context, IPROPD_RESTART, "krb5_storage_from_mem");
+	ret = krb5_store_uint32(sp, YOU_HAVE_LAST_VERSION);
+	krb5_storage_free(sp);
+	data.data   = buf;
+	data.length = 4;
+        if (ret == 0) {
+            ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
+            if (ret) {
+                krb5_warn(context, ret, "send_diffs: failed to send to slave");
+                slave_dead(context, s);
+            }
+            krb5_warnx(context, "slave %s in sync already at version %ld",
+                       s->name, (long)s->version);
+        }
+	return ret;
     }
 
-    if (s->flags & SLAVE_F_DEAD)
-	return 0;
+    if (verbose)
+        krb5_warnx(context, "sending diffs to live-seeming slave %s", s->name);
 
-    /* if slave is a fresh client, starting over */
-    if (s->version == 0) {
-	krb5_warnx(context, "sending complete log to fresh slave %s",
-		   s->name);
-	return send_complete (context, s, database, current_version);
+    /*
+     * XXX The code that makes the diffs should be made a separate function,
+     * then error handling (send_are_you_there() or slave_dead()) can be done
+     * here.
+     */
+
+    if (flock(log_fd, LOCK_SH) == -1) {
+        krb5_warn(context, errno, "could not obtain shared lock on log file");
+        send_are_you_there(context, s);
+        return errno;
     }
-
-    sp = kadm5_log_goto_end (log_fd);
+    ret = kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_FIRST,
+                                   &initial_version, &initial_tstamp);
+    sp = kadm5_log_goto_end(server_context, log_fd);
+    flock(log_fd, LOCK_UN);
+    if (ret) {
+        if (sp != NULL)
+            krb5_storage_free(sp);
+        krb5_warn(context, ret, "send_diffs: failed to read log");
+        send_are_you_there(context, s);
+        return ret;
+    }
+    if (sp == NULL) {
+        send_are_you_there(context, s);
+        krb5_warn(context, errno ? errno : EINVAL,
+                  "send_diffs: failed to read log");
+        return errno ? errno : EINVAL;
+    }
+    /*
+     * We're not holding any locks here, so we can't prevent truncations.
+     *
+     * We protect against this by re-checking that the initial version and
+     * timestamp are the same before and after this loop.
+     */
     right = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (right == (off_t)-1) {
+        krb5_storage_free(sp);
+        send_are_you_there(context, s);
+        return errno;
+    }
     for (;;) {
-	ret = kadm5_log_previous (context, sp, &ver, &timestamp, &op, &len);
+	ret = kadm5_log_previous (context, sp, &ver, NULL, &op, &len);
 	if (ret)
-	    krb5_err(context, 1, ret,
+	    krb5_err(context, IPROPD_RESTART, ret,
 		     "send_diffs: failed to find previous entry");
 	left = krb5_storage_seek(sp, -16, SEEK_CUR);
-	if (ver == s->version)
-	    return 0;
+        if (left == (off_t)-1) {
+            krb5_storage_free(sp);
+            send_are_you_there(context, s);
+            return errno;
+        }
 	if (ver == s->version + 1)
 	    break;
-	if (left == 0) {
+
+        /*
+         * We don't expect to reach the slave's version, except when it is
+         * starting empty with the uber record.
+         */
+	if (ver == s->version && !(ver == 0 && op == kadm_nop)) {
+            /*
+             * This shouldn't happen, but recall we're not holding a lock on
+             * the log.
+             */
+            krb5_storage_free(sp);
+            krb5_warnx(context, "iprop log truncated while sending diffs to "
+                       "slave??  ver = %lu", (unsigned long)ver);
+            send_are_you_there(context, s);
+            return 0;
+        }
+
+        /* If we've reached the uber record, send the complete database */
+	if (left == 0 || (ver == 0 && op == kadm_nop)) {
 	    krb5_storage_free(sp);
 	    krb5_warnx(context,
 		       "slave %s (version %lu) out of sync with master "
 		       "(first version in log %lu), sending complete database",
 		       s->name, (unsigned long)s->version, (unsigned long)ver);
-	    return send_complete (context, s, database, current_version);
+	    return send_complete (context, s, database, current_version, ver,
+                                  initial_tstamp);
 	}
     }
 
+    assert(ver == s->version + 1);
+
     krb5_warnx(context,
 	       "syncing slave %s from version %lu to version %lu",
 	       s->name, (unsigned long)s->version,
@@ -512,19 +803,52 @@ send_diffs (krb5_context context, slave *s, int log_fd,
     if (ret) {
 	krb5_storage_free(sp);
 	krb5_warn (context, ret, "send_diffs: krb5_data_alloc");
-	slave_dead(context, s);
+        send_are_you_there(context, s);
 	return 1;
     }
-    krb5_storage_read (sp, (char *)data.data + 4, data.length - 4);
+    bytes = krb5_storage_read(sp, (char *)data.data + 4, data.length - 4);
     krb5_storage_free(sp);
+    if (bytes != data.length - 4) {
+        krb5_warnx(context, "iprop log truncated while sending diffs to "
+                   "slave??  ver = %lu", (unsigned long)ver);
+        send_are_you_there(context, s);
+        return 1;
+    }
+
+    /*
+     * Check that we have the same log initial version and timestamp now as
+     * when we dropped the shared lock on the log file!  Else we could be
+     * sending garbage to the slave.
+     */
+    if (flock(log_fd, LOCK_SH) == -1) {
+        krb5_warn(context, errno, "could not obtain shared lock on log file");
+        send_are_you_there(context, s);
+        return 1;
+    }
+    ret = kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_FIRST,
+                                   &initial_version2, &initial_tstamp2);
+    flock(log_fd, LOCK_UN);
+    if (ret) {
+        krb5_warn(context, ret,
+                   "send_diffs: failed to read log while producing diffs");
+        send_are_you_there(context, s);
+        return 1;
+    }
+    if (initial_version != initial_version2 ||
+        initial_tstamp != initial_tstamp2) {
+        krb5_warn(context, ret,
+                   "send_diffs: log truncated while producing diffs");
+        send_are_you_there(context, s);
+        return 1;
+    }
 
     sp = krb5_storage_from_data (&data);
     if (sp == NULL) {
 	krb5_warnx (context, "send_diffs: krb5_storage_from_data");
-	slave_dead(context, s);
+        send_are_you_there(context, s);
 	return 1;
     }
-    krb5_store_int32 (sp, FOR_YOU);
+    krb5_store_uint32 (sp, FOR_YOU);
     krb5_storage_free(sp);
 
     ret = krb5_write_priv_message(context, s->ac, &s->fd, &data);
@@ -539,70 +863,79 @@ send_diffs (krb5_context context, slave *s, int log_fd,
 
     s->version = current_version;
 
+    krb5_warnx(context, "slave %s is now up to date (%u)", s->name, s->version);
+
     return 0;
 }
 
 static int
-process_msg (krb5_context context, slave *s, int log_fd,
-	     const char *database, uint32_t current_version)
+process_msg (kadm5_server_context *server_context, slave *s, int log_fd,
+	     const char *database, uint32_t current_version,
+             uint32_t current_tstamp)
 {
+    krb5_context context = server_context->context;
     int ret = 0;
     krb5_data out;
     krb5_storage *sp;
-    int32_t tmp;
+    uint32_t tmp;
 
     ret = krb5_read_priv_message(context, s->ac, &s->fd, &out);
     if(ret) {
-	krb5_warn (context, ret, "error reading message from %s", s->name);
+	krb5_warn(context, ret, "error reading message from %s", s->name);
 	return 1;
     }
 
-    sp = krb5_storage_from_mem (out.data, out.length);
+    sp = krb5_storage_from_mem(out.data, out.length);
     if (sp == NULL) {
-	krb5_warnx (context, "process_msg: no memory");
-	krb5_data_free (&out);
+	krb5_warnx(context, "process_msg: no memory");
+	krb5_data_free(&out);
 	return 1;
     }
-    if (krb5_ret_int32 (sp, &tmp) != 0) {
-	krb5_warnx (context, "process_msg: client send too short command");
-	krb5_data_free (&out);
+    if (krb5_ret_uint32(sp, &tmp) != 0) {
+	krb5_warnx(context, "process_msg: client send too short command");
+	krb5_data_free(&out);
 	return 1;
     }
     switch (tmp) {
     case I_HAVE :
-	ret = krb5_ret_int32 (sp, &tmp);
+	ret = krb5_ret_uint32(sp, &tmp);
 	if (ret != 0) {
-	    krb5_warnx (context, "process_msg: client send too I_HAVE data");
+	    krb5_warnx(context, "process_msg: client send too little I_HAVE data");
 	    break;
 	}
 	/* new started slave that have old log */
 	if (s->version == 0 && tmp != 0) {
-	    if (current_version < (uint32_t)tmp) {
-		krb5_warnx (context, "Slave %s (version %lu) have later version "
-			    "the master (version %lu) OUT OF SYNC",
-			    s->name, (unsigned long)tmp,
-			    (unsigned long)current_version);
+	    if (current_version < tmp) {
+		krb5_warnx(context, "Slave %s (version %u) have later version "
+			   "the master (version %u) OUT OF SYNC",
+			   s->name, tmp, current_version);
 	    }
+            if (verbose)
+                krb5_warnx(context, "slave %s updated from %u to %u",
+                           s->name, s->version, tmp);
 	    s->version = tmp;
 	}
-	if ((uint32_t)tmp < s->version) {
-	    krb5_warnx (context, "Slave claims to not have "
-			"version we already sent to it");
-	} else {
-	    ret = send_diffs (context, s, log_fd, database, current_version);
+	if (tmp < s->version) {
+	    krb5_warnx(context, "Slave %s claims to not have "
+                       "version we already sent to it", s->name);
+            s->version = tmp;
 	}
-	break;
+        ret = send_diffs(server_context, s, log_fd, database, current_version,
+                         current_tstamp);
+        break;
     case I_AM_HERE :
+        if (verbose)
+            krb5_warnx(context, "slave %s is there", s->name);
 	break;
     case ARE_YOU_THERE:
     case FOR_YOU :
     default :
-	krb5_warnx (context, "Ignoring command %d", tmp);
+	krb5_warnx(context, "Ignoring command %d", tmp);
 	break;
     }
 
-    krb5_data_free (&out);
-    krb5_storage_free (sp);
+    krb5_data_free(&out);
+    krb5_storage_free(sp);
 
     slave_seen(s);
 
@@ -619,25 +952,28 @@ static FILE *
 open_stats(krb5_context context)
 {
     char *statfile = NULL;
-    const char *fn;
-    FILE *f;
+    const char *fn = NULL;
+    FILE *out = NULL;
 
+    /*
+     * krb5_config_get_string_default() returs default value as-is,
+     * delay free() of "statfile" until we're done with "fn".
+     */
     if (slave_stats_file)
 	fn = slave_stats_file;
-    else {
-	asprintf(&statfile,  "%s/slaves-stats", hdb_db_dir(context));
+    else if (asprintf(&statfile,  "%s/slaves-stats", hdb_db_dir(context)) != -1
+	     && statfile != NULL)
 	fn = krb5_config_get_string_default(context,
 					    NULL,
 					    statfile,
 					    "kdc",
 					    "iprop-stats",
 					    NULL);
-    }
-    f = fopen(fn, "w");
-    if (statfile)
+    if (fn != NULL)
+	out = fopen(fn, "w");
+    if (statfile != NULL)
 	free(statfile);
-
-    return f;
+    return out;
 }
 
 static void
@@ -722,7 +1058,7 @@ write_stats(krb5_context context, slave *slaves, uint32_t current_version)
 }
 
 
-static char sHDB[] = "HDB:";
+static char sHDB[] = "HDBGET:";
 static char *realm;
 static int version_flag;
 static int help_flag;
@@ -730,9 +1066,8 @@ static char *keytab_str = sHDB;
 static char *database;
 static char *config_file;
 static char *port_str;
-#ifdef SUPPORT_DETACH
-static int detach_from_console = 0;
-#endif
+static int detach_from_console;
+static int daemon_child = -1;
 
 static struct getargs args[] = {
     { "config-file", 'c', arg_string, &config_file, NULL, NULL },
@@ -748,12 +1083,13 @@ static struct getargs args[] = {
       "time of inactivity after which a slave is considered gone", "time"},
     { "port", 0, arg_string, &port_str,
       "port ipropd will listen to", "port"},
-#ifdef SUPPORT_DETACH
     { "detach", 0, arg_flag, &detach_from_console,
       "detach from console", NULL },
-#endif
+    { "daemon-child",       0 ,      arg_integer, &daemon_child,
+      "private argument, do not use", NULL },
     { "hostname", 0, arg_string, rk_UNCONST(&master_hostname),
       "hostname of master (if not same as hostname)", "hostname" },
+    { "verbose", 0, arg_flag, &verbose, NULL, NULL },
     { "version", 0, arg_flag, &version_flag, NULL, NULL },
     { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
@@ -771,24 +1107,40 @@ main(int argc, char **argv)
     int log_fd;
     slave *slaves = NULL;
     uint32_t current_version = 0, old_version = 0;
+    uint32_t current_tstamp = 0;
     krb5_keytab keytab;
-    int optidx;
     char **files;
+    int aret;
+    int optidx = 0;
+    int restarter_fd = -1;
+    struct stat st;
 
-    optidx = krb5_program_setup(&context, argc, argv, args, num_args, NULL);
+    setprogname(argv[0]);
 
-    if(help_flag)
+    if (getarg(args, num_args, argc, argv, &optidx))
+        krb5_std_usage(1, args, num_args);
+
+    if (help_flag)
 	krb5_std_usage(0, args, num_args);
-    if(version_flag) {
+
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
 
+    if (detach_from_console && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
+    rk_pidfile(NULL);
+
+    ret = krb5_init_context(&context);
+    if (ret)
+        errx(1, "krb5_init_context failed: %d", ret);
+
     setup_signal();
 
     if (config_file == NULL) {
-	asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
-	if (config_file == NULL)
+	aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
+	if (aret == -1 || config_file == NULL)
 	    errx(1, "out of memory");
     }
 
@@ -808,15 +1160,10 @@ main(int argc, char **argv)
     if (time_before_missing < 0)
 	krb5_errx (context, 1, "couldn't parse time: %s", slave_time_missing);
 
-#ifdef SUPPORT_DETACH
-    if (detach_from_console)
-	daemon(0, 0);
-#endif
-    pidfile (NULL);
-    krb5_openlog (context, "ipropd-master", &log_facility);
+    krb5_openlog(context, "ipropd-master", &log_facility);
     krb5_set_warn_dest(context, log_facility);
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
     if(ret)
 	krb5_err(context, 1, ret, "krb5_kt_register");
 
@@ -845,24 +1192,38 @@ main(int argc, char **argv)
 	krb5_err (context, 1, errno, "open %s",
 		  server_context->log_context.log_file);
 
+    if (fstat(log_fd, &st) == -1)
+        krb5_err(context, 1, errno, "stat %s",
+                 server_context->log_context.log_file);
+
+    if (flock(log_fd, LOCK_SH) == -1)
+        krb5_err(context, 1, errno, "shared flock %s",
+                 server_context->log_context.log_file);
+    kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_LAST,
+                             &current_version, &current_tstamp);
+    flock(log_fd, LOCK_UN);
+
     signal_fd = make_signal_socket (context);
     listen_fd = make_listen_socket (context, port_str);
 
-    kadm5_log_get_version_fd (log_fd, &current_version);
-
     krb5_warnx(context, "ipropd-master started at version: %lu",
 	       (unsigned long)current_version);
 
-    while(exit_flag == 0){
+    roken_detach_finish(NULL, daemon_child);
+    restarter_fd = restarter(context, NULL);
+
+    while (exit_flag == 0){
 	slave *p;
 	fd_set readset;
 	int max_fd = 0;
 	struct timeval to = {30, 0};
 	uint32_t vers;
+        struct stat st2;;
 
 #ifndef NO_LIMIT_FD_SETSIZE
-	if (signal_fd >= FD_SETSIZE || listen_fd >= FD_SETSIZE)
-	    krb5_errx (context, 1, "fd too large");
+	if (signal_fd >= FD_SETSIZE || listen_fd >= FD_SETSIZE ||
+            restarter_fd >= FD_SETSIZE)
+	    krb5_errx (context, IPROPD_RESTART, "fd too large");
 #endif
 
 	FD_ZERO(&readset);
@@ -870,6 +1231,10 @@ main(int argc, char **argv)
 	max_fd = max(max_fd, signal_fd);
 	FD_SET(listen_fd, &readset);
 	max_fd = max(max_fd, listen_fd);
+        if (restarter_fd > -1) {
+            FD_SET(restarter_fd, &readset);
+            max_fd = max(max_fd, restarter_fd);
+        }
 
 	for (p = slaves; p != NULL; p = p->next) {
 	    if (p->flags & SLAVE_F_DEAD)
@@ -884,12 +1249,45 @@ main(int argc, char **argv)
 	    if (errno == EINTR)
 		continue;
 	    else
-		krb5_err (context, 1, errno, "select");
+		krb5_err (context, IPROPD_RESTART, errno, "select");
 	}
 
+        if (stat(server_context->log_context.log_file, &st2) == -1) {
+            krb5_warn(context, errno, "could not stat log file by path");
+            st2 = st;
+        }
+
+        if (st2.st_dev != st.st_dev || st2.st_ino != st.st_ino) {
+            (void) close(log_fd);
+
+            log_fd = open(server_context->log_context.log_file, O_RDONLY, 0);
+            if (log_fd < 0)
+                krb5_err(context, 1, IPROPD_RESTART_SLOW, "open %s",
+                          server_context->log_context.log_file);
+
+            if (fstat(log_fd, &st) == -1)
+                krb5_err(context, IPROPD_RESTART_SLOW, errno, "stat %s",
+                         server_context->log_context.log_file);
+
+            if (flock(log_fd, LOCK_SH) == -1)
+                krb5_err(context, IPROPD_RESTART, errno, "shared flock %s",
+                         server_context->log_context.log_file);
+            kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_LAST,
+                                     &current_version, &current_tstamp);
+            flock(log_fd, LOCK_UN);
+        }
+
 	if (ret == 0) {
-	    old_version = current_version;
-	    kadm5_log_get_version_fd (log_fd, &current_version);
+            /* Recover from failed transactions */
+            if (kadm5_log_init_nb(server_context) == 0)
+                kadm5_log_end(server_context);
+
+	    if (flock(log_fd, LOCK_SH) == -1)
+                krb5_err(context, IPROPD_RESTART, errno,
+                         "could not lock log file");
+	    kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_LAST,
+                                     &current_version, &current_tstamp);
+	    flock(log_fd, LOCK_UN);
 
 	    if (current_version > old_version) {
 		krb5_warnx(context,
@@ -899,11 +1297,18 @@ main(int argc, char **argv)
 		for (p = slaves; p != NULL; p = p->next) {
 		    if (p->flags & SLAVE_F_DEAD)
 			continue;
-		    send_diffs (context, p, log_fd, database, current_version);
+		    send_diffs (server_context, p, log_fd, database,
+                                current_version, current_tstamp);
 		}
+                old_version = current_version;
 	    }
 	}
 
+        if (ret && FD_ISSET(restarter_fd, &readset)) {
+            exit_flag = SIGTERM;
+            break;
+        }
+
 	if (ret && FD_ISSET(signal_fd, &readset)) {
 #ifndef NO_UNIX_SOCKETS
 	    struct sockaddr_un peer_addr;
@@ -920,8 +1325,25 @@ main(int argc, char **argv)
 	    --ret;
 	    assert(ret >= 0);
 	    old_version = current_version;
-	    kadm5_log_get_version_fd (log_fd, &current_version);
-	    if (current_version > old_version) {
+	    if (flock(log_fd, LOCK_SH) == -1)
+                krb5_err(context, IPROPD_RESTART, errno, "shared flock %s",
+                         server_context->log_context.log_file);
+	    kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_LAST,
+                                     &current_version, &current_tstamp);
+	    flock(log_fd, LOCK_UN);
+	    if (current_version != old_version) {
+                /*
+                 * If current_version < old_version then the log got
+                 * truncated and we'll end up doing full propagations.
+                 *
+                 * Truncating the log when the current version is
+                 * numerically small can lead to race conditions.
+                 * Ideally we should identify log versions as
+                 * {init_or_trunc_time, vno}, then we could not have any
+                 * such race conditions, but this would either require
+                 * breaking backwards compatibility for the protocol or
+                 * adding new messages to it.
+                 */
 		krb5_warnx(context,
 			   "Got a signal, updating slaves %lu to %lu",
 			   (unsigned long)old_version,
@@ -929,7 +1351,8 @@ main(int argc, char **argv)
 		for (p = slaves; p != NULL; p = p->next) {
 		    if (p->flags & SLAVE_F_DEAD)
 			continue;
-		    send_diffs (context, p, log_fd, database, current_version);
+		    send_diffs (server_context, p, log_fd, database,
+                                current_version, current_tstamp);
 		}
 	    } else {
 		krb5_warnx(context,
@@ -944,7 +1367,8 @@ main(int argc, char **argv)
 	    if (ret && FD_ISSET(p->fd, &readset)) {
 		--ret;
 		assert(ret >= 0);
-		if(process_msg (context, p, log_fd, database, current_version))
+		if(process_msg (server_context, p, log_fd, database,
+				current_version, current_tstamp))
 		    slave_dead(context, p);
 	    } else if (slave_gone_p (p))
 		slave_dead(context, p);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_slave.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_slave.c
index 778004711..79a56c1a7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_slave.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/ipropd_slave.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipropd_slave.c,v 1.1.1.2 2014/04/24 12:45:48 pettai Exp $	*/
+/*	$NetBSD: ipropd_slave.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -35,10 +35,12 @@
 
 #include "iprop.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: ipropd_slave.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static const char *config_name = "ipropd-slave";
 
+static int verbose;
+
 static krb5_log_facility *log_facility;
 static char five_min[] = "5 min";
 static char *server_time_lost = five_min;
@@ -53,9 +55,10 @@ connect_to_master (krb5_context context, const char *master,
     struct addrinfo *ai, *a;
     struct addrinfo hints;
     int error;
+    int one = 1;
     int s = -1;
 
-    memset (&hints, 0, sizeof(hints));
+    memset(&hints, 0, sizeof(hints));
     hints.ai_socktype = SOCK_STREAM;
 
     if (port_str == NULL) {
@@ -63,7 +66,7 @@ connect_to_master (krb5_context context, const char *master,
 	port_str = port;
     }
 
-    error = getaddrinfo (master, port_str, &hints, &ai);
+    error = getaddrinfo(master, port_str, &hints, &ai);
     if (error) {
 	krb5_warnx(context, "Failed to get address of to %s: %s",
 		   master, gai_strerror(error));
@@ -77,24 +80,27 @@ connect_to_master (krb5_context context, const char *master,
 	if (error)
 	    strlcpy(node, "[unknown-addr]", sizeof(node));
 
-	s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
+	s = socket(a->ai_family, a->ai_socktype, a->ai_protocol);
 	if (s < 0)
 	    continue;
-	if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
+	if (connect(s, a->ai_addr, a->ai_addrlen) < 0) {
 	    krb5_warn(context, errno, "connection failed to %s[%s]",
 		      master, node);
-	    close (s);
+	    close(s);
 	    continue;
 	}
 	krb5_warnx(context, "connection successful "
 		   "to master: %s[%s]", master, node);
 	break;
     }
-    freeaddrinfo (ai);
+    freeaddrinfo(ai);
 
     if (a == NULL)
 	return -1;
 
+    if (setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one)) < 0)
+        krb5_warn(context, errno, "setsockopt(SO_KEEPALIVE) failed");
+
     return s;
 }
 
@@ -109,6 +115,7 @@ get_creds(krb5_context context, const char *keytab_str,
     krb5_creds creds;
     char *server;
     char keytab_buf[256];
+    int aret;
 
     if (keytab_str == NULL) {
 	ret = krb5_kt_default_name (context, keytab_buf, sizeof(keytab_buf));
@@ -129,8 +136,8 @@ get_creds(krb5_context context, const char *keytab_str,
     ret = krb5_get_init_creds_opt_alloc(context, &init_opts);
     if (ret) krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
 
-    asprintf (&server, "%s/%s", IPROP_NAME, serverhost);
-    if (server == NULL)
+    aret = asprintf (&server, "%s/%s", IPROP_NAME, serverhost);
+    if (aret == -1 || server == NULL)
 	krb5_errx (context, 1, "malloc: no memory");
 
     ret = krb5_get_init_creds_keytab(context, &creds, client, keytab,
@@ -145,7 +152,7 @@ get_creds(krb5_context context, const char *keytab_str,
     ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, cache);
     if(ret) krb5_err(context, 1, ret, "krb5_cc_new_unique");
 
-    ret = krb5_cc_initialize(context, *cache, client);
+    ret = krb5_cc_initialize(context, *cache, creds.client);
     if(ret) krb5_err(context, 1, ret, "krb5_cc_initialize");
 
     ret = krb5_cc_store_cred(context, *cache, &creds);
@@ -156,200 +163,331 @@ get_creds(krb5_context context, const char *keytab_str,
 }
 
 static krb5_error_code
-ihave (krb5_context context, krb5_auth_context auth_context,
-       int fd, uint32_t version)
+ihave(krb5_context context, krb5_auth_context auth_context,
+      int fd, uint32_t version)
 {
     int ret;
     u_char buf[8];
     krb5_storage *sp;
     krb5_data data;
 
-    sp = krb5_storage_from_mem (buf, 8);
-    krb5_store_int32 (sp, I_HAVE);
-    krb5_store_int32 (sp, version);
-    krb5_storage_free (sp);
+    sp = krb5_storage_from_mem(buf, 8);
+    ret = krb5_store_uint32(sp, I_HAVE);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, version);
+    krb5_storage_free(sp);
     data.length = 8;
     data.data   = buf;
 
-    ret = krb5_write_priv_message(context, auth_context, &fd, &data);
-    if (ret)
-	krb5_warn (context, ret, "krb5_write_message");
+    if (ret == 0) {
+        if (verbose)
+            krb5_warnx(context, "telling master we are at %u", version);
+
+        ret = krb5_write_priv_message(context, auth_context, &fd, &data);
+        if (ret)
+            krb5_warn(context, ret, "krb5_write_message");
+    }
     return ret;
 }
 
-static void
+#ifndef EDQUOT
+/* There's no EDQUOT on WIN32, for example */
+#define EDQUOT ENOSPC
+#endif
+
+static int
+append_to_log_file(krb5_context context,
+                   kadm5_server_context *server_context,
+                   krb5_storage *sp, off_t start, ssize_t slen)
+{
+    size_t len;
+    ssize_t sret;
+    off_t log_off;
+    int ret, ret2;
+    void *buf;
+
+    if (verbose)
+        krb5_warnx(context, "appending diffs to log");
+
+    if (slen == 0)
+        return 0;
+    if (slen < 0)
+        return EINVAL;
+    len = slen;
+    if (len != slen)
+        return EOVERFLOW;
+
+    buf = malloc(len);
+    if (buf == NULL && len != 0) {
+        krb5_warn(context, errno, "malloc: no memory");
+        return ENOMEM;
+    }
+
+    if (krb5_storage_seek(sp, start, SEEK_SET) != start) {
+        krb5_errx(context, IPROPD_RESTART,
+                  "krb5_storage_seek() failed"); /* can't happen */
+    }
+    sret = krb5_storage_read(sp, buf, len);
+    if (sret < 0)
+        return errno;
+    if (len != (size_t)sret) {
+        /* Can't happen */
+        krb5_errx(context, IPROPD_RESTART,
+                  "short krb5_storage_read() from memory buffer");
+    }
+    log_off = lseek(server_context->log_context.log_fd, 0, SEEK_CUR);
+    if (log_off == -1)
+        return errno;
+
+    /*
+     * Use net_write() so we get an errno if less that len bytes were
+     * written.
+     */
+    sret = net_write(server_context->log_context.log_fd, buf, len);
+    free(buf);
+    if (sret != slen)
+        ret = errno;
+    else
+        ret = fsync(server_context->log_context.log_fd);
+    if (ret == 0)
+        return 0;
+
+    /*
+     * Attempt to recover from this.  First, truncate the log file
+     * and reset the fd offset.  Failure to do this -> unlink the
+     * log file and re-create it.  Since we're the slave, we ought to be
+     * able to recover from the log being unlinked...
+     */
+    if (ftruncate(server_context->log_context.log_fd, log_off) == -1 ||
+        lseek(server_context->log_context.log_fd, log_off, SEEK_SET) == -1) {
+        (void) kadm5_log_end(server_context);
+        if (unlink(server_context->log_context.log_file) == -1) {
+            krb5_err(context, IPROPD_FATAL, errno,
+                     "Failed to recover from failure to write log "
+                     "entries from master to disk");
+        }
+        ret2 = kadm5_log_init(server_context);
+        if (ret2) {
+            krb5_err(context, IPROPD_RESTART_SLOW, ret2,
+                     "Failed to initialize log to recover from "
+                     "failure to write log entries from master to disk");
+        }
+    }
+    if (ret == ENOSPC || ret == EDQUOT || ret == EFBIG) {
+        /* Unlink the file in these cases. */
+        krb5_warn(context, IPROPD_RESTART_SLOW,
+                  "Failed to write log entries from master to disk");
+        (void) kadm5_log_end(server_context);
+        if (unlink(server_context->log_context.log_file) == -1) {
+            krb5_err(context, IPROPD_FATAL, errno,
+                     "Failed to recover from failure to write log "
+                     "entries from master to disk");
+        }
+        ret2 = kadm5_log_init(server_context);
+        if (ret2) {
+            krb5_err(context, IPROPD_RESTART_SLOW, ret2,
+                     "Failed to initialize log to recover from "
+                     "failure to write log entries from master to disk");
+        }
+        return ret;
+    }
+    /*
+     * All other errors we treat as fatal here.  This includes, for
+     * example, EIO and EPIPE (sorry, can't log to pipes nor sockets).
+     */
+    krb5_err(context, IPROPD_FATAL, ret,
+             "Failed to write log entries from master to disk");
+}
+
+static int
 receive_loop (krb5_context context,
 	      krb5_storage *sp,
 	      kadm5_server_context *server_context)
 {
     int ret;
-    off_t left, right;
-    void *buf;
-    int32_t vers, vers2;
-    ssize_t sret;
+    off_t left, right, off;
+    uint32_t len, vers;
+
+    if (verbose)
+        krb5_warnx(context, "receiving diffs");
 
     /*
-     * Seek to the current version of the local database.
+     * Seek to the first entry in the message from the master that is
+     * past the current version of the local database.
      */
     do {
-	int32_t len, timestamp, tmp;
-	enum kadm_ops op;
+	uint32_t timestamp;
+        uint32_t op;
 
-	if(krb5_ret_int32 (sp, &vers) != 0)
-	    return;
-	krb5_ret_int32 (sp, &timestamp);
-	krb5_ret_int32 (sp, &tmp);
-	op = tmp;
-	krb5_ret_int32 (sp, &len);
-	if ((uint32_t)vers <= server_context->log_context.version)
-	    krb5_storage_seek(sp, len + 8, SEEK_CUR);
-    } while((uint32_t)vers <= server_context->log_context.version);
+        if ((ret = krb5_ret_uint32(sp, &vers)) == HEIM_ERR_EOF) {
+            krb5_warnx(context, "master sent no new iprop entries");
+            return 0;
+        }
+
+        /*
+         * TODO We could do more to validate the entries from the master
+         * here.  And we could use/reuse more kadm5_log_*() code here.
+         *
+         * Alternatively we should trust that the master sent us exactly
+         * what we needed and just write this to the log file and let
+         * kadm5_log_recover() do the rest.
+         */
+	if (ret || krb5_ret_uint32(sp, &timestamp) != 0 ||
+            krb5_ret_uint32(sp, &op) != 0 ||
+            krb5_ret_uint32(sp, &len) != 0) {
+
+            /*
+             * This shouldn't happen.  Reconnecting probably won't help
+             * if it does happen, but by reconnecting we get a chance to
+             * connect to a new master if a new one is configured.
+             */
+            krb5_warnx(context, "iprop entries from master were truncated");
+            return EINVAL;
+        }
+	if (vers > server_context->log_context.version) {
+            break;
+        }
+        off = krb5_storage_seek(sp, 0, SEEK_CUR);
+        if (krb5_storage_seek(sp, len + 8, SEEK_CUR) != off + len + 8) {
+            krb5_warnx(context, "iprop entries from master were truncated");
+            return EINVAL;
+        }
+        if (verbose) {
+            krb5_warnx(context, "diff contains old log record version "
+                       "%u %lld %u length %u",
+                       vers, (long long)timestamp, op, len);
+        }
+    } while(vers <= server_context->log_context.version);
 
     /*
-     * Read up rest of the entires into the memory...
+     * Read the remaining entries into memory...
      */
-    left  = krb5_storage_seek (sp, -16, SEEK_CUR);
-    right = krb5_storage_seek (sp, 0, SEEK_END);
-    buf = malloc (right - left);
-    if (buf == NULL && (right - left) != 0)
-	krb5_errx (context, 1, "malloc: no memory");
+    /* SEEK_CUR is a header into the first entry we care about */
+    left  = krb5_storage_seek(sp, -16, SEEK_CUR);
+    right = krb5_storage_seek(sp, 0, SEEK_END);
+    if (right - left < 24 + len) {
+        krb5_warnx(context, "iprop entries from master were truncated");
+        return EINVAL;
+    }
 
     /*
      * ...and then write them out to the on-disk log.
      */
-    krb5_storage_seek (sp, left, SEEK_SET);
-    krb5_storage_read (sp, buf, right - left);
-    sret = write (server_context->log_context.log_fd, buf, right-left);
-    if (sret != right - left)
-	krb5_err(context, 1, errno, "Failed to write log to disk");
-    ret = fsync (server_context->log_context.log_fd);
+
+    ret = append_to_log_file(context, server_context, sp, left, right - left);
     if (ret)
-	krb5_err(context, 1, errno, "Failed to sync log to disk");
-    free (buf);
+        return ret;
 
     /*
-     * Go back to the startpoint and start to commit the entires to
-     * the database.
+     * Replay the new entries.
      */
-    krb5_storage_seek (sp, left, SEEK_SET);
-
-    for(;;) {
-	int32_t len, len2, timestamp, tmp;
-	off_t cur, cur2;
-	enum kadm_ops op;
-
-	if(krb5_ret_int32 (sp, &vers) != 0)
-	    break;
-	ret = krb5_ret_int32 (sp, &timestamp);
-	if (ret) krb5_errx(context, 1, "entry %ld: too short", (long)vers);
-	ret = krb5_ret_int32 (sp, &tmp);
-	if (ret) krb5_errx(context, 1, "entry %ld: too short", (long)vers);
-	op = tmp;
-	ret = krb5_ret_int32 (sp, &len);
-	if (ret) krb5_errx(context, 1, "entry %ld: too short", (long)vers);
-	if (len < 0)
-	    krb5_errx(context, 1, "log is corrupted, "
-		      "negative length of entry version %ld: %ld",
-		      (long)vers, (long)len);
-	cur = krb5_storage_seek(sp, 0, SEEK_CUR);
-
-	krb5_warnx (context, "replaying entry %d", (int)vers);
-
-	ret = kadm5_log_replay (server_context,
-				op, vers, len, sp);
-	if (ret) {
-	    const char *s = krb5_get_error_message(server_context->context, ret);
-	    krb5_warnx (context,
-			"kadm5_log_replay: %ld. Lost entry entry, "
-			"Database out of sync ?: %s (%d)",
-			(long)vers, s ? s : "unknown error", ret);
-	    krb5_free_error_message(context, s);
-	}
-
-	{
-	    /*
-	     * Make sure the krb5_log_replay does the right thing wrt
-	     * reading out data from the sp.
-	     */
-	    cur2 = krb5_storage_seek(sp, 0, SEEK_CUR);
-	    if (cur + len != cur2)
-		krb5_errx(context, 1,
-			  "kadm5_log_reply version: %ld didn't read the whole entry",
-			  (long)vers);
-	}
-
-	if (krb5_ret_int32 (sp, &len2) != 0)
-	    krb5_errx(context, 1, "entry %ld: postamble too short", (long)vers);
-	if(krb5_ret_int32 (sp, &vers2) != 0)
-	    krb5_errx(context, 1, "entry %ld: postamble too short", (long)vers);
-
-	if (len != len2)
-	    krb5_errx(context, 1, "entry %ld: len != len2", (long)vers);
-	if (vers != vers2)
-	    krb5_errx(context, 1, "entry %ld: vers != vers2", (long)vers);
+    if (verbose)
+        krb5_warnx(context, "replaying entries from master");
+    ret = kadm5_log_recover(server_context, kadm_recover_replay);
+    if (ret) {
+        krb5_warn(context, ret, "replay failed");
+        return ret;
     }
 
-    /*
-     * Update version
-     */
+    ret = kadm5_log_get_version(server_context, &vers);
+    if (ret) {
+        krb5_warn(context, ret,
+                  "could not get log version after applying diffs!");
+        return ret;
+    }
+    if (verbose)
+        krb5_warnx(context, "slave at version %u", vers);
 
-    server_context->log_context.version = vers;
+    if (vers != server_context->log_context.version) {
+        krb5_warnx(context, "slave's log_context version (%u) is "
+                   "inconsistent with log's version (%u)",
+                   server_context->log_context.version, vers);
+    }
+
+    return 0;
 }
 
-static void
-receive (krb5_context context,
-	 krb5_storage *sp,
-	 kadm5_server_context *server_context)
+static int
+receive(krb5_context context,
+        krb5_storage *sp,
+        kadm5_server_context *server_context)
 {
-    int ret;
+    krb5_error_code ret, ret2;
 
     ret = server_context->db->hdb_open(context,
 				       server_context->db,
 				       O_RDWR | O_CREAT, 0600);
     if (ret)
-	krb5_err (context, 1, ret, "db->open");
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->open");
 
-    receive_loop (context, sp, server_context);
+    ret2 = receive_loop(context, sp, server_context);
+    if (ret2)
+	krb5_warn(context, ret2, "receive from ipropd-master had errors");
 
-    ret = server_context->db->hdb_close (context, server_context->db);
+    ret = server_context->db->hdb_close(context, server_context->db);
     if (ret)
-	krb5_err (context, 1, ret, "db->close");
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->close");
+
+    return ret2;
 }
 
 static void
-send_im_here (krb5_context context, int fd,
-	      krb5_auth_context auth_context)
+send_im_here(krb5_context context, int fd,
+	     krb5_auth_context auth_context)
 {
     krb5_storage *sp;
     krb5_data data;
-    int ret;
+    krb5_error_code ret;
 
-    ret = krb5_data_alloc (&data, 4);
+    ret = krb5_data_alloc(&data, 4);
     if (ret)
-	krb5_err (context, 1, ret, "send_im_here");
+        krb5_err(context, IPROPD_RESTART, ret, "send_im_here");
 
     sp = krb5_storage_from_data (&data);
     if (sp == NULL)
-	krb5_errx (context, 1, "krb5_storage_from_data");
-    krb5_store_int32(sp, I_AM_HERE);
+        krb5_errx(context, IPROPD_RESTART, "krb5_storage_from_data");
+    ret = krb5_store_uint32(sp, I_AM_HERE);
     krb5_storage_free(sp);
 
-    ret = krb5_write_priv_message(context, auth_context, &fd, &data);
-    krb5_data_free(&data);
+    if (ret == 0) {
+        ret = krb5_write_priv_message(context, auth_context, &fd, &data);
+        krb5_data_free(&data);
 
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_write_priv_message");
+        if (ret)
+            krb5_err(context, IPROPD_RESTART, ret, "krb5_write_priv_message");
+
+        if (verbose)
+            krb5_warnx(context, "pinged master");
+    }
+
+    return;
 }
 
+static void
+reinit_log(krb5_context context,
+	   kadm5_server_context *server_context,
+	   uint32_t vno)
+{
+    krb5_error_code ret;
+
+    if (verbose)
+        krb5_warnx(context, "truncating log on slave");
+
+    ret = kadm5_log_reinit(server_context, vno);
+    if (ret)
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "kadm5_log_reinit");
+}
+
+
 static krb5_error_code
-receive_everything (krb5_context context, int fd,
-		    kadm5_server_context *server_context,
-		    krb5_auth_context auth_context)
+receive_everything(krb5_context context, int fd,
+		   kadm5_server_context *server_context,
+		   krb5_auth_context auth_context)
 {
     int ret;
     krb5_data data;
-    int32_t vno = 0;
-    int32_t opcode;
+    uint32_t vno = 0;
+    uint32_t opcode;
     krb5_storage *sp;
 
     char *dbname;
@@ -357,36 +495,39 @@ receive_everything (krb5_context context, int fd,
 
     krb5_warnx(context, "receive complete database");
 
-    asprintf(&dbname, "%s-NEW", server_context->db->hdb_name);
+    ret = asprintf(&dbname, "%s-NEW", server_context->db->hdb_name);
+    if (ret == -1)
+        krb5_err(context, IPROPD_RESTART, ENOMEM, "asprintf");
     ret = hdb_create(context, &mydb, dbname);
     if(ret)
-	krb5_err(context,1, ret, "hdb_create");
+        krb5_err(context, IPROPD_RESTART, ret, "hdb_create");
     free(dbname);
 
-    ret = hdb_set_master_keyfile (context,
-				  mydb, server_context->config.stash_file);
+    ret = hdb_set_master_keyfile(context,
+				 mydb, server_context->config.stash_file);
     if(ret)
-	krb5_err(context,1, ret, "hdb_set_master_keyfile");
+        krb5_err(context, IPROPD_RESTART, ret, "hdb_set_master_keyfile");
 
     /* I really want to use O_EXCL here, but given that I can't easily clean
        up on error, I won't */
     ret = mydb->hdb_open(context, mydb, O_RDWR | O_CREAT | O_TRUNC, 0600);
     if (ret)
-	krb5_err (context, 1, ret, "db->open");
+        krb5_err(context, IPROPD_RESTART, ret, "db->open");
 
     sp = NULL;
+    krb5_data_zero(&data);
     do {
 	ret = krb5_read_priv_message(context, auth_context, &fd, &data);
 
 	if (ret) {
-	    krb5_warn (context, ret, "krb5_read_priv_message");
+	    krb5_warn(context, ret, "krb5_read_priv_message");
 	    goto cleanup;
 	}
 
-	sp = krb5_storage_from_data (&data);
+	sp = krb5_storage_from_data(&data);
 	if (sp == NULL)
-	    krb5_errx (context, 1, "krb5_storage_from_data");
-	krb5_ret_int32 (sp, &opcode);
+	    krb5_errx(context, IPROPD_RESTART, "krb5_storage_from_data");
+	krb5_ret_uint32(sp, &opcode);
 	if (opcode == ONE_PRINC) {
 	    krb5_data fake_data;
 	    hdb_entry_ex entry;
@@ -398,69 +539,116 @@ receive_everything (krb5_context context, int fd,
 
 	    memset(&entry, 0, sizeof(entry));
 
-	    ret = hdb_value2entry (context, &fake_data, &entry.entry);
+	    ret = hdb_value2entry(context, &fake_data, &entry.entry);
 	    if (ret)
-		krb5_err (context, 1, ret, "hdb_value2entry");
+		krb5_err(context, IPROPD_RESTART, ret, "hdb_value2entry");
 	    ret = mydb->hdb_store(server_context->context,
 				  mydb,
 				  0, &entry);
 	    if (ret)
-		krb5_err (context, 1, ret, "hdb_store");
+		krb5_err(context, IPROPD_RESTART_SLOW, ret, "hdb_store");
 
-	    hdb_free_entry (context, &entry);
-	    krb5_data_free (&data);
+	    hdb_free_entry(context, &entry);
+	    krb5_data_free(&data);
 	} else if (opcode == NOW_YOU_HAVE)
 	    ;
 	else
-	    krb5_errx (context, 1, "strange opcode %d", opcode);
+	    krb5_errx(context, 1, "strange opcode %d", opcode);
     } while (opcode == ONE_PRINC);
 
     if (opcode != NOW_YOU_HAVE)
-	krb5_errx (context, 1, "receive_everything: strange %d", opcode);
+        krb5_errx(context, IPROPD_RESTART_SLOW,
+                  "receive_everything: strange %d", opcode);
 
-    krb5_ret_int32 (sp, &vno);
+    krb5_ret_uint32(sp, &vno);
     krb5_storage_free(sp);
 
-    ret = kadm5_log_reinit (server_context);
-    if (ret)
-	krb5_err(context, 1, ret, "kadm5_log_reinit");
+    reinit_log(context, server_context, vno);
 
-    ret = kadm5_log_set_version (server_context, vno - 1);
+    ret = mydb->hdb_close(context, mydb);
     if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_set_version");
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->close");
 
-    ret = kadm5_log_nop (server_context);
+    ret = mydb->hdb_rename(context, mydb, server_context->db->hdb_name);
     if (ret)
-	krb5_err (context, 1, ret, "kadm5_log_nop");
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->rename");
 
-    ret = mydb->hdb_rename (context, mydb, server_context->db->hdb_name);
-    if (ret)
-	krb5_err (context, 1, ret, "db->rename");
+
+    return 0;
 
  cleanup:
-    krb5_data_free (&data);
+    krb5_data_free(&data);
 
-    ret = mydb->hdb_close (context, mydb);
     if (ret)
-	krb5_err (context, 1, ret, "db->close");
+        krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->close");
 
-    ret = mydb->hdb_destroy (context, mydb);
+    ret = mydb->hdb_destroy(context, mydb);
     if (ret)
-	krb5_err (context, 1, ret, "db->destroy");
+        krb5_err(context, IPROPD_RESTART, ret, "db->destroy");
 
     krb5_warnx(context, "receive complete database, version %ld", (long)vno);
     return ret;
 }
 
+static void
+slave_status(krb5_context context,
+	     const char *file,
+	     const char *status, ...)
+     __attribute__ ((__format__ (__printf__, 3, 4)));
+
+
+static void
+slave_status(krb5_context context,
+	     const char *file,
+	     const char *fmt, ...)
+{
+    char *status;
+    char *fmt2;
+    va_list args;
+    int len;
+    
+    if (asprintf(&fmt2, "%s\n", fmt) == -1 || fmt2 == NULL) {
+        (void) unlink(file);
+        return;
+    }
+    va_start(args, fmt);
+    len = vasprintf(&status, fmt2, args);
+    free(fmt2);
+    va_end(args);
+    if (len < 0 || status == NULL) {
+	(void) unlink(file);
+	return;
+    }
+    krb5_warnx(context, "slave status change: %s", status);
+    
+    rk_dumpdata(file, status, len);
+    free(status);
+}
+
+static void
+is_up_to_date(krb5_context context, const char *file,
+	      kadm5_server_context *server_context)
+{
+    krb5_error_code ret;
+    char buf[80];
+    ret = krb5_format_time(context, time(NULL), buf, sizeof(buf), 1);
+    if (ret) {
+	unlink(file);
+	return;
+    }
+    slave_status(context, file, "up-to-date with version: %lu at %s",
+		 (unsigned long)server_context->log_context.version, buf);
+}
+
+static char *status_file;
 static char *config_file;
 static char *realm;
 static int version_flag;
 static int help_flag;
 static char *keytab_str;
 static char *port_str;
-#ifdef SUPPORT_DETACH
-static int detach_from_console = 0;
-#endif
+static int detach_from_console;
+static int daemon_child = -1;
 
 static struct getargs args[] = {
     { "config-file", 'c', arg_string, &config_file, NULL, NULL },
@@ -469,14 +657,17 @@ static struct getargs args[] = {
       "keytab to get authentication from", "kspec" },
     { "time-lost", 0, arg_string, &server_time_lost,
       "time before server is considered lost", "time" },
+    { "status-file", 0, arg_string, &status_file,
+      "file to write out status into", "file" },
     { "port", 0, arg_string, &port_str,
       "port ipropd-slave will connect to", "port"},
-#ifdef SUPPORT_DETACH
     { "detach", 0, arg_flag, &detach_from_console,
       "detach from console", NULL },
-#endif
+    { "daemon-child",       0 ,      arg_integer, &daemon_child,
+      "private argument, do not use", NULL },
     { "hostname", 0, arg_string, rk_UNCONST(&slave_str),
       "hostname of slave (if not same as hostname)", "hostname" },
+    { "verbose", 0, arg_flag, &verbose, NULL, NULL },
     { "version", 0, arg_flag, &version_flag, NULL, NULL },
     { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
@@ -493,7 +684,7 @@ usage(int status)
 int
 main(int argc, char **argv)
 {
-    krb5_error_code ret;
+    krb5_error_code ret, ret2;
     krb5_context context;
     krb5_auth_context auth_context;
     void *kadm_handle;
@@ -509,21 +700,27 @@ main(int argc, char **argv)
     time_t reconnect_max;
     time_t reconnect;
     time_t before = 0;
+    int restarter_fd = -1;
 
     const char *master;
 
     setprogname(argv[0]);
 
-    if(getarg(args, num_args, argc, argv, &optidx))
+    if (getarg(args, num_args, argc, argv, &optidx))
 	usage(1);
 
-    if(help_flag)
+    if (help_flag)
 	usage(0);
-    if(version_flag) {
+
+    if (version_flag) {
 	print_version(NULL);
 	exit(0);
     }
 
+    if (detach_from_console && daemon_child == -1)
+        roken_detach_prep(argc, argv, "--daemon-child");
+    rk_pidfile(NULL);
+
     ret = krb5_init_context(&context);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
@@ -553,15 +750,17 @@ main(int argc, char **argv)
 
     master = argv[0];
 
-#ifdef SUPPORT_DETACH
-    if (detach_from_console)
-	daemon(0, 0);
-#endif
-    pidfile (NULL);
-    krb5_openlog (context, "ipropd-slave", &log_facility);
+    if (status_file == NULL) {
+	if (asprintf(&status_file,  "%s/ipropd-slave-status", hdb_db_dir(context)) < 0 || status_file == NULL)
+	    krb5_errx(context, 1, "can't allocate status file buffer"); 
+    }
+
+    krb5_openlog(context, "ipropd-slave", &log_facility);
     krb5_set_warn_dest(context, log_facility);
 
-    ret = krb5_kt_register(context, &hdb_kt_ops);
+    slave_status(context, status_file, "bootstrapping");
+
+    ret = krb5_kt_register(context, &hdb_get_kt_ops);
     if(ret)
 	krb5_err(context, 1, ret, "krb5_kt_register");
 
@@ -569,6 +768,8 @@ main(int argc, char **argv)
     if (time_before_lost < 0)
 	krb5_errx (context, 1, "couldn't parse time: %s", server_time_lost);
 
+    slave_status(context, status_file, "getting credentials from keytab/database");
+
     memset(&conf, 0, sizeof(conf));
     if(realm) {
 	conf.mask |= KADM5_CONFIG_REALM;
@@ -585,6 +786,8 @@ main(int argc, char **argv)
 
     server_context = (kadm5_server_context *)kadm_handle;
 
+    slave_status(context, status_file, "creating log file");
+
     ret = kadm5_log_init (server_context);
     if (ret)
 	krb5_err (context, 1, ret, "kadm5_log_init");
@@ -607,10 +810,26 @@ main(int argc, char **argv)
 			 10, &backoff);
     reconnect = reconnect_min;
 
+    slave_status(context, status_file, "ipropd-slave started");
+
+    roken_detach_finish(NULL, daemon_child);
+    restarter_fd = restarter(context, NULL);
+
     while (!exit_flag) {
+        struct timeval to;
 	time_t now, elapsed;
+        fd_set readset;
 	int connected = FALSE;
 
+#ifndef NO_LIMIT_FD_SETSIZE
+        if (restarter_fd >= FD_SETSIZE)
+            krb5_errx(context, IPROPD_RESTART, "fd too large");
+#endif
+
+        FD_ZERO(&readset);
+        if (restarter_fd > -1)
+            FD_SET(restarter_fd, &readset);
+
 	now = time(NULL);
 	elapsed = now - before;
 
@@ -618,10 +837,17 @@ main(int argc, char **argv)
 	    time_t left = reconnect - elapsed;
 	    krb5_warnx(context, "sleeping %d seconds before "
 		       "retrying to connect", (int)left);
-	    sleep(left);
+            to.tv_sec = left;
+            to.tv_usec = 0;
+            if (select(restarter_fd + 1, &readset, NULL, NULL, &to) == 1) {
+                exit_flag = SIGTERM;
+                continue;
+            }
 	}
 	before = now;
 
+	slave_status(context, status_file, "connecting to master: %s\n", master);
+
 	master_fd = connect_to_master (context, master, port_str);
 	if (master_fd < 0)
 	    goto retry;
@@ -634,6 +860,8 @@ main(int argc, char **argv)
 	    krb5_cc_destroy(context, ccache);
 	    get_creds(context, keytab_str, &ccache, master);
 	}
+        if (verbose)
+            krb5_warnx(context, "authenticating to master");
 	ret = krb5_sendauth (context, &auth_context, &master_fd,
 			     IPROP_VERSION, NULL, server,
 			     AP_OPTS_MUTUAL_REQUIRED, NULL, NULL,
@@ -646,32 +874,41 @@ main(int argc, char **argv)
 	krb5_warnx(context, "ipropd-slave started at version: %ld",
 		   (long)server_context->log_context.version);
 
-	ret = ihave (context, auth_context, master_fd,
-		     server_context->log_context.version);
+	ret = ihave(context, auth_context, master_fd,
+		    server_context->log_context.version);
 	if (ret)
 	    goto retry;
 
 	connected = TRUE;
 
+        if (verbose)
+            krb5_warnx(context, "connected to master");
+
+	slave_status(context, status_file, "connected to master, waiting instructions");
+
 	while (connected && !exit_flag) {
 	    krb5_data out;
 	    krb5_storage *sp;
-	    int32_t tmp;
-	    fd_set readset;
-	    struct timeval to;
+	    uint32_t tmp;
+            int max_fd;
 
 #ifndef NO_LIMIT_FD_SETSIZE
 	    if (master_fd >= FD_SETSIZE)
-		krb5_errx (context, 1, "fd too large");
+                krb5_errx(context, IPROPD_RESTART, "fd too large");
+            if (restarter_fd >= FD_SETSIZE)
+                krb5_errx(context, IPROPD_RESTART, "fd too large");
+            max_fd = max(restarter_fd, master_fd);
 #endif
 
 	    FD_ZERO(&readset);
 	    FD_SET(master_fd, &readset);
+            if (restarter_fd != -1)
+                FD_SET(restarter_fd, &readset);
 
 	    to.tv_sec = time_before_lost;
 	    to.tv_usec = 0;
 
-	    ret = select (master_fd + 1,
+	    ret = select (max_fd + 1,
 			  &readset, NULL, NULL, &to);
 	    if (ret < 0) {
 		if (errno == EINTR)
@@ -679,35 +916,101 @@ main(int argc, char **argv)
 		else
 		    krb5_err (context, 1, errno, "select");
 	    }
-	    if (ret == 0)
-		krb5_errx (context, 1, "server didn't send a message "
-			   "in %d seconds", time_before_lost);
+	    if (ret == 0) {
+		krb5_warnx(context, "server didn't send a message "
+                           "in %d seconds", time_before_lost);
+		connected = FALSE;
+		continue;
+	    }
+
+            if (restarter_fd > -1 && FD_ISSET(restarter_fd, &readset)) {
+                if (verbose)
+                    krb5_warnx(context, "slave restarter exited");
+                exit_flag = SIGTERM;
+            }
+
+            if (!FD_ISSET(master_fd, &readset))
+                continue;
+
+            if (verbose)
+                krb5_warnx(context, "message from master");
 
 	    ret = krb5_read_priv_message(context, auth_context, &master_fd, &out);
 	    if (ret) {
-		krb5_warn (context, ret, "krb5_read_priv_message");
+		krb5_warn(context, ret, "krb5_read_priv_message");
 		connected = FALSE;
 		continue;
 	    }
 
 	    sp = krb5_storage_from_mem (out.data, out.length);
-	    krb5_ret_int32 (sp, &tmp);
+            if (sp == NULL)
+                krb5_err(context, IPROPD_RESTART, errno, "krb5_storage_from_mem");
+	    ret = krb5_ret_uint32(sp, &tmp);
+            if (ret == HEIM_ERR_EOF) {
+                krb5_warn(context, ret, "master sent zero-length message");
+                connected = FALSE;
+                continue;
+            }
+            if (ret != 0) {
+                krb5_warn(context, ret, "couldn't read master's message");
+                connected = FALSE;
+                continue;
+            }
+
+            ret = kadm5_log_init(server_context);
+            if (ret) {
+                krb5_err(context, IPROPD_RESTART, ret, "kadm5_log_init while "
+                         "handling a message from the master");
+            }
 	    switch (tmp) {
 	    case FOR_YOU :
-		receive (context, sp, server_context);
-		ret = ihave (context, auth_context, master_fd,
-			     server_context->log_context.version);
-		if (ret)
+                if (verbose)
+                    krb5_warnx(context, "master sent us diffs");
+		ret2 = receive(context, sp, server_context);
+                if (ret2)
+                    krb5_warn(context, ret2,
+                              "receive from ipropd-master had errors");
+		ret = ihave(context, auth_context, master_fd,
+			    server_context->log_context.version);
+		if (ret || ret2)
 		    connected = FALSE;
+
+                /*
+                 * If it returns an error, receive() may nonetheless
+                 * have committed some entries successfully, so we must
+                 * update the slave_status even if there were errors.
+                 */
+                is_up_to_date(context, status_file, server_context);
 		break;
 	    case TELL_YOU_EVERYTHING :
-		ret = receive_everything (context, master_fd, server_context,
-					  auth_context);
-		if (ret)
+                if (verbose)
+                    krb5_warnx(context, "master sent us a full dump");
+		ret = receive_everything(context, master_fd, server_context,
+					 auth_context);
+                if (ret == 0) {
+                    ret = ihave(context, auth_context, master_fd,
+                                server_context->log_context.version);
+                }
+                if (ret)
 		    connected = FALSE;
+                else
+                    is_up_to_date(context, status_file, server_context);
 		break;
 	    case ARE_YOU_THERE :
-		send_im_here (context, master_fd, auth_context);
+                if (verbose)
+                    krb5_warnx(context, "master sent us a ping");
+		is_up_to_date(context, status_file, server_context);
+                ret = ihave(context, auth_context, master_fd,
+                            server_context->log_context.version);
+                if (ret)
+                    connected = FALSE;
+
+		send_im_here(context, master_fd, auth_context);
+		break;
+	    case YOU_HAVE_LAST_VERSION:
+                if (verbose)
+                    krb5_warnx(context, "master tells us we are up to date");
+		is_up_to_date(context, status_file, server_context);
 		break;
 	    case NOW_YOU_HAVE :
 	    case I_HAVE :
@@ -721,9 +1024,12 @@ main(int argc, char **argv)
 	    krb5_data_free (&out);
 
 	}
+
+	slave_status(context, status_file, "disconnected from master");
     retry:
 	if (connected == FALSE)
 	    krb5_warnx (context, "disconnected for server");
+
 	if (exit_flag)
 	    krb5_warnx (context, "got an exit signal");
 
@@ -731,8 +1037,15 @@ main(int argc, char **argv)
 	    close(master_fd);
 
 	reconnect += backoff;
-	if (reconnect > reconnect_max)
+	if (reconnect > reconnect_max) {
+	    slave_status(context, status_file, "disconnected from master for a long time");
 	    reconnect = reconnect_max;
+	}
+    }
+
+    if (status_file) {
+        /* XXX It'd be better to leave it saying we're not here */
+	unlink(status_file);
     }
 
     if (0);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5-pwcheck.h b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5-pwcheck.h
index e8fb9fb19..0a047fc69 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5-pwcheck.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5-pwcheck.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadm5-pwcheck.h,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $	*/
+/*	$NetBSD: kadm5-pwcheck.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_err.et b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_err.et
index 86b453dc6..c390dc1d6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_err.et
@@ -57,3 +57,13 @@ error_code AUTH_CHANGEPW,	"Operation requires `change-password' privilege"
 error_code BAD_TL_TYPE,		"Invalid tagged data list element type"
 error_code MISSING_CONF_PARAMS,	"Required parameters in kdc.conf missing"
 error_code BAD_SERVER_NAME,	"Bad krb5 admin server hostname"
+error_code KS_TUPLE_NOSUPP,	"Key/salt tuples not supported by this function"
+error_code SETKEY3_ETYPE_MISMATCH,	"Key/salt tuples don't match keys"
+error_code DECRYPT_USAGE_NOSUPP,	"Given usage of kadm5_decrypt() not supported"
+error_code POLICY_OP_NOSUPP,	"Policy operations not supported"
+error_code KEEPOLD_NOSUPP,	"Keep old keys option not supported"
+error_code AUTH_GET_KEYS,	"Operation requires `get-keys' privilege"
+error_code ALREADY_LOCKED,	"Database already locked"
+error_code NOT_LOCKED,		"Database not locked"
+error_code LOG_CORRUPT,		"Incremental propagation log got corrupted"
+error_code LOG_NEEDS_UPGRADE,	"Incremental propagation log must be upgraded"
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_locl.h b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_locl.h
index bc4f34612..22f37d3b8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kadm5_locl.h,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $	*/
+/*	$NetBSD: kadm5_locl.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
@@ -40,6 +40,7 @@
 
 #include <config.h>
 #include <krb5/roken.h>
+#include <krb5/heimbase.h>
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_pwcheck.3 b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_pwcheck.3
index 9201a8041..8b7495e0e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_pwcheck.3
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/kadm5_pwcheck.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kadm5_pwcheck.3,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $
+.\"	$NetBSD: kadm5_pwcheck.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/keys.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/keys.c
index 56b9bfd14..c86625e96 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/keys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/keys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keys.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
  * free all the memory used by (len, keys)
@@ -65,16 +65,18 @@ _kadm5_init_keys (Key *keys, int len)
     }
 }
 
+
 /*
  * return 1 if any key in `keys1, len1' exists in `keys2, len2'
  */
-
-int
+static int
 _kadm5_exists_keys(Key *keys1, int len1, Key *keys2, int len2)
 {
-    int i, j;
+    size_t i, j;
+    size_t optimize;
 
     for (i = 0; i < len1; ++i) {
+	optimize = 0;
 	for (j = 0; j < len2; j++) {
 	    if ((keys1[i].salt != NULL && keys2[j].salt == NULL)
 		|| (keys1[i].salt == NULL && keys2[j].salt != NULL))
@@ -91,6 +93,7 @@ _kadm5_exists_keys(Key *keys1, int len1, Key *keys2, int len2)
 	    }
 	    if (keys1[i].key.keytype != keys2[j].key.keytype)
 		continue;
+	    optimize = 1;
 	    if (keys1[i].key.keyvalue.length != keys2[j].key.keyvalue.length)
 		continue;
 	    if (memcmp (keys1[i].key.keyvalue.data, keys2[j].key.keyvalue.data,
@@ -99,6 +102,33 @@ _kadm5_exists_keys(Key *keys1, int len1, Key *keys2, int len2)
 
 	    return 1;
 	}
+
+	/*
+	 * Optimization: no need to check all of keys1[] if one there
+	 * was one key in keys2[] with matching enctype and salt but not
+	 * matching key.  Assumption: all keys in keys1[] and keys2[]
+	 * are output by string2key.
+	 */
+	if (optimize)
+	    return 0;
     }
     return 0;
 }
+
+/*
+ * return 1 if any key in `keys1, len1' exists in hist_keys
+ */
+int
+_kadm5_exists_keys_hist(Key *keys1, int len1, HDB_Ext_KeySet *hist_keys)
+{
+    size_t i;
+
+    for (i = 0; i < hist_keys->len; i++) {
+	if (_kadm5_exists_keys(keys1, len1,
+			       hist_keys->val[i].keys.val,
+			       hist_keys->val[i].keys.len))
+	    return 1;
+    }
+
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/libkadm5srv-exports.def b/crypto/external/bsd/heimdal/dist/lib/kadm5/libkadm5srv-exports.def
index ad5fa37e9..ecffbb91c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/libkadm5srv-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/libkadm5srv-exports.def
@@ -2,16 +2,26 @@ EXPORTS
 ;!	kadm5_ad_init_with_password
 ;!	kadm5_ad_init_with_password_ctx
 	kadm5_add_passwd_quality_verifier
+	kadm5_all_keys_are_bogus
 	kadm5_check_password_quality
 	kadm5_chpass_principal
+	kadm5_chpass_principal_3
 	kadm5_chpass_principal_with_key
+	kadm5_chpass_principal_with_key_3
+        kadm5_create_policy
 	kadm5_create_principal
+	kadm5_create_principal_3
+        kadm5_decrypt_key
+        kadm5_delete_policy
 	kadm5_delete_principal
 	kadm5_destroy
 	kadm5_flush
 	kadm5_free_key_data
 	kadm5_free_name_list
+        kadm5_free_policy_ent
 	kadm5_free_principal_ent
+        kadm5_get_policies
+        kadm5_get_policy
 	kadm5_get_principal
 	kadm5_get_principals
 	kadm5_get_privs
@@ -21,18 +31,26 @@ EXPORTS
 	kadm5_init_with_password_ctx
 	kadm5_init_with_skey
 	kadm5_init_with_skey_ctx
+        kadm5_lock
+        kadm5_modify_policy
 	kadm5_modify_principal
 	kadm5_randkey_principal
+	kadm5_randkey_principal_3
 	kadm5_rename_principal
 	kadm5_ret_key_data
 	kadm5_ret_principal_ent
 	kadm5_ret_principal_ent_mask
 	kadm5_ret_tl_data
+        kadm5_setkey_principal
+        kadm5_setkey_principal_3
 	kadm5_setup_passwd_quality_check
+	kadm5_some_keys_are_bogus
 	kadm5_store_key_data
 	kadm5_store_principal_ent
 	kadm5_store_principal_ent_mask
+        kadm5_store_principal_ent_nokeys
 	kadm5_store_tl_data
+        kadm5_unlock
 	kadm5_s_init_with_password_ctx
 	kadm5_s_init_with_password
 	kadm5_s_init_with_skey_ctx
@@ -41,6 +59,7 @@ EXPORTS
 	kadm5_s_init_with_creds
 	kadm5_s_chpass_principal_cond
 	kadm5_log_set_version
+	kadm5_log_signal_master
 ;!	kadm5_log_signal_socket
 	kadm5_log_signal_socket_info    ;!
 	kadm5_log_previous
@@ -48,10 +67,14 @@ EXPORTS
 	kadm5_log_foreach
 	kadm5_log_get_version_fd
 	kadm5_log_get_version
+	kadm5_log_recover
 	kadm5_log_replay
 	kadm5_log_end
 	kadm5_log_reinit
 	kadm5_log_init
+	kadm5_log_init_nb
+	kadm5_log_init_nolock
+	kadm5_log_init_sharedlock
 	kadm5_log_nop
 	kadm5_log_truncate
 	kadm5_log_modify
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/log.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/log.c
index 17c6de44a..dc40579cd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/log.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/log.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: log.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: log.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -36,53 +36,522 @@
 #include "kadm5_locl.h"
 #include "heim_threads.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: log.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
- * A log record consists of:
+ * A log consists of a sequence of records of this form:
  *
- * version number		4 bytes
- * time in seconds		4 bytes
- * operation (enum kadm_ops)	4 bytes
- * length of record		4 bytes
- * data...			n bytes
- * length of record		4 bytes
- * version number		4 bytes
+ * version number		4 bytes -\
+ * time in seconds		4 bytes   +> preamble --+> header
+ * operation (enum kadm_ops)	4 bytes -/             /
+ * n, length of payload		4 bytes --------------+
+ *      PAYLOAD DATA...		n bytes
+ * n, length of payload		4 bytes ----------------+> trailer
+ * version number		4 bytes ->postamble ---/
  *
+ * I.e., records have a header and a trailer so that knowing the offset
+ * of an record's start or end one can traverse the log forwards and
+ * backwards.
+ *
+ * The log always starts with a nop record (uber record) that contains the
+ * offset (8 bytes) of the first unconfirmed record (typically EOF), and the
+ * version number and timestamp of the preceding last confirmed record:
+ *
+ * offset of next new record    8 bytes
+ * last record time             4 bytes
+ * last record version number   4 bytes
+ *
+ * When an iprop slave receives a complete database, it saves that version as
+ * the last confirmed version, without writing any other records to the log.  We
+ * use that version as the basis for further updates.
+ *
+ * kadm5 write operations are done in this order:
+ *
+ *  - replay unconfirmed log records
+ *  - write (append) and fsync() the log record for the kadm5 update
+ *  - update the HDB (which includes fsync() or moral equivalent)
+ *  - update the log uber record to mark the log record written as
+ *    confirmed (not fsync()ed)
+ *
+ * This makes it possible and safe to seek to the logical end of the log
+ * (that is, the end of the last confirmed record) without traversing
+ * the whole log forward from offset zero.  Unconfirmed records (which
+ * -currently- should never be more than one) can then be found (and
+ * rolled forward) by traversing forward from the logical end of the
+ * log.  The trailers make it possible to traverse the log backwards
+ * from the logical end.
+ *
+ * This also makes the log + the HDB a two-phase commit with
+ * roll-forward system.
+ *
+ * HDB entry exists and HDB entry does not exist errors occurring during
+ * replay of unconfirmed records are ignored.  This is because the
+ * corresponding HDB update might have completed.  But also because a
+ * change to add aliases to a principal can fail because we don't check
+ * for alias conflicts before going ahead with the write operation.
+ *
+ * Non-sensical and incomplete log records found during roll-forward are
+ * truncated.  A log record is non-sensical if its header and trailer
+ * don't match.
+ *
+ * Recovery (by rolling forward) occurs at the next read or write by a
+ * kadm5 API reader (e.g., kadmin), but not by an hdb API reader (e.g.,
+ * the KDC).  This means that, e.g., a principal rename could fail in
+ * between the store and the delete, and recovery might not take place
+ * until the next write operation.
+ *
+ * The log record payload format for create is:
+ *
+ * DER-encoded HDB_entry        n bytes
+ *
+ * The log record payload format for update is:
+ *
+ * mask                         4 bytes
+ * DER-encoded HDB_entry        n-4 bytes
+ *
+ * The log record payload format for delete is:
+ *
+ * krb5_store_principal         n bytes
+ *
+ * The log record payload format for rename is:
+ *
+ * krb5_store_principal         m bytes (old principal name)
+ * DER-encoded HDB_entry        n-m bytes (new record)
+ *
+ * The log record payload format for nop varies:
+ *
+ *  - The zeroth record in new logs is a nop with a 16 byte payload:
+ *
+ *    offset of end of last confirmed record        8 bytes
+ *    timestamp of last confirmed record            4 bytes
+ *    version number of last confirmed record       4 bytes
+ *
+ *  - New non-zeroth nop records:
+ *
+ *    nop type                                      4 bytes
+ *
+ *  - Old nop records:
+ *
+ *    version number                                4 bytes
+ *    timestamp                                     4 bytes
+ *
+ * Upon initialization, the log's uber record will have version 1, and
+ * will be followed by a nop record with version 2.  The version numbers
+ * of additional records will be monotonically increasing.
+ *
+ * Truncation (kadm5_log_truncate()) takes some N > 0 records from the
+ * tail of the log and writes them to the beginning of the log after an
+ * uber record whose version will then be one less than the first of
+ * those records.
+ *
+ * On masters the log should never have more than one unconfirmed
+ * record, but slaves append all of a master's "diffs" and then call
+ * kadm5_log_recover() to recover.
  */
 
-kadm5_ret_t
-kadm5_log_get_version_fd (int fd,
-			  uint32_t *ver)
-{
-    int ret;
-    krb5_storage *sp;
-    int32_t old_version;
+/*
+ * HDB and log lock order on the master:
+ *
+ * 1) open and lock the HDB
+ * 2) open and lock the log
+ * 3) do something
+ * 4) unlock and close the log
+ * 5) repeat (2)..(4) if desired
+ * 6) unlock and close the HDB
+ *
+ * The kadmin -l lock command can be used to hold the HDB open and
+ * locked for multiple operations.
+ *
+ * HDB and log lock order on the slave:
+ *
+ * 1) open and lock the log
+ * 2) open and lock the HDB
+ * 3) replay entries
+ * 4) unlock and close the HDB
+ * 5) repeat (2)..(4) until signaled
+ * 6) unlock and close the HDB
+ *
+ * The slave doesn't want to allow other local writers, after all, thus
+ * the order is reversed.  This means that using "kadmin -l" on a slave
+ * will deadlock with ipropd-slave -- don't do that.
+ */
 
-    ret = lseek (fd, 0, SEEK_END);
-    if(ret < 0)
-	return errno;
-    if(ret == 0) {
-	*ver = 0;
-	return 0;
+#define LOG_HEADER_SZ   ((off_t)(sizeof(uint32_t) * 4))
+#define LOG_TRAILER_SZ  ((off_t)(sizeof(uint32_t) * 2))
+#define LOG_WRAPPER_SZ  ((off_t)(LOG_HEADER_SZ + LOG_TRAILER_SZ))
+#define LOG_UBER_LEN    ((off_t)(sizeof(uint64_t) + sizeof(uint32_t) * 2))
+#define LOG_UBER_SZ     ((off_t)(LOG_WRAPPER_SZ + LOG_UBER_LEN))
+
+#define LOG_NOPEEK 0
+#define LOG_DOPEEK 1
+
+/*
+ * Read the header of the record starting at the current offset into sp.
+ *
+ * Preserves sp's offset on success if `peek', else skips the header.
+ *
+ * Preserves sp's offset on failure where possible.
+ */
+static kadm5_ret_t
+get_header(krb5_storage *sp, int peek, uint32_t *verp, uint32_t *tstampp,
+           enum kadm_ops *opp, uint32_t *lenp)
+{
+    krb5_error_code ret;
+    uint32_t tstamp, op, len;
+    off_t off, new_off;
+
+    if (tstampp == NULL)
+        tstampp = &tstamp;
+    if (lenp == NULL)
+        lenp = &len;
+
+    *verp = 0;
+    *tstampp = 0;
+    if (opp != NULL)
+        *opp = kadm_nop;
+    *lenp = 0;
+
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off < 0)
+        return errno;
+    ret = krb5_ret_uint32(sp, verp);
+    if (ret == HEIM_ERR_EOF) {
+        (void) krb5_storage_seek(sp, off, SEEK_SET);
+        return HEIM_ERR_EOF;
     }
-    sp = krb5_storage_from_fd (fd);
-    krb5_storage_seek(sp, -4, SEEK_CUR);
-    krb5_ret_int32 (sp, &old_version);
-    *ver = old_version;
-    krb5_storage_free(sp);
-    lseek (fd, 0, SEEK_END);
+    if (ret)
+        goto log_corrupt;
+    ret = krb5_ret_uint32(sp, tstampp);
+    if (ret)
+        goto log_corrupt;
+
+    /* Note: sizeof(*opp) might not == sizeof(op) */
+    ret = krb5_ret_uint32(sp, &op);
+    if (ret)
+        goto log_corrupt;
+    if (opp != NULL)
+        *opp = op;
+
+    ret = krb5_ret_uint32(sp, lenp);
+    if (ret)
+        goto log_corrupt;
+
+    /* Restore offset if requested */
+    if (peek == LOG_DOPEEK) {
+        new_off = krb5_storage_seek(sp, off, SEEK_SET);
+        if (new_off == -1)
+            return errno;
+        if (new_off != off)
+            return EIO;
+    }
+
+    return 0;
+
+log_corrupt:
+    (void) krb5_storage_seek(sp, off, SEEK_SET);
+    return KADM5_LOG_CORRUPT;
+}
+
+/*
+ * Seek to the start of the preceding record's header and returns its
+ * offset.  If sp is at offset zero this sets *verp = 0 and returns 0.
+ *
+ * Does not verify the header of the previous entry.
+ *
+ * On error returns -1, setting errno (possibly to a kadm5_ret_t or
+ * krb5_error_code value) and preserves sp's offset where possible.
+ */
+static off_t
+seek_prev(krb5_storage *sp, uint32_t *verp, uint32_t *lenp)
+{
+    krb5_error_code ret;
+    uint32_t len, ver;
+    off_t off_len;
+    off_t off, new_off;
+
+    if (lenp == NULL)
+        lenp = &len;
+    if (verp == NULL)
+        verp = &ver;
+
+    *verp = 0;
+    *lenp = 0;
+
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off < 0)
+        return off;
+    if (off == 0)
+        return 0;
+
+    /* Check that `off' allows for the record's header and trailer */
+    if (off < LOG_WRAPPER_SZ)
+        goto log_corrupt;
+
+    /* Get the previous entry's length and version from its trailer */
+    new_off = krb5_storage_seek(sp, -8, SEEK_CUR);
+    if (new_off == -1)
+        return -1;
+    if (new_off != off - 8) {
+        errno = EIO;
+        return -1;
+    }
+    ret = krb5_ret_uint32(sp, lenp);
+    if (ret)
+        goto log_corrupt;
+
+    /* Check for overflow/sign extension */
+    off_len = (off_t)*lenp;
+    if (off_len < 0 || *lenp != (uint32_t)off_len)
+        goto log_corrupt;
+
+    ret = krb5_ret_uint32(sp, verp);
+    if (ret)
+        goto log_corrupt;
+
+    /* Check that `off' allows for the record */
+    if (off < LOG_WRAPPER_SZ + off_len)
+        goto log_corrupt;
+
+    /* Seek backwards to the entry's start */
+    new_off = krb5_storage_seek(sp, -(LOG_WRAPPER_SZ + off_len), SEEK_CUR);
+    if (new_off == -1)
+        return -1;
+    if (new_off != off - (LOG_WRAPPER_SZ + off_len)) {
+        errno = EIO;
+        return -1;
+    }
+    return new_off;
+
+log_corrupt:
+    (void) krb5_storage_seek(sp, off, SEEK_SET);
+    errno = KADM5_LOG_CORRUPT;
+    return -1;
+}
+
+/*
+ * Seek to the start of the next entry's header.
+ *
+ * On error returns -1 and preserves sp's offset.
+ */
+static off_t
+seek_next(krb5_storage *sp)
+{
+    krb5_error_code ret;
+    uint32_t ver, ver2, len, len2;
+    enum kadm_ops op;
+    uint32_t tstamp;
+    off_t off, off_len, new_off;
+
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off < 0)
+        return off;
+
+    errno = get_header(sp, LOG_NOPEEK, &ver, &tstamp, &op, &len);
+    if (errno)
+        return -1;
+
+    /* Check for overflow */
+    off_len = len;
+    if (off_len < 0)
+        goto log_corrupt;
+
+    new_off = krb5_storage_seek(sp, off_len, SEEK_CUR);
+    if (new_off == -1) {
+        (void) krb5_storage_seek(sp, off, SEEK_SET);
+        return -1;
+    }
+    if (new_off != off + LOG_HEADER_SZ + off_len)
+        goto log_corrupt;
+    ret = krb5_ret_uint32(sp, &len2);
+    if (ret || len2 != len)
+        goto log_corrupt;
+    ret = krb5_ret_uint32(sp, &ver2);
+    if (ret || ver2 != ver)
+        goto log_corrupt;
+    new_off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (new_off == -1) {
+        (void) krb5_storage_seek(sp, off, SEEK_SET);
+        return -1;
+    }
+    if (new_off != off + off_len + LOG_WRAPPER_SZ)
+        goto log_corrupt;
+
+    return off + off_len + LOG_WRAPPER_SZ;
+
+log_corrupt:
+    (void) krb5_storage_seek(sp, off, SEEK_SET);
+    errno = KADM5_LOG_CORRUPT;
+    return -1;
+}
+
+/*
+ * Get the version of the entry ending at the current offset into sp.
+ * If it is the uber record, return its nominal version instead.
+ *
+ * Returns HEIM_ERR_EOF if sp is at offset zero.
+ *
+ * Preserves sp's offset.
+ */
+static kadm5_ret_t
+get_version_prev(krb5_storage *sp, uint32_t *verp, uint32_t *tstampp)
+{
+    krb5_error_code ret;
+    uint32_t ver, ver2, len, len2;
+    off_t off, prev_off, new_off;
+
+    *verp = 0;
+    if (tstampp != NULL)
+        *tstampp = 0;
+
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off < 0)
+        return errno;
+    if (off == 0)
+        return HEIM_ERR_EOF;
+
+    /* Read the trailer and seek back */
+    prev_off = seek_prev(sp, &ver, &len);
+    if (prev_off == -1)
+        return errno;
+
+    /* Uber record? Return nominal version. */
+    if (prev_off == 0 && len == LOG_UBER_LEN && ver == 0) {
+        /* Skip 8 byte offset and 4 byte time */
+        if (krb5_storage_seek(sp, LOG_HEADER_SZ + 12, SEEK_SET)
+            != LOG_HEADER_SZ + 12)
+            return errno;
+        ret = krb5_ret_uint32(sp, verp);
+        if (krb5_storage_seek(sp, 0, SEEK_SET) != 0)
+            return errno;
+        if (ret != 0)
+            return ret;
+    } else {
+        *verp = ver;
+    }
+
+    /* Verify that the trailer matches header */
+    ret = get_header(sp, LOG_NOPEEK, &ver2, tstampp, NULL, &len2);
+    if (ret || ver != ver2 || len != len2)
+        goto log_corrupt;
+
+    /* Preserve offset */
+    new_off = krb5_storage_seek(sp, off, SEEK_SET);
+    if (new_off == -1)
+        return errno;
+    if (new_off != off) {
+        errno = EIO;
+        return errno;
+    }
+    return 0;
+
+log_corrupt:
+    (void) krb5_storage_seek(sp, off, SEEK_SET);
+    return KADM5_LOG_CORRUPT;
+}
+
+static size_t
+get_max_log_size(krb5_context context)
+{
+    off_t n;
+
+    /* Use database-label-specific lookup?  No, ETOOHARD. */
+    /* Default to 50MB max log size */
+    n = krb5_config_get_int_default(context, NULL, 52428800,
+                                    "kdc",
+                                    "log-max-size",
+                                    NULL);
+    if (n >= 4 * (LOG_UBER_LEN + LOG_WRAPPER_SZ) && n == (size_t)n)
+        return (size_t)n;
     return 0;
 }
 
+static kadm5_ret_t truncate_if_needed(kadm5_server_context *);
+static krb5_storage *log_goto_first(kadm5_server_context *, int);
+
+/*
+ * Get the version and timestamp metadata of either the first, or last
+ * confirmed entry in the log.
+ *
+ * If `which' is LOG_VERSION_UBER, then this gets the version number of the uber
+ * uber record which must be 0, or else we need to upgrade the log.
+ *
+ * If `which' is LOG_VERSION_FIRST, then this gets the metadata for the
+ * logically first entry past the uberblock, or returns HEIM_EOF if
+ * only the uber record is present.
+ *
+ * If `which' is LOG_VERSION_LAST, then this gets metadata for the last
+ * confirmed entry's version and timestamp. If only the uber record is present,
+ * then the version will be its "nominal" version, which may differ from its
+ * actual version (0).
+ *
+ * The `fd''s offset will be set to the start of the header of the entry
+ * identified by `which'.
+ */
 kadm5_ret_t
-kadm5_log_get_version (kadm5_server_context *context, uint32_t *ver)
+kadm5_log_get_version_fd(kadm5_server_context *server_context, int fd,
+                         int which, uint32_t *ver, uint32_t *tstamp)
 {
-    return kadm5_log_get_version_fd (context->log_context.log_fd, ver);
+    kadm5_ret_t ret = 0;
+    krb5_storage *sp;
+    enum kadm_ops op = kadm_get;
+    uint32_t len = 0;
+    uint32_t tmp;
+
+    if (fd == -1)
+        return 0; /* /dev/null */
+
+    if (tstamp == NULL)
+        tstamp = &tmp;
+
+    *ver = 0;
+    *tstamp = 0;
+
+    switch (which) {
+    case LOG_VERSION_LAST:
+        sp = kadm5_log_goto_end(server_context, fd);
+        if (sp == NULL)
+            return errno;
+        ret = get_version_prev(sp, ver, tstamp);
+        krb5_storage_free(sp);
+        break;
+    case LOG_VERSION_FIRST:
+        sp = log_goto_first(server_context, fd);
+        if (sp == NULL)
+            return errno;
+        ret = get_header(sp, LOG_DOPEEK, ver, tstamp, NULL, NULL);
+        krb5_storage_free(sp);
+        break;
+    case LOG_VERSION_UBER:
+        sp = krb5_storage_from_fd(server_context->log_context.log_fd);
+        if (sp == NULL)
+            return errno;
+        if (krb5_storage_seek(sp, 0, SEEK_SET) == 0)
+            ret = get_header(sp, LOG_DOPEEK, ver, tstamp, &op, &len);
+        else
+            ret = errno;
+        if (ret == 0 && (op != kadm_nop || len != LOG_UBER_LEN || *ver != 0))
+            ret = KADM5_LOG_NEEDS_UPGRADE;
+        krb5_storage_free(sp);
+        break;
+    default:
+        return ENOTSUP;
+    }
+
+    return ret;
 }
 
+/* Get the version of the last confirmed entry in the log */
 kadm5_ret_t
-kadm5_log_set_version (kadm5_server_context *context, uint32_t vno)
+kadm5_log_get_version(kadm5_server_context *server_context, uint32_t *ver)
+{
+    return kadm5_log_get_version_fd(server_context,
+                                    server_context->log_context.log_fd,
+                                    LOG_VERSION_LAST, ver, NULL);
+}
+
+/* Sets the version in the context, but NOT in the log */
+kadm5_ret_t
+kadm5_log_set_version(kadm5_server_context *context, uint32_t vno)
 {
     kadm5_log_context *log_context = &context->log_context;
 
@@ -90,187 +559,439 @@ kadm5_log_set_version (kadm5_server_context *context, uint32_t vno)
     return 0;
 }
 
-kadm5_ret_t
-kadm5_log_init (kadm5_server_context *context)
+/*
+ * Open the log and setup server_context->log_context
+ */
+static kadm5_ret_t
+log_open(kadm5_server_context *server_context, int lock_mode)
 {
-    int fd;
+    int fd = -1;
+    int lock_it = 0;
+    int lock_nb = 0;
+    int oflags = O_RDWR;
     kadm5_ret_t ret;
-    kadm5_log_context *log_context = &context->log_context;
+    kadm5_log_context *log_context = &server_context->log_context;
 
-    if (log_context->log_fd != -1)
-	return 0;
-    fd = open (log_context->log_file, O_RDWR | O_CREAT, 0600);
-    if (fd < 0) {
-	ret = errno;
-	krb5_set_error_message(context->context, ret, "kadm5_log_init: open %s",
-			      log_context->log_file);
-	return ret;
-    }
-    if (flock (fd, LOCK_EX) < 0) {
-	ret = errno;
-	krb5_set_error_message(context->context, ret, "kadm5_log_init: flock %s",
-			       log_context->log_file);
-	close (fd);
-	return errno;
+    if (lock_mode & LOCK_NB) {
+        lock_mode &= ~LOCK_NB;
+        lock_nb = LOCK_NB;
     }
 
-    ret = kadm5_log_get_version_fd (fd, &log_context->version);
-    if (ret)
-	return ret;
+    if (lock_mode == log_context->lock_mode && log_context->log_fd != -1)
+        return 0;
 
-    log_context->log_fd  = fd;
-    return 0;
-}
-
-kadm5_ret_t
-kadm5_log_reinit (kadm5_server_context *context)
-{
-    int fd;
-    kadm5_log_context *log_context = &context->log_context;
+    if (strcmp(log_context->log_file, "/dev/null") == 0) {
+        /* log_context->log_fd should be -1 here */
+        return 0;
+    }
 
     if (log_context->log_fd != -1) {
-	flock (log_context->log_fd, LOCK_UN);
-	close (log_context->log_fd);
-	log_context->log_fd = -1;
+        /* Lock or change lock */
+        fd = log_context->log_fd;
+        if (lseek(fd, 0, SEEK_SET) == -1)
+            return errno;
+        lock_it = (lock_mode != log_context->lock_mode);
+    } else {
+        /* Open and lock */
+        if (lock_mode != LOCK_UN)
+            oflags |= O_CREAT;
+        fd = open(log_context->log_file, oflags, 0600);
+        if (fd < 0) {
+            ret = errno;
+            krb5_set_error_message(server_context->context, ret,
+                                   "log_open: open %s", log_context->log_file);
+            return ret;
+        }
+        lock_it = (lock_mode != LOCK_UN);
     }
-    fd = open (log_context->log_file, O_RDWR | O_CREAT | O_TRUNC, 0600);
-    if (fd < 0)
-	return errno;
-    if (flock (fd, LOCK_EX) < 0) {
-	close (fd);
-	return errno;
+    if (lock_it && flock(fd, lock_mode | lock_nb) < 0) {
+	ret = errno;
+	krb5_set_error_message(server_context->context, ret,
+                               "log_open: flock %s", log_context->log_file);
+        if (fd != log_context->log_fd)
+            (void) close(fd);
+	return ret;
     }
 
-    log_context->version = 0;
-    log_context->log_fd  = fd;
+    log_context->log_fd = fd;
+    log_context->lock_mode = lock_mode;
+    log_context->read_only = (lock_mode != LOCK_EX);
+
     return 0;
 }
 
-
-kadm5_ret_t
-kadm5_log_end (kadm5_server_context *context)
+/*
+ * Open the log and setup server_context->log_context
+ */
+static kadm5_ret_t
+log_init(kadm5_server_context *server_context, int lock_mode)
 {
-    kadm5_log_context *log_context = &context->log_context;
+    int fd;
+    struct stat st;
+    uint32_t vno;
+    size_t maxbytes = get_max_log_size(server_context->context);
+    kadm5_ret_t ret;
+    kadm5_log_context *log_context = &server_context->log_context;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0) {
+        /* log_context->log_fd should be -1 here */
+        return 0;
+    }
+
+    ret = log_open(server_context, lock_mode);
+    if (ret)
+        return ret;
+
+    fd = log_context->log_fd;
+    if (!log_context->read_only) {
+        if (fstat(fd, &st) == -1)
+            ret = errno;
+        if (ret == 0 && st.st_size == 0) {
+            /* Write first entry */
+            log_context->version = 0;
+            ret = kadm5_log_nop(server_context, kadm_nop_plain);
+            if (ret == 0)
+                return 0; /* no need to truncate_if_needed(): it's not */
+        }
+        if (ret == 0) {
+            ret = kadm5_log_get_version_fd(server_context, fd,
+                                           LOG_VERSION_UBER, &vno, NULL);
+
+            /* Upgrade the log if it was an old-style log */
+            if (ret == KADM5_LOG_NEEDS_UPGRADE)
+                ret = kadm5_log_truncate(server_context, 0, maxbytes / 4);
+        }
+        if (ret == 0)
+            ret = kadm5_log_recover(server_context, kadm_recover_replay);
+    }
+
+    if (ret == 0) {
+        ret = kadm5_log_get_version_fd(server_context, fd, LOG_VERSION_LAST,
+                                       &log_context->version, NULL);
+        if (ret == HEIM_ERR_EOF)
+            ret = 0;
+    }
+
+    if (ret == 0)
+        ret = truncate_if_needed(server_context);
+
+    if (ret != 0)
+        (void) kadm5_log_end(server_context);
+    return ret;
+}
+
+/* Open the log with an exclusive lock */
+kadm5_ret_t
+kadm5_log_init(kadm5_server_context *server_context)
+{
+    return log_init(server_context, LOCK_EX);
+}
+
+/* Open the log with an exclusive non-blocking lock */
+kadm5_ret_t
+kadm5_log_init_nb(kadm5_server_context *server_context)
+{
+    return log_init(server_context, LOCK_EX | LOCK_NB);
+}
+
+/* Open the log with no locks */
+kadm5_ret_t
+kadm5_log_init_nolock(kadm5_server_context *server_context)
+{
+    return log_init(server_context, LOCK_UN);
+}
+
+/* Open the log with a shared lock */
+kadm5_ret_t
+kadm5_log_init_sharedlock(kadm5_server_context *server_context, int lock_flags)
+{
+    return log_init(server_context, LOCK_SH | lock_flags);
+}
+
+/*
+ * Reinitialize the log and open it
+ */
+kadm5_ret_t
+kadm5_log_reinit(kadm5_server_context *server_context, uint32_t vno)
+{
+    int ret;
+    kadm5_log_context *log_context = &server_context->log_context;
+
+    ret = log_open(server_context, LOCK_EX);
+    if (ret)
+	return ret;
+    if (log_context->log_fd != -1) {
+        if (ftruncate(log_context->log_fd, 0) < 0) {
+            ret = errno;
+            return ret;
+        }
+        if (lseek(log_context->log_fd, 0, SEEK_SET) < 0) {
+            ret = errno;
+            return ret;
+        }
+    }
+
+    /* Write uber entry and truncation nop with version `vno` */
+    log_context->version = vno;
+    return kadm5_log_nop(server_context, kadm_nop_plain);
+}
+
+/* Close the server_context->log_context. */
+kadm5_ret_t
+kadm5_log_end(kadm5_server_context *server_context)
+{
+    kadm5_log_context *log_context = &server_context->log_context;
+    kadm5_ret_t ret = 0;
     int fd = log_context->log_fd;
 
-    flock (fd, LOCK_UN);
-    close(fd);
+    if (fd != -1) {
+        if (log_context->lock_mode != LOCK_UN) {
+            if (flock(fd, LOCK_UN) == -1 && errno == EBADF)
+                ret = errno;
+        }
+        if (ret != EBADF && close(fd) == -1)
+            ret = errno;
+    }
     log_context->log_fd = -1;
-    return 0;
+    log_context->lock_mode = LOCK_UN;
+    return ret;
 }
 
+/*
+ * Write the version, timestamp, and op for a new entry.
+ *
+ * Note that the sp should be a krb5_storage_emem(), not a file.
+ *
+ * On success the sp's offset will be where the length of the payload
+ * should be written.
+ */
 static kadm5_ret_t
-kadm5_log_preamble (kadm5_server_context *context,
-		    krb5_storage *sp,
-		    enum kadm_ops op)
+kadm5_log_preamble(kadm5_server_context *context,
+		   krb5_storage *sp,
+		   enum kadm_ops op,
+		   uint32_t vno)
 {
     kadm5_log_context *log_context = &context->log_context;
-    kadm5_ret_t kadm_ret;
+    time_t now = time(NULL);
+    kadm5_ret_t ret;
 
-    kadm_ret = kadm5_log_init (context);
-    if (kadm_ret)
-	return kadm_ret;
+    ret = krb5_store_uint32(sp, vno);
+    if (ret)
+        return ret;
+    ret = krb5_store_uint32(sp, now);
+    if (ret)
+        return ret;
+    log_context->last_time = now;
 
-    krb5_store_int32 (sp, ++log_context->version);
-    krb5_store_int32 (sp, time(NULL));
-    krb5_store_int32 (sp, op);
-    return 0;
+    if (op < kadm_first || op > kadm_last)
+        return ERANGE;
+    return krb5_store_uint32(sp, op);
 }
 
+/* Writes the version part of the trailer */
 static kadm5_ret_t
-kadm5_log_postamble (kadm5_log_context *context,
-		     krb5_storage *sp)
+kadm5_log_postamble(kadm5_log_context *context,
+		    krb5_storage *sp,
+		    uint32_t vno)
 {
-    krb5_store_int32 (sp, context->version);
-    return 0;
+    return krb5_store_uint32(sp, vno);
 }
 
 /*
- * flush the log record in `sp'.
+ * Signal the ipropd-master about changes to the log.
+ */
+/*
+ * XXX Get rid of the ifdef by having a sockaddr in log_context in both
+ * cases.
+ *
+ * XXX Better yet, just connect to the master's socket that slaves
+ * connect to, and then disconnect.  The master should then check the
+ * log on every connection accepted.  Then we wouldn't need IPC to
+ * signal the master.
+ */
+void
+kadm5_log_signal_master(kadm5_server_context *context)
+{
+    kadm5_log_context *log_context = &context->log_context;
+#ifndef NO_UNIX_SOCKETS
+    sendto(log_context->socket_fd,
+	   (void *)&log_context->version,
+	   sizeof(log_context->version),
+	   0,
+	   (struct sockaddr *)&log_context->socket_name,
+	   sizeof(log_context->socket_name));
+#else
+    sendto(log_context->socket_fd,
+	   (void *)&log_context->version,
+	   sizeof(log_context->version),
+	   0,
+	   log_context->socket_info->ai_addr,
+	   log_context->socket_info->ai_addrlen);
+#endif
+}
+
+/*
+ * Write sp's contents (which must be a fully formed record, complete
+ * with header, payload, and trailer) to the log and fsync the log.
+ *
+ * Does not free sp.
  */
 
 static kadm5_ret_t
-kadm5_log_flush (kadm5_log_context *log_context,
-		 krb5_storage *sp)
+kadm5_log_flush(kadm5_server_context *context, krb5_storage *sp)
 {
+    kadm5_log_context *log_context = &context->log_context;
+    kadm5_ret_t ret;
     krb5_data data;
     size_t len;
-    ssize_t ret;
+    krb5_ssize_t bytes;
+    uint32_t new_ver, prev_ver;
+    off_t off, end;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return 0;
+
+    if (log_context->read_only)
+        return EROFS;
+
+    if (krb5_storage_seek(sp, 0, SEEK_SET) == -1)
+        return errno;
+
+    ret = get_header(sp, LOG_DOPEEK, &new_ver, NULL, NULL, NULL);
+    if (ret)
+        return ret;
+
+    ret = krb5_storage_to_data(sp, &data);
+    if (ret)
+        return ret;
+
+    /* Abandon the emem storage reference */
+    sp = krb5_storage_from_fd(log_context->log_fd);
+    if (sp == NULL) {
+        krb5_data_free(&data);
+        return ENOMEM;
+    }
+
+    /* Check that we are at the end of the log and fail if not */
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off == -1) {
+        krb5_data_free(&data);
+        krb5_storage_free(sp);
+        return errno;
+    }
+    end = krb5_storage_seek(sp, 0, SEEK_END);
+    if (end == -1) {
+        krb5_data_free(&data);
+        krb5_storage_free(sp);
+        return errno;
+    }
+    if (end != off) {
+        krb5_data_free(&data);
+        krb5_storage_free(sp);
+        return KADM5_LOG_CORRUPT;
+    }
+
+    /* Enforce monotonically incremented versioning of records */
+    if (seek_prev(sp, &prev_ver, NULL) == -1 ||
+        krb5_storage_seek(sp, end, SEEK_SET) == -1) {
+        ret = errno;
+        krb5_data_free(&data);
+        krb5_storage_free(sp);
+        return ret;
+    }
+
+    if (prev_ver != 0 && prev_ver != log_context->version)
+        return EINVAL; /* Internal error, really; just a consistency check */
+
+    if (prev_ver != 0 && new_ver != prev_ver + 1) {
+        krb5_warnx(context->context, "refusing to write a log record "
+                   "with non-monotonic version (new: %u, old: %u)",
+                   new_ver, prev_ver);
+        return KADM5_LOG_CORRUPT;
+    }
 
-    krb5_storage_to_data(sp, &data);
     len = data.length;
-    ret = write (log_context->log_fd, data.data, len);
-    if (ret < 0 || (size_t)ret != len) {
-	krb5_data_free(&data);
-	return errno;
-    }
-    if (fsync (log_context->log_fd) < 0) {
-	krb5_data_free(&data);
-	return errno;
-    }
-
-    /*
-     * Try to send a signal to any running `ipropd-master'
-     */
-#ifndef NO_UNIX_SOCKETS
-    sendto (log_context->socket_fd,
-	    (void *)&log_context->version,
-	    sizeof(log_context->version),
-	    0,
-	    (struct sockaddr *)&log_context->socket_name,
-	    sizeof(log_context->socket_name));
-#else
-    sendto (log_context->socket_fd,
-	    (void *)&log_context->version,
-	    sizeof(log_context->version),
-	    0,
-	    log_context->socket_info->ai_addr,
-	    log_context->socket_info->ai_addrlen);
-#endif
-
+    bytes = krb5_storage_write(sp, data.data, len);
     krb5_data_free(&data);
+    if (bytes < 0) {
+        krb5_storage_free(sp);
+	return errno;
+    }
+    if (bytes != (krb5_ssize_t)len) {
+        krb5_storage_free(sp);
+        return EIO;
+    }
+
+    ret = krb5_storage_fsync(sp);
+    krb5_storage_free(sp);
+    if (ret)
+        return ret;
+
+    /* Retain the nominal database version when flushing the uber record */
+    if (new_ver != 0)
+        log_context->version = new_ver;
     return 0;
 }
 
 /*
- * Add a `create' operation to the log.
+ * Add a `create' operation to the log and perform the create against the HDB.
  */
-
 kadm5_ret_t
-kadm5_log_create (kadm5_server_context *context,
-		  hdb_entry *ent)
+kadm5_log_create(kadm5_server_context *context, hdb_entry *entry)
 {
     krb5_storage *sp;
     kadm5_ret_t ret;
     krb5_data value;
+    hdb_entry_ex ent;
     kadm5_log_context *log_context = &context->log_context;
 
-    sp = krb5_storage_emem();
-    ret = hdb_entry2value (context->context, ent, &value);
-    if (ret) {
-	krb5_storage_free(sp);
-	return ret;
-    }
-    ret = kadm5_log_preamble (context, sp, kadm_create);
-    if (ret) {
-	krb5_data_free (&value);
-	krb5_storage_free(sp);
-	return ret;
-    }
-    krb5_store_int32 (sp, value.length);
-    krb5_storage_write(sp, value.data, value.length);
-    krb5_store_int32 (sp, value.length);
-    krb5_data_free (&value);
-    ret = kadm5_log_postamble (log_context, sp);
-    if (ret) {
-	krb5_storage_free (sp);
-	return ret;
-    }
-    ret = kadm5_log_flush (log_context, sp);
-    krb5_storage_free (sp);
+    memset(&ent, 0, sizeof(ent));
+    ent.ctx = 0;
+    ent.free_entry = 0;
+    ent.entry = *entry;
+
+    /*
+     * If we're not logging then we can't recover-to-perform, so just
+     * perform.
+     */
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return context->db->hdb_store(context->context, context->db, 0, &ent);
+
+    /*
+     * Test for any conflicting entries before writing the log.  If we commit
+     * to the log we'll end-up rolling forward on recovery, but that would be
+     * wrong if the initial create is rejected.
+     */
+    ret = context->db->hdb_store(context->context, context->db,
+                                 HDB_F_PRECHECK, &ent);
+    if (ret == 0)
+        ret = hdb_entry2value(context->context, entry, &value);
     if (ret)
-	return ret;
-    ret = kadm5_log_end (context);
+        return ret;
+    sp = krb5_storage_emem();
+    if (sp == NULL)
+        ret = ENOMEM;
+    if (ret == 0)
+        ret = kadm5_log_preamble(context, sp, kadm_create,
+                                 log_context->version + 1);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, value.length);
+    if (ret == 0) {
+        if (krb5_storage_write(sp, value.data, value.length) !=
+            (krb5_ssize_t)value.length)
+            ret = errno;
+    }
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, value.length);
+    if (ret == 0)
+        ret = kadm5_log_postamble(log_context, sp,
+                                  log_context->version + 1);
+    if (ret == 0)
+        ret = kadm5_log_flush(context, sp);
+    krb5_storage_free(sp);
+    krb5_data_free(&value);
+    if (ret == 0)
+        ret = kadm5_log_recover(context, kadm_recover_commit);
     return ret;
 }
 
@@ -278,12 +999,11 @@ kadm5_log_create (kadm5_server_context *context,
  * Read the data of a create log record from `sp' and change the
  * database.
  */
-
 static kadm5_ret_t
-kadm5_log_replay_create (kadm5_server_context *context,
-			 uint32_t ver,
-			 uint32_t len,
-			 krb5_storage *sp)
+kadm5_log_replay_create(kadm5_server_context *context,
+		        uint32_t ver,
+		        uint32_t len,
+		        krb5_storage *sp)
 {
     krb5_error_code ret;
     krb5_data data;
@@ -291,158 +1011,237 @@ kadm5_log_replay_create (kadm5_server_context *context,
 
     memset(&ent, 0, sizeof(ent));
 
-    ret = krb5_data_alloc (&data, len);
+    ret = krb5_data_alloc(&data, len);
     if (ret) {
 	krb5_set_error_message(context->context, ret, "out of memory");
 	return ret;
     }
-    krb5_storage_read (sp, data.data, len);
-    ret = hdb_value2entry (context->context, &data, &ent.entry);
+    krb5_storage_read(sp, data.data, len);
+    ret = hdb_value2entry(context->context, &data, &ent.entry);
     krb5_data_free(&data);
     if (ret) {
 	krb5_set_error_message(context->context, ret,
-			       "Unmarshaling hdb entry failed");
+			       "Unmarshaling hdb entry in log failed, "
+                               "version: %ld", (long)ver);
 	return ret;
     }
     ret = context->db->hdb_store(context->context, context->db, 0, &ent);
-    hdb_free_entry (context->context, &ent);
+    hdb_free_entry(context->context, &ent);
     return ret;
 }
 
 /*
  * Add a `delete' operation to the log.
  */
-
 kadm5_ret_t
-kadm5_log_delete (kadm5_server_context *context,
-		  krb5_principal princ)
+kadm5_log_delete(kadm5_server_context *context,
+		 krb5_principal princ)
 {
-    krb5_storage *sp;
     kadm5_ret_t ret;
-    off_t off;
-    off_t len;
     kadm5_log_context *log_context = &context->log_context;
+    krb5_storage *sp;
+    uint32_t len = 0;   /* So dumb compilers don't warn */
+    off_t end_off = 0;  /* Ditto; this allows de-indentation by two levels */
+    off_t off;
 
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return context->db->hdb_remove(context->context, context->db, 0,
+                                       princ);
+    ret = context->db->hdb_remove(context->context, context->db,
+                                  HDB_F_PRECHECK, princ);
+    if (ret)
+        return ret;
     sp = krb5_storage_emem();
     if (sp == NULL)
-	return ENOMEM;
-    ret = kadm5_log_preamble (context, sp, kadm_delete);
-    if (ret)
-	goto out;
-    ret = krb5_store_int32 (sp, 0);
-    if (ret)
-	goto out;
-    off = krb5_storage_seek (sp, 0, SEEK_CUR);
-    ret = krb5_store_principal (sp, princ);
-    if (ret)
-	goto out;
-    len = krb5_storage_seek (sp, 0, SEEK_CUR) - off;
-    krb5_storage_seek(sp, -(len + 4), SEEK_CUR);
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto out;
-    krb5_storage_seek(sp, len, SEEK_CUR);
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto out;
-    ret = kadm5_log_postamble (log_context, sp);
-    if (ret)
-	goto out;
-    ret = kadm5_log_flush (log_context, sp);
-    if (ret)
-	goto out;
-    ret = kadm5_log_end (context);
-out:
-    krb5_storage_free (sp);
+        ret = ENOMEM;
+    if (ret == 0)
+        ret = kadm5_log_preamble(context, sp, kadm_delete,
+                                 log_context->version + 1);
+    if (ret) {
+        krb5_storage_free(sp);
+        return ret;
+    }
+
+    /*
+     * Write a 0 length which we overwrite once we know the length of
+     * the principal name payload.
+     */
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off == -1)
+        ret = errno;
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, 0);
+    if (ret == 0)
+        ret = krb5_store_principal(sp, princ);
+    if (ret == 0) {
+        end_off = krb5_storage_seek(sp, 0, SEEK_CUR);
+        if (end_off == -1)
+            ret = errno;
+        else if (end_off < off)
+            ret = KADM5_LOG_CORRUPT;
+    }
+    if (ret == 0) {
+        /* We wrote sizeof(uint32_t) + payload length bytes */
+        len = (uint32_t)(end_off - off);
+        if (end_off - off != len || len < sizeof(len))
+            ret = KADM5_LOG_CORRUPT;
+        else
+            len -= sizeof(len);
+    }
+    if (ret == 0 && krb5_storage_seek(sp, off, SEEK_SET) == -1)
+        ret = errno;
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, len);
+    if (ret == 0 && krb5_storage_seek(sp, end_off, SEEK_SET) == -1)
+        ret = errno;
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, len);
+    if (ret == 0)
+        ret = kadm5_log_postamble(log_context, sp,
+                                  log_context->version + 1);
+    if (ret == 0)
+        ret = kadm5_log_flush(context, sp);
+    if (ret == 0)
+        ret = kadm5_log_recover(context, kadm_recover_commit);
+    krb5_storage_free(sp);
     return ret;
 }
 
 /*
  * Read a `delete' log operation from `sp' and apply it.
  */
-
 static kadm5_ret_t
-kadm5_log_replay_delete (kadm5_server_context *context,
-			 uint32_t ver,
-			 uint32_t len,
-			 krb5_storage *sp)
+kadm5_log_replay_delete(kadm5_server_context *context,
+		        uint32_t ver, uint32_t len, krb5_storage *sp)
 {
     krb5_error_code ret;
     krb5_principal principal;
 
-    ret = krb5_ret_principal (sp, &principal);
+    ret = krb5_ret_principal(sp, &principal);
     if (ret) {
 	krb5_set_error_message(context->context,  ret, "Failed to read deleted "
 			       "principal from log version: %ld",  (long)ver);
 	return ret;
     }
 
-    ret = context->db->hdb_remove(context->context, context->db, principal);
-    krb5_free_principal (context->context, principal);
+    ret = context->db->hdb_remove(context->context, context->db, 0, principal);
+    krb5_free_principal(context->context, principal);
     return ret;
 }
 
+static kadm5_ret_t kadm5_log_replay_rename(kadm5_server_context *,
+                                           uint32_t, uint32_t,
+                                           krb5_storage *);
+
 /*
  * Add a `rename' operation to the log.
  */
-
 kadm5_ret_t
-kadm5_log_rename (kadm5_server_context *context,
-		  krb5_principal source,
-		  hdb_entry *ent)
+kadm5_log_rename(kadm5_server_context *context,
+		 krb5_principal source,
+		 hdb_entry *entry)
 {
     krb5_storage *sp;
     kadm5_ret_t ret;
+    uint32_t len = 0;   /* So dumb compilers don't warn */
+    off_t end_off = 0;  /* Ditto; this allows de-indentation by two levels */
     off_t off;
-    off_t len;
     krb5_data value;
+    hdb_entry_ex ent;
     kadm5_log_context *log_context = &context->log_context;
 
-    krb5_data_zero(&value);
+    memset(&ent, 0, sizeof(ent));
+    ent.ctx = 0;
+    ent.free_entry = 0;
+    ent.entry = *entry;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0) {
+        ret = context->db->hdb_store(context->context, context->db, 0, &ent);
+        if (ret == 0)
+            return context->db->hdb_remove(context->context, context->db, 0,
+                                           source);
+        return ret;
+    }
+
+    /*
+     * Pre-check that the transaction will succeed.
+     *
+     * Note that rename doesn't work to swap a principal's canonical
+     * name with one of its aliases.  To make that work would require
+     * adding an hdb_rename() method for renaming principals (there's an
+     * hdb_rename() method already, but for renaming the HDB), which is
+     * ETOOMUCHWORK for the time being.
+     */
+    ret = context->db->hdb_store(context->context, context->db,
+                                 HDB_F_PRECHECK, &ent);
+    if (ret == 0)
+        ret = context->db->hdb_remove(context->context, context->db,
+                                       HDB_F_PRECHECK, source);
+    if (ret)
+        return ret;
 
     sp = krb5_storage_emem();
-    ret = hdb_entry2value (context->context, ent, &value);
-    if (ret)
-	goto failed;
+    krb5_data_zero(&value);
+    if (sp == NULL)
+	ret = ENOMEM;
+    if (ret == 0)
+        ret = kadm5_log_preamble(context, sp, kadm_rename,
+                                 log_context->version + 1);
+    if (ret == 0)
+        ret = hdb_entry2value(context->context, entry, &value);
+    if (ret) {
+        krb5_data_free(&value);
+        krb5_storage_free(sp);
+        return ret;
+    }
 
-    ret = kadm5_log_preamble (context, sp, kadm_rename);
-    if (ret)
-	goto failed;
-
-    ret = krb5_store_int32 (sp, 0);
-    if (ret)
-	goto failed;
-    off = krb5_storage_seek (sp, 0, SEEK_CUR);
-    ret = krb5_store_principal (sp, source);
-    if (ret)
-	goto failed;
-
-    krb5_storage_write(sp, value.data, value.length);
-    len = krb5_storage_seek (sp, 0, SEEK_CUR) - off;
-
-    krb5_storage_seek(sp, -(len + 4), SEEK_CUR);
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto failed;
-
-    krb5_storage_seek(sp, len, SEEK_CUR);
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto failed;
-
-    ret = kadm5_log_postamble (log_context, sp);
-    if (ret)
-	goto failed;
-
-    ret = kadm5_log_flush (log_context, sp);
-    if (ret)
-	goto failed;
-    krb5_storage_free (sp);
-    krb5_data_free (&value);
-
-    return kadm5_log_end (context);
-
-failed:
+    /*
+     * Write a zero length which we'll overwrite once we know the length of the
+     * payload.
+     */
+    off = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (off == -1)
+        ret = errno;
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, 0);
+    if (ret == 0)
+        ret = krb5_store_principal(sp, source);
+    if (ret == 0) {
+        errno = 0;
+        if (krb5_storage_write(sp, value.data, value.length) !=
+            (krb5_ssize_t)value.length)
+            ret = errno ? errno : EIO;
+    }
+    if (ret == 0) {
+        end_off = krb5_storage_seek(sp, 0, SEEK_CUR);
+        if (end_off == -1)
+            ret = errno;
+        else if (end_off < off)
+            ret = KADM5_LOG_CORRUPT;
+    }
+    if (ret == 0) {
+        /* We wrote sizeof(uint32_t) + payload length bytes */
+        len = (uint32_t)(end_off - off);
+        if (end_off - off != len || len < sizeof(len))
+            ret = KADM5_LOG_CORRUPT;
+        else
+            len -= sizeof(len);
+        if (ret == 0 && krb5_storage_seek(sp, off, SEEK_SET) == -1)
+            ret = errno;
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, len);
+        if (ret == 0 && krb5_storage_seek(sp, end_off, SEEK_SET) == -1)
+            ret = errno;
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, len);
+        if (ret == 0)
+            ret = kadm5_log_postamble(log_context, sp,
+                                      log_context->version + 1);
+        if (ret == 0)
+            ret = kadm5_log_flush(context, sp);
+        if (ret == 0)
+            ret = kadm5_log_recover(context, kadm_recover_commit);
+    }
     krb5_data_free(&value);
     krb5_storage_free(sp);
     return ret;
@@ -453,10 +1252,10 @@ failed:
  */
 
 static kadm5_ret_t
-kadm5_log_replay_rename (kadm5_server_context *context,
-			 uint32_t ver,
-			 uint32_t len,
-			 krb5_storage *sp)
+kadm5_log_replay_rename(kadm5_server_context *context,
+		        uint32_t ver,
+		        uint32_t len,
+		        krb5_storage *sp)
 {
     krb5_error_code ret;
     krb5_principal source;
@@ -468,7 +1267,7 @@ kadm5_log_replay_rename (kadm5_server_context *context,
     memset(&target_ent, 0, sizeof(target_ent));
 
     off = krb5_storage_seek(sp, 0, SEEK_CUR);
-    ret = krb5_ret_principal (sp, &source);
+    ret = krb5_ret_principal(sp, &source);
     if (ret) {
 	krb5_set_error_message(context->context, ret, "Failed to read renamed "
 			       "principal in log, version: %ld", (long)ver);
@@ -476,79 +1275,96 @@ kadm5_log_replay_rename (kadm5_server_context *context,
     }
     princ_len = krb5_storage_seek(sp, 0, SEEK_CUR) - off;
     data_len = len - princ_len;
-    ret = krb5_data_alloc (&value, data_len);
+    ret = krb5_data_alloc(&value, data_len);
     if (ret) {
 	krb5_free_principal (context->context, source);
 	return ret;
     }
-    krb5_storage_read (sp, value.data, data_len);
-    ret = hdb_value2entry (context->context, &value, &target_ent.entry);
+    krb5_storage_read(sp, value.data, data_len);
+    ret = hdb_value2entry(context->context, &value, &target_ent.entry);
     krb5_data_free(&value);
     if (ret) {
-	krb5_free_principal (context->context, source);
+	krb5_free_principal(context->context, source);
 	return ret;
     }
-    ret = context->db->hdb_store (context->context, context->db,
-				  0, &target_ent);
-    hdb_free_entry (context->context, &target_ent);
+    ret = context->db->hdb_store(context->context, context->db,
+				 0, &target_ent);
+    hdb_free_entry(context->context, &target_ent);
     if (ret) {
-	krb5_free_principal (context->context, source);
+	krb5_free_principal(context->context, source);
 	return ret;
     }
-    ret = context->db->hdb_remove (context->context, context->db, source);
-    krb5_free_principal (context->context, source);
+    ret = context->db->hdb_remove(context->context, context->db, 0, source);
+    krb5_free_principal(context->context, source);
+
     return ret;
 }
 
-
 /*
  * Add a `modify' operation to the log.
  */
-
 kadm5_ret_t
-kadm5_log_modify (kadm5_server_context *context,
-		  hdb_entry *ent,
-		  uint32_t mask)
+kadm5_log_modify(kadm5_server_context *context,
+		 hdb_entry *entry,
+		 uint32_t mask)
 {
     krb5_storage *sp;
     kadm5_ret_t ret;
     krb5_data value;
     uint32_t len;
+    hdb_entry_ex ent;
     kadm5_log_context *log_context = &context->log_context;
 
-    krb5_data_zero(&value);
+    memset(&ent, 0, sizeof(ent));
+    ent.ctx = 0;
+    ent.free_entry = 0;
+    ent.entry = *entry;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return context->db->hdb_store(context->context, context->db,
+                                      HDB_F_REPLACE, &ent);
+
+    ret = context->db->hdb_store(context->context, context->db,
+                                 HDB_F_PRECHECK | HDB_F_REPLACE, &ent);
+    if (ret)
+        return ret;
 
     sp = krb5_storage_emem();
-    ret = hdb_entry2value (context->context, ent, &value);
-    if (ret)
-	goto failed;
+    krb5_data_zero(&value);
+    if (sp == NULL)
+        ret = ENOMEM;
+    if (ret == 0)
+        ret = hdb_entry2value(context->context, entry, &value);
+    if (ret) {
+        krb5_data_free(&value);
+        krb5_storage_free(sp);
+	return ret;
+    }
 
-    ret = kadm5_log_preamble (context, sp, kadm_modify);
-    if (ret)
-	goto failed;
-
-    len = value.length + 4;
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto failed;
-    ret = krb5_store_int32 (sp, mask);
-    if (ret)
-	goto failed;
-    krb5_storage_write (sp, value.data, value.length);
-
-    ret = krb5_store_int32 (sp, len);
-    if (ret)
-	goto failed;
-    ret = kadm5_log_postamble (log_context, sp);
-    if (ret)
-	goto failed;
-    ret = kadm5_log_flush (log_context, sp);
-    if (ret)
-	goto failed;
-    krb5_data_free(&value);
-    krb5_storage_free (sp);
-    return kadm5_log_end (context);
-failed:
+    len = value.length + sizeof(len);
+    if (value.length > len || len > INT32_MAX)
+        ret = E2BIG;
+    if (ret == 0)
+        ret = kadm5_log_preamble(context, sp, kadm_modify,
+                                 log_context->version + 1);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, len);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, mask);
+    if (ret == 0) {
+        if (krb5_storage_write(sp, value.data, value.length) !=
+            (krb5_ssize_t)value.length)
+            ret = errno;
+    }
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, len);
+    if (ret == 0)
+        ret = kadm5_log_postamble(log_context, sp,
+                                  log_context->version + 1);
+    if (ret == 0)
+        ret = kadm5_log_flush(context, sp);
+    if (ret == 0)
+        ret = kadm5_log_recover(context, kadm_recover_commit);
     krb5_data_free(&value);
     krb5_storage_free(sp);
     return ret;
@@ -557,28 +1373,33 @@ failed:
 /*
  * Read a `modify' log operation from `sp' and apply it.
  */
-
 static kadm5_ret_t
-kadm5_log_replay_modify (kadm5_server_context *context,
-			 uint32_t ver,
-			 uint32_t len,
-			 krb5_storage *sp)
+kadm5_log_replay_modify(kadm5_server_context *context,
+		        uint32_t ver,
+		        uint32_t len,
+		        krb5_storage *sp)
 {
     krb5_error_code ret;
-    int32_t mask;
+    uint32_t mask;
     krb5_data value;
     hdb_entry_ex ent, log_ent;
 
     memset(&log_ent, 0, sizeof(log_ent));
 
-    krb5_ret_int32 (sp, &mask);
+    ret = krb5_ret_uint32(sp, &mask);
+    if (ret)
+        return ret;
     len -= 4;
     ret = krb5_data_alloc (&value, len);
     if (ret) {
 	krb5_set_error_message(context->context, ret, "out of memory");
 	return ret;
     }
-    krb5_storage_read (sp, value.data, len);
+    errno = 0;
+    if (krb5_storage_read (sp, value.data, len) != (krb5_ssize_t)len) {
+        ret = errno ? errno : EIO;
+        return ret;
+    }
     ret = hdb_value2entry (context->context, &value, &log_ent.entry);
     krb5_data_free(&value);
     if (ret)
@@ -587,7 +1408,8 @@ kadm5_log_replay_modify (kadm5_server_context *context,
     memset(&ent, 0, sizeof(ent));
     ret = context->db->hdb_fetch_kvno(context->context, context->db,
 				      log_ent.entry.principal,
-				      HDB_F_DECRYPT|HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
+				      HDB_F_DECRYPT|HDB_F_ALL_KVNOS|
+				      HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
     if (ret)
 	goto out;
     if (mask & KADM5_PRINC_EXPIRE_TIME) {
@@ -621,7 +1443,8 @@ kadm5_log_replay_modify (kadm5_server_context *context,
 	}
     }
     if (mask & KADM5_LAST_PWD_CHANGE) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_LAST_PWD_CHANGE");
+        krb5_warnx (context->context,
+                    "Unimplemented mask KADM5_LAST_PWD_CHANGE");
     }
     if (mask & KADM5_ATTRIBUTES) {
 	ent.entry.flags = log_ent.entry.flags;
@@ -661,16 +1484,14 @@ kadm5_log_replay_modify (kadm5_server_context *context,
 	ent.entry.kvno = log_ent.entry.kvno;
     }
     if (mask & KADM5_MKVNO) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_KVNO");
+        krb5_warnx(context->context, "Unimplemented mask KADM5_KVNO");
     }
     if (mask & KADM5_AUX_ATTRIBUTES) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_AUX_ATTRIBUTES");
-    }
-    if (mask & KADM5_POLICY) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_POLICY");
+        krb5_warnx(context->context,
+                   "Unimplemented mask KADM5_AUX_ATTRIBUTES");
     }
     if (mask & KADM5_POLICY_CLR) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_POLICY_CLR");
+        krb5_warnx(context->context, "Unimplemented mask KADM5_POLICY_CLR");
     }
     if (mask & KADM5_MAX_RLIFE) {
 	if (log_ent.entry.max_renew == NULL) {
@@ -688,18 +1509,28 @@ kadm5_log_replay_modify (kadm5_server_context *context,
 	}
     }
     if (mask & KADM5_LAST_SUCCESS) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_LAST_SUCCESS");
+        krb5_warnx(context->context, "Unimplemented mask KADM5_LAST_SUCCESS");
     }
     if (mask & KADM5_LAST_FAILED) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_LAST_FAILED");
+        krb5_warnx(context->context, "Unimplemented mask KADM5_LAST_FAILED");
     }
     if (mask & KADM5_FAIL_AUTH_COUNT) {
-        krb5_warnx (context->context, "Unimplemented mask KADM5_FAIL_AUTH_COUNT");
+        krb5_warnx(context->context,
+                   "Unimplemented mask KADM5_FAIL_AUTH_COUNT");
     }
     if (mask & KADM5_KEY_DATA) {
 	size_t num;
 	size_t i;
 
+	/*
+	 * We don't need to do anything about key history here because
+	 * the log entry contains a complete entry, including hdb
+	 * extensions.  We do need to make sure that KADM5_TL_DATA is in
+	 * the mask though, since that's what it takes to update the
+	 * extensions (see below).
+	 */
+	mask |= KADM5_TL_DATA;
+
 	for (i = 0; i < ent.entry.keys.len; ++i)
 	    free_Key(&ent.entry.keys.val[i]);
 	free (ent.entry.keys.val);
@@ -710,7 +1541,8 @@ kadm5_log_replay_modify (kadm5_server_context *context,
 	ent.entry.keys.val = malloc(len * sizeof(*ent.entry.keys.val));
 	if (ent.entry.keys.val == NULL) {
 	    krb5_set_error_message(context->context, ENOMEM, "out of memory");
-	    return ENOMEM;
+            ret = ENOMEM;
+	    goto out;
 	}
 	for (i = 0; i < ent.entry.keys.len; ++i) {
 	    ret = copy_Key(&log_ent.entry.keys.val[i],
@@ -744,179 +1576,652 @@ kadm5_log_replay_modify (kadm5_server_context *context,
     ret = context->db->hdb_store(context->context, context->db,
 				 HDB_F_REPLACE, &ent);
  out:
-    hdb_free_entry (context->context, &ent);
-    hdb_free_entry (context->context, &log_ent);
+    hdb_free_entry(context->context, &ent);
+    hdb_free_entry(context->context, &log_ent);
+    return ret;
+}
+
+/*
+ * Update the first entry (which should be a `nop'), the "uber-entry".
+ */
+static kadm5_ret_t
+log_update_uber(kadm5_server_context *context, off_t off)
+{
+    kadm5_log_context *log_context = &context->log_context;
+    kadm5_ret_t ret = 0;
+    krb5_storage *sp, *mem_sp;
+    krb5_data data;
+    uint32_t op, len;
+    ssize_t bytes;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return 0;
+
+    if (log_context->read_only)
+        return EROFS;
+
+    krb5_data_zero(&data);
+
+    mem_sp = krb5_storage_emem();
+    if (mem_sp == NULL)
+        return ENOMEM;
+
+    sp = krb5_storage_from_fd(log_context->log_fd);
+    if (sp == NULL) {
+        krb5_storage_free(mem_sp);
+        return ENOMEM;
+    }
+
+    /* Skip first entry's version and timestamp */
+    if (krb5_storage_seek(sp, 8, SEEK_SET) == -1) {
+        ret = errno;
+        goto out;
+    }
+
+    /* If the first entry is not a nop, there's nothing we can do here */
+    ret = krb5_ret_uint32(sp, &op);
+    if (ret || op != kadm_nop)
+        goto out;
+
+    /* If the first entry is not a 16-byte nop, ditto */
+    ret = krb5_ret_uint32(sp, &len);
+    if (ret || len != LOG_UBER_LEN)
+        goto out;
+
+    /*
+     * Try to make the writes here as close to atomic as possible: a
+     * single write() call.
+     */
+    ret = krb5_store_uint64(mem_sp, off);
+    if (ret)
+        goto out;
+    ret = krb5_store_uint32(mem_sp, log_context->last_time);
+    if (ret)
+        goto out;
+    ret = krb5_store_uint32(mem_sp, log_context->version);
+    if (ret)
+        goto out;
+
+    krb5_storage_to_data(mem_sp, &data);
+    bytes = krb5_storage_write(sp, data.data, data.length);
+    if (bytes < 0)
+        ret = errno;
+    else if (bytes != data.length)
+        ret = EIO;
+
+    /*
+     * We don't fsync() this write because we can recover if the write
+     * doesn't complete, though for now we don't have code for properly
+     * dealing with the offset not getting written completely.
+     *
+     * We should probably have two copies of the offset so we can use
+     * one copy to verify the other, and when they don't match we could
+     * traverse the whole log forwards, replaying just the last entry.
+     */
+
+out:
+    if (ret == 0)
+        kadm5_log_signal_master(context);
+    krb5_data_free(&data);
+    krb5_storage_free(sp);
+    krb5_storage_free(mem_sp);
+    if (lseek(log_context->log_fd, off, SEEK_SET) == -1)
+        ret = ret ? ret : errno;
+
     return ret;
 }
 
 /*
  * Add a `nop' operation to the log. Does not close the log.
  */
-
 kadm5_ret_t
-kadm5_log_nop (kadm5_server_context *context)
+kadm5_log_nop(kadm5_server_context *context, enum kadm_nop_type nop_type)
 {
     krb5_storage *sp;
     kadm5_ret_t ret;
     kadm5_log_context *log_context = &context->log_context;
+    off_t off;
+    uint32_t vno = log_context->version;
+
+    if (strcmp(log_context->log_file, "/dev/null") == 0)
+        return 0;
+
+    off = lseek(log_context->log_fd, 0, SEEK_CUR);
+    if (off == -1)
+        return errno;
 
     sp = krb5_storage_emem();
-    ret = kadm5_log_preamble (context, sp, kadm_nop);
-    if (ret) {
-	krb5_storage_free (sp);
-	return ret;
-    }
-    krb5_store_int32 (sp, 0);
-    krb5_store_int32 (sp, 0);
-    ret = kadm5_log_postamble (log_context, sp);
-    if (ret) {
-	krb5_storage_free (sp);
-	return ret;
-    }
-    ret = kadm5_log_flush (log_context, sp);
-    krb5_storage_free (sp);
+    ret = kadm5_log_preamble(context, sp, kadm_nop, off == 0 ? 0 : vno + 1);
+    if (ret)
+        goto out;
 
+    if (off == 0) {
+        /*
+         * First entry (uber-entry) gets room for offset of next new
+         * entry and time and version of last entry.
+         */
+        ret = krb5_store_uint32(sp, LOG_UBER_LEN);
+        /* These get overwritten with the same values below */
+        if (ret == 0)
+            ret = krb5_store_uint64(sp, LOG_UBER_SZ);
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, log_context->last_time);
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, vno);
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, LOG_UBER_LEN);
+    } else if (nop_type == kadm_nop_plain) {
+        ret = krb5_store_uint32(sp, 0);
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, 0);
+    } else {
+        ret = krb5_store_uint32(sp, sizeof(uint32_t));
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, nop_type);
+        if (ret == 0)
+            ret = krb5_store_uint32(sp, sizeof(uint32_t));
+    }
+
+    if (ret == 0)
+        ret = kadm5_log_postamble(log_context, sp, off == 0 ? 0 : vno + 1);
+    if (ret == 0)
+        ret = kadm5_log_flush(context, sp);
+
+    if (ret == 0 && off == 0 && nop_type != kadm_nop_plain)
+        ret = kadm5_log_nop(context, nop_type);
+
+    if (ret == 0 && off != 0)
+        ret = kadm5_log_recover(context, kadm_recover_commit);
+
+out:
+    krb5_storage_free(sp);
     return ret;
 }
 
 /*
- * Read a `nop' log operation from `sp' and apply it.
+ * Read a `nop' log operation from `sp' and "apply" it (there's nothing
+ * to do).
+ *
+ * FIXME Actually, if the nop payload is 4 bytes and contains an enum
+ * kadm_nop_type value of kadm_nop_trunc then we should truncate the
+ * log, and if it contains a kadm_nop_close then we should rename a new
+ * log into place.  However, this is not implemented yet.
  */
-
 static kadm5_ret_t
-kadm5_log_replay_nop (kadm5_server_context *context,
-		      uint32_t ver,
-		      uint32_t len,
-		      krb5_storage *sp)
+kadm5_log_replay_nop(kadm5_server_context *context,
+		     uint32_t ver,
+		     uint32_t len,
+		     krb5_storage *sp)
 {
     return 0;
 }
 
+struct replay_cb_data {
+    size_t count;
+    uint32_t ver;
+    enum kadm_recover_mode mode;
+};
+
+
 /*
- * Call `func' for each log record in the log in `context'
+ * Recover or perform the initial commit of an unconfirmed log entry
  */
+static kadm5_ret_t
+recover_replay(kadm5_server_context *context,
+               uint32_t ver, time_t timestamp, enum kadm_ops op,
+               uint32_t len, krb5_storage *sp, void *ctx)
+{
+    struct replay_cb_data *data = ctx;
+    kadm5_ret_t ret;
+    off_t off;
+
+    /* On initial commit there must be just one pending unconfirmed entry */
+    if (data->count > 0 && data->mode == kadm_recover_commit)
+        return KADM5_LOG_CORRUPT;
+
+    /* We're at the start of the payload; compute end of entry offset */
+    off = krb5_storage_seek(sp, 0, SEEK_CUR) + len + LOG_TRAILER_SZ;
+
+    /* We cannot perform log recovery on LDAP and such backends */
+    if (data->mode == kadm_recover_replay &&
+        (context->db->hdb_capability_flags & HDB_CAP_F_SHARED_DIRECTORY))
+        ret = 0;
+    else
+        ret = kadm5_log_replay(context, op, ver, len, sp);
+    switch (ret) {
+    case HDB_ERR_NOENTRY:
+    case HDB_ERR_EXISTS:
+        if (data->mode != kadm_recover_replay)
+            return ret;
+    case 0:
+        break;
+    case KADM5_LOG_CORRUPT:
+        return -1;
+    default:
+        krb5_warn(context->context, ret, "unexpected error while replaying");
+        return -1;
+    }
+    data->count++;
+    data->ver = ver;
+
+    /*
+     * With replay we may be making multiple HDB changes.  We must sync the
+     * confirmation of each one before moving on to the next.  Otherwise, we
+     * might attempt to replay multiple already applied updates, and this may
+     * introduce unintended intermediate states or fail to yield the same final
+     * result.
+     */
+    kadm5_log_set_version(context, ver);
+    ret = log_update_uber(context, off);
+    if (ret == 0 && data->mode != kadm_recover_commit)
+        ret = krb5_storage_fsync(sp);
+    return ret;
+}
+
 
 kadm5_ret_t
-kadm5_log_foreach (kadm5_server_context *context,
-		   void (*func)(kadm5_server_context *server_context,
-				uint32_t ver,
-				time_t timestamp,
-				enum kadm_ops op,
-				uint32_t len,
-				krb5_storage *,
-				void *),
-		   void *ctx)
+kadm5_log_recover(kadm5_server_context *context, enum kadm_recover_mode mode)
 {
+    kadm5_ret_t ret;
+    krb5_storage *sp;
+    struct replay_cb_data replay_data;
+
+    replay_data.count = 0;
+    replay_data.ver = 0;
+    replay_data.mode = mode;
+
+    sp = kadm5_log_goto_end(context, context->log_context.log_fd);
+    if (sp == NULL)
+        return errno ? errno : EIO;
+
+    ret = kadm5_log_foreach(context, kadm_forward | kadm_unconfirmed,
+                            NULL, recover_replay, &replay_data);
+    if (ret == 0 && mode == kadm_recover_commit && replay_data.count != 1)
+        ret = KADM5_LOG_CORRUPT;
+    krb5_storage_free(sp);
+    return ret;
+}
+
+/*
+ * Call `func' for each log record in the log in `context'.
+ *
+ * `func' is optional.
+ *
+ * If `func' returns -1 then log traversal terminates and this returns 0.
+ * Otherwise `func''s return is returned if there are no other errors.
+ */
+kadm5_ret_t
+kadm5_log_foreach(kadm5_server_context *context,
+                  enum kadm_iter_opts iter_opts,
+                  off_t *off_lastp,
+		  kadm5_ret_t (*func)(kadm5_server_context *server_context,
+                                      uint32_t ver, time_t timestamp,
+                                      enum kadm_ops op, uint32_t len,
+                                      krb5_storage *sp, void *ctx),
+		  void *ctx)
+{
+    kadm5_ret_t ret = 0;
     int fd = context->log_context.log_fd;
     krb5_storage *sp;
+    off_t off_last;
+    off_t this_entry = 0;
+    off_t log_end = 0;
+
+    if (strcmp(context->log_context.log_file, "/dev/null") == 0)
+        return 0;
+
+    if (off_lastp == NULL)
+        off_lastp = &off_last;
+    *off_lastp = -1;
+
+    if (((iter_opts & kadm_forward) && (iter_opts & kadm_backward)) ||
+        (!(iter_opts & kadm_confirmed) && !(iter_opts & kadm_unconfirmed)))
+        return EINVAL;
+
+    if ((iter_opts & kadm_forward) && (iter_opts & kadm_confirmed) &&
+        (iter_opts & kadm_unconfirmed)) {
+        /*
+         * We want to traverse all log entries, confirmed or not, from
+         * the start, then there's no need to kadm5_log_goto_end()
+         * -- no reason to try to find the end.
+         */
+        sp = krb5_storage_from_fd(fd);
+        if (sp == NULL)
+            return errno;
+
+        log_end = krb5_storage_seek(sp, 0, SEEK_END);
+        if (log_end == -1 ||
+            krb5_storage_seek(sp, 0, SEEK_SET) == -1) {
+            ret = errno;
+            krb5_storage_free(sp);
+            return ret;
+        }
+    } else {
+        /* Get the end of the log based on the uber entry */
+        sp = kadm5_log_goto_end(context, fd);
+        if (sp == NULL)
+            return errno;
+        log_end = krb5_storage_seek(sp, 0, SEEK_CUR);
+    }
+
+    *off_lastp = log_end;
+
+    if ((iter_opts & kadm_forward) && (iter_opts & kadm_confirmed)) {
+        /* Start at the beginning */
+        if (krb5_storage_seek(sp, 0, SEEK_SET) == -1) {
+            ret = errno;
+            krb5_storage_free(sp);
+            return ret;
+        }
+    } else if ((iter_opts & kadm_backward) && (iter_opts & kadm_unconfirmed)) {
+        /*
+         * We're at the confirmed end but need to be at the unconfirmed
+         * end.  Skip forward to the real end, re-entering to do it.
+         */
+        ret = kadm5_log_foreach(context, kadm_forward | kadm_unconfirmed,
+                                &log_end, NULL, NULL);
+        if (ret)
+            return ret;
+        if (krb5_storage_seek(sp, log_end, SEEK_SET) == -1) {
+            ret = errno;
+            krb5_storage_free(sp);
+            return ret;
+        }
+    }
 
-    lseek (fd, 0, SEEK_SET);
-    sp = krb5_storage_from_fd (fd);
     for (;;) {
-	int32_t ver, timestamp, op, len, len2, ver2;
+	uint32_t ver, ver2, len, len2;
+	uint32_t tstamp;
+        time_t timestamp;
+        enum kadm_ops op;
 
-	if(krb5_ret_int32 (sp, &ver) != 0)
+        if ((iter_opts & kadm_backward)) {
+            off_t o;
+
+            o = krb5_storage_seek(sp, 0, SEEK_CUR);
+            if (o == 0 ||
+                ((iter_opts & kadm_unconfirmed) && o <= *off_lastp))
+                break;
+            ret = kadm5_log_previous(context->context, sp, &ver,
+                                     &timestamp, &op, &len);
+            if (ret)
+                break;
+
+            /* Offset is now at payload of current entry */
+
+            o = krb5_storage_seek(sp, 0, SEEK_CUR);
+            if (o == -1) {
+                ret = errno;
+                break;
+            }
+            this_entry = o - LOG_HEADER_SZ;
+            if (this_entry < 0) {
+                ret = KADM5_LOG_CORRUPT;
+                break;
+            }
+        } else {
+            /* Offset is now at start of current entry, read header */
+            this_entry = krb5_storage_seek(sp, 0, SEEK_CUR);
+            if (!(iter_opts & kadm_unconfirmed) && this_entry == log_end)
+                break;
+            ret = get_header(sp, LOG_NOPEEK, &ver, &tstamp, &op, &len);
+            if (ret == HEIM_ERR_EOF) {
+                ret = 0;
+                break;
+            }
+            timestamp = tstamp;
+            if (ret)
+                break;
+            /* Offset is now at payload of current entry */
+        }
+
+        /* Validate trailer before calling the callback */
+        if (krb5_storage_seek(sp, len, SEEK_CUR) == -1) {
+            ret = errno;
+            break;
+        }
+
+	ret = krb5_ret_uint32(sp, &len2);
+        if (ret)
+            break;
+	ret = krb5_ret_uint32(sp, &ver2);
+        if (ret)
+            break;
+	if (len != len2 || ver != ver2) {
+            ret = KADM5_LOG_CORRUPT;
 	    break;
-	krb5_ret_int32 (sp, &timestamp);
-	krb5_ret_int32 (sp, &op);
-	krb5_ret_int32 (sp, &len);
-	(*func)(context, ver, timestamp, op, len, sp, ctx);
-	krb5_ret_int32 (sp, &len2);
-	krb5_ret_int32 (sp, &ver2);
-	if (len != len2)
-	    abort();
-	if (ver != ver2)
-	    abort();
+        }
+
+        /* Rewind to start of payload and call callback if we have one */
+        if (krb5_storage_seek(sp, this_entry + LOG_HEADER_SZ,
+                              SEEK_SET) == -1) {
+            ret = errno;
+            break;
+        }
+
+        if (func != NULL) {
+            ret = (*func)(context, ver, timestamp, op, len, sp, ctx);
+            if (ret) {
+                /* Callback signals desire to stop by returning -1 */
+                if (ret == -1)
+                    ret = 0;
+                break;
+            }
+        }
+        if ((iter_opts & kadm_forward)) {
+            off_t o;
+
+            o = krb5_storage_seek(sp, this_entry+LOG_WRAPPER_SZ+len, SEEK_SET);
+            if (o == -1) {
+                ret = errno;
+                break;
+            }
+            if (o > log_end)
+                *off_lastp = o;
+        } else if ((iter_opts & kadm_backward)) {
+            /*
+             * Rewind to the start of this entry so kadm5_log_previous()
+             * can find the previous one.
+             */
+            if (krb5_storage_seek(sp, this_entry, SEEK_SET) == -1) {
+                ret = errno;
+                break;
+            }
+        }
+    }
+    if ((ret == HEIM_ERR_EOF || ret == KADM5_LOG_CORRUPT) &&
+        (iter_opts & kadm_forward) &&
+        context->log_context.lock_mode == LOCK_EX) {
+        /*
+         * Truncate partially written last log entry so we can write
+         * again.
+         */
+        ret = krb5_storage_truncate(sp, this_entry);
+        if (ret == 0 &&
+            krb5_storage_seek(sp, this_entry, SEEK_SET) == -1)
+            ret = errno;
+        krb5_warnx(context->context, "Truncating log at partial or "
+                   "corrupt %s entry",
+                   this_entry > log_end ? "unconfirmed" : "confirmed");
     }
     krb5_storage_free(sp);
-    return 0;
+    return ret;
+}
+
+/*
+ * Go to the second record, which, if we have an uber record, will be
+ * the first record.
+ */
+static krb5_storage *
+log_goto_first(kadm5_server_context *server_context, int fd)
+{
+    krb5_storage *sp;
+    enum kadm_ops op;
+    uint32_t ver, len;
+    kadm5_ret_t ret;
+
+    if (fd == -1) {
+        errno = EINVAL;
+        return NULL;
+    }
+
+    sp = krb5_storage_from_fd(fd);
+    if (sp == NULL)
+        return NULL;
+
+    if (krb5_storage_seek(sp, 0, SEEK_SET) == -1)
+        return NULL;
+
+    ret = get_header(sp, LOG_DOPEEK, &ver, NULL, &op, &len);
+    if (ret) {
+        krb5_storage_free(sp);
+        errno = ret;
+        return NULL;
+    }
+    if (op == kadm_nop && len == LOG_UBER_LEN && seek_next(sp) == -1) {
+        krb5_storage_free(sp);
+        return NULL;
+    }
+    return sp;
 }
 
 /*
  * Go to end of log.
+ *
+ * XXX This really needs to return a kadm5_ret_t and either output a
+ * krb5_storage * via an argument, or take one as input.
  */
 
 krb5_storage *
-kadm5_log_goto_end (int fd)
+kadm5_log_goto_end(kadm5_server_context *server_context, int fd)
 {
+    krb5_error_code ret = 0;
     krb5_storage *sp;
+    enum kadm_ops op;
+    uint32_t ver, len;
+    uint32_t tstamp;
+    uint64_t off;
 
-    sp = krb5_storage_from_fd (fd);
-    krb5_storage_seek(sp, 0, SEEK_END);
+    if (fd == -1) {
+        errno = EINVAL;
+        return NULL;
+    }
+
+    sp = krb5_storage_from_fd(fd);
+    if (sp == NULL)
+        return NULL;
+
+    if (krb5_storage_seek(sp, 0, SEEK_SET) == -1) {
+        ret = errno;
+        goto fail;
+    }
+    ret = get_header(sp, LOG_NOPEEK, &ver, &tstamp, &op, &len);
+    if (ret == HEIM_ERR_EOF) {
+        (void) krb5_storage_seek(sp, 0, SEEK_SET);
+        return sp;
+    }
+    if (ret == KADM5_LOG_CORRUPT)
+        goto truncate;
+    if (ret)
+        goto fail;
+
+    if (op == kadm_nop && len == LOG_UBER_LEN) {
+        /* New style log */
+        ret = krb5_ret_uint64(sp, &off);
+        if (ret)
+            goto truncate;
+
+        if (krb5_storage_seek(sp, off, SEEK_SET) == -1)
+            goto fail;
+
+        if (off >= LOG_UBER_SZ) {
+            ret = get_version_prev(sp, &ver, NULL);
+            if (ret == 0)
+                return sp;
+        }
+        /* Invalid offset in uber entry */
+        goto truncate;
+    }
+
+    /* Old log with no uber entry */
+    if (krb5_storage_seek(sp, 0, SEEK_END) == -1) {
+        static int warned = 0;
+        if (!warned) {
+            warned = 1;
+            krb5_warnx(server_context->context,
+                       "Old log found; truncate it to upgrade");
+        }
+    }
+    ret = get_version_prev(sp, &ver, NULL);
+    if (ret)
+        goto truncate;
     return sp;
+
+truncate:
+    /* If we can, truncate */
+    if (server_context->log_context.lock_mode == LOCK_EX) {
+        ret = kadm5_log_reinit(server_context, 0);
+        if (ret == 0) {
+            krb5_warn(server_context->context, ret,
+                      "Invalid log; truncating to recover");
+            if (krb5_storage_seek(sp, 0, SEEK_END) == -1)
+                return NULL;
+            return sp;
+        }
+    }
+    krb5_warn(server_context->context, ret,
+              "Invalid log; truncate to recover");
+
+fail:
+    errno = ret;
+    krb5_storage_free(sp);
+    return NULL;
 }
 
 /*
  * Return previous log entry.
  *
- * The pointer in `sp´ is assumed to be at the top of the entry before
- * previous entry. On success, the `sp´ pointer is set to data portion
- * of previous entry. In case of error, it's not changed at all.
+ * The pointer in `sp' is assumed to be at the top of the entry after
+ * previous entry (e.g., at EOF).  On success, the `sp' pointer is set to
+ * data portion of previous entry.  In case of error, it's not changed
+ * at all.
  */
-
 kadm5_ret_t
-kadm5_log_previous (krb5_context context,
-		    krb5_storage *sp,
-		    uint32_t *ver,
-		    time_t *timestamp,
-		    enum kadm_ops *op,
-		    uint32_t *len)
+kadm5_log_previous(krb5_context context,
+		   krb5_storage *sp,
+		   uint32_t *verp,
+		   time_t *tstampp,
+		   enum kadm_ops *opp,
+		   uint32_t *lenp)
 {
     krb5_error_code ret;
-    off_t off, oldoff;
-    int32_t tmp;
+    off_t oldoff;
+    uint32_t ver2, len2;
+    uint32_t tstamp;
 
     oldoff = krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (oldoff == -1)
+        goto log_corrupt;
 
-    krb5_storage_seek(sp, -8, SEEK_CUR);
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    *len = tmp;
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    *ver = tmp;
-    off = 24 + *len;
-    krb5_storage_seek(sp, -off, SEEK_CUR);
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    if ((uint32_t)tmp != *ver) {
-	krb5_storage_seek(sp, oldoff, SEEK_SET);
-	krb5_set_error_message(context, KADM5_BAD_DB,
-			       "kadm5_log_previous: log entry "
-			       "have consistency failure, version number wrong "
-			       "(tmp %lu ver %lu)",
-			       (unsigned long)tmp,
-			       (unsigned long)*ver);
-	return KADM5_BAD_DB;
-    }
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    *timestamp = tmp;
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    *op = tmp;
-    ret = krb5_ret_int32 (sp, &tmp);
-    if (ret)
-	goto end_of_storage;
-    if ((uint32_t)tmp != *len) {
-	krb5_storage_seek(sp, oldoff, SEEK_SET);
-	krb5_set_error_message(context, KADM5_BAD_DB,
-			       "kadm5_log_previous: log entry "
-			       "have consistency failure, length wrong");
-	return KADM5_BAD_DB;
+    /* This reads the physical version of the uber record */
+    if (seek_prev(sp, verp, lenp) == -1)
+        goto log_corrupt;
+
+    ret = get_header(sp, LOG_NOPEEK, &ver2, &tstamp, opp, &len2);
+    if (ret) {
+        (void) krb5_storage_seek(sp, oldoff, SEEK_SET);
+        return ret;
     }
+    if (tstampp)
+        *tstampp = tstamp;
+    if (ver2 != *verp || len2 != *lenp)
+        goto log_corrupt;
+
     return 0;
 
- end_of_storage:
-    krb5_storage_seek(sp, oldoff, SEEK_SET);
-    krb5_set_error_message(context, ret, "kadm5_log_previous: end of storage "
-			   "reached before end");
-    return ret;
+log_corrupt:
+    (void) krb5_storage_seek(sp, oldoff, SEEK_SET);
+    return KADM5_LOG_CORRUPT;
 }
 
 /*
@@ -924,65 +2229,367 @@ kadm5_log_previous (krb5_context context,
  */
 
 kadm5_ret_t
-kadm5_log_replay (kadm5_server_context *context,
-		  enum kadm_ops op,
-		  uint32_t ver,
-		  uint32_t len,
-		  krb5_storage *sp)
+kadm5_log_replay(kadm5_server_context *context,
+		 enum kadm_ops op,
+		 uint32_t ver,
+		 uint32_t len,
+		 krb5_storage *sp)
 {
     switch (op) {
     case kadm_create :
-	return kadm5_log_replay_create (context, ver, len, sp);
+	return kadm5_log_replay_create(context, ver, len, sp);
     case kadm_delete :
-	return kadm5_log_replay_delete (context, ver, len, sp);
+	return kadm5_log_replay_delete(context, ver, len, sp);
     case kadm_rename :
-	return kadm5_log_replay_rename (context, ver, len, sp);
+	return kadm5_log_replay_rename(context, ver, len, sp);
     case kadm_modify :
-	return kadm5_log_replay_modify (context, ver, len, sp);
+	return kadm5_log_replay_modify(context, ver, len, sp);
     case kadm_nop :
-	return kadm5_log_replay_nop (context, ver, len, sp);
+	return kadm5_log_replay_nop(context, ver, len, sp);
     default :
+        /*
+         * FIXME This default arm makes it difficult to add new kadm_ops
+         *       values.
+         */
 	krb5_set_error_message(context->context, KADM5_FAILURE,
 			       "Unsupported replay op %d", (int)op);
+        (void) krb5_storage_seek(sp, len, SEEK_CUR);
 	return KADM5_FAILURE;
     }
 }
 
-/*
- * truncate the log - i.e. create an empty file with just (nop vno + 2)
- */
+struct load_entries_data {
+    krb5_data *entries;
+    unsigned char *p;
+    uint32_t first;
+    uint32_t last;
+    size_t bytes;
+    size_t nentries;
+    size_t maxbytes;
+    size_t maxentries;
+};
 
+
+/*
+ * Prepend one entry with header and trailer to the entry buffer, stopping when
+ * we've reached either of the byte or entry-count limits (if non-zero).
+ *
+ * This is a two-pass algorithm:
+ *
+ * In the first pass, when entries->entries == NULL,  we compute the space
+ * required, and count the entries that fit up from zero.
+ *
+ * In the second pass we fill the buffer, and count the entries back down to
+ * zero.  The space used must be an exact fit, and the number of entries must
+ * reach zero at that point or an error is returned.
+ *
+ * The caller MUST check that entries->nentries == 0 at the end of the second
+ * pass.
+ */
+static kadm5_ret_t
+load_entries_cb(kadm5_server_context *server_context,
+            uint32_t ver,
+            time_t timestamp,
+            enum kadm_ops op,
+            uint32_t len,
+            krb5_storage *sp,
+            void *ctx)
+{
+    struct load_entries_data *entries = ctx;
+    kadm5_ret_t ret;
+    ssize_t bytes;
+    size_t entry_len = len + LOG_WRAPPER_SZ;
+    unsigned char *base;
+
+    if (entries->entries == NULL) {
+        size_t total = entries->bytes + entry_len;
+
+        /*
+         * First run: find the size of krb5_data buffer needed.
+         *
+         * If the log was huge we'd have to perhaps open a temp file for this.
+         * For now KISS.
+         */
+        if ((op == kadm_nop && entry_len == LOG_UBER_SZ) ||
+            entry_len < len /*overflow?*/ ||
+            (entries->maxbytes > 0 && total > entries->maxbytes) ||
+            total < entries->bytes /*overflow?*/ ||
+            (entries->maxentries > 0 && entries->nentries == entries->maxentries))
+            return -1; /* stop iteration */
+        entries->bytes = total;
+        entries->first = ver;
+        if (entries->nentries++ == 0)
+            entries->last = ver;
+        return 0;
+    }
+
+    /* Second run: load the data into memory */
+    base = (unsigned char *)entries->entries->data;
+    if (entries->p - base < entry_len && entries->p != base) {
+        /*
+         * This can't happen normally: we stop the log record iteration
+         * above before we get here.  This could happen if someone wrote
+         * garbage to the log while we were traversing it.  We return an
+         * error instead of asserting.
+         */
+        return KADM5_LOG_CORRUPT;
+    }
+
+    /*
+     * sp here is a krb5_storage_from_fd() of the log file, and the
+     * offset pointer points at the current log record payload.
+     *
+     * Seek back to the start of the record poayload so we can read the
+     * whole record.
+     */
+    if (krb5_storage_seek(sp, -LOG_HEADER_SZ, SEEK_CUR) == -1)
+        return errno;
+
+    /*
+     * We read the header, payload, and trailer into the buffer we have, that
+     * many bytes before the previous record we read.
+     */
+    errno = 0;
+    bytes = krb5_storage_read(sp, entries->p - entry_len, entry_len);
+    ret = errno;
+    if (bytes < 0 || bytes != entry_len)
+        return ret ? ret : EIO;
+
+    entries->first = ver;
+    --entries->nentries;
+    entries->p -= entry_len;
+    return (entries->p == base) ? -1 : 0;
+}
+
+
+/*
+ * Serialize a tail fragment of the log as a krb5_data, this is constrained to
+ * at most `maxbytes' bytes and to at most `maxentries' entries if not zero.
+ */
+static kadm5_ret_t
+load_entries(kadm5_server_context *context, krb5_data *p,
+             size_t maxentries, size_t maxbytes,
+             uint32_t *first, uint32_t *last)
+{
+    struct load_entries_data entries;
+    kadm5_ret_t ret;
+    unsigned char *base;
+
+    krb5_data_zero(p);
+
+    *first = 0;
+
+    memset(&entries, 0, sizeof(entries));
+    entries.entries = NULL;
+    entries.p = NULL;
+    entries.maxentries = maxentries;
+    entries.maxbytes = maxbytes;
+
+    /* Figure out how many bytes it will take */
+    ret = kadm5_log_foreach(context, kadm_backward | kadm_confirmed,
+                            NULL, load_entries_cb, &entries);
+    if (ret)
+        return ret;
+
+    /*
+     * If no entries fit our limits, we do not truncate, instead the caller can
+     * call kadm5_log_reinit() if desired.
+     */
+    if (entries.bytes == 0)
+        return 0;
+
+    ret = krb5_data_alloc(p, entries.bytes);
+    if (ret)
+        return ret;
+
+    *first = entries.first;
+    *last = entries.last;
+    entries.entries = p;
+    base = (unsigned char *)entries.entries->data;
+    entries.p = base + entries.bytes;
+
+    ret = kadm5_log_foreach(context, kadm_backward | kadm_confirmed,
+                            NULL, load_entries_cb, &entries);
+    if (ret == 0 &&
+        (entries.nentries || entries.p != base || entries.first != *first))
+            ret = KADM5_LOG_CORRUPT;
+    if (ret)
+        krb5_data_free(p);
+    return ret;
+}
+
+/*
+ * Truncate the log, retaining at most `keep' entries and at most `maxbytes'.
+ * If `maxbytes' is zero, keep at most the default log size limit.
+ */
 kadm5_ret_t
-kadm5_log_truncate (kadm5_server_context *server_context)
+kadm5_log_truncate(kadm5_server_context *context, size_t keep, size_t maxbytes)
 {
     kadm5_ret_t ret;
-    uint32_t vno;
+    uint32_t first, last, last_tstamp;
+    time_t now = time(NULL);
+    krb5_data entries;
+    krb5_storage *sp;
+    ssize_t bytes;
+    uint64_t sz;
+    off_t off;
 
-    ret = kadm5_log_init (server_context);
+    if (maxbytes == 0)
+        maxbytes = get_max_log_size(context->context);
+
+    if (strcmp(context->log_context.log_file, "/dev/null") == 0)
+        return 0;
+
+    if (context->log_context.read_only)
+        return EROFS;
+
+    /* Get the desired records. */
+    krb5_data_zero(&entries);
+    ret = load_entries(context, &entries, keep, maxbytes, &first, &last);
     if (ret)
-	return ret;
+        return ret;
 
-    ret = kadm5_log_get_version (server_context, &vno);
-    if (ret)
-	return ret;
+    if (first == 0) {
+        /*
+         * No records found/fit within resource limits.  The caller should call
+         * kadm5_log_reinit(context) to truly truncate and reset the log to
+         * version 0, else call again with better limits.
+         */
+        krb5_data_free(&entries);
+        return EINVAL;
+    }
 
-    ret = kadm5_log_reinit (server_context);
-    if (ret)
-	return ret;
+    /* Check that entries.length won't overflow off_t */
+    sz = LOG_UBER_SZ + entries.length;
+    off = (off_t)sz;
+    if (off < 0 || off != sz || sz < entries.length) {
+        krb5_data_free(&entries);
+        return EOVERFLOW; /* caller should ask for fewer entries */
+    }
 
-    ret = kadm5_log_set_version (server_context, vno);
-    if (ret)
-	return ret;
+    /* Truncate to zero size and seek to zero offset */
+    if (ftruncate(context->log_context.log_fd, 0) < 0 ||
+        lseek(context->log_context.log_fd, 0, SEEK_SET) < 0) {
+        krb5_data_free(&entries);
+        return errno;
+    }
 
-    ret = kadm5_log_nop (server_context);
-    if (ret)
-	return ret;
+    /*
+     * Write the uber record and then the records loaded.  Confirm the entries
+     * after writing them.
+     *
+     * If we crash then the log may not have all the entries we want, and
+     * replaying only some of the entries will leave us in a bad state.
+     * Additionally, we don't have mathematical proof that replaying the last
+     * N>1 entries is always idempotent.  And though we believe we can make
+     * such replays idempotent, they would still leave the HDB with
+     * intermediate states that would not have occurred on the master.
+     *
+     * By initially setting the offset in the uber record to 0, the log will be
+     * seen as invalid should we crash here, thus the only
+     * harm will be that we'll reinitialize the log and force full props.
+     *
+     * We can't use the normal kadm5_log_*() machinery for this because
+     * we must set specific version numbers and timestamps.  To keep
+     * things simple we don't try to do a single atomic write here as we
+     * do in kadm5_log_flush().
+     *
+     * We really do want to keep the new first entry's version and
+     * timestamp so we don't trip up iprop.
+     *
+     * Keep this in sync with kadm5_log_nop().
+     */
+    sp = krb5_storage_from_fd(context->log_context.log_fd);
+    if (sp == NULL) {
+        ret = errno;
+        krb5_warn(context->context, ret, "Unable to keep entries");
+        krb5_data_free(&entries);
+        return errno;
+    }
+    ret = krb5_store_uint32(sp, 0);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, now);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, kadm_nop);      /* end of preamble */
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, LOG_UBER_LEN);  /* end of header */
+    if (ret == 0)
+        ret = krb5_store_uint64(sp, LOG_UBER_SZ);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, now);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, last);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, LOG_UBER_LEN);
+    if (ret == 0)
+        ret = krb5_store_uint32(sp, 0);             /* end of trailer */
+    if (ret == 0) {
+        bytes = krb5_storage_write(sp, entries.data, entries.length);
+        if (bytes == -1)
+            ret = errno;
+    }
+    if (ret == 0)
+        ret = krb5_storage_fsync(sp);
+    /* Confirm all the records now */
+    if (ret == 0) {
+        if (krb5_storage_seek(sp, LOG_HEADER_SZ, SEEK_SET) == -1)
+            ret = errno;
+    }
+    if (ret == 0)
+        ret = krb5_store_uint64(sp, off);
+    krb5_data_free(&entries);
+    krb5_storage_free(sp);
 
-    ret = kadm5_log_end (server_context);
-    if (ret)
-	return ret;
-    return 0;
+    if (ret) {
+        krb5_warn(context->context, ret, "Unable to keep entries");
+        (void) ftruncate(context->log_context.log_fd, LOG_UBER_SZ);
+        (void) lseek(context->log_context.log_fd, 0, SEEK_SET);
+        return ret;
+    }
 
+    /* Done.  Now rebuild the log_context state. */
+    (void) lseek(context->log_context.log_fd, off, SEEK_SET);
+    sp = kadm5_log_goto_end(context, context->log_context.log_fd);
+    if (sp == NULL)
+        return ENOMEM;
+    ret = get_version_prev(sp, &context->log_context.version, &last_tstamp);
+    context->log_context.last_time = last_tstamp;
+    krb5_storage_free(sp);
+    return ret;
+}
+
+/*
+ * "Truncate" the log if not read only and over the desired maximum size.  We
+ * attempt to retain 1/4 of the existing storage.
+ *
+ * Called after successful log recovery, so at this point we must have no
+ * unconfirmed entries in the log.
+ */
+static kadm5_ret_t
+truncate_if_needed(kadm5_server_context *context)
+{
+    kadm5_ret_t ret = 0;
+    kadm5_log_context *log_context = &context->log_context;
+    size_t maxbytes;
+    struct stat st;
+
+    if (log_context->log_fd == -1 || log_context->read_only)
+        return 0;
+    if (strcmp(context->log_context.log_file, "/dev/null") == 0)
+        return 0;
+
+    maxbytes = get_max_log_size(context->context);
+    if (maxbytes <= 0)
+        return 0;
+
+    if (fstat(log_context->log_fd, &st) == -1)
+        return errno;
+    if (st.st_size == (size_t)st.st_size && (size_t)st.st_size <= maxbytes)
+        return 0;
+
+    /* Shrink the log by a factor of 4 */
+    ret = kadm5_log_truncate(context, 0, maxbytes/4);
+    return ret == EINVAL ? 0 : ret;
 }
 
 #ifndef NO_UNIX_SOCKETS
@@ -993,9 +2600,13 @@ static HEIMDAL_MUTEX signal_mutex = HEIMDAL_MUTEX_INITIALIZER;
 const char *
 kadm5_log_signal_socket(krb5_context context)
 {
+    int ret = 0;
+
     HEIMDAL_MUTEX_lock(&signal_mutex);
     if (!default_signal)
-	asprintf(&default_signal, "%s/signal", hdb_db_dir(context));
+	ret = asprintf(&default_signal, "%s/signal", hdb_db_dir(context));
+    if (ret == -1)
+	default_signal = NULL;
     HEIMDAL_MUTEX_unlock(&signal_mutex);
 
     return krb5_config_get_string_default(context,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/marshall.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/marshall.c
index 60a3987c4..061c6dc23 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/marshall.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/marshall.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: marshall.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: marshall.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,40 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: marshall.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
+
+int
+kadm5_some_keys_are_bogus(size_t n_keys, krb5_key_data *keys)
+{
+    size_t i;
+
+    for (i = 0; i < n_keys; i++) {
+	krb5_key_data *key = &keys[i];
+	if (key->key_data_length[0] == sizeof(KADM5_BOGUS_KEY_DATA) - 1 &&
+	    ct_memcmp(key->key_data_contents[1], KADM5_BOGUS_KEY_DATA,
+		      key->key_data_length[0]) == 0)
+	    return 1;
+    }
+    return 0;
+}
+
+int
+kadm5_all_keys_are_bogus(size_t n_keys, krb5_key_data *keys)
+{
+    size_t i;
+
+    if (n_keys == 0)
+	return 0;
+
+    for (i = 0; i < n_keys; i++) {
+	krb5_key_data *key = &keys[i];
+	if (key->key_data_length[0] != sizeof(KADM5_BOGUS_KEY_DATA) - 1 ||
+	    ct_memcmp(key->key_data_contents[1], KADM5_BOGUS_KEY_DATA,
+		      key->key_data_length[0]) != 0)
+	    return 0;
+    }
+    return 1;
+}
 
 kadm5_ret_t
 kadm5_store_key_data(krb5_storage *sp,
@@ -55,6 +88,36 @@ kadm5_store_key_data(krb5_storage *sp,
     return 0;
 }
 
+kadm5_ret_t
+kadm5_store_fake_key_data(krb5_storage *sp,
+		          krb5_key_data *key)
+{
+    krb5_data c;
+
+    krb5_store_int32(sp, key->key_data_ver);
+    krb5_store_int32(sp, key->key_data_kvno);
+    krb5_store_int32(sp, key->key_data_type[0]);
+
+    /*
+     * This is the key contents.  We want it to be obvious to the client
+     * (if it really did want the keys) that the key won't work.
+     * 32-bit keys are no good for any enctype, so that should do.
+     * Clients that didn't need keys will ignore this, and clients that
+     * did want keys will either fail or they'll, say, create bogus
+     * keytab entries that will subsequently fail to be useful.
+     */
+    c.length = sizeof (KADM5_BOGUS_KEY_DATA) - 1;
+    c.data = KADM5_BOGUS_KEY_DATA;
+    krb5_store_data(sp, c);
+
+    /* This is the salt -- no need to send garbage */
+    krb5_store_int32(sp, key->key_data_type[1]);
+    c.length = key->key_data_length[1];
+    c.data = key->key_data_contents[1];
+    krb5_store_data(sp, c);
+    return 0;
+}
+
 kadm5_ret_t
 kadm5_ret_key_data(krb5_storage *sp,
 		   krb5_key_data *key)
@@ -107,7 +170,7 @@ kadm5_ret_tl_data(krb5_storage *sp,
 static kadm5_ret_t
 store_principal_ent(krb5_storage *sp,
 		    kadm5_principal_ent_t princ,
-		    uint32_t mask)
+		    uint32_t mask, int wkeys)
 {
     int i;
 
@@ -151,8 +214,12 @@ store_principal_ent(krb5_storage *sp,
 	krb5_store_int32(sp, princ->fail_auth_count);
     if (mask & KADM5_KEY_DATA) {
 	krb5_store_int32(sp, princ->n_key_data);
-	for(i = 0; i < princ->n_key_data; i++)
-	    kadm5_store_key_data(sp, &princ->key_data[i]);
+	for(i = 0; i < princ->n_key_data; i++) {
+	    if (wkeys)
+		kadm5_store_key_data(sp, &princ->key_data[i]);
+	    else
+		kadm5_store_fake_key_data(sp, &princ->key_data[i]);
+	}
     }
     if (mask & KADM5_TL_DATA) {
 	krb5_tl_data *tp;
@@ -169,7 +236,14 @@ kadm5_ret_t
 kadm5_store_principal_ent(krb5_storage *sp,
 			  kadm5_principal_ent_t princ)
 {
-    return store_principal_ent (sp, princ, ~0);
+    return store_principal_ent (sp, princ, ~0, 1);
+}
+
+kadm5_ret_t
+kadm5_store_principal_ent_nokeys(krb5_storage *sp,
+			        kadm5_principal_ent_t princ)
+{
+    return store_principal_ent (sp, princ, ~0, 0);
 }
 
 kadm5_ret_t
@@ -178,7 +252,7 @@ kadm5_store_principal_ent_mask(krb5_storage *sp,
 			       uint32_t mask)
 {
     krb5_store_int32(sp, mask);
-    return store_principal_ent (sp, princ, mask);
+    return store_principal_ent (sp, princ, mask, 1);
 }
 
 static kadm5_ret_t
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_c.c
index 0b6e72a5b..8f46060c3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: modify_c.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: modify_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: modify_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_modify_principal(void *server_handle,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_s.c
index 60b15785d..c0d45b186 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/modify_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: modify_s.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: modify_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001, 2003, 2005-2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: modify_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static kadm5_ret_t
 modify_principal(void *server_handle,
@@ -46,43 +46,87 @@ modify_principal(void *server_handle,
     kadm5_server_context *context = server_handle;
     hdb_entry_ex ent;
     kadm5_ret_t ret;
+
+    memset(&ent, 0, sizeof(ent));
+
     if((mask & forbidden_mask))
 	return KADM5_BAD_MASK;
     if((mask & KADM5_POLICY) && strcmp(princ->policy, "default"))
 	return KADM5_UNK_POLICY;
 
-    memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret)
+	    return ret;
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db,
 				      princ->principal, HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
-    if(ret)
-	goto out;
+    if (ret)
+	goto out2;
     ret = _kadm5_setup_entry(context, &ent, mask, princ, mask, NULL, 0);
-    if(ret)
-	goto out2;
+    if (ret)
+	goto out3;
     ret = _kadm5_set_modifier(context, &ent.entry);
-    if(ret)
-	goto out2;
+    if (ret)
+	goto out3;
+
+    /*
+     * If any keys are bogus, disallow the modify.  If the keys were
+     * bogus as stored in the HDB we could allow those through, but
+     * distinguishing that case from a pre-1.6 client using add_enctype
+     * without the get-keys privilege requires more work (mainly: checking that
+     * the bogus keys in princ->key_data[] have corresponding bogus keys in ent
+     * before calling _kadm5_setup_entry()).
+     */
+    if ((mask & KADM5_KEY_DATA) &&
+	kadm5_some_keys_are_bogus(princ->n_key_data, princ->key_data)) {
+	ret = KADM5_AUTH_GET_KEYS; /* Not quite appropriate, but it'll do */
+	goto out3;
+    }
 
     ret = hdb_seal_keys(context->context, context->db, &ent.entry);
     if (ret)
-	goto out2;
+	goto out3;
 
-    ret = context->db->hdb_store(context->context, context->db,
-			     HDB_F_REPLACE, &ent);
-    if (ret)
-	goto out2;
+    if ((mask & KADM5_POLICY)) {
+	HDB_extension ext;
 
-    kadm5_log_modify (context,
-		      &ent.entry,
-		      mask | KADM5_MOD_NAME | KADM5_MOD_TIME);
+        memset(&ext, 0, sizeof(ext));
+        /* XXX should be TRUE, but we don't yet support policies */
+        ext.mandatory = FALSE;
+	ext.data.element = choice_HDB_extension_data_policy;
+	ext.data.u.policy = strdup(princ->policy);
+	if (ext.data.u.policy == NULL) {
+	    ret = ENOMEM;
+	    goto out3;
+	}
+	/* This calls free_HDB_extension(), freeing ext.data.u.policy */
+	ret = hdb_replace_extension(context->context, &ent.entry, &ext);
+        free(ext.data.u.policy);
+	if (ret)
+	    goto out3;
+    }
 
-out2:
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_modify(context, &ent.entry,
+                           mask | KADM5_MOD_NAME | KADM5_MOD_TIME);
+
+ out3:
     hdb_free_entry(context->context, &ent);
-out:
-    context->db->hdb_close(context->context, context->db);
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/password_quality.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/password_quality.c
index 49a1061ef..7ba65549e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/password_quality.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/password_quality.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: password_quality.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: password_quality.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000, 2003-2005 Kungliga Tekniska Högskolan
@@ -380,23 +380,24 @@ kadm5_add_passwd_quality_verifier(krb5_context context,
 #ifdef HAVE_DLOPEN
 
     if(check_library == NULL) {
-	krb5_error_code ret;
+	krb5_error_code ret = 0;
+        char **strs;
 	char **tmp;
 
-	tmp = krb5_config_get_strings(context, NULL,
-				      "password_quality",
-				      "policy_libraries",
-				      NULL);
-	if(tmp == NULL || *tmp == NULL)
+	strs = krb5_config_get_strings(context, NULL,
+				       "password_quality",
+				       "policy_libraries",
+				       NULL);
+	if (strs == NULL)
 	    return 0;
 
-	while (*tmp) {
+	for (tmp = strs; *tmp; tmp++) {
 	    ret = add_verifier(context, *tmp);
 	    if (ret)
-		return ret;
-	    tmp++;
+		break;
 	}
-	return 0;
+        krb5_config_free_strings(strs);
+	return ret;
     } else {
 	return add_verifier(context, check_library);
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/private.h b/crypto/external/bsd/heimdal/dist/lib/kadm5/private.h
index c6da49d5c..847294a78 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/private.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/private.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: private.h,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $	*/
+/*	$NetBSD: private.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
@@ -38,10 +38,16 @@
 #ifndef __kadm5_privatex_h__
 #define __kadm5_privatex_h__
 
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
 struct kadm_func {
-    kadm5_ret_t (*chpass_principal) (void *, krb5_principal, const char*);
-    kadm5_ret_t (*create_principal) (void*, kadm5_principal_ent_t,
-				     uint32_t, const char*);
+    kadm5_ret_t (*chpass_principal) (void *, krb5_principal, int,
+				     int, krb5_key_salt_tuple*, const char*);
+    kadm5_ret_t (*create_principal) (void*, kadm5_principal_ent_t, uint32_t,
+				     int, krb5_key_salt_tuple *,
+				     const char*);
     kadm5_ret_t (*delete_principal) (void*, krb5_principal);
     kadm5_ret_t (*destroy) (void*);
     kadm5_ret_t (*flush) (void*);
@@ -50,11 +56,17 @@ struct kadm_func {
     kadm5_ret_t (*get_principals) (void*, const char*, char***, int*);
     kadm5_ret_t (*get_privs) (void*, uint32_t*);
     kadm5_ret_t (*modify_principal) (void*, kadm5_principal_ent_t, uint32_t);
-    kadm5_ret_t (*randkey_principal) (void*, krb5_principal,
-				      krb5_keyblock**, int*);
+    kadm5_ret_t (*randkey_principal) (void*, krb5_principal, krb5_boolean, int,
+				      krb5_key_salt_tuple*, krb5_keyblock**,
+				      int*);
     kadm5_ret_t (*rename_principal) (void*, krb5_principal, krb5_principal);
-    kadm5_ret_t (*chpass_principal_with_key) (void *, krb5_principal,
+    kadm5_ret_t (*chpass_principal_with_key) (void *, krb5_principal, int,
 					      int, krb5_key_data *);
+    kadm5_ret_t (*lock) (void *);
+    kadm5_ret_t (*unlock) (void *);
+    kadm5_ret_t (*setkey_principal_3) (void *, krb5_principal, krb5_boolean,
+				       int, krb5_key_salt_tuple *,
+				       krb5_keyblock *, int);
 };
 
 /* XXX should be integrated */
@@ -63,7 +75,7 @@ typedef struct kadm5_common_context {
     krb5_boolean my_context;
     struct kadm_func funcs;
     void *data;
-}kadm5_common_context;
+} kadm5_common_context;
 
 typedef struct kadm5_log_peer {
     int fd;
@@ -75,7 +87,10 @@ typedef struct kadm5_log_peer {
 typedef struct kadm5_log_context {
     char *log_file;
     int log_fd;
+    int read_only;
+    int lock_mode;
     uint32_t version;
+    time_t last_time;
 #ifndef NO_UNIX_SOCKETS
     struct sockaddr_un socket_name;
 #else
@@ -91,6 +106,7 @@ typedef struct kadm5_server_context {
     /* */
     kadm5_config_params config;
     HDB *db;
+    int keep_open;
     krb5_principal caller;
     unsigned acl_flags;
     kadm5_log_context log_context;
@@ -105,14 +121,14 @@ typedef struct kadm5_client_context {
     char *realm;
     char *admin_server;
     int kadmind_port;
-    int sock;
+    krb5_socket_t sock;
     char *client_name;
     char *service_name;
     krb5_prompter_fct prompter;
     const char *keytab;
     krb5_ccache ccache;
     kadm5_config_params *realm_params;
-}kadm5_client_context;
+} kadm5_client_context;
 
 typedef struct kadm5_ad_context {
     krb5_context context;
@@ -128,6 +144,11 @@ typedef struct kadm5_ad_context {
     char *base_dn;
 } kadm5_ad_context;
 
+/*
+ * This enum is used in the iprop log file and on the wire in the iprop
+ * protocol.  DO NOT CHANGE, except to add new op types at the end, and
+ * look for places in lib/kadm5/log.c to update.
+ */
 enum kadm_ops {
     kadm_get,
     kadm_delete,
@@ -139,7 +160,28 @@ enum kadm_ops {
     kadm_get_privs,
     kadm_get_princs,
     kadm_chpass_with_key,
-    kadm_nop
+    kadm_nop,
+    kadm_first = kadm_get,
+    kadm_last = kadm_nop
+};
+
+/* FIXME nop types are currently not implemented */
+enum kadm_nop_type {
+    kadm_nop_plain, /* plain nop, not relevance except as uberblock */
+    kadm_nop_trunc, /* indicates that the master truncated the log  */
+    kadm_nop_close  /* indicates that the master closed this log    */
+};
+
+enum kadm_iter_opts {
+    kadm_forward        = 1,
+    kadm_backward       = 2,
+    kadm_confirmed      = 4,
+    kadm_unconfirmed    = 8
+};
+
+enum kadm_recover_mode {
+    kadm_recover_commit,
+    kadm_recover_replay
 };
 
 #define KADMIN_APPL_VERSION "KADM0.1"
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_c.c
index c4dd38339..432a5f554 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: privs_c.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: privs_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: privs_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_get_privs(void *server_handle, uint32_t *privs)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_s.c
index 0945dd46d..e4aa0d027 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/privs_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: privs_s.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: privs_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: privs_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_s_get_privs(void *server_handle, uint32_t *privs)
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_c.c
index 2c62e668f..9cbdd5c66 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: randkey_c.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: randkey_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,19 +35,23 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: randkey_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_randkey_principal(void *server_handle,
 			  krb5_principal princ,
+			  krb5_boolean keepold,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
 			  krb5_keyblock **new_keys,
 			  int *n_keys)
 {
     kadm5_client_context *context = server_handle;
     kadm5_ret_t ret;
     krb5_storage *sp;
-    unsigned char buf[1024];
+    unsigned char buf[1536];
     int32_t tmp;
+    size_t i;
     krb5_data reply;
 
     ret = _kadm5_connect(server_handle);
@@ -59,8 +63,41 @@ kadm5_c_randkey_principal(void *server_handle,
 	krb5_clear_error_message(context->context);
 	return ENOMEM;
     }
-    krb5_store_int32(sp, kadm_randkey);
-    krb5_store_principal(sp, princ);
+
+    /*
+     * NOTE WELL: This message is extensible.  It currently consists of:
+     *
+     *  - opcode (kadm_randkey)
+     *  - principal name (princ)
+     *
+     * followed by optional items, each of which must be present if
+     * there are any items following them that are also present:
+     *
+     *  - keepold boolean (whether to delete old kvnos)
+     *  - number of key/salt type tuples
+     *  - array of {enctype, salttype}
+     *
+     * Eventually we may add:
+     *
+     *  - opaque string2key parameters (salt, rounds, ...)
+     */
+    ret = krb5_store_int32(sp, kadm_randkey);
+    if (ret == 0)
+        ret = krb5_store_principal(sp, princ);
+
+    if (ret == 0 && (keepold == TRUE || n_ks_tuple > 0))
+	ret = krb5_store_uint32(sp, keepold);
+    if (ret == 0 && n_ks_tuple > 0)
+	ret = krb5_store_uint32(sp, n_ks_tuple);
+    for (i = 0; ret == 0 && i < n_ks_tuple; i++) {
+	ret = krb5_store_int32(sp, ks_tuple[i].ks_enctype);
+        if (ret == 0)
+            krb5_store_int32(sp, ks_tuple[i].ks_salttype);
+    }
+    if (ret)
+        return ret;
+    /* Future extensions go here */
+
     ret = _kadm5_client_send(context, sp);
     krb5_storage_free(sp);
     if (ret)
@@ -75,22 +112,35 @@ kadm5_c_randkey_principal(void *server_handle,
 	return ENOMEM;
     }
     krb5_clear_error_message(context->context);
-    krb5_ret_int32(sp, &tmp);
-    ret = tmp;
-    if(ret == 0){
+    ret = krb5_ret_int32(sp, &tmp);
+    if (ret == 0)
+        ret = tmp;
+    if (ret == 0){
 	krb5_keyblock *k;
-	int i;
 
-	krb5_ret_int32(sp, &tmp);
-	k = malloc(tmp * sizeof(*k));
+	ret = krb5_ret_int32(sp, &tmp);
+        if (ret)
+            goto out;
+	if (tmp < 0) {
+	    ret = EOVERFLOW;
+	    goto out;
+	}
+	k = calloc(tmp, sizeof(*k));
 	if (k == NULL) {
 	    ret = ENOMEM;
 	    goto out;
 	}
-	for(i = 0; i < tmp; i++)
-	    krb5_ret_keyblock(sp, &k[i]);
-	*n_keys = tmp;
-	*new_keys = k;
+	for(i = 0; ret == 0 && i < tmp; i++)
+	    ret = krb5_ret_keyblock(sp, &k[i]);
+	if (ret == 0 && n_keys && new_keys) {
+	    *n_keys = tmp;
+	    *new_keys = k;
+	} else {
+            krb5_free_keyblock_contents(context->context, &k[i]);
+            for (; i > 0; i--)
+                krb5_free_keyblock_contents(context->context, &k[i - 1]);
+            free(k);
+        }
     }
 out:
     krb5_storage_free(sp);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_s.c
index 4ce0619a9..c0bc621bc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/randkey_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: randkey_s.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: randkey_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001, 2003-2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: randkey_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
  * Set the keys of `princ' to random values, returning the random keys
@@ -45,6 +45,9 @@ __RCSID("NetBSD");
 kadm5_ret_t
 kadm5_s_randkey_principal(void *server_handle,
 			  krb5_principal princ,
+			  krb5_boolean keepold,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
 			  krb5_keyblock **new_keys,
 			  int *n_keys)
 {
@@ -53,57 +56,84 @@ kadm5_s_randkey_principal(void *server_handle,
     kadm5_ret_t ret;
 
     memset(&ent, 0, sizeof(ent));
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret)
+	    return ret;
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
 				      HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
     if(ret)
-	goto out;
-
-    ret = _kadm5_set_keys_randomly (context,
-				    &ent.entry,
-				    new_keys,
-				    n_keys);
-    if (ret)
 	goto out2;
+
+    if (keepold) {
+	ret = hdb_add_current_keys_to_history(context->context, &ent.entry);
+	if (ret)
+	    goto out3;
+    }
+
+    ret = _kadm5_set_keys_randomly(context, &ent.entry, n_ks_tuple, ks_tuple,
+                                   new_keys, n_keys);
+    if (ret)
+	goto out3;
     ent.entry.kvno++;
 
+    ent.entry.flags.require_pwchange = 0;
+
     ret = _kadm5_set_modifier(context, &ent.entry);
     if(ret)
-	goto out3;
+	goto out4;
     ret = _kadm5_bump_pw_expire(context, &ent.entry);
     if (ret)
-	goto out2;
+	goto out4;
 
-    ret = hdb_seal_keys(context->context, context->db, &ent.entry);
-    if (ret)
-	goto out2;
+    if (keepold) {
+	ret = hdb_seal_keys(context->context, context->db, &ent.entry);
+	if (ret)
+	    goto out4;
+    } else {
+	HDB_extension ext;
 
-    ret = context->db->hdb_store(context->context, context->db,
-				 HDB_F_REPLACE, &ent);
-    if (ret)
-	goto out2;
+	memset(&ext, 0, sizeof (ext));
+        ext.mandatory = FALSE;
+	ext.data.element = choice_HDB_extension_data_hist_keys;
+	ext.data.u.hist_keys.len = 0;
+	ext.data.u.hist_keys.val = NULL;
+	hdb_replace_extension(context->context, &ent.entry, &ext);
+    }
 
-    kadm5_log_modify (context,
-		      &ent.entry,
-		      KADM5_PRINCIPAL | KADM5_MOD_NAME | KADM5_MOD_TIME |
-		      KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION |
-		      KADM5_TL_DATA);
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_modify(context, &ent.entry,
+                           KADM5_ATTRIBUTES | KADM5_PRINCIPAL |
+                           KADM5_MOD_NAME | KADM5_MOD_TIME |
+                           KADM5_KEY_DATA | KADM5_KVNO |
+                           KADM5_PW_EXPIRATION | KADM5_TL_DATA);
 
-out3:
+ out4:
     if (ret) {
 	int i;
 
 	for (i = 0; i < *n_keys; ++i)
-	    krb5_free_keyblock_contents (context->context, &(*new_keys)[i]);
+	    krb5_free_keyblock_contents(context->context, &(*new_keys)[i]);
 	free (*new_keys);
 	*new_keys = NULL;
 	*n_keys = 0;
     }
-out2:
+ out3:
     hdb_free_entry(context->context, &ent);
-out:
-    context->db->hdb_close(context->context, context->db);
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_c.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_c.c
index 5d1a82602..5506e20d7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_c.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rename_c.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: rename_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: rename_c.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_c_rename_principal(void *server_handle,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_s.c
index 747579b93..4d9657907 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_s.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/rename_s.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rename_s.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: rename_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003, 2005 - 2005 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: rename_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_s_rename_principal(void *server_handle,
@@ -48,20 +48,26 @@ kadm5_s_rename_principal(void *server_handle,
     krb5_principal oldname;
 
     memset(&ent, 0, sizeof(ent));
-    if(krb5_principal_compare(context->context, source, target))
+    if (krb5_principal_compare(context->context, source, target))
 	return KADM5_DUP; /* XXX is this right? */
-    ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
-    if(ret)
-	return ret;
+    if (!context->keep_open) {
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+	if(ret)
+	    return ret;
+    }
+
+    ret = kadm5_log_init(context);
+    if (ret)
+        goto out;
+
     ret = context->db->hdb_fetch_kvno(context->context, context->db,
 				      source, HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
-    if(ret){
-	context->db->hdb_close(context->context, context->db);
-	goto out;
-    }
-    ret = _kadm5_set_modifier(context, &ent.entry);
-    if(ret)
+    if (ret)
 	goto out2;
+    oldname = ent.entry.principal;
+    ret = _kadm5_set_modifier(context, &ent.entry);
+    if (ret)
+	goto out3;
     {
 	/* fix salt */
 	size_t i;
@@ -75,39 +81,41 @@ kadm5_s_rename_principal(void *server_handle,
 	    if(ent.entry.keys.val[i].salt == NULL){
 		ent.entry.keys.val[i].salt =
 		    malloc(sizeof(*ent.entry.keys.val[i].salt));
-		if(ent.entry.keys.val[i].salt == NULL)
-		    return ENOMEM;
-		ret = copy_Salt(&salt, ent.entry.keys.val[i].salt);
-		if(ret)
+		if (ent.entry.keys.val[i].salt == NULL)
+		    ret = ENOMEM;
+                else
+                    ret = copy_Salt(&salt, ent.entry.keys.val[i].salt);
+		if (ret)
 		    break;
 	    }
 	}
 	krb5_free_salt(context->context, salt2);
     }
-    if(ret)
-	goto out2;
-    oldname = ent.entry.principal;
+    if (ret)
+	goto out3;
+
+    /* Borrow target */
     ent.entry.principal = target;
-
     ret = hdb_seal_keys(context->context, context->db, &ent.entry);
-    if (ret) {
-	ent.entry.principal = oldname;
-	goto out2;
-    }
+    if (ret)
+	goto out3;
 
-    kadm5_log_rename (context, source, &ent.entry);
+    /* This logs the change for iprop and writes to the HDB */
+    ret = kadm5_log_rename(context, source, &ent.entry);
 
-    ret = context->db->hdb_store(context->context, context->db, 0, &ent);
-    if(ret){
-	ent.entry.principal = oldname;
-	goto out2;
-    }
-    ret = context->db->hdb_remove(context->context, context->db, oldname);
-    ent.entry.principal = oldname;
-out2:
-    context->db->hdb_close(context->context, context->db);
+ out3:
+    ent.entry.principal = oldname; /* Unborrow target */
     hdb_free_entry(context->context, &ent);
-out:
+
+ out2:
+    (void) kadm5_log_end(context);
+ out:
+    if (!context->keep_open) {
+        kadm5_ret_t ret2;
+        ret2 = context->db->hdb_close(context->context, context->db);
+        if (ret == 0 && ret2 != 0)
+            ret = ret2;
+    }
     return _kadm5_error_code(ret);
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/sample_passwd_check.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/sample_passwd_check.c
index 7b58c4fea..5e02d1872 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/sample_passwd_check.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/sample_passwd_check.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sample_passwd_check.c,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $	*/
+/*	$NetBSD: sample_passwd_check.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/send_recv.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/send_recv.c
index fa5a2cd23..018fb77b0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/send_recv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/send_recv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: send_recv.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: send_recv.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2003, 2006 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: send_recv.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 _kadm5_client_send(kadm5_client_context *context, krb5_storage *sp)
@@ -45,7 +45,7 @@ _kadm5_client_send(kadm5_client_context *context, krb5_storage *sp)
     size_t len;
     krb5_storage *sock;
 
-    assert(context->sock != -1);
+    assert(context->sock != rk_INVALID_SOCKET);
 
     len = krb5_storage_seek(sp, 0, SEEK_CUR);
     ret = krb5_data_alloc(&msg, len);
@@ -61,7 +61,7 @@ _kadm5_client_send(kadm5_client_context *context, krb5_storage *sp)
     if(ret)
 	return ret;
 
-    sock = krb5_storage_from_fd(context->sock);
+    sock = krb5_storage_from_socket(context->sock);
     if(sock == NULL) {
 	krb5_clear_error_message(context->context);
 	krb5_data_free(&out);
@@ -83,7 +83,7 @@ _kadm5_client_recv(kadm5_client_context *context, krb5_data *reply)
     krb5_data data;
     krb5_storage *sock;
 
-    sock = krb5_storage_from_fd(context->sock);
+    sock = krb5_storage_from_socket(context->sock);
     if(sock == NULL) {
 	krb5_clear_error_message(context->context);
 	return ENOMEM;
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/server_glue.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/server_glue.c
index da07ea851..d52183fb1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/server_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/server_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: server_glue.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: server_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: server_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 kadm5_init_with_password(const char *client_name,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/set_keys.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/set_keys.c
index d22270969..6c68d8f8a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/set_keys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/set_keys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_keys.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: set_keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: set_keys.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 /*
  * Set the keys of `ent' to the string-to-key of `password'
@@ -44,6 +44,8 @@ __RCSID("NetBSD");
 kadm5_ret_t
 _kadm5_set_keys(kadm5_server_context *context,
 		hdb_entry *ent,
+		int n_ks_tuple,
+		krb5_key_salt_tuple *ks_tuple,
 		const char *password)
 {
     Key *keys;
@@ -52,7 +54,9 @@ _kadm5_set_keys(kadm5_server_context *context,
 
     ret = hdb_generate_key_set_password(context->context,
 					ent->principal,
-					password, &keys, &num_keys);
+					password,
+					ks_tuple, n_ks_tuple,
+					&keys, &num_keys);
     if (ret)
 	return ret;
 
@@ -74,6 +78,23 @@ _kadm5_set_keys(kadm5_server_context *context,
     return 0;
 }
 
+static void
+setup_Key(Key *k, Salt *s, krb5_key_data *kd, size_t kd_offset)
+{
+    memset(k, 0, sizeof (*k)); /* sets mkvno and salt */
+    k->key.keytype = kd[kd_offset].key_data_type[0];
+    k->key.keyvalue.length = kd[kd_offset].key_data_length[0];
+    k->key.keyvalue.data = kd[kd_offset].key_data_contents[0];
+
+    if(kd[kd_offset].key_data_ver == 2) {
+	memset(s, 0, sizeof (*s));
+	s->type = kd[kd_offset].key_data_type[1];
+	s->salt.length = kd[kd_offset].key_data_length[1];
+	s->salt.data = kd[kd_offset].key_data_contents[1];
+	k->salt = s;
+    }
+}
+
 /*
  * Set the keys of `ent' to (`n_key_data', `key_data')
  */
@@ -85,51 +106,167 @@ _kadm5_set_keys2(kadm5_server_context *context,
 		 krb5_key_data *key_data)
 {
     krb5_error_code ret;
-    int i;
-    unsigned len;
-    Key *keys;
+    size_t i, k;
+    HDB_extension ext;
+    HDB_extension *extp = NULL;
+    HDB_Ext_KeySet *hist_keys = &ext.data.u.hist_keys;
+    Key key;
+    Salt salt;
+    Keys keys;
+    hdb_keyset hkset;
+    krb5_kvno kvno = -1;
+    int one_key_set = 1;
+    int replace_hist_keys = 0;
 
-    len  = n_key_data;
-    keys = malloc (len * sizeof(*keys));
-    if (keys == NULL && len != 0)
-	return ENOMEM;
-
-    _kadm5_init_keys (keys, len);
-
-    for(i = 0; i < n_key_data; i++) {
-	keys[i].mkvno = NULL;
-	keys[i].key.keytype = key_data[i].key_data_type[0];
-	ret = krb5_data_copy(&keys[i].key.keyvalue,
-			     key_data[i].key_data_contents[0],
-			     key_data[i].key_data_length[0]);
-	if(ret)
-	    goto out;
-	if(key_data[i].key_data_ver == 2) {
-	    Salt *salt;
-
-	    salt = calloc(1, sizeof(*salt));
-	    if(salt == NULL) {
-		ret = ENOMEM;
-		goto out;
-	    }
-	    keys[i].salt = salt;
-	    salt->type = key_data[i].key_data_type[1];
-	    krb5_data_copy(&salt->salt,
-			   key_data[i].key_data_contents[1],
-			   key_data[i].key_data_length[1]);
-	} else
-	    keys[i].salt = NULL;
+    if (n_key_data == 0) {
+	/* Clear all keys! */
+	ret = hdb_clear_extension(context->context, ent,
+				  choice_HDB_extension_data_hist_keys);
+	if (ret)
+	    return ret;
+	free_Keys(&ent->keys);
+	return 0;
     }
-    _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
-    ent->keys.len = len;
-    ent->keys.val = keys;
 
+    memset(&keys, 0, sizeof (keys));
+    memset(&hkset, 0, sizeof (hkset)); /* set set_time */
+    memset(&ext, 0, sizeof (ext));
+    ext.mandatory = FALSE;
+    ext.data.element = choice_HDB_extension_data_hist_keys;
+    memset(hist_keys, 0, sizeof (*hist_keys));
+
+    for (i = 0; i < n_key_data; i++) {
+	if (kvno != -1 && kvno != key_data[i].key_data_kvno) {
+	    one_key_set = 0;
+	    break;
+	}
+	kvno = key_data[i].key_data_kvno;
+    }
+    if (one_key_set) {
+	/*
+	 * If we're updating KADM5_KEY_DATA with a single keyset then we
+	 * assume we must be setting the principal's kvno as well!
+	 *
+	 * Just have to be careful about old clients that might have
+	 * sent 0 as the kvno...  This may seem ugly, but it's the price
+	 * of backwards compatibility with pre-multi-kvno kadmin clients
+	 * (besides, who's to say that updating KADM5_KEY_DATA requires
+	 * updating the entry's kvno?)
+	 *
+	 * Note that we do nothing special for the case where multiple
+	 * keysets are given but the entry's kvno is not set and not in
+	 * the given set of keysets.  If this happens we'll just update
+	 * the key history only and leave the current keyset alone.
+	 */
+	if (kvno == 0) {
+	    /* Force kvno to 1 if it was 0; (ank would do this anyways) */
+	    if (ent->kvno == 0)
+		ent->kvno = 1;
+	    /* Below we need key_data[*].kvno to be reasonable */
+	    for (i = 0; i < n_key_data; i++)
+		key_data[i].key_data_kvno = ent->kvno;
+	} else {
+	    /*
+	     * Or force the entry's kvno to match the one from the new,
+	     * singular keyset
+	     */
+	    ent->kvno = kvno;
+	}
+    }
+
+    for (i = 0; i < n_key_data; i++) {
+	if (key_data[i].key_data_kvno == ent->kvno) {
+	    /* A current key; add to current key set */
+	    setup_Key(&key, &salt, key_data, i);
+	    ret = add_Keys(&keys, &key);
+	    continue;
+	}
+
+	/*
+	 * This kvno is historical.  Build an hdb_keyset for keys of
+	 * this enctype and add them to the new key history.
+	 */
+	for (k = 0; k < hist_keys->len; k++) {
+	    if (hist_keys->val[k].kvno == key_data[i].key_data_kvno)
+		break;
+	}
+	if (hist_keys->len > k &&
+	    hist_keys->val[k].kvno == key_data[i].key_data_kvno)
+	    /* We've added all keys of this kvno already (see below) */
+	    continue;
+
+	memset(&hkset, 0, sizeof (hkset)); /* set set_time */
+	hkset.kvno = key_data[i].key_data_kvno;
+	for (k = 0; k < n_key_data; k++) {
+	    /* Find all keys of this kvno and add them to the new keyset */
+	    if (key_data[k].key_data_kvno != hkset.kvno)
+		continue;
+
+	    setup_Key(&key, &salt, key_data, k);
+	    ret = add_Keys(&hkset.keys, &key);
+	    if (ret) {
+                free_hdb_keyset(&hkset);
+		goto out;
+            }
+	}
+	ret = add_HDB_Ext_KeySet(hist_keys, &hkset);
+        free_hdb_keyset(&hkset);
+	if (ret)
+	    goto out;
+	replace_hist_keys = 1;
+    }
+
+    if (replace_hist_keys)
+	/* No key history given -> leave it alone */
+	extp = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
+    if (extp != NULL) {
+	HDB_Ext_KeySet *old_hist_keys;
+
+	/*
+	 * Try to keep the very useful set_time values from the old hist
+	 * keys.  kadm5 loses this info, so this heuristic is the best we
+	 * can do.
+	 */
+	old_hist_keys = &extp->data.u.hist_keys;
+	for (i = 0; i < old_hist_keys->len; i++) {
+	    if (old_hist_keys->val[i].set_time == NULL)
+		continue;
+	    for (k = 0; k < hist_keys->len; k++) {
+		if (hist_keys->val[k].kvno != old_hist_keys->val[k].kvno)
+		    continue;
+		hist_keys->val[k].set_time = old_hist_keys->val[k].set_time;
+		old_hist_keys->val[k].set_time = NULL;
+	    }
+	}
+    }
+
+    if (replace_hist_keys) {
+	/* If hist keys not given in key_data then don't blow away hist_keys */
+	ret = hdb_replace_extension(context->context, ent, &ext);
+	if (ret)
+	    goto out;
+    }
+ 
+    /*
+     * A structure copy is more efficient here than this would be:
+     *
+     * copy_Keys(&keys, &ent->keys);
+     * free_Keys(&keys);
+     *
+     * Of course, the above hdb_replace_extension() is not at all efficient...
+     */
+    free_HDB_extension(&ext);
+    free_Keys(&ent->keys);
+    free_hdb_keyset(&hkset);
+    ent->keys = keys;
     hdb_entry_set_pw_change_time(context->context, ent, 0);
     hdb_entry_clear_password(context->context, ent);
 
     return 0;
- out:
-    _kadm5_free_keys (context->context, len, keys);
+
+out:
+    free_Keys(&keys);
+    free_HDB_extension(&ext);
     return ret;
 }
 
@@ -198,6 +335,8 @@ is_des_key_p(int keytype)
 kadm5_ret_t
 _kadm5_set_keys_randomly (kadm5_server_context *context,
 			  hdb_entry *ent,
+			  int n_ks_tuple,
+			  krb5_key_salt_tuple *ks_tuple,
 			  krb5_keyblock **new_keys,
 			  int *n_keys)
 {
@@ -208,7 +347,7 @@ _kadm5_set_keys_randomly (kadm5_server_context *context,
    Key *keys;
 
    ret = hdb_generate_key_set(context->context, ent->principal,
-			       &keys, &num_keys, 1);
+			      ks_tuple, n_ks_tuple, &keys, &num_keys, 1);
    if (ret)
 	return ret;
 
@@ -265,8 +404,12 @@ out:
    _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
    ent->keys.val = keys;
    ent->keys.len = num_keys;
-   *new_keys     = kblock;
-   *n_keys       = num_keys;
+   if (n_keys && new_keys) {
+       *new_keys     = kblock;
+       *n_keys       = num_keys;
+   } else {
+        free(kblock);
+   }
 
    hdb_entry_set_pw_change_time(context->context, ent, 0);
    hdb_entry_clear_password(context->context, ent);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/set_modifier.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/set_modifier.c
index 5ea13d7c1..f5c2eb53d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/set_modifier.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/set_modifier.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_modifier.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: set_modifier.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "kadm5_locl.h"
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: set_modifier.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 kadm5_ret_t
 _kadm5_set_modifier(kadm5_server_context *context,
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/setkey3_s.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/setkey3_s.c
new file mode 100644
index 000000000..d166979f8
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/setkey3_s.c
@@ -0,0 +1,137 @@
+/*	$NetBSD: setkey3_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997-2001, 2003, 2005-2006 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kadm5_locl.h"
+
+/**
+ * Server-side function to set new keys for a principal.
+ */
+kadm5_ret_t
+kadm5_s_setkey_principal_3(void *server_handle,
+			   krb5_principal princ,
+			   krb5_boolean keepold,
+			   int n_ks_tuple,
+			   krb5_key_salt_tuple *ks_tuple,
+			   krb5_keyblock *keyblocks, int n_keys)
+{
+    kadm5_server_context *context = server_handle;
+    hdb_entry_ex ent;
+    kadm5_ret_t ret = 0;
+
+    memset(&ent, 0, sizeof(ent));
+    if (!context->keep_open)
+	ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
+    if (ret)
+	return ret;
+
+    ret = kadm5_log_init(context);
+    if (ret) {
+        if (!context->keep_open)
+            context->db->hdb_close(context->context, context->db);
+        return ret;
+    }
+
+    ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
+				      HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent);
+    if (ret) {
+        (void) kadm5_log_end(context);
+        if (!context->keep_open)
+            context->db->hdb_close(context->context, context->db);
+        return ret;
+    }
+
+    if (keepold) {
+        ret = hdb_add_current_keys_to_history(context->context, &ent.entry);
+    } else
+	ret = hdb_clear_extension(context->context, &ent.entry,
+				  choice_HDB_extension_data_hist_keys);
+
+    /*
+     * Though in practice all real calls to this function will pass an empty
+     * ks_tuple, and cannot in any case employ any salts that require
+     * additional data, we go the extra mile to set any requested salt type
+     * along with a zero length salt value.  While we're at it we check that
+     * each ks_tuple's enctype matches the corresponding key enctype.
+     */
+    if (ret == 0) {
+	int i;
+
+	free_Keys(&ent.entry.keys);
+	for (i = 0; i < n_keys; ++i) {
+	    Key k;
+	    Salt s;
+
+	    k.mkvno = 0;
+	    k.key = keyblocks[i];
+	    if (n_ks_tuple == 0)
+		k.salt = 0;
+	    else {
+		if (ks_tuple[i].ks_enctype != keyblocks[i].keytype) {
+		    ret = KADM5_SETKEY3_ETYPE_MISMATCH;
+		    break;
+		}
+		s.type = ks_tuple[i].ks_salttype;
+		s.salt.data = 0;
+		s.opaque = 0;
+		k.salt = &s;
+	    }
+	    if ((ret = add_Keys(&ent.entry.keys, &k)) != 0)
+		break;
+	}
+    }
+
+    if (ret == 0) {
+	ent.entry.kvno++;
+	ent.entry.flags.require_pwchange = 0;
+	hdb_entry_set_pw_change_time(context->context, &ent.entry, 0);
+	hdb_entry_clear_password(context->context, &ent.entry);
+
+	if ((ret = hdb_seal_keys(context->context, context->db,
+				 &ent.entry)) == 0
+	    && (ret = _kadm5_set_modifier(context, &ent.entry)) == 0
+	    && (ret = _kadm5_bump_pw_expire(context, &ent.entry)) == 0)
+	    ret = kadm5_log_modify(context, &ent.entry,
+                                   KADM5_ATTRIBUTES | KADM5_PRINCIPAL |
+                                   KADM5_MOD_NAME | KADM5_MOD_TIME |
+                                   KADM5_KEY_DATA | KADM5_KVNO |
+                                   KADM5_PW_EXPIRATION | KADM5_TL_DATA);
+    }
+
+    hdb_free_entry(context->context, &ent);
+    (void) kadm5_log_end(context);
+    if (!context->keep_open)
+	context->db->hdb_close(context->context, context->db);
+    return _kadm5_error_code(ret);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/test_pw_quality.c b/crypto/external/bsd/heimdal/dist/lib/kadm5/test_pw_quality.c
index 8acd5f550..a4dcf2924 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/test_pw_quality.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/test_pw_quality.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pw_quality.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: test_pw_quality.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003, 2005 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "kadm5_locl.h"
 #include <krb5/getarg.h>
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: test_pw_quality.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 static int version_flag;
 static int help_flag;
@@ -44,10 +44,10 @@ static char *principal;
 static char *password;
 
 static struct getargs args[] = {
-    { "principal", 0, arg_string, &principal },
-    { "password", 0, arg_string, &password },
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "principal", 0, arg_string, &principal, NULL, NULL },
+    { "password", 0, arg_string, &password, NULL, NULL },
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script-client.map b/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script-client.map
new file mode 100644
index 000000000..de0ed6749
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script-client.map
@@ -0,0 +1,59 @@
+HEIMDAL_KADM5_CLIENT_1.0 {
+	global:
+		et_kadm5_error_table;
+		initialize_kadm5_error_table;
+		initialize_kadm5_error_table_r;
+		kadm5_ad_init_with_password;
+		kadm5_ad_init_with_password_ctx;
+		kadm5_all_keys_are_bogus;
+		kadm5_c_chpass_principal;
+		kadm5_c_chpass_principal_with_key;
+		kadm5_c_create_principal;
+		kadm5_c_delete_principal;
+		kadm5_c_destroy;
+		kadm5_c_flush;
+		kadm5_c_get_principal;
+		kadm5_c_get_principals;
+		kadm5_c_get_privs;
+		kadm5_c_init_with_creds;
+		kadm5_c_init_with_creds_ctx;
+		kadm5_c_init_with_password;
+		kadm5_c_init_with_password_ctx;
+		kadm5_c_init_with_skey;
+		kadm5_c_init_with_skey_ctx;
+		kadm5_c_modify_principal;
+		kadm5_c_randkey_principal;
+		kadm5_c_rename_principal;
+		kadm5_chpass_principal;
+		kadm5_chpass_principal_with_key;
+		kadm5_create_principal;
+		kadm5_delete_principal;
+		kadm5_destroy;
+		kadm5_flush;
+		kadm5_free_key_data;
+		kadm5_free_name_list;
+		kadm5_free_principal_ent;
+		kadm5_get_principal;
+		kadm5_get_principals;
+		kadm5_get_privs;
+		kadm5_init_with_creds;
+		kadm5_init_with_creds_ctx;
+		kadm5_init_with_password;
+		kadm5_init_with_password_ctx;
+		kadm5_init_with_skey;
+		kadm5_init_with_skey_ctx;
+		kadm5_modify_principal;
+		kadm5_randkey_principal;
+		kadm5_rename_principal;
+		kadm5_ret_key_data;
+		kadm5_ret_principal_ent;
+		kadm5_ret_principal_ent_mask;
+		kadm5_ret_tl_data;
+		kadm5_some_keys_are_bogus;
+		kadm5_store_key_data;
+		kadm5_store_principal_ent;
+		kadm5_store_principal_ent_mask;
+		kadm5_store_tl_data;
+	local:
+		*;
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script.map b/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script.map
index f219ddba1..23bc9c1ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/kadm5/version-script.map
@@ -4,17 +4,27 @@ HEIMDAL_KAMD5_SERVER_1.0 {
 	global:
 		kadm5_ad_init_with_password;
 		kadm5_ad_init_with_password_ctx;
+		kadm5_all_keys_are_bogus;
 		kadm5_add_passwd_quality_verifier;
 		kadm5_check_password_quality;
 		kadm5_chpass_principal;
+		kadm5_chpass_principal_3;
 		kadm5_chpass_principal_with_key;
+		kadm5_chpass_principal_with_key_3;
+		kadm5_create_policy;
 		kadm5_create_principal;
+		kadm5_create_principal_3;
 		kadm5_delete_principal;
 		kadm5_destroy;
+		kadm5_decrypt_key;
+		kadm5_delete_policy;
 		kadm5_flush;
 		kadm5_free_key_data;
 		kadm5_free_name_list;
+		kadm5_free_policy_ent;
 		kadm5_free_principal_ent;
+		kadm5_get_policy;
+		kadm5_get_policies;
 		kadm5_get_principal;
 		kadm5_get_principals;
 		kadm5_get_privs;
@@ -24,18 +34,26 @@ HEIMDAL_KAMD5_SERVER_1.0 {
 		kadm5_init_with_password_ctx;
 		kadm5_init_with_skey;
 		kadm5_init_with_skey_ctx;
+		kadm5_lock;
 		kadm5_modify_principal;
+		kadm5_modify_policy;
 		kadm5_randkey_principal;
+		kadm5_randkey_principal_3;
 		kadm5_rename_principal;
 		kadm5_ret_key_data;
 		kadm5_ret_principal_ent;
 		kadm5_ret_principal_ent_mask;
 		kadm5_ret_tl_data;
 		kadm5_setup_passwd_quality_check;
+		kadm5_setkey_principal;
+		kadm5_setkey_principal_3;
+		kadm5_some_keys_are_bogus;
 		kadm5_store_key_data;
 		kadm5_store_principal_ent;
 		kadm5_store_principal_ent_mask;
+		kadm5_store_principal_ent_nokeys;
 		kadm5_store_tl_data;
+		kadm5_unlock;
 		kadm5_s_init_with_password_ctx;
 		kadm5_s_init_with_password;
 		kadm5_s_init_with_skey_ctx;
@@ -44,16 +62,21 @@ HEIMDAL_KAMD5_SERVER_1.0 {
 		kadm5_s_init_with_creds;
 		kadm5_s_chpass_principal_cond;
 		kadm5_log_set_version;
+		kadm5_log_signal_master;
 		kadm5_log_signal_socket;
 		kadm5_log_previous;
 		kadm5_log_goto_end;
 		kadm5_log_foreach;
 		kadm5_log_get_version_fd;
 		kadm5_log_get_version;
+		kadm5_log_recover;
 		kadm5_log_replay;
 		kadm5_log_end;
 		kadm5_log_reinit;
 		kadm5_log_init;
+		kadm5_log_init_nb;
+		kadm5_log_init_nolock;
+		kadm5_log_init_sharedlock;
 		kadm5_log_nop;
 		kadm5_log_truncate;
 		kadm5_log_modify;
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/kafs/Makefile.am
index 487256a43..a4a48383c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/Makefile.am
@@ -5,8 +5,8 @@ include $(top_srcdir)/Makefile.am.common
 AM_CPPFLAGS += $(AFS_EXTRA_DEFS) $(ROKEN_RENAME)
 
 if KRB5
-DEPLIB_krb5 = ../krb5/libkrb5.la 
-krb5_am_workaround = $(INCLUDE_hcrypto) -I$(top_srcdir)/lib/krb5
+DEPLIB_krb5 = ../krb5/libkrb5.la $(LIB_hcrypto)
+krb5_am_workaround = -I$(top_srcdir)/lib/krb5
 else
 DEPLIB_krb5  =
 krb5_am_workaround = 
@@ -61,6 +61,7 @@ endif
 dist_libkafs_la_SOURCES =			\
 	afssys.c				\
 	afskrb5.c				\
+	rxkad_kdf.c				\
 	common.c				\
 	$(AIX_SRC)				\
 	kafs_locl.h				\
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/afskrb5.c b/crypto/external/bsd/heimdal/dist/lib/kafs/afskrb5.c
index 04fb29d1a..c1e740c7a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/afskrb5.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/afskrb5.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: afskrb5.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: afskrb5.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan
@@ -53,10 +53,6 @@ v5_to_kt(krb5_creds *cred, uid_t uid, struct kafs_token *kt, int local524)
 
     kt->ticket = NULL;
 
-    /* check if des key */
-    if (cred->session.keyvalue.length != 8)
-	return EINVAL;
-
     if (local524) {
 	Ticket t;
 	unsigned char *buf;
@@ -100,8 +96,16 @@ v5_to_kt(krb5_creds *cred, uid_t uid, struct kafs_token *kt, int local524)
      * Build a struct ClearToken
      */
 
+    ret = _kafs_derive_des_key(cred->session.keytype,
+			       cred->session.keyvalue.data,
+			       cred->session.keyvalue.length,
+			       kt->ct.HandShakeKey);
+    if (ret) {
+	free(kt->ticket);
+	kt->ticket = NULL;
+	return ret;
+    }
     kt->ct.AuthHandle = kvno;
-    memcpy(kt->ct.HandShakeKey, cred->session.keyvalue.data, 8);
     kt->ct.ViceId = uid;
     kt->ct.BeginTimestamp = cred->times.starttime;
     kt->ct.EndTimestamp = cred->times.endtime;
@@ -165,21 +169,15 @@ get_cred(struct kafs_data *data, const char *name, const char *inst,
 	return ret;
     }
 
-    in_creds.session.keytype = ETYPE_DES_CBC_CRC;
-
     /* check if des is disable, and in that case enable it for afs */
-    invalid = krb5_enctype_valid(d->context, in_creds.session.keytype);
+    invalid = krb5_enctype_valid(d->context, ETYPE_DES_CBC_CRC);
     if (invalid)
-	krb5_enctype_enable(d->context, in_creds.session.keytype);
+	krb5_enctype_enable(d->context, ETYPE_DES_CBC_CRC);
 
     ret = krb5_get_credentials(d->context, 0, d->id, &in_creds, &out_creds);
-    if (ret) {
-	in_creds.session.keytype = ETYPE_DES_CBC_MD5;
-	ret = krb5_get_credentials(d->context, 0, d->id, &in_creds, &out_creds);
-    }
 
     if (invalid)
-	krb5_enctype_disable(d->context, in_creds.session.keytype);
+	krb5_enctype_disable(d->context, ETYPE_DES_CBC_CRC);
 
     krb5_free_principal(d->context, in_creds.server);
     krb5_free_principal(d->context, in_creds.client);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/afslib.c b/crypto/external/bsd/heimdal/dist/lib/kafs/afslib.c
index 6f48f01f3..94edd77ee 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/afslib.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/afslib.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: afslib.c,v 1.1.1.1 2011/04/13 18:15:30 elric Exp $	*/
+/*	$NetBSD: afslib.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/afssys.c b/crypto/external/bsd/heimdal/dist/lib/kafs/afssys.c
index 041341a76..a3d297de7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/afssys.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/afssys.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: afssys.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: afssys.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000, 2002, 2004, 2005 Kungliga Tekniska Högskolan
@@ -42,7 +42,12 @@ struct procdata {
     unsigned long param1;
     unsigned long syscall;
 };
+#ifdef __GNU__
+#define _IOT_procdata _IOT(_IOTS(long), 5, 0, 0, 0, 0)
+#define VIOC_SYSCALL_PROC _IOW('C', 1, struct procdata)
+#else
 #define VIOC_SYSCALL_PROC _IOW('C', 1, void *)
+#endif
 
 struct devdata {
     unsigned long syscall;
@@ -54,11 +59,40 @@ struct devdata {
     unsigned long param6;
     unsigned long retval;
 };
+#ifdef __GNU__
+#define _IOT_devdata _IOT(_IOTS(long), 8, 0, 0, 0, 0)
+#endif
 #ifdef _IOWR
 #define VIOC_SYSCALL_DEV _IOWR('C', 2, struct devdata)
 #define VIOC_SYSCALL_DEV_OPENAFS _IOWR('C', 1, struct devdata)
 #endif
 
+#ifdef _IOW
+#ifdef _ILP32
+struct sundevdata {
+    uint32_t param6;
+    uint32_t param5;
+    uint32_t param4;
+    uint32_t param3;
+    uint32_t param2;
+    uint32_t param1;
+    uint32_t syscall;
+};
+#define VIOC_SUN_SYSCALL_DEV _IOW('C', 2, struct sundevdata)
+#else
+struct sundevdata {
+    uint64_t param6;
+    uint64_t param5;
+    uint64_t param4;
+    uint64_t param3;
+    uint64_t param2;
+    uint64_t param1;
+    uint64_t syscall;
+};
+#define VIOC_SUN_SYSCALL_DEV _IOW('C', 1, struct sundevdata)
+#endif
+#endif /* _IOW */
+
 
 int _kafs_debug; /* this should be done in a better way */
 
@@ -71,6 +105,7 @@ int _kafs_debug; /* this should be done in a better way */
 #define LINUX_PROC_POINT	5
 #define AIX_ENTRY_POINTS	6
 #define MACOS_DEV_POINT		7
+#define SUN_PROC_POINT		8
 
 static int afs_entry_point = UNKNOWN_ENTRY_POINT;
 static int afs_syscalls[2];
@@ -186,6 +221,12 @@ try_ioctlpath(const char *path, unsigned long ioctlnum, int entrypoint)
 	ret = ioctl(fd, ioctlnum, &data);
 	break;
     }
+    case SUN_PROC_POINT: {
+	struct sundevdata data = { 0, 0, 0, 0, 0, 0, AFSCALL_PIOCTL };
+	data.param2 = (unsigned long)VIOCGETTOK;
+	ret = ioctl(fd, ioctlnum, &data);
+	break;
+    }
     default:
 	abort();
     }
@@ -267,6 +308,14 @@ k_pioctl(char *a_path,
 
 	return data.retval;
     }
+    case SUN_PROC_POINT: {
+	struct sundevdata data = { 0, 0, 0, 0, 0, 0, AFSCALL_PIOCTL };
+	data.param1 = (unsigned long)a_path;
+	data.param2 = (unsigned long)o_opcode;
+	data.param3 = (unsigned long)a_paramsP;
+	data.param4 = (unsigned long)a_followSymlinks;
+	return do_ioctl(&data);
+    }
 #ifdef _AIX
     case AIX_ENTRY_POINTS:
 	return Pioctl(a_path, o_opcode, a_paramsP, a_followSymlinks);
@@ -325,6 +374,10 @@ k_setpag(void)
 	    return ret;
 	return data.retval;
      }
+    case SUN_PROC_POINT: {
+	struct sundevdata data = { 0, 0, 0, 0, 0, 0, AFSCALL_SETPAG };
+	return do_ioctl(&data);
+    }
 #ifdef _AIX
     case AIX_ENTRY_POINTS:
 	return Setpag();
@@ -472,6 +525,12 @@ k_hasafs(void)
     if (ret == 0)
 	goto done;
 #endif
+#ifdef VIOC_SUN_SYSCALL_DEV
+    ret = try_ioctlpath("/dev/afs", VIOC_SUN_SYSCALL_DEV, SUN_PROC_POINT);
+    if (ret == 0)
+	goto done;
+#endif
+
 
 #if defined(AFS_SYSCALL) || defined(AFS_SYSCALL2) || defined(AFS_SYSCALL3)
     {
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/afssysdefs.h b/crypto/external/bsd/heimdal/dist/lib/kafs/afssysdefs.h
index c4f4eef97..9745db530 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/afssysdefs.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/afssysdefs.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: afssysdefs.h,v 1.1.1.2 2011/04/14 14:09:18 elric Exp $	*/
+/*	$NetBSD: afssysdefs.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/common.c b/crypto/external/bsd/heimdal/dist/lib/kafs/common.c
index 5a37f449c..808ab374c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: common.c,v 1.1.1.1 2011/04/13 18:15:30 elric Exp $	*/
+/*	$NetBSD: common.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -351,13 +351,19 @@ _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
     if (kafs_verbose) {
 	const char *estr = (*data->get_error)(data, ret);
 	char *str;
-	asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)",
-		 data->name, cell ? "/" : "",
-		 cell ? cell : "", realm, estr ? estr : "unknown", ret);
-	(*kafs_verbose)(kafs_verbose_ctx, str);
+	int aret;
+
+	aret = asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)",
+			data->name, cell ? "/" : "",
+			cell ? cell : "", realm, estr ? estr : "unknown", ret);
+	if (aret != -1) {
+	    (*kafs_verbose)(kafs_verbose_ctx, str);
+	    free(str);
+	} else {
+	    (*kafs_verbose)(kafs_verbose_ctx, "out of memory");
+	}
 	if (estr)
 	    (*data->free_error)(data, estr);
-	free(str);
     }
 
     return ret;
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.3 b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.3
index 5e366a9c3..4793f78bc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.3
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kafs.3,v 1.1.1.3 2014/04/24 12:45:49 pettai Exp $
+.\"	$NetBSD: kafs.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1998 - 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.h b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.h
index 949a54aac..fd902bec1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kafs.h,v 1.1.1.3 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: kafs.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001, 2003 Kungliga Tekniska Högskolan
@@ -48,6 +48,9 @@
 #define AFSCALL_SETPAG 21
 
 #ifndef _VICEIOCTL
+#ifdef __GNU__
+#define _IOT_ViceIoctl _IOT(_IOTS(caddr_t), 2, _IOTS(short), 2, 0, 0)
+#endif
 #define _VICEIOCTL(id)  ((unsigned int ) _IOW('V', id, struct ViceIoctl))
 #define _AFSCIOCTL(id)  ((unsigned int ) _IOW('C', id, struct ViceIoctl))
 #endif /* _VICEIOCTL */
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs_locl.h b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs_locl.h
index 057319d02..b804672e3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/kafs_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/kafs_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kafs_locl.h,v 1.1.1.2 2011/04/14 14:09:18 elric Exp $	*/
+/*	$NetBSD: kafs_locl.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
@@ -101,7 +101,9 @@
 #include <krb5/krb5-v4compat.h>
 typedef struct credentials CREDENTIALS;
 #endif /* KRB5 */
+#ifndef NO_AFS
 #include <krb5/kafs.h>
+#endif
 
 #include <krb5/resolve.h>
 
@@ -152,6 +154,9 @@ _kafs_v4_to_kt(CREDENTIALS *, uid_t, struct kafs_token *);
 void
 _kafs_fixup_viceid(struct ClearToken *, uid_t);
 
+int
+_kafs_derive_des_key(krb5_enctype, void *, size_t, char[8]);
+
 #ifdef _AIX
 int aix_pioctl(char*, int, struct ViceIoctl*, int);
 int aix_setpag(void);
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/kafs/roken_rename.h
index ad5443a1e..b42a9db45 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kafs/roken_rename.h
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/roken_rename.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_rename.h,v 1.1.1.2 2011/04/14 14:09:17 elric Exp $	*/
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001-2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/kafs/rxkad_kdf.c b/crypto/external/bsd/heimdal/dist/lib/kafs/rxkad_kdf.c
new file mode 100644
index 000000000..dd89a57bf
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/kafs/rxkad_kdf.c
@@ -0,0 +1,218 @@
+/*	$NetBSD: rxkad_kdf.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2013-2014 Carnegie Mellon University
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2013 by the Massachusetts Institute of Technology
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kafs_locl.h"
+
+static int rxkad_derive_des_key(const void *, size_t, char[8]);
+static int compress_parity_bits(void *, size_t *);
+
+/**
+ * Use NIST SP800-108 with HMAC(MD5) in counter mode as the PRF to derive a
+ * des key from another type of key.
+ *
+ * L is 64, as we take 64 random bits and turn them into a 56-bit des key.
+ * The output of hmac_md5 is 128 bits; we take the first 64 only, so n
+ * properly should be 1.  However, we apply a slight variation due to the
+ * possibility of producing a weak des key.  If the output key is weak, do NOT
+ * simply correct it, instead, the counter is advanced and the next output
+ * used.  As such, we code so as to have n be the full 255 permitted by our
+ * encoding of the counter i in an 8-bit field.  L itself is encoded as a
+ * 32-bit field, big-endian.  We use the constant string "rxkad" as a label
+ * for this key derivation, the standard NUL byte separator, and omit a
+ * key-derivation context.  The input key is unique to the krb5 service ticket,
+ * which is unlikely to be used in an other location.  If it is used in such
+ * a fashion, both locations will derive the same des key from the PRF, but
+ * this is no different from if a krb5 des key had been used in the same way,
+ * as traditional krb5 rxkad uses the ticket session key directly as the token
+ * key.
+ *
+ * @param[in]  in      pointer to input key data
+ * @param[in]  insize  length of input key data
+ * @param[out] out     8-byte buffer to hold the derived key
+ *
+ * @return Returns 0 to indicate success, or an error code.
+ *
+ * @retval KRB5DES_WEAK_KEY  Successive derivation attempts with all
+ * 255 possible counter values each produced weak DES keys.  This input
+ * cannot be used to produce a usable key.
+ */
+static int
+rxkad_derive_des_key(const void *in, size_t insize, char out[8])
+{
+    unsigned char i;
+    static unsigned char label[] = "rxkad";
+    /* bits of output, as 32 bit word, MSB first */
+    static unsigned char Lbuf[4] = { 0, 0, 0, 64 };
+    /* only needs to be 16 for md5, but lets be sure it fits */
+    unsigned char tmp[64];
+    unsigned int mdsize;
+    DES_cblock ktmp;
+    HMAC_CTX mctx;
+
+    /* stop when 8 bit counter wraps to 0 */
+    for (i = 1; i; i++) {
+	HMAC_CTX_init(&mctx);
+	HMAC_Init_ex(&mctx, in, insize, EVP_md5(), NULL);
+	HMAC_Update(&mctx, &i, 1);
+	HMAC_Update(&mctx, label, sizeof(label));   /* includes label and separator */
+	HMAC_Update(&mctx, Lbuf, 4);
+	mdsize = sizeof(tmp);
+	HMAC_Final(&mctx, tmp, &mdsize);
+	memcpy(ktmp, tmp, 8);
+	DES_set_odd_parity(&ktmp);
+	if (!DES_is_weak_key(&ktmp)) {
+	    memcpy(out, ktmp, 8);
+	    return 0;
+	}
+    }
+    return KRB5DES_WEAK_KEY;
+}
+
+/**
+ * This is the inverse of the random-to-key for 3des specified in
+ * rfc3961, converting blocks of 8 bytes to blocks of 7 bytes by distributing
+ * the bits of each 8th byte as the lsb of the previous 7 bytes.
+ *
+ * @param[in,out]  buffer  Buffer containing the key to be converted
+ * @param[in,out]  bufsiz  Points to the size of the key data.  On
+ * return, this is updated to reflect the size of the compressed data.
+ *
+ * @return Returns 0 to indicate success, or an error code.
+ *
+ * @retval KRB5_BAD_KEYSIZE  The key size was not a multiple of 8 bytes.
+ */
+static int
+compress_parity_bits(void *buffer, size_t *bufsiz)
+{
+    unsigned char *cb, tmp;
+    int i, j, nk;
+
+    if (*bufsiz % 8 != 0)
+	return KRB5_BAD_KEYSIZE;
+    cb = (unsigned char *)buffer;
+    nk = *bufsiz / 8;
+    for (i = 0; i < nk; i++) {
+	tmp = cb[8 * i + 7] >> 1;
+	for (j = 0; j < 7; j++) {
+	    cb[8 * i + j] &= 0xfe;
+	    cb[8 * i + j] |= tmp & 0x1;
+	    tmp >>= 1;
+	}
+    }
+    for (i = 1; i < nk; i++)
+	memmove(cb + 7 * i, cb + 8 * i, 7);
+    *bufsiz = 7 * nk;
+    return 0;
+}
+
+/**
+ * Derive a DES key for use with rxkad and fcrypt from a given Kerberos
+ * key of (almost) any type.  This function encodes enctype-specific
+ * knowledge about how to derive a DES key from a given key type.
+ * If given a des key, use it directly; otherwise, perform any parity
+ * fixup that may be needed and pass through to the hmad-md5 bits.
+ *
+ * @param[in]   enctype  Kerberos enctype of the input key
+ * @param[in]   keydata  Input key data
+ * @param[in]   keylen   Size of input key data
+ * @param[out]  output   8-byte buffer to hold the derived key
+ *
+ * @return Returns 0 to indicate success, or an error code.
+ *
+ * @retval KRB5_PROG_ETYPE_NOSUPP  The enctype is one for which rxkad-kdf
+ * is not supported.  This includes several reserved enctypes, enctype
+ * values used in PKINIT to stand for CMS algorithm identifiers, and all
+ * private-use (negative) enctypes.
+ *
+ * @retval KRB5_BAD_KEYSIZE  The key size was not a multiple of 8 bytes
+ * (for 3DES key types), exactly 8 bytes (for DES key types), or at least
+ * 8 bytes (for other key types).
+ *
+ * @retval KRB5DES_WEAK_KEY  Successive derivation attempts with all
+ * 255 possible counter values each produced weak DES keys.  This input
+ * cannot be used to produce a usable key.
+ */
+int
+_kafs_derive_des_key(krb5_enctype enctype, void *keydata, size_t keylen,
+		     char output[8])
+{
+    int ret = 0;
+
+    switch ((int)enctype) {
+    case ETYPE_DES_CBC_CRC:
+    case ETYPE_DES_CBC_MD4:
+    case ETYPE_DES_CBC_MD5:
+	if (keylen != 8)
+	    return KRB5_BAD_KEYSIZE;
+
+	/* Extract session key */
+	memcpy(output, keydata, 8);
+	break;
+    case ETYPE_NULL:
+    case 4:
+    case 6:
+    case 8:
+    case 9:
+    case 10:
+    case 11:
+    case 12:
+    case 13:
+    case 14:
+    case 15:
+	return KRB5_PROG_ETYPE_NOSUPP;
+	/*In order to become a "Cryptographic Key" as specified in
+	 * SP800-108, it must be indistinguishable from a random bitstring. */
+    case ETYPE_DES3_CBC_MD5:
+    case ETYPE_OLD_DES3_CBC_SHA1:
+    case ETYPE_DES3_CBC_SHA1:
+	ret = compress_parity_bits(keydata, &keylen);
+	if (ret)
+	    return ret;
+	/* FALLTHROUGH */
+    default:
+	if (enctype < 0)
+	    return KRB5_PROG_ETYPE_NOSUPP;
+	if (keylen < 7)
+	    return KRB5_BAD_KEYSIZE;
+	ret = rxkad_derive_des_key(keydata, keylen, output);
+    }
+    return ret;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/kdfs/k5dfspag.c b/crypto/external/bsd/heimdal/dist/lib/kdfs/k5dfspag.c
index 10d740604..406eeb552 100644
--- a/crypto/external/bsd/heimdal/dist/lib/kdfs/k5dfspag.c
+++ b/crypto/external/bsd/heimdal/dist/lib/kdfs/k5dfspag.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: k5dfspag.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: k5dfspag.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * lib/krb5/os/k5dfspag.c
@@ -27,7 +27,7 @@
 #include <config.h>
 #endif
 
-__RCSID("NetBSD");
+__RCSID("$NetBSD: k5dfspag.c,v 1.2 2017/01/28 21:31:49 christos Exp $");
 
 #include <krb5/krb5.h>
 
@@ -238,7 +238,7 @@ int krb5_dfs_getpag()
  * user.
  *
  * And it should be called before access to the home directory
- * as this may be in DFS, not accessable by root, and require
+ * as this may be in DFS, not accessible by root, and require
  * the PAG to have been setup.
  *
  * The krb5_afs_pag can be called after this routine to
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/krb5/Makefile.am
index 343b3ba5a..25cf577cf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/Makefile.am
@@ -2,20 +2,21 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_krb4) $(INCLUDE_hcrypto) -I../com_err -I$(srcdir)/../com_err $(INCLUDE_sqlite3) $(INCLUDE_libintl)
+AM_CPPFLAGS += -I../com_err -I$(srcdir)/../com_err $(INCLUDE_sqlite3) $(INCLUDE_libintl) $(INCLUDE_openssl_crypto)
 
 bin_PROGRAMS = verify_krb5_conf
 
 noinst_PROGRAMS =				\
 	krbhst-test				\
-	test_gic				\
 	test_alname				\
 	test_crypto				\
-	test_rfc3961				\
+	test_forward				\
 	test_get_addrs				\
+	test_gic				\
 	test_kuserok				\
 	test_renew				\
-	test_forward
+	test_rfc3961
+
 
 noinst_LTLIBRARIES =				\
 	librfc3961.la
@@ -25,6 +26,7 @@ TESTS =						\
 	derived-key-test			\
 	n-fold-test				\
 	parse-name-test				\
+	pseudo-random-test			\
 	store-test				\
 	string-to-key-test			\
 	test_acl				\
@@ -43,17 +45,18 @@ TESTS =						\
 	test_pkinit_dh2key			\
 	test_pknistkdf				\
 	test_time				\
+	test_expand_toks			\
 	test_x500
 
 check_DATA = test_config_strings.out
 
-check_PROGRAMS = $(TESTS) test_hostname test_ap-req
+check_PROGRAMS = $(TESTS) test_hostname test_ap-req test_canon test_set_kvno0
 
 LDADD = libkrb5.la \
 	$(LIB_hcrypto) \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(top_builddir)/lib/wind/libwind.la \
-	$(LIB_roken)
+	$(LIB_heimbase) $(LIB_roken)
 
 if PKINIT
 LIB_pkinit = ../hx509/libhx509.la
@@ -67,8 +70,9 @@ libkrb5_la_LIBADD = \
 	$(top_builddir)/lib/asn1/libasn1.la \
 	$(top_builddir)/lib/ipc/libheim-ipcc.la \
 	$(top_builddir)/lib/wind/libwind.la \
-	$(top_builddir)/base/libheimbase.la \
+	$(top_builddir)/lib/base/libheimbase.la \
 	$(LIB_pkinit) \
+	$(LIB_openssl_crypto) \
 	$(use_sqlite) \
 	$(LIB_com_err) \
 	$(LIB_hcrypto) \
@@ -111,6 +115,7 @@ dist_libkrb5_la_SOURCES =			\
 	acl.c					\
 	add_et_list.c				\
 	addr_families.c				\
+	an2ln_plugin.h				\
 	aname_to_localname.c			\
 	appdefault.c				\
 	asn1_glue.c				\
@@ -129,7 +134,8 @@ dist_libkrb5_la_SOURCES =			\
 	creds.c					\
 	crypto.c				\
 	crypto.h				\
-	crypto-aes.c				\
+	crypto-aes-sha1.c			\
+	crypto-aes-sha2.c			\
 	crypto-algs.c				\
 	crypto-arcfour.c			\
 	crypto-des.c				\
@@ -141,12 +147,17 @@ dist_libkrb5_la_SOURCES =			\
 	crypto-rand.c				\
 	doxygen.c				\
 	data.c					\
+	db_plugin.c				\
+	db_plugin.h				\
+	dcache.c				\
 	deprecated.c				\
 	digest.c				\
 	eai_to_heim_errno.c			\
+        enomem.c                                \
 	error_string.c				\
 	expand_hostname.c			\
 	expand_path.c				\
+	fast.c					\
 	fcache.c				\
 	free.c					\
 	free_host_realm.c			\
@@ -174,6 +185,7 @@ dist_libkrb5_la_SOURCES =			\
 	krb5-v4compat.h				\
 	krbhst.c				\
 	kuserok.c				\
+	kuserok_plugin.h			\
 	log.c					\
 	mcache.c				\
 	misc.c					\
@@ -191,6 +203,7 @@ dist_libkrb5_la_SOURCES =			\
 	padata.c				\
 	pcache.c				\
 	pkinit.c				\
+	pkinit-ec.c				\
 	principal.c				\
 	prog_setup.c				\
 	prompter_posix.c			\
@@ -204,10 +217,12 @@ dist_libkrb5_la_SOURCES =			\
 	recvauth.c				\
 	replay.c				\
 	salt.c					\
-	salt-aes.c				\
+	salt-aes-sha1.c				\
+	salt-aes-sha2.c				\
 	salt-arcfour.c				\
 	salt-des.c				\
 	salt-des3.c				\
+	sp800-108-kdf.c				\
 	scache.c				\
 	send_to_kdc.c				\
 	sendauth.c				\
@@ -219,6 +234,7 @@ dist_libkrb5_la_SOURCES =			\
 	store_emem.c				\
 	store_fd.c				\
 	store_mem.c				\
+	store_sock.c				\
 	plugin.c				\
 	ticket.c				\
 	time.c					\
@@ -241,13 +257,29 @@ if versionscript
 libkrb5_la_LDFLAGS += $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
 endif
 
-$(libkrb5_la_OBJECTS) $(verify_krb5_conf_OBJECTS) $(librfc3961_la_OBJECTS): $(srcdir)/krb5-protos.h $(srcdir)/krb5-private.h krb5_err.h heim_err.h k524_err.h krb5_err.h krb_err.h k524_err.h
+ALL_OBJECTS  = $(libkrb5_la_OBJECTS)
+ALL_OBJECTS += $(verify_krb5_conf_OBJECTS)
+ALL_OBJECTS += $(librfc3961_la_OBJECTS)
+ALL_OBJECTS += $(librfc3961_la_OBJECTS)
+ALL_OBJECTS += $(krbhst_test_OBJECTS)
+ALL_OBJECTS += $(test_alname_OBJECTS)
+ALL_OBJECTS += $(test_crypto_OBJECTS)
+ALL_OBJECTS += $(test_forward_OBJECTS)
+ALL_OBJECTS += $(test_get_addrs_OBJECTS)
+ALL_OBJECTS += $(test_gic_OBJECTS)
+ALL_OBJECTS += $(test_kuserok_OBJECTS)
+ALL_OBJECTS += $(test_renew_OBJECTS)
+ALL_OBJECTS += $(test_rfc3961_OBJECTS)
+
+$(ALL_OBJECTS): $(srcdir)/krb5-protos.h $(srcdir)/krb5-private.h
+$(ALL_OBJECTS): krb5_err.h heim_err.h k524_err.h krb5_err.h krb_err.h k524_err.h
 
 librfc3961_la_SOURCES =				\
 	crc.c					\
 	crypto.c				\
 	crypto.h				\
-	crypto-aes.c				\
+	crypto-aes-sha1.c			\
+	crypto-aes-sha2.c			\
 	crypto-algs.c				\
 	crypto-arcfour.c			\
 	crypto-des.c				\
@@ -259,14 +291,17 @@ librfc3961_la_SOURCES =				\
 	crypto-rand.c				\
 	crypto-stubs.c				\
 	data.c					\
+	enomem.c				\
 	error_string.c				\
 	keyblock.c				\
 	n-fold.c				\
 	salt.c					\
-	salt-aes.c				\
+	salt-aes-sha1.c				\
+	salt-aes-sha2.c				\
 	salt-arcfour.c				\
 	salt-des.c				\
 	salt-des3.c				\
+	sp800-108-kdf.c				\
 	store-int.c				\
 	warn.c
 
@@ -277,15 +312,20 @@ test_rfc3961_LDADD = 				\
 	$(LIB_hcrypto)				\
 	$(LIB_roken)
 
-$(srcdir)/krb5-protos.h:
-	cd $(srcdir) && perl ../../cf/make-proto.pl -E KRB5_LIB -q -P comment -o krb5-protos.h $(dist_libkrb5_la_SOURCES) || rm -f krb5-protos.h
+if DEVELOPER_MODE
+headerdeps = $(dist_libkrb5_la_SOURCES)
+endif
 
-$(srcdir)/krb5-private.h:
-	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5-private.h $(dist_libkrb5_la_SOURCES) || rm -f krb5-private.h
+$(srcdir)/krb5-protos.h: $(headerdeps)
+	@cd $(srcdir) && perl ../../cf/make-proto.pl -E KRB5_LIB -q -P comment -o krb5-protos.h $(dist_libkrb5_la_SOURCES) || rm -f krb5-protos.h
+
+$(srcdir)/krb5-private.h: $(headerdeps)
+	@cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5-private.h $(dist_libkrb5_la_SOURCES) || rm -f krb5-private.h
 
 man_MANS =					\
 	kerberos.8				\
 	krb5.conf.5				\
+	krb5-plugin.7				\
 	krb524_convert_creds_kdc.3		\
 	krb5_425_conv_principal.3		\
 	krb5_acl_match_file.3			\
@@ -330,15 +370,17 @@ man_MANS =					\
 
 dist_include_HEADERS = \
 	krb5.h \
-	krb5-protos.h \
-	krb5-private.h \
+	$(srcdir)/krb5-protos.h \
 	krb5_ccapi.h
 
+noinst_HEADERS = $(srcdir)/krb5-private.h
+
+
 nodist_include_HEADERS = krb5_err.h heim_err.h k524_err.h
 
 # XXX use nobase_include_HEADERS = krb5/locate_plugin.h
 krb5dir = $(includedir)/krb5
-krb5_HEADERS = locate_plugin.h send_to_kdc_plugin.h ccache_plugin.h
+krb5_HEADERS = locate_plugin.h send_to_kdc_plugin.h ccache_plugin.h an2ln_plugin.h db_plugin.h
 
 build_HEADERZ = \
 	$(krb5_HEADERS) \
@@ -359,6 +401,9 @@ test_config_strings.out: test_config_strings.cfg
 
 EXTRA_DIST = \
 	NTMakefile \
+	config_reg.c \
+	dll.c \
+	libkrb5-exports.def.in \
 	verify_krb5_conf-version.rc \
 	krb5_err.et \
 	krb_err.et \
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/krb5/NTMakefile
index 733121c80..b0848716c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2009, Secure Endpoints Inc.
+# Copyright (c) 2009 - 2016, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -51,11 +51,13 @@ libkrb5_OBJS =			\
 	$(OBJ)\config_reg.obj		    \
 	$(OBJ)\constants.obj		    \
 	$(OBJ)\context.obj		    \
+        $(OBJ)\convert_creds.obj            \
 	$(OBJ)\copy_host_realm.obj	    \
 	$(OBJ)\crc.obj			    \
 	$(OBJ)\creds.obj		    \
 	$(OBJ)\crypto.obj		    \
-	$(OBJ)\crypto-aes.obj		    \
+	$(OBJ)\crypto-aes-sha1.obj	    \
+	$(OBJ)\crypto-aes-sha2.obj	    \
 	$(OBJ)\crypto-algs.obj		    \
 	$(OBJ)\crypto-arcfour.obj	    \
 	$(OBJ)\crypto-des-common.obj	    \
@@ -66,13 +68,17 @@ libkrb5_OBJS =			\
 	$(OBJ)\crypto-pk.obj		    \
 	$(OBJ)\crypto-rand.obj		    \
 	$(OBJ)\data.obj			    \
+	$(OBJ)\dcache.obj                   \
+	$(OBJ)\db_plugin.obj		    \
 	$(OBJ)\deprecated.obj		    \
 	$(OBJ)\digest.obj		    \
 	$(OBJ)\dll.obj			    \
 	$(OBJ)\eai_to_heim_errno.obj	    \
+        $(OBJ)\enomem.obj                   \
 	$(OBJ)\error_string.obj		    \
 	$(OBJ)\expand_hostname.obj	    \
 	$(OBJ)\expand_path.obj	    	    \
+	$(OBJ)\fast.obj			    \
 	$(OBJ)\fcache.obj		    \
 	$(OBJ)\free.obj			    \
 	$(OBJ)\free_host_realm.obj	    \
@@ -112,7 +118,10 @@ libkrb5_OBJS =			\
 	$(OBJ)\n-fold.obj		    \
 	$(OBJ)\pac.obj			    \
 	$(OBJ)\padata.obj		    \
+	$(OBJ)\pcache.obj		    \
 	$(OBJ)\pkinit.obj		    \
+	$(OBJ)\pkinit-ec.obj		    \
+	$(OBJ)\plugin.obj                   \
 	$(OBJ)\principal.obj		    \
 	$(OBJ)\prog_setup.obj		    \
 	$(OBJ)\prompter_posix.obj	    \
@@ -125,7 +134,8 @@ libkrb5_OBJS =			\
 	$(OBJ)\read_message.obj		    \
 	$(OBJ)\recvauth.obj		    \
 	$(OBJ)\replay.obj		    \
-	$(OBJ)\salt-aes.obj		    \
+	$(OBJ)\salt-aes-sha1.obj	    \
+	$(OBJ)\salt-aes-sha2.obj	    \
 	$(OBJ)\salt-arcfour.obj		    \
 	$(OBJ)\salt-des.obj		    \
 	$(OBJ)\salt-des3.obj		    \
@@ -135,13 +145,13 @@ libkrb5_OBJS =			\
 	$(OBJ)\sendauth.obj		    \
 	$(OBJ)\set_default_realm.obj	    \
 	$(OBJ)\sock_principal.obj	    \
+	$(OBJ)\sp800-108-kdf.obj	    \
 	$(OBJ)\store.obj		    \
 	$(OBJ)\store-int.obj		    \
 	$(OBJ)\store_emem.obj		    \
 	$(OBJ)\store_fd.obj		    \
 	$(OBJ)\store_mem.obj		    \
-	$(OBJ)\pcache.obj		    \
-	$(OBJ)\plugin.obj		    \
+	$(OBJ)\store_sock.obj		    \
 	$(OBJ)\ticket.obj		    \
 	$(OBJ)\time.obj			    \
 	$(OBJ)\transited.obj		    \
@@ -199,7 +209,8 @@ dist_libkrb5_la_SOURCES =			\
 	creds.c					\
 	crypto.c				\
 	crypto.h				\
-	crypto-aes.c				\
+	crypto-aes-sha1.c			\
+	crypto-aes-sha2.c			\
 	crypto-algs.c				\
 	crypto-arcfour.c			\
 	crypto-des.c				\
@@ -208,14 +219,18 @@ dist_libkrb5_la_SOURCES =			\
 	crypto-evp.c				\
 	crypto-pk.c				\
 	crypto-rand.c				\
+	db_plugin.c                             \
 	doxygen.c				\
 	data.c					\
+	dcache.c                                \
 	deprecated.c				\
 	digest.c				\
 	eai_to_heim_errno.c			\
+        enomem.c                                \
 	error_string.c				\
 	expand_hostname.c			\
 	expand_path.c				\
+	fast.c					\
 	fcache.c				\
 	free.c					\
 	free_host_realm.c			\
@@ -259,6 +274,8 @@ dist_libkrb5_la_SOURCES =			\
 	pac.c					\
 	padata.c				\
 	pkinit.c				\
+	pkinit-ec.c				\
+	plugin.c                                \
 	principal.c				\
 	prog_setup.c				\
 	prompter_posix.c			\
@@ -272,7 +289,8 @@ dist_libkrb5_la_SOURCES =			\
 	recvauth.c				\
 	replay.c				\
 	salt.c					\
-	salt-aes.c				\
+	salt-aes-sha1.c				\
+	salt-aes-sha2.c				\
 	salt-arcfour.c				\
 	salt-des.c				\
 	salt-des3.c				\
@@ -281,12 +299,14 @@ dist_libkrb5_la_SOURCES =			\
 	sendauth.c				\
 	set_default_realm.c			\
 	sock_principal.c			\
+	sp800-108-kdf.c				\
 	store.c					\
 	store-int.c				\
 	store-int.h				\
 	store_emem.c				\
 	store_fd.c				\
 	store_mem.c				\
+	store_sock.c				\
 	pcache.c				\
 	plugin.c				\
 	ticket.c				\
@@ -327,8 +347,13 @@ $(OBJ)\k524_err.c $(OBJ)\k524_err.h: k524_err.et
 #----------------------------------------------------------------------
 # libkrb5
 
-$(LIBKRB5): $(libkrb5_OBJS) $(libkrb5_gen_OBJS)
-	$(LIBCON)
+$(LIBKRB5): $(libkrb5_OBJS)  $(libkrb5_gen_OBJS)
+	$(LIBCON_C) -OUT:$@ $(LIBHEIMBASE) $(LIB_openssl_crypto) @<<
+$(libkrb5_OBJS: =
+)
+$(libkrb5_gen_OBJS: =
+)
+<<
 
 all:: $(LIBKRB5)
 
@@ -349,7 +374,8 @@ clean::
 librfc3961_OBJS=\
 	$(OBJ)\crc.obj			\
 	$(OBJ)\crypto.obj		\
-	$(OBJ)\crypto-aes.obj		\
+	$(OBJ)\crypto-aes-sha1.obj	\
+	$(OBJ)\crypto-aes-sha2.obj	\
 	$(OBJ)\crypto-algs.obj		\
 	$(OBJ)\crypto-arcfour.obj	\
 	$(OBJ)\crypto-des.obj		\
@@ -365,10 +391,12 @@ librfc3961_OBJS=\
 	$(OBJ)\keyblock.obj		\
 	$(OBJ)\n-fold.obj		\
 	$(OBJ)\salt.obj			\
-	$(OBJ)\salt-aes.obj		\
+	$(OBJ)\salt-aes-sha1.obj	\
+	$(OBJ)\salt-aes-sha2.obj	\
 	$(OBJ)\salt-arcfour.obj		\
 	$(OBJ)\salt-des.obj		\
 	$(OBJ)\salt-des3.obj		\
+	$(OBJ)\sp800-108-kdf.obj	\
 	$(OBJ)\store-int.obj		\
 	$(OBJ)\warn.obj
 
@@ -409,6 +437,7 @@ test_binaries =				\
 	$(OBJ)\krbhst-test.exe		\
 	$(OBJ)\n-fold-test.exe		\
 	$(OBJ)\parse-name-test.exe	\
+	$(OBJ)\pseudo-random-test.exe	\
 	$(OBJ)\store-test.exe		\
 	$(OBJ)\string-to-key-test.exe	\
 	$(OBJ)\test_acl.exe		\
@@ -431,11 +460,10 @@ test_binaries =				\
 	$(OBJ)\test_prf.exe		\
 	$(OBJ)\test_princ.exe		\
 	$(OBJ)\test_renew.exe		\
-	$(OBJ)\test_rfc3961.exe		\
 	$(OBJ)\test_store.exe		\
 	$(OBJ)\test_time.exe		\
 
-test-binaries: $(test_binaries)
+test-binaries: $(test_binaries) $(OBJ)\test_rfc3961.exe
 
 test-files: $(OBJ)\test_config_strings.out
 
@@ -444,35 +472,46 @@ $(OBJ)\test_config_strings.out: test_config_strings.cfg
 
 test-run:
 	cd $(OBJ)
-	aes-test.exe
-	derived-key-test.exe
-	n-fold-test.exe
-	parse-name-test.exe
-	store-test.exe
-	string-to-key-test.exe
-	test_acl.exe
-	test_addr.exe
-	test_cc.exe
-	test_config.exe
-	test_prf.exe
-	test_store.exe
-	test_crypto.exe
-	test_crypto_wrapping.exe
-	test_keytab.exe
-	test_mem.exe
-	test_pac.exe
-	test_plugin.exe
-	test_princ.exe
-	test_pkinit_dh2key.exe
-	test_pknistkdf.exe
-	test_time.exe
+	-aes-test.exe
+	-derived-key-test.exe
+	-krbhst-test.exe
+	-n-fold-test.exe
+	-parse-name-test.exe
+	-pseudo-random-test.exe
+	-store-test.exe
+	-string-to-key-test.exe
+	-test_acl.exe
+	-test_addr.exe
+# Skip alname due to lack of .k5login and "root"
+#	-test_alname.exe
+	-test_cc.exe
+	-test_config.exe
+	-test_crypto.exe
+	-test_crypto_wrapping.exe
+# Skip forward due to need for existing hostname
+#	-test_forward.exe
+	-test_get_addrs.exe
+	-test_hostname.exe
+	-test_keytab.exe
+# Skip kuserok requires principal and localname
+#	-test_kuserok.exe
+	-test_mem.exe
+	-test_pac.exe
+	-test_pkinit_dh2key.exe
+	-test_pknistkdf.exe
+	-test_plugin.exe
+	-test_prf.exe
+	-test_renew.exe
+	-test_rfc3961.exe
+	-test_store.exe
+	-test_time.exe
 	cd $(SRCDIR)
 
-$(test_binaries): $$(@R).obj $(LIBHEIMDAL) $(LIBVERS) $(LIBROKEN)
+$(test_binaries): $$(@R).obj $(LIBHEIMDAL) $(LIBVERS) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
-$(OBJ)\test_rfc3961.exe: $(OBJ)\test_rfc3961.obj $(LIBRFC3961) $(LIBHEIMDAL) $(LIBVERS) $(LIBROKEN)
+$(OBJ)\test_rfc3961.exe: $(OBJ)\test_rfc3961.obj $(LIBRFC3961) $(LIBHEIMDAL) $(LIBVERS) $(LIBCOMERR) $(LIBROKEN) $(LIBHEIMBASE)
 	$(EXECONLINK)
 	$(EXEPREP_NODIST)
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/acache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/acache.c
index c2d968845..8abcbe7e2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/acache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/acache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acache.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: acache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
@@ -127,7 +127,7 @@ init_ccapi(krb5_context context)
 #ifdef KRB5_USE_PATH_TOKENS
     {
       char * explib = NULL;
-      if (_krb5_expand_path_tokens(context, lib, &explib) == 0) {
+      if (_krb5_expand_path_tokens(context, lib, 0, &explib) == 0) {
 	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL);
 	free(explib);
       }
@@ -170,7 +170,7 @@ init_ccapi(krb5_context context)
 #endif
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _heim_krb5_ipc_client_set_target_uid(uid_t uid)
 {
     init_ccapi(NULL);
@@ -178,7 +178,7 @@ _heim_krb5_ipc_client_set_target_uid(uid_t uid)
         (*set_target_uid)(uid);
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _heim_krb5_ipc_client_clear_target(void)
 {
     init_ccapi(NULL);
@@ -305,8 +305,7 @@ make_cred_from_ccred(krb5_context context,
     return 0;
 
 nomem:
-    ret = ENOMEM;
-    krb5_set_error_message(context, ret, N_("malloc: out of memory", "malloc"));
+    ret = krb5_enomem(context);
 
 fail:
     krb5_free_cred_contents(context, cred);
@@ -907,10 +906,8 @@ acc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 	return ret;
 
     iter = calloc(1, sizeof(*iter));
-    if (iter == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
-    }
+    if (iter == NULL)
+	return krb5_enomem(context);
 
     error = (*init_func)(&iter->context, ccapi_version_3, NULL, NULL);
     if (error) {
@@ -1038,10 +1035,8 @@ acc_get_default_name(krb5_context context, char **str)
     (*name->func->release)(name);
     (*cc->func->release)(cc);
 
-    if (error < 0 || *str == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (error < 0 || *str == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/acl.c b/crypto/external/bsd/heimdal/dist/lib/krb5/acl.c
index 0b04709b3..1ca84434c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/acl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/acl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: acl.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: acl.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2002, 2004 Kungliga Tekniska Högskolan
@@ -83,10 +83,8 @@ acl_parse_format(krb5_context context,
     for(p = format; *p != '\0'; p++) {
 	tmp = malloc(sizeof(*tmp));
 	if(tmp == NULL) {
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
 	    acl_free_list(acl, 0);
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	if(*p == 's') {
 	    tmp->type = acl_string;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/add_et_list.c b/crypto/external/bsd/heimdal/dist/lib/krb5/add_et_list.c
index da2feaa39..d40aa73de 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/add_et_list.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/add_et_list.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: add_et_list.c,v 1.1.1.1 2011/04/13 18:15:31 elric Exp $	*/
+/*	$NetBSD: add_et_list.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/addr_families.c b/crypto/external/bsd/heimdal/dist/lib/krb5/addr_families.c
index a0f6a08bd..0d3e3528d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/addr_families.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/addr_families.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: addr_families.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: addr_families.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -801,6 +801,7 @@ static struct addr_operations at[] = {
 	NULL,
 	NULL,
 	NULL,
+	NULL,
 	NULL
     }
 };
@@ -1162,6 +1163,7 @@ krb5_parse_address(krb5_context context,
 {
     int i, n;
     struct addrinfo *ai, *a;
+    struct addrinfo hint;
     int error;
     int save_errno;
 
@@ -1173,18 +1175,18 @@ krb5_parse_address(krb5_context context,
 	    krb5_address addr;
 	    if((*at[i].parse_addr)(context, string, &addr) == 0) {
 		ALLOC_SEQ(addresses, 1);
-		if (addresses->val == NULL) {
-		    krb5_set_error_message(context, ENOMEM,
-					   N_("malloc: out of memory", ""));
-		    return ENOMEM;
-		}
+		if (addresses->val == NULL)
+		    return krb5_enomem(context);
 		addresses->val[0] = addr;
 		return 0;
 	    }
 	}
     }
 
-    error = getaddrinfo (string, NULL, NULL, &ai);
+    /* if not parsed as numeric address, do a name lookup */
+    memset(&hint, 0, sizeof(hint));
+    hint.ai_family = AF_UNSPEC;
+    error = getaddrinfo (string, NULL, &hint, &ai);
     if (error) {
 	krb5_error_code ret2;
 	save_errno = errno;
@@ -1200,10 +1202,8 @@ krb5_parse_address(krb5_context context,
 
     ALLOC_SEQ(addresses, n);
     if (addresses->val == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	freeaddrinfo(ai);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     addresses->len = 0;
@@ -1413,7 +1413,7 @@ krb5_copy_addresses(krb5_context context,
     size_t i;
     ALLOC_SEQ(outaddr, inaddr->len);
     if(inaddr->len > 0 && outaddr->val == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     for(i = 0; i < inaddr->len; i++)
 	krb5_copy_address(context, &inaddr->val[i], &outaddr->val[i]);
     return 0;
@@ -1442,11 +1442,8 @@ krb5_append_addresses(krb5_context context,
     size_t i;
     if(source->len > 0) {
 	tmp = realloc(dest->val, (dest->len + source->len) * sizeof(*tmp));
-	if(tmp == NULL) {
-	    krb5_set_error_message (context, ENOMEM,
-				    N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (tmp == NULL)
+	    return krb5_enomem(context);
 	dest->val = tmp;
 	for(i = 0; i < source->len; i++) {
 	    /* skip duplicates */
@@ -1485,19 +1482,14 @@ krb5_make_addrport (krb5_context context,
     u_char *p;
 
     *res = malloc (sizeof(**res));
-    if (*res == NULL) {
-	krb5_set_error_message (context, ENOMEM,
-				N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*res == NULL)
+	return krb5_enomem(context);
     (*res)->addr_type = KRB5_ADDRESS_ADDRPORT;
     ret = krb5_data_alloc (&(*res)->address, len);
     if (ret) {
-	krb5_set_error_message (context, ret,
-				N_("malloc: out of memory", ""));
 	free (*res);
 	*res = NULL;
-	return ret;
+	return krb5_enomem(context);
     }
     p = (*res)->address.data;
     *p++ = 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/aes-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/aes-test.c
index 80511706c..3fa1c0e9d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/aes-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/aes-test.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: aes-test.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: aes-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
- * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -37,10 +37,6 @@
 #include <err.h>
 #include <assert.h>
 
-#ifdef HAVE_OPENSSL
-#include <openssl/evp.h>
-#endif
-
 static int verbose = 0;
 
 static void
@@ -63,6 +59,29 @@ struct {
     char *pbkdf2;
     char *key;
 } keys[] = {
+    {
+	"password",
+	"\x10\xDF\x9D\xD7\x83\xE5\xBC\x8A\xCE\xA1\x73\x0E\x74\x35\x5F\x61"
+	"ATHENA.MIT.EDUraeburn",
+	37,
+	32768,
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	16,
+	NULL,
+	"\x08\x9B\xCA\x48\xB1\x05\xEA\x6E\xA7\x7C\xA5\xD2\xF3\x9D\xC5\xE7"
+    },
+    {
+	"password",
+	"\x10\xDF\x9D\xD7\x83\xE5\xBC\x8A\xCE\xA1\x73\x0E\x74\x35\x5F\x61"
+	"ATHENA.MIT.EDUraeburn",
+	37,
+	32768,
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+	32,
+	NULL,
+	"\x45\xBD\x80\x6D\xBF\x6A\x83\x3A\x9C\xFF\xC1\xC9\x45\x89\xA2\x22"
+	"\x36\x7A\x79\xBC\x21\xC4\x13\x71\x89\x06\xE9\xF5\x78\xA7\x84\x67"
+    },
     {
 	"password", "ATHENA.MIT.EDUraeburn", -1,
 	1,
@@ -162,7 +181,6 @@ struct {
 	"\x1a\x8b\x4d\x28\x26\x01\xdb\x3b\x36\xbe\x92\x46\x91\x5e\xc8\x2a",
 	"\xd7\x8c\x5c\x9c\xb8\x72\xa8\xc9\xda\xd4\x69\x7f\x0b\xb5\xb2\xd2"
 	"\x14\x96\xc8\x2b\xeb\x2c\xae\xda\x21\x12\xfc\xee\xa0\x57\x40\x1b"
-
     },
     {
 	"\xf0\x9d\x84\x9e" /* g-clef */, "EXAMPLE.COMpianist", -1,
@@ -227,14 +245,15 @@ string_to_key_test(krb5_context context)
 	    if (keys[i].keylen > sizeof(keyout))
 		abort();
 
-	    PKCS5_PBKDF2_HMAC_SHA1(password.data, password.length,
-				   salt.saltvalue.data, salt.saltvalue.length,
-				   keys[i].iterations,
-				   keys[i].keylen, keyout);
+	    PKCS5_PBKDF2_HMAC(password.data, password.length,
+			      salt.saltvalue.data, salt.saltvalue.length,
+			      keys[i].iterations, EVP_sha1(),
+			      keys[i].keylen, keyout);
 
 	    if (memcmp(keyout, keys[i].pbkdf2, keys[i].keylen) != 0) {
 		krb5_warnx(context, "%d: pbkdf2", i);
 		val = 1;
+		hex_dump_data(keyout, keys[i].keylen);
 		continue;
 	    }
 
@@ -271,6 +290,8 @@ string_to_key_test(krb5_context context)
 	    if (memcmp(key.keyvalue.data, keys[i].key, keys[i].keylen) != 0) {
 		krb5_warnx(context, "%d: key wrong", i);
 		val = 1;
+		hex_dump_data(key.keyvalue.data, key.keyvalue.length);
+		hex_dump_data(keys[i].key, keys[i].keylen);
 		continue;
 	    }
 
@@ -480,9 +501,10 @@ static int
 krb_checksum_iov(krb5_context context,
 		 krb5_crypto crypto,
 		 unsigned usage,
-		 krb5_data *plain)
+		 krb5_data *plain,
+		 krb5_data *verify)
 {
-    krb5_crypto_iov iov[4];
+    krb5_crypto_iov iov[3];
     int ret;
     char *p;
     size_t len;
@@ -491,8 +513,12 @@ krb_checksum_iov(krb5_context context,
     len = plain->length;
 
     iov[0].flags = KRB5_CRYPTO_TYPE_CHECKSUM;
-    krb5_crypto_length(context, crypto, iov[0].flags, &iov[0].data.length);
-    iov[0].data.data = emalloc(iov[0].data.length);
+    if (verify) {
+	iov[0].data = *verify;
+    } else {
+	krb5_crypto_length(context, crypto, iov[0].flags, &iov[0].data.length);
+	iov[0].data.data = emalloc(iov[0].data.length);
+    }
 
     iov[1].flags = KRB5_CRYPTO_TYPE_DATA;
     iov[1].data.length = len;
@@ -502,16 +528,19 @@ krb_checksum_iov(krb5_context context,
     krb5_crypto_length(context, crypto, iov[0].flags, &iov[2].data.length);
     iov[2].data.data = malloc(iov[2].data.length);
 
-    ret = krb5_create_checksum_iov(context, crypto, usage,
-				   iov, sizeof(iov)/sizeof(iov[0]), NULL);
-    if (ret)
-	krb5_err(context, 1, ret, "krb5_create_checksum_iov failed");
+    if (verify == NULL) {
+	ret = krb5_create_checksum_iov(context, crypto, usage,
+				       iov, sizeof(iov)/sizeof(iov[0]), NULL);
+	if (ret)
+	    krb5_err(context, 1, ret, "krb5_create_checksum_iov failed");
+    }
 
     ret = krb5_verify_checksum_iov(context, crypto, usage, iov, sizeof(iov)/sizeof(iov[0]), NULL);
     if (ret)
 	krb5_err(context, 1, ret, "krb5_verify_checksum_iov");
 
-    free(iov[0].data.data);
+    if (verify == NULL)
+	free(iov[0].data.data);
     free(iov[2].data.data);
 
     return 0;
@@ -561,7 +590,6 @@ krb_enc_mit(krb5_context context,
     return 0;
 }
 
-
 struct {
     krb5_enctype enctype;
     unsigned usage;
@@ -571,6 +599,8 @@ struct {
     void* edata;
     size_t plen;
     void *pdata;
+    size_t clen; /* checksum length */
+    void *cdata; /* checksum data */
 } krbencs[] =  {
     {
 	ETYPE_AES256_CTS_HMAC_SHA1_96,
@@ -583,11 +613,133 @@ struct {
 	"\xa9\xec\x1c\x5c\x21\xfb\x6e\xef\x1a\x7a\xc8\xc1\xcc\x5a\x95\x24"
 	"\x6f\x9f\xf4\xd5\xbe\x5d\x59\x97\x44\xd8\x47\xcd",
 	16,
-	"\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x2e\x0a"
+	"\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x2e\x0a",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	2,
+	16,
+	"\x37\x05\xD9\x60\x80\xC1\x77\x28\xA0\xE8\x00\xEA\xB6\xE0\xD2\x3C",
+	32,
+	"\xEF\x85\xFB\x89\x0B\xB8\x47\x2F\x4D\xAB\x20\x39\x4D\xCA\x78\x1D"
+	"\xAD\x87\x7E\xDA\x39\xD5\x0C\x87\x0C\x0D\x5A\x0A\x8E\x48\xC7\x18",
+	0,
+	"",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	2,
+	16,
+	"\x37\x05\xD9\x60\x80\xC1\x77\x28\xA0\xE8\x00\xEA\xB6\xE0\xD2\x3C",
+	38,
+	"\x84\xD7\xF3\x07\x54\xED\x98\x7B\xAB\x0B\xF3\x50\x6B\xEB\x09\xCF"
+	"\xB5\x54\x02\xCE\xF7\xE6\x87\x7C\xE9\x9E\x24\x7E\x52\xD1\x6E\xD4"
+	"\x42\x1D\xFD\xF8\x97\x6C",
+	6,
+	"\x00\x01\x02\x03\x04\x05",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	2,
+	16,
+	"\x37\x05\xD9\x60\x80\xC1\x77\x28\xA0\xE8\x00\xEA\xB6\xE0\xD2\x3C",
+	48,
+	"\x35\x17\xD6\x40\xF5\x0D\xDC\x8A\xD3\x62\x87\x22\xB3\x56\x9D\x2A"
+	"\xE0\x74\x93\xFA\x82\x63\x25\x40\x80\xEA\x65\xC1\x00\x8E\x8F\xC2"
+	"\x95\xFB\x48\x52\xE7\xD8\x3E\x1E\x7C\x48\xC3\x7E\xEB\xE6\xB0\xD3",
+	16,
+	"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	2,
+	16,
+	"\x37\x05\xD9\x60\x80\xC1\x77\x28\xA0\xE8\x00\xEA\xB6\xE0\xD2\x3C",
+	53,
+	"\x72\x0F\x73\xB1\x8D\x98\x59\xCD\x6C\xCB\x43\x46\x11\x5C\xD3\x36"
+	"\xC7\x0F\x58\xED\xC0\xC4\x43\x7C\x55\x73\x54\x4C\x31\xC8\x13\xBC"
+	"\xE1\xE6\xD0\x72\xC1\x86\xB3\x9A\x41\x3C\x2F\x92\xCA\x9B\x83\x34"
+	"\xA2\x87\xFF\xCB\xFC",
+	21,
+	"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F"
+	"\x10\x11\x12\x13\x14",
+	16,
+	"\xD7\x83\x67\x18\x66\x43\xD6\x7B\x41\x1C\xBA\x91\x39\xFC\x1D\xEE"
+    },
+    {
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+	2,
+	32,
+	"\x6D\x40\x4D\x37\xFA\xF7\x9F\x9D\xF0\xD3\x35\x68\xD3\x20\x66\x98"
+	"\x00\xEB\x48\x36\x47\x2E\xA8\xA0\x26\xD1\x6B\x71\x82\x46\x0C\x52",
+	40,
+	"\x41\xF5\x3F\xA5\xBF\xE7\x02\x6D\x91\xFA\xF9\xBE\x95\x91\x95\xA0"
+	"\x58\x70\x72\x73\xA9\x6A\x40\xF0\xA0\x19\x60\x62\x1A\xC6\x12\x74"
+	"\x8B\x9B\xBF\xBE\x7E\xB4\xCE\x3C",
+	0,
+	"",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+	2,
+	32,
+	"\x6D\x40\x4D\x37\xFA\xF7\x9F\x9D\xF0\xD3\x35\x68\xD3\x20\x66\x98"
+	"\x00\xEB\x48\x36\x47\x2E\xA8\xA0\x26\xD1\x6B\x71\x82\x46\x0C\x52",
+	46,
+	"\x4E\xD7\xB3\x7C\x2B\xCA\xC8\xF7\x4F\x23\xC1\xCF\x07\xE6\x2B\xC7"
+	"\xB7\x5F\xB3\xF6\x37\xB9\xF5\x59\xC7\xF6\x64\xF6\x9E\xAB\x7B\x60"
+	"\x92\x23\x75\x26\xEA\x0D\x1F\x61\xCB\x20\xD6\x9D\x10\xF2",
+	6,
+	"\x00\x01\x02\x03\x04\x05",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+	2,
+	32,
+	"\x6D\x40\x4D\x37\xFA\xF7\x9F\x9D\xF0\xD3\x35\x68\xD3\x20\x66\x98"
+	"\x00\xEB\x48\x36\x47\x2E\xA8\xA0\x26\xD1\x6B\x71\x82\x46\x0C\x52",
+	56,
+	"\xBC\x47\xFF\xEC\x79\x98\xEB\x91\xE8\x11\x5C\xF8\xD1\x9D\xAC\x4B"
+	"\xBB\xE2\xE1\x63\xE8\x7D\xD3\x7F\x49\xBE\xCA\x92\x02\x77\x64\xF6"
+	"\x8C\xF5\x1F\x14\xD7\x98\xC2\x27\x3F\x35\xDF\x57\x4D\x1F\x93\x2E"
+	"\x40\xC4\xFF\x25\x5B\x36\xA2\x66",
+	16,
+	"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F",
+	0,
+	NULL
+    },
+    {
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+	2,
+	32,
+	"\x6D\x40\x4D\x37\xFA\xF7\x9F\x9D\xF0\xD3\x35\x68\xD3\x20\x66\x98"
+	"\x00\xEB\x48\x36\x47\x2E\xA8\xA0\x26\xD1\x6B\x71\x82\x46\x0C\x52",
+	61,
+	"\x40\x01\x3E\x2D\xF5\x8E\x87\x51\x95\x7D\x28\x78\xBC\xD2\xD6\xFE"
+	"\x10\x1C\xCF\xD5\x56\xCB\x1E\xAE\x79\xDB\x3C\x3E\xE8\x64\x29\xF2"
+	"\xB2\xA6\x02\xAC\x86\xFE\xF6\xEC\xB6\x47\xD6\x29\x5F\xAE\x07\x7A"
+	"\x1F\xEB\x51\x75\x08\xD2\xC1\x6B\x41\x92\xE0\x1F\x62",
+	21,
+	"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F"
+	"\x10\x11\x12\x13\x14",
+	24,
+	"\x45\xEE\x79\x15\x67\xEE\xFC\xA3\x7F\x4A\xC1\xE0\x22\x2D\xE8\x0D"
+	"\x43\xC3\xBF\xA0\x66\x99\x67\x2A"
     }
 };
 
-
 static int
 krb_enc_test(krb5_context context)
 {
@@ -624,10 +776,22 @@ krb_enc_test(krb5_context context)
 	if (ret)
 	    errx(1, "krb_enc_iov2 failed with %d for test %d", ret, i);
 
-	ret = krb_checksum_iov(context, crypto, krbencs[i].usage, &plain);
+	ret = krb_checksum_iov(context, crypto, krbencs[i].usage, &plain, NULL);
 	if (ret)
 	    errx(1, "krb_checksum_iov failed with %d for test %d", ret, i);
 
+	if (krbencs[i].cdata) {
+	    krb5_data checksum;
+
+	    checksum.length = krbencs[i].clen;
+	    checksum.data = krbencs[i].cdata;
+
+	    ret = krb_checksum_iov(context, crypto, krbencs[i].usage,
+				   &plain, &checksum);
+	    if (ret)
+		errx(1, "krb_checksum_iov(2) failed with %d for test %d", ret, i);
+	}
+
 	krb5_crypto_destroy(context, crypto);
 
 	ret = krb_enc_mit(context, krbencs[i].enctype, &kb,
@@ -640,9 +804,8 @@ krb_enc_test(krb5_context context)
 }
 
 static int
-iov_test(krb5_context context)
+iov_test(krb5_context context, krb5_enctype enctype)
 {
-    krb5_enctype enctype = ENCTYPE_AES256_CTS_HMAC_SHA1_96;
     krb5_error_code ret;
     krb5_crypto crypto;
     krb5_keyblock key;
@@ -859,6 +1022,9 @@ main(int argc, char **argv)
     krb5_context context;
     int val = 0;
 
+    if (argc > 1 && strcmp(argv[1], "-v") == 0)
+        verbose = 1;
+
     ret = krb5_init_context (&context);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
@@ -867,7 +1033,9 @@ main(int argc, char **argv)
 
     val |= krb_enc_test(context);
     val |= random_to_key(context);
-    val |= iov_test(context);
+    val |= iov_test(context, KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96);
+    val |= iov_test(context, KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128);
+    val |= iov_test(context, KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192);
 
     if (verbose && val == 0)
 	printf("all ok\n");
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/an2ln_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/an2ln_plugin.h
new file mode 100644
index 000000000..26b647bdf
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/an2ln_plugin.h
@@ -0,0 +1,93 @@
+/*	$NetBSD: an2ln_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIMDAL_KRB5_AN2LN_PLUGIN_H
+#define HEIMDAL_KRB5_AN2LN_PLUGIN_H 1
+
+#define KRB5_PLUGIN_AN2LN "an2ln"
+#define KRB5_PLUGIN_AN2LN_VERSION_0 0
+
+typedef krb5_error_code (KRB5_LIB_CALL *set_result_f)(void *, const char *);
+
+/** @struct krb5plugin_an2ln_ftable_desc
+ *
+ * @brief Description of the krb5_aname_to_lname(3) plugin facility.
+ *
+ * The krb5_aname_to_lname(3) function is pluggable.  The plugin is
+ * named KRB5_PLUGIN_AN2LN ("an2ln"), with a single minor version,
+ * KRB5_PLUGIN_AN2LN_VERSION_0 (0).
+ *
+ * The plugin for krb5_aname_to_lname(3) consists of a data symbol
+ * referencing a structure of type krb5plugin_an2ln_ftable, with four
+ * fields:
+ *
+ * @param init          Plugin initialization function (see krb5-plugin(7))
+ *
+ * @param minor_version The plugin minor version number (0)
+ *
+ * @param fini          Plugin finalization function
+ *
+ * @param an2ln         Plugin aname_to_lname function
+ *
+ * The an2ln field is the plugin entry point that performs the
+ * traditional aname_to_lname operation however the plugin desires.  It
+ * is invoked in no particular order relative to other an2ln plugins,
+ * but it has a 'rule' argument that indicates which plugin is intended
+ * to act on the rule.  The plugin an2ln function must return
+ * KRB5_PLUGIN_NO_HANDLE if the rule is not applicable to it.
+ *
+ * The plugin an2ln function has the following arguments, in this order:
+ *
+ * -# plug_ctx, the context value output by the plugin's init function
+ * -# context, a krb5_context
+ * -# rule, the aname_to_lname rule being evaluated (from krb5.conf(5))
+ * -# aname, the krb5_principal to be mapped to an lname
+ * -# set_res_f, a function the plugin must call to set its result
+ * -# set_res_ctx, the first argument to set_res_f (the second is the result lname string)
+ *
+ * @ingroup krb5_support
+ */
+typedef struct krb5plugin_an2ln_ftable_desc {
+    int			minor_version;
+    krb5_error_code	(KRB5_LIB_CALL *init)(krb5_context, void **);
+    void		(KRB5_LIB_CALL *fini)(void *);
+    krb5_error_code	(KRB5_LIB_CALL *an2ln)(void *, krb5_context, const char *,
+	                         krb5_const_principal, set_result_f, void *);
+} krb5plugin_an2ln_ftable;
+
+#endif /* HEIMDAL_KRB5_AN2LN_PLUGIN_H */
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/aname_to_localname.c b/crypto/external/bsd/heimdal/dist/lib/krb5/aname_to_localname.c
index f60f633af..718b11e9d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/aname_to_localname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/aname_to_localname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: aname_to_localname.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: aname_to_localname.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999, 2002 - 2003 Kungliga Tekniska Högskolan
@@ -33,23 +33,109 @@
  * SUCH DAMAGE.
  */
 
+#include <string.h>
 #include "krb5_locl.h"
+#include "an2ln_plugin.h"
+#include "db_plugin.h"
 
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_aname_to_localname (krb5_context context,
-			 krb5_const_principal aname,
-			 size_t lnsize,
-			 char *lname)
+/* Default plugin (DB using binary search of sorted text file) follows */
+static krb5_error_code KRB5_LIB_CALL an2ln_def_plug_init(krb5_context, void **);
+static void KRB5_LIB_CALL an2ln_def_plug_fini(void *);
+static krb5_error_code KRB5_LIB_CALL an2ln_def_plug_an2ln(void *, krb5_context, const char *,
+					    krb5_const_principal, set_result_f,
+					    void *);
+
+static krb5plugin_an2ln_ftable an2ln_def_plug = {
+    0,
+    an2ln_def_plug_init,
+    an2ln_def_plug_fini,
+    an2ln_def_plug_an2ln,
+};
+
+/* Plugin engine code follows */
+struct plctx {
+    krb5_const_principal aname;
+    heim_string_t luser;
+    const char *rule;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+set_res(void *userctx, const char *res)
+{
+    struct plctx *plctx = userctx;
+    plctx->luser = heim_string_create(res);
+    if (plctx->luser == NULL)
+	return ENOMEM;
+    return 0;
+}
+
+static krb5_error_code KRB5_LIB_CALL
+plcallback(krb5_context context,
+	   const void *plug, void *plugctx, void *userctx)
+{
+    const krb5plugin_an2ln_ftable *locate = plug;
+    struct plctx *plctx = userctx;
+
+    if (plctx->luser)
+	return 0;
+    
+    return locate->an2ln(plugctx, context, plctx->rule, plctx->aname, set_res, plctx);
+}
+
+static krb5_error_code
+an2ln_plugin(krb5_context context, const char *rule, krb5_const_principal aname,
+	     size_t lnsize, char *lname)
 {
     krb5_error_code ret;
-    krb5_realm *lrealms, *r;
-    int valid;
-    size_t len;
-    const char *res;
+    struct plctx ctx;
 
-    ret = krb5_get_default_realms (context, &lrealms);
-    if (ret)
+    ctx.rule = rule;
+    ctx.aname = aname;
+    ctx.luser = NULL;
+
+    /*
+     * Order of plugin invocation is non-deterministic, but there should
+     * really be no more than one plugin that can handle any given kind
+     * rule, so the effect should be deterministic anyways.
+     */
+    ret = _krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_AN2LN,
+			     KRB5_PLUGIN_AN2LN_VERSION_0, 0, &ctx, plcallback);
+    if (ret != 0) {
+	heim_release(ctx.luser);
 	return ret;
+    }
+
+    if (ctx.luser == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    if (strlcpy(lname, heim_string_get_utf8(ctx.luser), lnsize) >= lnsize)
+	ret = KRB5_CONFIG_NOTENUFSPACE;
+
+    heim_release(ctx.luser);
+    return ret;
+}
+
+static void
+reg_def_plugins_once(void *ctx)
+{
+    krb5_context context = ctx;
+
+    krb5_plugin_register(context, PLUGIN_TYPE_DATA, KRB5_PLUGIN_AN2LN,
+                         &an2ln_def_plug);
+}
+
+static int
+princ_realm_is_default(krb5_context context,
+		       krb5_const_principal aname)
+{
+    krb5_error_code ret;
+    krb5_realm *lrealms = NULL;
+    krb5_realm *r;
+    int valid;
+
+    ret = krb5_get_default_realms(context, &lrealms);
+    if (ret)
+	return 0;
 
     valid = 0;
     for (r = lrealms; *r != NULL; ++r) {
@@ -59,13 +145,107 @@ krb5_aname_to_localname (krb5_context context,
 	}
     }
     krb5_free_host_realm (context, lrealms);
-    if (valid == 0)
+    return valid;
+}
+
+/*
+ * This function implements MIT's auth_to_local_names configuration for
+ * configuration compatibility.  Specifically:
+ *
+ * [realms]
+ *     <realm-name> = {
+ *         auth_to_local_names = {
+ *             <unparsed-principal-name> = <username>
+ *         }
+ *     }
+ *
+ * If multiple usernames are configured then the last one is taken.
+ *
+ * The configuration can only be expected to hold a relatively small
+ * number of mappings.  For lots of mappings use a DB.
+ */
+static krb5_error_code
+an2ln_local_names(krb5_context context,
+		  krb5_const_principal aname,
+		  size_t lnsize,
+		  char *lname)
+{
+    krb5_error_code ret;
+    char *unparsed;
+    char **values;
+    char *res;
+    size_t i;
+
+    if (!princ_realm_is_default(context, aname))
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    ret = krb5_unparse_name_flags(context, aname,
+				  KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+				  &unparsed);
+    if (ret)
+	return ret;
+
+    ret = KRB5_PLUGIN_NO_HANDLE;
+    values = krb5_config_get_strings(context, NULL, "realms", aname->realm,
+				     "auth_to_local_names", unparsed, NULL);
+    free(unparsed);
+    if (!values)
+	return ret;
+    /* Take the last value, just like MIT */
+    for (res = NULL, i = 0; values[i]; i++)
+	res = values[i];
+    if (res) {
+	ret = 0;
+	if (strlcpy(lname, res, lnsize) >= lnsize)
+	    ret = KRB5_CONFIG_NOTENUFSPACE;
+
+	if (!*res || strcmp(res, ":") == 0)
+	    ret = KRB5_NO_LOCALNAME;
+    }
+
+    krb5_config_free_strings(values);
+    return ret;
+}
+
+/*
+ * Heimdal's default aname2lname mapping.
+ */
+static krb5_error_code
+an2ln_default(krb5_context context,
+	      char *rule,
+	      krb5_const_principal aname,
+	      size_t lnsize, char *lname)
+{
+    krb5_error_code ret;
+    const char *res;
+    int root_princs_ok;
+
+    if (strcmp(rule, "NONE") == 0)
 	return KRB5_NO_LOCALNAME;
 
-    if (aname->name.name_string.len == 1)
+    if (strcmp(rule, "DEFAULT") == 0)
+	root_princs_ok = 0;
+    else if (strcmp(rule, "HEIMDAL_DEFAULT") == 0)
+	root_princs_ok = 1;
+    else
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    if (!princ_realm_is_default(context, aname))
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    if (aname->name.name_string.len == 1) {
+	/*
+	 * One component principal names in default realm -> the one
+	 * component is the username.
+	 */
 	res = aname->name.name_string.val[0];
-    else if (aname->name.name_string.len == 2
-	     && strcmp (aname->name.name_string.val[1], "root") == 0) {
+    } else if (root_princs_ok && aname->name.name_string.len == 2 &&
+	       strcmp (aname->name.name_string.val[1], "root") == 0) {
+	/*
+	 * Two-component principal names in default realm where the
+	 * first component is "root" -> root IFF the principal is in
+	 * root's .k5login (or whatever krb5_kuserok() does).
+	 */
 	krb5_principal rootprinc;
 	krb5_boolean userok;
 
@@ -75,18 +255,206 @@ krb5_aname_to_localname (krb5_context context,
 	if (ret)
 	    return ret;
 
-	userok = krb5_kuserok(context, rootprinc, res);
+	userok = _krb5_kuserok(context, rootprinc, res, FALSE);
 	krb5_free_principal(context, rootprinc);
 	if (!userok)
 	    return KRB5_NO_LOCALNAME;
+    } else {
+	return KRB5_PLUGIN_NO_HANDLE;
+    }
 
-    } else
-	return KRB5_NO_LOCALNAME;
-
-    len = strlen (res);
-    if (len >= lnsize)
-	return ERANGE;
-    strlcpy (lname, res, lnsize);
+    if (strlcpy(lname, res, lnsize) >= lnsize)
+	return KRB5_CONFIG_NOTENUFSPACE;
 
     return 0;
 }
+
+/**
+ * Map a principal name to a local username.
+ *
+ * Returns 0 on success, KRB5_NO_LOCALNAME if no mapping was found, or
+ * some Kerberos or system error.
+ *
+ * Inputs:
+ *
+ * @param context    A krb5_context
+ * @param aname      A principal name
+ * @param lnsize     The size of the buffer into which the username will be written
+ * @param lname      The buffer into which the username will be written
+ *
+ * @ingroup krb5_support
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_aname_to_localname(krb5_context context,
+			krb5_const_principal aname,
+			size_t lnsize,
+			char *lname)
+{
+    static heim_base_once_t reg_def_plugins = HEIM_BASE_ONCE_INIT;
+    krb5_error_code ret;
+    krb5_realm realm;
+    size_t i;
+    char **rules = NULL;
+    char *rule;
+
+    if (lnsize)
+	lname[0] = '\0';
+
+    heim_base_once_f(&reg_def_plugins, context, reg_def_plugins_once);
+
+    /* Try MIT's auth_to_local_names config first */
+    ret = an2ln_local_names(context, aname, lnsize, lname);
+    if (ret != KRB5_PLUGIN_NO_HANDLE)
+	return ret;
+
+    ret = krb5_get_default_realm(context, &realm);
+    if (ret)
+	return ret;
+
+    rules = krb5_config_get_strings(context, NULL, "realms", realm,
+				    "auth_to_local", NULL);
+    krb5_xfree(realm);
+    if (!rules) {
+	/* Heimdal's default rule */
+	ret = an2ln_default(context, "HEIMDAL_DEFAULT", aname, lnsize, lname);
+	if (ret == KRB5_PLUGIN_NO_HANDLE)
+	    return KRB5_NO_LOCALNAME;
+	return ret;
+    }
+
+    /*
+     * MIT rules.
+     *
+     * Note that RULEs and DBs only have white-list functionality,
+     * thus RULEs and DBs that we don't understand we simply ignore.
+     *
+     * This means that plugins that implement black-lists are
+     * dangerous: if a black-list plugin isn't found, the black-list
+     * won't be enforced.  But black-lists are dangerous anyways.
+     */
+    for (ret = KRB5_PLUGIN_NO_HANDLE, i = 0; rules[i]; i++) {
+	rule = rules[i];
+
+	/* Try NONE, DEFAULT, and HEIMDAL_DEFAULT rules */
+	ret = an2ln_default(context, rule, aname, lnsize, lname);
+	if (ret == KRB5_PLUGIN_NO_HANDLE)
+	    /* Try DB, RULE, ... plugins */
+	    ret = an2ln_plugin(context, rule, aname, lnsize, lname);
+
+	if (ret == 0 && lnsize && !lname[0])
+	    continue; /* Success but no lname?!  lies! */
+	else if (ret != KRB5_PLUGIN_NO_HANDLE)
+	    break;
+    }
+
+    if (ret == KRB5_PLUGIN_NO_HANDLE) {
+	if (lnsize)
+	    lname[0] = '\0';
+	ret = KRB5_NO_LOCALNAME;
+    }
+
+    krb5_config_free_strings(rules);
+    return ret;
+}
+
+static krb5_error_code KRB5_LIB_CALL
+an2ln_def_plug_init(krb5_context context, void **ctx)
+{
+    *ctx = NULL;
+    return 0;
+}
+
+static void KRB5_LIB_CALL
+an2ln_def_plug_fini(void *ctx)
+{
+}
+
+static heim_base_once_t sorted_text_db_init_once = HEIM_BASE_ONCE_INIT;
+
+static void
+sorted_text_db_init_f(void *arg)
+{
+    (void) heim_db_register("sorted-text", NULL, &heim_sorted_text_file_dbtype);
+}
+
+static krb5_error_code KRB5_LIB_CALL
+an2ln_def_plug_an2ln(void *plug_ctx, krb5_context context,
+		     const char *rule,
+		     krb5_const_principal aname,
+		     set_result_f set_res_f, void *set_res_ctx)
+{
+    krb5_error_code ret;
+    const char *an2ln_db_fname;
+    heim_db_t dbh = NULL;
+    heim_dict_t db_options;
+    heim_data_t k, v;
+    heim_error_t error;
+    char *unparsed = NULL;
+    char *value = NULL;
+
+    _krb5_load_db_plugins(context);
+    heim_base_once_f(&sorted_text_db_init_once, NULL, sorted_text_db_init_f);
+
+    if (strncmp(rule, "DB:", strlen("DB:")) != 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    an2ln_db_fname = &rule[strlen("DB:")];
+    if (!*an2ln_db_fname)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    ret = krb5_unparse_name(context, aname, &unparsed);
+    if (ret)
+	return ret;
+
+    db_options = heim_dict_create(11);
+    if (db_options != NULL)
+	heim_dict_set_value(db_options, HSTR("read-only"),
+			    heim_number_create(1));
+    dbh = heim_db_create(NULL, an2ln_db_fname, db_options, &error);
+    if (dbh == NULL) {
+	krb5_set_error_message(context, heim_error_get_code(error),
+			       N_("Couldn't open aname2lname-text-db", ""));
+	ret = KRB5_PLUGIN_NO_HANDLE;
+	goto cleanup;
+    }
+
+    /* Binary search; file should be sorted (in C locale) */
+    k = heim_data_ref_create(unparsed, strlen(unparsed), NULL);
+    if (k == NULL) {
+	ret = krb5_enomem(context);
+        goto cleanup;
+    }
+    v = heim_db_copy_value(dbh, NULL, k, &error);
+    heim_release(k);
+    if (v == NULL && error != NULL) {
+	krb5_set_error_message(context, heim_error_get_code(error),
+			       N_("Lookup in aname2lname-text-db failed", ""));
+	ret = heim_error_get_code(error);
+	goto cleanup;
+    } else if (v == NULL) {
+	ret = KRB5_PLUGIN_NO_HANDLE;
+	goto cleanup;
+    } else {
+	/* found */
+	if (heim_data_get_length(v) == 0) {
+	    krb5_set_error_message(context, ret,
+				   N_("Principal mapped to empty username", ""));
+	    ret = KRB5_NO_LOCALNAME;
+	    goto cleanup;
+	}
+        value = strndup(heim_data_get_ptr(v), heim_data_get_length(v));
+	heim_release(v);
+        if (value == NULL) {
+            ret = krb5_enomem(context);
+            goto cleanup;
+        }
+	ret = set_res_f(set_res_ctx, value);
+    }
+
+cleanup:
+    heim_release(dbh);
+    free(unparsed);
+    free(value);
+    return ret;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/appdefault.c b/crypto/external/bsd/heimdal/dist/lib/krb5/appdefault.c
index 45aace709..75c767388 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/appdefault.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/appdefault.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: appdefault.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: appdefault.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/asn1_glue.c b/crypto/external/bsd/heimdal/dist/lib/krb5/asn1_glue.c
index a1f465bfc..ad3304645 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/asn1_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/asn1_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: asn1_glue.c,v 1.1.1.1 2011/04/13 18:15:31 elric Exp $	*/
+/*	$NetBSD: asn1_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -55,9 +55,9 @@ _krb5_principalname2krb5_principal (krb5_context context,
     krb5_error_code ret;
     krb5_principal p;
 
-    p = malloc(sizeof(*p));
+    p = calloc(1, sizeof(*p));
     if (p == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     ret = copy_PrincipalName(&from, &p->name);
     if (ret) {
 	free(p);
@@ -67,7 +67,7 @@ _krb5_principalname2krb5_principal (krb5_context context,
     if (p->realm == NULL) {
 	free_PrincipalName(&p->name);
         free(p);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     *principal = p;
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/auth_context.c b/crypto/external/bsd/heimdal/dist/lib/krb5/auth_context.c
index 37e7514a5..8c73daa46 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/auth_context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/auth_context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: auth_context.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: auth_context.c,v 1.4 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -35,6 +35,16 @@
 
 #include "krb5_locl.h"
 
+/**
+ * Allocate and initialize an autentication context.
+ *
+ * @param context      A kerberos context.
+ * @param auth_context The authentication context to be initialized.
+ *
+ * Use krb5_auth_con_free() to release the memory when done using the context.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_init(krb5_context context,
 		   krb5_auth_context *auth_context)
@@ -42,16 +52,13 @@ krb5_auth_con_init(krb5_context context,
     krb5_auth_context p;
 
     ALLOC(p, 1);
-    if(!p) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (!p)
+	return krb5_enomem(context);
     memset(p, 0, sizeof(*p));
     ALLOC(p->authenticator, 1);
     if (!p->authenticator) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(p);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     memset (p->authenticator, 0, sizeof(*p->authenticator));
     p->flags = KRB5_AUTH_CONTEXT_DO_TIME;
@@ -60,12 +67,22 @@ krb5_auth_con_init(krb5_context context,
     p->remote_address = NULL;
     p->local_port     = 0;
     p->remote_port    = 0;
-    p->keytype        = ENCTYPE_NULL;
+    p->keytype        = KRB5_ENCTYPE_NULL;
     p->cksumtype      = CKSUMTYPE_NONE;
+    p->auth_data      = NULL;
     *auth_context     = p;
     return 0;
 }
 
+/**
+ * Deallocate an authentication context previously initialized with
+ * krb5_auth_con_init().
+ *
+ * @param context      A kerberos context.
+ * @param auth_context The authentication context to be deallocated.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_free(krb5_context context,
 		   krb5_auth_context auth_context)
@@ -83,6 +100,10 @@ krb5_auth_con_free(krb5_context context,
 	krb5_free_keyblock(context, auth_context->keyblock);
 	krb5_free_keyblock(context, auth_context->remote_subkey);
 	krb5_free_keyblock(context, auth_context->local_subkey);
+	if (auth_context->auth_data) {
+	    free_AuthorizationData(auth_context->auth_data);
+	    free(auth_context->auth_data);
+	}
 	free (auth_context);
     }
     return 0;
@@ -142,7 +163,7 @@ krb5_auth_con_setaddrs(krb5_context context,
 	    krb5_free_address (context, auth_context->local_address);
 	else
 	    if ((auth_context->local_address = malloc(sizeof(krb5_address))) == NULL)
-		return ENOMEM;
+		return krb5_enomem(context);
 	krb5_copy_address(context, local_addr, auth_context->local_address);
     }
     if (remote_addr) {
@@ -150,12 +171,18 @@ krb5_auth_con_setaddrs(krb5_context context,
 	    krb5_free_address (context, auth_context->remote_address);
 	else
 	    if ((auth_context->remote_address = malloc(sizeof(krb5_address))) == NULL)
-		return ENOMEM;
+		return krb5_enomem(context);
 	krb5_copy_address(context, remote_addr, auth_context->remote_address);
     }
     return 0;
 }
 
+/**
+ * Update the authentication context \a auth_context with the local
+ * and remote addresses from socket \a fd, according to \a flags.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_genaddrs(krb5_context context,
 		       krb5_auth_context auth_context,
@@ -241,10 +268,8 @@ krb5_auth_con_getaddrs(krb5_context context,
     if(*local_addr)
 	krb5_free_address (context, *local_addr);
     *local_addr = malloc (sizeof(**local_addr));
-    if (*local_addr == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*local_addr == NULL)
+	return krb5_enomem(context);
     krb5_copy_address(context,
 		      auth_context->local_address,
 		      *local_addr);
@@ -253,10 +278,9 @@ krb5_auth_con_getaddrs(krb5_context context,
 	krb5_free_address (context, *remote_addr);
     *remote_addr = malloc (sizeof(**remote_addr));
     if (*remote_addr == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	krb5_free_address (context, *local_addr);
 	*local_addr = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     krb5_copy_address(context,
 		      auth_context->remote_address,
@@ -270,9 +294,9 @@ copy_key(krb5_context context,
 	 krb5_keyblock *in,
 	 krb5_keyblock **out)
 {
-    if(in)
+    *out = NULL;
+    if (in)
 	return krb5_copy_keyblock(context, in, out);
-    *out = NULL; /* is this right? */
     return 0;
 }
 
@@ -387,6 +411,28 @@ krb5_auth_con_getkeytype (krb5_context context,
     return 0;
 }
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_auth_con_add_AuthorizationData(krb5_context context,
+				    krb5_auth_context auth_context,
+				    int type,
+				    krb5_data *data)
+{
+    AuthorizationDataElement el;
+
+    if (auth_context->auth_data == NULL) {
+	auth_context->auth_data = calloc(1, sizeof(*auth_context->auth_data));
+	if (auth_context->auth_data == NULL)
+	    return krb5_enomem(context);
+    }
+    el.ad_type = type;
+    el.ad_data.data = data->data;
+    el.ad_data.length = data->length;
+
+    return add_AuthorizationData(auth_context->auth_data, &el);
+}
+
+
+
 #if 0
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_setenctype(krb5_context context,
@@ -397,7 +443,7 @@ krb5_auth_con_setenctype(krb5_context context,
 	krb5_free_keyblock(context, auth_context->keyblock);
     ALLOC(auth_context->keyblock, 1);
     if(auth_context->keyblock == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     auth_context->keyblock->keytype = etype;
     return 0;
 }
@@ -454,10 +500,8 @@ krb5_auth_con_getauthenticator(krb5_context context,
 			   krb5_authenticator *authenticator)
 {
     *authenticator = malloc(sizeof(**authenticator));
-    if (*authenticator == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*authenticator == NULL)
+	return krb5_enomem(context);
 
     copy_Authenticator(auth_context->authenticator,
 		       *authenticator);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/build_ap_req.c b/crypto/external/bsd/heimdal/dist/lib/krb5/build_ap_req.c
index 80389c9a6..859a63ea4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/build_ap_req.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/build_ap_req.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: build_ap_req.c,v 1.1.1.1 2011/04/13 18:15:31 elric Exp $	*/
+/*	$NetBSD: build_ap_req.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/build_auth.c b/crypto/external/bsd/heimdal/dist/lib/krb5/build_auth.c
index 78fc20535..652596f05 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/build_auth.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/build_auth.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: build_auth.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: build_auth.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -64,8 +64,7 @@ make_etypelist(krb5_context context,
     ALLOC_SEQ(&ad, 1);
     if (ad.val == NULL) {
 	free(buf);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ad.val[0].ad_type = KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION;
@@ -84,16 +83,14 @@ make_etypelist(krb5_context context,
     ALLOC(*auth_data, 1);
     if (*auth_data == NULL) {
         free(buf);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ALLOC_SEQ(*auth_data, 1);
     if ((*auth_data)->val == NULL) {
         free(*auth_data);
 	free(buf);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     (*auth_data)->val[0].ad_type = KRB5_AUTHDATA_IF_RELEVANT;
@@ -138,7 +135,7 @@ _krb5_build_authenticator (krb5_context context,
 				      &auth_context->local_seqnumber);
 	ALLOC(auth.seq_number, 1);
 	if(auth.seq_number == NULL) {
-	    ret = ENOMEM;
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	*auth.seq_number = auth_context->local_seqnumber;
@@ -149,7 +146,7 @@ _krb5_build_authenticator (krb5_context context,
     if (cksum) {
 	ALLOC(auth.cksum, 1);
 	if (auth.cksum == NULL) {
-	    ret = ENOMEM;
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	ret = copy_Checksum(cksum, auth.cksum);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/cache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/cache.c
index 9a3f9a00e..61bd403d3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/cache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/cache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cache.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: cache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -157,15 +157,15 @@ krb5_cc_register(krb5_context context,
  * `ops'. Returns 0 or and error code.
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_cc_allocate(krb5_context context,
 		  const krb5_cc_ops *ops,
 		  krb5_ccache *id)
 {
     krb5_ccache p;
 
-    p = malloc (sizeof(*p));
-    if(p == NULL) {
+    p = calloc(1, sizeof(*p));
+    if (p == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOMEM,
 			       N_("malloc: out of memory", ""));
 	return KRB5_CC_NOMEM;
@@ -190,8 +190,13 @@ allocate_ccache (krb5_context context,
     krb5_error_code ret;
 #ifdef KRB5_USE_PATH_TOKENS
     char * exp_residual = NULL;
+    int filepath;
 
-    ret = _krb5_expand_path_tokens(context, residual, &exp_residual);
+    filepath = (strcmp("FILE", ops->prefix) == 0
+		 || strcmp("DIR", ops->prefix) == 0
+		 || strcmp("SCC", ops->prefix) == 0);
+
+    ret = _krb5_expand_path_tokens(context, residual, filepath, &exp_residual);
     if (ret)
 	return ret;
 
@@ -385,9 +390,8 @@ krb5_cc_get_full_name(krb5_context context,
     }
 
     if (asprintf(str, "%s:%s", type, name) == -1) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	*str = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -409,10 +413,16 @@ krb5_cc_get_ops(krb5_context context, krb5_ccache id)
  * Expand variables in `str' into `res'
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
 {
-    return _krb5_expand_path_tokens(context, str, res);
+    int filepath;
+
+    filepath = (strncmp("FILE:", str, 5) == 0
+		 || strncmp("DIR:", str, 4) == 0
+		 || strncmp("SCC:", str, 4) == 0);
+
+    return _krb5_expand_path_tokens(context, str, filepath, res);
 }
 
 /*
@@ -504,11 +514,13 @@ krb5_cc_set_default_name(krb5_context context, const char *name)
 {
     krb5_error_code ret = 0;
     char *p = NULL, *exp_p = NULL;
+    int filepath;
+    const krb5_cc_ops *ops = KRB5_DEFAULT_CCTYPE;
 
     if (name == NULL) {
 	const char *e = NULL;
 
-	if(!issuid()) {
+	if (!issuid()) {
 	    e = getenv("KRB5CCNAME");
 	    if (e) {
 		p = strdup(e);
@@ -519,11 +531,11 @@ krb5_cc_set_default_name(krb5_context context, const char *name)
 	}
 
 #ifdef _WIN32
-        if (e == NULL) {
-            e = p = _krb5_get_default_cc_name_from_registry(context);
+	if (p == NULL) {
+	    p = _krb5_get_default_cc_name_from_registry(context);
         }
 #endif
-	if (e == NULL) {
+	if (p == NULL) {
 	    e = krb5_config_get_string(context, NULL, "libdefaults",
 				       "default_cc_name", NULL);
 	    if (e) {
@@ -531,45 +543,78 @@ krb5_cc_set_default_name(krb5_context context, const char *name)
 		if (ret)
 		    return ret;
 	    }
-	    if (e == NULL) {
-		const krb5_cc_ops *ops = KRB5_DEFAULT_CCTYPE;
-		e = krb5_config_get_string(context, NULL, "libdefaults",
-					   "default_cc_type", NULL);
-		if (e) {
-		    ops = krb5_cc_get_prefix_ops(context, e);
-		    if (ops == NULL) {
-			krb5_set_error_message(context,
-					       KRB5_CC_UNKNOWN_TYPE,
-					       "Credential cache type %s "
-					      "is unknown", e);
-			return KRB5_CC_UNKNOWN_TYPE;
-		    }
+	}
+	if (p == NULL) {
+	    e = krb5_config_get_string(context, NULL, "libdefaults",
+				       "default_cc_type", NULL);
+	    if (e) {
+		ops = krb5_cc_get_prefix_ops(context, e);
+		if (ops == NULL) {
+		    krb5_set_error_message(context,
+					   KRB5_CC_UNKNOWN_TYPE,
+					   "Credential cache type %s "
+					   "is unknown", e);
+		    return KRB5_CC_UNKNOWN_TYPE;
 		}
-		ret = (*ops->get_default_name)(context, &p);
-		if (ret)
-		    return ret;
 	    }
 	}
+#ifdef _WIN32
+	if (p == NULL) {
+	    /*
+	     * If the MSLSA ccache type has a principal name,
+	     * use it as the default.
+	     */
+	    krb5_ccache id;
+	    ret = krb5_cc_resolve(context, "MSLSA:", &id);
+	    if (ret == 0) {
+		krb5_principal princ;
+		ret = krb5_cc_get_principal(context, id, &princ);
+		if (ret == 0) {
+		    krb5_free_principal(context, princ);
+		    p = strdup("MSLSA:");
+		}
+		krb5_cc_close(context, id);
+	    }
+	}
+	if (p == NULL) {
+	    /*
+	     * If the API:krb5cc ccache can be resolved,
+	     * use it as the default.
+	     */
+	    krb5_ccache api_id;
+	    ret = krb5_cc_resolve(context, "API:krb5cc", &api_id);
+	    if (ret == 0)
+		krb5_cc_close(context, api_id);
+	}
+	/* Otherwise, fallback to the FILE ccache */
+#endif
+	if (p == NULL) {
+	    ret = (*ops->get_default_name)(context, &p);
+	    if (ret)
+		return ret;
+	}
 	context->default_cc_name_set = 0;
     } else {
 	p = strdup(name);
+	if (p == NULL)
+	    return krb5_enomem(context);
 	context->default_cc_name_set = 1;
     }
 
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    filepath = (strncmp("FILE:", p, 5) == 0
+		 || strncmp("DIR:", p, 4) == 0
+		 || strncmp("SCC:", p, 4) == 0);
 
-    ret = _krb5_expand_path_tokens(context, p, &exp_p);
+    ret = _krb5_expand_path_tokens(context, p, filepath, &exp_p);
     free(p);
+    p = exp_p;
     if (ret)
 	return ret;
 
     if (context->default_cc_name)
 	free(context->default_cc_name);
 
-    context->default_cc_name = exp_p;
+    context->default_cc_name = p;
 
     return 0;
 }
@@ -608,10 +653,8 @@ krb5_cc_default(krb5_context context,
 {
     const char *p = krb5_cc_default_name(context);
 
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (p == NULL)
+	return krb5_enomem(context);
     return krb5_cc_resolve(context, p, id);
 }
 
@@ -629,7 +672,12 @@ krb5_cc_initialize(krb5_context context,
 		   krb5_ccache id,
 		   krb5_principal primary_principal)
 {
-    return (*id->ops->init)(context, id, primary_principal);
+    krb5_error_code ret;
+
+    ret = (*id->ops->init)(context, id, primary_principal);
+    if (ret == 0)
+        id->initialized = 1;
+    return ret;
 }
 
 
@@ -686,7 +734,35 @@ krb5_cc_store_cred(krb5_context context,
 		   krb5_ccache id,
 		   krb5_creds *creds)
 {
-    return (*id->ops->store)(context, id, creds);
+    krb5_error_code ret;
+    krb5_data realm;
+
+    ret = (*id->ops->store)(context, id, creds);
+
+    /* Look for and mark the first root TGT's realm as the start realm */
+    if (ret == 0 && id->initialized &&
+        krb5_principal_is_root_krbtgt(context, creds->server)) {
+
+        id->initialized = 0;
+        realm.length = strlen(creds->server->realm);
+        realm.data = creds->server->realm;
+        (void) krb5_cc_set_config(context, id, NULL, "start_realm", &realm);
+    } else if (ret == 0 && id->initialized &&
+        krb5_is_config_principal(context, creds->server) &&
+        strcmp(creds->server->name.name_string.val[1], "start_realm") == 0) {
+
+        /*
+         * But if the caller is storing a start_realm ccconfig, then
+         * stop looking for root TGTs to mark as the start_realm.
+         *
+         * By honoring any start_realm cc config stored, we interop
+         * both, with ccache implementations that don't preserve
+         * insertion order, and Kerberos implementations that store this
+         * cc config before the TGT.
+         */
+        id->initialized = 0;
+    }
+    return ret;
 }
 
 /**
@@ -905,7 +981,7 @@ krb5_cc_copy_match_f(krb5_context context,
     }
 
     while ((ret = krb5_cc_next_cred(context, from, &cursor, &cred)) == 0) {
-	   if (match == NULL || (*match)(context, matchctx, &cred) == 0) {
+	   if (match == NULL || (*match)(context, matchctx, &cred)) {
 	       if (matched)
 		   (*matched)++;
 	       ret = krb5_cc_store_cred(context, to, &cred);
@@ -986,12 +1062,20 @@ krb5_cc_get_prefix_ops(krb5_context context, const char *prefix)
 
     if (prefix == NULL)
 	return KRB5_DEFAULT_CCTYPE;
-    if (prefix[0] == '/')
+
+    /* Is absolute path? Or UNC path? */
+    if (ISPATHSEP(prefix[0]))
 	return &krb5_fcc_ops;
 
+#ifdef _WIN32
+    /* Is drive letter? */
+    if (isalpha(prefix[0]) && prefix[1] == ':')
+	return &krb5_fcc_ops;
+#endif
+
     p = strdup(prefix);
     if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
+	krb5_enomem(context);
 	return NULL;
     }
     p1 = strchr(p, ':');
@@ -1055,10 +1139,8 @@ krb5_cc_cache_get_first (krb5_context context,
     }
 
     *cursor = calloc(1, sizeof(**cursor));
-    if (*cursor == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*cursor == NULL)
+	return krb5_enomem(context);
 
     (*cursor)->ops = ops;
 
@@ -1136,6 +1218,7 @@ krb5_cc_cache_match (krb5_context context,
     krb5_cccol_cursor cursor;
     krb5_error_code ret;
     krb5_ccache cache = NULL;
+    krb5_ccache expired_match = NULL;
 
     *id = NULL;
 
@@ -1143,26 +1226,46 @@ krb5_cc_cache_match (krb5_context context,
     if (ret)
 	return ret;
 
-    while (krb5_cccol_cursor_next (context, cursor, &cache) == 0 && cache != NULL) {
+    while (krb5_cccol_cursor_next(context, cursor, &cache) == 0 && cache != NULL) {
 	krb5_principal principal;
+	krb5_boolean match;
+	time_t lifetime;
 
 	ret = krb5_cc_get_principal(context, cache, &principal);
-	if (ret == 0) {
-	    krb5_boolean match;
+	if (ret)
+	    goto next;
 
+	if (client->name.name_string.len == 0)
+	    match = (strcmp(client->realm, principal->realm) == 0);
+	else
 	    match = krb5_principal_compare(context, principal, client);
-	    krb5_free_principal(context, principal);
-	    if (match)
-		break;
-	}
+	krb5_free_principal(context, principal);
 
-	krb5_cc_close(context, cache);
+	if (!match)
+	    goto next;
+
+	if (expired_match == NULL &&
+	    (krb5_cc_get_lifetime(context, cache, &lifetime) != 0 || lifetime == 0)) {
+	    expired_match = cache;
+	    cache = NULL;
+	    goto next;
+	}
+	break;
+
+    next:
+        if (cache)
+	    krb5_cc_close(context, cache);
 	cache = NULL;
     }
 
     krb5_cccol_cursor_free(context, &cursor);
 
-    if (cache == NULL) {
+    if (cache == NULL && expired_match) {
+	cache = expired_match;
+	expired_match = NULL;
+    } else if (expired_match) {
+	krb5_cc_close(context, expired_match);
+    } else if (cache == NULL) {
 	char *str;
 
 	krb5_unparse_name(context, client, &str);
@@ -1175,6 +1278,7 @@ krb5_cc_cache_match (krb5_context context,
 	    free(str);
 	return KRB5_CC_NOTFOUND;
     }
+
     *id = cache;
 
     return 0;
@@ -1390,10 +1494,8 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cccol_cursor_new(krb5_context context, krb5_cccol_cursor *cursor)
 {
     *cursor = calloc(1, sizeof(**cursor));
-    if (*cursor == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*cursor == NULL)
+	return krb5_enomem(context);
     (*cursor)->idx = 0;
     (*cursor)->cursor = NULL;
 
@@ -1579,10 +1681,9 @@ krb5_cc_get_friendly_name(krb5_context context,
     } else {
 	ret = asprintf(name, "%.*s", (int)data.length, (char *)data.data);
 	krb5_data_free(&data);
-	if (ret <= 0) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
-	} else
+	if (ret <= 0)
+	    ret = krb5_enomem(context);
+	else
 	    ret = 0;
     }
 
@@ -1628,27 +1729,72 @@ krb5_cc_set_friendly_name(krb5_context context,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t *t)
 {
+    krb5_data config_start_realm;
+    char *start_realm;
     krb5_cc_cursor cursor;
     krb5_error_code ret;
     krb5_creds cred;
-    time_t now;
+    time_t now, endtime = 0;
 
     *t = 0;
-    now = time(NULL);
+    krb5_timeofday(context, &now);
+
+    ret = krb5_cc_get_config(context, id, NULL, "start_realm", &config_start_realm);
+    if (ret == 0) {
+	start_realm = strndup(config_start_realm.data, config_start_realm.length);
+	krb5_data_free(&config_start_realm);
+    } else {
+	krb5_principal client;
+
+	ret = krb5_cc_get_principal(context, id, &client);
+	if (ret)
+	    return ret;
+	start_realm = strdup(krb5_principal_get_realm(context, client));
+	krb5_free_principal(context, client);
+    }
+    if (start_realm == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_cc_start_seq_get(context, id, &cursor);
-    if (ret)
+    if (ret) {
+        free(start_realm);
 	return ret;
+    }
 
     while ((ret = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
-	if (cred.flags.b.initial) {
+	/**
+	 * If we find the start krbtgt in the cache, use that as the lifespan.
+	 */
+	if (krb5_principal_is_root_krbtgt(context, cred.server) &&
+	    strcmp(cred.server->realm, start_realm) == 0) {
 	    if (now < cred.times.endtime)
-		*t = cred.times.endtime - now;
+		endtime = cred.times.endtime;
 	    krb5_free_cred_contents(context, &cred);
 	    break;
 	}
+	/*
+	 * Skip config entries
+	 */
+	if (krb5_is_config_principal(context, cred.server)) {
+	    krb5_free_cred_contents(context, &cred);
+	    continue;
+	}
+	/**
+	 * If there was no krbtgt, use the shortest lifetime of
+	 * service tickets that have yet to expire.  If all
+	 * credentials are expired, krb5_cc_get_lifetime() will fail.
+	 */
+	if ((endtime == 0 || cred.times.endtime < endtime) && now < cred.times.endtime)
+	    endtime = cred.times.endtime;
 	krb5_free_cred_contents(context, &cred);
     }
+    free(start_realm);
+
+    /* if we found an endtime use that */
+    if (endtime) {
+	*t = endtime - now;
+	ret = 0;
+    }
 
     krb5_cc_end_seq_get(context, id, &cursor);
 
@@ -1704,18 +1850,17 @@ krb5_cc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *offset
     return (*id->ops->get_kdc_offset)(context, id, offset);
 }
 
-
 #ifdef _WIN32
-
 #define REGPATH_MIT_KRB5 "SOFTWARE\\MIT\\Kerberos5"
-char *
-_krb5_get_default_cc_name_from_registry(krb5_context context)
+
+static char *
+_get_default_cc_name_from_registry(krb5_context context, HKEY hkBase)
 {
     HKEY hk_k5 = 0;
     LONG code;
-    char * ccname = NULL;
+    char *ccname = NULL;
 
-    code = RegOpenKeyEx(HKEY_CURRENT_USER,
+    code = RegOpenKeyEx(hkBase,
                         REGPATH_MIT_KRB5,
                         0, KEY_READ, &hk_k5);
 
@@ -1730,7 +1875,20 @@ _krb5_get_default_cc_name_from_registry(krb5_context context)
     return ccname;
 }
 
-int
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
+_krb5_get_default_cc_name_from_registry(krb5_context context)
+{
+    char *ccname;
+
+    ccname = _get_default_cc_name_from_registry(context, HKEY_CURRENT_USER);
+    if (ccname == NULL)
+	ccname = _get_default_cc_name_from_registry(context,
+						    HKEY_LOCAL_MACHINE);
+
+    return ccname;
+}
+
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_set_default_cc_name_to_registry(krb5_context context, krb5_ccache id)
 {
     HKEY hk_k5 = 0;
@@ -1761,5 +1919,4 @@ _krb5_set_default_cc_name_to_registry(krb5_context context, krb5_ccache id)
 
     return ret;
 }
-
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/ccache_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/ccache_plugin.h
index 007b95807..d52116667 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/ccache_plugin.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/ccache_plugin.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ccache_plugin.h,v 1.1.1.1 2011/04/13 18:15:31 elric Exp $	*/
+/*	$NetBSD: ccache_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2010, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/changepw.c b/crypto/external/bsd/heimdal/dist/lib/krb5/changepw.c
index bfb284b4c..6feee5f61 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/changepw.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/changepw.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: changepw.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: changepw.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -42,7 +42,7 @@
 static void
 str2data (krb5_data *d,
 	  const char *fmt,
-	  ...) __attribute__ ((format (printf, 2, 3)));
+	  ...) __attribute__ ((__format__ (__printf__, 2, 3)));
 
 static void
 str2data (krb5_data *d,
@@ -304,6 +304,10 @@ process_reply (krb5_context context,
 	    _krb5_get_int(reply, &size, 4);
 	    if (size + 4 < len)
 		continue;
+	    if (sizeof(reply) - 4 < size) {
+		krb5_set_error_message(context, ERANGE, "size from server too large %s", host);
+		return ERANGE;
+	    }
 	    memmove(reply, reply + 4, size);
 	    len = size;
 	    break;
@@ -328,7 +332,7 @@ process_reply (krb5_context context,
 
     if (len < 6) {
 	str2data (result_string, "server %s sent to too short message "
-		  "(%zu bytes)", host, len);
+		  "(%llu bytes)", host, (unsigned long long)len);
 	*result_code = KRB5_KPASSWD_MALFORMED;
 	return 0;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/codec.c b/crypto/external/bsd/heimdal/dist/lib/krb5/codec.c
index d2aaef50d..d90ec6038 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/codec.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/codec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: codec.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: codec.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/config_file.c b/crypto/external/bsd/heimdal/dist/lib/krb5/config_file.c
index 359cbcac7..4de665f53 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/config_file.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/config_file.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: config_file.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: config_file.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -84,7 +84,7 @@ static krb5_error_code parse_list(struct fileptr *f, unsigned *lineno,
 				  krb5_config_binding **parent,
 				  const char **err_message);
 
-krb5_config_section *
+KRB5_LIB_FUNCTION krb5_config_section * KRB5_LIB_CALL
 _krb5_config_get_entry(krb5_config_section **parent, const char *name, int type)
 {
     krb5_config_section **q;
@@ -372,11 +372,11 @@ krb5_config_parse_debug (struct fileptr *f,
 	    b = NULL;
 	} else if (*p == '}') {
 	    *err_message = "unmatched }";
-	    return EINVAL;	/* XXX */
+	    return KRB5_CONFIG_BADFORMAT;
 	} else if(*p != '\0') {
 	    if (s == NULL) {
 		*err_message = "binding before section";
-		return EINVAL;
+		return KRB5_CONFIG_BADFORMAT;
 	    }
 	    ret = parse_binding(f, lineno, p, &b, &s->u.list, err_message);
 	    if (ret)
@@ -427,7 +427,7 @@ krb5_config_parse_file_multi (krb5_context context,
      * current users home directory. The behavior can be disabled and
      * enabled by calling krb5_set_home_dir_access().
      */
-    if (fname[0] == '~' && fname[1] == '/') {
+    if (ISTILDE(fname[0]) && ISPATHSEP(fname[1])) {
 #ifndef KRB5_USE_PATH_TOKENS
 	const char *home = NULL;
 
@@ -441,27 +441,24 @@ krb5_config_parse_file_multi (krb5_context context,
 	    home = getenv("HOME");
 
 	if (home == NULL) {
-	    struct passwd *pw = getpwuid(getuid());
-	    if(pw != NULL)
-		home = pw->pw_dir;
+	    struct passwd pw, *pwd = NULL;
+	    char pwbuf[2048];
+
+	    if (rk_getpwuid_r(getuid(), &pw, pwbuf, sizeof(pwbuf), &pwd) == 0)
+		home = pwd->pw_dir;
 	}
 	if (home) {
-	    asprintf(&newfname, "%s%s", home, &fname[1]);
-	    if (newfname == NULL) {
-		krb5_set_error_message(context, ENOMEM,
-				       N_("malloc: out of memory", ""));
-		return ENOMEM;
-	    }
+	    int aret;
+
+	    aret = asprintf(&newfname, "%s%s", home, &fname[1]);
+	    if (aret == -1 || newfname == NULL)
+		return krb5_enomem(context);
 	    fname = newfname;
 	}
 #else  /* KRB5_USE_PATH_TOKENS */
 	if (asprintf(&newfname, "%%{USERCONFIG}%s", &fname[1]) < 0 ||
 	    newfname == NULL)
-	{
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	    return krb5_enomem(context);
 	fname = newfname;
 #endif
     }
@@ -485,7 +482,7 @@ krb5_config_parse_file_multi (krb5_context context,
 #ifdef KRB5_USE_PATH_TOKENS
 	char * exp_fname = NULL;
 
-	ret = _krb5_expand_path_tokens(context, fname, &exp_fname);
+	ret = _krb5_expand_path_tokens(context, fname, 1, &exp_fname);
 	if (ret) {
 	    if (newfname)
 		free(newfname);
@@ -699,7 +696,7 @@ _krb5_config_get (krb5_context context,
 }
 
 
-const void *
+KRB5_LIB_FUNCTION const void * KRB5_LIB_CALL
 _krb5_config_vget (krb5_context context,
 		   const krb5_config_section *c,
 		   int type,
@@ -941,13 +938,17 @@ krb5_config_vget_strings(krb5_context context,
 	s = next_component_string(tmp, " \t", &pos);
 	while(s){
 	    char **tmp2 = realloc(strings, (nstr + 1) * sizeof(*strings));
-	    if(tmp2 == NULL)
+	    if(tmp2 == NULL) {
+		free(tmp);
 		goto cleanup;
+	    }
 	    strings = tmp2;
 	    strings[nstr] = strdup(s);
 	    nstr++;
-	    if(strings[nstr-1] == NULL)
+	    if(strings[nstr-1] == NULL)	{
+		free(tmp);
 		goto cleanup;
+	    }
 	    s = next_component_string(NULL, " \t", &pos);
 	}
 	free(tmp);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/config_reg.c b/crypto/external/bsd/heimdal/dist/lib/krb5/config_reg.c
index 169749fea..860aca2e2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/config_reg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/config_reg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: config_reg.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: config_reg.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2010, Secure Endpoints Inc.
@@ -88,7 +88,7 @@
  * krb5_set_error_message().
  *
  */
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_store_string_to_reg_value(krb5_context context,
                                 HKEY key, const char * valuename,
                                 DWORD type, const char *data, DWORD cb_data,
@@ -158,7 +158,6 @@ _krb5_store_string_to_reg_value(krb5_context context,
     case REG_MULTI_SZ:
         if (separator && *separator)
         {
-            int i;
             char *cp;
 
             if (data != static_buffer)
@@ -192,7 +191,7 @@ _krb5_store_string_to_reg_value(krb5_context context,
                                        GetLastError());
         }
 
-        rcode = RegSetValueEx(key, valuename, 0, type, dwData, sizeof(DWORD));
+	rcode = RegSetValueEx(key, valuename, 0, type, (BYTE *)&dwData, sizeof(DWORD));
         if (rcode)
         {
             if (context)
@@ -215,7 +214,7 @@ _krb5_store_string_to_reg_value(krb5_context context,
  *
  * @see _krb5_parse_reg_value_as_multi_string()
  */
-char *
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
 _krb5_parse_reg_value_as_string(krb5_context context,
                                 HKEY key, const char * valuename,
                                 DWORD type, DWORD cb_data)
@@ -254,7 +253,7 @@ _krb5_parse_reg_value_as_string(krb5_context context,
  * If NULL is returned, an error message has been set using
  * krb5_set_error_message().
  */
-char *
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
 _krb5_parse_reg_value_as_multi_string(krb5_context context,
                                       HKEY key, const char * valuename,
                                       DWORD type, DWORD cb_data, char *separator)
@@ -581,10 +580,8 @@ parse_reg_root(krb5_context context,
     krb5_error_code     code = 0;
 
     libdefaults = _krb5_config_get_entry(parent, "libdefaults", krb5_config_list);
-    if (libdefaults == NULL) {
-        krb5_set_error_message(context, ENOMEM, "Out of memory while parsing configuration");
-        return ENOMEM;
-    }
+    if (libdefaults == NULL)
+        return krb5_enomem(context);
 
     code = parse_reg_values(context, key, &libdefaults->u.list);
     if (code)
@@ -625,7 +622,7 @@ load_config_from_regpath(krb5_context context,
  *
  * @see parse_reg_value() for details about how each type of value is handled.
  */
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_load_config_from_registry(krb5_context context,
                                 krb5_config_section ** res)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/constants.c b/crypto/external/bsd/heimdal/dist/lib/krb5/constants.c
index 9088989f9..a50bd2f41 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/constants.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/constants.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: constants.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: constants.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -38,6 +38,9 @@
 #include "krb5_locl.h"
 
 KRB5_LIB_VARIABLE const char *krb5_config_file =
+#ifdef KRB5_DEFAULT_CONFIG_FILE
+KRB5_DEFAULT_CONFIG_FILE
+#else
 #ifdef __APPLE__
 "~/Library/Preferences/com.apple.Kerberos.plist" PATH_SEP
 "/Library/Preferences/com.apple.Kerberos.plist" PATH_SEP
@@ -45,13 +48,14 @@ KRB5_LIB_VARIABLE const char *krb5_config_file =
 "/Library/Preferences/edu.mit.Kerberos" PATH_SEP
 #endif	/* __APPLE__ */
 "~/.krb5/config" PATH_SEP
-SYSCONFDIR "/krb5.conf"
+SYSCONFDIR "/krb5.conf" PATH_SEP
 #ifdef _WIN32
-PATH_SEP "%{COMMON_APPDATA}/Kerberos/krb5.conf"
-PATH_SEP "%{WINDOWS}/krb5.ini"
-#else
-PATH_SEP "/etc/krb5.conf"
-#endif
+"%{COMMON_APPDATA}/Kerberos/krb5.conf" PATH_SEP
+"%{WINDOWS}/krb5.ini"
+#else /* _WIN32 */
+"/etc/krb5.conf"
+#endif /* _WIN32 */
+#endif /* KRB5_DEFAULT_CONFIG_FILE */
 ;
 
 KRB5_LIB_VARIABLE const char *krb5_defkeyname = KEYTAB_DEFAULT;
@@ -61,3 +65,4 @@ KRB5_LIB_VARIABLE const char *krb5_cc_type_file = "FILE";
 KRB5_LIB_VARIABLE const char *krb5_cc_type_memory = "MEMORY";
 KRB5_LIB_VARIABLE const char *krb5_cc_type_kcm = "KCM";
 KRB5_LIB_VARIABLE const char *krb5_cc_type_scc = "SCC";
+KRB5_LIB_VARIABLE const char *krb5_cc_type_dcc = "DIR";
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/context.c b/crypto/external/bsd/heimdal/dist/lib/krb5/context.c
index 71c4f390c..5d6339f87 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/context.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/context.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: context.c,v 1.4 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: context.c,v 1.6 2017/01/30 18:59:04 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2010 Kungliga Tekniska Högskolan
@@ -50,6 +50,11 @@
         }								\
     } while(0)
 
+static krb5_error_code
+copy_enctypes(krb5_context context,
+	      const krb5_enctype *in,
+	      krb5_enctype **out);
+
 /*
  * Set the list of etypes `ret_etypes' from the configuration variable
  * `name'
@@ -71,8 +76,7 @@ set_etypes (krb5_context context,
 	etypes = malloc((i+1) * sizeof(*etypes));
 	if (etypes == NULL) {
 	    krb5_config_free_strings (etypes_str);
-	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	for(j = 0, k = 0; j < i; j++) {
 	    krb5_enctype e;
@@ -102,7 +106,8 @@ init_context_from_config_file(krb5_context context)
     krb5_enctype *tmptypes;
 
     INIT_FIELD(context, time, max_skew, 5 * 60, "clockskew");
-    INIT_FIELD(context, time, kdc_timeout, 3, "kdc_timeout");
+    INIT_FIELD(context, time, kdc_timeout, 30, "kdc_timeout");
+    INIT_FIELD(context, time, host_timeout, 3, "host_timeout");
     INIT_FIELD(context, int, max_retries, 3, "max_retries");
 
     INIT_FIELD(context, string, http_proxy, NULL, "http_proxy");
@@ -125,6 +130,18 @@ init_context_from_config_file(krb5_context context)
     free(context->etypes);
     context->etypes = tmptypes;
 
+    /* The etypes member may change during the lifetime
+     * of the context. To be able to reset it to
+     * config value, we keep another copy.
+     */
+    free(context->cfg_etypes);
+    context->cfg_etypes = NULL;
+    if (tmptypes) {
+	ret = copy_enctypes(context, tmptypes, &context->cfg_etypes);
+	if (ret)
+	    return ret;
+    }
+
     ret = set_etypes (context, "default_etypes_des", &tmptypes);
     if(ret)
 	return ret;
@@ -149,15 +166,8 @@ init_context_from_config_file(krb5_context context)
     free(context->permitted_enctypes);
     context->permitted_enctypes = tmptypes;
 
-    /* default keytab name */
-    tmp = NULL;
-    if(!issuid())
-	tmp = getenv("KRB5_KTNAME");
-    if(tmp != NULL)
-	context->default_keytab = tmp;
-    else
-	INIT_FIELD(context, string, default_keytab,
-		   KEYTAB_DEFAULT, "default_keytab_name");
+    INIT_FIELD(context, string, default_keytab,
+	       KEYTAB_DEFAULT, "default_keytab_name");
 
     INIT_FIELD(context, string, default_keytab_modify,
 	       NULL, "default_keytab_modify_name");
@@ -222,14 +232,22 @@ init_context_from_config_file(krb5_context context)
     INIT_FIELD(context, bool, srv_lookup, TRUE, "srv_lookup");
     INIT_FIELD(context, bool, srv_lookup, context->srv_lookup, "dns_lookup_kdc");
     INIT_FIELD(context, int, large_msg_size, 1400, "large_message_size");
+    INIT_FIELD(context, int, max_msg_size, 1000 * 1024, "maximum_message_size");
     INIT_FLAG(context, flags, KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME, TRUE, "dns_canonicalize_hostname");
     INIT_FLAG(context, flags, KRB5_CTX_F_CHECK_PAC, TRUE, "check_pac");
+
+    if (context->default_cc_name)
+	free(context->default_cc_name);
     context->default_cc_name = NULL;
     context->default_cc_name_set = 0;
 
     s = krb5_config_get_strings(context, NULL, "logging", "krb5", NULL);
     if(s) {
 	char **p;
+
+	if (context->debug_dest)
+	    krb5_closelog(context, context->debug_dest);
+
 	krb5_initlog(context, "libkrb5", &context->debug_dest);
 	for(p = s; *p; p++)
 	    krb5_addlog_dest(context, context->debug_dest, *p);
@@ -244,6 +262,11 @@ init_context_from_config_file(krb5_context context)
 	if (strcasecmp(tmp, "ignore") == 0)
 	    context->flags |= KRB5_CTX_F_RD_REQ_IGNORE;
     }
+    ret = krb5_config_get_bool_default(context, NULL, TRUE,
+				       "libdefaults",
+				       "fcache_strict_checking", NULL);
+    if (ret)
+	context->flags |= KRB5_CTX_F_FCACHE_STRICT_CHECKING;
 
     return 0;
 }
@@ -258,6 +281,7 @@ cc_ops_register(krb5_context context)
     krb5_cc_register(context, &krb5_acc_ops, TRUE);
 #endif
     krb5_cc_register(context, &krb5_fcc_ops, TRUE);
+    krb5_cc_register(context, &krb5_dcc_ops, TRUE);
     krb5_cc_register(context, &krb5_mcc_ops, TRUE);
 #ifdef HAVE_SCC
     krb5_cc_register(context, &krb5_scc_ops, TRUE);
@@ -325,11 +349,8 @@ kt_ops_copy(krb5_context context, const krb5_context src_context)
 	return 0;
 
     context->kt_types = malloc(sizeof(context->kt_types[0]) * src_context->num_kt_types);
-    if (context->kt_types == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (context->kt_types == NULL)
+	return krb5_enomem(context);
 
     context->num_kt_types = src_context->num_kt_types;
     memcpy(context->kt_types, src_context->kt_types,
@@ -339,10 +360,17 @@ kt_ops_copy(krb5_context context, const krb5_context src_context)
 }
 
 static const char *sysplugin_dirs[] =  {
-    LIBDIR "/plugin/krb5",
+#ifdef _WIN32
+    "$ORIGIN",
+#else
+    "$ORIGIN/../lib/plugin/krb5",
+#endif
 #ifdef __APPLE__
+    LIBDIR "/plugin/krb5",
+#ifdef HEIM_PLUGINS_SEARCH_SYSTEM
     "/Library/KerberosPlugins/KerberosFrameworkPlugins",
     "/System/Library/KerberosPlugins/KerberosFrameworkPlugins",
+#endif
 #endif
     NULL
 };
@@ -351,8 +379,21 @@ static void
 init_context_once(void *ctx)
 {
     krb5_context context = ctx;
+    char **dirs;
 
-    _krb5_load_plugins(context, "krb5", sysplugin_dirs);
+#ifdef _WIN32
+    dirs = rk_UNCONST(sysplugin_dirs);
+#else
+    dirs = krb5_config_get_strings(context, NULL, "libdefaults",
+				   "plugin_dir", NULL);
+    if (dirs == NULL)
+	dirs = rk_UNCONST(sysplugin_dirs);
+#endif
+
+    _krb5_load_plugins(context, "krb5", (const char **)dirs);
+
+    if (dirs != rk_UNCONST(sysplugin_dirs))
+	krb5_config_free_strings(dirs);
 
     bindtextdomain(HEIMDAL_TEXTDOMAIN, HEIMDAL_LOCALEDIR);
 }
@@ -368,7 +409,8 @@ init_context_once(void *ctx)
  * @return Returns 0 to indicate success.  Otherwise an errno code is
  * returned.  Failure means either that something bad happened during
  * initialization (typically ENOMEM) or that Kerberos should not be
- * used ENXIO.
+ * used ENXIO. If the function returns HEIM_ERR_RANDOM_OFFLINE, the
+ * random source is not available and later Kerberos calls might fail.
  *
  * @ingroup krb5
  */
@@ -380,19 +422,28 @@ krb5_init_context(krb5_context *context)
     krb5_context p;
     krb5_error_code ret;
     char **files;
+    uint8_t rnd;
 
     *context = NULL;
 
+    /**
+     * krb5_init_context() will get one random byte to make sure our
+     * random is alive.  Assumption is that once the non blocking
+     * source allows us to pull bytes, its all seeded and allows us to
+     * pull more bytes.
+     *
+     * Most Kerberos users calls krb5_init_context(), so this is
+     * useful point where we can do the checking.
+     */
+    ret = krb5_generate_random(&rnd, sizeof(rnd));
+    if (ret)
+	return ret;
+
     p = calloc(1, sizeof(*p));
     if(!p)
 	return ENOMEM;
 
-    p->mutex = malloc(sizeof(HEIMDAL_MUTEX));
-    if (p->mutex == NULL) {
-	free(p);
-	return ENOMEM;
-    }
-    HEIMDAL_MUTEX_init(p->mutex);
+    HEIMDAL_MUTEX_init(&p->mutex);
 
     p->flags |= KRB5_CTX_F_HOMEDIR_ACCESS;
 
@@ -404,6 +455,9 @@ krb5_init_context(krb5_context *context)
     if(ret)
 	goto out;
 
+    /* done enough to load plugins */
+    heim_base_once_f(&init_context, p, init_context_once);
+
     /* init error tables */
     krb5_init_ets(p);
     cc_ops_register(p);
@@ -421,8 +475,6 @@ out:
     if(ret) {
 	krb5_free_context(p);
 	p = NULL;
-    } else {
-	heim_base_once_f(&init_context, p, init_context_once);
     }
     *context = p;
     return ret;
@@ -452,13 +504,10 @@ copy_etypes (krb5_context context,
 	;
     i++;
 
-    *ret_enctypes = malloc(sizeof(**ret_enctypes) * i);
-    if (*ret_enctypes == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-    memcpy(*ret_enctypes, enctypes, sizeof(**ret_enctypes) * i);
+    *ret_enctypes = malloc(sizeof(enctypes[0]) * i);
+    if (*ret_enctypes == NULL)
+	return krb5_enomem(context);
+    memcpy(*ret_enctypes, enctypes, sizeof(enctypes[0]) * i);
     return 0;
 }
 
@@ -484,19 +533,10 @@ krb5_copy_context(krb5_context context, krb5_context *out)
     *out = NULL;
 
     p = calloc(1, sizeof(*p));
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-
-    p->mutex = malloc(sizeof(HEIMDAL_MUTEX));
-    if (p->mutex == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	free(p);
-	return ENOMEM;
-    }
-    HEIMDAL_MUTEX_init(p->mutex);
+    if (p == NULL)
+	return krb5_enomem(context);
 
+    HEIMDAL_MUTEX_init(&p->mutex);
 
     if (context->default_cc_name)
 	p->default_cc_name = strdup(context->default_cc_name);
@@ -508,6 +548,11 @@ krb5_copy_context(krb5_context context, krb5_context *out)
 	if (ret)
 	    goto out;
     }
+    if (context->cfg_etypes) {
+	ret = copy_etypes(context, context->cfg_etypes, &p->cfg_etypes);
+	if (ret)
+	    goto out;
+    }
     if (context->etypes_des) {
 	ret = copy_etypes(context, context->etypes_des, &p->etypes_des);
 	if (ret)
@@ -571,11 +616,13 @@ krb5_copy_context(krb5_context context, krb5_context *out)
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_context(krb5_context context)
 {
+    _krb5_free_name_canon_rules(context, context->name_canon_rules);
     if (context->default_cc_name)
 	free(context->default_cc_name);
     if (context->default_cc_name_env)
 	free(context->default_cc_name_env);
     free(context->etypes);
+    free(context->cfg_etypes);
     free(context->etypes_des);
     krb5_free_host_realm (context, context->default_realms);
     krb5_config_file_free (context, context->cf);
@@ -596,8 +643,7 @@ krb5_free_context(krb5_context context)
 	hx509_context_free(&context->hx509ctx);
 #endif
 
-    HEIMDAL_MUTEX_destroy(context->mutex);
-    free(context->mutex);
+    HEIMDAL_MUTEX_destroy(&context->mutex);
     if (context->flags & KRB5_CTX_F_SOCKETS_INITIALIZED) {
  	rk_SOCK_EXIT();
     }
@@ -625,7 +671,8 @@ krb5_set_config_files(krb5_context context, char **filenames)
     krb5_config_binding *tmp = NULL;
     while(filenames != NULL && *filenames != NULL && **filenames != '\0') {
 	ret = krb5_config_parse_file_multi(context, *filenames, &tmp);
-	if(ret != 0 && ret != ENOENT && ret != EACCES && ret != EPERM) {
+	if (ret != 0 && ret != ENOENT && ret != EACCES && ret != EPERM
+	    && ret != KRB5_CONFIG_BADFORMAT) {
 	    krb5_config_file_free(context, tmp);
 	    return ret;
 	}
@@ -771,7 +818,7 @@ krb5_prepend_config_files_default(const char *filelist, char ***pfilenames)
  * to find the configuration file location in the
  * SOFTWARE\MIT\Kerberos registry key under the value "config".
  */
-char *
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
 _krb5_get_default_config_config_files_from_registry()
 {
     static const char * KeyName = "Software\\MIT\\Kerberos";
@@ -883,6 +930,18 @@ krb5_kerberos_enctypes(krb5_context context)
     static const krb5_enctype p[] = {
 	ETYPE_AES256_CTS_HMAC_SHA1_96,
 	ETYPE_AES128_CTS_HMAC_SHA1_96,
+	ETYPE_AES256_CTS_HMAC_SHA384_192,
+	ETYPE_AES128_CTS_HMAC_SHA256_128,
+	ETYPE_DES3_CBC_SHA1,
+	ETYPE_ARCFOUR_HMAC_MD5,
+	ETYPE_NULL
+    };
+
+    static const krb5_enctype weak[] = {
+	ETYPE_AES256_CTS_HMAC_SHA1_96,
+	ETYPE_AES128_CTS_HMAC_SHA1_96,
+	ETYPE_AES256_CTS_HMAC_SHA384_192,
+	ETYPE_AES128_CTS_HMAC_SHA256_128,
 	ETYPE_DES3_CBC_SHA1,
 	ETYPE_DES3_CBC_MD5,
 	ETYPE_ARCFOUR_HMAC_MD5,
@@ -891,6 +950,20 @@ krb5_kerberos_enctypes(krb5_context context)
 	ETYPE_DES_CBC_CRC,
 	ETYPE_NULL
     };
+
+    /*
+     * if the list of enctypes enabled by "allow_weak_crypto"
+     * are valid, then return the former default enctype list
+     * that contained the weak entries.
+     */
+    if (krb5_enctype_valid(context, ETYPE_DES_CBC_CRC) == 0 &&
+        krb5_enctype_valid(context, ETYPE_DES_CBC_MD4) == 0 &&
+        krb5_enctype_valid(context, ETYPE_DES_CBC_MD5) == 0 &&
+        krb5_enctype_valid(context, ETYPE_DES_CBC_NONE) == 0 &&
+        krb5_enctype_valid(context, ETYPE_DES_CFB64_NONE) == 0 &&
+        krb5_enctype_valid(context, ETYPE_DES_PCBC_NONE) == 0)
+        return weak;
+
     return p;
 }
 
@@ -946,6 +1019,8 @@ default_etypes(krb5_context context, krb5_enctype **etype)
  *
  * @param context Kerberos 5 context.
  * @param etypes Encryption types, array terminated with ETYPE_NULL (0).
+ * A value of NULL resets the encryption types to the defaults set in the
+ * configuration file.
  *
  * @return Returns 0 to indicate success. Otherwise an kerberos et
  * error code is returned, see krb5_get_error_message().
@@ -960,6 +1035,10 @@ krb5_set_default_in_tkt_etypes(krb5_context context,
     krb5_error_code ret;
     krb5_enctype *p = NULL;
 
+    if(!etypes) {
+	etypes = context->cfg_etypes;
+    }
+
     if(etypes) {
 	ret = copy_enctypes(context, etypes, &p);
 	if (ret)
@@ -976,6 +1055,7 @@ krb5_set_default_in_tkt_etypes(krb5_context context,
  * with the KDC, clients and servers.
  *
  * @param context Kerberos 5 context.
+ * @param pdu_type request type (AS, TGS or none)
  * @param etypes Encryption types, array terminated with
  * ETYPE_NULL(0), caller should free array with krb5_xfree():
  *
@@ -996,7 +1076,7 @@ krb5_get_default_in_tkt_etypes(krb5_context context,
 
     heim_assert(pdu_type == KRB5_PDU_AS_REQUEST || 
 		pdu_type == KRB5_PDU_TGS_REQUEST ||
-		pdu_type == KRB5_PDU_NONE, "pdu contant not as expected");
+		pdu_type == KRB5_PDU_NONE, "unexpected pdu type");
 
     if (pdu_type == KRB5_PDU_AS_REQUEST && context->as_etypes != NULL)
 	enctypes = context->as_etypes;
@@ -1135,10 +1215,8 @@ krb5_set_extra_addresses(krb5_context context, const krb5_addresses *addresses)
     }
     if(context->extra_addresses == NULL) {
 	context->extra_addresses = malloc(sizeof(*context->extra_addresses));
-	if(context->extra_addresses == NULL) {
-	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (context->extra_addresses == NULL)
+	    return krb5_enomem(context);
     }
     return krb5_copy_addresses(context, addresses, context->extra_addresses);
 }
@@ -1217,10 +1295,8 @@ krb5_set_ignore_addresses(krb5_context context, const krb5_addresses *addresses)
     }
     if(context->ignore_addresses == NULL) {
 	context->ignore_addresses = malloc(sizeof(*context->ignore_addresses));
-	if(context->ignore_addresses == NULL) {
-	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (context->ignore_addresses == NULL)
+	    return krb5_enomem(context);
     }
     return krb5_copy_addresses(context, addresses, context->ignore_addresses);
 }
@@ -1459,17 +1535,11 @@ _krb5_init_etype(krb5_context context,
 static HEIMDAL_MUTEX homedir_mutex = HEIMDAL_MUTEX_INITIALIZER;
 static krb5_boolean allow_homedir = TRUE;
 
-krb5_boolean
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 _krb5_homedir_access(krb5_context context)
 {
     krb5_boolean allow;
 
-#ifdef HAVE_GETEUID
-    /* is never allowed for root */
-    if (geteuid() == 0)
-	return FALSE;
-#endif
-
     if (context && (context->flags & KRB5_CTX_F_HOMEDIR_ACCESS) == 0)
 	return FALSE;
 
@@ -1488,8 +1558,6 @@ _krb5_homedir_access(krb5_context context)
  * For home directory access to be allowed, both the global state and
  * the krb5_context state have to be allowed.
  *
- * Administrator (root user), never uses the home directory.
- *
  * @param context a Kerberos 5 context or NULL
  * @param allow allow if TRUE home directory
  * @return the old value
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/convert_creds.c b/crypto/external/bsd/heimdal/dist/lib/krb5/convert_creds.c
index a42511332..6d0bb1f54 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/convert_creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/convert_creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: convert_creds.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: convert_creds.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/copy_host_realm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/copy_host_realm.c
index 91759f386..d4e5d6304 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/copy_host_realm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/copy_host_realm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: copy_host_realm.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: copy_host_realm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -60,19 +60,14 @@ krb5_copy_host_realm(krb5_context context,
 	++n;
 
     *to = calloc (n, sizeof(**to));
-    if (*to == NULL) {
-	krb5_set_error_message (context, ENOMEM,
-				N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*to == NULL)
+	return krb5_enomem(context);
 
     for (i = 0, p = from; *p != NULL; ++p, ++i) {
 	(*to)[i] = strdup(*p);
 	if ((*to)[i] == NULL) {
 	    krb5_free_host_realm (context, *to);
-	    krb5_set_error_message (context, ENOMEM,
-				    N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
     }
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crc.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crc.c
index 6d6783e4c..ed374f11f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crc.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: crc.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@ static u_long table[256];
 
 #define CRC_GEN 0xEDB88320L
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_crc_init_table(void)
 {
     static int flag = 0;
@@ -62,7 +62,7 @@ _krb5_crc_init_table(void)
     flag = 1;
 }
 
-uint32_t
+KRB5_LIB_FUNCTION uint32_t KRB5_LIB_CALL
 _krb5_crc_update (const char *p, size_t len, uint32_t res)
 {
     while (len--)
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/creds.c b/crypto/external/bsd/heimdal/dist/lib/krb5/creds.c
index 6dc97d028..91054ec23 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: creds.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: creds.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -140,13 +140,9 @@ krb5_copy_creds (krb5_context context,
 {
     krb5_creds *c;
 
-    c = malloc (sizeof (*c));
-    if (c == NULL) {
-	krb5_set_error_message (context, ENOMEM,
-				N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-    memset (c, 0, sizeof(*c));
+    c = calloc(1, sizeof(*c));
+    if (c == NULL)
+	return krb5_enomem(context);
     *outcred = c;
     return krb5_copy_creds_contents (context, incred, c);
 }
@@ -166,8 +162,9 @@ krb5_copy_creds (krb5_context context,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_creds (krb5_context context, krb5_creds *c)
 {
-    krb5_free_cred_contents (context, c);
-    free (c);
+    if (c != NULL)
+        krb5_free_cred_contents(context, c);
+    free(c);
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha1.c
similarity index 86%
rename from crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes.c
rename to crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha1.c
index 83c48812c..a6a79216b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha1.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-aes.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-aes-sha1.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -39,29 +39,29 @@
  * AES
  */
 
-static struct _krb5_key_type keytype_aes128 = {
-    ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+static struct _krb5_key_type keytype_aes128_sha1 = {
+    KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96,
     "aes-128",
     128,
     16,
     sizeof(struct _krb5_evp_schedule),
     NULL,
     _krb5_evp_schedule,
-    _krb5_AES_salt,
+    _krb5_AES_SHA1_salt,
     NULL,
     _krb5_evp_cleanup,
     EVP_aes_128_cbc
 };
 
-static struct _krb5_key_type keytype_aes256 = {
-    ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+static struct _krb5_key_type keytype_aes256_sha1 = {
+    KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96,
     "aes-256",
     256,
     32,
     sizeof(struct _krb5_evp_schedule),
     NULL,
     _krb5_evp_schedule,
-    _krb5_AES_salt,
+    _krb5_AES_SHA1_salt,
     NULL,
     _krb5_evp_cleanup,
     EVP_aes_256_cbc
@@ -88,10 +88,10 @@ struct _krb5_checksum_type _krb5_checksum_hmac_sha1_aes256 = {
 };
 
 static krb5_error_code
-AES_PRF(krb5_context context,
-	krb5_crypto crypto,
-	const krb5_data *in,
-	krb5_data *out)
+AES_SHA1_PRF(krb5_context context,
+	     krb5_crypto crypto,
+	     const krb5_data *in,
+	     krb5_data *out)
 {
     struct _krb5_checksum_type *ct = crypto->et->checksum;
     krb5_error_code ret;
@@ -144,29 +144,31 @@ AES_PRF(krb5_context context,
 struct _krb5_encryption_type _krb5_enctype_aes128_cts_hmac_sha1 = {
     ETYPE_AES128_CTS_HMAC_SHA1_96,
     "aes128-cts-hmac-sha1-96",
+    "aes128-cts",
     16,
     1,
     16,
-    &keytype_aes128,
+    &keytype_aes128_sha1,
     &_krb5_checksum_sha1,
     &_krb5_checksum_hmac_sha1_aes128,
-    F_DERIVED,
+    F_DERIVED | F_RFC3961_ENC | F_RFC3961_KDF,
     _krb5_evp_encrypt_cts,
     16,
-    AES_PRF
+    AES_SHA1_PRF
 };
 
 struct _krb5_encryption_type _krb5_enctype_aes256_cts_hmac_sha1 = {
     ETYPE_AES256_CTS_HMAC_SHA1_96,
     "aes256-cts-hmac-sha1-96",
+    "aes256-cts",
     16,
     1,
     16,
-    &keytype_aes256,
+    &keytype_aes256_sha1,
     &_krb5_checksum_sha1,
     &_krb5_checksum_hmac_sha1_aes256,
-    F_DERIVED,
+    F_DERIVED | F_RFC3961_ENC | F_RFC3961_KDF,
     _krb5_evp_encrypt_cts,
     16,
-    AES_PRF
+    AES_SHA1_PRF
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha2.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha2.c
new file mode 100644
index 000000000..089779669
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-aes-sha2.c
@@ -0,0 +1,196 @@
+/*	$NetBSD: crypto-aes-sha2.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb5_locl.h"
+
+/*
+ * AES HMAC-SHA2
+ */
+
+krb5_error_code
+_krb5_aes_sha2_md_for_enctype(krb5_context context,
+			      krb5_enctype enctype,
+			      const EVP_MD **md)
+{
+    switch (enctype) {
+    case ETYPE_AES128_CTS_HMAC_SHA256_128:
+	*md = EVP_sha256();
+	break;
+    case ETYPE_AES256_CTS_HMAC_SHA384_192:
+	*md = EVP_sha384();
+	break;
+    default:
+	return KRB5_PROG_ETYPE_NOSUPP;
+	break;
+    }
+    return 0;
+}
+
+static krb5_error_code
+SP_HMAC_SHA2_checksum(krb5_context context,
+		      struct _krb5_key_data *key,
+		      const void *data,
+		      size_t len,
+		      unsigned usage,
+		      Checksum *result)
+{
+    krb5_error_code ret;
+    const EVP_MD *md;
+    unsigned char hmac[EVP_MAX_MD_SIZE];
+    unsigned int hmaclen = sizeof(hmac);
+
+    ret = _krb5_aes_sha2_md_for_enctype(context, key->key->keytype, &md);
+    if (ret)
+	return ret;
+
+    HMAC(md, key->key->keyvalue.data, key->key->keyvalue.length,
+	 data, len, hmac, &hmaclen);
+
+    heim_assert(result->checksum.length <= hmaclen, "SHA2 internal error");
+
+    memcpy(result->checksum.data, hmac, result->checksum.length);
+
+    return 0;
+}
+
+static struct _krb5_key_type keytype_aes128_sha2 = {
+    KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+    "aes-128-sha2",
+    128,
+    16,
+    sizeof(struct _krb5_evp_schedule),
+    NULL,
+    _krb5_evp_schedule,
+    _krb5_AES_SHA2_salt,
+    NULL,
+    _krb5_evp_cleanup,
+    EVP_aes_128_cbc
+};
+
+static struct _krb5_key_type keytype_aes256_sha2 = {
+    KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
+    "aes-256-sha2",
+    256,
+    32,
+    sizeof(struct _krb5_evp_schedule),
+    NULL,
+    _krb5_evp_schedule,
+    _krb5_AES_SHA2_salt,
+    NULL,
+    _krb5_evp_cleanup,
+    EVP_aes_256_cbc
+};
+
+struct _krb5_checksum_type _krb5_checksum_hmac_sha256_128_aes128 = {
+    CKSUMTYPE_HMAC_SHA256_128_AES128,
+    "hmac-sha256-128-aes128",
+    64,
+    16,
+    F_KEYED | F_CPROOF | F_DERIVED,
+    SP_HMAC_SHA2_checksum,
+    NULL
+};
+
+struct _krb5_checksum_type _krb5_checksum_hmac_sha384_192_aes256 = {
+    CKSUMTYPE_HMAC_SHA384_192_AES256,
+    "hmac-sha384-192-aes256",
+    128,
+    24,
+    F_KEYED | F_CPROOF | F_DERIVED,
+    SP_HMAC_SHA2_checksum,
+    NULL
+};
+
+static krb5_error_code
+AES_SHA2_PRF(krb5_context context,
+	     krb5_crypto crypto,
+	     const krb5_data *in,
+	     krb5_data *out)
+{
+    krb5_error_code ret;
+    krb5_data label;
+    const EVP_MD *md = NULL;
+
+    ret = _krb5_aes_sha2_md_for_enctype(context, crypto->et->type, &md);
+    if (ret)
+	return ret;
+
+    label.data = "prf";
+    label.length = 3;
+
+    ret = krb5_data_alloc(out, EVP_MD_size(md));
+    if (ret)
+	return ret;
+
+    ret = _krb5_SP800_108_HMAC_KDF(context, &crypto->key.key->keyvalue,
+				   &label, in, md, out);
+
+    if (ret)
+	krb5_data_free(out);
+
+    return ret;
+}
+
+struct _krb5_encryption_type _krb5_enctype_aes128_cts_hmac_sha256_128 = {
+    ETYPE_AES128_CTS_HMAC_SHA256_128,
+    "aes128-cts-hmac-sha256-128",
+    "aes128-cts-sha256",
+    16,
+    1,
+    16,
+    &keytype_aes128_sha2,
+    NULL, /* should never be called */
+    &_krb5_checksum_hmac_sha256_128_aes128,
+    F_DERIVED | F_ENC_THEN_CKSUM | F_SP800_108_HMAC_KDF,
+    _krb5_evp_encrypt_cts,
+    16,
+    AES_SHA2_PRF
+};
+
+struct _krb5_encryption_type _krb5_enctype_aes256_cts_hmac_sha384_192 = {
+    ETYPE_AES256_CTS_HMAC_SHA384_192,
+    "aes256-cts-hmac-sha384-192",
+    "aes256-cts-sha384",
+    16,
+    1,
+    16,
+    &keytype_aes256_sha2,
+    NULL, /* should never be called */
+    &_krb5_checksum_hmac_sha384_192_aes256,
+    F_DERIVED | F_ENC_THEN_CKSUM | F_SP800_108_HMAC_KDF,
+    _krb5_evp_encrypt_cts,
+    16,
+    AES_SHA2_PRF
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-algs.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-algs.c
index 40d7dd126..79e640ff2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-algs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-algs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-algs.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: crypto-algs.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -55,6 +55,8 @@ struct _krb5_checksum_type *_krb5_checksum_types[] = {
     &_krb5_checksum_hmac_sha1_des3,
     &_krb5_checksum_hmac_sha1_aes128,
     &_krb5_checksum_hmac_sha1_aes256,
+    &_krb5_checksum_hmac_sha256_128_aes128,
+    &_krb5_checksum_hmac_sha384_192_aes256,
     &_krb5_checksum_hmac_md5
 };
 
@@ -66,6 +68,8 @@ int _krb5_num_checksums
  * (only relevant for !F_PSEUDO) */
 
 struct _krb5_encryption_type *_krb5_etypes[] = {
+    &_krb5_enctype_aes256_cts_hmac_sha384_192,
+    &_krb5_enctype_aes128_cts_hmac_sha256_128,
     &_krb5_enctype_aes256_cts_hmac_sha1,
     &_krb5_enctype_aes128_cts_hmac_sha1,
     &_krb5_enctype_des3_cbc_sha1,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-arcfour.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-arcfour.c
index e1f1f6c6f..bb25de827 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-arcfour.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-arcfour.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-arcfour.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-arcfour.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -40,7 +40,7 @@
 #include "krb5_locl.h"
 
 static struct _krb5_key_type keytype_arcfour = {
-    ENCTYPE_ARCFOUR_HMAC_MD5,
+    KRB5_ENCTYPE_ARCFOUR_HMAC_MD5,
     "arcfour",
     128,
     16,
@@ -77,10 +77,8 @@ _krb5_HMAC_MD5_checksum(krb5_context context,
     krb5_error_code ret;
 
     m = EVP_MD_CTX_create();
-    if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (m == NULL)
+	return krb5_enomem(context);
     ksign_c.checksum.length = sizeof(ksign_c_data);
     ksign_c.checksum.data   = ksign_c_data;
     ret = _krb5_internal_hmac(context, c, signature, sizeof(signature),
@@ -149,7 +147,7 @@ ARCFOUR_subencrypt(krb5_context context,
     k1_c.checksum.length = sizeof(k1_c_data);
     k1_c.checksum.data   = k1_c_data;
 
-    ret = _krb5_internal_hmac(NULL, c, t, sizeof(t), 0, key, &k1_c);
+    ret = _krb5_internal_hmac(context, c, t, sizeof(t), 0, key, &k1_c);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -164,7 +162,7 @@ ARCFOUR_subencrypt(krb5_context context,
     cksum.checksum.length = 16;
     cksum.checksum.data   = data;
 
-    ret = _krb5_internal_hmac(NULL, c, cdata + 16, len - 16, 0, &ke, &cksum);
+    ret = _krb5_internal_hmac(context, c, cdata + 16, len - 16, 0, &ke, &cksum);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -174,7 +172,7 @@ ARCFOUR_subencrypt(krb5_context context,
     k3_c.checksum.length = sizeof(k3_c_data);
     k3_c.checksum.data   = k3_c_data;
 
-    ret = _krb5_internal_hmac(NULL, c, data, 16, 0, &ke, &k3_c);
+    ret = _krb5_internal_hmac(context, c, data, 16, 0, &ke, &k3_c);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -217,7 +215,7 @@ ARCFOUR_subdecrypt(krb5_context context,
     k1_c.checksum.length = sizeof(k1_c_data);
     k1_c.checksum.data   = k1_c_data;
 
-    ret = _krb5_internal_hmac(NULL, c, t, sizeof(t), 0, key, &k1_c);
+    ret = _krb5_internal_hmac(context, c, t, sizeof(t), 0, key, &k1_c);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -232,7 +230,7 @@ ARCFOUR_subdecrypt(krb5_context context,
     k3_c.checksum.length = sizeof(k3_c_data);
     k3_c.checksum.data   = k3_c_data;
 
-    ret = _krb5_internal_hmac(NULL, c, cdata, 16, 0, &ke, &k3_c);
+    ret = _krb5_internal_hmac(context, c, cdata, 16, 0, &ke, &k3_c);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -247,7 +245,7 @@ ARCFOUR_subdecrypt(krb5_context context,
     cksum.checksum.length = 16;
     cksum.checksum.data   = cksum_data;
 
-    ret = _krb5_internal_hmac(NULL, c, cdata + 16, len - 16, 0, &ke, &cksum);
+    ret = _krb5_internal_hmac(context, c, cdata + 16, len - 16, 0, &ke, &cksum);
     if (ret)
 	krb5_abortx(context, "hmac failed");
 
@@ -269,7 +267,7 @@ ARCFOUR_subdecrypt(krb5_context context,
  * draft-brezak-win2k-krb-rc4-hmac-04.txt
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_usage2arcfour(krb5_context context, unsigned *usage)
 {
     switch (*usage) {
@@ -311,17 +309,42 @@ ARCFOUR_encrypt(krb5_context context,
 	return ARCFOUR_subdecrypt (context, key, data, len, keyusage, ivec);
 }
 
+static krb5_error_code
+ARCFOUR_prf(krb5_context context,
+	    krb5_crypto crypto,
+	    const krb5_data *in,
+	    krb5_data *out)
+{
+    struct _krb5_checksum_type *c = _krb5_find_checksum(CKSUMTYPE_SHA1);
+    krb5_error_code ret;
+    Checksum res;
+
+    ret = krb5_data_alloc(out, c->checksumsize);
+    if (ret)
+	return ret;
+
+    res.checksum.data = out->data;
+    res.checksum.length = out->length;
+
+    ret = _krb5_internal_hmac(context, c, in->data, in->length, 0, &crypto->key, &res);
+    if (ret)
+	krb5_data_free(out);
+    return 0;
+}
+
+
 struct _krb5_encryption_type _krb5_enctype_arcfour_hmac_md5 = {
     ETYPE_ARCFOUR_HMAC_MD5,
     "arcfour-hmac-md5",
+    "rc4-hmac",
     1,
     1,
     8,
     &keytype_arcfour,
     &_krb5_checksum_hmac_md5,
     &_krb5_checksum_hmac_md5,
-    F_SPECIAL,
+    F_SPECIAL | F_WEAK,
     ARCFOUR_encrypt,
     0,
-    NULL
+    ARCFOUR_prf
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des-common.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des-common.c
index d120c5d7f..d65c43ea7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des-common.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des-common.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-des-common.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: crypto-des-common.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -41,10 +41,9 @@
  * A = A xor B. A & B are 8 bytes.
  */
 
-void
-_krb5_xor (DES_cblock *key, const unsigned char *b)
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_xor8(unsigned char *a, const unsigned char *b)
 {
-    unsigned char *a = (unsigned char*)key;
     a[0] ^= b[0];
     a[1] ^= b[1];
     a[2] ^= b[2];
@@ -56,7 +55,7 @@ _krb5_xor (DES_cblock *key, const unsigned char *b)
 }
 
 #if defined(DES3_OLD_ENCTYPE) || defined(HEIM_WEAK_CRYPTO)
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_des_checksum(krb5_context context,
 		   const EVP_MD *evp_md,
 		   struct _krb5_key_data *key,
@@ -72,10 +71,8 @@ _krb5_des_checksum(krb5_context context,
     krb5_generate_random_block(p, 8);
 
     m = EVP_MD_CTX_create();
-    if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (m == NULL)
+	return krb5_enomem(context);
 
     EVP_DigestInit_ex(m, evp_md, NULL);
     EVP_DigestUpdate(m, p, 8);
@@ -89,7 +86,7 @@ _krb5_des_checksum(krb5_context context,
     return 0;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_des_verify(krb5_context context,
 		 const EVP_MD *evp_md,
 		 struct _krb5_key_data *key,
@@ -105,10 +102,8 @@ _krb5_des_verify(krb5_context context,
     krb5_error_code ret = 0;
 
     m = EVP_MD_CTX_create();
-    if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (m == NULL)
+	return krb5_enomem(context);
 
     memset(&ivec, 0, sizeof(ivec));
     EVP_CipherInit_ex(&ctx->dctx, NULL, NULL, NULL, (void *)&ivec, -1);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des.c
index 52b0b6233..55becfa0c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-des.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-des.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -67,7 +67,7 @@ krb5_DES_random_to_key(krb5_context context,
     memcpy(k, data, key->keyvalue.length);
     DES_set_odd_parity(k);
     if(DES_is_weak_key(k))
-	_krb5_xor(k, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
+	_krb5_xor8(*k, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
 }
 
 static struct _krb5_key_type keytype_des_old = {
@@ -290,6 +290,7 @@ DES_PCBC_encrypt_key_ivec(krb5_context context,
 struct _krb5_encryption_type _krb5_enctype_des_cbc_crc = {
     ETYPE_DES_CBC_CRC,
     "des-cbc-crc",
+    NULL,
     8,
     8,
     8,
@@ -305,6 +306,7 @@ struct _krb5_encryption_type _krb5_enctype_des_cbc_crc = {
 struct _krb5_encryption_type _krb5_enctype_des_cbc_md4 = {
     ETYPE_DES_CBC_MD4,
     "des-cbc-md4",
+    NULL,
     8,
     8,
     8,
@@ -320,6 +322,7 @@ struct _krb5_encryption_type _krb5_enctype_des_cbc_md4 = {
 struct _krb5_encryption_type _krb5_enctype_des_cbc_md5 = {
     ETYPE_DES_CBC_MD5,
     "des-cbc-md5",
+    NULL,
     8,
     8,
     8,
@@ -335,6 +338,7 @@ struct _krb5_encryption_type _krb5_enctype_des_cbc_md5 = {
 struct _krb5_encryption_type _krb5_enctype_des_cbc_none = {
     ETYPE_DES_CBC_NONE,
     "des-cbc-none",
+    NULL,
     8,
     8,
     0,
@@ -350,6 +354,7 @@ struct _krb5_encryption_type _krb5_enctype_des_cbc_none = {
 struct _krb5_encryption_type _krb5_enctype_des_cfb64_none = {
     ETYPE_DES_CFB64_NONE,
     "des-cfb64-none",
+    NULL,
     1,
     1,
     0,
@@ -365,6 +370,7 @@ struct _krb5_encryption_type _krb5_enctype_des_cfb64_none = {
 struct _krb5_encryption_type _krb5_enctype_des_pcbc_none = {
     ETYPE_DES_PCBC_NONE,
     "des-pcbc-none",
+    NULL,
     8,
     8,
     0,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des3.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des3.c
index d692fbb7f..508ed8ae9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des3.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-des3.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-des3.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: crypto-des3.c,v 1.4 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -54,6 +54,59 @@ DES3_random_key(krb5_context context,
 	    DES_is_weak_key(&k[2]));
 }
 
+static krb5_error_code
+DES3_prf(krb5_context context,
+	 krb5_crypto crypto,
+	 const krb5_data *in,
+	 krb5_data *out)
+{
+    struct _krb5_checksum_type *ct = crypto->et->checksum;
+    krb5_error_code ret;
+    Checksum result;
+    krb5_keyblock *derived;
+
+    result.cksumtype = ct->type;
+    ret = krb5_data_alloc(&result.checksum, ct->checksumsize);
+    if (ret) {
+	krb5_set_error_message(context, ret, N_("malloc: out memory", ""));
+	return ret;
+    }
+
+    ret = (*ct->checksum)(context, NULL, in->data, in->length, 0, &result);
+    if (ret) {
+	krb5_data_free(&result.checksum);
+	return ret;
+    }
+
+    if (result.checksum.length < crypto->et->blocksize)
+	krb5_abortx(context, "internal prf error");
+
+    derived = NULL;
+    ret = krb5_derive_key(context, crypto->key.key,
+			  crypto->et->type, "prf", 3, &derived);
+    if (ret)
+	krb5_abortx(context, "krb5_derive_key");
+
+    ret = krb5_data_alloc(out, crypto->et->prf_length);
+    if (ret)
+	krb5_abortx(context, "malloc failed");
+
+    {
+	const EVP_CIPHER *c = (*crypto->et->keytype->evp)();
+	EVP_CIPHER_CTX ctx;
+
+	EVP_CIPHER_CTX_init(&ctx); /* ivec all zero */
+	EVP_CipherInit_ex(&ctx, c, NULL, derived->keyvalue.data, NULL, 1);
+	EVP_Cipher(&ctx, out->data, result.checksum.data,
+		   crypto->et->prf_length);
+	EVP_CIPHER_CTX_cleanup(&ctx);
+    }
+
+    krb5_data_free(&result.checksum);
+    krb5_free_keyblock(context, derived);
+
+    return ret;
+}
 
 #ifdef DES3_OLD_ENCTYPE
 static struct _krb5_key_type keytype_des3 = {
@@ -133,6 +186,7 @@ struct _krb5_checksum_type _krb5_checksum_hmac_sha1_des3 = {
 struct _krb5_encryption_type _krb5_enctype_des3_cbc_md5 = {
     ETYPE_DES3_CBC_MD5,
     "des3-cbc-md5",
+    NULL,
     8,
     8,
     8,
@@ -149,22 +203,24 @@ struct _krb5_encryption_type _krb5_enctype_des3_cbc_md5 = {
 struct _krb5_encryption_type _krb5_enctype_des3_cbc_sha1 = {
     ETYPE_DES3_CBC_SHA1,
     "des3-cbc-sha1",
+    NULL,
     8,
     8,
     8,
     &keytype_des3_derived,
     &_krb5_checksum_sha1,
     &_krb5_checksum_hmac_sha1_des3,
-    F_DERIVED,
+    F_DERIVED | F_RFC3961_ENC | F_RFC3961_KDF,
     _krb5_evp_encrypt,
-    0,
-    NULL
+    16,
+    DES3_prf
 };
 
 #ifdef DES3_OLD_ENCTYPE
 struct _krb5_encryption_type _krb5_enctype_old_des3_cbc_sha1 = {
     ETYPE_OLD_DES3_CBC_SHA1,
     "old-des3-cbc-sha1",
+    NULL,
     8,
     8,
     8,
@@ -181,6 +237,7 @@ struct _krb5_encryption_type _krb5_enctype_old_des3_cbc_sha1 = {
 struct _krb5_encryption_type _krb5_enctype_des3_cbc_none = {
     ETYPE_DES3_CBC_NONE,
     "des3-cbc-none",
+    NULL,
     8,
     8,
     0,
@@ -223,6 +280,6 @@ _krb5_DES3_random_to_key(krb5_context context,
     for (i = 0; i < 3; i++) {
 	DES_set_odd_parity(&k[i]);
 	if(DES_is_weak_key(&k[i]))
-	    _krb5_xor(&k[i], (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
+	    _krb5_xor8(k[i], (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
     }
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-evp.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-evp.c
index 158c9879d..10d862533 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-evp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-evp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-evp.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-evp.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -74,10 +74,8 @@ _krb5_evp_encrypt(krb5_context context,
 	/* alloca ? */
 	size_t len2 = EVP_CIPHER_CTX_iv_length(c);
 	void *loiv = malloc(len2);
-	if (loiv == NULL) {
-	    krb5_clear_error_message(context);
-	    return ENOMEM;
-	}
+	if (loiv == NULL)
+	    return krb5_enomem(context);
 	memset(loiv, 0, len2);
 	EVP_CipherInit_ex(c, NULL, NULL, NULL, loiv, -1);
 	free(loiv);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-null.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-null.c
index d15e3147e..f82051230 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-null.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-null.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-null.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-null.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -40,13 +40,16 @@
 #endif
 
 static struct _krb5_key_type keytype_null = {
-    ENCTYPE_NULL,
+    KRB5_ENCTYPE_NULL,
     "null",
     0,
     0,
     0,
     NULL,
     NULL,
+    NULL,
+    NULL,
+    NULL,
     NULL
 };
 
@@ -86,6 +89,7 @@ NULL_encrypt(krb5_context context,
 struct _krb5_encryption_type _krb5_enctype_null = {
     ETYPE_NULL,
     "null",
+    NULL,
     1,
     1,
     0,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-pk.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-pk.c
index f4cfc08d8..29e1501d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-pk.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-pk.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-pk.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto-pk.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -37,7 +37,7 @@
 
 #include <krb5/pkinit_asn1.h>
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pk_octetstring2key(krb5_context context,
 			 krb5_enctype type,
 			 const void *dhdata,
@@ -63,16 +63,13 @@ _krb5_pk_octetstring2key(krb5_context context,
     keylen = (et->keytype->bits + 7) / 8;
 
     keydata = malloc(keylen);
-    if (keydata == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (keydata == NULL)
+	return krb5_enomem(context);
 
     m = EVP_MD_CTX_create();
     if (m == NULL) {
 	free(keydata);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     counter = 0;
@@ -196,7 +193,7 @@ encode_otherinfo(krb5_context context,
 
 
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pk_kdf(krb5_context context,
 	     const struct AlgorithmIdentifier *ai,
 	     const void *dhdata,
@@ -250,10 +247,8 @@ _krb5_pk_kdf(krb5_context context,
     keylen = (et->keytype->bits + 7) / 8;
 
     keydata = malloc(keylen);
-    if (keydata == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (keydata == NULL)
+	return krb5_enomem(context);
 
     ret = encode_otherinfo(context, ai, client, server,
 			   enctype, as_req, pk_as_rep, ticket, &other);
@@ -266,8 +261,7 @@ _krb5_pk_kdf(krb5_context context,
     if (m == NULL) {
 	free(keydata);
 	free(other.data);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     offset = 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-rand.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-rand.c
index 2539c0009..c4197003b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-rand.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-rand.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-rand.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: crypto-rand.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -35,6 +35,9 @@
 
 #include "krb5_locl.h"
 
+#undef HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+
 #define ENTROPY_NEEDED 128
 
 static HEIMDAL_MUTEX crypto_mutex = HEIMDAL_MUTEX_INITIALIZER;
@@ -42,6 +45,7 @@ static HEIMDAL_MUTEX crypto_mutex = HEIMDAL_MUTEX_INITIALIZER;
 static int
 seed_something(void)
 {
+#ifndef NO_RANDFILE
     char buf[1024], seedfile[256];
 
     /* If there is a seed file, load it. But such a file cannot be trusted,
@@ -60,52 +64,91 @@ seed_something(void)
 	    seedfile[0] = '\0';
     } else
 	seedfile[0] = '\0';
+#endif
 
     /* Calling RAND_status() will try to use /dev/urandom if it exists so
        we do not have to deal with it. */
     if (RAND_status() != 1) {
-#ifndef _WIN32
-	krb5_context context;
-	const char *p;
-
-	/* Try using egd */
-	if (!krb5_init_context(&context)) {
-	    p = krb5_config_get_string(context, NULL, "libdefaults",
-				       "egd_socket", NULL);
-	    if (p != NULL)
-		RAND_egd_bytes(p, ENTROPY_NEEDED);
-	    krb5_free_context(context);
-	}
-#else
 	/* TODO: Once a Windows CryptoAPI RAND method is defined, we
 	   can use that and failover to another method. */
-#endif
     }
 
     if (RAND_status() == 1)	{
+#ifndef NO_RANDFILE
 	/* Update the seed file */
 	if (seedfile[0])
 	    RAND_write_file(seedfile);
+#endif
 
 	return 0;
     } else
 	return -1;
 }
 
-KRB5_LIB_FUNCTION void KRB5_LIB_CALL
-krb5_generate_random_block(void *buf, size_t len)
+/**
+ * Fill buffer buf with len bytes of PRNG randomness that is ok to use
+ * for key generation, padding and public diclosing the randomness w/o
+ * disclosing the randomness source.
+ *
+ * This function can fail, and callers must check the return value.
+ *
+ * @param buf a buffer to fill with randomness
+ * @param len length of memory that buf points to.
+ *
+ * @return return 0 on success or HEIM_ERR_RANDOM_OFFLINE if the
+ * funcation failed to initialize the randomness source.
+ *
+ * @ingroup krb5_crypto
+ */
+
+HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_generate_random(void *buf, size_t len)
 {
     static int rng_initialized = 0;
+    int ret;
 
     HEIMDAL_MUTEX_lock(&crypto_mutex);
     if (!rng_initialized) {
-	if (seed_something())
-	    krb5_abortx(NULL, "Fatal: could not seed the "
-			"random number generator");
-
+	if (seed_something()) {
+            HEIMDAL_MUTEX_unlock(&crypto_mutex);
+	    return HEIM_ERR_RANDOM_OFFLINE;
+        }
 	rng_initialized = 1;
     }
-    HEIMDAL_MUTEX_unlock(&crypto_mutex);
     if (RAND_bytes(buf, len) <= 0)
+	ret = HEIM_ERR_RANDOM_OFFLINE;
+    else
+	ret = 0;
+    HEIMDAL_MUTEX_unlock(&crypto_mutex);
+
+    return ret;
+}
+
+/**
+ * Fill buffer buf with len bytes of PRNG randomness that is ok to use
+ * for key generation, padding and public diclosing the randomness w/o
+ * disclosing the randomness source.
+ *
+ * This function can NOT fail, instead it will abort() and program will crash.
+ *
+ * If this function is called after a successful krb5_init_context(),
+ * the chance of it failing is low due to that krb5_init_context()
+ * pulls out some random, and quite commonly the randomness sources
+ * will not fail once it have started to produce good output,
+ * /dev/urandom behavies that way.
+ *
+ * @param buf a buffer to fill with randomness
+ * @param len length of memory that buf points to.
+ *
+ * @ingroup krb5_crypto
+ */
+
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_generate_random_block(void *buf, size_t len)
+{
+    int ret = krb5_generate_random(buf, len);
+    if (ret)
 	krb5_abortx(NULL, "Failed to generate random block");
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-stubs.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-stubs.c
index d2a992261..955e3d29e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-stubs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto-stubs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto-stubs.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: crypto-stubs.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -51,12 +51,7 @@ krb5_init_context(krb5_context *context)
     if(!p)
         return ENOMEM;
 
-    p->mutex = malloc(sizeof(HEIMDAL_MUTEX));
-    if (p->mutex == NULL) {
-        free(p);
-        return ENOMEM;
-    }
-    HEIMDAL_MUTEX_init(p->mutex);
+    HEIMDAL_MUTEX_init(&p->mutex);
 
     *context = p;
     return 0;
@@ -67,8 +62,7 @@ krb5_free_context(krb5_context context)
 {
     krb5_clear_error_message(context);
 
-    HEIMDAL_MUTEX_destroy(context->mutex);
-    free(context->mutex);
+    HEIMDAL_MUTEX_destroy(&context->mutex);
     if (context->flags & KRB5_CTX_F_SOCKETS_INITIALIZED) {
         rk_SOCK_EXIT();
     }
@@ -77,7 +71,7 @@ krb5_free_context(krb5_context context)
     free(context);
 }
 
-krb5_boolean
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 _krb5_homedir_access(krb5_context context) {
     return 0;
 }
@@ -92,6 +86,15 @@ krb5_log(krb5_context context,
     return 0;
 }
 
+void KRB5_LIB_FUNCTION
+_krb5_debug(krb5_context context,
+	    int level,
+	    const char *fmt,
+	    ...)
+{
+}
+
+
 /* This function is currently just used to get the location of the EGD
  * socket. If we're not using an EGD, then we can just return NULL */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.c b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.c
index bf00dbeab..d31c20077 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -149,10 +149,8 @@ _key_schedule(krb5_context context,
     if (key->schedule != NULL)
 	return 0;
     ALLOC(key->schedule, 1);
-    if(key->schedule == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (key->schedule == NULL)
+	return krb5_enomem(context);
     ret = krb5_data_alloc(key->schedule, kt->schedule_size);
     if(ret) {
 	free(key->schedule);
@@ -181,7 +179,7 @@ SHA1_checksum(krb5_context context,
 }
 
 /* HMAC according to RFC2104 */
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_internal_hmac(krb5_context context,
 		    struct _krb5_checksum_type *cm,
 		    const void *data,
@@ -302,7 +300,7 @@ struct _krb5_checksum_type _krb5_checksum_sha1 = {
     NULL
 };
 
-struct _krb5_checksum_type *
+KRB5_LIB_FUNCTION struct _krb5_checksum_type * KRB5_LIB_CALL
 _krb5_find_checksum(krb5_cksumtype type)
 {
     int i;
@@ -327,10 +325,8 @@ get_checksum_key(krb5_context context,
 	size_t i;
 
 	*key = _new_derived_key(crypto, 0xff/* KRB5_KU_RFC1510_VARIANT */);
-	if(*key == NULL) {
-	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (*key == NULL)
+	    return krb5_enomem(context);
 	ret = krb5_copy_keyblock(context, crypto->key.key, &(*key)->key);
 	if(ret)
 	    return ret;
@@ -642,7 +638,7 @@ krb5_checksum_disable(krb5_context context,
  *                                                          *
  ************************************************************/
 
-struct _krb5_encryption_type *
+KRB5_LIB_FUNCTION struct _krb5_encryption_type * KRB5_LIB_CALL
 _krb5_find_enctype(krb5_enctype type)
 {
     int i;
@@ -668,10 +664,8 @@ krb5_enctype_to_string(krb5_context context,
 	return KRB5_PROG_ETYPE_NOSUPP;
     }
     *string = strdup(e->name);
-    if(*string == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*string == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -681,11 +675,17 @@ krb5_string_to_enctype(krb5_context context,
 		       krb5_enctype *etype)
 {
     int i;
-    for(i = 0; i < _krb5_num_etypes; i++)
+    for(i = 0; i < _krb5_num_etypes; i++) {
 	if(strcasecmp(_krb5_etypes[i]->name, string) == 0){
 	    *etype = _krb5_etypes[i]->type;
 	    return 0;
 	}
+	if(_krb5_etypes[i]->alias != NULL &&
+	   strcasecmp(_krb5_etypes[i]->alias, string) == 0){
+	    *etype = _krb5_etypes[i]->type;
+	    return 0;
+	}
+    }
     krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
 			    N_("encryption type %s not supported", ""),
 			    string);
@@ -792,7 +792,6 @@ krb5_cksumtype_valid(krb5_context context,
     return 0;
 }
 
-
 static krb5_boolean
 derived_crypto(krb5_context context,
 	       krb5_crypto crypto)
@@ -800,13 +799,6 @@ derived_crypto(krb5_context context,
     return (crypto->et->flags & F_DERIVED) != 0;
 }
 
-static krb5_boolean
-special_crypto(krb5_context context,
-	       krb5_crypto crypto)
-{
-    return (crypto->et->flags & F_SPECIAL) != 0;
-}
-
 #define CHECKSUMSIZE(C) ((C)->checksumsize)
 #define CHECKSUMTYPE(C) ((C)->type)
 
@@ -832,10 +824,8 @@ encrypt_internal_derived(krb5_context context,
     block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
     total_sz = block_sz + checksum_sz;
     p = calloc(1, total_sz);
-    if(p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (p == NULL)
+	return krb5_enomem(context);
 
     q = p;
     krb5_generate_random_block(q, et->confoundersize); /* XXX */
@@ -876,6 +866,85 @@ encrypt_internal_derived(krb5_context context,
     return ret;
 }
 
+static krb5_error_code
+encrypt_internal_enc_then_cksum(krb5_context context,
+				krb5_crypto crypto,
+				unsigned usage,
+				const void *data,
+				size_t len,
+				krb5_data *result,
+				void *ivec)
+{
+    size_t sz, block_sz, checksum_sz, total_sz;
+    Checksum cksum;
+    unsigned char *p, *q, *ivc = NULL;
+    krb5_error_code ret;
+    struct _krb5_key_data *dkey;
+    const struct _krb5_encryption_type *et = crypto->et;
+
+    checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
+
+    sz = et->confoundersize + len;
+    block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
+    total_sz = block_sz + checksum_sz;
+    p = calloc(1, total_sz);
+    if (p == NULL)
+	return krb5_enomem(context);
+
+    q = p;
+    krb5_generate_random_block(q, et->confoundersize); /* XXX */
+    q += et->confoundersize;
+    memcpy(q, data, len);
+
+    ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+    if(ret)
+	goto fail;
+    ret = _key_schedule(context, dkey);
+    if(ret)
+	goto fail;
+
+    /* XXX EVP style update API would avoid needing to allocate here */
+    ivc = malloc(et->blocksize + block_sz);
+    if (ivc == NULL) {
+	ret = krb5_enomem(context);
+	goto fail;
+    }
+    if (ivec)
+	memcpy(ivc, ivec, et->blocksize);
+    else
+	memset(ivc, 0, et->blocksize);
+
+    ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
+    if (ret)
+	goto fail;
+    memcpy(&ivc[et->blocksize], p, block_sz);
+
+    ret = create_checksum(context,
+			  et->keyed_checksum,
+			  crypto,
+			  INTEGRITY_USAGE(usage),
+			  ivc,
+			  et->blocksize + block_sz,
+			  &cksum);
+    if(ret == 0 && cksum.checksum.length != checksum_sz) {
+	free_Checksum (&cksum);
+	krb5_clear_error_message (context);
+	ret = KRB5_CRYPTO_INTERNAL;
+    }
+    if(ret)
+	goto fail;
+    memcpy(p + block_sz, cksum.checksum.data, cksum.checksum.length);
+    free_Checksum (&cksum);
+    result->data = p;
+    result->length = total_sz;
+    free(ivc);
+    return 0;
+ fail:
+    memset_s(p, total_sz, 0, total_sz);
+    free(p);
+    free(ivc);
+    return ret;
+}
 
 static krb5_error_code
 encrypt_internal(krb5_context context,
@@ -896,10 +965,8 @@ encrypt_internal(krb5_context context,
     sz = et->confoundersize + checksum_sz + len;
     block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
     p = calloc(1, block_sz);
-    if(p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (p == NULL)
+	return krb5_enomem(context);
 
     q = p;
     krb5_generate_random_block(q, et->confoundersize); /* XXX */
@@ -958,10 +1025,8 @@ encrypt_internal_special(krb5_context context,
     krb5_error_code ret;
 
     tmp = malloc (sz);
-    if (tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (tmp == NULL)
+	return krb5_enomem(context);
     p = tmp;
     memset (p, 0, cksum_sz);
     p += cksum_sz;
@@ -1010,10 +1075,8 @@ decrypt_internal_derived(krb5_context context,
     }
 
     p = malloc(len);
-    if(len != 0 && p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (len != 0 && p == NULL)
+	return krb5_enomem(context);
     memcpy(p, data, len);
 
     len -= checksum_sz;
@@ -1053,8 +1116,91 @@ decrypt_internal_derived(krb5_context context,
     result->data = realloc(p, l);
     if(result->data == NULL && l != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
+    }
+    result->length = l;
+    return 0;
+}
+
+static krb5_error_code
+decrypt_internal_enc_then_cksum(krb5_context context,
+				krb5_crypto crypto,
+				unsigned usage,
+				void *data,
+				size_t len,
+				krb5_data *result,
+				void *ivec)
+{
+    size_t checksum_sz;
+    Checksum cksum;
+    unsigned char *p;
+    krb5_error_code ret;
+    struct _krb5_key_data *dkey;
+    struct _krb5_encryption_type *et = crypto->et;
+    unsigned long l;
+
+    checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
+    if (len < checksum_sz + et->confoundersize) {
+	krb5_set_error_message(context, KRB5_BAD_MSIZE,
+			       N_("Encrypted data shorter then "
+				  "checksum + confunder", ""));
+	return KRB5_BAD_MSIZE;
+    }
+
+    if (((len - checksum_sz) % et->padsize) != 0) {
+	krb5_clear_error_message(context);
+	return KRB5_BAD_MSIZE;
+    }
+
+    len -= checksum_sz;
+
+    p = malloc(et->blocksize + len);
+    if (p == NULL)
+	return krb5_enomem(context);
+
+    if (ivec)
+	memcpy(p, ivec, et->blocksize);
+    else
+	memset(p, 0, et->blocksize);
+    memcpy(&p[et->blocksize], data, len);
+
+    cksum.checksum.data   = (unsigned char *)data + len;
+    cksum.checksum.length = checksum_sz;
+    cksum.cksumtype       = CHECKSUMTYPE(et->keyed_checksum);
+
+    ret = verify_checksum(context,
+			  crypto,
+			  INTEGRITY_USAGE(usage),
+			  p,
+			  et->blocksize + len,
+			  &cksum);
+    if(ret) {
+	free(p);
+	return ret;
+    }
+
+    ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+    if(ret) {
+	free(p);
+	return ret;
+    }
+    ret = _key_schedule(context, dkey);
+    if(ret) {
+	free(p);
+	return ret;
+    }
+    ret = (*et->encrypt)(context, dkey, &p[et->blocksize], len, 0, usage, ivec);
+    if (ret) {
+	free(p);
+	return ret;
+    }
+
+    l = len - et->confoundersize;
+    memmove(p, p + et->blocksize + et->confoundersize, l);
+    result->data = realloc(p, l);
+    if(result->data == NULL && l != 0) {
+	free(p);
+	return krb5_enomem(context);
     }
     result->length = l;
     return 0;
@@ -1087,10 +1233,8 @@ decrypt_internal(krb5_context context,
     }
 
     p = malloc(len);
-    if(len != 0 && p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (len != 0 && p == NULL)
+	return krb5_enomem(context);
     memcpy(p, data, len);
 
     ret = _key_schedule(context, &crypto->key);
@@ -1121,8 +1265,7 @@ decrypt_internal(krb5_context context,
     result->data = realloc(p, l);
     if(result->data == NULL && l != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     result->length = l;
     return 0;
@@ -1155,10 +1298,8 @@ decrypt_internal_special(krb5_context context,
     }
 
     p = malloc (len);
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (p == NULL)
+	return krb5_enomem(context);
     memcpy(p, data, len);
 
     ret = (*et->encrypt)(context, &crypto->key, p, len, FALSE, usage, ivec);
@@ -1171,15 +1312,14 @@ decrypt_internal_special(krb5_context context,
     result->data = realloc(p, sz);
     if(result->data == NULL && sz != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     result->length = sz;
     return 0;
 }
 
 static krb5_crypto_iov *
-find_iv(krb5_crypto_iov *data, size_t num_data, unsigned type)
+iov_find(krb5_crypto_iov *data, size_t num_data, unsigned type)
 {
     size_t i;
     for (i = 0; i < num_data; i++)
@@ -1188,6 +1328,154 @@ find_iv(krb5_crypto_iov *data, size_t num_data, unsigned type)
     return NULL;
 }
 
+static size_t
+iov_enc_data_len(krb5_crypto_iov *data, int num_data)
+{
+    size_t i, len;
+
+    for (len = 0, i = 0; i < num_data; i++) {
+	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
+	    continue;
+	len += data[i].data.length;
+    }
+
+    return len;
+}
+
+static size_t
+iov_sign_data_len(krb5_crypto_iov *data, int num_data)
+{
+    size_t i, len;
+
+    for (len = 0, i = 0; i < num_data; i++) {
+	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
+	    data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
+	    continue;
+	len += data[i].data.length;
+    }
+
+    return len;
+}
+
+static krb5_error_code
+iov_coalesce(krb5_context context,
+	     krb5_data *prefix,
+	     krb5_crypto_iov *data,
+	     int num_data,
+	     krb5_boolean inc_sign_data,
+	     krb5_data *out)
+{
+    unsigned char *p, *q;
+    krb5_crypto_iov *hiv, *piv;
+    size_t len;
+    unsigned int i;
+
+    hiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
+
+    piv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
+
+    len = 0;
+    if (prefix)
+	len += prefix->length;
+    len += hiv->data.length;
+    if (inc_sign_data)
+	len += iov_sign_data_len(data, num_data);
+    else
+	len += iov_enc_data_len(data, num_data);
+    if (piv)
+	len += piv->data.length;
+
+    p = q = malloc(len);
+    if (p == NULL)
+	return krb5_enomem(context);
+
+    if (prefix) {
+	memcpy(q, prefix->data, prefix->length);
+	q += prefix->length;
+    }
+    memcpy(q, hiv->data.data, hiv->data.length);
+    q += hiv->data.length;
+    for (i = 0; i < num_data; i++) {
+	if (data[i].flags == KRB5_CRYPTO_TYPE_DATA ||
+	    (inc_sign_data && data[i].flags == KRB5_CRYPTO_TYPE_SIGN_ONLY)) {
+	    memcpy(q, data[i].data.data, data[i].data.length);
+	    q += data[i].data.length;
+	}
+    }
+    if (piv)
+	memset(q, 0, piv->data.length);
+
+    out->length = len;
+    out->data = p;
+
+    return 0;
+}
+
+static krb5_error_code
+iov_uncoalesce(krb5_context context,
+	       krb5_data *enc_data,
+	       krb5_crypto_iov *data,
+	       int num_data)
+{
+    unsigned char *q = enc_data->data;
+    krb5_crypto_iov *hiv, *piv;
+    unsigned int i;
+
+    hiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
+
+    piv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
+
+    memcpy(hiv->data.data, q, hiv->data.length);
+    q += hiv->data.length;
+
+    for (i = 0; i < num_data; i++) {
+	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
+	    continue;
+	memcpy(data[i].data.data, q, data[i].data.length);
+	q += data[i].data.length;
+    }
+    if (piv)
+	memcpy(piv->data.data, q, piv->data.length);
+
+    return 0;
+}
+
+static krb5_error_code
+iov_pad_validate(const struct _krb5_encryption_type *et,
+		 krb5_crypto_iov *data,
+		 int num_data,
+		 krb5_crypto_iov **ppiv)
+{
+    krb5_crypto_iov *piv;
+    size_t sz, headersz, block_sz, pad_sz, len;
+
+    len = iov_enc_data_len(data, num_data);
+
+    headersz = et->confoundersize;
+
+    sz = headersz + len;
+    block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
+
+    pad_sz = block_sz - sz;
+
+    piv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
+    /* its ok to have no TYPE_PADDING if there is no padding */
+    if (piv == NULL && pad_sz != 0)
+	return KRB5_BAD_MSIZE;
+    if (piv) {
+	if (piv->data.length < pad_sz)
+	    return KRB5_BAD_MSIZE;
+	piv->data.length = pad_sz;
+	if (pad_sz)
+	    memset(piv->data.data, pad_sz, pad_sz);
+	else
+	    piv = NULL;
+    }
+
+    *ppiv = piv;
+    return 0;
+}
+
 /**
  * Inline encrypt a kerberos message
  *
@@ -1220,11 +1508,9 @@ krb5_encrypt_iov_ivec(krb5_context context,
 		      int num_data,
 		      void *ivec)
 {
-    size_t headersz, trailersz, len;
-    int i;
-    size_t sz, block_sz, pad_sz;
+    size_t headersz, trailersz;
     Checksum cksum;
-    unsigned char *p, *q;
+    krb5_data enc_data, sign_data;
     krb5_error_code ret;
     struct _krb5_key_data *dkey;
     const struct _krb5_encryption_type *et = crypto->et;
@@ -1240,147 +1526,126 @@ krb5_encrypt_iov_ivec(krb5_context context,
 	return KRB5_CRYPTO_INTERNAL;
     }
 
+    krb5_data_zero(&enc_data);
+    krb5_data_zero(&sign_data);
+
     headersz = et->confoundersize;
     trailersz = CHECKSUMSIZE(et->keyed_checksum);
 
-    for (len = 0, i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	len += data[i].data.length;
-    }
-
-    sz = headersz + len;
-    block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
-
-    pad_sz = block_sz - sz;
-
     /* header */
-
-    hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
+    hiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
     if (hiv == NULL || hiv->data.length != headersz)
 	return KRB5_BAD_MSIZE;
-
     krb5_generate_random_block(hiv->data.data, hiv->data.length);
 
     /* padding */
-    piv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
-    /* its ok to have no TYPE_PADDING if there is no padding */
-    if (piv == NULL && pad_sz != 0)
-	return KRB5_BAD_MSIZE;
-    if (piv) {
-	if (piv->data.length < pad_sz)
-	    return KRB5_BAD_MSIZE;
-	piv->data.length = pad_sz;
-	if (pad_sz)
-	    memset(piv->data.data, pad_sz, pad_sz);
-	else
-	    piv = NULL;
-    }
+    ret = iov_pad_validate(et, data, num_data, &piv);
+    if(ret)
+	goto cleanup;
 
     /* trailer */
-    tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
-    if (tiv == NULL || tiv->data.length != trailersz)
-	return KRB5_BAD_MSIZE;
-
-    /*
-     * XXX replace with EVP_Sign? at least make create_checksum an iov
-     * function.
-     * XXX CTS EVP is broken, can't handle multi buffers :(
-     */
-
-    len = block_sz;
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
-	    continue;
-	len += data[i].data.length;
+    tiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
+    if (tiv == NULL || tiv->data.length != trailersz) {
+	ret = KRB5_BAD_MSIZE;
+	goto cleanup;
     }
 
-    p = q = malloc(len);
+    if (et->flags & F_ENC_THEN_CKSUM) {
+	unsigned char old_ivec[EVP_MAX_IV_LENGTH];
+	krb5_data ivec_data;
 
-    memcpy(q, hiv->data.data, hiv->data.length);
-    q += hiv->data.length;
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
-	    data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
-	    continue;
-	memcpy(q, data[i].data.data, data[i].data.length);
-	q += data[i].data.length;
+	ret = iov_coalesce(context, NULL, data, num_data, FALSE, &enc_data);
+	if(ret)
+	    goto cleanup;
+
+	ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+	if(ret)
+	    goto cleanup;
+
+	ret = _key_schedule(context, dkey);
+	if(ret)
+	    goto cleanup;
+
+	heim_assert(et->blocksize <= sizeof(old_ivec),
+		    "blocksize too big for ivec buffer");
+
+	if (ivec)
+	    memcpy(old_ivec, ivec, et->blocksize);
+	else
+	    memset(old_ivec, 0, et->blocksize);
+
+	ret = (*et->encrypt)(context, dkey, enc_data.data, enc_data.length,
+			     1, usage, ivec);
+	if(ret)
+	    goto cleanup;
+
+	ret = iov_uncoalesce(context, &enc_data, data, num_data);
+	if(ret)
+	    goto cleanup;
+
+	ivec_data.length = et->blocksize;
+	ivec_data.data = old_ivec;
+
+	ret = iov_coalesce(context, &ivec_data, data, num_data, TRUE, &sign_data);
+	if(ret)
+	    goto cleanup;
+    } else {
+	ret = iov_coalesce(context, NULL, data, num_data, TRUE, &sign_data);
+	if(ret)
+	    goto cleanup;
     }
-    if (piv)
-	memset(q, 0, piv->data.length);
 
     ret = create_checksum(context,
 			  et->keyed_checksum,
 			  crypto,
 			  INTEGRITY_USAGE(usage),
-			  p,
-			  len,
+			  sign_data.data,
+			  sign_data.length,
 			  &cksum);
-    free(p);
     if(ret == 0 && cksum.checksum.length != trailersz) {
 	free_Checksum (&cksum);
 	krb5_clear_error_message (context);
 	ret = KRB5_CRYPTO_INTERNAL;
     }
     if(ret)
-	return ret;
+	goto cleanup;
 
     /* save cksum at end */
     memcpy(tiv->data.data, cksum.checksum.data, cksum.checksum.length);
     free_Checksum (&cksum);
 
-    /* XXX replace with EVP_Cipher */
-    p = q = malloc(block_sz);
-    if(p == NULL)
-	return ENOMEM;
+    if (!(et->flags & F_ENC_THEN_CKSUM)) {
+	ret = iov_coalesce(context, NULL, data, num_data, FALSE, &enc_data);
+	if(ret)
+	    goto cleanup;
 
-    memcpy(q, hiv->data.data, hiv->data.length);
-    q += hiv->data.length;
+	ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+	if(ret)
+	    goto cleanup;
 
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	memcpy(q, data[i].data.data, data[i].data.length);
-	q += data[i].data.length;
-    }
-    if (piv)
-	memset(q, 0, piv->data.length);
+	ret = _key_schedule(context, dkey);
+	if(ret)
+	    goto cleanup;
 
+	ret = (*et->encrypt)(context, dkey, enc_data.data, enc_data.length,
+			     1, usage, ivec);
+	if(ret)
+	    goto cleanup;
 
-    ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
-    if(ret) {
-	free(p);
-	return ret;
-    }
-    ret = _key_schedule(context, dkey);
-    if(ret) {
-	free(p);
-	return ret;
+	ret = iov_uncoalesce(context, &enc_data, data, num_data);
+	if(ret)
+	    goto cleanup;
     }
 
-    ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
-    if (ret) {
-	free(p);
-	return ret;
+cleanup:
+    if (enc_data.data) {
+	memset_s(enc_data.data, enc_data.length, 0, enc_data.length);
+	krb5_data_free(&enc_data);
     }
-
-    /* now copy data back to buffers */
-    q = p;
-
-    memcpy(hiv->data.data, q, hiv->data.length);
-    q += hiv->data.length;
-
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	memcpy(data[i].data.data, q, data[i].data.length);
-	q += data[i].data.length;
+    if (sign_data.data) {
+	memset_s(sign_data.data, sign_data.length, 0, sign_data.length);
+	krb5_data_free(&sign_data);
     }
-    if (piv)
-	memcpy(piv->data.data, q, pad_sz);
-
-    free(p);
-
     return ret;
 }
 
@@ -1413,10 +1678,8 @@ krb5_decrypt_iov_ivec(krb5_context context,
 		      unsigned int num_data,
 		      void *ivec)
 {
-    unsigned int i;
-    size_t headersz, trailersz, len;
     Checksum cksum;
-    unsigned char *p, *q;
+    krb5_data enc_data, sign_data;
     krb5_error_code ret;
     struct _krb5_key_data *dkey;
     struct _krb5_encryption_type *et = crypto->et;
@@ -1427,97 +1690,63 @@ krb5_decrypt_iov_ivec(krb5_context context,
 	return KRB5_CRYPTO_INTERNAL;
     }
 
-    headersz = et->confoundersize;
-
-    hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
-    if (hiv == NULL || hiv->data.length != headersz)
+    /* header */
+    hiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
+    if (hiv == NULL || hiv->data.length != et->confoundersize)
 	return KRB5_BAD_MSIZE;
 
     /* trailer */
-    trailersz = CHECKSUMSIZE(et->keyed_checksum);
-
-    tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
-    if (tiv->data.length != trailersz)
+    tiv = iov_find(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
+    if (tiv->data.length != CHECKSUMSIZE(et->keyed_checksum))
 	return KRB5_BAD_MSIZE;
 
-    /* Find length of data we will decrypt */
-
-    len = headersz;
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	len += data[i].data.length;
-    }
-
-    if ((len % et->padsize) != 0) {
+    /* padding */
+    if ((iov_enc_data_len(data, num_data) % et->padsize) != 0) {
 	krb5_clear_error_message(context);
 	return KRB5_BAD_MSIZE;
     }
 
-    /* XXX replace with EVP_Cipher */
+    krb5_data_zero(&enc_data);
+    krb5_data_zero(&sign_data);
 
-    p = q = malloc(len);
-    if (p == NULL)
-	return ENOMEM;
+    if (!(et->flags & F_ENC_THEN_CKSUM)) {
+	ret = iov_coalesce(context, NULL, data, num_data, FALSE, &enc_data);
+	if(ret)
+	    goto cleanup;
 
-    memcpy(q, hiv->data.data, hiv->data.length);
-    q += hiv->data.length;
+	ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+	if(ret)
+	    goto cleanup;
 
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	memcpy(q, data[i].data.data, data[i].data.length);
-	q += data[i].data.length;
-    }
+	ret = _key_schedule(context, dkey);
+	if(ret)
+	    goto cleanup;
 
-    ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
-    if(ret) {
-	free(p);
-	return ret;
-    }
-    ret = _key_schedule(context, dkey);
-    if(ret) {
-	free(p);
-	return ret;
-    }
+	ret = (*et->encrypt)(context, dkey, enc_data.data, enc_data.length,
+			     0, usage, ivec);
+	if(ret)
+	    goto cleanup;
 
-    ret = (*et->encrypt)(context, dkey, p, len, 0, usage, ivec);
-    if (ret) {
-	free(p);
-	return ret;
-    }
+	ret = iov_uncoalesce(context, &enc_data, data, num_data);
+	if(ret)
+	    goto cleanup;
 
-    /* copy data back to buffers */
-    memcpy(hiv->data.data, p, hiv->data.length);
-    q = p + hiv->data.length;
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
-	    continue;
-	memcpy(data[i].data.data, q, data[i].data.length);
-	q += data[i].data.length;
-    }
+	ret = iov_coalesce(context, NULL, data, num_data, TRUE, &sign_data);
+	if(ret)
+	    goto cleanup;
+    } else {
+	krb5_data ivec_data;
+	static unsigned char zero_ivec[EVP_MAX_IV_LENGTH];
 
-    free(p);
+	heim_assert(et->blocksize <= sizeof(zero_ivec),
+		    "blocksize too big for ivec buffer");
 
-    /* check signature */
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
-	    continue;
-	len += data[i].data.length;
-    }
+	ivec_data.length = et->blocksize;
+	ivec_data.data = ivec ? ivec : zero_ivec;
 
-    p = q = malloc(len);
-    if (p == NULL)
-	return ENOMEM;
-
-    memcpy(q, hiv->data.data, hiv->data.length);
-    q += hiv->data.length;
-    for (i = 0; i < num_data; i++) {
-	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
-	    data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
-	    continue;
-	memcpy(q, data[i].data.data, data[i].data.length);
-	q += data[i].data.length;
+	ret = iov_coalesce(context, &ivec_data, data, num_data, TRUE, &sign_data);
+	if(ret)
+	    goto cleanup;
     }
 
     cksum.checksum.data   = tiv->data.data;
@@ -1527,10 +1756,44 @@ krb5_decrypt_iov_ivec(krb5_context context,
     ret = verify_checksum(context,
 			  crypto,
 			  INTEGRITY_USAGE(usage),
-			  p,
-			  len,
+			  sign_data.data,
+			  sign_data.length,
 			  &cksum);
-    free(p);
+    if(ret)
+	goto cleanup;
+
+    if (et->flags & F_ENC_THEN_CKSUM) {
+	ret = iov_coalesce(context, NULL, data, num_data, FALSE, &enc_data);
+	if(ret)
+	    goto cleanup;
+
+	ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
+	if(ret)
+	    goto cleanup;
+
+	ret = _key_schedule(context, dkey);
+	if(ret)
+	    goto cleanup;
+
+	ret = (*et->encrypt)(context, dkey, enc_data.data, enc_data.length,
+			     0, usage, ivec);
+	if(ret)
+	    goto cleanup;
+
+	ret = iov_uncoalesce(context, &enc_data, data, num_data);
+	if(ret)
+	    goto cleanup;
+    }
+
+cleanup:
+    if (enc_data.data) {
+	memset_s(enc_data.data, enc_data.length, 0, enc_data.length);
+	krb5_data_free(&enc_data);
+    }
+    if (sign_data.data) {
+	memset_s(sign_data.data, sign_data.length, 0, sign_data.length);
+	krb5_data_free(&sign_data);
+    }
     return ret;
 }
 
@@ -1568,7 +1831,7 @@ krb5_create_checksum_iov(krb5_context context,
 	return KRB5_CRYPTO_INTERNAL;
     }
 
-    civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
+    civ = iov_find(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
     if (civ == NULL)
 	return KRB5_BAD_MSIZE;
 
@@ -1647,7 +1910,7 @@ krb5_verify_checksum_iov(krb5_context context,
 	return KRB5_CRYPTO_INTERNAL;
     }
 
-    civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
+    civ = iov_find(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
     if (civ == NULL)
 	return KRB5_BAD_MSIZE;
 
@@ -1756,14 +2019,27 @@ krb5_encrypt_ivec(krb5_context context,
 		  krb5_data *result,
 		  void *ivec)
 {
-    if(derived_crypto(context, crypto))
-	return encrypt_internal_derived(context, crypto, usage,
+    krb5_error_code ret;
+
+    switch (crypto->et->flags & F_CRYPTO_MASK) {
+    case F_RFC3961_ENC:
+	ret = encrypt_internal_derived(context, crypto, usage,
+				       data, len, result, ivec);
+	break;
+    case F_SPECIAL:
+	ret = encrypt_internal_special (context, crypto, usage,
 					data, len, result, ivec);
-    else if (special_crypto(context, crypto))
-	return encrypt_internal_special (context, crypto, usage,
-					 data, len, result, ivec);
-    else
-	return encrypt_internal(context, crypto, data, len, result, ivec);
+	break;
+    case F_ENC_THEN_CKSUM:
+	ret = encrypt_internal_enc_then_cksum(context, crypto, usage,
+					      data, len, result, ivec);
+	break;
+    default:
+	ret = encrypt_internal(context, crypto, data, len, result, ivec);
+	break;
+    }
+
+    return ret;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -1804,14 +2080,27 @@ krb5_decrypt_ivec(krb5_context context,
 		  krb5_data *result,
 		  void *ivec)
 {
-    if(derived_crypto(context, crypto))
-	return decrypt_internal_derived(context, crypto, usage,
-					data, len, result, ivec);
-    else if (special_crypto (context, crypto))
-	return decrypt_internal_special(context, crypto, usage,
-					data, len, result, ivec);
-    else
-	return decrypt_internal(context, crypto, data, len, result, ivec);
+    krb5_error_code ret;
+
+    switch (crypto->et->flags & F_CRYPTO_MASK) {
+    case F_RFC3961_ENC:
+	ret = decrypt_internal_derived(context, crypto, usage,
+				data, len, result, ivec);
+	break;
+    case F_SPECIAL:
+	ret = decrypt_internal_special(context, crypto, usage,
+				       data, len, result, ivec);
+	break;
+    case F_ENC_THEN_CKSUM:
+	ret = decrypt_internal_enc_then_cksum(context, crypto, usage,
+					      data, len, result, ivec);
+	break;
+    default:
+	ret = decrypt_internal(context, crypto, data, len, result, ivec);
+	break;
+    }
+
+    return ret;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -1841,32 +2130,29 @@ krb5_decrypt_EncryptedData(krb5_context context,
  *                                                          *
  ************************************************************/
 
-krb5_error_code
-_krb5_derive_key(krb5_context context,
-		 struct _krb5_encryption_type *et,
-		 struct _krb5_key_data *key,
-		 const void *constant,
-		 size_t len)
+static krb5_error_code
+derive_key_rfc3961(krb5_context context,
+		   struct _krb5_encryption_type *et,
+		   struct _krb5_key_data *key,
+		   const void *constant,
+		   size_t len)
 {
+
     unsigned char *k = NULL;
     unsigned int nblocks = 0, i;
     krb5_error_code ret = 0;
     struct _krb5_key_type *kt = et->keytype;
 
-    ret = _key_schedule(context, key);
-    if(ret)
-	return ret;
     if(et->blocksize * 8 < kt->bits || len != et->blocksize) {
 	nblocks = (kt->bits + et->blocksize * 8 - 1) / (et->blocksize * 8);
 	k = malloc(nblocks * et->blocksize);
 	if(k == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	ret = _krb5_n_fold(constant, len, k, et->blocksize);
 	if (ret) {
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    krb5_enomem(context);
 	    goto out;
 	}
 
@@ -1884,8 +2170,7 @@ _krb5_derive_key(krb5_context context,
 	size_t res_len = (kt->bits + 7) / 8;
 
 	if(len != 0 && c == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	memcpy(c, constant, len);
@@ -1893,43 +2178,113 @@ _krb5_derive_key(krb5_context context,
 	k = malloc(res_len);
 	if(res_len != 0 && k == NULL) {
 	    free(c);
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	ret = _krb5_n_fold(c, len, k, res_len);
 	free(c);
 	if (ret) {
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    krb5_enomem(context);
 	    goto out;
 	}
     }
 
-    /* XXX keytype dependent post-processing */
-    switch(kt->type) {
-    case ETYPE_OLD_DES3_CBC_SHA1:
+    if (kt->type == KRB5_ENCTYPE_OLD_DES3_CBC_SHA1)
 	_krb5_DES3_random_to_key(context, key->key, k, nblocks * et->blocksize);
-	break;
-    case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
-    case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
+    else
 	memcpy(key->key->keyvalue.data, k, key->key->keyvalue.length);
+
+ out:
+    if (k) {
+	memset_s(k, nblocks * et->blocksize, 0, nblocks * et->blocksize);
+	free(k);
+    }
+    return ret;
+}
+
+static krb5_error_code
+derive_key_sp800_hmac(krb5_context context,
+		      struct _krb5_encryption_type *et,
+		      struct _krb5_key_data *key,
+		      const void *constant,
+		      size_t len)
+{
+    krb5_error_code ret;
+    struct _krb5_key_type *kt = et->keytype;
+    krb5_data label;
+    const EVP_MD *md = NULL;
+    const unsigned char *c = constant;
+    size_t key_len;
+    krb5_data K1;
+
+    ret = _krb5_aes_sha2_md_for_enctype(context, kt->type, &md);
+    if (ret)
+	return ret;
+
+    /*
+     * PRF usage: not handled here (output cannot be longer)
+     * Integrity usage: truncated hash (half length)
+     * Encryption usage: base key length
+     */
+    if (len == 5 && (c[4] == 0x99 || c[4] == 0x55))
+	key_len = EVP_MD_size(md) / 2;
+    else
+	key_len = kt->size;
+
+    ret = krb5_data_alloc(&K1, key_len);
+    if (ret)
+	return ret;
+
+    label.data = (void *)constant;
+    label.length = len;
+
+    ret = _krb5_SP800_108_HMAC_KDF(context, &key->key->keyvalue,
+				   &label, NULL, md, &K1);
+    if (ret == 0) {
+	if (key->key->keyvalue.length > key_len)
+	    key->key->keyvalue.length = key_len;
+	memcpy(key->key->keyvalue.data, K1.data, key_len);
+    }
+
+    memset_s(K1.data, K1.length, 0, K1.length);
+    krb5_data_free(&K1);
+
+    return ret;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_derive_key(krb5_context context,
+		 struct _krb5_encryption_type *et,
+		 struct _krb5_key_data *key,
+		 const void *constant,
+		 size_t len)
+{
+    krb5_error_code ret;
+
+    ret = _key_schedule(context, key);
+    if(ret)
+	return ret;
+
+    switch (et->flags & F_KDF_MASK) {
+    case F_RFC3961_KDF:
+	ret = derive_key_rfc3961(context, et, key, constant, len);
+	break;
+    case F_SP800_108_HMAC_KDF:
+	ret = derive_key_sp800_hmac(context, et, key, constant, len);
 	break;
     default:
 	ret = KRB5_CRYPTO_INTERNAL;
 	krb5_set_error_message(context, ret,
 			       N_("derive_key() called with unknown keytype (%u)", ""),
-			       kt->type);
+			       et->keytype->type);
 	break;
     }
- out:
+
     if (key->schedule) {
 	free_key_schedule(context, key, et);
 	key->schedule = NULL;
     }
-    if (k) {
-	memset(k, 0, nblocks * et->blocksize);
-	free(k);
-    }
+
     return ret;
 }
 
@@ -1988,21 +2343,19 @@ _get_derived_key(krb5_context context,
     struct _krb5_key_data *d;
     unsigned char constant[5];
 
+    *key = NULL;
     for(i = 0; i < crypto->num_key_usage; i++)
 	if(crypto->key_usage[i].usage == usage) {
 	    *key = &crypto->key_usage[i].key;
 	    return 0;
 	}
     d = _new_derived_key(crypto, usage);
-    if(d == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-    krb5_copy_keyblock(context, crypto->key.key, &d->key);
-    _krb5_put_int(constant, usage, 5);
-    _krb5_derive_key(context, crypto->et, d, constant, sizeof(constant));
+    if (d == NULL)
+	return krb5_enomem(context);
     *key = d;
-    return 0;
+    krb5_copy_keyblock(context, crypto->key.key, &d->key);
+    _krb5_put_int(constant, usage, sizeof(constant));
+    return _krb5_derive_key(context, crypto->et, d, constant, sizeof(constant));
 }
 
 /**
@@ -2031,11 +2384,9 @@ krb5_crypto_init(krb5_context context,
 {
     krb5_error_code ret;
     ALLOC(*crypto, 1);
-    if(*crypto == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-    if(etype == ETYPE_NULL)
+    if (*crypto == NULL)
+	return krb5_enomem(context);
+    if(etype == (krb5_enctype)ETYPE_NULL)
 	etype = key->keytype;
     (*crypto)->et = _krb5_find_enctype(etype);
     if((*crypto)->et == NULL || ((*crypto)->et->flags & F_DISABLED)) {
@@ -2073,7 +2424,7 @@ free_key_schedule(krb5_context context,
     krb5_free_data(context, key->schedule);
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_key_data(krb5_context context, struct _krb5_key_data *key,
 	      struct _krb5_encryption_type *et)
 {
@@ -2282,6 +2633,47 @@ krb5_allow_weak_crypto(krb5_context context,
     return 0;
 }
 
+/**
+ * Returns is the encryption is strong or weak
+ *
+ * @param context Kerberos 5 context
+ * @param enctype encryption type to probe
+ *
+ * @return Returns true if encryption type is weak or is not supported.
+ *
+ * @ingroup krb5_crypto
+ */
+
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+krb5_is_enctype_weak(krb5_context context, krb5_enctype enctype)
+{
+    struct _krb5_encryption_type *et = _krb5_find_enctype(enctype);
+    if(et == NULL || (et->flags & F_WEAK))
+	return TRUE;
+    return FALSE;
+}
+
+/**
+ * Returns whether the encryption type should use randomly generated salts
+ *
+ * @param context Kerberos 5 context
+ * @param enctype encryption type to probe
+ *
+ * @return Returns true if generated salts should have random component
+ *
+ * @ingroup krb5_crypto
+ */
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+_krb5_enctype_requires_random_salt(krb5_context context,
+				   krb5_enctype enctype)
+{
+    struct _krb5_encryption_type *et;
+
+    et = _krb5_find_enctype (enctype);
+
+    return et && (et->flags & F_SP800_108_HMAC_KDF);
+}
+
 static size_t
 wrapped_length (krb5_context context,
 		krb5_crypto  crypto,
@@ -2554,13 +2946,11 @@ krb5_crypto_fx_cf2(krb5_context context,
     krb5_data_zero(&os1);
     krb5_data_zero(&os2);
 
-    ret = krb5_enctype_keysize(context, enctype, &keysize);
+    ret = krb5_enctype_keybits(context, enctype, &keysize);
     if (ret)
 	return ret;
+    keysize = (keysize + 7) / 8;
 
-    ret = krb5_data_alloc(&res->keyvalue, keysize);
-    if (ret)
-	goto out;
     ret = krb5_crypto_prfplus(context, crypto1, pepper1, keysize, &os1);
     if (ret)
 	goto out;
@@ -2570,13 +2960,12 @@ krb5_crypto_fx_cf2(krb5_context context,
 
     res->keytype = enctype;
     {
-	unsigned char *p1 = os1.data, *p2 = os2.data, *p3 = res->keyvalue.data;
+	unsigned char *p1 = os1.data, *p2 = os2.data;
 	for (i = 0; i < keysize; i++)
-	    p3[i] = p1[i] ^ p2[i];
+	    p1[i] ^= p2[i];
     }
+    ret = krb5_random_to_key(context, enctype, os1.data, keysize, res);
  out:
-    if (ret)
-	krb5_data_free(&res->keyvalue);
     krb5_data_free(&os1);
     krb5_data_free(&os2);
 
@@ -2617,10 +3006,8 @@ krb5_keytype_to_enctypes (krb5_context context,
     }
 
     ret = malloc(n * sizeof(*ret));
-    if (ret == NULL && n != 0) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
-    }
+    if (ret == NULL && n != 0)
+	return krb5_enomem(context);
     n = 0;
     for (i = _krb5_num_etypes - 1; i >= 0; --i) {
 	if (_krb5_etypes[i]->keytype->type == keytype
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.h b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.h
index fdbb8adbf..f25c05403 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/crypto.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: crypto.h,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: crypto.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
- * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -54,14 +54,22 @@ struct krb5_crypto_data {
 #define CRYPTO_ETYPE(C) ((C)->et->type)
 
 /* bits for `flags' below */
-#define F_KEYED		 1	/* checksum is keyed */
-#define F_CPROOF	 2	/* checksum is collision proof */
-#define F_DERIVED	 4	/* uses derived keys */
-#define F_VARIANT	 8	/* uses `variant' keys (6.4.3) */
-#define F_PSEUDO	16	/* not a real protocol type */
-#define F_SPECIAL	32	/* backwards */
-#define F_DISABLED	64	/* enctype/checksum disabled */
-#define F_WEAK	       128	/* enctype is considered weak */
+#define F_KEYED			0x0001	/* checksum is keyed */
+#define F_CPROOF		0x0002	/* checksum is collision proof */
+#define F_DERIVED		0x0004	/* uses derived keys */
+#define F_VARIANT		0x0008	/* uses `variant' keys (6.4.3) */
+#define F_PSEUDO		0x0010	/* not a real protocol type */
+#define F_DISABLED		0x0020	/* enctype/checksum disabled */
+#define F_WEAK			0x0040	/* enctype is considered weak */
+
+#define F_RFC3961_ENC		0x0100	/* RFC3961 simplified profile */
+#define F_SPECIAL		0x0200	/* backwards */
+#define F_ENC_THEN_CKSUM	0x0400  /* checksum is over encrypted data */
+#define F_CRYPTO_MASK		0x0F00
+
+#define F_RFC3961_KDF		0x1000	/* RFC3961 KDF */
+#define F_SP800_108_HMAC_KDF	0x2000	/* SP800-108 HMAC KDF */
+#define F_KDF_MASK		0xF000
 
 struct salt_type {
     krb5_salttype type;
@@ -105,6 +113,7 @@ struct _krb5_checksum_type {
 struct _krb5_encryption_type {
     krb5_enctype type;
     const char *name;
+    const char *alias;
     size_t blocksize;
     size_t padsize;
     size_t confoundersize;
@@ -139,15 +148,19 @@ extern struct _krb5_checksum_type _krb5_checksum_rsa_md5;
 extern struct _krb5_checksum_type _krb5_checksum_hmac_sha1_des3;
 extern struct _krb5_checksum_type _krb5_checksum_hmac_sha1_aes128;
 extern struct _krb5_checksum_type _krb5_checksum_hmac_sha1_aes256;
+extern struct _krb5_checksum_type _krb5_checksum_hmac_sha256_128_aes128;
+extern struct _krb5_checksum_type _krb5_checksum_hmac_sha384_192_aes256;
 extern struct _krb5_checksum_type _krb5_checksum_hmac_md5;
 extern struct _krb5_checksum_type _krb5_checksum_sha1;
+extern struct _krb5_checksum_type _krb5_checksum_sha2;
 
 extern struct _krb5_checksum_type *_krb5_checksum_types[];
 extern int _krb5_num_checksums;
 
 /* Salts */
 
-extern struct salt_type _krb5_AES_salt[];
+extern struct salt_type _krb5_AES_SHA1_salt[];
+extern struct salt_type _krb5_AES_SHA2_salt[];
 extern struct salt_type _krb5_arcfour_salt[];
 extern struct salt_type _krb5_des_salt[];
 extern struct salt_type _krb5_des3_salt[];
@@ -157,6 +170,8 @@ extern struct salt_type _krb5_des3_salt_derived[];
 
 extern struct _krb5_encryption_type _krb5_enctype_aes256_cts_hmac_sha1;
 extern struct _krb5_encryption_type _krb5_enctype_aes128_cts_hmac_sha1;
+extern struct _krb5_encryption_type _krb5_enctype_aes128_cts_hmac_sha256_128;
+extern struct _krb5_encryption_type _krb5_enctype_aes256_cts_hmac_sha384_192;
 extern struct _krb5_encryption_type _krb5_enctype_des3_cbc_sha1;
 extern struct _krb5_encryption_type _krb5_enctype_des3_cbc_md5;
 extern struct _krb5_encryption_type _krb5_enctype_des3_cbc_none;
@@ -174,8 +189,15 @@ extern struct _krb5_encryption_type _krb5_enctype_null;
 extern struct _krb5_encryption_type *_krb5_etypes[];
 extern int _krb5_num_etypes;
 
+/* NO_HCRYPTO_POLLUTION is defined in pkinit-ec.c.  See commentary there. */
+#ifndef NO_HCRYPTO_POLLUTION
 /* Interface to the EVP crypto layer provided by hcrypto */
 struct _krb5_evp_schedule {
+    /*
+     * Normally we'd say EVP_CIPHER_CTX here, but!  this header gets
+     * included in lib/krb5/pkinit-ec.ck
+     */
     EVP_CIPHER_CTX ectx;
     EVP_CIPHER_CTX dctx;
 };
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/data.c b/crypto/external/bsd/heimdal/dist/lib/krb5/data.c
index beffe6fc6..f210db4f7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/data.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/data.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: data.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: data.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -64,8 +64,7 @@ krb5_data_zero(krb5_data *p)
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_data_free(krb5_data *p)
 {
-    if(p->data != NULL)
-	free(p->data);
+    free(p->data);
     krb5_data_zero(p);
 }
 
@@ -178,10 +177,8 @@ krb5_copy_data(krb5_context context,
 {
     krb5_error_code ret;
     ALLOC(*outdata, 1);
-    if(*outdata == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
-    }
+    if(*outdata == NULL)
+	return krb5_enomem(context);
     ret = der_copy_octet_string(indata, *outdata);
     if(ret) {
 	krb5_clear_error_message (context);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.c b/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.c
new file mode 100644
index 000000000..72025feeb
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.c
@@ -0,0 +1,33 @@
+/*	$NetBSD: db_plugin.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ */
+
+#include "krb5_locl.h"
+#include "db_plugin.h"
+
+/* Default plugin (DB using binary search of sorted text file) follows */
+static heim_base_once_t db_plugins_once = HEIM_BASE_ONCE_INIT;
+
+static krb5_error_code KRB5_LIB_CALL
+db_plugins_plcallback(krb5_context context, const void *plug, void *plugctx,
+		      void *userctx)
+{
+    return 0;
+}
+
+static void
+db_plugins_init(void *arg)
+{
+    krb5_context context = arg;
+    (void)_krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_DB,
+			     KRB5_PLUGIN_DB_VERSION_0, 0, NULL,
+			     db_plugins_plcallback);
+}
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_load_db_plugins(krb5_context context)
+{
+    heim_base_once_f(&db_plugins_once, context, db_plugins_init);
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.h
new file mode 100644
index 000000000..9b8095ae6
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/db_plugin.h
@@ -0,0 +1,70 @@
+/*	$NetBSD: db_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Id */
+
+#ifndef HEIMDAL_KRB5_DB_PLUGIN_H
+#define HEIMDAL_KRB5_DB_PLUGIN_H 1
+
+#define KRB5_PLUGIN_DB "krb5_db_plug"
+#define KRB5_PLUGIN_DB_VERSION_0 0
+
+/** @struct krb5plugin_db_ftable_desc
+ *
+ * @brief Description of the krb5 DB plugin facility.
+ *
+ * The krb5_aname_to_lname(3) function's DB rule is pluggable.  The
+ * plugin is named KRB5_PLUGIN_DB ("krb5_db_plug"), with a single minor
+ * version, KRB5_PLUGIN_DB_VERSION_0 (0).
+ *
+ * The plugin consists of a data symbol referencing a structure of type
+ * krb5plugin_db_ftable_desc, with three fields:
+ *
+ * @param init          Plugin initialization function (see krb5-plugin(7))
+ *
+ * @param minor_version The plugin minor version number (0)
+ *
+ * @param fini          Plugin finalization function
+ *
+ * The init entry point is expected to call heim_db_register().  The
+ * fini entry point is expected to do nothing.
+ *
+ * @ingroup krb5_support
+ */
+typedef struct krb5plugin_db_ftable_desc {
+    int			minor_version;
+    krb5_error_code	(KRB5_LIB_CALL *init)(krb5_context, void **);
+    void		(KRB5_LIB_CALL *fini)(void *);
+} krb5plugin_db_ftable;
+
+#endif /* HEIMDAL_KRB5_DB_PLUGIN_H */
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/dcache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/dcache.c
new file mode 100644
index 000000000..ff1f42c4f
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/dcache.c
@@ -0,0 +1,701 @@
+/*	$NetBSD: dcache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb5_locl.h"
+
+typedef struct krb5_dcache{
+    krb5_ccache fcache;
+    char *dir;
+    char *name;
+} krb5_dcache;
+
+#define DCACHE(X) ((krb5_dcache*)(X)->data.data)
+#define D2FCACHE(X) ((X)->fcache)
+
+static krb5_error_code KRB5_CALLCONV dcc_close(krb5_context, krb5_ccache);
+static krb5_error_code KRB5_CALLCONV dcc_get_default_name(krb5_context, char **);
+
+
+static char *
+primary_create(krb5_dcache *dc)
+{
+    char *primary = NULL;
+
+    asprintf(&primary, "%s/primary", dc->dir);
+    if (primary == NULL)
+	return NULL;
+
+    return primary;
+}
+
+static int
+is_filename_cacheish(const char *name)
+{
+    return strncmp(name, "tkt", 3) == 0;
+	
+}
+
+static krb5_error_code
+set_default_cache(krb5_context context, krb5_dcache *dc, const char *residual)
+{
+    char *path = NULL, *primary = NULL;
+    krb5_error_code ret;
+    struct iovec iov[2];
+    size_t len;
+    int fd = -1;
+
+    if (!is_filename_cacheish(residual)) {
+	krb5_set_error_message(context, KRB5_CC_FORMAT,
+			       "name %s is not a cache (doesn't start with tkt)", residual);
+	return KRB5_CC_FORMAT;
+    }
+
+    asprintf(&path, "%s/primary-XXXXXX", dc->dir);
+    if (path == NULL)
+	return krb5_enomem(context);
+
+    fd = mkstemp(path);
+    if (fd < 0) {
+	ret = errno;
+	goto out;
+    }
+    rk_cloexec(fd);
+#ifndef _WIN32
+    if (fchmod(fd, S_IRUSR | S_IWUSR) < 0) {
+	ret = errno;
+	goto out;
+    }
+#endif
+    len = strlen(residual);
+
+    iov[0].iov_base = rk_UNCONST(residual);
+    iov[0].iov_len = len;
+    iov[1].iov_base = "\n";
+    iov[1].iov_len = 1;
+
+    if (writev(fd, iov, sizeof(iov)/sizeof(iov[0])) != len + 1) {
+	ret = errno;
+	goto out;
+    }
+    
+    primary = primary_create(dc);
+    if (primary == NULL) {
+	ret = krb5_enomem(context);
+	goto out;
+    }
+
+    if (rename(path, primary) < 0) {
+	ret = errno;
+	goto out;
+    }
+
+    close(fd);
+    fd = -1;
+
+    ret = 0;
+ out:
+    if (fd >= 0) {
+	(void)unlink(path);
+	close(fd);
+    }
+    if (path)
+	free(path);
+    if (primary)
+	free(primary);
+
+    return ret;
+}
+
+static krb5_error_code
+get_default_cache(krb5_context context, krb5_dcache *dc, char **residual)
+{
+    krb5_error_code ret;
+    char buf[MAXPATHLEN];
+    char *primary;
+    FILE *f;
+
+    *residual = NULL;
+    primary = primary_create(dc);
+    if (primary == NULL)
+	return krb5_enomem(context);
+
+    f = fopen(primary, "r");
+    if (f == NULL) {
+	if (errno == ENOENT) {
+	    free(primary);
+	    *residual = strdup("tkt");
+	    if (*residual == NULL)
+		return krb5_enomem(context);
+	    return 0;
+	}
+	ret = errno;
+	krb5_set_error_message(context, ret, "failed to open %s", primary);
+	free(primary);
+	return ret;
+    }
+
+    if (fgets(buf, sizeof(buf), f) == NULL) {
+	ret = ferror(f);
+	fclose(f);
+	krb5_set_error_message(context, ret, "read file %s", primary);
+	free(primary);
+	return ret;
+    }
+    fclose(f);
+	
+    buf[strcspn(buf, "\r\n")] = '\0';
+
+    if (!is_filename_cacheish(buf)) {
+	krb5_set_error_message(context, KRB5_CC_FORMAT,
+			       "name in %s is not a cache (doesn't start with tkt)", primary);
+	free(primary);
+        return KRB5_CC_FORMAT;
+    }
+
+    free(primary);
+
+    *residual = strdup(buf);
+    if (*residual == NULL)
+	return krb5_enomem(context);
+
+    return 0;
+}
+
+
+
+static const char* KRB5_CALLCONV
+dcc_get_name(krb5_context context,
+	     krb5_ccache id)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return dc->name;
+}
+
+
+static krb5_error_code
+verify_directory(krb5_context context, const char *path)
+{
+    struct stat sb;
+
+    if (stat(path, &sb) != 0) {
+	if (errno == ENOENT) {
+	    /* XXX should use mkdirx_np()  */
+	    if (rk_mkdir(path, S_IRWXU) == 0)
+		return 0;
+
+	    krb5_set_error_message(context, ENOENT,
+				   N_("DIR directory %s doesn't exists", ""), path);
+	    return ENOENT;
+	} else {
+	    int ret = errno;
+	    krb5_set_error_message(context, ret,
+				   N_("DIR directory %s is bad: %s", ""), path, strerror(ret));
+	    return errno;
+	}
+    }
+    if (!S_ISDIR(sb.st_mode)) {
+	krb5_set_error_message(context, KRB5_CC_BADNAME, 
+			       N_("DIR directory %s is not a directory", ""), path);
+	return KRB5_CC_BADNAME;
+    }
+
+    return 0;
+}
+
+static void
+dcc_release(krb5_context context, krb5_dcache *dc)
+{
+    if (dc->fcache)
+	krb5_cc_close(context, dc->fcache);
+    if (dc->dir)
+	free(dc->dir);
+    if (dc->name)
+	free(dc->name);
+    memset(dc, 0, sizeof(*dc));
+    free(dc);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_resolve(krb5_context context, krb5_ccache *id, const char *res)
+{
+    char *filename = NULL;
+    krb5_error_code ret;
+    krb5_dcache *dc;
+    const char *p;
+
+    p = res;
+    do {
+	p = strstr(p, "..");
+	if (p && (p == res || ISPATHSEP(p[-1])) && (ISPATHSEP(p[2]) || p[2] == '\0')) {
+	    krb5_set_error_message(context, KRB5_CC_FORMAT,
+				   N_("Path contains a .. component", ""));
+	    return KRB5_CC_FORMAT;
+	}
+	if (p)
+	    p += 3;
+    } while (p);
+
+    dc = calloc(1, sizeof(*dc));
+    if (dc == NULL) {
+	krb5_set_error_message(context, KRB5_CC_NOMEM,
+			       N_("malloc: out of memory", ""));
+	return KRB5_CC_NOMEM;
+    }
+    
+    /* check for explicit component */
+    if (res[0] == ':') {
+	char *q;
+
+	dc->dir = strdup(&res[1]);
+#ifdef _WIN32
+	q = strrchr(dc->dir, '\\');
+	if (q == NULL)
+#endif
+	q = strrchr(dc->dir, '/');
+	if (q) {
+	    *q++ = '\0';
+	} else {
+	    krb5_set_error_message(context, KRB5_CC_FORMAT, N_("Cache not an absolute path: %s", ""), dc->dir);
+	    dcc_release(context, dc);
+	    return KRB5_CC_FORMAT;
+	}
+
+	if (!is_filename_cacheish(q)) {
+	    krb5_set_error_message(context, KRB5_CC_FORMAT,
+				   N_("Name %s is not a cache (doesn't start with tkt)", ""), q);
+	    dcc_release(context, dc);
+	    return KRB5_CC_FORMAT;
+	}
+	
+	ret = verify_directory(context, dc->dir);
+	if (ret) {
+	    dcc_release(context, dc);
+	    return ret;
+	}
+
+	dc->name = strdup(res);
+	if (dc->name == NULL) {
+	    dcc_release(context, dc);
+	    return krb5_enomem(context);
+	}
+
+    } else {
+	char *residual;
+	size_t len;
+
+	dc->dir = strdup(res);
+	if (dc->dir == NULL) {
+	    dcc_release(context, dc);
+	    return krb5_enomem(context);
+	}
+
+	len = strlen(dc->dir);
+
+	if (ISPATHSEP(dc->dir[len - 1]))
+	    dc->dir[len - 1] = '\0';
+
+	ret = verify_directory(context, dc->dir);
+	if (ret) {
+	    dcc_release(context, dc);
+	    return ret;
+	}
+
+	ret = get_default_cache(context, dc, &residual);
+	if (ret) {
+	    dcc_release(context, dc);
+	    return ret;
+	}
+	asprintf(&dc->name, ":%s/%s", dc->dir, residual);
+	free(residual);
+	if (dc->name == NULL) {
+	    dcc_release(context, dc);
+	    return krb5_enomem(context);
+	}
+    }
+
+    asprintf(&filename, "FILE%s", dc->name);
+    if (filename == NULL) {
+	dcc_release(context, dc);
+	return krb5_enomem(context);
+    }
+
+    ret = krb5_cc_resolve(context, filename, &dc->fcache);
+    free(filename);
+    if (ret) {
+	dcc_release(context, dc);
+	return ret;
+    }
+
+
+    (*id)->data.data = dc;
+    (*id)->data.length = sizeof(*dc);
+    return 0;
+}
+
+static char *
+copy_default_dcc_cache(krb5_context context)
+{
+    const char *defname;
+    krb5_error_code ret;
+    char *name = NULL;
+    size_t len;
+
+    len = strlen(krb5_dcc_ops.prefix);
+
+    defname = krb5_cc_default_name(context);
+    if (defname == NULL ||
+	strncmp(defname, krb5_dcc_ops.prefix, len) != 0 ||
+	defname[len] != ':')
+    {
+	ret = dcc_get_default_name(context, &name);
+	if (ret)
+	    return NULL;
+
+	return name;
+    } else {
+	return strdup(&defname[len + 1]);
+    }
+}
+
+
+static krb5_error_code KRB5_CALLCONV
+dcc_gen_new(krb5_context context, krb5_ccache *id)
+{
+    krb5_error_code ret;
+    char *name = NULL;
+    krb5_dcache *dc;
+    int fd;
+    size_t len;
+
+    name = copy_default_dcc_cache(context);
+    if (name == NULL) {
+	krb5_set_error_message(context, KRB5_CC_FORMAT,
+			       N_("Can't generate DIR caches unless its the default type", ""));
+	return KRB5_CC_FORMAT;
+    }
+
+    len = strlen(krb5_dcc_ops.prefix);
+    if (strncmp(name, krb5_dcc_ops.prefix, len) == 0 && name[len] == ':')
+	++len;
+    else
+	len = 0;
+
+    ret = dcc_resolve(context, id, name + len);
+    free(name);
+    name = NULL;
+    if (ret)
+	return ret;
+
+    dc = DCACHE((*id));
+
+    asprintf(&name, ":%s/tktXXXXXX", dc->dir);
+    if (name == NULL) {
+	dcc_close(context, *id);
+	return krb5_enomem(context);
+    }
+
+    fd = mkstemp(&name[1]);
+    if (fd < 0) {
+	dcc_close(context, *id);
+	return krb5_enomem(context);
+    }
+    close(fd);
+
+    free(dc->name);
+    dc->name = name;
+
+    return 0;
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_initialize(krb5_context context,
+	       krb5_ccache id,
+	       krb5_principal primary_principal)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_initialize(context, D2FCACHE(dc), primary_principal);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_close(krb5_context context,
+	  krb5_ccache id)
+{
+    dcc_release(context, DCACHE(id));
+    return 0;
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_destroy(krb5_context context,
+	    krb5_ccache id)
+{
+    krb5_dcache *dc = DCACHE(id);
+    krb5_ccache fcache = D2FCACHE(dc);
+    dc->fcache = NULL;
+    return krb5_cc_destroy(context, fcache);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_store_cred(krb5_context context,
+	       krb5_ccache id,
+	       krb5_creds *creds)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_store_cred(context, D2FCACHE(dc), creds);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_principal(krb5_context context,
+		  krb5_ccache id,
+		  krb5_principal *principal)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_get_principal(context, D2FCACHE(dc), principal);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_first (krb5_context context,
+	       krb5_ccache id,
+	       krb5_cc_cursor *cursor)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_start_seq_get(context, D2FCACHE(dc), cursor);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_next (krb5_context context,
+	      krb5_ccache id,
+	      krb5_cc_cursor *cursor,
+	      krb5_creds *creds)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_next_cred(context, D2FCACHE(dc), cursor, creds);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_end_get (krb5_context context,
+	     krb5_ccache id,
+	     krb5_cc_cursor *cursor)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_end_seq_get(context, D2FCACHE(dc), cursor);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_remove_cred(krb5_context context,
+		 krb5_ccache id,
+		 krb5_flags which,
+		 krb5_creds *cred)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_remove_cred(context, D2FCACHE(dc), which, cred);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_set_flags(krb5_context context,
+	      krb5_ccache id,
+	      krb5_flags flags)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_set_flags(context, D2FCACHE(dc), flags);
+}
+
+static int KRB5_CALLCONV
+dcc_get_version(krb5_context context,
+		krb5_ccache id)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_get_version(context, D2FCACHE(dc));
+}
+
+struct dcache_iter {
+    int first;
+    krb5_dcache *dc;
+};
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
+{
+    struct dcache_iter *iter;
+    krb5_error_code ret;
+    char *name;
+
+    *cursor = NULL;
+    iter = calloc(1, sizeof(*iter));
+    if (iter == NULL)
+	return krb5_enomem(context);
+    iter->first = 1;
+
+    name = copy_default_dcc_cache(context);
+    if (name == NULL) {
+        free(iter);
+	krb5_set_error_message(context, KRB5_CC_FORMAT,
+			       N_("Can't generate DIR caches unless its the default type", ""));
+	return KRB5_CC_FORMAT;
+    }
+
+    ret = dcc_resolve(context, NULL, name);
+    free(name);
+    if (ret) {
+        free(iter);
+        return ret;
+    }
+
+    /* XXX We need to opendir() here */
+
+    *cursor = iter;
+    return 0;
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
+{
+    struct dcache_iter *iter = cursor;
+
+    if (iter == NULL)
+        return krb5_einval(context, 2);
+
+    if (!iter->first) {
+	krb5_clear_error_message(context);
+	return KRB5_CC_END;
+    }
+
+    /* XXX We need to readdir() here */
+    iter->first = 0;
+
+    return KRB5_CC_END;
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_end_cache_get(krb5_context context, krb5_cc_cursor cursor)
+{
+    struct dcache_iter *iter = cursor;
+
+    if (iter == NULL)
+        return krb5_einval(context, 2);
+
+    /* XXX We need to closedir() here */
+    if (iter->dc)
+	dcc_release(context, iter->dc);
+    free(iter);
+    return 0;
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
+{
+    krb5_dcache *dcfrom = DCACHE(from);
+    krb5_dcache *dcto = DCACHE(to);
+    return krb5_cc_move(context, D2FCACHE(dcfrom), D2FCACHE(dcto));
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_default_name(krb5_context context, char **str)
+{
+    return _krb5_expand_default_cc_name(context,
+					KRB5_DEFAULT_CCNAME_DIR,
+					str);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_set_default(krb5_context context, krb5_ccache id)
+{
+    krb5_dcache *dc = DCACHE(id);
+    const char *name;
+
+    name = krb5_cc_get_name(context, D2FCACHE(dc));
+    if (name == NULL)
+	return ENOENT;
+
+    return set_default_cache(context, dc, name);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_last_change_time(context, D2FCACHE(dc), mtime);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat kdc_offset)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_set_kdc_offset(context, D2FCACHE(dc), kdc_offset);
+}
+
+static krb5_error_code KRB5_CALLCONV
+dcc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset)
+{
+    krb5_dcache *dc = DCACHE(id);
+    return krb5_cc_get_kdc_offset(context, D2FCACHE(dc), kdc_offset);
+}
+
+
+/**
+ * Variable containing the DIR based credential cache implemention.
+ *
+ * @ingroup krb5_ccache
+ */
+
+KRB5_LIB_VARIABLE const krb5_cc_ops krb5_dcc_ops = {
+    KRB5_CC_OPS_VERSION,
+    "DIR",
+    dcc_get_name,
+    dcc_resolve,
+    dcc_gen_new,
+    dcc_initialize,
+    dcc_destroy,
+    dcc_close,
+    dcc_store_cred,
+    NULL, /* dcc_retrieve */
+    dcc_get_principal,
+    dcc_get_first,
+    dcc_get_next,
+    dcc_end_get,
+    dcc_remove_cred,
+    dcc_set_flags,
+    dcc_get_version,
+    dcc_get_cache_first,
+    dcc_get_cache_next,
+    dcc_end_cache_get,
+    dcc_move,
+    dcc_get_default_name,
+    dcc_set_default,
+    dcc_lastchange,
+    dcc_set_kdc_offset,
+    dcc_get_kdc_offset
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/deprecated.c b/crypto/external/bsd/heimdal/dist/lib/krb5/deprecated.c
index 44425b4bc..ba4c8ee00 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/deprecated.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/deprecated.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: deprecated.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: deprecated.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2009 Kungliga Tekniska Högskolan
@@ -40,6 +40,7 @@
 
 #include "krb5_locl.h"
 
+
 #undef __attribute__
 #define __attribute__(x)
 
@@ -79,16 +80,14 @@ krb5_keytype_to_enctypes_default (krb5_context context,
     unsigned int i, n;
     krb5_enctype *ret;
 
-    if (keytype != KEYTYPE_DES || context->etypes_des == NULL)
+    if (keytype != (krb5_keytype)KEYTYPE_DES || context->etypes_des == NULL)
 	return krb5_keytype_to_enctypes (context, keytype, len, val);
 
     for (n = 0; context->etypes_des[n]; ++n)
 	;
     ret = malloc (n * sizeof(*ret));
-    if (ret == NULL && n != 0) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ret == NULL && n != 0)
+	return krb5_enomem(context);
     for (i = 0; i < n; ++i)
 	ret[i] = context->etypes_des[i];
     *len = n;
@@ -101,13 +100,13 @@ static struct {
     const char *name;
     krb5_keytype type;
 } keys[] = {
-    { "null", ENCTYPE_NULL },
-    { "des", ETYPE_DES_CBC_CRC },
-    { "des3", ETYPE_OLD_DES3_CBC_SHA1 },
-    { "aes-128", ETYPE_AES128_CTS_HMAC_SHA1_96 },
-    { "aes-256", ETYPE_AES256_CTS_HMAC_SHA1_96 },
-    { "arcfour", ETYPE_ARCFOUR_HMAC_MD5 },
-    { "arcfour-56", ETYPE_ARCFOUR_HMAC_MD5_56 }
+    { "null", KRB5_ENCTYPE_NULL },
+    { "des", KRB5_ENCTYPE_DES_CBC_CRC },
+    { "des3", KRB5_ENCTYPE_OLD_DES3_CBC_SHA1 },
+    { "aes-128", KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96 },
+    { "aes-256", KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96 },
+    { "arcfour", KRB5_ENCTYPE_ARCFOUR_HMAC_MD5 },
+    { "arcfour-56", KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56 }
 };
 
 static int num_keys = sizeof(keys) / sizeof(keys[0]);
@@ -141,11 +140,8 @@ krb5_keytype_to_string(krb5_context context,
 	return KRB5_PROG_KEYTYPE_NOSUPP;
     }
     *string = strdup(name);
-    if(*string == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*string == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -202,10 +198,8 @@ krb5_password_key_proc (krb5_context context,
     char buf[BUFSIZ];
 
     *key = malloc (sizeof (**key));
-    if (*key == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
-    }
+    if (*key == NULL)
+	return krb5_enomem(context);
     if (password == NULL) {
 	if(UI_UTIL_read_pw_string (buf, sizeof(buf), "Password: ", 0)) {
 	    free (*key);
@@ -478,7 +472,7 @@ krb5_free_error_string(krb5_context context, char *str)
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_error_string(krb5_context context, const char *fmt, ...)
-    __attribute__((format (printf, 2, 3)))
+    __attribute__ ((__format__ (__printf__, 2, 3)))
     KRB5_DEPRECATED_FUNCTION("Use X instead")
 {
     va_list ap;
@@ -496,7 +490,8 @@ krb5_set_error_string(krb5_context context, const char *fmt, ...)
  * Deprecated: use krb5_vset_error_message()
  *
  * @param context Kerberos context
- * @param msg error message to free
+ * @param fmt error message to free
+ * @param args variable argument list vector
  *
  * @return Return an error code or 0.
  *
@@ -505,7 +500,7 @@ krb5_set_error_string(krb5_context context, const char *fmt, ...)
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vset_error_string(krb5_context context, const char *fmt, va_list args)
-    __attribute__ ((format (printf, 2, 0)))
+    __attribute__ ((__format__ (__printf__, 2, 0)))
     KRB5_DEPRECATED_FUNCTION("Use X instead")
 {
     krb5_vset_error_message(context, 0, fmt, args);
@@ -613,4 +608,133 @@ krb5_auth_getremoteseqnumber(krb5_context context,
   return 0;
 }
 
+/**
+ * Return the error message in context. On error or no error string,
+ * the function returns NULL.
+ *
+ * @param context Kerberos 5 context
+ *
+ * @return an error string, needs to be freed with
+ * krb5_free_error_message(). The functions return NULL on error.
+ *
+ * @ingroup krb5_error
+ */
+
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
+krb5_get_error_string(krb5_context context)
+    KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead")
+{
+    char *ret = NULL;
+
+    HEIMDAL_MUTEX_lock(&context->mutex);
+    if (context->error_string)
+	ret = strdup(context->error_string);
+    HEIMDAL_MUTEX_unlock(&context->mutex);
+    return ret;
+}
+
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+krb5_have_error_string(krb5_context context)
+    KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead")
+{
+    char *str;
+    HEIMDAL_MUTEX_lock(&context->mutex);
+    str = context->error_string;
+    HEIMDAL_MUTEX_unlock(&context->mutex);
+    return str != NULL;
+}
+
+struct send_to_kdc {
+    krb5_send_to_kdc_func func;
+    void *data;
+};
+
+/*
+ * Send the data `send' to one host from `handle` and get back the reply
+ * in `receive'.
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sendto (krb5_context context,
+	     const krb5_data *send_data,
+	     krb5_krbhst_handle handle,
+	     krb5_data *receive)
+{
+    krb5_error_code ret;
+    krb5_sendto_ctx ctx;
+
+    ret = krb5_sendto_ctx_alloc(context, &ctx);
+    if (ret)
+	return ret;
+    _krb5_sendto_ctx_set_krb5hst(context, ctx, handle);
+
+    ret = krb5_sendto_context(context, ctx, send_data, (char *)_krb5_krbhst_get_realm(handle), receive);
+    krb5_sendto_ctx_free(context, ctx);
+    return ret;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sendto_kdc(krb5_context context,
+		const krb5_data *send_data,
+		const krb5_realm *realm,
+		krb5_data *receive)
+{
+    return krb5_sendto_kdc_flags(context, send_data, realm, receive, 0);
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sendto_kdc_flags(krb5_context context,
+		      const krb5_data *send_data,
+		      const krb5_realm *realm,
+		      krb5_data *receive,
+		      int flags)
+{
+    krb5_error_code ret;
+    krb5_sendto_ctx ctx;
+
+    ret = krb5_sendto_ctx_alloc(context, &ctx);
+    if (ret)
+	return ret;
+    krb5_sendto_ctx_add_flags(ctx, flags);
+    krb5_sendto_ctx_set_func(ctx, _krb5_kdc_retry, NULL);
+
+    ret = krb5_sendto_context(context, ctx, send_data, *realm, receive);
+    krb5_sendto_ctx_free(context, ctx);
+    return ret;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_set_send_to_kdc_func(krb5_context context,
+			  krb5_send_to_kdc_func func,
+			  void *data)
+{
+    free(context->send_to_kdc);
+    if (func == NULL) {
+	context->send_to_kdc = NULL;
+	return 0;
+    }
+
+    context->send_to_kdc = malloc(sizeof(*context->send_to_kdc));
+    if (context->send_to_kdc == NULL) {
+	krb5_set_error_message(context, ENOMEM,
+			       N_("malloc: out of memory", ""));
+	return ENOMEM;
+    }
+
+    context->send_to_kdc->func = func;
+    context->send_to_kdc->data = data;
+    return 0;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_copy_send_to_kdc_func(krb5_context context, krb5_context to)
+{
+    if (context->send_to_kdc)
+	return krb5_set_send_to_kdc_func(to,
+					 context->send_to_kdc->func,
+					 context->send_to_kdc->data);
+    else
+	return krb5_set_send_to_kdc_func(to, NULL, NULL);
+}
+
 #endif /* HEIMDAL_SMALLER */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/derived-key-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/derived-key-test.c
index 9a11688b6..03d1737cc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/derived-key-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/derived-key-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: derived-key-test.c,v 1.1.1.1 2011/04/13 18:15:32 elric Exp $	*/
+/*	$NetBSD: derived-key-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 #include "krb5_locl.h"
 #include <err.h>
 
-enum { MAXSIZE = 24 };
+enum { MAXSIZE = 32 };
 
 static struct testcase {
     krb5_enctype enctype;
@@ -74,7 +74,31 @@ static struct testcase {
     {ETYPE_DES3_CBC_SHA1, {0x00, 0x00, 0x00, 0x01, 0xaa}, 5,
      {0x26, 0xdc, 0xe3, 0x34, 0xb5, 0x45, 0x29, 0x2f, 0x2f, 0xea, 0xb9, 0xa8, 0x70, 0x1a, 0x89, 0xa4, 0xb9, 0x9e, 0xb9, 0x94, 0x2c, 0xec, 0xd0, 0x16},
      {0xf4, 0x8f, 0xfd, 0x6e, 0x83, 0xf8, 0x3e, 0x73, 0x54, 0xe6, 0x94, 0xfd, 0x25, 0x2c, 0xf8, 0x3b, 0xfe, 0x58, 0xf7, 0xd5, 0xba, 0x37, 0xec, 0x5d}},
-    {0}
+    {ETYPE_AES128_CTS_HMAC_SHA256_128, {0x00, 0x00, 0x00, 0x02, 0x99}, 5,
+     {0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28, 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C},
+     {0xB3, 0x1A, 0x01, 0x8A, 0x48, 0xF5, 0x47, 0x76, 0xF4, 0x03, 0xE9, 0xA3, 0x96, 0x32, 0x5D, 0xC3}},
+    {ETYPE_AES128_CTS_HMAC_SHA256_128, {0x00, 0x00, 0x00, 0x02, 0xAA}, 5,
+     {0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28, 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C},
+     {0x9B, 0x19, 0x7D, 0xD1, 0xE8, 0xC5, 0x60, 0x9D, 0x6E, 0x67, 0xC3, 0xE3, 0x7C, 0x62, 0xC7, 0x2E}},
+    {ETYPE_AES128_CTS_HMAC_SHA256_128, {0x00, 0x00, 0x00, 0x02, 0x55}, 5,
+     {0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28, 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C},
+     {0x9F, 0xDA, 0x0E, 0x56, 0xAB, 0x2D, 0x85, 0xE1, 0x56, 0x9A, 0x68, 0x86, 0x96, 0xC2, 0x6A, 0x6C}},
+    {ETYPE_AES256_CTS_HMAC_SHA384_192, {0x00, 0x00, 0x00, 0x02, 0x99}, 5,
+     {0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D, 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
+      0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0, 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52},
+     {0xEF, 0x57, 0x18, 0xBE, 0x86, 0xCC, 0x84, 0x96, 0x3D, 0x8B, 0xBB, 0x50, 0x31, 0xE9, 0xF5, 0xC4,
+      0xBA, 0x41, 0xF2, 0x8F, 0xAF, 0x69, 0xE7, 0x3D }},
+    {ETYPE_AES256_CTS_HMAC_SHA384_192, {0x00, 0x00, 0x00, 0x02, 0xAA}, 5,
+     {0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D, 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
+      0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0, 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52},
+     {0x56, 0xAB, 0x22, 0xBE, 0xE6, 0x3D, 0x82, 0xD7, 0xBC, 0x52, 0x27, 0xF6, 0x77, 0x3F, 0x8E, 0xA7,
+      0xA5, 0xEB, 0x1C, 0x82, 0x51, 0x60, 0xC3, 0x83, 0x12, 0x98, 0x0C, 0x44, 0x2E, 0x5C, 0x7E, 0x49}},
+    {ETYPE_AES256_CTS_HMAC_SHA384_192, {0x00, 0x00, 0x00, 0x02, 0x55}, 5,
+     {0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D, 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
+      0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0, 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52},
+     {0x69, 0xB1, 0x65, 0x14, 0xE3, 0xCD, 0x8E, 0x56, 0xB8, 0x20, 0x10, 0xD5, 0xC7, 0x30, 0x12, 0xB6,
+      0x22, 0xC4, 0xD0, 0x0F, 0xFC, 0x23, 0xED, 0x1F}},
+    {0, {0}, 0, {0}, {0}}
 };
 
 int
@@ -93,8 +117,8 @@ main(int argc, char **argv)
 	krb5_keyblock key;
 	krb5_keyblock *dkey;
 
-	key.keytype = KEYTYPE_DES3;
-	key.keyvalue.length = MAXSIZE;
+	key.keytype = t->enctype;
+	krb5_enctype_keysize(context, t->enctype, &key.keyvalue.length);
 	key.keyvalue.data   = t->key;
 
 	ret = krb5_derive_key(context, &key, t->enctype, t->constant,
@@ -105,7 +129,7 @@ main(int argc, char **argv)
 	    const unsigned char *p = dkey->keyvalue.data;
 	    int i;
 
-	    printf ("derive_key failed\n");
+	    printf ("derive_key failed (enctype %d)\n", t->enctype);
 	    printf ("should be: ");
 	    for (i = 0; i < dkey->keyvalue.length; ++i)
 		printf ("%02x", t->res[i]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/digest.c b/crypto/external/bsd/heimdal/dist/lib/krb5/digest.c
index 1cb0c8b1a..2372e8772 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/digest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/digest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: digest.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: digest.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -56,8 +56,7 @@ krb5_digest_alloc(krb5_context context, krb5_digest *digest)
     d = calloc(1, sizeof(*d));
     if (d == NULL) {
 	*digest = NULL;
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     *digest = d;
 
@@ -108,8 +107,7 @@ krb5_digest_set_server_cb(krb5_context context,
 	free(digest->init.channel);
 	digest->init.channel = NULL;
     }
-    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-    return ENOMEM;
+    return krb5_enomem(context);
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -122,10 +120,8 @@ krb5_digest_set_type(krb5_context context,
 	return EINVAL;
     }
     digest->init.type = strdup(type);
-    if (digest->init.type == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->init.type == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -139,16 +135,13 @@ krb5_digest_set_hostname(krb5_context context,
 	return EINVAL;
     }
     digest->init.hostname = malloc(sizeof(*digest->init.hostname));
-    if (digest->init.hostname == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->init.hostname == NULL)
+	return krb5_enomem(context);
     *digest->init.hostname = strdup(hostname);
     if (*digest->init.hostname == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->init.hostname);
 	digest->init.hostname = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -170,10 +163,8 @@ krb5_digest_set_server_nonce(krb5_context context,
 	return EINVAL;
     }
     digest->request.serverNonce = strdup(nonce);
-    if (digest->request.serverNonce == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.serverNonce == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -194,10 +185,8 @@ krb5_digest_set_opaque(krb5_context context,
 	return EINVAL;
     }
     digest->request.opaque = strdup(opaque);
-    if (digest->request.opaque == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.opaque == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -220,16 +209,13 @@ krb5_digest_set_identifier(krb5_context context,
 	return EINVAL;
     }
     digest->request.identifier = calloc(1, sizeof(*digest->request.identifier));
-    if (digest->request.identifier == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.identifier == NULL)
+	return krb5_enomem(context);
     *digest->request.identifier = strdup(id);
     if (*digest->request.identifier == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.identifier);
 	digest->request.identifier = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -475,16 +461,13 @@ krb5_digest_set_client_nonce(krb5_context context,
     }
     digest->request.clientNonce =
 	calloc(1, sizeof(*digest->request.clientNonce));
-    if (digest->request.clientNonce == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.clientNonce == NULL)
+	return krb5_enomem(context);
     *digest->request.clientNonce = strdup(nonce);
     if (*digest->request.clientNonce == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.clientNonce);
 	digest->request.clientNonce = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -500,10 +483,8 @@ krb5_digest_set_digest(krb5_context context,
 	return EINVAL;
     }
     digest->request.digest = strdup(dgst);
-    if (digest->request.digest == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.digest == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -517,10 +498,8 @@ krb5_digest_set_username(krb5_context context,
 	return EINVAL;
     }
     digest->request.username = strdup(username);
-    if (digest->request.username == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.username == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -534,16 +513,13 @@ krb5_digest_set_authid(krb5_context context,
 	return EINVAL;
     }
     digest->request.authid = malloc(sizeof(*digest->request.authid));
-    if (digest->request.authid == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.authid == NULL)
+	return krb5_enomem(context);
     *digest->request.authid = strdup(authid);
     if (*digest->request.authid == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.authid);
 	digest->request.authid = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -578,16 +554,13 @@ krb5_digest_set_realm(krb5_context context,
 	return EINVAL;
     }
     digest->request.realm = malloc(sizeof(*digest->request.realm));
-    if (digest->request.realm == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.realm == NULL)
+	return krb5_enomem(context);
     *digest->request.realm = strdup(realm);
     if (*digest->request.realm == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.realm);
 	digest->request.realm = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -603,16 +576,13 @@ krb5_digest_set_method(krb5_context context,
 	return EINVAL;
     }
     digest->request.method = malloc(sizeof(*digest->request.method));
-    if (digest->request.method == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.method == NULL)
+	return krb5_enomem(context);
     *digest->request.method = strdup(method);
     if (*digest->request.method == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.method);
 	digest->request.method = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -627,16 +597,13 @@ krb5_digest_set_uri(krb5_context context,
 	return EINVAL;
     }
     digest->request.uri = malloc(sizeof(*digest->request.uri));
-    if (digest->request.uri == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.uri == NULL)
+	return krb5_enomem(context);
     *digest->request.uri = strdup(uri);
     if (*digest->request.uri == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.uri);
 	digest->request.uri = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -653,16 +620,13 @@ krb5_digest_set_nonceCount(krb5_context context,
     }
     digest->request.nonceCount =
 	malloc(sizeof(*digest->request.nonceCount));
-    if (digest->request.nonceCount == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.nonceCount == NULL)
+	return krb5_enomem(context);
     *digest->request.nonceCount = strdup(nonce_count);
     if (*digest->request.nonceCount == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.nonceCount);
 	digest->request.nonceCount = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -677,16 +641,13 @@ krb5_digest_set_qop(krb5_context context,
 	return EINVAL;
     }
     digest->request.qop = malloc(sizeof(*digest->request.qop));
-    if (digest->request.qop == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.qop == NULL)
+	return krb5_enomem(context);
     *digest->request.qop = strdup(qop);
     if (*digest->request.qop == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(digest->request.qop);
 	digest->request.qop = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -697,10 +658,8 @@ krb5_digest_set_responseData(krb5_context context,
 			     const char *response)
 {
     digest->request.responseData = strdup(response);
-    if (digest->request.responseData == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (digest->request.responseData == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -805,8 +764,7 @@ krb5_digest_get_client_binding(krb5_context context,
 	if (*type == NULL || *binding == NULL) {
 	    free(*type);
 	    free(*binding);
-	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
     } else {
 	*type = NULL;
@@ -844,10 +802,8 @@ krb5_ntlm_alloc(krb5_context context,
 		krb5_ntlm *ntlm)
 {
     *ntlm = calloc(1, sizeof(**ntlm));
-    if (*ntlm == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*ntlm == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -935,13 +891,13 @@ krb5_ntlm_init_get_flags(krb5_context context,
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_ntlm_init_get_challange(krb5_context context,
+krb5_ntlm_init_get_challenge(krb5_context context,
 			     krb5_ntlm ntlm,
-			     krb5_data *challange)
+			     krb5_data *challenge)
 {
     krb5_error_code ret;
 
-    ret = der_copy_octet_string(&ntlm->initReply.challange, challange);
+    ret = der_copy_octet_string(&ntlm->initReply.challenge, challenge);
     if (ret)
 	krb5_clear_error_message(context);
 
@@ -968,10 +924,8 @@ krb5_ntlm_init_get_targetname(krb5_context context,
 			      char **name)
 {
     *name = strdup(ntlm->initReply.targetname);
-    if (*name == NULL) {
-	krb5_clear_error_message(context);
-	return ENOMEM;
-    }
+    if (*name == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -1062,10 +1016,8 @@ krb5_ntlm_req_set_username(krb5_context context,
 			   const char *username)
 {
     ntlm->request.username = strdup(username);
-    if (ntlm->request.username == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.username == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -1075,10 +1027,8 @@ krb5_ntlm_req_set_targetname(krb5_context context,
 			     const char *targetname)
 {
     ntlm->request.targetname = strdup(targetname);
-    if (ntlm->request.targetname == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.targetname == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -1088,10 +1038,8 @@ krb5_ntlm_req_set_lm(krb5_context context,
 		     void *hash, size_t len)
 {
     ntlm->request.lm.data = malloc(len);
-    if (ntlm->request.lm.data == NULL && len != 0) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.lm.data == NULL && len != 0)
+	return krb5_enomem(context);
     ntlm->request.lm.length = len;
     memcpy(ntlm->request.lm.data, hash, len);
     return 0;
@@ -1103,10 +1051,8 @@ krb5_ntlm_req_set_ntlm(krb5_context context,
 		       void *hash, size_t len)
 {
     ntlm->request.ntlm.data = malloc(len);
-    if (ntlm->request.ntlm.data == NULL && len != 0) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.ntlm.data == NULL && len != 0)
+	return krb5_enomem(context);
     ntlm->request.ntlm.length = len;
     memcpy(ntlm->request.ntlm.data, hash, len);
     return 0;
@@ -1118,10 +1064,8 @@ krb5_ntlm_req_set_opaque(krb5_context context,
 			 krb5_data *opaque)
 {
     ntlm->request.opaque.data = malloc(opaque->length);
-    if (ntlm->request.opaque.data == NULL && opaque->length != 0) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.opaque.data == NULL && opaque->length != 0)
+	return krb5_enomem(context);
     ntlm->request.opaque.length = opaque->length;
     memcpy(ntlm->request.opaque.data, opaque->data, opaque->length);
     return 0;
@@ -1133,15 +1077,11 @@ krb5_ntlm_req_set_session(krb5_context context,
 			  void *sessionkey, size_t length)
 {
     ntlm->request.sessionkey = calloc(1, sizeof(*ntlm->request.sessionkey));
-    if (ntlm->request.sessionkey == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.sessionkey == NULL)
+	return krb5_enomem(context);
     ntlm->request.sessionkey->data = malloc(length);
-    if (ntlm->request.sessionkey->data == NULL && length != 0) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ntlm->request.sessionkey->data == NULL && length != 0)
+	return krb5_enomem(context);
     memcpy(ntlm->request.sessionkey->data, sessionkey, length);
     ntlm->request.sessionkey->length = length;
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/dll.c b/crypto/external/bsd/heimdal/dist/lib/krb5/dll.c
index da32ab0dd..67b3c27a7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/dll.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/dll.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dll.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: dll.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
@@ -33,12 +33,29 @@
 
 #include<windows.h>
 
+extern void heim_w32_service_thread_detach(void *);
+
 HINSTANCE _krb5_hInstance = NULL;
 
+#if NTDDI_VERSION >= NTDDI_VISTA
+extern BOOL WINAPI
+_hc_w32crypto_DllMain(HINSTANCE hinstDLL,
+		      DWORD fdwReason,
+		      LPVOID lpvReserved);
+#endif
+
 BOOL WINAPI DllMain(HINSTANCE hinstDLL,
 		    DWORD fdwReason,
 		    LPVOID lpvReserved)
 {
+#if NTDDI_VERSION >= NTDDI_VISTA
+    BOOL ret;
+
+    ret = _hc_w32crypto_DllMain(hinstDLL, fdwReason, lpvReserved);
+    if (!ret)
+	return ret;
+#endif
+
     switch (fdwReason) {
     case DLL_PROCESS_ATTACH:
 
@@ -52,6 +69,7 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL,
 	return FALSE;
 
     case DLL_THREAD_DETACH:
+        heim_w32_service_thread_detach(NULL);
 	return FALSE;
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/krb5/doxygen.c
index b4e4e0c45..da8eaceef 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2007-2008 Kungliga Tekniska Högskolan
@@ -310,8 +310,8 @@
  *
  * In this case, mutual authentication will be tried. That means that the server
  * will authenticate to the client. Using mutual authentication
- * is good since it enables the user to verify that they are talking to the
- * right server (a server that knows the key).
+ * is required to avoid man-in-the-middle attacks, since it enables the user to
+ * verify that they are talking to the right server (a server that knows the key).
  *
  * If you are using a non-blocking socket you will need to do all work of
  * krb5_sendauth() yourself. Basically you need to send over the
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/eai_to_heim_errno.c b/crypto/external/bsd/heimdal/dist/lib/krb5/eai_to_heim_errno.c
index 1893c29c2..71e20a666 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/eai_to_heim_errno.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/eai_to_heim_errno.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: eai_to_heim_errno.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: eai_to_heim_errno.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dllmain.c b/crypto/external/bsd/heimdal/dist/lib/krb5/enomem.c
similarity index 81%
rename from crypto/external/bsd/heimdal/dist/lib/hcrypto/dllmain.c
rename to crypto/external/bsd/heimdal/dist/lib/krb5/enomem.c
index e845e4b4d..7238e8696 100644
--- a/crypto/external/bsd/heimdal/dist/lib/hcrypto/dllmain.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/enomem.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: dllmain.c,v 1.1.1.1 2011/04/13 18:14:49 elric Exp $	*/
+/*	$NetBSD: enomem.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -33,19 +33,12 @@
  * SUCH DAMAGE.
  */
 
-#include <config.h>
+#include "krb5_locl.h"
 
-#include <Windows.h>
-
-BOOL WINAPI
-DllMain (HANDLE hInst,
-	 ULONG reason,
-	 LPVOID lpReserved)
+krb5_error_code
+krb5_enomem(krb5_context context)
 {
-    switch(reason) {
-    case DLL_PROCESS_ATTACH:
-    case DLL_PROCESS_DETACH:
-    default:
-	return TRUE;
-    }
+    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
+    return ENOMEM;
 }
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/error_string.c b/crypto/external/bsd/heimdal/dist/lib/krb5/error_string.c
index b492569d7..3e9ead359 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/error_string.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/error_string.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: error_string.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: error_string.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001, 2003, 2005 - 2006 Kungliga Tekniska Högskolan
@@ -49,12 +49,12 @@
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_clear_error_message(krb5_context context)
 {
-    HEIMDAL_MUTEX_lock(context->mutex);
+    HEIMDAL_MUTEX_lock(&context->mutex);
     if (context->error_string)
 	free(context->error_string);
     context->error_code = 0;
     context->error_string = NULL;
-    HEIMDAL_MUTEX_unlock(context->mutex);
+    HEIMDAL_MUTEX_unlock(&context->mutex);
 }
 
 /**
@@ -74,7 +74,7 @@ krb5_clear_error_message(krb5_context context)
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_set_error_message(krb5_context context, krb5_error_code ret,
 		       const char *fmt, ...)
-    __attribute__ ((format (printf, 3, 4)))
+    __attribute__ ((__format__ (__printf__, 3, 4)))
 {
     va_list ap;
 
@@ -100,14 +100,14 @@ krb5_set_error_message(krb5_context context, krb5_error_code ret,
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_vset_error_message (krb5_context context, krb5_error_code ret,
 			 const char *fmt, va_list args)
-    __attribute__ ((format (printf, 3, 0)))
+    __attribute__ ((__format__ (__printf__, 3, 0)))
 {
     int r;
 
     if (context == NULL)
 	return;
 
-    HEIMDAL_MUTEX_lock(context->mutex);
+    HEIMDAL_MUTEX_lock(&context->mutex);
     if (context->error_string) {
 	free(context->error_string);
 	context->error_string = NULL;
@@ -116,7 +116,9 @@ krb5_vset_error_message (krb5_context context, krb5_error_code ret,
     r = vasprintf(&context->error_string, fmt, args);
     if (r < 0)
 	context->error_string = NULL;
-    HEIMDAL_MUTEX_unlock(context->mutex);
+    HEIMDAL_MUTEX_unlock(&context->mutex);
+    if (context->error_string)
+	_krb5_debug(context, 100, "error message: %s: %d", context->error_string, ret);
 }
 
 /**
@@ -136,7 +138,7 @@ krb5_vset_error_message (krb5_context context, krb5_error_code ret,
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_prepend_error_message(krb5_context context, krb5_error_code ret,
 			   const char *fmt, ...)
-    __attribute__ ((format (printf, 3, 4)))
+    __attribute__ ((__format__ (__printf__, 3, 4)))
 {
     va_list ap;
 
@@ -161,20 +163,20 @@ krb5_prepend_error_message(krb5_context context, krb5_error_code ret,
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_vprepend_error_message(krb5_context context, krb5_error_code ret,
 			    const char *fmt, va_list args)
-    __attribute__ ((format (printf, 3, 0)))
+    __attribute__ ((__format__ (__printf__, 3, 0)))
 {
     char *str = NULL, *str2 = NULL;
 
     if (context == NULL)
 	return;
 
-    HEIMDAL_MUTEX_lock(context->mutex);
+    HEIMDAL_MUTEX_lock(&context->mutex);
     if (context->error_code != ret) {
-	HEIMDAL_MUTEX_unlock(context->mutex);
+	HEIMDAL_MUTEX_unlock(&context->mutex);
 	return;
     }
     if (vasprintf(&str, fmt, args) < 0 || str == NULL) {
-	HEIMDAL_MUTEX_unlock(context->mutex);
+	HEIMDAL_MUTEX_unlock(&context->mutex);
 	return;
     }
     if (context->error_string) {
@@ -189,42 +191,7 @@ krb5_vprepend_error_message(krb5_context context, krb5_error_code ret,
 	free(str);
     } else
 	context->error_string = str;
-    HEIMDAL_MUTEX_unlock(context->mutex);
-}
-
-
-/**
- * Return the error message in context. On error or no error string,
- * the function returns NULL.
- *
- * @param context Kerberos 5 context
- *
- * @return an error string, needs to be freed with
- * krb5_free_error_message(). The functions return NULL on error.
- *
- * @ingroup krb5_error
- */
-
-KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
-krb5_get_error_string(krb5_context context)
-{
-    char *ret = NULL;
-
-    HEIMDAL_MUTEX_lock(context->mutex);
-    if (context->error_string)
-	ret = strdup(context->error_string);
-    HEIMDAL_MUTEX_unlock(context->mutex);
-    return ret;
-}
-
-KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
-krb5_have_error_string(krb5_context context)
-{
-    char *str;
-    HEIMDAL_MUTEX_lock(context->mutex);
-    str = context->error_string;
-    HEIMDAL_MUTEX_unlock(context->mutex);
-    return str != NULL;
+    HEIMDAL_MUTEX_unlock(&context->mutex);
 }
 
 /**
@@ -261,13 +228,13 @@ krb5_get_error_message(krb5_context context, krb5_error_code code)
      */
     if (context)
     {
-        HEIMDAL_MUTEX_lock(context->mutex);
+	HEIMDAL_MUTEX_lock(&context->mutex);
         if (context->error_string &&
             (code == context->error_code || context->error_code == 0))
         {
             str = strdup(context->error_string);
         }
-        HEIMDAL_MUTEX_unlock(context->mutex);
+	HEIMDAL_MUTEX_unlock(&context->mutex);
 
         if (str)
             return str;
@@ -331,7 +298,7 @@ krb5_free_error_message(krb5_context context, const char *msg)
 
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_get_err_text(krb5_context context, krb5_error_code code)
-    KRB5_DEPRECATED_FUNCTION("Use X instead")
+    KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead")
 {
     const char *p = NULL;
     if(context != NULL)
@@ -342,3 +309,4 @@ krb5_get_err_text(krb5_context context, krb5_error_code code)
 	p = "Unknown error";
     return p;
 }
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/expand_hostname.c b/crypto/external/bsd/heimdal/dist/lib/krb5/expand_hostname.c
index 36c8a748a..3ee3e21cf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/expand_hostname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/expand_hostname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: expand_hostname.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: expand_hostname.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -41,11 +41,8 @@ copy_hostname(krb5_context context,
 	      char **new_hostname)
 {
     *new_hostname = strdup (orig_hostname);
-    if (*new_hostname == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*new_hostname == NULL)
+	return krb5_enomem(context);
     strlwr (*new_hostname);
     return 0;
 }
@@ -86,13 +83,10 @@ krb5_expand_hostname (krb5_context context,
 	if (a->ai_canonname != NULL) {
 	    *new_hostname = strdup (a->ai_canonname);
 	    freeaddrinfo (ai);
-	    if (*new_hostname == NULL) {
-		krb5_set_error_message(context, ENOMEM,
-				       N_("malloc: out of memory", ""));
-		return ENOMEM;
-	    } else {
+	    if (*new_hostname == NULL)
+		return krb5_enomem(context);
+	    else
 		return 0;
-	    }
 	}
     }
     freeaddrinfo (ai);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/expand_path.c b/crypto/external/bsd/heimdal/dist/lib/krb5/expand_path.c
index c5d234fcb..2183c6ad1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/expand_path.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/expand_path.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: expand_path.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: expand_path.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 
 /***********************************************************************
@@ -34,6 +34,8 @@
 
 #include "krb5_locl.h"
 
+#include <stdarg.h>
+
 typedef int PTYPE;
 
 #ifdef _WIN32
@@ -51,7 +53,7 @@ typedef int PTYPE;
  * temporary directory until the user profile is loaded.  In addition,
  * the returned path may or may not exist.
  */
-static int
+static krb5_error_code
 _expand_temp_folder(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     TCHAR tpath[MAX_PATH];
@@ -72,11 +74,8 @@ _expand_temp_folder(krb5_context context, PTYPE param, const char *postfix, char
 
     *ret = strdup(tpath);
 
-    if (*ret == NULL) {
-	if (context)
-	    krb5_set_error_message(context, ENOMEM, "strdup - Out of memory");
-	return ENOMEM;
-    }
+    if (*ret == NULL)
+	return krb5_enomem(context);
 
     return 0;
 }
@@ -91,7 +90,7 @@ extern HINSTANCE _krb5_hInstance;
  * "bin" directory is considered to be the directory in which the
  * krb5.dll is located.
  */
-static int
+static krb5_error_code
 _expand_bin_dir(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     TCHAR path[MAX_PATH];
@@ -121,7 +120,7 @@ _expand_bin_dir(krb5_context context, PTYPE param, const char *postfix, char **r
 
     *ret = strdup(path);
     if (*ret == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
 
     return 0;
 }
@@ -141,7 +140,7 @@ _expand_bin_dir(krb5_context context, PTYPE param, const char *postfix, char **r
  *    SecurityIdentification level the call will fail.
  *
  */
-static int
+static krb5_error_code
 _expand_userid(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     int rv = EINVAL;
@@ -239,7 +238,7 @@ _expand_userid(krb5_context context, PTYPE param, const char *postfix, char **re
  * Expand a folder identified by a CSIDL
  */
 
-static int
+static krb5_error_code
 _expand_csidl(krb5_context context, PTYPE folder, const char *postfix, char **ret)
 {
     TCHAR path[MAX_PATH];
@@ -257,80 +256,85 @@ _expand_csidl(krb5_context context, PTYPE folder, const char *postfix, char **re
 	path[len - 1] = '\0';
 
     if (postfix &&
-	strlcat(path, postfix, sizeof(path)/sizeof(path[0])) >= sizeof(path)/sizeof(path[0])) {
-	return ENOMEM;
-    }
+	strlcat(path, postfix, sizeof(path)/sizeof(path[0])) >= sizeof(path)/sizeof(path[0]))
+	return krb5_enomem(context);
 
     *ret = strdup(path);
-    if (*ret == NULL) {
-	if (context)
-	    krb5_set_error_message(context, ENOMEM, "Out of memory");
-	return ENOMEM;
-    }
+    if (*ret == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
 #else
 
-static int
+static krb5_error_code
 _expand_path(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     *ret = strdup(postfix);
-    if (*ret == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc - out of memory");
-	return ENOMEM;
-    }
+    if (*ret == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
-static int
+static krb5_error_code
 _expand_temp_folder(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     const char *p = NULL;
 
-    if (issuid())
+    if (!issuid())
 	p = getenv("TEMP");
+
     if (p)
 	*ret = strdup(p);
     else
 	*ret = strdup("/tmp");
     if (*ret == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     return 0;
 }
 
-static int
+static krb5_error_code
 _expand_userid(krb5_context context, PTYPE param, const char *postfix, char **str)
 {
     int ret = asprintf(str, "%ld", (unsigned long)getuid());
     if (ret < 0 || *str == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     return 0;
 }
 
 
 #endif /* _WIN32 */
 
+/**
+ * Expand an extra token
+ */
+
+static krb5_error_code
+_expand_extra_token(krb5_context context, const char *value, char **ret)
+{
+    *ret = strdup(value);
+    if (*ret == NULL)
+	return krb5_enomem(context);
+    return 0;
+}
+
 /**
  * Expand a %{null} token
  *
  * The expansion of a %{null} token is always the empty string.
  */
 
-static int
+static krb5_error_code
 _expand_null(krb5_context context, PTYPE param, const char *postfix, char **ret)
 {
     *ret = strdup("");
-    if (*ret == NULL) {
-	if (context)
-	    krb5_set_error_message(context, ENOMEM, "Out of memory");
-	return ENOMEM;
-    }
+    if (*ret == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
 
-static const struct token {
+static const struct {
     const char * tok;
     int ftype;
 #define FTYPE_CSIDL 0
@@ -372,13 +376,15 @@ static const struct token {
     {"null", SPECIAL(_expand_null)}
 };
 
-static int
+static krb5_error_code
 _expand_token(krb5_context context,
 	      const char *token,
 	      const char *token_end,
+	      char **extra_tokens,
 	      char **ret)
 {
     size_t i;
+    char **p;
 
     *ret = NULL;
 
@@ -389,6 +395,11 @@ _expand_token(krb5_context context,
 	return EINVAL;
     }
 
+    for (p = extra_tokens; p && p[0]; p += 2) {
+	if (strncmp(token+2, p[0], (token_end - token) - 2) == 0)
+	    return _expand_extra_token(context, p[1], ret);
+    }
+
     for (i = 0; i < sizeof(tokens)/sizeof(tokens[0]); i++) {
 	if (!strncmp(token+2, tokens[i].tok, (token_end - token) - 2))
 	    return tokens[i].exp_func(context, tokens[i].param,
@@ -400,14 +411,65 @@ _expand_token(krb5_context context,
     return EINVAL;
 }
 
+/**
+ * Internal function to expand tokens in paths.
+ *
+ * Inputs:
+ *
+ * @context   A krb5_context
+ * @path_in   The path to expand tokens from
+ * 
+ * Outputs:
+ *
+ * @ppath_out Path with expanded tokens (caller must free() this)
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_expand_path_tokens(krb5_context context,
 			 const char *path_in,
+			 int filepath,
 			 char **ppath_out)
+{
+    return _krb5_expand_path_tokensv(context, path_in, filepath, ppath_out, NULL);
+}
+
+static void
+free_extra_tokens(char **extra_tokens)
+{
+    char **p;
+
+    for (p = extra_tokens; p && *p; p++)
+	free(*p);
+    free(extra_tokens);
+}
+
+/**
+ * Internal function to expand tokens in paths.
+ *
+ * Inputs:
+ *
+ * @context   A krb5_context
+ * @path_in   The path to expand tokens from
+ * @ppath_out The expanded path
+ * @...       Variable number of pairs of strings, the first of each
+ *            being a token (e.g., "luser") and the second a string to
+ *            replace it with.  The list is terminated by a NULL.
+ * 
+ * Outputs:
+ *
+ * @ppath_out Path with expanded tokens (caller must free() this)
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_expand_path_tokensv(krb5_context context,
+			  const char *path_in,
+			  int filepath,
+			  char **ppath_out, ...)
 {
     char *tok_begin, *tok_end, *append;
+    char **extra_tokens = NULL;
     const char *path_left;
+    size_t nargs = 0;
     size_t len = 0;
+    va_list ap;
 
     if (path_in == NULL || *path_in == '\0') {
         *ppath_out = strdup("");
@@ -416,6 +478,45 @@ _krb5_expand_path_tokens(krb5_context context,
 
     *ppath_out = NULL;
 
+    va_start(ap, ppath_out);
+    while (va_arg(ap, const char *)) {
+	nargs++;
+        va_arg(ap, const char *);
+    }
+    va_end(ap);
+    nargs *= 2;
+
+    /* Get extra tokens */
+    if (nargs) {
+	size_t i;
+
+	extra_tokens = calloc(nargs + 1, sizeof (*extra_tokens));
+	if (extra_tokens == NULL)
+	    return krb5_enomem(context);
+	va_start(ap, ppath_out);
+	for (i = 0; i < nargs; i++) {
+	    const char *s = va_arg(ap, const char *); /* token key */
+	    if (s == NULL)
+		break;
+	    extra_tokens[i] = strdup(s);
+	    if (extra_tokens[i++] == NULL) {
+		va_end(ap);
+		free_extra_tokens(extra_tokens);
+		return krb5_enomem(context);
+	    }
+	    s = va_arg(ap, const char *); /* token value */
+	    if (s == NULL)
+		s = "";
+	    extra_tokens[i] = strdup(s);
+	    if (extra_tokens[i] == NULL) {
+		va_end(ap);
+		free_extra_tokens(extra_tokens);
+		return krb5_enomem(context);
+	    }
+	}
+	va_end(ap);
+    }
+
     for (path_left = path_in; path_left && *path_left; ) {
 
 	tok_begin = strstr(path_left, "%{");
@@ -433,6 +534,7 @@ _krb5_expand_path_tokens(krb5_context context,
 
 	    tok_end = strchr(tok_begin, '}');
 	    if (tok_end == NULL) {
+		free_extra_tokens(extra_tokens);
 		if (*ppath_out)
 		    free(*ppath_out);
 		*ppath_out = NULL;
@@ -441,7 +543,9 @@ _krb5_expand_path_tokens(krb5_context context,
 		return EINVAL;
 	    }
 
-	    if (_expand_token(context, tok_begin, tok_end, &append)) {
+	    if (_expand_token(context, tok_begin, tok_end, extra_tokens,
+			      &append)) {
+		free_extra_tokens(extra_tokens);
 		if (*ppath_out)
 		    free(*ppath_out);
 		*ppath_out = NULL;
@@ -458,12 +562,11 @@ _krb5_expand_path_tokens(krb5_context context,
 
 	if (append == NULL) {
 
+	    free_extra_tokens(extra_tokens);
 	    if (*ppath_out)
 		free(*ppath_out);
 	    *ppath_out = NULL;
-	    if (context)
-		krb5_set_error_message(context, ENOMEM, "malloc - out of memory");
-	    return ENOMEM;
+	    return krb5_enomem(context);
 
 	}
 
@@ -472,13 +575,12 @@ _krb5_expand_path_tokens(krb5_context context,
 	    char * new_str = realloc(*ppath_out, len + append_len + 1);
 
 	    if (new_str == NULL) {
+		free_extra_tokens(extra_tokens);
 		free(append);
 		if (*ppath_out)
 		    free(*ppath_out);
 		*ppath_out = NULL;
-		if (context)
-		    krb5_set_error_message(context, ENOMEM, "malloc - out of memory");
-		return ENOMEM;
+		return krb5_enomem(context);
 	    }
 
 	    *ppath_out = new_str;
@@ -490,13 +592,15 @@ _krb5_expand_path_tokens(krb5_context context,
 
 #ifdef _WIN32
     /* Also deal with slashes */
-    if (*ppath_out) {
+    if (filepath && *ppath_out) {
 	char * c;
+
 	for (c = *ppath_out; *c; c++)
 	    if (*c == '/')
 		*c = '\\';
     }
 #endif
 
+    free_extra_tokens(extra_tokens);
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/fast.c b/crypto/external/bsd/heimdal/dist/lib/krb5/fast.c
new file mode 100644
index 000000000..d1a2d18c1
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/fast.c
@@ -0,0 +1,97 @@
+/*	$NetBSD: fast.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb5_locl.h"
+
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_fast_cf2(krb5_context context,
+	       krb5_keyblock *key1,
+	       const char *pepper1,
+	       krb5_keyblock *key2,
+	       const char *pepper2,
+	       krb5_keyblock *armorkey,
+	       krb5_crypto *armor_crypto)
+{
+    krb5_crypto crypto1, crypto2;
+    krb5_data pa1, pa2;
+    krb5_error_code ret;
+
+    ret = krb5_crypto_init(context, key1, 0, &crypto1);
+    if (ret)
+	return ret;
+
+    ret = krb5_crypto_init(context, key2, 0, &crypto2);
+    if (ret) {
+	krb5_crypto_destroy(context, crypto1);
+	return ret;
+    }
+
+    pa1.data = rk_UNCONST(pepper1);
+    pa1.length = strlen(pepper1);
+    pa2.data = rk_UNCONST(pepper2);
+    pa2.length = strlen(pepper2);
+
+    ret = krb5_crypto_fx_cf2(context, crypto1, crypto2, &pa1, &pa2,
+			     key1->keytype, armorkey);
+    krb5_crypto_destroy(context, crypto1);
+    krb5_crypto_destroy(context, crypto2);
+    if (ret)
+	return ret;
+
+    if (armor_crypto) {
+	ret = krb5_crypto_init(context, armorkey, 0, armor_crypto);
+	if (ret)
+	    krb5_free_keyblock_contents(context, armorkey);
+    }
+
+    return ret;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_fast_armor_key(krb5_context context,
+		     krb5_keyblock *subkey,
+		     krb5_keyblock *sessionkey,
+		     krb5_keyblock *armorkey,
+		     krb5_crypto *armor_crypto)
+{
+    return _krb5_fast_cf2(context,
+			  subkey,
+			  "subkeyarmor",
+			  sessionkey,
+			  "ticketarmor",
+			  armorkey,
+			  armor_crypto);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/fcache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/fcache.c
index 976b8e85e..fefe02c85 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/fcache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/fcache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: fcache.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $	*/
+/*	$NetBSD: fcache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -44,6 +44,8 @@ typedef struct krb5_fcache{
 
 struct fcc_cursor {
     int fd;
+    off_t cred_start;
+    off_t cred_end;
     krb5_storage *sp;
 };
 
@@ -70,7 +72,7 @@ fcc_get_name(krb5_context context,
     return FILENAME(id);
 }
 
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_xlock(krb5_context context, int fd, krb5_boolean exclusive,
 	    const char *filename)
 {
@@ -114,7 +116,7 @@ _krb5_xlock(krb5_context context, int fd, krb5_boolean exclusive,
     return ret;
 }
 
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_xunlock(krb5_context context, int fd)
 {
     int ret;
@@ -225,7 +227,11 @@ scrub_file (int fd)
         return errno;
     memset(buf, 0, sizeof(buf));
     while(pos > 0) {
-        ssize_t tmp = write(fd, buf, min((off_t)sizeof(buf), pos));
+	ssize_t tmp;
+	size_t wr = sizeof(buf);
+	if (wr > pos)
+	    wr = (size_t)pos;
+        tmp = write(fd, buf, wr);
 
 	if (tmp < 0)
 	    return errno;
@@ -246,7 +252,7 @@ scrub_file (int fd)
  * hardlink)
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_erase_file(krb5_context context, const char *filename)
 {
     int fd;
@@ -257,7 +263,7 @@ _krb5_erase_file(krb5_context context, const char *filename)
     if (ret < 0)
 	return errno;
 
-    fd = open(filename, O_RDWR | O_BINARY);
+    fd = open(filename, O_RDWR | O_BINARY | O_CLOEXEC | O_NOFOLLOW);
     if(fd < 0) {
 	if(errno == ENOENT)
 	    return 0;
@@ -271,22 +277,27 @@ _krb5_erase_file(krb5_context context, const char *filename)
 	return ret;
     }
     if (unlink(filename) < 0) {
+	ret = errno;
 	_krb5_xunlock(context, fd);
         close (fd);
-        return errno;
+	krb5_set_error_message(context, errno,
+	    N_("krb5_cc_destroy: unlinking \"%s\": %s", ""),
+	    filename, strerror(ret));
+        return ret;
     }
-    ret = fstat (fd, &sb2);
+    ret = fstat(fd, &sb2);
     if (ret < 0) {
+	ret = errno;
 	_krb5_xunlock(context, fd);
 	close (fd);
-	return errno;
+	return ret;
     }
 
     /* check if someone was playing with symlinks */
 
     if (sb1.st_dev != sb2.st_dev || sb1.st_ino != sb2.st_ino) {
 	_krb5_xunlock(context, fd);
-	close (fd);
+	close(fd);
 	return EPERM;
     }
 
@@ -294,18 +305,18 @@ _krb5_erase_file(krb5_context context, const char *filename)
 
     if (sb2.st_nlink != 0) {
 	_krb5_xunlock(context, fd);
-        close (fd);
+        close(fd);
         return 0;
     }
 
-    ret = scrub_file (fd);
+    ret = scrub_file(fd);
     if (ret) {
 	_krb5_xunlock(context, fd);
 	close(fd);
 	return ret;
     }
     ret = _krb5_xunlock(context, fd);
-    close (fd);
+    close(fd);
     return ret;
 }
 
@@ -323,27 +334,29 @@ fcc_gen_new(krb5_context context, krb5_ccache *id)
 			       N_("malloc: out of memory", ""));
 	return KRB5_CC_NOMEM;
     }
-    ret = asprintf (&file, "%sXXXXXX", KRB5_DEFAULT_CCFILE_ROOT);
+    ret = asprintf(&file, "%sXXXXXX", KRB5_DEFAULT_CCFILE_ROOT);
     if(ret < 0 || file == NULL) {
 	free(f);
 	krb5_set_error_message(context, KRB5_CC_NOMEM,
 			       N_("malloc: out of memory", ""));
 	return KRB5_CC_NOMEM;
     }
-    ret = _krb5_expand_path_tokens(context, file, &exp_file);
+    ret = _krb5_expand_path_tokens(context, file, 1, &exp_file);
     free(file);
-    if (ret)
+    if (ret) {
+	free(f);
 	return ret;
+    }
 
     file = exp_file;
 
     fd = mkstemp(exp_file);
     if(fd < 0) {
-	int xret = errno;
-	krb5_set_error_message(context, xret, N_("mkstemp %s failed", ""), exp_file);
+	ret = (krb5_error_code)errno;
+	krb5_set_error_message(context, ret, N_("mkstemp %s failed", ""), exp_file);
 	free(f);
 	free(exp_file);
-	return xret;
+	return ret;
     }
     close(fd);
     f->filename = exp_file;
@@ -381,6 +394,7 @@ storage_set_flags(krb5_context context, krb5_storage *sp, int vno)
 static krb5_error_code KRB5_CALLCONV
 fcc_open(krb5_context context,
 	 krb5_ccache id,
+	 const char *operation,
 	 int *fd_ret,
 	 int flags,
 	 mode_t mode)
@@ -389,24 +403,132 @@ fcc_open(krb5_context context,
 			      (flags | O_RDWR) == flags);
     krb5_error_code ret;
     const char *filename;
+    struct stat sb1, sb2;
+#ifndef _WIN32
+    struct stat sb3;
+    size_t tries = 3;
+#endif
+    int strict_checking;
     int fd;
 
+    flags |= O_BINARY | O_CLOEXEC | O_NOFOLLOW;
+
+    *fd_ret = -1;
+
     if (FCACHE(id) == NULL)
         return krb5_einval(context, 2);
 
     filename = FILENAME(id);
 
+    strict_checking = (flags & O_CREAT) == 0 &&
+	(context->flags & KRB5_CTX_F_FCACHE_STRICT_CHECKING) != 0;
+
+again:
+    memset(&sb1, 0, sizeof(sb1));
+    ret = lstat(filename, &sb1);
+    if (ret == 0) {
+	if (!S_ISREG(sb1.st_mode)) {
+	    krb5_set_error_message(context, EPERM,
+				   N_("Refuses to open symlinks for caches FILE:%s", ""), filename);
+	    return EPERM;
+	}
+    } else if (errno != ENOENT || !(flags & O_CREAT)) {
+	krb5_set_error_message(context, errno, N_("%s lstat(%s)", "file, error"),
+			       operation, filename);
+	return errno;
+    }
+
     fd = open(filename, flags, mode);
     if(fd < 0) {
 	char buf[128];
 	ret = errno;
 	rk_strerror_r(ret, buf, sizeof(buf));
-	krb5_set_error_message(context, ret, N_("open(%s): %s", "file, error"),
-			       filename, buf);
+	krb5_set_error_message(context, ret, N_("%s open(%s): %s", "file, error"),
+			       operation, filename, buf);
 	return ret;
     }
     rk_cloexec(fd);
 
+    ret = fstat(fd, &sb2);
+    if (ret < 0) {
+	krb5_clear_error_message(context);
+	close(fd);
+	return errno;
+    }
+
+    if (!S_ISREG(sb2.st_mode)) {
+	krb5_set_error_message(context, EPERM, N_("Refuses to open non files caches: FILE:%s", ""), filename);
+	close(fd);
+	return EPERM;
+    }
+
+#ifndef _WIN32
+    if (sb1.st_dev && sb1.st_ino &&
+	(sb1.st_dev != sb2.st_dev || sb1.st_ino != sb2.st_ino)) {
+	/*
+	 * Perhaps we raced with a rename().  To complain about
+	 * symlinks in that case would cause unnecessary concern, so
+	 * we check for that possibility and loop.  This has no
+	 * TOCTOU problems because we redo the open().  We could also
+	 * not do any of this checking if O_NOFOLLOW != 0...
+	 */
+	close(fd);
+	ret = lstat(filename, &sb3);
+	if (ret || sb1.st_dev != sb2.st_dev ||
+	    sb3.st_dev != sb2.st_dev || sb3.st_ino != sb2.st_ino) {
+	    krb5_set_error_message(context, EPERM, N_("Refuses to open possible symlink for caches: FILE:%s", ""), filename);
+	    return EPERM;
+	}
+	if (--tries == 0) {
+	    krb5_set_error_message(context, EPERM, N_("Raced too many times with renames of FILE:%s", ""), filename);
+	    return EPERM;
+	}
+	goto again;
+    }
+#endif
+
+    /*
+     * /tmp (or wherever default ccaches go) might not be on its own
+     * filesystem, or on a filesystem different /etc, say, and even if
+     * it were, suppose a user hard-links another's ccache to her
+     * default ccache, then runs a set-uid program that will user her
+     * default ccache (even if it ignores KRB5CCNAME)...
+     *
+     * Default ccache locations should really be on per-user non-tmp
+     * locations on tmpfs "run" directories.  But we don't know here
+     * that this is the case.  Thus: no hard-links, no symlinks.
+     */
+    if (sb2.st_nlink != 1) {
+	krb5_set_error_message(context, EPERM, N_("Refuses to open hardlinks for caches FILE:%s", ""), filename);
+	close(fd);
+	return EPERM;
+    }
+
+    if (strict_checking) {
+#ifndef _WIN32
+	/*
+	 * XXX WIN32: Needs to have ACL checking code!
+	 * st_mode comes out as 100666, and st_uid is no use.
+	 */
+	/*
+	 * XXX Should probably add options to improve control over this
+	 * check.  We might want strict checking of everything except
+	 * this.
+	 */
+	if (sb2.st_uid != geteuid()) {
+	    krb5_set_error_message(context, EPERM, N_("Refuses to open cache files not own by myself FILE:%s (owned by %d)", ""), filename, (int)sb2.st_uid);
+	    close(fd);
+	    return EPERM;
+	}
+	if ((sb2.st_mode & 077) != 0) {
+	    krb5_set_error_message(context, EPERM,
+				   N_("Refuses to open group/other readable files FILE:%s", ""), filename);
+	    close(fd);
+	    return EPERM;
+	}
+#endif
+    }
+
     if((ret = fcc_lock(context, id, fd, exclusive)) != 0) {
 	close(fd);
 	return ret;
@@ -429,7 +551,7 @@ fcc_initialize(krb5_context context,
 
     unlink (f->filename);
 
-    ret = fcc_open(context, id, &fd, O_RDWR | O_CREAT | O_EXCL | O_BINARY | O_CLOEXEC, 0600);
+    ret = fcc_open(context, id, "initialize", &fd, O_RDWR | O_CREAT | O_EXCL, 0600);
     if(ret)
 	return ret;
     {
@@ -467,8 +589,8 @@ fcc_initialize(krb5_context context,
 	    char buf[128];
 	    ret = errno;
 	    rk_strerror_r(ret, buf, sizeof(buf));
-	    krb5_set_error_message (context, ret, N_("close %s: %s", ""),
-				    FILENAME(id), buf);
+	    krb5_set_error_message(context, ret, N_("close %s: %s", ""),
+				   FILENAME(id), buf);
 	}
     return ret;
 }
@@ -492,8 +614,7 @@ fcc_destroy(krb5_context context,
     if (FCACHE(id) == NULL)
         return krb5_einval(context, 2);
 
-    _krb5_erase_file(context, FILENAME(id));
-    return 0;
+    return _krb5_erase_file(context, FILENAME(id));
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -504,7 +625,7 @@ fcc_store_cred(krb5_context context,
     int ret;
     int fd;
 
-    ret = fcc_open(context, id, &fd, O_WRONLY | O_APPEND | O_BINARY | O_CLOEXEC, 0);
+    ret = fcc_open(context, id, "store", &fd, O_WRONLY | O_APPEND, 0);
     if(ret)
 	return ret;
     {
@@ -513,11 +634,6 @@ fcc_store_cred(krb5_context context,
 	sp = krb5_storage_emem();
 	krb5_storage_set_eof_code(sp, KRB5_CC_END);
 	storage_set_flags(context, sp, FCACHE(id)->version);
-	if (!krb5_config_get_bool_default(context, NULL, TRUE,
-					  "libdefaults",
-					  "fcc-mit-ticketflags",
-					  NULL))
-	    krb5_storage_set_flags(sp, KRB5_STORAGE_CREDS_FLAGS_WRONG_BITORDER);
 	ret = krb5_store_creds(sp, creds);
 	if (ret == 0)
 	    ret = write_storage(context, sp, fd);
@@ -527,31 +643,34 @@ fcc_store_cred(krb5_context context,
     if (close(fd) < 0) {
 	if (ret == 0) {
 	    char buf[128];
-	    rk_strerror_r(ret, buf, sizeof(buf));
 	    ret = errno;
-	    krb5_set_error_message (context, ret, N_("close %s: %s", ""),
-				    FILENAME(id), buf);
+	    rk_strerror_r(ret, buf, sizeof(buf));
+	    krb5_set_error_message(context, ret, N_("close %s: %s", ""),
+				   FILENAME(id), buf);
 	}
     }
     return ret;
 }
 
 static krb5_error_code
-init_fcc (krb5_context context,
-	  krb5_ccache id,
-	  krb5_storage **ret_sp,
-	  int *ret_fd,
-	  krb5_deltat *kdc_offset)
+init_fcc(krb5_context context,
+	 krb5_ccache id,
+	 const char *operation,
+	 krb5_storage **ret_sp,
+	 int *ret_fd,
+	 krb5_deltat *kdc_offset)
 {
     int fd;
     int8_t pvno, tag;
     krb5_storage *sp;
     krb5_error_code ret;
 
+    *ret_fd = -1;
+    *ret_sp = NULL;
     if (kdc_offset)
 	*kdc_offset = 0;
 
-    ret = fcc_open(context, id, &fd, O_RDONLY | O_BINARY | O_CLOEXEC, 0);
+    ret = fcc_open(context, id, operation, &fd, O_RDONLY, 0);
     if(ret)
 	return ret;
 
@@ -563,7 +682,7 @@ init_fcc (krb5_context context,
     }
     krb5_storage_set_eof_code(sp, KRB5_CC_END);
     ret = krb5_ret_int8(sp, &pvno);
-    if(ret != 0) {
+    if (ret != 0) {
 	if(ret == KRB5_CC_END) {
 	    ret = ENOENT;
 	    krb5_set_error_message(context, ret,
@@ -575,7 +694,7 @@ init_fcc (krb5_context context,
 				   FILENAME(id));
 	goto out;
     }
-    if(pvno != 5) {
+    if (pvno != 5) {
 	ret = KRB5_CCACHE_BADVNO;
 	krb5_set_error_message(context, ret, N_("Bad version number in credential "
 						"cache file: %s", ""),
@@ -583,7 +702,7 @@ init_fcc (krb5_context context,
 	goto out;
     }
     ret = krb5_ret_int8(sp, &tag); /* should not be host byte order */
-    if(ret != 0) {
+    if (ret != 0) {
 	ret = KRB5_CC_FORMAT;
 	krb5_set_error_message(context, ret, "Error reading tag in "
 			      "cache file: %s", FILENAME(id));
@@ -695,7 +814,7 @@ fcc_get_principal(krb5_context context,
     int fd;
     krb5_storage *sp;
 
-    ret = init_fcc (context, id, &sp, &fd, NULL);
+    ret = init_fcc (context, id, "get-principal", &sp, &fd, NULL);
     if (ret)
 	return ret;
     ret = krb5_ret_principal(sp, principal);
@@ -730,8 +849,8 @@ fcc_get_first (krb5_context context,
     }
     memset(*cursor, 0, sizeof(struct fcc_cursor));
 
-    ret = init_fcc (context, id, &FCC_CURSOR(*cursor)->sp,
-		    &FCC_CURSOR(*cursor)->fd, NULL);
+    ret = init_fcc(context, id, "get-frist", &FCC_CURSOR(*cursor)->sp,
+		   &FCC_CURSOR(*cursor)->fd, NULL);
     if (ret) {
 	free(*cursor);
 	*cursor = NULL;
@@ -764,11 +883,16 @@ fcc_get_next (krb5_context context,
 
     if((ret = fcc_lock(context, id, FCC_CURSOR(*cursor)->fd, FALSE)) != 0)
 	return ret;
+    FCC_CURSOR(*cursor)->cred_start = lseek(FCC_CURSOR(*cursor)->fd,
+					   0, SEEK_CUR);
 
     ret = krb5_ret_creds(FCC_CURSOR(*cursor)->sp, creds);
     if (ret)
 	krb5_clear_error_message(context);
 
+    FCC_CURSOR(*cursor)->cred_end = lseek(FCC_CURSOR(*cursor)->fd,
+					 0, SEEK_CUR);
+
     fcc_unlock(context, FCC_CURSOR(*cursor)->fd);
     return ret;
 }
@@ -792,72 +916,158 @@ fcc_end_get (krb5_context context,
     return 0;
 }
 
-static krb5_error_code KRB5_CALLCONV
-fcc_remove_cred(krb5_context context,
-		 krb5_ccache id,
-		 krb5_flags which,
-		 krb5_creds *cred)
+static void KRB5_CALLCONV
+cred_delete(krb5_context context,
+	    krb5_ccache id,
+	    krb5_cc_cursor *cursor,
+	    krb5_creds *cred)
 {
     krb5_error_code ret;
-    krb5_ccache copy, newfile;
-    char *newname = NULL;
-    int fd;
+    krb5_storage *sp;
+    krb5_data orig_cred_data;
+    unsigned char *cred_data_in_file = NULL;
+    off_t new_cred_sz;
+    struct stat sb1, sb2;
+    int fd = -1;
+    ssize_t bytes;
+    krb5_const_realm srealm = krb5_principal_get_realm(context, cred->server);
+
+    /* This is best-effort code; if we lose track of errors here it's OK */
+
+    heim_assert(FCC_CURSOR(*cursor)->cred_start < FCC_CURSOR(*cursor)->cred_end,
+		"fcache internal error");
+
+    krb5_data_zero(&orig_cred_data);
+
+    sp = krb5_storage_emem();
+    if (sp == NULL)
+	return;
+    krb5_storage_set_eof_code(sp, KRB5_CC_END);
+    storage_set_flags(context, sp, FCACHE(id)->version);
+
+    /* Get a copy of what the cred should look like in the file; see below */
+    ret = krb5_store_creds(sp, cred);
+    if (ret)
+	goto out;
+
+    ret = krb5_storage_to_data(sp, &orig_cred_data);
+    if (ret)
+	goto out;
+    krb5_storage_free(sp);
+
+    cred_data_in_file = malloc(orig_cred_data.length);
+    if (cred_data_in_file == NULL)
+	goto out;
+
+    /*
+     * Mark the cred expired; krb5_cc_retrieve_cred() callers should use
+     * KRB5_TC_MATCH_TIMES, so this should be good enough...
+     */
+    cred->times.endtime = 0;
+
+    /* ...except for config creds because we don't check their endtimes */
+    if (srealm && strcmp(srealm, "X-CACHECONF:") == 0) {
+	ret = krb5_principal_set_realm(context, cred->server, "X-RMED-CONF:");
+	if (ret)
+	    goto out;
+    }
+
+    sp = krb5_storage_emem();
+    if (sp == NULL)
+	goto out;
+    krb5_storage_set_eof_code(sp, KRB5_CC_END);
+    storage_set_flags(context, sp, FCACHE(id)->version);
+
+    ret = krb5_store_creds(sp, cred);
+
+    /* The new cred must be the same size as the old cred */
+    new_cred_sz = krb5_storage_seek(sp, 0, SEEK_END);
+    if (new_cred_sz != orig_cred_data.length || new_cred_sz !=
+	(FCC_CURSOR(*cursor)->cred_end - FCC_CURSOR(*cursor)->cred_start)) {
+	/* XXX This really can't happen.  Assert like above? */
+	krb5_set_error_message(context, EINVAL,
+			       N_("Credential deletion failed on ccache "
+				  "FILE:%s: new credential size did not "
+				  "match old credential size", ""),
+			       FILENAME(id));
+	goto out;
+    }
+
+    ret = fcc_open(context, id, "remove_cred", &fd, O_RDWR, 0);
+    if (ret)
+	goto out;
+
+    /*
+     * Check that we're updating the same file where we got the
+     * cred's offset, else we'd be corrupting a new ccache.
+     */
+    if (fstat(FCC_CURSOR(*cursor)->fd, &sb1) == -1 ||
+	fstat(fd, &sb2) == -1)
+	goto out;
+    if (sb1.st_dev != sb2.st_dev || sb1.st_ino != sb2.st_ino)
+	goto out;
+
+    /*
+     * Make sure what we overwrite is what we expected.
+     *
+     * FIXME: We *really* need the ccache v4 tag for ccache ID.  This
+     * check that we're only overwriting something that looks exactly
+     * like what we want to is probably good enough in practice, but
+     * it's not guaranteed to work.
+     */
+    if (lseek(fd, FCC_CURSOR(*cursor)->cred_start, SEEK_SET) == (off_t)-1)
+	goto out;
+    bytes = read(fd, cred_data_in_file, orig_cred_data.length);
+    if (bytes != orig_cred_data.length)
+	goto out;
+    if (memcmp(orig_cred_data.data, cred_data_in_file, bytes) != 0)
+	goto out;
+    if (lseek(fd, FCC_CURSOR(*cursor)->cred_start, SEEK_SET) == (off_t)-1)
+	goto out;
+    ret = write_storage(context, sp, fd);
+out:
+    if (fd > -1) {
+	fcc_unlock(context, fd);
+	if (close(fd) < 0 && ret == 0) {
+	    krb5_set_error_message(context, errno, N_("close %s", ""),
+				   FILENAME(id));
+	}
+    }
+    krb5_data_free(&orig_cred_data);
+    free(cred_data_in_file);
+    krb5_storage_free(sp);
+    return;
+}
+
+static krb5_error_code KRB5_CALLCONV
+fcc_remove_cred(krb5_context context,
+		krb5_ccache id,
+		krb5_flags which,
+		krb5_creds *mcred)
+{
+    krb5_error_code ret, ret2;
+    krb5_cc_cursor cursor;
+    krb5_creds found_cred;
 
     if (FCACHE(id) == NULL)
-        return krb5_einval(context, 2);
+	return krb5_einval(context, 2);
 
-    ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &copy);
+    ret = krb5_cc_start_seq_get(context, id, &cursor);
     if (ret)
 	return ret;
-
-    ret = krb5_cc_copy_cache(context, id, copy);
-    if (ret) {
-	krb5_cc_destroy(context, copy);
-	return ret;
+    while ((ret = krb5_cc_next_cred(context, id, &cursor, &found_cred)) == 0) {
+	if (!krb5_compare_creds(context, which, mcred, &found_cred)) {
+            krb5_free_cred_contents(context, &found_cred);
+	    continue;
+        }
+	cred_delete(context, id, &cursor, &found_cred);
+	krb5_free_cred_contents(context, &found_cred);
     }
-
-    ret = krb5_cc_remove_cred(context, copy, which, cred);
-    if (ret) {
-	krb5_cc_destroy(context, copy);
-	return ret;
-    }
-
-    ret = asprintf(&newname, "FILE:%s.XXXXXX", FILENAME(id));
-    if (ret < 0 || newname == NULL) {
-	krb5_cc_destroy(context, copy);
-	return ENOMEM;
-    }
-
-    fd = mkstemp(&newname[5]);
-    if (fd < 0) {
-	ret = errno;
-	krb5_cc_destroy(context, copy);
-	return ret;
-    }
-    close(fd);
-
-    ret = krb5_cc_resolve(context, newname, &newfile);
-    if (ret) {
-	unlink(&newname[5]);
-	free(newname);
-	krb5_cc_destroy(context, copy);
-	return ret;
-    }
-
-    ret = krb5_cc_copy_cache(context, copy, newfile);
-    krb5_cc_destroy(context, copy);
-    if (ret) {
-	free(newname);
-	krb5_cc_destroy(context, newfile);
-	return ret;
-    }
-
-    ret = rk_rename(&newname[5], FILENAME(id));
-    if (ret)
-	ret = errno;
-    free(newname);
-    krb5_cc_close(context, newfile);
-
+    ret2 = krb5_cc_end_seq_get(context, id, &cursor);
+    if (ret == 0)
+	return ret2;
+    if (ret == KRB5_CC_END)
+	return 0;
     return ret;
 }
 
@@ -906,8 +1116,8 @@ fcc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
 {
     struct fcache_iter *iter = cursor;
     krb5_error_code ret;
-    const char *fn;
-    char *expandedfn = NULL;
+    const char *fn, *cc_type;
+    krb5_ccache cc;
 
     if (iter == NULL)
         return krb5_einval(context, 2);
@@ -918,30 +1128,26 @@ fcc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
     }
     iter->first = 0;
 
+    /*
+     * Note: do not allow krb5_cc_default_name() to recurse via
+     * krb5_cc_cache_match().
+     * Note that context->default_cc_name will be NULL even though
+     * KRB5CCNAME is set in the environment if
+     * krb5_cc_set_default_name() hasn't
+     */
     fn = krb5_cc_default_name(context);
-    if (fn == NULL || strncasecmp(fn, "FILE:", 5) != 0) {
-	ret = _krb5_expand_default_cc_name(context,
-					   KRB5_DEFAULT_CCNAME_FILE,
-					   &expandedfn);
-	if (ret)
-	    return ret;
-	fn = expandedfn;
+    ret = krb5_cc_resolve(context, fn, &cc);
+    if (ret != 0)
+        return ret;
+    cc_type = krb5_cc_get_type(context, cc);
+    if (strcmp(cc_type, "FILE") != 0) {
+        krb5_cc_close(context, cc);
+        return KRB5_CC_END;
     }
-    /* check if file exists, don't return a non existant "next" */
-    if (strncasecmp(fn, "FILE:", 5) == 0) {
-	struct stat sb;
-	ret = stat(fn + 5, &sb);
-	if (ret) {
-	    ret = KRB5_CC_END;
-	    goto out;
-	}
-    }
-    ret = krb5_cc_resolve(context, fn, id);
- out:
-    if (expandedfn)
-	free(expandedfn);
 
-    return ret;
+    *id = cc;
+
+    return 0;
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -978,14 +1184,14 @@ fcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
 	int fd1, fd2;
 	char buf[BUFSIZ];
 
-	ret = fcc_open(context, from, &fd1, O_RDONLY | O_BINARY | O_CLOEXEC, 0);
+	ret = fcc_open(context, from, "move/from", &fd1, O_RDONLY, 0);
 	if(ret)
 	    return ret;
 
 	unlink(FILENAME(to));
 
-	ret = fcc_open(context, to, &fd2,
-		       O_WRONLY | O_CREAT | O_EXCL | O_BINARY | O_CLOEXEC, 0600);
+	ret = fcc_open(context, to, "move/to", &fd2,
+		       O_WRONLY | O_CREAT | O_EXCL, 0600);
 	if(ret)
 	    goto out1;
 
@@ -1026,7 +1232,7 @@ fcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
     {
 	krb5_storage *sp;
 	int fd;
-	if ((ret = init_fcc (context, to, &sp, &fd, NULL)) == 0) {
+	if ((ret = init_fcc (context, to, "move", &sp, &fd, NULL)) == 0) {
 	    if (sp)
 		krb5_storage_free(sp);
 	    fcc_unlock(context, fd);
@@ -1054,7 +1260,7 @@ fcc_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
     struct stat sb;
     int fd;
 
-    ret = fcc_open(context, id, &fd, O_RDONLY | O_BINARY | O_CLOEXEC, 0);
+    ret = fcc_open(context, id, "lastchange", &fd, O_RDONLY, 0);
     if(ret)
 	return ret;
     ret = fstat(fd, &sb);
@@ -1080,7 +1286,7 @@ fcc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset
     krb5_error_code ret;
     krb5_storage *sp = NULL;
     int fd;
-    ret = init_fcc(context, id, &sp, &fd, kdc_offset);
+    ret = init_fcc(context, id, "get-kdc-offset", &sp, &fd, kdc_offset);
     if (sp)
 	krb5_storage_free(sp);
     fcc_unlock(context, fd);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/free.c b/crypto/external/bsd/heimdal/dist/lib/krb5/free.c
index 71e08d395..2bd8c3863 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/free.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/free.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: free.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: free.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999, 2004 - 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/free_host_realm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/free_host_realm.c
index b14e316ba..5991aa5cc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/free_host_realm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/free_host_realm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: free_host_realm.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: free_host_realm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/generate_seq_number.c b/crypto/external/bsd/heimdal/dist/lib/krb5/generate_seq_number.c
index 618777c4c..a1d5d9452 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/generate_seq_number.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/generate_seq_number.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: generate_seq_number.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: generate_seq_number.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/generate_subkey.c b/crypto/external/bsd/heimdal/dist/lib/krb5/generate_subkey.c
index 2711ecf67..d9485d5a8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/generate_subkey.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/generate_subkey.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: generate_subkey.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: generate_subkey.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -57,12 +57,10 @@ krb5_generate_subkey_extended(krb5_context context,
     krb5_error_code ret;
 
     ALLOC(*subkey, 1);
-    if (*subkey == NULL) {
-	krb5_set_error_message(context, ENOMEM,N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*subkey == NULL)
+	return krb5_enomem(context);
 
-    if (etype == ETYPE_NULL)
+    if (etype == (krb5_enctype)ETYPE_NULL)
 	etype = key->keytype; /* use session key etype */
 
     /* XXX should we use the session key as input to the RF? */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_addrs.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_addrs.c
index 1ec01d71b..1ab1ad048 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_addrs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_addrs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_addrs.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: get_addrs.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -66,10 +66,8 @@ gethostname_fallback (krb5_context context, krb5_addresses *res)
     }
     res->len = 1;
     res->val = malloc (sizeof(*res->val));
-    if (res->val == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (res->val == NULL)
+	return krb5_enomem(context);
     res->val[0].addr_type = hostent->h_addrtype;
     res->val[0].address.data = NULL;
     res->val[0].address.length = 0;
@@ -132,10 +130,10 @@ find_all_addresses (krb5_context context, krb5_addresses *res, int flags)
     /* Allocate storage for them. */
     res->val = calloc(num, sizeof(*res->val));
     if (res->val == NULL) {
-	krb5_free_addresses(context, &ignore_addresses);
+	if (flags & EXTRA_ADDRESSES)
+	    krb5_free_addresses(context, &ignore_addresses);
 	freeifaddrs(ifa0);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     /* Now traverse the list. */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_cred.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_cred.c
index 7328b0d6a..b559ac3b8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_cred.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: get_cred.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -107,9 +107,7 @@ set_auth_data (krb5_context context,
 	ALLOC(req_body->enc_authorization_data, 1);
 	if (req_body->enc_authorization_data == NULL) {
 	    free (buf);
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	ret = krb5_crypto_init(context, subkey, 0, &crypto);
 	if (ret) {
@@ -161,9 +159,7 @@ init_tgs_req (krb5_context context,
     if (in_creds->session.keytype) {
 	ALLOC_SEQ(&t->req_body.etype, 1);
 	if(t->req_body.etype.val == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	t->req_body.etype.val[0] = in_creds->session.keytype;
@@ -186,8 +182,7 @@ init_tgs_req (krb5_context context,
 	goto fail;
     ALLOC(t->req_body.sname, 1);
     if (t->req_body.sname == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
 
@@ -211,8 +206,7 @@ init_tgs_req (krb5_context context,
        but old MIT code (like DCE secd) doesn't like that */
     ALLOC(t->req_body.till, 1);
     if(t->req_body.till == NULL){
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     *t->req_body.till = in_creds->times.endtime;
@@ -230,16 +224,12 @@ init_tgs_req (krb5_context context,
     if(second_ticket){
 	ALLOC(t->req_body.additional_tickets, 1);
 	if (t->req_body.additional_tickets == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	ALLOC_SEQ(t->req_body.additional_tickets, 1);
 	if (t->req_body.additional_tickets->val == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
@@ -248,14 +238,12 @@ init_tgs_req (krb5_context context,
     }
     ALLOC(t->padata, 1);
     if (t->padata == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     ALLOC_SEQ(t->padata, 1 + padata->len);
     if (t->padata->val == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     {
@@ -305,7 +293,7 @@ fail:
     return ret;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_krbtgt(krb5_context context,
 		 krb5_ccache  id,
 		 krb5_realm realm,
@@ -330,8 +318,13 @@ _krb5_get_krbtgt(krb5_context context,
 	krb5_free_principal(context, tmp_cred.client);
 	return ret;
     }
+    /*
+     * The forwardable TGT might not be the start TGT, in which case, it is
+     * generally, but not always already cached.  Just in case, get it again if
+     * lost.
+     */
     ret = krb5_get_credentials(context,
-			       KRB5_GC_CACHED,
+			       0,
 			       id,
 			       &tmp_cred,
 			       cred);
@@ -579,6 +572,7 @@ get_cred_kdc(krb5_context context,
 				   &krbtgt->addresses,
 				   nonce,
 				   eflags,
+				   NULL,
 				   decrypt_tkt_with_subkey,
 				   subkey);
     out2:
@@ -665,11 +659,8 @@ krb5_get_kdc_cred(krb5_context context,
     krb5_creds *krbtgt;
 
     *out_creds = calloc(1, sizeof(**out_creds));
-    if(*out_creds == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(*out_creds == NULL)
+	return krb5_enomem(context);
     ret = _krb5_get_krbtgt (context,
 			    id,
 			    in_creds->server->realm,
@@ -718,7 +709,10 @@ find_cred(krb5_context context,
 
     krb5_cc_clear_mcred(&mcreds);
     mcreds.server = server;
-    ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
+    krb5_timeofday(context, &mcreds.times.endtime);
+    ret = krb5_cc_retrieve_cred(context, id,
+				KRB5_TC_DONT_MATCH_REALM |
+				KRB5_TC_MATCH_TIMES,
 				&mcreds, out_creds);
     if(ret == 0)
 	return 0;
@@ -742,11 +736,8 @@ add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 
     for(i = 0; tmp && tmp[i]; i++); /* XXX */
     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(tmp == NULL)
+	return krb5_enomem(context);
     *tgts = tmp;
     ret = krb5_copy_creds(context, tkt, &tmp[i]);
     tmp[i+1] = NULL;
@@ -765,18 +756,22 @@ get_cred_kdc_capath_worker(krb5_context context,
                            krb5_creds ***ret_tgts)
 {
     krb5_error_code ret;
-    krb5_creds *tgt, tmp_creds;
+    krb5_creds *tgt = NULL;
+    krb5_creds tmp_creds;
     krb5_const_realm client_realm, server_realm;
     int ok_as_delegate = 1;
 
-    *out_creds = NULL;
+    *out_creds = calloc(1, sizeof(**out_creds));
+    if (*out_creds == NULL)
+	return krb5_enomem(context);
+
+    memset(&tmp_creds, 0, sizeof(tmp_creds));
 
     client_realm = krb5_principal_get_realm(context, in_creds->client);
     server_realm = krb5_principal_get_realm(context, in_creds->server);
-    memset(&tmp_creds, 0, sizeof(tmp_creds));
     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
-    if(ret)
-	return ret;
+    if (ret)
+	goto out;
 
     ret = krb5_make_principal(context,
 			      &tmp_creds.server,
@@ -784,57 +779,66 @@ get_cred_kdc_capath_worker(krb5_context context,
 			      KRB5_TGS_NAME,
 			      server_realm,
 			      NULL);
-    if(ret){
-	krb5_free_principal(context, tmp_creds.client);
-	return ret;
-    }
+    if (ret)
+	goto out;
+
     {
 	krb5_creds tgts;
 
+	/*
+	 * If we have krbtgt/server_realm@try_realm cached, use it and we're
+	 * done.
+	 */
 	ret = find_cred(context, ccache, tmp_creds.server,
 			*ret_tgts, &tgts);
-	if(ret == 0){
+	if (ret == 0) {
 	    /* only allow implicit ok_as_delegate if the realm is the clients realm */
-	    if (strcmp(try_realm, client_realm) != 0 || strcmp(try_realm, server_realm) != 0)
+	    if (strcmp(try_realm, client_realm) != 0
+		 || strcmp(try_realm, server_realm) != 0) {
 		ok_as_delegate = tgts.flags.b.ok_as_delegate;
-
-	    *out_creds = calloc(1, sizeof(**out_creds));
-	    if(*out_creds == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_message(context, ret,
-				       N_("malloc: out of memory", ""));
-	    } else {
-		ret = get_cred_kdc_address(context, ccache, flags, NULL,
-					   in_creds, &tgts,
-					   impersonate_principal,
-					   second_ticket,
-					   *out_creds);
-		if (ret) {
-		    free (*out_creds);
-		    *out_creds = NULL;
-		} else if (ok_as_delegate == 0)
-		    (*out_creds)->flags.b.ok_as_delegate = 0;
 	    }
-	    krb5_free_cred_contents(context, &tgts);
-	    krb5_free_principal(context, tmp_creds.server);
-	    krb5_free_principal(context, tmp_creds.client);
-	    return ret;
+
+	    ret = get_cred_kdc_address(context, ccache, flags, NULL,
+				   in_creds, &tgts,
+				   impersonate_principal,
+				   second_ticket,
+				   *out_creds);
+            krb5_free_cred_contents(context, &tgts);
+	    if (ret == 0 &&
+                !krb5_principal_compare(context, in_creds->server,
+                                        (*out_creds)->server)) {
+		ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	    }
+	    if (ret == 0 && ok_as_delegate == 0)
+		(*out_creds)->flags.b.ok_as_delegate = 0;
+
+	    goto out;
 	}
     }
-    if(krb5_realm_compare(context, in_creds->client, in_creds->server))
-	return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 
-    /* XXX this can loop forever */
-    while(1){
+    if (krb5_realm_compare(context, in_creds->client, in_creds->server)) {
+	ret = not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
+	goto out;
+    }
+
+    /*
+     * XXX This can loop forever, plus we recurse, so we can't just keep a
+     * count here.  The count would have to get passed around by reference.
+     *
+     * The KDCs check for transit loops for us, and capath data is finite, so
+     * in fact we'll fall out of this loop at some point.  We should do our own
+     * transit loop checking (like get_cred_kdc_referral()), and we should
+     * impose a max number of iterations altogether.  But barring malicious or
+     * broken KDCs, this is good enough.
+     */
+    while (1) {
 	heim_general_string tgt_inst;
 
 	ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 				  NULL, NULL, &tgt, ret_tgts);
-	if(ret) {
-	    krb5_free_principal(context, tmp_creds.server);
-	    krb5_free_principal(context, tmp_creds.client);
-	    return ret;
-	}
+	if (ret)
+	    goto out;
+
 	/*
 	 * if either of the chain or the ok_as_delegate was stripped
 	 * by the kdc, make sure we strip it too.
@@ -845,46 +849,46 @@ get_cred_kdc_capath_worker(krb5_context context,
 	}
 
 	ret = add_cred(context, tgt, ret_tgts);
-	if(ret) {
-	    krb5_free_principal(context, tmp_creds.server);
-	    krb5_free_principal(context, tmp_creds.client);
-	    return ret;
-	}
+	if (ret)
+	    goto out;
 	tgt_inst = tgt->server->name.name_string.val[1];
-	if(strcmp(tgt_inst, server_realm) == 0)
+	if (strcmp(tgt_inst, server_realm) == 0)
 	    break;
 	krb5_free_principal(context, tmp_creds.server);
+	tmp_creds.server = NULL;
 	ret = krb5_make_principal(context, &tmp_creds.server,
 				  tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
-	if(ret) {
-	    krb5_free_principal(context, tmp_creds.server);
-	    krb5_free_principal(context, tmp_creds.client);
-	    return ret;
-	}
+	if (ret)
+	    goto out;
 	ret = krb5_free_creds(context, tgt);
-	if(ret) {
-	    krb5_free_principal(context, tmp_creds.server);
-	    krb5_free_principal(context, tmp_creds.client);
-	    return ret;
-	}
+	tgt = NULL;
+	if (ret)
+	    goto out;
     }
 
-    krb5_free_principal(context, tmp_creds.server);
-    krb5_free_principal(context, tmp_creds.client);
-    *out_creds = calloc(1, sizeof(**out_creds));
-    if(*out_creds == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
-    } else {
-	ret = get_cred_kdc_address (context, ccache, flags, NULL,
-				    in_creds, tgt, impersonate_principal,
-				    second_ticket, *out_creds);
-	if (ret) {
-	    free (*out_creds);
-	    *out_creds = NULL;
-	}
+    ret = get_cred_kdc_address(context, ccache, flags, NULL,
+			       in_creds, tgt, impersonate_principal,
+			       second_ticket, *out_creds);
+    if (ret == 0 &&
+        !krb5_principal_compare(context, in_creds->server,
+                                    (*out_creds)->server)) {
+        krb5_free_cred_contents(context, *out_creds);
+        ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
     }
-    krb5_free_creds(context, tgt);
+    if (ret == 0 && ok_as_delegate == 0)
+        (*out_creds)->flags.b.ok_as_delegate = 0;
+
+out:
+    if (ret) {
+	krb5_free_creds(context, *out_creds);
+        *out_creds = NULL;
+    }
+    if (tmp_creds.server)
+	krb5_free_principal(context, tmp_creds.server);
+    if (tmp_creds.client)
+	krb5_free_principal(context, tmp_creds.client);
+    if (tgt)
+	krb5_free_creds(context, tgt);
     return ret;
 }
 
@@ -938,6 +942,13 @@ get_cred_kdc_capath(krb5_context context,
     return ret;
 }
 
+/*
+ * Get a service ticket from a KDC by chasing referrals from a start realm.
+ *
+ * All referral TGTs produced in the process are thrown away when we're done.
+ * We don't store them, and we don't allow other search mechanisms (capaths) to
+ * use referral TGTs produced here.
+ */
 static krb5_error_code
 get_cred_kdc_referral(krb5_context context,
 		      krb5_kdc_flags flags,
@@ -945,14 +956,16 @@ get_cred_kdc_referral(krb5_context context,
 		      krb5_creds *in_creds,
 		      krb5_principal impersonate_principal,
 		      Ticket *second_ticket,
-		      krb5_creds **out_creds,
-		      krb5_creds ***ret_tgts)
+		      krb5_creds **out_creds)
 {
-    krb5_const_realm client_realm;
+    krb5_realm start_realm = NULL;
+    krb5_data config_start_realm;
     krb5_error_code ret;
     krb5_creds tgt, referral, ticket;
+    krb5_creds **referral_tgts = NULL;  /* used for loop detection */
     int loop = 0;
     int ok_as_delegate = 1;
+    size_t i;
 
     if (in_creds->server->name.name_string.len < 2 && !flags.b.canonicalize) {
 	krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
@@ -967,33 +980,49 @@ get_cred_kdc_referral(krb5_context context,
 
     *out_creds = NULL;
 
-    client_realm = krb5_principal_get_realm(context, in_creds->client);
+
+    ret = krb5_cc_get_config(context, ccache, NULL, "start_realm", &config_start_realm);
+    if (ret == 0) {
+        start_realm = strndup(config_start_realm.data, config_start_realm.length);
+	krb5_data_free(&config_start_realm);
+    } else {
+        start_realm = strdup(krb5_principal_get_realm(context, in_creds->client));
+    }
+    if (start_realm == NULL)
+        return krb5_enomem(context);
 
     /* find tgt for the clients base realm */
     {
 	krb5_principal tgtname;
 
 	ret = krb5_make_principal(context, &tgtname,
-				  client_realm,
+				  start_realm,
 				  KRB5_TGS_NAME,
-				  client_realm,
+				  start_realm,
 				  NULL);
-	if(ret)
+	if (ret) {
+            free(start_realm);
 	    return ret;
+        }
 
-	ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
+	ret = find_cred(context, ccache, tgtname, NULL, &tgt);
 	krb5_free_principal(context, tgtname);
-	if (ret)
+	if (ret) {
+            free(start_realm);
 	    return ret;
+        }
     }
 
     referral = *in_creds;
     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
     if (ret) {
 	krb5_free_cred_contents(context, &tgt);
+        free(start_realm);
 	return ret;
     }
-    ret = krb5_principal_set_realm(context, referral.server, client_realm);
+    ret = krb5_principal_set_realm(context, referral.server, start_realm);
+    free(start_realm);
+    start_realm = NULL;
     if (ret) {
 	krb5_free_cred_contents(context, &tgt);
 	krb5_free_principal(context, referral.server);
@@ -1005,11 +1034,13 @@ get_cred_kdc_referral(krb5_context context,
 	krb5_creds mcreds;
 	char *referral_realm;
 
-	/* Use cache if we are not doing impersonation or contrainte deleg */
+	/* Use cache if we are not doing impersonation or contrained deleg */
 	if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 	    krb5_cc_clear_mcred(&mcreds);
 	    mcreds.server = referral.server;
-	    ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
+	    krb5_timeofday(context, &mcreds.times.endtime);
+	    ret = krb5_cc_retrieve_cred(context, ccache, KRB5_TC_MATCH_TIMES,
+					&mcreds, &ticket);
 	} else
 	    ret = EINVAL;
 
@@ -1038,17 +1069,16 @@ get_cred_kdc_referral(krb5_context context,
 	referral_realm = ticket.server->name.name_string.val[1];
 
 	/* check that there are no referrals loops */
-	tickets = *ret_tgts;
+	tickets = referral_tgts;
 
 	krb5_cc_clear_mcred(&mcreds);
 	mcreds.server = ticket.server;
 
-	while(tickets && *tickets){
-	    if(krb5_compare_creds(context,
+	while (tickets && *tickets){
+	    if (krb5_compare_creds(context,
 				  KRB5_TC_DONT_MATCH_REALM,
 				  &mcreds,
-				  *tickets))
-	    {
+				  *tickets)) {
 		krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
 				       N_("Referral from %s "
 					  "loops back to realm %s", ""),
@@ -1070,7 +1100,9 @@ get_cred_kdc_referral(krb5_context context,
 	    ticket.flags.b.ok_as_delegate = 0;
 	}
 
-	ret = add_cred(context, &ticket, ret_tgts);
+        _krb5_debug(context, 6, "get_cred_kdc_referral: got referral "
+                    "to %s from %s", referral_realm, referral.server->realm);
+	ret = add_cred(context, &ticket, &referral_tgts);
 	if (ret)
 	    goto out;
 
@@ -1088,6 +1120,9 @@ get_cred_kdc_referral(krb5_context context,
     ret = krb5_copy_creds(context, &ticket, out_creds);
 
 out:
+    for (i = 0; referral_tgts && referral_tgts[i]; i++)
+	krb5_free_creds(context, referral_tgts[i]);
+    free(referral_tgts);
     krb5_free_principal(context, referral.server);
     krb5_free_cred_contents(context, &tgt);
     krb5_free_cred_contents(context, &ticket);
@@ -1100,7 +1135,7 @@ out:
  * codebase.
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_cred_kdc_any(krb5_context context,
 		       krb5_kdc_flags flags,
 		       krb5_ccache ccache,
@@ -1114,29 +1149,89 @@ _krb5_get_cred_kdc_any(krb5_context context,
     krb5_deltat offset;
 
     ret = krb5_cc_get_kdc_offset(context, ccache, &offset);
-    if (ret) {
+    if (ret == 0) {
 	context->kdc_sec_offset = offset;
 	context->kdc_usec_offset = 0;
     }
 
-    ret = get_cred_kdc_referral(context,
-				flags,
-				ccache,
-				in_creds,
-				impersonate_principal,
-				second_ticket,
-				out_creds,
-				ret_tgts);
-    if (ret == 0 || flags.b.canonicalize)
-	return ret;
-    return get_cred_kdc_capath(context,
-				flags,
-				ccache,
-				in_creds,
-				impersonate_principal,
-				second_ticket,
-				out_creds,
-				ret_tgts);
+    if (strcmp(in_creds->server->realm, "") != 0) {
+        /*
+         * Non-empty realm?  Try capaths first.  We might have local
+         * policy (capaths) to honor.
+         */
+        ret = get_cred_kdc_capath(context,
+                                  flags,
+                                  ccache,
+                                  in_creds,
+                                  impersonate_principal,
+                                  second_ticket,
+                                  out_creds,
+                                  ret_tgts);
+        if (ret == 0)
+            return ret;
+    }
+
+    /* Otherwise try referrals */
+    return get_cred_kdc_referral(context,
+                                 flags,
+                                 ccache,
+                                 in_creds,
+                                 impersonate_principal,
+                                 second_ticket,
+                                 out_creds);
+}
+
+static krb5_error_code
+check_cc(krb5_context context, krb5_flags options, krb5_ccache ccache,
+	 krb5_creds *in_creds, krb5_creds *out_creds)
+{
+    krb5_error_code ret;
+    krb5_timestamp now;
+    krb5_times save_times = in_creds->times;
+    NAME_TYPE save_type = in_creds->server->name.name_type;
+
+    krb5_timeofday(context, &now);
+
+    if (!(options & KRB5_GC_EXPIRED_OK) &&
+	in_creds->times.endtime < now) {
+	in_creds->times.renew_till = 0;
+	krb5_timeofday(context, &in_creds->times.endtime);
+	options |= KRB5_TC_MATCH_TIMES;
+    }
+
+    if (save_type == KRB5_NT_SRV_HST_NEEDS_CANON) {
+        /* Avoid name canonicalization in krb5_cc_retrieve_cred() */
+        krb5_principal_set_type(context, in_creds->server, KRB5_NT_SRV_HST);
+    }
+
+    ret = krb5_cc_retrieve_cred(context, ccache,
+				(options &
+				 (KRB5_TC_DONT_MATCH_REALM |
+                                  KRB5_TC_MATCH_KEYTYPE |
+				  KRB5_TC_MATCH_TIMES)),
+				in_creds, out_creds);
+
+    in_creds->server->name.name_type = save_type;
+    in_creds->times = save_times;
+    return ret;
+}
+
+static void
+store_cred(krb5_context context, krb5_ccache ccache,
+	   krb5_const_principal server_princ, krb5_creds *creds)
+{
+    if (!krb5_principal_compare(context, creds->server, server_princ)) {
+        krb5_principal tmp_princ = creds->server;
+        /*
+         * Store the cred with the pre-canon server princ first so it
+         * can be found quickly in the future.
+         */
+        creds->server = (krb5_principal)server_princ;
+        krb5_cc_store_cred(context, ccache, creds);
+        creds->server = tmp_princ;
+        /* Then store again with the canonicalized server princ */
+    }
+    krb5_cc_store_cred(context, ccache, creds);
 }
 
 
@@ -1149,64 +1244,72 @@ krb5_get_credentials_with_flags(krb5_context context,
 				krb5_creds **out_creds)
 {
     krb5_error_code ret;
+    krb5_name_canon_iterator name_canon_iter = NULL;
+    krb5_name_canon_rule_options rule_opts;
+    krb5_const_principal try_princ = NULL;
+    krb5_principal save_princ = in_creds->server;
     krb5_creds **tgts;
     krb5_creds *res_creds;
     int i;
 
+    if (_krb5_have_debug(context, 5)) {
+        char *unparsed;
+
+        ret = krb5_unparse_name(context, in_creds->server, &unparsed);
+        if (ret) {
+            _krb5_debug(context, 5, "krb5_get_creds: unable to display "
+                        "requested service principal");
+        } else {
+            _krb5_debug(context, 5, "krb5_get_creds: requesting a ticket "
+                        "for %s", unparsed);
+            free(unparsed);
+        }
+    }
+
     if (in_creds->session.keytype) {
 	ret = krb5_enctype_valid(context, in_creds->session.keytype);
 	if (ret)
 	    return ret;
+	options |= KRB5_TC_MATCH_KEYTYPE;
     }
 
     *out_creds = NULL;
     res_creds = calloc(1, sizeof(*res_creds));
-    if (res_creds == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+    if (res_creds == NULL)
+	return krb5_enomem(context);
+
+    ret = krb5_name_canon_iterator_start(context, in_creds->server,
+					 &name_canon_iter);
+    if (ret)
+	return ret;
+
+next_rule:
+    krb5_free_cred_contents(context, res_creds);
+    memset(res_creds, 0, sizeof (*res_creds));
+    ret = krb5_name_canon_iterate(context, &name_canon_iter, &try_princ,
+                                  &rule_opts);
+    in_creds->server = rk_UNCONST(try_princ);
+    if (ret)
+	goto out;
+
+    if (name_canon_iter == NULL) {
+	if (options & KRB5_GC_CACHED)
+	    ret = KRB5_CC_NOTFOUND;
+	else
+	    ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	goto out;
     }
 
-    if (in_creds->session.keytype)
-	options |= KRB5_TC_MATCH_KEYTYPE;
-
-    /*
-     * If we got a credential, check if credential is expired before
-     * returning it.
-     */
-    ret = krb5_cc_retrieve_cred(context,
-                                ccache,
-                                in_creds->session.keytype ?
-                                KRB5_TC_MATCH_KEYTYPE : 0,
-                                in_creds, res_creds);
-    /*
-     * If we got a credential, check if credential is expired before
-     * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
-     */
+    ret = check_cc(context, options, ccache, in_creds, res_creds);
     if (ret == 0) {
-	krb5_timestamp timeret;
-
-	/* If expired ok, don't bother checking */
-        if(options & KRB5_GC_EXPIRED_OK) {
-            *out_creds = res_creds;
-            return 0;
-        }
-
-	krb5_timeofday(context, &timeret);
-	if(res_creds->times.endtime > timeret) {
-	    *out_creds = res_creds;
-	    return 0;
-	}
-	if(options & KRB5_GC_CACHED)
-	    krb5_cc_remove_cred(context, ccache, 0, res_creds);
-
+	*out_creds = res_creds;
+        res_creds = NULL;
+	goto out;
     } else if(ret != KRB5_CC_END) {
-        free(res_creds);
-        return ret;
+        goto out;
     }
-    free(res_creds);
-    if(options & KRB5_GC_CACHED)
-	return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
+    if (options & KRB5_GC_CACHED)
+	goto next_rule;
 
     if(options & KRB5_GC_USER_USER)
 	flags.b.enc_tkt_in_skey = 1;
@@ -1216,14 +1319,42 @@ krb5_get_credentials_with_flags(krb5_context context,
     tgts = NULL;
     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
 				 in_creds, NULL, NULL, out_creds, &tgts);
-    for(i = 0; tgts && tgts[i]; i++) {
-	krb5_cc_store_cred(context, ccache, tgts[i]);
+    for (i = 0; tgts && tgts[i]; i++) {
+	if ((options & KRB5_GC_NO_STORE) == 0)
+	    krb5_cc_store_cred(context, ccache, tgts[i]);
 	krb5_free_creds(context, tgts[i]);
     }
     free(tgts);
+
+    /* We don't yet have TGS w/ FAST, so we can't protect KBR-ERRORs */
+    if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
+	!(rule_opts & KRB5_NCRO_USE_FAST))
+	goto next_rule;
+
     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
-	krb5_cc_store_cred(context, ccache, *out_creds);
-    return ret;
+	store_cred(context, ccache, in_creds->server, *out_creds);
+
+    if (ret == 0 && _krb5_have_debug(context, 5)) {
+        char *unparsed;
+
+        ret = krb5_unparse_name(context, (*out_creds)->server, &unparsed);
+        if (ret) {
+            _krb5_debug(context, 5, "krb5_get_creds: unable to display "
+                        "service principal");
+        } else {
+            _krb5_debug(context, 5, "krb5_get_creds: got a ticket for %s",
+                        unparsed);
+            free(unparsed);
+        }
+    }
+
+out:
+    in_creds->server = save_princ;
+    krb5_free_creds(context, res_creds);
+    krb5_free_name_canon_iterator(context, name_canon_iter);
+    if (ret)
+	return not_found(context, in_creds->server, ret);
+    return 0;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -1251,11 +1382,8 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
 {
     *opt = calloc(1, sizeof(**opt));
-    if (*opt == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*opt == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -1320,11 +1448,8 @@ krb5_get_creds_opt_set_ticket(krb5_context context,
 	krb5_error_code ret;
 
 	opt->ticket = malloc(sizeof(*ticket));
-	if (opt->ticket == NULL) {
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (opt->ticket == NULL)
+	    return krb5_enomem(context);
 	ret = copy_Ticket(ticket, opt->ticket);
 	if (ret) {
 	    free(opt->ticket);
@@ -1338,7 +1463,6 @@ krb5_get_creds_opt_set_ticket(krb5_context context,
 }
 
 
-
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_creds(krb5_context context,
 	       krb5_get_creds_opt opt,
@@ -1352,7 +1476,29 @@ krb5_get_creds(krb5_context context,
     krb5_error_code ret;
     krb5_creds **tgts;
     krb5_creds *res_creds;
+    krb5_const_principal try_princ = NULL;
+    krb5_name_canon_iterator name_canon_iter = NULL;
+    krb5_name_canon_rule_options rule_opts;
     int i;
+    int type;
+    const char *comp;
+
+    memset(&in_creds, 0, sizeof(in_creds));
+    in_creds.server = rk_UNCONST(inprinc);
+
+    if (_krb5_have_debug(context, 5)) {
+        char *unparsed;
+
+        ret = krb5_unparse_name(context, in_creds.server, &unparsed);
+        if (ret) {
+            _krb5_debug(context, 5, "krb5_get_creds: unable to display "
+                        "requested service principal");
+        } else {
+            _krb5_debug(context, 5, "krb5_get_creds: requesting a ticket "
+                        "for %s", unparsed);
+            free(unparsed);
+        }
+    }
 
     if (opt && opt->enctype) {
 	ret = krb5_enctype_valid(context, opt->enctype);
@@ -1360,9 +1506,6 @@ krb5_get_creds(krb5_context context,
 	    return ret;
     }
 
-    memset(&in_creds, 0, sizeof(in_creds));
-    in_creds.server = rk_UNCONST(inprinc);
-
     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
     if (ret)
 	return ret;
@@ -1377,9 +1520,7 @@ krb5_get_creds(krb5_context context,
     res_creds = calloc(1, sizeof(*res_creds));
     if (res_creds == NULL) {
 	krb5_free_principal(context, in_creds.client);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     if (opt && opt->enctype) {
@@ -1387,49 +1528,47 @@ krb5_get_creds(krb5_context context,
 	options |= KRB5_TC_MATCH_KEYTYPE;
     }
 
-    /*
-     * If we got a credential, check if credential is expired before
-     * returning it.
-     */
-    ret = krb5_cc_retrieve_cred(context,
-                                ccache,
-				options & KRB5_TC_MATCH_KEYTYPE,
-                                &in_creds, res_creds);
-    /*
-     * If we got a credential, check if credential is expired before
-     * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
-     */
+    ret = krb5_name_canon_iterator_start(context, in_creds.server,
+					 &name_canon_iter);
+    if (ret)
+	goto out;
+
+next_rule:
+    ret = krb5_name_canon_iterate(context, &name_canon_iter, &try_princ,
+                                  &rule_opts);
+    in_creds.server = rk_UNCONST(try_princ);
+    if (ret)
+	goto out;
+
+    if (name_canon_iter == NULL) {
+	if (options & KRB5_GC_CACHED)
+	    ret = KRB5_CC_NOTFOUND;
+	else
+	    ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	goto out;
+    }
+
+    ret = check_cc(context, options, ccache, &in_creds, res_creds);
     if (ret == 0) {
-	krb5_timestamp timeret;
-
-	/* If expired ok, don't bother checking */
-        if(options & KRB5_GC_EXPIRED_OK) {
-            *out_creds = res_creds;
-	    krb5_free_principal(context, in_creds.client);
-            goto out;
-        }
-
-	krb5_timeofday(context, &timeret);
-	if(res_creds->times.endtime > timeret) {
-	    *out_creds = res_creds;
-	    krb5_free_principal(context, in_creds.client);
-            goto out;
-	}
-	if(options & KRB5_GC_CACHED)
-	    krb5_cc_remove_cred(context, ccache, 0, res_creds);
-
-    } else if(ret != KRB5_CC_END) {
-        free(res_creds);
-	krb5_free_principal(context, in_creds.client);
+	*out_creds = res_creds;
+        res_creds = NULL;
+	goto out;
+    } else if (ret != KRB5_CC_END) {
 	goto out;
     }
-    free(res_creds);
-    if(options & KRB5_GC_CACHED) {
-	krb5_free_principal(context, in_creds.client);
-	ret = not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
-	goto out;
-    }
-    if(options & KRB5_GC_USER_USER) {
+    if (options & KRB5_GC_CACHED)
+	goto next_rule;
+
+    type = krb5_principal_get_type(context, try_princ);
+    comp = krb5_principal_get_comp_string(context, try_princ, 0);
+    if ((type == KRB5_NT_SRV_HST || type == KRB5_NT_UNKNOWN) &&
+        comp != NULL && strcmp(comp, "host") == 0)
+	flags.b.canonicalize = 1;
+    if (rule_opts & KRB5_NCRO_NO_REFERRALS)
+	flags.b.canonicalize = 0;
+    else
+	flags.b.canonicalize = (options & KRB5_GC_CANONICALIZE) ? 1 : 0;
+    if (options & KRB5_GC_USER_USER) {
 	flags.b.enc_tkt_in_skey = 1;
 	options |= KRB5_GC_NO_STORE;
     }
@@ -1441,25 +1580,47 @@ krb5_get_creds(krb5_context context,
 	flags.b.request_anonymous = 1; /* XXX ARGH confusion */
 	flags.b.constrained_delegation = 1;
     }
-    if (options & KRB5_GC_CANONICALIZE)
-	flags.b.canonicalize = 1;
 
     tgts = NULL;
     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
-				 &in_creds, opt->self, opt->ticket,
-				 out_creds, &tgts);
-    krb5_free_principal(context, in_creds.client);
-    for(i = 0; tgts && tgts[i]; i++) {
-	krb5_cc_store_cred(context, ccache, tgts[i]);
+				 &in_creds, opt ? opt->self : 0,
+				 opt ? opt->ticket : 0, out_creds,
+				 &tgts);
+    for (i = 0; tgts && tgts[i]; i++) {
+	if ((options & KRB5_GC_NO_STORE) == 0)
+	    krb5_cc_store_cred(context, ccache, tgts[i]);
 	krb5_free_creds(context, tgts[i]);
     }
     free(tgts);
-    if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
-	krb5_cc_store_cred(context, ccache, *out_creds);
 
- out:
-    _krb5_debug(context, 5, "krb5_get_creds: ret = %d", ret);
+    /* We don't yet have TGS w/ FAST, so we can't protect KBR-ERRORs */
+    if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
+	!(rule_opts & KRB5_NCRO_USE_FAST))
+	goto next_rule;
 
+    if (ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
+	store_cred(context, ccache, inprinc, *out_creds);
+
+    if (ret == 0 && _krb5_have_debug(context, 5)) {
+        char *unparsed;
+
+        ret = krb5_unparse_name(context, (*out_creds)->server, &unparsed);
+        if (ret) {
+            _krb5_debug(context, 5, "krb5_get_creds: unable to display "
+                        "service principal");
+        } else {
+            _krb5_debug(context, 5, "krb5_get_creds: got a ticket for %s",
+                        unparsed);
+            free(unparsed);
+        }
+    }
+
+out:
+    krb5_free_creds(context, res_creds);
+    krb5_free_principal(context, in_creds.client);
+    krb5_free_name_canon_iterator(context, name_canon_iter);
+    if (ret)
+	return not_found(context, inprinc, ret);
     return ret;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_principal.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_principal.c
index 103b93293..682ec771e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_principal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_principal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_default_principal.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: get_default_principal.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -58,7 +58,7 @@ get_env_user(void)
  * avoid recursive calls.
  */
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_default_principal_local (krb5_context context,
 				   krb5_principal *princ)
 {
@@ -78,9 +78,11 @@ _krb5_get_default_principal_local (krb5_context context,
 	else
 	    ret = krb5_make_principal(context, princ, NULL, "root", NULL);
     } else {
-	struct passwd *pw = getpwuid(uid);
-	if(pw != NULL)
-	    user = pw->pw_name;
+	struct passwd pw, *pwd = NULL;
+	char pwbuf[2048];
+
+	if (rk_getpwuid_r(uid, &pw, pwbuf, sizeof(pwbuf), &pwd) == 0)
+	    user = pwd->pw_name;
 	else {
 	    user = get_env_user();
 	    if(user == NULL)
@@ -102,7 +104,7 @@ _krb5_get_default_principal_local (krb5_context context,
 #define SECURITY_WIN32
 #include <security.h>
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_default_principal_local(krb5_context context,
 				  krb5_principal *princ)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_realm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_realm.c
index f4b5b74c5..45c873f84 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_realm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_default_realm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_default_realm.c,v 1.1.1.1 2011/04/13 18:15:33 elric Exp $	*/
+/*	$NetBSD: get_default_realm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2004 Kungliga Tekniska Högskolan
@@ -75,11 +75,8 @@ krb5_get_default_realm(krb5_context context,
     }
 
     res = strdup (context->default_realms[0]);
-    if (res == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (res == NULL)
+	return krb5_enomem(context);
     *realm = res;
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_for_creds.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_for_creds.c
index 973a3da84..504884561 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_for_creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_for_creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_for_creds.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: get_for_creds.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -51,8 +51,7 @@ add_addrs(krb5_context context,
 
     tmp = realloc(addr->val, (addr->len + n) * sizeof(*addr->val));
     if (tmp == NULL && (addr->len + n) != 0) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     addr->val = tmp;
@@ -268,8 +267,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
     cred.msg_type = krb_cred;
     ALLOC_SEQ(&cred.tickets, 1);
     if (cred.tickets.val == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out2;
     }
     ret = decode_Ticket(out_creds->ticket.data,
@@ -281,8 +279,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
     memset (&enc_krb_cred_part, 0, sizeof(enc_krb_cred_part));
     ALLOC_SEQ(&enc_krb_cred_part.ticket_info, 1);
     if (enc_krb_cred_part.ticket_info.val == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out4;
     }
 
@@ -294,15 +291,13 @@ krb5_get_forwarded_creds (krb5_context	    context,
 
 	ALLOC(enc_krb_cred_part.timestamp, 1);
 	if (enc_krb_cred_part.timestamp == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out4;
 	}
 	*enc_krb_cred_part.timestamp = sec;
 	ALLOC(enc_krb_cred_part.usec, 1);
 	if (enc_krb_cred_part.usec == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out4;
 	}
 	*enc_krb_cred_part.usec      = usec;
@@ -345,9 +340,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
 	} else {
 	    ALLOC(enc_krb_cred_part.r_address, 1);
 	    if (enc_krb_cred_part.r_address == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_message(context, ret,
-				       N_("malloc: out of memory", ""));
+		ret = krb5_enomem(context);
 		goto out4;
 	    }
 
@@ -409,7 +402,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
      */
 
     if (auth_context->flags & KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED) {
-	cred.enc_part.etype = ENCTYPE_NULL;
+	cred.enc_part.etype = KRB5_ENCTYPE_NULL;
 	cred.enc_part.kvno = NULL;
 	cred.enc_part.cipher.data = buf;
 	cred.enc_part.cipher.length = buf_size;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_host_realm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_host_realm.c
index 9ee4d3c73..68b985c84 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_host_realm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_host_realm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_host_realm.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: get_host_realm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -51,8 +51,10 @@
  */
 
 static int
-copy_txt_to_realms (struct rk_resource_record *head,
-		    krb5_realm **realms)
+copy_txt_to_realms(krb5_context context,
+		   const char *domain,
+		   struct rk_resource_record *head,
+		   krb5_realm **realms)
 {
     struct rk_resource_record *rr;
     unsigned int n, i;
@@ -66,21 +68,36 @@ copy_txt_to_realms (struct rk_resource_record *head,
 
     *realms = malloc ((n + 1) * sizeof(krb5_realm));
     if (*realms == NULL)
-	return -1;
+	return krb5_enomem(context);;
 
     for (i = 0; i < n + 1; ++i)
 	(*realms)[i] = NULL;
 
     for (i = 0, rr = head; rr; rr = rr->next) {
 	if (rr->type == rk_ns_t_txt) {
-	    char *tmp;
+	    char *tmp = NULL;
+	    int invalid_tld = 1;
 
-	    tmp = strdup(rr->u.txt);
+	    /* Check for a gTLD controlled interruption */
+	    if (strcmp("Your DNS configuration needs immediate "
+			"attention see https://icann.org/namecollision",
+			rr->u.txt) != 0) {
+		invalid_tld = 0;
+		tmp = strdup(rr->u.txt);
+	    }
 	    if (tmp == NULL) {
 		for (i = 0; i < n; ++i)
 		    free ((*realms)[i]);
 		free (*realms);
-		return -1;
+		if (invalid_tld) {
+		    krb5_warnx(context,
+			       "Realm lookup failed: "
+			       "Domain '%s' needs immediate attention "
+			       "see https://icann.org/namecollision",
+				domain);
+		    return KRB5_KDC_UNREACH;
+		}
+		return krb5_enomem(context);;
 	    }
 	    (*realms)[i] = tmp;
 	    ++i;
@@ -99,7 +116,7 @@ dns_find_realm(krb5_context context,
     struct rk_dns_reply *r;
     const char **labels;
     char **config_labels;
-    int i, ret;
+    int i, ret = 0;
 
     config_labels = krb5_config_get_strings(context, NULL, "libdefaults",
 					    "dns_lookup_realm_labels", NULL);
@@ -112,24 +129,26 @@ dns_find_realm(krb5_context context,
     for (i = 0; labels[i] != NULL; i++) {
 	ret = snprintf(dom, sizeof(dom), "%s.%s.", labels[i], domain);
 	if(ret < 0 || (size_t)ret >= sizeof(dom)) {
-	    if (config_labels)
-		krb5_config_free_strings(config_labels);
-	    return -1;
+	    ret = krb5_enomem(context);
+	    goto out;
 	}
     	r = rk_dns_lookup(dom, "TXT");
     	if(r != NULL) {
-	    ret = copy_txt_to_realms (r->head, realms);
+	    ret = copy_txt_to_realms(context, domain, r->head, realms);
 	    rk_dns_free_data(r);
-	    if(ret == 0) {
-		if (config_labels)
-		    krb5_config_free_strings(config_labels);
-		return 0;
-	    }
+	    if(ret == 0)
+		goto out;
 	}
     }
+    krb5_set_error_message(context, KRB5_KDC_UNREACH,
+			    "Realm lookup failed: "
+			    "No DNS TXT record for %s",
+			    domain);
+    ret = KRB5_KDC_UNREACH;
+out:
     if (config_labels)
 	krb5_config_free_strings(config_labels);
-    return -1;
+    return ret;
 }
 
 /*
@@ -161,55 +180,78 @@ config_find_realm(krb5_context context,
  */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-_krb5_get_host_realm_int (krb5_context context,
-			  const char *host,
-			  krb5_boolean use_dns,
-			  krb5_realm **realms)
+_krb5_get_host_realm_int(krb5_context context,
+                         const char *host,
+                         krb5_boolean use_dns,
+                         krb5_realm **realms)
 {
     const char *p, *q;
+    const char *port;
     krb5_boolean dns_locate_enable;
+    krb5_error_code ret = 0;
+
+    /* Strip off any trailing ":port" suffix. */
+    port = strchr(host, ':');
+    if (port != NULL) {
+        host = strndup(host, port - host);
+        if (host == NULL)
+            return krb5_enomem(context);
+    }
 
     dns_locate_enable = krb5_config_get_bool_default(context, NULL, TRUE,
-	"libdefaults", "dns_lookup_realm", NULL);
+        "libdefaults", "dns_lookup_realm", NULL);
     for (p = host; p != NULL; p = strchr (p + 1, '.')) {
-	if(config_find_realm(context, p, realms) == 0) {
-	    if(strcasecmp(*realms[0], "dns_locate") == 0) {
-		if(use_dns)
-		    for (q = host; q != NULL; q = strchr(q + 1, '.'))
-			if(dns_find_realm(context, q, realms) == 0)
-			    return 0;
-		continue;
-	    } else
-	    	return 0;
-	}
-	else if(use_dns && dns_locate_enable) {
-	    if(dns_find_realm(context, p, realms) == 0)
-		return 0;
-	}
+        if (config_find_realm(context, p, realms) == 0) {
+            if (strcasecmp(*realms[0], "dns_locate") != 0)
+                break;
+	    krb5_free_host_realm(context, *realms);
+	    *realms = NULL;
+            if (!use_dns)
+                continue;
+            for (q = host; q != NULL; q = strchr(q + 1, '.'))
+                if (dns_find_realm(context, q, realms) == 0)
+                    break;
+            if (q)
+                break;
+        } else if (use_dns && dns_locate_enable) {
+            if (dns_find_realm(context, p, realms) == 0)
+                break;
+        }
     }
-    p = strchr(host, '.');
-    if(p != NULL) {
-	p++;
-	*realms = malloc(2 * sizeof(krb5_realm));
-	if (*realms == NULL) {
-	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
 
-	(*realms)[0] = strdup(p);
-	if((*realms)[0] == NULL) {
-	    free(*realms);
-	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
-	strupr((*realms)[0]);
-	(*realms)[1] = NULL;
-	return 0;
+    /*
+     * If 'p' is NULL, we did not find an explicit realm mapping in either the
+     * configuration file or DNS.  Try the hostname suffix as a last resort.
+     *
+     * XXX: If we implement a KDC-specific variant of this function just for
+     * referrals, we could check whether we have a cross-realm TGT for the
+     * realm in question, and if not try the parent (loop again).
+     */
+    if (p == NULL) {
+        p = strchr(host, '.');
+        if (p != NULL) {
+            p++;
+            *realms = malloc(2 * sizeof(krb5_realm));
+            if (*realms != NULL &&
+                ((*realms)[0] = strdup(p)) != NULL) {
+                strupr((*realms)[0]);
+                (*realms)[1] = NULL;
+            } else {
+                free(*realms);
+                ret = krb5_enomem(context);
+            }
+        } else {
+            krb5_set_error_message(context, KRB5_ERR_HOST_REALM_UNKNOWN,
+                                   N_("unable to find realm of host %s", ""),
+                                   host);
+            ret = KRB5_ERR_HOST_REALM_UNKNOWN;
+        }
     }
-    krb5_set_error_message(context, KRB5_ERR_HOST_REALM_UNKNOWN,
-			   N_("unable to find realm of host %s", ""),
-			   host);
-    return KRB5_ERR_HOST_REALM_UNKNOWN;
+
+    /* If 'port' is not NULL, we have a copy of 'host' to free. */
+    if (port)
+        free((void *)host);
+    return ret;
 }
 
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_in_tkt.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_in_tkt.c
index fc6dd8f20..2ddbe06f5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_in_tkt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_in_tkt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_in_tkt.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: get_in_tkt.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -117,14 +117,12 @@ add_padata(krb5_context context,
     if (!enctypes) {
 	enctypes = context->etypes;
 	netypes = 0;
-	for (ep = enctypes; *ep != ETYPE_NULL; ep++)
+	for (ep = enctypes; *ep != (krb5_enctype)ETYPE_NULL; ep++)
 	    netypes++;
     }
     pa2 = realloc (md->val, (md->len + netypes) * sizeof(*md->val));
-    if (pa2 == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (pa2 == NULL)
+	return krb5_enomem(context);
     md->val = pa2;
 
     for (i = 0; i < netypes; ++i) {
@@ -168,14 +166,12 @@ init_as_req (krb5_context context,
     a->req_body.kdc_options = opts;
     a->req_body.cname = malloc(sizeof(*a->req_body.cname));
     if (a->req_body.cname == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     a->req_body.sname = malloc(sizeof(*a->req_body.sname));
     if (a->req_body.sname == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
@@ -191,8 +187,7 @@ init_as_req (krb5_context context,
     if(creds->times.starttime) {
 	a->req_body.from = malloc(sizeof(*a->req_body.from));
 	if (a->req_body.from == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	*a->req_body.from = creds->times.starttime;
@@ -204,8 +199,7 @@ init_as_req (krb5_context context,
     if(creds->times.renew_till){
 	a->req_body.rtime = malloc(sizeof(*a->req_body.rtime));
 	if (a->req_body.rtime == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	*a->req_body.rtime = creds->times.renew_till;
@@ -228,8 +222,7 @@ init_as_req (krb5_context context,
     } else {
 	a->req_body.addresses = malloc(sizeof(*a->req_body.addresses));
 	if (a->req_body.addresses == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 
@@ -253,8 +246,7 @@ init_as_req (krb5_context context,
 	size_t i;
 	ALLOC(a->padata, 1);
 	if(a->padata == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	a->padata->val = NULL;
@@ -292,8 +284,7 @@ init_as_req (krb5_context context,
     else if (*ptypes ==  KRB5_PADATA_ENC_TIMESTAMP) {
 	ALLOC(a->padata, 1);
 	if (a->padata == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	a->padata->len = 0;
@@ -514,6 +505,7 @@ krb5_get_in_cred(krb5_context context,
 				   NULL,
 				   nonce,
 				   flags,
+				   NULL,
 				   decrypt_proc,
 				   decryptarg);
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/get_port.c b/crypto/external/bsd/heimdal/dist/lib/krb5/get_port.c
index cbe67cf99..ff001afd6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/get_port.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/get_port.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_port.c,v 1.1.1.1 2011/04/13 18:15:34 elric Exp $	*/
+/*	$NetBSD: get_port.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/heim_err.et b/crypto/external/bsd/heimdal/dist/lib/krb5/heim_err.et
index 177021ed7..ac15cb74a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/heim_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/heim_err.et
@@ -20,6 +20,7 @@ error_code SERVICE_NOMATCH,	"Unacceptable service used"
 error_code NOT_SEEKABLE,	"File descriptor not seekable"
 error_code TOO_BIG,		"Offset too large"
 error_code BAD_HDBENT_ENCODING,	"Invalid HDB entry encoding"
+error_code RANDOM_OFFLINE,	"No random source available"
 
 index 64
 prefix HEIM_PKINIT
@@ -44,4 +45,9 @@ error_code NONAME,		"nodename nor servname provided, or not known"
 error_code SERVICE,		"servname not supported for ai_socktype"
 error_code SOCKTYPE,		"ai_socktype not supported"
 error_code SYSTEM,		"system error returned in errno"
+
+index 192
+prefix HEIM_NET
+error_code CONN_REFUSED,	"connection refused"
+
 end
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds.c b/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds.c
index 19796b3d1..3f310a893 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_creds.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: init_creds.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -62,18 +62,13 @@ krb5_get_init_creds_opt_alloc(krb5_context context,
 
     *opt = NULL;
     o = calloc(1, sizeof(*o));
-    if (o == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (o == NULL)
+	return krb5_enomem(context);
 
     o->opt_private = calloc(1, sizeof(*o->opt_private));
     if (o->opt_private == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	free(o);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     o->opt_private->refcount = 1;
     *opt = o;
@@ -202,6 +197,13 @@ krb5_get_init_creds_opt_set_default_flags(krb5_context context,
 #endif
 }
 
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_get_init_creds_opt_set_change_password_prompt(krb5_get_init_creds_opt *opt,
+                                                   int change_password_prompt)
+{
+	opt->flags |= KRB5_GET_INIT_CREDS_OPT_CHANGE_PASSWORD_PROMPT;
+	opt->change_password_prompt = change_password_prompt;
+}
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt *opt,
@@ -381,7 +383,7 @@ krb5_get_init_creds_opt_set_process_last_req(krb5_context context,
 					     void *ctx)
 {
     krb5_error_code ret;
-    ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
+    ret = require_ext_opt(context, opt, "init_creds_opt_set_process_last_req");
     if (ret)
 	return ret;
 
@@ -425,10 +427,8 @@ krb5_get_init_creds_opt_get_error(krb5_context context,
     KRB5_DEPRECATED_FUNCTION("Use X instead")
 {
     *error = calloc(1, sizeof(**error));
-    if (*error == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*error == NULL)
+	return krb5_enomem(context);
 
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds_pw.c b/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds_pw.c
index 06b95988c..353c80483 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds_pw.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/init_creds_pw.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_creds_pw.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: init_creds_pw.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -36,6 +36,9 @@
  */
 
 #include "krb5_locl.h"
+#ifndef WIN32
+#include <heim-ipc.h>
+#endif /* WIN32 */
 
 typedef struct krb5_get_init_creds_ctx {
     KDCOptions flags;
@@ -63,6 +66,10 @@ typedef struct krb5_get_init_creds_ctx {
     krb5_pk_init_ctx pk_init_ctx;
     int ic_flags;
 
+    struct {
+	unsigned change_password:1;
+    } runflags;
+
     int used_pa_types;
 #define  USED_PKINIT	1
 #define  USED_PKINIT_W2K	2
@@ -78,7 +85,25 @@ typedef struct krb5_get_init_creds_ctx {
     void *prompter_data;
 
     struct pa_info_data *ppaid;
-
+    struct fast_state {
+	enum PA_FX_FAST_REQUEST_enum type;
+	unsigned int flags;
+#define KRB5_FAST_REPLY_KEY_USE_TO_ENCRYPT_THE_REPLY 1
+#define KRB5_FAST_REPLY_KEY_USE_IN_TRANSACTION 2
+#define KRB5_FAST_KDC_REPLY_KEY_REPLACED 4
+#define KRB5_FAST_REPLY_REPLY_VERIFED 8
+#define KRB5_FAST_STRONG 16
+#define KRB5_FAST_EXPECTED 32 /* in exchange with KDC, fast was discovered */
+#define KRB5_FAST_REQUIRED 64 /* fast required by action of caller */
+#define KRB5_FAST_DISABLED 128
+#define KRB5_FAST_AP_ARMOR_SERVICE 256
+	krb5_keyblock *reply_key;
+	krb5_ccache armor_ccache;
+	krb5_principal armor_service;
+	krb5_crypto armor_crypto;
+	krb5_keyblock armor_key;
+	krb5_keyblock *strengthen_key;
+    } fast_state;
 } krb5_get_init_creds_ctx;
 
 
@@ -142,6 +167,19 @@ free_init_creds_ctx(krb5_context context, krb5_init_creds_context ctx)
 	memset(ctx->password, 0, strlen(ctx->password));
 	free(ctx->password);
     }
+    /*
+     * FAST state (we don't close the armor_ccache because we might have
+     * to destroy it, and how would we know? also, the caller should
+     * take care of cleaning up the armor_ccache).
+     */
+    if (ctx->fast_state.armor_service)
+	krb5_free_principal(context, ctx->fast_state.armor_service);
+    if (ctx->fast_state.armor_crypto)
+	krb5_crypto_destroy(context, ctx->fast_state.armor_crypto);
+    if (ctx->fast_state.strengthen_key)
+	krb5_free_keyblock(context, ctx->fast_state.strengthen_key);
+    krb5_free_keyblock_contents(context, &ctx->fast_state.armor_key);
+
     krb5_data_free(&ctx->req_buffer);
     krb5_free_cred_contents(context, &ctx->cred);
     free_METHOD_DATA(&ctx->md);
@@ -196,13 +234,11 @@ init_cred (krb5_context context,
     memset (cred, 0, sizeof(*cred));
 
     if (client)
-	krb5_copy_principal(context, client, &cred->client);
-    else {
-	ret = krb5_get_default_principal (context,
-					  &cred->client);
-	if (ret)
-	    goto out;
-    }
+	ret = krb5_copy_principal(context, client, &cred->client);
+    else
+	ret = krb5_get_default_principal(context, &cred->client);
+    if (ret)
+        goto out;
 
     if (start_time)
 	cred->times.starttime  = now + start_time;
@@ -210,12 +246,15 @@ init_cred (krb5_context context,
     if (options->flags & KRB5_GET_INIT_CREDS_OPT_TKT_LIFE)
 	tmp = options->tkt_life;
     else
-	tmp = 10 * 60 * 60;
+	tmp = KRB5_TKT_LIFETIME_DEFAULT;
     cred->times.endtime = now + tmp;
 
-    if ((options->flags & KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE) &&
-	options->renew_life > 0) {
-	cred->times.renew_till = now + options->renew_life;
+    if ((options->flags & KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE)) {
+	if (options->renew_life > 0)
+	    tmp = options->renew_life;
+	else
+	    tmp = KRB5_TKT_RENEW_LIFETIME_DEFAULT;
+	cred->times.renew_till = now + tmp;
     }
 
     return 0;
@@ -253,10 +292,10 @@ report_expiration (krb5_context context,
  * @param ctx The krb5_init_creds_context check for expiration.
  */
 
-static krb5_error_code
-process_last_request(krb5_context context,
-		     krb5_get_init_creds_opt *options,
-		     krb5_init_creds_context ctx)
+krb5_error_code
+krb5_process_last_request(krb5_context context,
+			  krb5_get_init_creds_opt *options,
+			  krb5_init_creds_context ctx)
 {
     krb5_const_realm realm;
     LastReq *lr;
@@ -275,12 +314,9 @@ process_last_request(krb5_context context,
     if (options && options->opt_private && options->opt_private->lr.func) {
 	krb5_last_req_entry **lre;
 
-	lre = calloc(lr->len + 1, sizeof(**lre));
-	if (lre == NULL) {
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	lre = calloc(lr->len + 1, sizeof(*lre));
+	if (lre == NULL)
+	    return krb5_enomem(context);
 	for (i = 0; i < lr->len; i++) {
 	    lre[i] = calloc(1, sizeof(*lre[i]));
 	    if (lre[i] == NULL)
@@ -313,7 +349,7 @@ process_last_request(krb5_context context,
 
     for (i = 0; i < lr->len; ++i) {
 	if (lr->val[i].lr_value <= t) {
-	    switch (abs(lr->val[i].lr_type)) {
+	    switch (lr->val[i].lr_type) {
 	    case LR_PW_EXPTIME :
 		report_expiration(context, ctx->prompter,
 				  ctx->prompter_data,
@@ -328,6 +364,8 @@ process_last_request(krb5_context context,
 				  lr->val[i].lr_value);
 		reported = TRUE;
 		break;
+            default:
+                break;
 	    }
 	}
     }
@@ -442,8 +480,7 @@ get_init_creds_common(krb5_context context,
 	etypes = malloc((options->etype_list_length + 1)
 			* sizeof(krb5_enctype));
 	if (etypes == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	memcpy (etypes, options->etype_list,
@@ -455,8 +492,7 @@ get_init_creds_common(krb5_context context,
 	pre_auth_types = malloc((options->preauth_list_length + 1)
 				* sizeof(krb5_preauthtype));
 	if (pre_auth_types == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	memcpy (pre_auth_types, options->preauth_list,
@@ -496,6 +532,8 @@ change_password (krb5_context context,
     char *p;
     krb5_get_init_creds_opt *options;
 
+    heim_assert(prompter != NULL, "unexpected NULL prompter");
+
     memset (&cpw_cred, 0, sizeof(cpw_cred));
 
     ret = krb5_get_init_creds_opt_alloc(context, &options);
@@ -504,10 +542,15 @@ change_password (krb5_context context,
     krb5_get_init_creds_opt_set_tkt_life (options, 60);
     krb5_get_init_creds_opt_set_forwardable (options, FALSE);
     krb5_get_init_creds_opt_set_proxiable (options, FALSE);
-    if (old_options && old_options->flags & KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST)
-	krb5_get_init_creds_opt_set_preauth_list (options,
-						  old_options->preauth_list,
-						  old_options->preauth_list_length);
+    if (old_options &&
+        (old_options->flags & KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST))
+	krb5_get_init_creds_opt_set_preauth_list(options,
+						 old_options->preauth_list,
+						 old_options->preauth_list_length);
+    if (old_options &&
+        (old_options->flags & KRB5_GET_INIT_CREDS_OPT_CHANGE_PASSWORD_PROMPT))
+        krb5_get_init_creds_opt_set_change_password_prompt(options,
+                                                           old_options->change_password_prompt);
 
     krb5_data_zero (&result_code_string);
     krb5_data_zero (&result_string);
@@ -628,14 +671,12 @@ init_as_req (krb5_context context,
     a->req_body.kdc_options = opts;
     a->req_body.cname = malloc(sizeof(*a->req_body.cname));
     if (a->req_body.cname == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
     a->req_body.sname = malloc(sizeof(*a->req_body.sname));
     if (a->req_body.sname == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto fail;
     }
 
@@ -653,21 +694,23 @@ init_as_req (krb5_context context,
     if(creds->times.starttime) {
 	a->req_body.from = malloc(sizeof(*a->req_body.from));
 	if (a->req_body.from == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	*a->req_body.from = creds->times.starttime;
     }
     if(creds->times.endtime){
-	ALLOC(a->req_body.till, 1);
-	*a->req_body.till = creds->times.endtime;
+	if ((ALLOC(a->req_body.till, 1)) != NULL)
+            *a->req_body.till = creds->times.endtime;
+        else {
+            ret = krb5_enomem(context);
+            goto fail;
+        }
     }
     if(creds->times.renew_till){
 	a->req_body.rtime = malloc(sizeof(*a->req_body.rtime));
 	if (a->req_body.rtime == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	*a->req_body.rtime = creds->times.renew_till;
@@ -690,8 +733,7 @@ init_as_req (krb5_context context,
     } else {
 	a->req_body.addresses = malloc(sizeof(*a->req_body.addresses));
 	if (a->req_body.addresses == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 
@@ -861,7 +903,7 @@ pa_pw_or_afs3_salt(krb5_context context,
 		   heim_octet_string *data)
 {
     krb5_error_code ret;
-    if (paid->etype == ENCTYPE_NULL)
+    if (paid->etype == KRB5_ENCTYPE_NULL)
 	return NULL;
     ret = set_paid(paid, context,
 		   paid->etype,
@@ -1004,7 +1046,7 @@ add_enc_ts_padata(krb5_context context,
     if (!enctypes) {
 	enctypes = context->etypes;
 	netypes = 0;
-	for (ep = enctypes; *ep != ETYPE_NULL; ep++)
+	for (ep = enctypes; *ep != (krb5_enctype)ETYPE_NULL; ep++)
 	    netypes++;
     }
 
@@ -1158,10 +1200,9 @@ process_pa_data_to_md(krb5_context context,
     krb5_error_code ret;
 
     ALLOC(*out_md, 1);
-    if (*out_md == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*out_md == NULL)
+	return krb5_enomem(context);
+
     (*out_md)->len = 0;
     (*out_md)->val = NULL;
 
@@ -1205,8 +1246,10 @@ process_pa_data_to_md(krb5_context context,
  	unsigned flag;
 
 	paid = calloc(1, sizeof(*paid));
+        if (paid == NULL)
+            return krb5_enomem(context);
 
-	paid->etype = ENCTYPE_NULL;
+	paid->etype = KRB5_ENCTYPE_NULL;
 	ppaid = process_pa_info(context, creds->client, a, paid, in_md);
 
  	if (ppaid)
@@ -1217,6 +1260,7 @@ process_pa_data_to_md(krb5_context context,
  	if (ctx->used_pa_types & flag) {
  	    if (ppaid)
  		free_paid(context, ppaid);
+            free(paid);
  	    krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
  				   "Already tried ENC-TS-%s, looping",
  				   flag == USED_ENC_TS_INFO ? "info" : "guess");
@@ -1239,6 +1283,12 @@ process_pa_data_to_md(krb5_context context,
 
     pa_data_add_pac_request(context, ctx, *out_md);
 
+    if ((ctx->fast_state.flags & KRB5_FAST_DISABLED) == 0) {
+ 	ret = krb5_padata_add(context, *out_md, KRB5_PADATA_REQ_ENC_PA_REP, NULL, 0);
+ 	if (ret)
+ 	    return ret;
+    }
+
     if ((*out_md)->len == 0) {
 	free(*out_md);
 	*out_md = NULL;
@@ -1359,10 +1409,8 @@ krb5_init_creds_init(krb5_context context,
     *rctx = NULL;
 
     ctx = calloc(1, sizeof(*ctx));
-    if (ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ctx == NULL)
+	return krb5_enomem(context);
 
     ret = get_init_creds_common(context, client, start_time, options, ctx);
     if (ret) {
@@ -1460,10 +1508,8 @@ krb5_init_creds_set_password(krb5_context context,
     }
     if (password) {
 	ctx->password = strdup(password);
-	if (ctx->password == NULL) {
-	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (ctx->password == NULL)
+	    return krb5_enomem(context);
 	ctx->keyseed = (void *) ctx->password;
     } else {
 	ctx->keyseed = NULL;
@@ -1528,14 +1574,11 @@ krb5_init_creds_set_keytab(krb5_context context,
     krb5_enctype *etypes = NULL;
     krb5_error_code ret;
     size_t netypes = 0;
-    int kvno = 0;
+    int kvno = 0, found = 0;
 
     a = malloc(sizeof(*a));
-    if (a == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (a == NULL)
+	return krb5_enomem(context);
 
     a->principal = ctx->cred.client;
     a->keytab    = keytab;
@@ -1561,6 +1604,8 @@ krb5_init_creds_set_keytab(krb5_context context,
 	if (!krb5_principal_compare(context, entry.principal, ctx->cred.client))
 	    goto next;
 
+	found = 1;
+
 	/* check if we ahve this kvno already */
 	if (entry.vno > kvno) {
 	    /* remove old list of etype */
@@ -1578,8 +1623,11 @@ krb5_init_creds_set_keytab(krb5_context context,
 
 	/* add enctype to supported list */
 	ptr = realloc(etypes, sizeof(etypes[0]) * (netypes + 2));
-	if (ptr == NULL)
-	    goto next;
+	if (ptr == NULL) {
+	    free(etypes);
+	    ret = krb5_enomem(context);
+	    goto out;
+	}
 
 	etypes = ptr;
 	etypes[netypes] = entry.keyblock.keytype;
@@ -1597,7 +1645,13 @@ krb5_init_creds_set_keytab(krb5_context context,
     }
 
  out:
-    return 0;
+    if (!found) {
+	if (ret == 0)
+	    ret = KRB5_KT_NOTFOUND;
+	_krb5_kt_principal_not_found(context, ret, keytab, ctx->cred.client, 0, 0);
+    }
+
+    return ret;
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -1620,6 +1674,483 @@ krb5_init_creds_set_keyblock(krb5_context context,
     return 0;
 }
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_init_creds_set_fast_ccache(krb5_context context,
+				krb5_init_creds_context ctx,
+				krb5_ccache fast_ccache)
+{
+    ctx->fast_state.armor_ccache = fast_ccache;
+    ctx->fast_state.flags |= KRB5_FAST_REQUIRED;
+    return 0;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_init_creds_set_fast_ap_armor_service(krb5_context context,
+					  krb5_init_creds_context ctx,
+					  krb5_const_principal armor_service)
+{
+    krb5_error_code ret;
+
+    if (ctx->fast_state.armor_service)
+	krb5_free_principal(context, ctx->fast_state.armor_service);
+    if (armor_service) {
+	ret = krb5_copy_principal(context, armor_service, &ctx->fast_state.armor_service);
+	if (ret)
+	    return ret;
+    } else {
+	ctx->fast_state.armor_service = NULL;
+    }
+    ctx->fast_state.flags |= KRB5_FAST_REQUIRED | KRB5_FAST_AP_ARMOR_SERVICE;
+    return 0;
+}
+
+/*
+ * FAST
+ */
+
+static krb5_error_code
+check_fast(krb5_context context, struct fast_state *state)
+{
+    if (state->flags & KRB5_FAST_EXPECTED) {
+	krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
+			       "Expected FAST, but no FAST "
+			       "was in the response from the KDC");
+	return KRB5KRB_AP_ERR_MODIFIED;
+    }
+    return 0;
+}
+
+
+static krb5_error_code
+fast_unwrap_as_rep(krb5_context context, int32_t nonce,
+		   krb5_data *chksumdata,
+		   struct fast_state *state, AS_REP *rep)
+{
+    PA_FX_FAST_REPLY fxfastrep;
+    KrbFastResponse fastrep;
+    krb5_error_code ret;
+    PA_DATA *pa = NULL;
+    int idx = 0;
+
+    if (state->armor_crypto == NULL || rep->padata == NULL)
+	return check_fast(context, state);
+
+    /* find PA_FX_FAST_REPLY */
+
+    pa = krb5_find_padata(rep->padata->val, rep->padata->len,
+			  KRB5_PADATA_FX_FAST, &idx);
+    if (pa == NULL)
+	return check_fast(context, state);
+
+    memset(&fxfastrep, 0, sizeof(fxfastrep));
+    memset(&fastrep, 0, sizeof(fastrep));
+
+    ret = decode_PA_FX_FAST_REPLY(pa->padata_value.data, pa->padata_value.length, &fxfastrep, NULL);
+    if (ret)
+	return ret;
+
+    if (fxfastrep.element == choice_PA_FX_FAST_REPLY_armored_data) {
+	krb5_data data;
+	ret = krb5_decrypt_EncryptedData(context,
+					 state->armor_crypto,
+					 KRB5_KU_FAST_REP,
+					 &fxfastrep.u.armored_data.enc_fast_rep,
+					 &data);
+	if (ret)
+	    goto out;
+
+	ret = decode_KrbFastResponse(data.data, data.length, &fastrep, NULL);
+	krb5_data_free(&data);
+	if (ret)
+	    goto out;
+
+    } else {
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+
+    free_METHOD_DATA(rep->padata);
+    ret = copy_METHOD_DATA(&fastrep.padata, rep->padata);
+    if (ret)
+	goto out;
+
+    if (fastrep.strengthen_key) {
+	if (state->strengthen_key)
+	    krb5_free_keyblock(context, state->strengthen_key);
+
+	ret = krb5_copy_keyblock(context, fastrep.strengthen_key, &state->strengthen_key);
+	if (ret)
+	    goto out;
+    }
+
+    if (nonce != fastrep.nonce) {
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	goto out;
+    }
+    if (fastrep.finished) {
+	PrincipalName cname;
+	krb5_realm crealm = NULL;
+
+	if (chksumdata == NULL) {
+	    ret = KRB5KDC_ERR_PREAUTH_FAILED;
+	    goto out;
+	}
+
+	ret = krb5_verify_checksum(context, state->armor_crypto,
+				   KRB5_KU_FAST_FINISHED,
+				   chksumdata->data, chksumdata->length,
+				   &fastrep.finished->ticket_checksum);
+	if (ret)
+	    goto out;
+
+	/* update */
+	ret = copy_Realm(&fastrep.finished->crealm, &crealm);
+	if (ret)
+	    goto out;
+	free_Realm(&rep->crealm);
+	rep->crealm = crealm;
+
+	ret = copy_PrincipalName(&fastrep.finished->cname, &cname);
+	if (ret)
+	    goto out;
+	free_PrincipalName(&rep->cname);
+	rep->cname = cname;
+	
+#if 0 /* store authenticated checksum as kdc-offset */
+	fastrep->finished.timestamp;
+	fastrep->finished.usec = 0;
+#endif
+
+    } else if (chksumdata) {
+	/* expected fastrep.finish but didn't get it */
+	ret = KRB5KDC_ERR_PREAUTH_FAILED;
+    }
+
+ out:
+    free_PA_FX_FAST_REPLY(&fxfastrep);
+
+    return ret;
+}
+
+static krb5_error_code
+fast_unwrap_error(krb5_context context, struct fast_state *state, KRB_ERROR *error)
+{
+    if (state->armor_crypto == NULL)
+	return check_fast(context, state);
+
+    return 0;
+}
+
+krb5_error_code
+_krb5_make_fast_ap_fxarmor(krb5_context context,
+			   krb5_ccache armor_ccache,
+			   krb5_data *armor_value,
+			   krb5_keyblock *armor_key,
+			   krb5_crypto *armor_crypto)
+{
+    krb5_auth_context auth_context = NULL;
+    krb5_creds cred, *credp = NULL;
+    krb5_error_code ret;
+    krb5_data empty;
+
+    krb5_data_zero(&empty);
+
+    memset(&cred, 0, sizeof(cred));
+
+    ret = krb5_auth_con_init (context, &auth_context);
+    if (ret)
+	goto out;
+    
+    ret = krb5_cc_get_principal(context, armor_ccache, &cred.client);
+    if (ret)
+	goto out;
+    
+    ret = krb5_make_principal(context, &cred.server,
+			      cred.client->realm,
+			      KRB5_TGS_NAME,
+			      cred.client->realm,
+			      NULL);
+    if (ret) {
+	krb5_free_principal(context, cred.client);
+	goto out;
+    }
+    
+    ret = krb5_get_credentials(context, 0, armor_ccache, &cred, &credp);
+    krb5_free_principal(context, cred.server);
+    krb5_free_principal(context, cred.client);
+    if (ret)
+	goto out;
+    
+    ret = krb5_auth_con_add_AuthorizationData(context, auth_context, KRB5_PADATA_FX_FAST_ARMOR, &empty);
+    if (ret)
+	goto out;
+
+    ret = krb5_mk_req_extended(context,
+			       &auth_context,
+			       AP_OPTS_USE_SUBKEY,
+			       NULL,
+			       credp,
+			       armor_value);
+    krb5_free_creds(context, credp);
+    if (ret)
+	goto out;
+    
+    ret = _krb5_fast_armor_key(context,
+			       auth_context->local_subkey,
+			       auth_context->keyblock,
+			       armor_key,
+			       armor_crypto);
+    if (ret)
+	goto out;
+
+ out:
+    krb5_auth_con_free(context, auth_context);
+    return ret;
+}
+
+#ifndef WIN32
+static heim_base_once_t armor_service_once = HEIM_BASE_ONCE_INIT;
+static heim_ipc armor_service = NULL;
+
+static void
+fast_armor_init_ipc(void *ctx)
+{
+    heim_ipc *ipc = ctx;
+    heim_ipc_init_context("ANY:org.h5l.armor-service", ipc);
+}
+#endif /* WIN32 */
+
+
+static krb5_error_code
+make_fast_ap_fxarmor(krb5_context context,
+		     struct fast_state *state,
+		     const char *realm,
+		     KrbFastArmor **armor)
+{
+    KrbFastArmor *fxarmor = NULL;
+    krb5_error_code ret;
+
+    if (state->armor_crypto)
+	krb5_crypto_destroy(context, state->armor_crypto);
+    krb5_free_keyblock_contents(context, &state->armor_key);
+
+
+    ALLOC(fxarmor, 1);
+    if (fxarmor == NULL)
+	return krb5_enomem(context);
+
+    if (state->flags & KRB5_FAST_AP_ARMOR_SERVICE) {
+#ifdef WIN32
+	krb5_set_error_message(context, ENOTSUP, "Fast armor IPC service not supportted yet on Windows");
+	ret = ENOTSUP;
+        goto out;
+#else /* WIN32 */
+	KERB_ARMOR_SERVICE_REPLY msg;
+	krb5_data request, reply;
+
+	heim_base_once_f(&armor_service_once, &armor_service, fast_armor_init_ipc);
+	if (armor_service == NULL) {
+	    krb5_set_error_message(context, ENOENT, "Failed to open fast armor service");
+            ret = ENOENT;
+	    goto out;
+	}
+
+	krb5_data_zero(&reply);
+
+	request.data = rk_UNCONST(realm);
+	request.length = strlen(realm);
+
+	ret = heim_ipc_call(armor_service, &request, &reply, NULL);
+	heim_release(send);
+	if (ret) {
+	    krb5_set_error_message(context, ret, "Failed to get armor service credential");
+	    goto out;
+	}
+
+	ret = decode_KERB_ARMOR_SERVICE_REPLY(reply.data, reply.length, &msg, NULL);
+	krb5_data_free(&reply);
+	if (ret)
+	    goto out;
+
+	ret = copy_KrbFastArmor(fxarmor, &msg.armor);
+	if (ret) {
+	    free_KERB_ARMOR_SERVICE_REPLY(&msg);
+	    goto out;
+	}
+
+	ret = krb5_copy_keyblock_contents(context, &msg.armor_key, &state->armor_key);
+	free_KERB_ARMOR_SERVICE_REPLY(&msg);
+	if (ret)
+	    goto out;
+
+	ret = krb5_crypto_init(context, &state->armor_key, 0, &state->armor_crypto);
+	if (ret)
+	    goto out;
+#endif /* WIN32 */
+    } else {
+
+	fxarmor->armor_type = 1;
+
+	ret = _krb5_make_fast_ap_fxarmor(context,
+					 state->armor_ccache,
+					 &fxarmor->armor_value,
+					 &state->armor_key,
+					 &state->armor_crypto);
+	if (ret)
+	    goto out;
+    }
+    
+
+    *armor = fxarmor;
+    fxarmor = NULL;
+ out:
+    if (fxarmor) {
+	free_KrbFastArmor(fxarmor);
+	free(fxarmor);
+    }
+    return ret;
+}
+
+static krb5_error_code
+fast_wrap_req(krb5_context context, struct fast_state *state, KDC_REQ *req)
+{
+    KrbFastArmor *fxarmor = NULL;
+    PA_FX_FAST_REQUEST fxreq;
+    krb5_error_code ret;
+    KrbFastReq fastreq;
+    krb5_data data;
+    size_t size;
+
+    if (state->flags & KRB5_FAST_DISABLED) {
+	_krb5_debug(context, 10, "fast disabled, not doing any fast wrapping");
+	return 0;
+    }
+
+    memset(&fxreq, 0, sizeof(fxreq));
+    memset(&fastreq, 0, sizeof(fastreq));
+    krb5_data_zero(&data);
+
+    if (state->armor_crypto == NULL) {
+	if (state->armor_ccache) {
+	    /*
+	     * Instead of keeping state in FX_COOKIE in the KDC, we
+	     * rebuild a new armor key for every request, because this
+	     * is what the MIT KDC expect and RFC6113 is vage about
+	     * what the behavior should be.
+	     */
+	    state->type = choice_PA_FX_FAST_REQUEST_armored_data;
+	} else {
+	    return check_fast(context, state);
+	}
+    }
+
+    state->flags |= KRB5_FAST_EXPECTED;
+
+    fastreq.fast_options.hide_client_names = 1;
+
+    ret = copy_KDC_REQ_BODY(&req->req_body, &fastreq.req_body);
+    free_KDC_REQ_BODY(&req->req_body);
+
+    req->req_body.realm = strdup(KRB5_ANON_REALM);
+    if ((ALLOC(req->req_body.cname, 1)) != NULL) {
+        req->req_body.cname->name_type = KRB5_NT_WELLKNOWN;
+    if ((ALLOC(req->req_body.cname->name_string.val, 2)) != NULL) {
+        req->req_body.cname->name_string.len = 2;
+        req->req_body.cname->name_string.val[0] = strdup(KRB5_WELLKNOWN_NAME);
+        req->req_body.cname->name_string.val[1] = strdup(KRB5_ANON_NAME);
+        if (req->req_body.cname->name_string.val[0] == NULL ||
+            req->req_body.cname->name_string.val[1] == NULL)
+            ret = krb5_enomem(context);
+      } else
+          ret = krb5_enomem(context);
+    } else
+        ret = krb5_enomem(context);
+    if ((ALLOC(req->req_body.till, 1)) != NULL)
+        *req->req_body.till = 0;
+    else
+        ret = krb5_enomem(context);
+    if (ret)
+        goto out;
+
+    if (req->padata) {
+	ret = copy_METHOD_DATA(req->padata, &fastreq.padata);
+	free_METHOD_DATA(req->padata);
+    } else {
+	if ((ALLOC(req->padata, 1)) == NULL)
+            ret = krb5_enomem(context);
+    }
+    if (ret)
+        goto out;
+
+    ASN1_MALLOC_ENCODE(KrbFastReq, data.data, data.length, &fastreq, &size, ret);
+    if (ret)
+	goto out;
+    heim_assert(data.length == size, "ASN.1 internal error");
+
+    fxreq.element = state->type;
+
+    if (state->type == choice_PA_FX_FAST_REQUEST_armored_data) {
+	size_t len;
+	void *buf;
+
+	ret = make_fast_ap_fxarmor(context, state, fastreq.req_body.realm, &fxreq.u.armored_data.armor);
+	if (ret)
+	    goto out;
+
+	heim_assert(state->armor_crypto != NULL, "FAST armor key missing when FAST started");
+
+	ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, len, &req->req_body, &size, ret);
+	if (ret)
+	    goto out;
+	heim_assert(len == size, "ASN.1 internal error");
+
+	ret = krb5_create_checksum(context, state->armor_crypto,
+				   KRB5_KU_FAST_REQ_CHKSUM, 0,
+				   buf, len, 
+				   &fxreq.u.armored_data.req_checksum);
+	free(buf);
+	if (ret)
+	    goto out;
+
+	ret = krb5_encrypt_EncryptedData(context, state->armor_crypto,
+					 KRB5_KU_FAST_ENC,
+					 data.data,
+					 data.length,
+					 0,
+					 &fxreq.u.armored_data.enc_fast_req);
+	krb5_data_free(&data);
+        if (ret)
+            goto out;
+
+    } else {
+	krb5_data_free(&data);
+	heim_assert(false, "unknown FAST type, internal error");
+    }
+
+    ASN1_MALLOC_ENCODE(PA_FX_FAST_REQUEST, data.data, data.length, &fxreq, &size, ret);
+    if (ret)
+	goto out;
+    heim_assert(data.length == size, "ASN.1 internal error");
+
+
+    ret = krb5_padata_add(context, req->padata, KRB5_PADATA_FX_FAST, data.data, data.length);
+    if (ret)
+	goto out;
+    krb5_data_zero(&data);
+
+ out:
+    free_PA_FX_FAST_REQUEST(&fxreq);
+    free_KrbFastReq(&fastreq);
+    if (fxarmor) {
+	free_KrbFastArmor(fxarmor);
+	free(fxarmor);
+    }
+    krb5_data_free(&data);
+
+    return ret;
+}
+
+
 /**
  * The core loop if krb5_get_init_creds() function family. Create the
  * packets and have the caller send them off to the KDC.
@@ -1652,6 +2183,7 @@ krb5_init_creds_step(krb5_context context,
     krb5_error_code ret;
     size_t len = 0;
     size_t size;
+    AS_REQ req2;
 
     krb5_data_zero(out);
 
@@ -1686,8 +2218,27 @@ krb5_init_creds_step(krb5_context context,
 
 	ret = decode_AS_REP(in->data, in->length, &rep.kdc_rep, &size);
 	if (ret == 0) {
-	    krb5_keyblock *key = NULL;
 	    unsigned eflags = EXTRACT_TICKET_AS_REQ | EXTRACT_TICKET_TIMESYNC;
+	    krb5_data data;
+
+	    /*
+	     * Unwrap AS-REP
+	     */
+	    ASN1_MALLOC_ENCODE(Ticket, data.data, data.length,
+			       &rep.kdc_rep.ticket, &size, ret);
+	    if (ret)
+		goto out;
+	    heim_assert(data.length == size, "ASN.1 internal error");
+
+	    ret = fast_unwrap_as_rep(context, ctx->nonce, &data,
+				     &ctx->fast_state, &rep.kdc_rep);
+	    krb5_data_free(&data);
+	    if (ret)
+		goto out;
+
+	    /*
+	     * Now check and extract the ticket
+	     */
 
 	    if (ctx->flags.canonicalize) {
 		eflags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
@@ -1697,7 +2248,8 @@ krb5_init_creds_step(krb5_context context,
 		eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 
 	    ret = process_pa_data_to_key(context, ctx, &ctx->cred,
-					 &ctx->as_req, &rep.kdc_rep, hostinfo, &key);
+					 &ctx->as_req, &rep.kdc_rep,
+					 hostinfo, &ctx->fast_state.reply_key);
 	    if (ret) {
 		free_AS_REP(&rep.kdc_rep);
 		goto out;
@@ -1708,21 +2260,22 @@ krb5_init_creds_step(krb5_context context,
 	    ret = _krb5_extract_ticket(context,
 				       &rep,
 				       &ctx->cred,
-				       key,
+				       ctx->fast_state.reply_key,
 				       NULL,
 				       KRB5_KU_AS_REP_ENC_PART,
 				       NULL,
 				       ctx->nonce,
 				       eflags,
+				       &ctx->req_buffer,
 				       NULL,
 				       NULL);
-	    krb5_free_keyblock(context, key);
-
-	    *flags = 0;
-
 	    if (ret == 0)
 		ret = copy_EncKDCRepPart(&rep.enc_part, &ctx->enc_part);
 
+	    krb5_free_keyblock(context, ctx->fast_state.reply_key);
+	    ctx->fast_state.reply_key = NULL;
+	    *flags = 0;
+
 	    free_AS_REP(&rep.kdc_rep);
 	    free_EncASRepPart(&rep.enc_part);
 
@@ -1743,6 +2296,17 @@ krb5_init_creds_step(krb5_context context,
 		goto out;
 	    }
 
+	    /*
+	     * Unwrap KRB-ERROR
+	     */
+	    ret = fast_unwrap_error(context, &ctx->fast_state, &ctx->error);
+	    if (ret)
+		goto out;
+
+	    /*
+	     *
+	     */
+
 	    ret = krb5_error_from_rd_error(context, &ctx->error, &ctx->cred);
 
 	    _krb5_debug(context, 5, "krb5_get_init_creds: KRB-ERROR %d", ret);
@@ -1799,14 +2363,79 @@ krb5_init_creds_step(krb5_context context,
 		ret = krb5_principal_set_realm(context,
 					       ctx->cred.client,
 					       *ctx->error.crealm);
+		if (ret)
+		    goto out;
+
+		if (krb5_principal_is_krbtgt(context, ctx->cred.server)) {
+		    ret = krb5_init_creds_set_service(context, ctx, NULL);
+		    if (ret)
+			goto out;
+		}
+
+		free_AS_REQ(&ctx->as_req);
+		memset(&ctx->as_req, 0, sizeof(ctx->as_req));
 
 		ctx->used_pa_types = 0;
+	    } else if (ret == KRB5KDC_ERR_KEY_EXP && ctx->runflags.change_password == 0 && ctx->prompter) {
+		char buf2[1024];
+
+		ctx->runflags.change_password = 1;
+
+		ctx->prompter(context, ctx->prompter_data, NULL, N_("Password has expired", ""), 0, NULL);
+
+
+		/* try to avoid recursion */
+		if (ctx->in_tkt_service != NULL && strcmp(ctx->in_tkt_service, "kadmin/changepw") == 0)
+		    goto out;
+
+                /* don't try to change password where then where none */
+                if (ctx->prompter == NULL)
+                    goto out;
+
+		ret = change_password(context,
+				      ctx->cred.client,
+				      ctx->password,
+				      buf2,
+				      sizeof(buf2),
+				      ctx->prompter,
+				      ctx->prompter_data,
+				      NULL);
+		if (ret)
+		    goto out;
+
+		krb5_init_creds_set_password(context, ctx, buf2);
+
+ 		ctx->used_pa_types = 0;
+		ret = 0;
+
+ 	    } else if (ret == KRB5KDC_ERR_PREAUTH_FAILED) {
+ 
+ 		if (ctx->fast_state.flags & KRB5_FAST_DISABLED)
+ 		    goto out;
+ 		if (ctx->fast_state.flags & (KRB5_FAST_REQUIRED | KRB5_FAST_EXPECTED))
+ 		    goto out;
+ 
+ 		_krb5_debug(context, 10, "preauth failed with FAST, "
+			    "and told by KD or user, trying w/o FAST");
+ 
+ 		ctx->fast_state.flags |= KRB5_FAST_DISABLED;
+ 		ctx->used_pa_types = 0;
+		ret = 0;
 	    }
 	    if (ret)
 		goto out;
 	}
     }
 
+    if (ctx->as_req.req_body.cname == NULL) {
+	ret = init_as_req(context, ctx->flags, &ctx->cred,
+			  ctx->addrs, ctx->etypes, &ctx->as_req);
+	if (ret) {
+	    free_init_creds_ctx(context, ctx);
+	    return ret;
+	}
+    }
+
     if (ctx->as_req.padata) {
 	free_METHOD_DATA(ctx->as_req.padata);
 	free(ctx->as_req.padata);
@@ -1823,11 +2452,23 @@ krb5_init_creds_step(krb5_context context,
     if (ret)
 	goto out;
 
+    /*
+     * Wrap with FAST
+     */
+    copy_AS_REQ(&ctx->as_req, &req2);
+
+    ret = fast_wrap_req(context, &ctx->fast_state, &req2);
+    if (ret) {
+	free_AS_REQ(&req2);
+	goto out;
+    }
+
     krb5_data_free(&ctx->req_buffer);
 
     ASN1_MALLOC_ENCODE(AS_REQ,
 		       ctx->req_buffer.data, ctx->req_buffer.length,
-		       &ctx->as_req, &len, ret);
+		       &req2, &len, ret);
+    free_AS_REQ(&req2);
     if (ret)
 	goto out;
     if(len != ctx->req_buffer.length)
@@ -1879,7 +2520,44 @@ krb5_init_creds_get_error(krb5_context context,
 
     ret = copy_KRB_ERROR(&ctx->error, error);
     if (ret)
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	krb5_enomem(context);
+
+    return ret;
+}
+
+/**
+ *
+ * @ingroup krb5_credential
+ */
+
+krb5_error_code
+krb5_init_creds_store(krb5_context context,
+		      krb5_init_creds_context ctx,
+		      krb5_ccache id)
+{
+    krb5_error_code ret;
+
+    if (ctx->cred.client == NULL) {
+	ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
+	krb5_set_error_message(context, ret, "init creds not completed yet");
+	return ret;
+    }
+
+    ret = krb5_cc_initialize(context, id, ctx->cred.client);
+    if (ret)
+	return ret;
+
+    ret = krb5_cc_store_cred(context, id, &ctx->cred);
+    if (ret)
+	return ret;
+
+    if (ctx->cred.flags.b.enc_pa_rep) {
+	krb5_data data = { 3, rk_UNCONST("yes") };
+	ret = krb5_cc_set_config(context, id, ctx->cred.server,
+				 "fast_avail", &data);
+	if (ret)
+	    return ret;
+    }
 
     return ret;
 }
@@ -1970,7 +2648,7 @@ krb5_get_init_creds_password(krb5_context context,
 			     krb5_get_init_creds_opt *options)
 {
     krb5_init_creds_context ctx;
-    char buf[BUFSIZ];
+    char buf[BUFSIZ], buf2[BUFSIZ];
     krb5_error_code ret;
     int chpw = 0;
 
@@ -1986,11 +2664,19 @@ krb5_get_init_creds_password(krb5_context context,
     if (prompter != NULL && ctx->password == NULL && password == NULL) {
 	krb5_prompt prompt;
 	krb5_data password_data;
-	char *p, *q;
+	char *p, *q = NULL;
+	int aret;
 
-	krb5_unparse_name (context, client, &p);
-	asprintf (&q, "%s's Password: ", p);
+	ret = krb5_unparse_name(context, client, &p);
+	if (ret)
+	    goto out;
+
+	aret = asprintf(&q, "%s's Password: ", p);
 	free (p);
+	if (aret == -1 || q == NULL) {
+	    ret = krb5_enomem(context);
+	    goto out;
+	}
 	prompt.prompt = q;
 	password_data.data   = buf;
 	password_data.length = sizeof(buf);
@@ -2018,12 +2704,10 @@ krb5_get_init_creds_password(krb5_context context,
     ret = krb5_init_creds_get(context, ctx);
 
     if (ret == 0)
-	process_last_request(context, options, ctx);
+	krb5_process_last_request(context, options, ctx);
 
 
     if (ret == KRB5KDC_ERR_KEY_EXPIRED && chpw == 0) {
-	char buf2[1024];
-
 	/* try to avoid recursion */
 	if (in_tkt_service != NULL && strcmp(in_tkt_service, "kadmin/changepw") == 0)
 	   goto out;
@@ -2032,16 +2716,21 @@ krb5_get_init_creds_password(krb5_context context,
 	if (prompter == NULL)
 	    goto out;
 
+	if ((options->flags & KRB5_GET_INIT_CREDS_OPT_CHANGE_PASSWORD_PROMPT) &&
+            !options->change_password_prompt)
+		goto out;
+
 	ret = change_password (context,
 			       client,
 			       ctx->password,
 			       buf2,
-			       sizeof(buf),
+			       sizeof(buf2),
 			       prompter,
 			       data,
 			       options);
 	if (ret)
 	    goto out;
+	password = buf2;
 	chpw = 1;
 	krb5_init_creds_free(context, ctx);
 	goto again;
@@ -2055,6 +2744,7 @@ krb5_get_init_creds_password(krb5_context context,
 	krb5_init_creds_free(context, ctx);
 
     memset(buf, 0, sizeof(buf));
+    memset(buf2, 0, sizeof(buf2));
     return ret;
 }
 
@@ -2093,7 +2783,7 @@ krb5_get_init_creds_keyblock(krb5_context context,
     ret = krb5_init_creds_get(context, ctx);
 
     if (ret == 0)
-        process_last_request(context, options, ctx);
+        krb5_process_last_request(context, options, ctx);
 
  out:
     if (ret == 0)
@@ -2121,10 +2811,22 @@ krb5_get_init_creds_keytab(krb5_context context,
 			   krb5_get_init_creds_opt *options)
 {
     krb5_init_creds_context ctx;
+    krb5_keytab_entry ktent;
     krb5_error_code ret;
 
+    memset(&ktent, 0, sizeof(ktent));
     memset(creds, 0, sizeof(*creds));
 
+    if (strcmp(client->realm, "") == 0) {
+        /*
+         * Referral realm.  We have a keytab, so pick a realm by
+         * matching in the keytab.
+         */
+        ret = krb5_kt_get_entry(context, keytab, client, 0, 0, &ktent);
+        if (ret == 0)
+            client = ktent.principal;
+    }
+
     ret = krb5_init_creds_init(context, client, NULL, NULL, start_time, options, &ctx);
     if (ret)
 	goto out;
@@ -2139,9 +2841,10 @@ krb5_get_init_creds_keytab(krb5_context context,
 
     ret = krb5_init_creds_get(context, ctx);
     if (ret == 0)
-        process_last_request(context, options, ctx);
+        krb5_process_last_request(context, options, ctx);
 
  out:
+    krb5_kt_free_entry(context, &ktent);
     if (ret == 0)
 	krb5_init_creds_get_creds(context, ctx, creds);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.c
index 4f3740a26..9252546d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kcm.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: kcm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
@@ -555,9 +555,7 @@ kcm_get_first (krb5_context context,
 
     c = calloc(1, sizeof(*c));
     if (c == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret,
-			       N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	return ret;
     }
 
@@ -579,9 +577,7 @@ kcm_get_first (krb5_context context,
 	if (ptr == NULL) {
 	    free(c->uuids);
 	    free(c);
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	c->uuids = ptr;
 
@@ -790,9 +786,7 @@ kcm_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 
     c = calloc(1, sizeof(*c));
     if (c == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret,
-			       N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -821,9 +815,7 @@ kcm_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 
 	ptr = realloc(c->uuids, sizeof(c->uuids[0]) * (c->length + 1));
 	if (ptr == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	c->uuids = ptr;
@@ -965,6 +957,7 @@ kcm_get_default_name(krb5_context context, const krb5_cc_ops *ops,
     krb5_storage *request, *response;
     krb5_data response_data;
     char *name;
+    int aret;
 
     *str = NULL;
 
@@ -983,9 +976,9 @@ kcm_get_default_name(krb5_context context, const krb5_cc_ops *ops,
     if (ret)
 	return ret;
 
-    asprintf(str, "%s:%s", ops->prefix, name);
+    aret = asprintf(str, "%s:%s", ops->prefix, name);
     free(name);
-    if (str == NULL)
+    if (aret == -1 || str == NULL)
 	return ENOMEM;
 
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.h b/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.h
index 7edf20e19..56b941207 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/kcm.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: kcm.h,v 1.1.1.1 2011/04/13 18:15:34 elric Exp $	*/
+/*	$NetBSD: kcm.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005, PADL Software Pty Ltd.
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/kerberos.8 b/crypto/external/bsd/heimdal/dist/lib/krb5/kerberos.8
index 0cec4e451..a61699460 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/kerberos.8
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/kerberos.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: kerberos.8,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: kerberos.8,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2000 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -33,7 +33,7 @@
 .\"
 .\" Id
 .\"
-.Dd September 1, 2000
+.Dd Jun 27, 2013
 .Dt KERBEROS 8
 .Os
 .Sh NAME
@@ -75,7 +75,7 @@ without giving your password.
 .Pp
 For more information on how Kerberos works, and other general Kerberos
 questions see the Kerberos FAQ at
-.Pa http://www.cmf.nrl.navy.mil/krb/kerberos-faq.html .
+.Lk http://www.cmf.nrl.navy.mil/krb/kerberos-faq.html .
 .Pp
 For setup instructions see the Heimdal Texinfo manual.
 .Sh SEE ALSO
@@ -84,7 +84,12 @@ For setup instructions see the Heimdal Texinfo manual.
 .Xr kinit 1 ,
 .Xr klist 1 ,
 .Xr kpasswd 1 ,
-.Xr telnet 1
+.Xr telnet 1 ,
+.Xr krb5 3 ,
+.Xr krb5.conf 5 ,
+.Xr kadmin 1 ,
+.Xr kdc 8 ,
+.Xr ktutil 1
 .Sh HISTORY
 The Kerberos authentication system was developed in the late 1980's as
 part of the Athena Project at the Massachusetts Institute of
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keyblock.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keyblock.c
index 616ae8794..7ca91f1e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keyblock.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keyblock.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keyblock.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: keyblock.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -67,7 +67,7 @@ krb5_free_keyblock_contents(krb5_context context,
 	if (keyblock->keyvalue.data != NULL)
 	    memset(keyblock->keyvalue.data, 0, keyblock->keyvalue.length);
 	krb5_data_free (&keyblock->keyvalue);
-	keyblock->keytype = ENCTYPE_NULL;
+	keyblock->keytype = KRB5_ENCTYPE_NULL;
     }
 }
 
@@ -137,10 +137,8 @@ krb5_copy_keyblock (krb5_context context,
     *to = NULL;
 
     k = calloc (1, sizeof(*k));
-    if (k == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	return ENOMEM;
-    }
+    if (k == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_copy_keyblock_contents (context, inblock, k);
     if (ret) {
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab.c
index 542b26c47..0ac78154b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: keytab.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -155,11 +155,8 @@ krb5_kt_register(krb5_context context,
 
     tmp = realloc(context->kt_types,
 		  (context->num_kt_types + 1) * sizeof(*context->kt_types));
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(tmp == NULL)
+	return krb5_enomem(context);
     memcpy(&tmp[context->num_kt_types], ops,
 	   sizeof(tmp[context->num_kt_types]));
     context->kt_types = tmp;
@@ -175,7 +172,7 @@ keytab_name(const char *name, const char **type, size_t *type_len)
     residual = strchr(name, ':');
 
     if (residual == NULL ||
-	name[0] == '/'
+	ISPATHSEP(name[0])
 #ifdef _WIN32
         /* Avoid treating <drive>:<path> as a keytab type
          * specification */
@@ -234,10 +231,8 @@ krb5_kt_resolve(krb5_context context,
     }
 
     k = malloc (sizeof(*k));
-    if (k == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (k == NULL)
+	return krb5_enomem(context);
     memcpy(k, &context->kt_types[i], sizeof(*k));
     k->data = NULL;
     ret = (*k->resolve)(context, residual, k);
@@ -249,6 +244,21 @@ krb5_kt_resolve(krb5_context context,
     return ret;
 }
 
+/*
+ * Default ktname from context with possible environment
+ * override
+ */
+static const char *default_ktname(krb5_context context)
+{
+    const char *tmp = NULL;
+
+    if(!issuid())
+	tmp = getenv("KRB5_KTNAME");
+    if(tmp != NULL)
+	return tmp;
+    return context->default_keytab;
+}
+
 /**
  * copy the name of the default keytab into `name'.
  *
@@ -264,7 +274,7 @@ krb5_kt_resolve(krb5_context context,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default_name(krb5_context context, char *name, size_t namesize)
 {
-    if (strlcpy (name, context->default_keytab, namesize) >= namesize) {
+    if (strlcpy (name, default_ktname(context), namesize) >= namesize) {
 	krb5_clear_error_message (context);
 	return KRB5_CONFIG_NOTENUFSPACE;
     }
@@ -286,17 +296,18 @@ krb5_kt_default_name(krb5_context context, char *name, size_t namesize)
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize)
 {
-    const char *kt = NULL;
+    const char *kt;
+
     if(context->default_keytab_modify == NULL) {
-	if(strncasecmp(context->default_keytab, "ANY:", 4) != 0)
-	    kt = context->default_keytab;
-	else {
-	    size_t len = strcspn(context->default_keytab + 4, ",");
-	    if(len >= namesize) {
+	kt = default_ktname(context);
+
+	if (strncasecmp(kt, "ANY:", 4) == 0) {
+	    size_t len = strcspn(kt + 4, ",");
+	    if (len >= namesize) {
 		krb5_clear_error_message(context);
 		return KRB5_CONFIG_NOTENUFSPACE;
 	    }
-	    strlcpy(name, context->default_keytab + 4, namesize);
+	    strlcpy(name, kt + 4, namesize);
 	    name[len] = '\0';
 	    return 0;
 	}
@@ -323,7 +334,7 @@ krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize)
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default(krb5_context context, krb5_keytab *id)
 {
-    return krb5_kt_resolve (context, context->default_keytab, id);
+    return krb5_kt_resolve (context, default_ktname(context), id);
 }
 
 /**
@@ -451,9 +462,8 @@ krb5_kt_get_full_name(krb5_context context,
 	return ret;
 
     if (asprintf(str, "%s:%s", type, name) == -1) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	*str = NULL;
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     return 0;
@@ -511,7 +521,7 @@ krb5_kt_destroy(krb5_context context,
  */
 
 static krb5_boolean
-compare_aliseses(krb5_context context,
+compare_aliases(krb5_context context,
 		 krb5_keytab_entry *entry,
 		 krb5_const_principal principal)
 {
@@ -547,18 +557,24 @@ krb5_kt_compare(krb5_context context,
 		krb5_kvno vno,
 		krb5_enctype enctype)
 {
-    if(principal != NULL &&
-       !(krb5_principal_compare(context, entry->principal, principal) ||
-	 compare_aliseses(context, entry, principal)))
+    /* krb5_principal_compare() does not special-case the referral realm */
+    if (principal != NULL && strcmp(principal->realm, "") == 0 &&
+        !(krb5_principal_compare_any_realm(context, entry->principal, principal) ||
+          compare_aliases(context, entry, principal))) {
+        return FALSE;
+    } else if (principal != NULL && strcmp(principal->realm, "") != 0 &&
+        !(krb5_principal_compare(context, entry->principal, principal) ||
+          compare_aliases(context, entry, principal))) {
 	return FALSE;
-    if(vno && vno != entry->vno)
+    }
+    if (vno && vno != entry->vno)
 	return FALSE;
-    if(enctype && enctype != entry->keyblock.keytype)
+    if (enctype && enctype != entry->keyblock.keytype)
 	return FALSE;
     return TRUE;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_kt_principal_not_found(krb5_context context,
 			     krb5_error_code ret,
 			     krb5_keytab id,
@@ -571,7 +587,8 @@ _krb5_kt_principal_not_found(krb5_context context,
 
     krb5_unparse_name_fixed (context, principal, princ, sizeof(princ));
     krb5_kt_get_full_name (context, id, &kt_name);
-    krb5_enctype_to_string(context, enctype, &enctype_str);
+    if (enctype)
+	krb5_enctype_to_string(context, enctype, &enctype_str);
 
     if (kvno)
 	snprintf(kvno_str, sizeof(kvno_str), "(kvno %d)", kvno);
@@ -586,34 +603,18 @@ _krb5_kt_principal_not_found(krb5_context context,
 			    kt_name ? kt_name : "unknown keytab",
 			    enctype_str ? enctype_str : "unknown enctype");
     free(kt_name);
-    free(enctype_str);
+    if (enctype_str)
+	free(enctype_str);
     return ret;
 }
 
-
-/**
- * Retrieve the keytab entry for `principal, kvno, enctype' into `entry'
- * from the keytab `id'. Matching is done like krb5_kt_compare().
- *
- * @param context a Keberos context.
- * @param id a keytab.
- * @param principal principal to match, NULL matches all principals.
- * @param kvno key version to match, 0 matches all key version numbers.
- * @param enctype encryption type to match, 0 matches all encryption types.
- * @param entry the returned entry, free with krb5_kt_free_entry().
- *
- * @return Return an error code or 0, see krb5_get_error_message().
- *
- * @ingroup krb5_keytab
- */
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_kt_get_entry(krb5_context context,
-		  krb5_keytab id,
-		  krb5_const_principal principal,
-		  krb5_kvno kvno,
-		  krb5_enctype enctype,
-		  krb5_keytab_entry *entry)
+static krb5_error_code
+krb5_kt_get_entry_wrapped(krb5_context context,
+			  krb5_keytab id,
+			  krb5_const_principal principal,
+			  krb5_kvno kvno,
+			  krb5_enctype enctype,
+			  krb5_keytab_entry *entry)
 {
     krb5_keytab_entry tmp;
     krb5_error_code ret;
@@ -656,6 +657,63 @@ krb5_kt_get_entry(krb5_context context,
     return 0;
 }
 
+/**
+ * Retrieve the keytab entry for `principal, kvno, enctype' into `entry'
+ * from the keytab `id'. Matching is done like krb5_kt_compare().
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param principal principal to match, NULL matches all principals.
+ * @param kvno key version to match, 0 matches all key version numbers.
+ * @param enctype encryption type to match, 0 matches all encryption types.
+ * @param entry the returned entry, free with krb5_kt_free_entry().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_kt_get_entry(krb5_context context,
+		  krb5_keytab id,
+		  krb5_const_principal principal,
+		  krb5_kvno kvno,
+		  krb5_enctype enctype,
+		  krb5_keytab_entry *entry)
+{
+    krb5_error_code ret;
+    krb5_const_principal try_princ;
+    krb5_name_canon_iterator name_canon_iter;
+
+    if (!principal)
+	return krb5_kt_get_entry_wrapped(context, id, principal, kvno, enctype,
+					 entry);
+
+    ret = krb5_name_canon_iterator_start(context, principal, &name_canon_iter);
+    if (ret)
+	return ret;
+
+    do {
+	ret = krb5_name_canon_iterate(context, &name_canon_iter, &try_princ,
+                                      NULL);
+	if (ret)
+	    break;
+        if (try_princ == NULL) {
+            ret = KRB5_KT_NOTFOUND;
+            continue;
+        }
+	ret = krb5_kt_get_entry_wrapped(context, id, try_princ, kvno,
+					enctype, entry);
+    } while (ret == KRB5_KT_NOTFOUND && name_canon_iter);
+
+    if (ret != KRB5_KT_NOTFOUND)
+	krb5_set_error_message(context, ret,
+			       N_("Name canon failed while searching keytab",
+				  ""));
+    krb5_free_name_canon_iterator(context, name_canon_iter);
+    return ret;
+}
+
 /**
  * Copy the contents of `in' into `out'.
  *
@@ -862,7 +920,7 @@ krb5_kt_remove_entry(krb5_context context,
  * @ingroup krb5_keytab
  */
 
-KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_have_content(krb5_context context,
 		     krb5_keytab id)
 {
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_any.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_any.c
index 24fc64d4d..911b1d497 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_any.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_any.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab_any.c,v 1.1.1.1 2011/04/13 18:15:34 elric Exp $	*/
+/*	$NetBSD: keytab_any.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001-2002 Kungliga Tekniska Högskolan
@@ -65,15 +65,14 @@ any_resolve(krb5_context context, const char *name, krb5_keytab id)
     while (strsep_copy(&name, ",", buf, sizeof(buf)) != -1) {
 	a = calloc(1, sizeof(*a));
 	if (a == NULL) {
-	    ret = ENOMEM;
+	    ret = krb5_enomem(context);
 	    goto fail;
 	}
 	if (a0 == NULL) {
 	    a0 = a;
 	    a->name = strdup(buf);
 	    if (a->name == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+		ret = krb5_enomem(context);
 		goto fail;
 	    }
 	} else
@@ -133,10 +132,8 @@ any_start_seq_get(krb5_context context,
     krb5_error_code ret;
 
     c->data = malloc (sizeof(struct any_cursor_extra_data));
-    if(c->data == NULL){
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(c->data == NULL)
+	return krb5_enomem(context);
     ed = (struct any_cursor_extra_data *)c->data;
     for (ed->a = a; ed->a != NULL; ed->a = ed->a->next) {
 	ret = krb5_kt_start_seq_get(context, ed->a->kt, &ed->cursor);
@@ -259,5 +256,7 @@ const krb5_kt_ops krb5_any_ops = {
     any_next_entry,
     any_end_seq_get,
     any_add_entry,
-    any_remove_entry
+    any_remove_entry,
+    NULL,
+    0
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_file.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_file.c
index 2abbd9afb..bb6e9df02 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_file.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_file.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab_file.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: keytab_file.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -61,10 +61,8 @@ krb5_kt_ret_data(krb5_context context,
 	return ret;
     data->length = size;
     data->data = malloc(size);
-    if (data->data == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (data->data == NULL)
+	return krb5_enomem(context);
     ret = krb5_storage_read(sp, data->data, size);
     if(ret != size)
 	return (ret < 0)? errno : KRB5_KT_END;
@@ -82,10 +80,8 @@ krb5_kt_ret_string(krb5_context context,
     if(ret)
 	return ret;
     *data = malloc(size + 1);
-    if (*data == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*data == NULL)
+	return krb5_enomem(context);
     ret = krb5_storage_read(sp, *data, size);
     (*data)[size] = '\0';
     if(ret != size)
@@ -190,11 +186,8 @@ krb5_kt_ret_principal(krb5_context context,
     int16_t len;
 
     ALLOC(p, 1);
-    if(p == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(p == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_ret_int16(sp, &len);
     if(ret) {
@@ -223,8 +216,7 @@ krb5_kt_ret_principal(krb5_context context,
     }
     p->name.name_string.val = calloc(len, sizeof(*p->name.name_string.val));
     if(p->name.name_string.val == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
     p->name.name_string.len = len;
@@ -294,15 +286,12 @@ fkt_resolve(krb5_context context, const char *name, krb5_keytab id)
     struct fkt_data *d;
 
     d = malloc(sizeof(*d));
-    if(d == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(d == NULL)
+	return krb5_enomem(context);
     d->filename = strdup(name);
     if(d->filename == NULL) {
 	free(d);
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     d->flags = 0;
     id->data = d;
@@ -399,9 +388,7 @@ fkt_start_seq_get_int(krb5_context context,
     if (c->sp == NULL) {
 	_krb5_xunlock(context, c->fd);
 	close(c->fd);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     krb5_storage_set_eof_code(c->sp, KRB5_KT_END);
     ret = krb5_ret_int8(c->sp, &pvno);
@@ -501,6 +488,8 @@ loop:
     if(start) *start = pos;
     if(end) *end = pos + 4 + len;
  out:
+    if (ret)
+        krb5_kt_free_entry(context, entry);
     krb5_storage_seek(cursor->sp, pos + 4 + len, SEEK_SET);
     return ret;
 }
@@ -624,9 +613,7 @@ fkt_add_entry(krb5_context context,
 	krb5_storage *emem;
 	emem = krb5_storage_emem();
 	if(emem == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 	ret = krb5_kt_store_principal(context, emem, entry->principal);
@@ -778,7 +765,9 @@ const krb5_kt_ops krb5_fkt_ops = {
     fkt_next_entry,
     fkt_end_seq_get,
     fkt_add_entry,
-    fkt_remove_entry
+    fkt_remove_entry,
+    NULL,
+    0
 };
 
 const krb5_kt_ops krb5_wrfkt_ops = {
@@ -792,7 +781,9 @@ const krb5_kt_ops krb5_wrfkt_ops = {
     fkt_next_entry,
     fkt_end_seq_get,
     fkt_add_entry,
-    fkt_remove_entry
+    fkt_remove_entry,
+    NULL,
+    0
 };
 
 const krb5_kt_ops krb5_javakt_ops = {
@@ -806,5 +797,7 @@ const krb5_kt_ops krb5_javakt_ops = {
     fkt_next_entry,
     fkt_end_seq_get,
     fkt_add_entry,
-    fkt_remove_entry
+    fkt_remove_entry,
+    NULL,
+    0
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_keyfile.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_keyfile.c
index eeb691bd6..a5b56f9f3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_keyfile.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_keyfile.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab_keyfile.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: keytab_keyfile.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -91,11 +91,8 @@ get_cell_and_realm (krb5_context context, struct akf_data *d)
     fclose(f);
 
     d->cell = strdup (buf);
-    if (d->cell == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (d->cell == NULL)
+	return krb5_enomem(context);
 
     f = fopen (AFS_SERVERMAGICKRBCONF, "r");
     if (f != NULL) {
@@ -119,9 +116,7 @@ get_cell_and_realm (krb5_context context, struct akf_data *d)
     if (d->realm == NULL) {
 	free (d->cell);
 	d->cell = NULL;
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     return 0;
 }
@@ -134,13 +129,10 @@ static krb5_error_code KRB5_CALLCONV
 akf_resolve(krb5_context context, const char *name, krb5_keytab id)
 {
     int ret;
-    struct akf_data *d = malloc(sizeof (struct akf_data));
+    struct akf_data *d = calloc(1, sizeof (struct akf_data));
 
-    if (d == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (d == NULL)
+	return krb5_enomem(context);
 
     d->num_entries = 0;
     ret = get_cell_and_realm (context, d);
@@ -153,9 +145,7 @@ akf_resolve(krb5_context context, const char *name, krb5_keytab id)
 	free (d->cell);
 	free (d->realm);
 	free (d);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     id->data = d;
 
@@ -273,9 +263,7 @@ akf_next_entry(krb5_context context,
     entry->keyblock.keyvalue.data   = malloc (8);
     if (entry->keyblock.keyvalue.data == NULL) {
 	krb5_free_principal (context, entry->principal);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	ret = ENOMEM;
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -350,9 +338,7 @@ akf_add_entry(krb5_context context,
     sp = krb5_storage_from_fd(fd);
     if(sp == NULL) {
 	close(fd);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     if (created)
 	len = 0;
@@ -464,7 +450,9 @@ const krb5_kt_ops krb5_akf_ops = {
     akf_next_entry,
     akf_end_seq_get,
     akf_add_entry,
-    NULL /* remove */
+    NULL, /* remove */
+    NULL,
+    0
 };
 
 #endif /* HEIMDAL_SMALLER */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_memory.c b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_memory.c
index 3654d8159..235cb9466 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_memory.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/keytab_memory.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: keytab_memory.c,v 1.1.1.1 2011/04/13 18:15:34 elric Exp $	*/
+/*	$NetBSD: keytab_memory.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -75,17 +75,13 @@ mkt_resolve(krb5_context context, const char *name, krb5_keytab id)
     d = calloc(1, sizeof(*d));
     if(d == NULL) {
 	HEIMDAL_MUTEX_unlock(&mkt_mutex);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     d->name = strdup(name);
     if (d->name == NULL) {
 	HEIMDAL_MUTEX_unlock(&mkt_mutex);
 	free(d);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     d->entries = NULL;
     d->num_entries = 0;
@@ -177,11 +173,8 @@ mkt_add_entry(krb5_context context,
     struct mkt_data *d = id->data;
     krb5_keytab_entry *tmp;
     tmp = realloc(d->entries, (d->num_entries + 1) * sizeof(*d->entries));
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (tmp == NULL)
+	return krb5_enomem(context);
     d->entries = tmp;
     return krb5_kt_copy_entry_contents(context, entry,
 				       &d->entries[d->num_entries++]);
@@ -234,5 +227,7 @@ const krb5_kt_ops krb5_mkt_ops = {
     mkt_next_entry,
     mkt_end_seq_get,
     mkt_add_entry,
-    mkt_remove_entry
+    mkt_remove_entry,
+    NULL,
+    0
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-plugin.7 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-plugin.7
new file mode 100644
index 000000000..beda6c84c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-plugin.7
@@ -0,0 +1,247 @@
+.\"	$NetBSD: krb5-plugin.7,v 1.2 2017/01/28 21:31:49 christos Exp $
+.\"
+.\" Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
+.\" (Royal Institute of Technology, Stockholm, Sweden).
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" 3. Neither the name of the Institute nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" Id
+.\"
+.Dd December  21, 2011
+.Dt KRB5-PLUGIN 7
+.Os HEIMDAL
+.Sh NAME
+.Nm krb5-plugin
+.Nd plugin interface for Heimdal
+.Sh SYNOPSIS
+.In krb5.h
+.In krb5/an2ln_plugin.h
+.In krb5/ccache_plugin.h
+.In krb5/db_plugin.h
+.In krb5/kuserok_plugin.h
+.In krb5/locate_plugin.h
+.In krb5/send_to_kdc_plugin.h
+.Sh DESCRIPTION
+Heimdal has a plugin interface.  Plugins may be statically linked into
+Heimdal and registered via the
+.Xr krb5_plugin_register 3
+function, or they may be dynamically loaded from shared objects present
+in the Heimdal plugins directories.
+.Pp
+Plugins consist of a C struct whose struct name is given in the
+associated header file, such as, for example,
+.Va krb5plugin_kuserok_ftable
+and a pointer to which is either registered via
+.Xr krb5_plugin_register 3
+or found in a shared object via a symbol lookup for the symbol name
+defined in the associated header file (e.g., "kuserok" for the
+plugin for
+.Xr krb5_kuserok 3
+).
+.Pp
+The plugin structs for all plugin types always begin with the same three
+common fields:
+.Bl -enum -compact
+.It
+.Va minor_version
+, an int.  Plugin minor versions are defined in each plugin type's
+associated header file.
+.It
+.Va init
+, a pointer to a function with two arguments, a krb5_context and a
+void **, returning a krb5_error_code.  This function will be called to
+initialize a plugin-specific context in the form of a void * that will
+be output through the init function's second argument.
+.It
+.Va fini
+, a pointer to a function of one argument, a void *, consisting of the
+plugin's context to be destroyed, and returning void.
+.El
+.Pp
+Each plugin type must add zero or more fields to this struct following
+the above three.  Plugins are typically invoked in no particular order
+until one succeeds or fails, or all return a special return value such
+as KRB5_PLUGIN_NO_HANDLE to indicate that the plugin was not applicable.
+Most plugin types obtain deterministic plugin behavior in spite of the
+non-deterministic invocation order by, for example, invoking all plugins
+for each "rule" and passing the rule to each plugin with the expectation
+that just one plugin will match any given rule.
+.Pp
+There is a database plugin system intended for many of the uses of
+databases in Heimdal.  The plugin is expected to call
+.Xr heim_db_register 3
+from its
+.Va init
+entry point to register a DB type.  The DB plugin's
+.Va fini
+function must do nothing, and the plugin must not provide any other
+entry points.
+.Pp
+The krb5_kuserok plugin adds a single field to its struct: a pointer to
+a function that implements kuserok functionality with the following
+form:
+.Bd -literal -offset indent
+static krb5_error_code
+kuserok(void *plug_ctx, krb5_context context, const char *rule,
+        unsigned int flags, const char *k5login_dir,
+        const char *luser, krb5_const_principal principal,
+        krb5_boolean *result)
+.Ed
+.Pp
+The
+.Va luser
+,
+.Va principal
+and
+.Va result
+arguments are self-explanatory (see
+.Xr krb5_kuserok 3
+).  The
+.Va plug_ctx
+argument is the context output by the plugin's init function.  The
+.Va rule
+argument is a kuserok rule from the krb5.conf file; each plugin is invoked once
+for each rule until all plugins fail or one succeeds.  The
+.Va k5login_dir
+argument provides an alternative k5login file location, if not NULL.
+The
+.Va flags
+argument indicates whether the plugin may call
+.Xr krb5_aname_to_localname 3
+(KUSEROK_ANAME_TO_LNAME_OK), and whether k5login databases are expected to be
+authoritative (KUSEROK_K5LOGIN_IS_AUTHORITATIVE).
+.Pp
+The plugin for
+.Xr krb5_aname_to_localname 3
+is named "an2ln" and has a single extra field for the plugin struct:
+.Bd -literal -offset indent
+typedef krb5_error_code (*set_result_f)(void *, const char *);
+
+static krb5_error_code
+an2ln(void *plug_ctx, krb5_context context, const char *rule,
+      krb5_const_principal aname, set_result_f set_res_f, void *set_res_ctx)
+.Ed
+.Pp
+The arguments for the
+.Va an2ln
+plugin are similar to those of the kuserok plugin, but the result, being
+a string, is set by calling the
+.Va set_res_f
+function argument with the
+.Va set_res_ctx
+and result string as arguments.  The
+.Va set_res_f
+function will make a copy of the string.
+.Sh FILES
+.Bl -tag -compact
+.It Pa libdir/plugin/krb5/*
+Shared objects containing plugins for Heimdal.
+.El
+.Sh EXAMPLES
+.Pp
+An example an2ln plugin that maps principals to a constant "nouser"
+follows:
+.Pp
+.Bd -literal -offset indent
+#include <krb5/an2ln_plugin.h>
+
+static krb5_error_code
+nouser_plug_init(krb5_context context, void **ctx)
+{
+    *ctx = NULL;
+    return 0;
+}
+
+static void nouser_plug_fini(void *ctx) { }
+
+static krb5_error_code
+nouser_plug_an2ln(void *plug_ctx, krb5_context context,
+                  const char *rule,
+                  krb5_const_principal aname,
+                  set_result_f set_res_f, void *set_res_ctx)
+{   
+    krb5_error_code ret;
+
+    if (strcmp(rule, "NOUSER") != 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    ret = set_res_f(set_res_ctx, "nouser");
+
+    return ret;
+}
+
+krb5plugin_an2ln_ftable an2ln = {
+    KRB5_PLUGIN_AN2LN_VERSION_0,
+    nouser_plug_init,
+    nouser_plug_fini,
+    nouser_plug_an2ln,
+};
+.Ed
+.Pp
+An example kuserok plugin that rejects all requests follows.  (Note that
+there exists a built-in plugin with this functionality; see
+.Xr krb5_kuserok 3
+).
+.Pp
+.Bd -literal -offset indent
+#include <krb5/kuserok_plugin.h>
+
+static krb5_error_code
+reject_plug_init(krb5_context context, void **ctx)
+{
+    *ctx = NULL;
+    return 0;
+}
+
+static void reject_plug_fini(void *ctx) { }
+
+static krb5_error_code
+reject_plug_kuserok(void *plug_ctx, krb5_context context, const char *rule,
+                    unsigned int flags, const char *k5login_dir,
+                    const char *luser, krb5_const_principal principal,
+                    krb5_boolean *result)
+{
+    if (strcmp(rule, "REJECT") != 0)
+        return KRB5_PLUGIN_NO_HANDLE;
+
+    *result = FALSE;
+    return 0;
+}
+
+krb5plugin_kuserok_ftable kuserok = {
+    KRB5_PLUGIN_KUSEROK_VERSION_0,
+    reject_plug_init,
+    reject_plug_fini,
+    reject_plug_kuserok,
+};
+.Ed
+.Sh SEE ALSO
+.Xr krb5_plugin_register 3
+.Xr krb5_kuserok 3
+.Xr krb5_aname_to_localname 3
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-v4compat.h b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-v4compat.h
index 218818a34..b59f928d2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-v4compat.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5-v4compat.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: krb5-v4compat.h,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $	*/
+/*	$NetBSD: krb5-v4compat.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.conf.5 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.conf.5
index 7ac4ab67b..b878ccaed 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.conf.5
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.conf.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5.conf.5,v 1.4 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5.conf.5,v 1.6 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -146,7 +146,7 @@ Default realm to use, this is also known as your
 The default is the result of
 .Fn krb5_get_host_realm "local hostname" .
 .It Li allow_weak_crypto = Va boolean
-is weaks crypto algorithms allowed to be used, among others, DES is
+are weak crypto algorithms allowed to be used, among others, DES is
 considered weak.
 .It Li clockskew = Va time
 Maximum time differential (in seconds) allowed when comparing
@@ -154,11 +154,6 @@ times.
 Default is 300 seconds (five minutes).
 .It Li kdc_timeout = Va time
 Maximum time to wait for a reply from the kdc, default is 3 seconds.
-.It Li v4_name_convert
-.It Li v4_instance_resolve
-These are described in the
-.Xr krb5_425_conv_principal  3
-manual page.
 .It Li capath = {
 .Bl -tag -width "xxx" -offset indent
 .It Va destination-realm Li = Va next-hop-realm
@@ -175,9 +170,9 @@ the default credentials cache name.
 If you want to change the type only use
 .Li default_cc_type .
 The string can contain variables that are expanded on runtime.
-Only support variable now is
+The Only supported variable currently is
 .Li %{uid}
-that expands to the current user id.
+which expands to the current user id.
 .It Li default_etypes = Va etypes ...
 A list of default encryption types to use. (Default: all enctypes if
 allow_weak_crypto = TRUE, else all enctypes except single DES enctypes.)
@@ -244,24 +239,172 @@ Scan all network interfaces for addresses, as opposed to simply using
 the address associated with the system's host name.
 .It Li fcache_version = Va int
 Use file credential cache format version specified.
-.It Li krb4_get_tickets = Va boolean
-Also get Kerberos 4 tickets in
-.Nm kinit ,
-.Nm login ,
-and other programs.
-This option is also valid in the [realms] section.
 .It Li fcc-mit-ticketflags = Va boolean
 Use MIT compatible format for file credential cache.
 It's the field ticketflags that is stored in reverse bit order for
 older than Heimdal 0.7.
 Setting this flag to
 .Dv TRUE
-make it store the MIT way, this is default for Heimdal 0.7.
+makes it store the MIT way, this is default for Heimdal 0.7.
 .It Li check-rd-req-server
-If set to "ignore", the framework will ignore any the server input to
-.Xr krb5_rd_req 3,
+If set to "ignore", the framework will ignore any of the server input to
+.Xr krb5_rd_req 3 ,
 this is very useful when the GSS-API server input the
 wrong server name into the gss_accept_sec_context call.
+.It Li k5login_directory = Va directory
+Alternative location for user .k5login files. This option is provided
+for compatibility with MIT krb5 configuration files.
+.It Li k5login_authoritative = Va boolean
+If true then if a principal is not found in k5login files then
+.Xr krb5_userok 3
+will not fallback on principal to username mapping. This option is
+provided for compatibility with MIT krb5 configuration files.
+.It Li kuserok = Va rule ...
+Specifies
+.Xr krb5_userok 3
+behavior.  If multiple values are given, then
+.Xr krb5_userok 3
+will evaluate them in order until one succeeds or all fail.  Rules are
+implemented by plugins, with three built-in plugins
+described below. Default: USER-K5LOGIN SIMPLE DENY.
+.It Li kuserok = Va DENY
+If set and evaluated then
+.Xr krb5_userok 3
+will deny access to the given username no matter what the principal name
+might be.
+.It Li kuserok = Va SIMPLE
+If set and evaluated then
+.Xr krb5_userok 3
+will use principal to username mapping (see auth_to_local below).  If
+the principal maps to the requested username then access is allowed.
+.It Li kuserok = Va SYSTEM-K5LOGIN[:directory]
+If set and evaluated then
+.Xr krb5_userok 3
+will use k5login files named after the
+.Va luser
+argument to
+.Xr krb5_userok 3
+in the given directory or in
+.Pa /etc/k5login.d/ .
+K5login files are text files, with each line containing just a principal
+name; principals apearing in a user's k5login file are permitted access
+to the user's account. Note: this rule performs no ownership nor
+permissions checks on k5login files; proper ownership and
+permissions/ACLs are expected due to the k5login location being a
+system location.
+.It Li kuserok = Va USER-K5LOGIN
+If set and evaluated then
+.Xr krb5_userok 3
+will use
+.Pa ~luser/.k5login
+and
+.Pa ~luser/.k5login.d/* .
+User k5login files and directories must be owned by the user and must
+not have world nor group write permissions.
+.It Li aname2lname-text-db = Va filename
+The named file must be a sorted (in increasing order) text file where
+every line consists of an unparsed principal name optionally followed by
+whitespace and a username.  The aname2lname function will do a binary
+search on this file, if configured, looking for lines that match the
+given principal name, and if found the given username will be used, or,
+if the username is missing, an error will be returned.  If the file
+doesn't exist, or if no matching line is found then other plugins will
+be allowed to run.
+.It Li fcache_strict_checking
+strict checking in FILE credential caches that owner, no symlink and
+permissions is correct.
+.It Li name_canon_rules = Va rules
+One or more service principal name canonicalization rules.  Each rule
+consists of one or more tokens separated by colon (':').  Currently
+these rules are used only for hostname canonicalization (usually when
+getting a service ticket, from a ccache or a TGS, but also when
+acquiring GSS initiator credentials from a keytab).  These rules can be
+used to implement DNS resolver-like search lists without having to use
+DNS.
+.Pp
+NOTE: Name canonicalization rules are an experimental feature.
+.Pp
+The first token is a rule type, one of:
+.Va as-is,
+.Va qualify, or
+.Va nss.
+.Pp
+Any remaining tokens must be options tokens:
+.Va use_fast
+(use FAST to protect TGS exchanges; currently not supported),
+.Va use_dnssec
+(use DNSSEC to protect hostname lookups; currently not supported),
+.Va ccache_only
+,
+.Va use_referrals,
+.Va no_referrals,
+.Va lookup_realm,
+.Va mindots=N,
+.Va maxdots=N,
+.Va order=N,
+domain=
+.Va domain,
+realm=
+.Va realm,
+match_domain=
+.Va domain,
+and match_realm=
+.Va realm.
+.Pp
+When trying to obtain a service ticket for a host-based service
+principal name, name canonicalization rules are applied to that name in
+the order given, one by one, until one succeds (a service ticket is
+obtained), or all fail.  Similarly when acquiring GSS initiator
+credentials from a keytab, and when comparing a non-canonical GSS name
+to a canonical one.
+.Pp
+For each rule the system checks that the hostname has at least
+.Va mindots
+periods (if given) in it, at most
+.Va maxdots
+periods (if given), that the hostname ends in the given
+.Va match_domain
+(if given),
+and that the realm of the principal matches the
+.Va match_realm
+(if given).
+.Pp
+.Va As-is
+rules leave the hostname unmodified but may set a realm.
+.Va Qualify
+rules qualify the hostname with the given
+.Va domain
+and also may set the realm.
+The
+.Va nss
+rule uses the system resolver to lookup the host's canonical name and is
+usually not secure.  Note that using the
+.Va nss
+rule type implies having to have principal aliases in the HDB (though
+not necessarily in keytabs).
+.Pp
+The empty realm denotes "ask the client's realm's TGS".  The empty realm
+may be set as well as matched.
+.Pp
+The order in which rules are applied is as follows: first all the rules
+with explicit
+.Va order
+then all other rules in the order in which they appear.  If any two
+rules have the same explicit
+.Va order ,
+their order of appearance in krb5.conf breaks the tie.  Explicitly
+specifying order can be useful where tools read and write the
+configuration file without preserving parameter order.
+.Pp
+Malformed rules are ignored.
+.It Li allow_hierarchical_capaths = Va boolean
+When validating cross-realm transit paths, absent any explicit capath from the
+client realm to the server realm, allow a hierarchical transit path via the
+common ancestor domain of the two realms.
+Defaults to true.
+Note, absent an explicit setting, hierarchical capaths are always used by
+the KDC when generating a referral to a destination with which is no direct
+trust.
 .El
 .It Li [domain_realm]
 This is a list of mappings from DNS domain to Kerberos realm.
@@ -321,17 +464,65 @@ to the database are performed.
 Points to the server where all the password changes are performed.
 If there is no such entry, the kpasswd port on the admin_server host
 will be tried.
-.It Li krb524_server = Va host[:port]
-Points to the server that does 524 conversions.
-If it is not mentioned, the krb524 port on the kdcs will be tried.
-.It Li v4_instance_convert
-.It Li v4_name_convert
-.It Li default_domain
-See
-.Xr krb5_425_conv_principal 3 .
 .It Li tgs_require_subkey
 a boolan variable that defaults to false.
 Old DCE secd (pre 1.1) might need this to be true.
+.It Li auth_to_local_names = {
+.Bl -tag -width "xxx" -offset indent
+.It Va principal_name = Va username
+The given
+.Va principal_name
+will be mapped to the given
+.Va username
+if the
+.Va REALM
+is a default realm.
+.El
+.It Li }
+.It Li auth_to_local = HEIMDAL_DEFAULT
+Use the Heimdal default principal to username mapping.
+Applies to principals from the
+.Va REALM
+if and only if
+.Va REALM
+is a default realm.
+.It Li auth_to_local = DEFAULT
+Use the MIT default principal to username mapping.
+Applies to principals from the
+.Va REALM
+if and only if
+.Va REALM
+is a default realm.
+.It Li auth_to_local = DB:/path/to/db.txt
+Use a binary search of the given DB.  The DB must be a flat-text
+file sortedf in the "C" locale, with each record being a line
+(separated by either LF or CRLF) consisting of a principal name
+followed by whitespace followed by a username.
+Applies to principals from the
+.Va REALM
+if and only if
+.Va REALM
+is a default realm.
+.It Li auth_to_local = DB:/path/to/db
+Use the given DB, if there's a plugin for it.
+Applies to principals from the
+.Va REALM
+if and only if
+.Va REALM
+is a default realm.
+.It Li auth_to_local = RULE:...
+Use the given rule, if there's a plugin for it.
+Applies to principals from the
+.Va REALM
+if and only if
+.Va REALM
+is a default realm.
+.It Li auth_to_local = NONE
+No additional principal to username mapping is done. Note that
+.Va auth_to_local_names
+and any preceding
+.Va auth_to_local
+rules have precedence.
 .El
 .It Li }
 .El
@@ -370,8 +561,10 @@ manual page for a list of defined destinations.
 .Bl -tag -width "xxx" -offset indent
 .It Li database Li = {
 .Bl -tag -width "xxx" -offset indent
-.It Li dbname Li = Va DATABASENAME
-Use this database for this realm.
+.It Li dbname Li = Va [DATBASETYPE:]DATABASENAME
+Use this database for this realm.  The
+.Va DATABASETYPE
+should be one of 'lmdb', 'db3', 'db1', 'db', 'sqlite', or 'ldap'.
 See the info documetation how to configure different database backends.
 .It Li realm Li = Va REALM
 Specifies the realm that will be stored in this database.
@@ -390,30 +583,37 @@ Use this file for the ACL list of this database.
 Use this file as the log of changes performed to the database.
 This file is used by
 .Nm ipropd-master
-for propagating changes to slaves.
+for propagating changes to slaves.  It is also used by
+.Nm kadmind
+and
+.Nm kadmin
+(when used with the
+.Li -l
+option), and by all applications using
+.Nm libkadm5
+with the local backend, for two-phase commit functionality.  Slaves also
+use this.  Setting this to
+.Nm /dev/null
+disables two-phase commit and incremental propagation.  Use
+.Nm iprop-log
+to show the contents of this log file.
+.It Li log-max-size = Pa number
+When the log reaches this size (in bytes), the log will be truncated,
+saving some entries, and keeping the latest version number so as to not
+disrupt incremental propagation.  If set to a negative value then
+automatic log truncation will be disabled.  Defaults to 52428800 (50MB).
 .El
 .It Li }
 .It Li max-request = Va SIZE
 Maximum size of a kdc request.
 .It Li require-preauth = Va BOOL
 If set pre-authentication is required.
-Since krb4 requests are not pre-authenticated they will be rejected.
 .It Li ports = Va "list of ports"
 List of ports the kdc should listen to.
 .It Li addresses = Va "list of interfaces"
 List of addresses the kdc should bind to.
-.It Li enable-kerberos4 = Va BOOL
-Turn on Kerberos 4 support.
-.It Li v4-realm = Va REALM
-To what realm v4 requests should be mapped.
-.It Li enable-524 = Va BOOL
-Should the Kerberos 524 converting facility be turned on.
-Default is the same as
-.Va enable-kerberos4 .
 .It Li enable-http = Va BOOL
 Should the kdc answer kdc-requests over http.
-.It Li enable-kaserver = Va BOOL
-If this kdc should emulate the AFS kaserver.
 .It Li tgt-use-strongest-session-key = Va BOOL
 If this is TRUE then the KDC will prefer the strongest key from the
 client's AS-REQ or TGS-REQ enctype list for the ticket session key that
@@ -451,14 +651,6 @@ The time before expiration that the user should be warned that her
 password is about to expire.
 .It Li logging = Va Logging
 What type of logging the kdc should use, see also [logging]/kdc.
-.It Li use_2b = {
-.Bl -tag -width "xxx" -offset indent
-.It Va principal Li = Va BOOL
-boolean value if the 524 daemon should return AFS 2b tokens for
-.Fa principal .
-.It ...
-.El
-.It Li }
 .It Li hdb-ldap-structural-object Va structural object
 If the LDAP backend is used for storing principals, this is the
 structural object that will be used when creating and when reading
@@ -472,11 +664,44 @@ Should the kdc answer digest requests. The default is FALSE.
 .It Li digests_allowed = Va list of digests
 Specifies the digests the kdc will reply to. The default is
 .Li ntlm-v2 .
+.It Li kx509_ca = Va file
+Specifies the PEM credentials for the kx509 certification authority.
+.It Li require_initial_kca_tickets = Va boolean
+Specified whether to require that tickets for the
+.Li kca_service
+service principal be INITIAL.
+This may be set on a per-realm basis as well as globally.
+Defaults to true for the global setting.
+.It Li kx509_include_pkinit_san = Va boolean
+If true then the kx509 client principal's name and realm will be
+included in an
+.Li id-pkinit-san
+certificate extension.
+This can be set on a per-realm basis as well as globally.
+Defaults to true for the global setting.
+.It Li kx509_template = Va file
+Specifies the PEM file with a template for the certificates to be
+issued.
+The following variables can be interpolated in the subject name using
+${variable} syntax:
+.Bl -tag -width "xxx" -offset indent
+.It principal-name
+The full name of the kx509 client principal.
+.It principal-name-without-realm
+The full name of the kx509 client principal, excluding the realm name.
+.It principal-name-realm
+The name of the client principal's realm.
 .El
+.El
+The 
+.Li kx509 ,
+.Li kx509_template ,
+.Li kx509_include_pkinit_san ,
+and
+.Li require_initial_kca_tickets
+parameters may be set on a per-realm basis as well.
 .It Li [kadmin]
 .Bl -tag -width "xxx" -offset indent
-.It Li require-preauth = Va BOOL
-If pre-authentication is required to talk to the kadmin server.
 .It Li password_lifetime = Va time
 If a principal already have its password set for expiration, this is
 the time it will be valid for after a change.
@@ -498,17 +723,27 @@ Additional special values of keytypes are:
 .It Li v5
 The Kerberos 5 salt
 .Va pw-salt
-.It Li v4
-The Kerberos 4 salt
-.Va des:pw-salt:
 .El
+.It Li default_key_rules = Va {
+.Bl -tag -width "xxx" -offset indent
+.It Va globing-rule Li = Va keytypes...
+a globbing rule to matching a principal, and when true, use the
+keytypes as specified the same format as [kadmin]default_keys .
+.El
+.It Li }
+.It Li prune-key-history = Va BOOL
+When adding keys to the key history, drop keys that are too old to match
+unexpired tickets (based on the principal's maximum ticket lifetime).
+If the KDC keystore is later compromised traffic protected with the
+discarded older keys may remain protected.  This also keeps the HDB
+records for principals with key history from growing without bound.
+The default (backwards compatible) value is "false".
 .It Li use_v4_salt = Va BOOL
 When true, this is the same as
 .Pp
 .Va default_keys = Va des3:pw-salt Va v4
 .Pp
 and is only left for backwards compatibility.
-.El
 .It Li [password_quality]
 Check the Password quality assurance in the info documentation for
 more information.
@@ -524,6 +759,7 @@ List of policy names to apply to the password. Builtin policies are
 among other minimum-length, character-class, external-check.
 .El
 .El
+.El
 .Sh ENVIRONMENT
 .Ev KRB5_CONFIG
 points to the configuration file to read.
@@ -536,24 +772,26 @@ configuration file for Kerberos 5.
 .Bd -literal -offset indent
 [libdefaults]
 	default_realm = FOO.SE
+	name_canon_rules = as-is:realm=FOO.SE
+	name_canon_rules = qualify:domain=foo.se:realm=FOO.SE
+	name_canon_rules = qualify:domain=bar.se:realm=FOO.SE
+	name_canon_rules = nss
 [domain_realm]
 	.foo.se = FOO.SE
 	.bar.se = FOO.SE
 [realms]
 	FOO.SE = {
 		kdc = kerberos.foo.se
-		v4_name_convert = {
-			rcmd = host
-		}
-		v4_instance_convert = {
-			xyz = xyz.bar.se
-		}
 		default_domain = foo.se
 	}
 [logging]
 	kdc = FILE:/var/heimdal/kdc.log
 	kdc = SYSLOG:INFO
 	default = SYSLOG:INFO:USER
+[kadmin]
+	default_key_rules = {
+		*/ppp@* = arcfour-hmac-md5:pw-salt
+	}
 .Ed
 .Sh DIAGNOSTICS
 Since
@@ -571,7 +809,6 @@ are actually used and thus cannot warn about unknown or misspelled
 ones.
 .Sh SEE ALSO
 .Xr kinit 1 ,
-.Xr krb5_425_conv_principal 3 ,
 .Xr krb5_openlog 3 ,
 .Xr strftime 3 ,
 .Xr verify_krb5_conf 8
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.h b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.h
index df9648322..fd88e8423 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: krb5.h,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: krb5.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -152,6 +152,8 @@ enum {
     ETYPE_DES3_CBC_SHA1		= KRB5_ENCTYPE_DES3_CBC_SHA1,
     ETYPE_AES128_CTS_HMAC_SHA1_96	= KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96,
     ETYPE_AES256_CTS_HMAC_SHA1_96	= KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+    ETYPE_AES128_CTS_HMAC_SHA256_128	= KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+    ETYPE_AES256_CTS_HMAC_SHA384_192	= KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192,
     ETYPE_ARCFOUR_HMAC_MD5	= KRB5_ENCTYPE_ARCFOUR_HMAC_MD5,
     ETYPE_ARCFOUR_HMAC_MD5_56	= KRB5_ENCTYPE_ARCFOUR_HMAC_MD5_56,
     ETYPE_ENCTYPE_PK_CROSS	= KRB5_ENCTYPE_ENCTYPE_PK_CROSS,
@@ -276,14 +278,28 @@ typedef enum krb5_key_usage {
     /* Encryption type of the kdc session contribution in pk-init */
     KRB5_KU_AS_REQ = 56,
     /* Checksum of over the AS-REQ send by the KDC in PA-REQ-ENC-PA-REP */
+    KRB5_KU_FAST_REQ_CHKSUM = 50,
+    /* FAST armor checksum */
+    KRB5_KU_FAST_ENC = 51,
+    /* FAST armor encryption */
+    KRB5_KU_FAST_REP = 52,
+    /* FAST armor reply */
+    KRB5_KU_FAST_FINISHED = 53,
+    /* FAST finished checksum */
+    KRB5_KU_ENC_CHALLENGE_CLIENT = 54,
+    /* fast challenge from client */
+    KRB5_KU_ENC_CHALLENGE_KDC = 55,
+    /* fast challenge from kdc */
     KRB5_KU_DIGEST_ENCRYPT = -18,
     /* Encryption key usage used in the digest encryption field */
     KRB5_KU_DIGEST_OPAQUE = -19,
     /* Checksum key usage used in the digest opaque field */
     KRB5_KU_KRB5SIGNEDPATH = -21,
     /* Checksum key usage on KRB5SignedPath */
-    KRB5_KU_CANONICALIZED_NAMES = -23
+    KRB5_KU_CANONICALIZED_NAMES = -23,
     /* Checksum key usage on PA-CANONICALIZED */
+    KRB5_KU_H5L_COOKIE = -25
+    /* encrypted foo */
 } krb5_key_usage;
 
 typedef krb5_key_usage krb5_keyusage;
@@ -369,6 +385,7 @@ typedef struct krb5_cccol_cursor_data *krb5_cccol_cursor;
 typedef struct krb5_ccache_data {
     const struct krb5_cc_ops *ops;
     krb5_data data;
+    int initialized; /* if non-zero: krb5_cc_initialize() called, now empty */
 }krb5_ccache_data;
 
 typedef struct krb5_ccache_data *krb5_ccache;
@@ -643,6 +660,8 @@ typedef struct krb5_auth_context_data {
 
     krb5_keytype keytype;	/* ¿requested key type ? */
     krb5_cksumtype cksumtype;	/* ¡requested checksum type! */
+    
+    AuthorizationData *auth_data;
 
 }krb5_auth_context_data, *krb5_auth_context;
 
@@ -673,8 +692,17 @@ typedef EncAPRepPart krb5_ap_rep_enc_part;
 #define KRB5_TGS_NAME ("krbtgt")
 #define KRB5_WELLKNOWN_NAME ("WELLKNOWN")
 #define KRB5_ANON_NAME ("ANONYMOUS")
+#define KRB5_ANON_REALM ("WELLKNOWN:ANONYMOUS")
+#define KRB5_WELLKNOWN_ORG_H5L_REALM ("WELLKNOWN:ORG.H5L")
 #define KRB5_DIGEST_NAME ("digest")
 
+
+#define KRB5_PKU2U_REALM_NAME ("WELLKNOWN:PKU2U")
+#define KRB5_LKDC_REALM_NAME ("WELLKNOWN:COM.APPLE.LKDC")
+
+#define KRB5_GSS_HOSTBASED_SERVICE_NAME ("WELLKNOWN:ORG.H5L.HOSTBASED-SERVICE")
+#define KRB5_GSS_REFERALS_REALM_NAME ("WELLKNOWN:ORG.H5L.REFERALS-REALM")
+
 typedef enum {
     KRB5_PROMPT_TYPE_PASSWORD		= 0x1,
     KRB5_PROMPT_TYPE_NEW_PASSWORD	= 0x2,
@@ -722,6 +750,7 @@ struct _krb5_get_init_creds_opt {
     int forwardable;
     int proxiable;
     int anonymous;
+    int change_password_prompt;
     krb5_enctype *etype_list;
     int etype_list_length;
     krb5_addresses *address_list;
@@ -745,6 +774,7 @@ typedef struct _krb5_get_init_creds_opt krb5_get_init_creds_opt;
 #define KRB5_GET_INIT_CREDS_OPT_SALT		0x0080 /* no supported */
 #define KRB5_GET_INIT_CREDS_OPT_ANONYMOUS	0x0100
 #define KRB5_GET_INIT_CREDS_OPT_DISABLE_TRANSITED_CHECK	0x0200
+#define KRB5_GET_INIT_CREDS_OPT_CHANGE_PASSWORD_PROMPT	0x0400
 
 /* krb5_init_creds_step flags argument */
 #define KRB5_INIT_CREDS_STEP_FLAG_CONTINUE	0x0001
@@ -808,6 +838,7 @@ enum {
     KRB5_KRBHST_FLAGS_LARGE_MSG	  = 2
 };
 
+typedef krb5_error_code (*krb5_sendto_prexmit)(krb5_context, int, void *, int, krb5_data *);
 typedef krb5_error_code
 (KRB5_CALLCONV * krb5_send_to_kdc_func)(krb5_context, void *, krb5_krbhst_info *, time_t,
 					const krb5_data *, krb5_data *);
@@ -816,7 +847,9 @@ typedef krb5_error_code
 enum {
     KRB5_PRINCIPAL_PARSE_NO_REALM = 1, /**< Require that there are no realm */
     KRB5_PRINCIPAL_PARSE_REQUIRE_REALM = 2, /**< Require a realm present */
-    KRB5_PRINCIPAL_PARSE_ENTERPRISE = 4 /**< Parse as a NT-ENTERPRISE name */
+    KRB5_PRINCIPAL_PARSE_ENTERPRISE = 4, /**< Parse as a NT-ENTERPRISE name */
+    KRB5_PRINCIPAL_PARSE_IGNORE_REALM = 8, /**< Ignore realm if present */
+    KRB5_PRINCIPAL_PARSE_NO_DEF_REALM = 16 /**< Don't default the realm */
 };
 
 /** flags for krb5_unparse_name_flags */
@@ -829,8 +862,13 @@ enum {
 typedef struct krb5_sendto_ctx_data *krb5_sendto_ctx;
 
 #define KRB5_SENDTO_DONE	0
-#define KRB5_SENDTO_RESTART	1
+#define KRB5_SENDTO_RESET	1
 #define KRB5_SENDTO_CONTINUE	2
+#define KRB5_SENDTO_TIMEOUT	3
+#define KRB5_SENDTO_INITIAL	4
+#define KRB5_SENDTO_FILTER	5
+#define KRB5_SENDTO_FAILED	6
+#define KRB5_SENDTO_KRBHST	7
 
 typedef krb5_error_code
 (KRB5_CALLCONV * krb5_sendto_ctx_func)(krb5_context, krb5_sendto_ctx, void *,
@@ -842,6 +880,8 @@ enum krb5_plugin_type {
     PLUGIN_TYPE_FUNC
 };
 
+#define KRB5_PLUGIN_INVOKE_ALL  1
+
 struct credentials; /* this is to keep the compiler happy */
 struct getargs;
 struct sockaddr;
@@ -880,6 +920,28 @@ typedef struct {
 typedef krb5_error_code
 (KRB5_CALLCONV * krb5_gic_process_last_req)(krb5_context, krb5_last_req_entry **, void *);
 
+typedef struct {
+    krb5_enctype	ks_enctype;
+    krb5int32		ks_salttype;
+}krb5_key_salt_tuple;
+
+/*
+ * Name canonicalization rule options
+ */
+
+typedef enum krb5_name_canon_rule_options {
+        KRB5_NCRO_GC_ONLY       = 1 << 0,
+        KRB5_NCRO_USE_REFERRALS = 1 << 1,
+        KRB5_NCRO_NO_REFERRALS  = 1 << 2,
+        KRB5_NCRO_USE_FAST      = 1 << 3,
+        KRB5_NCRO_USE_DNSSEC    = 1 << 4,
+        KRB5_NCRO_LOOKUP_REALM  = 1 << 5
+} krb5_name_canon_rule_options;
+
+typedef struct krb5_name_canon_rule_data *krb5_name_canon_rule;
+typedef const struct krb5_name_canon_rule_data *krb5_const_name_canon_rule;
+typedef struct krb5_name_canon_iterator_data *krb5_name_canon_iterator;
+
 /*
  *
  */
@@ -895,6 +957,7 @@ extern KRB5_LIB_VARIABLE const char *krb5_defkeyname;
 
 
 extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops;
+extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_dcc_ops;
 extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_fcc_ops;
 extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_mcc_ops;
 extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_kcm_ops;
@@ -913,6 +976,7 @@ extern KRB5_LIB_VARIABLE const char *krb5_cc_type_file;
 extern KRB5_LIB_VARIABLE const char *krb5_cc_type_memory;
 extern KRB5_LIB_VARIABLE const char *krb5_cc_type_kcm;
 extern KRB5_LIB_VARIABLE const char *krb5_cc_type_scc;
+extern KRB5_LIB_VARIABLE const char *krb5_cc_type_dcc;
 
 #endif /* __KRB5_H__ */
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb524_convert_creds_kdc.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb524_convert_creds_kdc.3
index b72402f4b..4c81dafe2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb524_convert_creds_kdc.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb524_convert_creds_kdc.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb524_convert_creds_kdc.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb524_convert_creds_kdc.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_425_conv_principal.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_425_conv_principal.3
index 74e7e026a..fc3501c62 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_425_conv_principal.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_425_conv_principal.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_425_conv_principal.3,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $
+.\"	$NetBSD: krb5_425_conv_principal.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1997-2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_acl_match_file.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_acl_match_file.3
index 4dabd3e40..c230e4670 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_acl_match_file.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_acl_match_file.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_acl_match_file.3,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $
+.\"	$NetBSD: krb5_acl_match_file.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004, 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_aname_to_localname.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_aname_to_localname.3
index 514438386..6955be951 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_aname_to_localname.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_aname_to_localname.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_aname_to_localname.3,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $
+.\"	$NetBSD: krb5_aname_to_localname.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_appdefault.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_appdefault.3
index 44efd9a19..ac0fb0ed9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_appdefault.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_appdefault.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_appdefault.3,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $
+.\"	$NetBSD: krb5_appdefault.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2000 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_auth_context.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_auth_context.3
index d53f48374..7733dfcaa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_auth_context.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_auth_context.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_auth_context.3,v 1.1.1.2 2011/04/14 14:09:22 elric Exp $
+.\"	$NetBSD: krb5_auth_context.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -226,7 +226,7 @@ will force
 and
 .Fn krb5_fwd_tgt_creds
 to create unencrypted )
-.Dv ENCTYPE_NULL )
+.Dv KRB5_ENCTYPE_NULL )
 credentials.
 This is for use with old MIT server and JAVA based servers as
 they can't handle encrypted
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_c_make_checksum.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_c_make_checksum.3
index 002549ff9..8eb819b71 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_c_make_checksum.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_c_make_checksum.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_c_make_checksum.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_c_make_checksum.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -170,7 +170,7 @@ The functions starting with krb5_c are compat functions with MIT kerberos.
 The
 .Li krb5_enc_data
 structure holds and encrypted data.
-There are two public accessable members of
+There are two public accessible members of
 .Li krb5_enc_data .
 .Li enctype
 that holds the encryption type of the data encrypted and
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_ccapi.h b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_ccapi.h
index 06358f587..3ef15644e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_ccapi.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_ccapi.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: krb5_ccapi.h,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $	*/
+/*	$NetBSD: krb5_ccapi.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_check_transited.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_check_transited.3
index 42664c37c..e029b7222 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_check_transited.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_check_transited.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_check_transited.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_check_transited.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004, 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_create_checksum.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_create_checksum.3
index 6f1d178a1..6bf9a3aab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_create_checksum.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_create_checksum.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_create_checksum.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_create_checksum.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1999-2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_creds.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_creds.3
index 2f6020c01..688e28870 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_creds.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_creds.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_creds.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_creds.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004, 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_digest.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_digest.3
index e83b09276..1b1319692 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_digest.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_digest.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_digest.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_digest.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -66,7 +66,7 @@
 .Nm krb5_digest_get_tickets ,
 .Nm krb5_digest_get_client_binding ,
 .Nm krb5_digest_get_a1_hash
-.Nd remote digest (HTTP-DIGEST, SASL, CHAP) suppport
+.Nd remote digest (HTTP-DIGEST, SASL, CHAP) support
 .Sh LIBRARY
 Kerberos 5 Library (libkrb5, -lkrb5)
 .Sh SYNOPSIS
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_eai_to_heim_errno.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_eai_to_heim_errno.3
index 18aa6f4bf..607b59444 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_eai_to_heim_errno.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_eai_to_heim_errno.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_eai_to_heim_errno.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_eai_to_heim_errno.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_encrypt.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_encrypt.3
index e2df9f91e..72dedb78d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_encrypt.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_encrypt.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_encrypt.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_encrypt.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1999 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_err.et b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_err.et
index a4ddf8bc1..07f6391bb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_err.et
@@ -112,7 +112,12 @@ index 94
 error_code INVALID_HASH_ALG, "Invalid OTP digest algorithm"
 error_code INVALID_ITERATION_COUNT, "Invalid OTP iteration count"
 
-# 97-127 are reserved
+# 97-99 are reserved
+
+index 100
+error_code NO_ACCEPTABLE_KDF, "No acceptable KDF offered"
+
+# 101-127 are reserved
 
 index 128
 prefix
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_find_padata.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_find_padata.3
index fc67b288e..03d898c5e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_find_padata.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_find_padata.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_find_padata.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_find_padata.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_generate_random_block.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_generate_random_block.3
index d1ab6d67b..c4034f761 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_generate_random_block.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_generate_random_block.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_generate_random_block.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_generate_random_block.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_all_client_addrs.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_all_client_addrs.3
index 57e7d2542..f32b90fd3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_all_client_addrs.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_all_client_addrs.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_all_client_addrs.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_get_all_client_addrs.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_credentials.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_credentials.3
index 5e288a8a8..fb08ad437 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_credentials.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_credentials.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_credentials.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_get_credentials.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_creds.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_creds.3
index 9412f15a1..e84c4e682 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_creds.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_creds.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_creds.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_get_creds.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -135,7 +135,7 @@ accessor functions.
 and
 .Fn krb5_get_creds_opt_set_options
 adds and sets options to the
-.Fi krb5_get_creds_opt
+.Li krb5_get_creds_opt
 structure .
 The possible options to set are
 .Bl -tag -width "KRB5_GC_USER_USER" -compact
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_forwarded_creds.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_forwarded_creds.3
index 70345a13d..acd571782 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_forwarded_creds.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_forwarded_creds.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_forwarded_creds.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_get_forwarded_creds.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_in_cred.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_in_cred.3
index 1bfa19f62..687b02105 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_in_cred.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_in_cred.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_in_cred.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_get_in_cred.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_init_creds.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_init_creds.3
index a83a2acd3..2f1078dcb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_init_creds.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_init_creds.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_init_creds.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_get_init_creds.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -99,6 +99,11 @@ Kerberos 5 Library (libkrb5, -lkrb5)
 .Fa "int anonymous"
 .Fc
 .Ft void
+.Fo krb5_get_init_creds_opt_set_change_password_prompt
+.Fa "krb5_get_init_creds_opt *opt"
+.Fa "int change_password_prompt"
+.Fc
+.Ft void
 .Fo krb5_get_init_creds_opt_set_default_flags
 .Fa "krb5_context context"
 .Fa "const char *appname"
@@ -388,7 +393,7 @@ sets the salt that is going to be used in the request.
 sets requested ticket lifetime.
 .Pp
 .Fn krb5_get_init_creds_opt_set_canonicalize
-requests that the KDC canonicalize the client pricipal if possible.
+requests that the KDC canonicalize the client principal if possible.
 .Pp
 .Fn krb5_get_init_creds_opt_set_win2k
 turns on compatibility with Windows 2000.
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_krbhst.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_krbhst.3
index cb267dc64..ce029738f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_krbhst.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_get_krbhst.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_get_krbhst.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_get_krbhst.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_getportbyname.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_getportbyname.3
index 5e9f2578b..b60358895 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_getportbyname.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_getportbyname.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_getportbyname.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_getportbyname.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_init_context.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_init_context.3
index b76105526..d7c8b8b07 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_init_context.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_init_context.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_init_context.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_init_context.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_is_thread_safe.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_is_thread_safe.3
index 4532ce4bc..311360f4e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_is_thread_safe.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_is_thread_safe.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_is_thread_safe.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_is_thread_safe.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_krbhst_init.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_krbhst_init.3
index 536369984..82b0d25f1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_krbhst_init.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_krbhst_init.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_krbhst_init.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_krbhst_init.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001-2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_locl.h b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_locl.h
index e3f52be14..a537268aa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_locl.h
@@ -1,7 +1,7 @@
-/*	$NetBSD: krb5_locl.h,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: krb5_locl.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
- * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997-2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -41,13 +41,9 @@
 #define __KRB5_LOCL_H__
 
 #include <config.h>
+#include <krb5/roken.h>
 
-#include <errno.h>
 #include <ctype.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <limits.h>
 
 #ifdef HAVE_POLL_H
 #include <sys/poll.h>
@@ -61,12 +57,6 @@
 #ifdef HAVE_SYS_MMAN_H
 #include <sys/mman.h>
 #endif
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
 
 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
 #include <sys/ioctl.h>
@@ -78,44 +68,11 @@
 #include <pwd.h>
 #endif
 
-#ifdef HAVE_SYS_PARAM_H
-#include <sys/param.h>
-#endif
-#include <time.h>
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
 #ifdef HAVE_SYS_SELECT_H
 #include <sys/select.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>
-#endif
-#ifdef HAVE_NETINET_IN6_H
-#include <netinet/in6.h>
-#endif
-#ifdef HAVE_NETINET6_IN6_H
-#include <netinet6/in6.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
 #ifdef _AIX
-struct ether_addr;
 struct mbuf;
-struct sockaddr_dl;
-#endif
-#ifdef HAVE_ARPA_INET_H
-#include <arpa/inet.h>
-#endif
-#ifdef HAVE_ARPA_NAMESER_H
-#include <arpa/nameser.h>
-#endif
-#ifdef HAVE_SYS_UIO_H
-#include <sys/uio.h>
 #endif
 #ifdef HAVE_SYS_FILIO_H
 #include <sys/filio.h>
@@ -150,17 +107,24 @@ struct sockaddr_dl;
 #include <door.h>
 #endif
 
-#include <krb5/roken.h>
 #include <krb5/parse_time.h>
 #include <krb5/base64.h>
 
 #include <krb5/wind.h>
 
+/*
+ * We use OpenSSL for EC, but to do this we need to disable cross-references
+ * between OpenSSL and hcrypto bn.h and such.  Source files that use OpenSSL EC
+ * must define HEIM_NO_CRYPTO_HDRS before including this file.
+ */
 #define HC_DEPRECATED_CRYPTO
+#ifndef HEIM_NO_CRYPTO_HDRS
 #include "crypto-headers.h"
+#endif
 
 
 #include <krb5/krb5_asn1.h>
+#include <krb5/pkinit_asn1.h>
 
 struct send_to_kdc;
 
@@ -256,6 +220,7 @@ typedef uint32_t krb5_enctype_set;
 
 typedef struct krb5_context_data {
     krb5_enctype *etypes;
+    krb5_enctype *cfg_etypes;
     krb5_enctype *etypes_des;/* deprecated */
     krb5_enctype *as_etypes;
     krb5_enctype *tgs_etypes;
@@ -263,6 +228,7 @@ typedef struct krb5_context_data {
     char **default_realms;
     time_t max_skew;
     time_t kdc_timeout;
+    time_t host_timeout;
     unsigned max_retries;
     int32_t kdc_sec_offset;
     int32_t kdc_usec_offset;
@@ -293,24 +259,31 @@ typedef struct krb5_context_data {
     char *default_cc_name;
     char *default_cc_name_env;
     int default_cc_name_set;
-    void *mutex;			/* protects error_string/error_buf */
+    HEIMDAL_MUTEX mutex;		/* protects error_string */
     int large_msg_size;
+    int max_msg_size;
+    int tgs_negative_timeout;		/* timeout for TGS negative cache */
     int flags;
 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME	1
 #define KRB5_CTX_F_CHECK_PAC			2
 #define KRB5_CTX_F_HOMEDIR_ACCESS		4
 #define KRB5_CTX_F_SOCKETS_INITIALIZED          8
 #define KRB5_CTX_F_RD_REQ_IGNORE		16
+#define KRB5_CTX_F_FCACHE_STRICT_CHECKING	32
     struct send_to_kdc *send_to_kdc;
 #ifdef PKINIT
     hx509_context hx509ctx;
 #endif
+    unsigned int num_kdc_requests;
+    krb5_name_canon_rule name_canon_rules;
 } krb5_context_data;
 
 #ifndef KRB5_USE_PATH_TOKENS
 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}"
+#define KRB5_DEFAULT_CCNAME_DIR "DIR:/tmp/krb5cc_%{uid}_dir/"
 #else
 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}"
+#define KRB5_DEFAULT_CCNAME_DIR "DIR:%{TEMP}/krb5cc_%{uid}_dir/"
 #endif
 #define KRB5_DEFAULT_CCNAME_API "API:"
 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}"
@@ -342,6 +315,22 @@ typedef struct krb5_context_data {
 #define KRB5_FORWARDABLE_DEFAULT TRUE
 #endif
 
+#ifndef KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME
+#define KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME "org.h5l.Kerberos.configuration-changed"
+#endif
+
+#ifndef KRB5_FALLBACK_DEFAULT
+#define KRB5_FALLBACK_DEFAULT TRUE
+#endif
+
+#ifndef KRB5_TKT_LIFETIME_DEFAULT
+# define KRB5_TKT_LIFETIME_DEFAULT        15778800  /* seconds */
+#endif
+
+#ifndef KRB5_TKT_RENEW_LIFETIME_DEFAULT
+# define KRB5_TKT_RENEW_LIFETIME_DEFAULT  15778800  /* seconds */
+#endif
+
 #ifdef PKINIT
 
 struct krb5_pk_identity {
@@ -360,6 +349,34 @@ enum krb5_pk_type {
     PKINIT_27 = 2
 };
 
+enum keyex_enum { USE_RSA, USE_DH, USE_ECDH };
+
+struct krb5_pk_init_ctx_data {
+    struct krb5_pk_identity *id;
+    enum keyex_enum keyex;
+    union {
+	DH *dh;
+        void *eckey;
+    } u;
+    krb5_data *clientDHNonce;
+    struct krb5_dh_moduli **m;
+    hx509_peer_info peer;
+    enum krb5_pk_type type;
+    unsigned int require_binding:1;
+    unsigned int require_eku:1;
+    unsigned int require_krbtgt_otherName:1;
+    unsigned int require_hostname_match:1;
+    unsigned int trustedCertifiers:1;
+    unsigned int anonymous:1;
+};
+
 #endif /* PKINIT */
 
+#define ISTILDE(x) (x == '~')
+#ifdef _WIN32
+# define ISPATHSEP(x) (x == '/' || x =='\\')
+#else
+# define ISPATHSEP(x) (x == '/')
+#endif
+
 #endif /* __KRB5_LOCL_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_req.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_req.3
index b062c90dd..5b89717e4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_req.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_req.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_mk_req.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $
+.\"	$NetBSD: krb5_mk_req.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_safe.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_safe.3
index 612b86a33..f1e06ab22 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_safe.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_mk_safe.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_mk_safe.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_mk_safe.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_openlog.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_openlog.3
index e2db4a026..af9cf18ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_openlog.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_openlog.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_openlog.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_openlog.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1997, 1999, 2001 - 2002 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_parse_name.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_parse_name.3
index a12978689..8aba34139 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_parse_name.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_parse_name.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_parse_name.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_parse_name.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 1997 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -63,7 +63,6 @@ quoting it with a backslash
 .Pq Dq \e .
 A realm should not contain slashes or colons.
 .Sh SEE ALSO
-.Xr krb5_425_conv_principal 3 ,
 .Xr krb5_build_principal 3 ,
 .Xr krb5_free_principal 3 ,
 .Xr krb5_sname_to_principal 3 ,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_principal.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_principal.3
index 229a08518..b2f5f10dd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_principal.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_principal.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_principal.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_principal.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -364,7 +364,6 @@ On failure the function returns an error code and set the error
 string.
 .\" .Sh EXAMPLES
 .Sh SEE ALSO
-.Xr krb5_425_conv_principal 3 ,
 .Xr krb5_config 3 ,
 .Xr krb5.conf 5
 .Sh BUGS
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rcache.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rcache.3
index f66841ca9..5ea38a41e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rcache.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rcache.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_rcache.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_rcache.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_error.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_error.3
index 5e0ee3069..f79682539 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_error.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_error.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_rd_error.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_rd_error.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_safe.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_safe.3
index 9d7b67b1d..33647b1f0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_safe.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_rd_safe.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_rd_safe.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_rd_safe.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_default_realm.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_default_realm.3
index 07dd86769..085c48c7f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_default_realm.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_default_realm.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_set_default_realm.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_set_default_realm.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -97,7 +97,7 @@ frees all memory allocated by
 .Fn krb5_get_default_realm
 returns the first default realm for this host.
 The realm returned should be freed with
-.Fn free .
+.Fn krb5_xfree .
 .Pp
 .Fn krb5_get_default_realms
 returns a
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_password.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_password.3
index ab5acb1aa..8f68fa5d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_password.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_set_password.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_set_password.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_set_password.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_string_to_key.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_string_to_key.3
index a2094c01a..38ddb9e3c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_string_to_key.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_string_to_key.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_string_to_key.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: krb5_string_to_key.3,v 1.4 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_timeofday.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_timeofday.3
index 1fa7e75ba..2255d8fd9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_timeofday.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_timeofday.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_timeofday.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_timeofday.3,v 1.3 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Id
 .\"
@@ -35,7 +35,7 @@
 .\"
 .\" Id
 .\"
-.Dd Sepember  16, 2006
+.Dd September  16, 2006
 .Dt KRB5_TIMEOFDAY 3
 .Os
 .Sh NAME
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_init_creds.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_init_creds.3
index d23f97e1d..7393427ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_init_creds.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_init_creds.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_verify_init_creds.3,v 1.1.1.2 2011/04/14 14:09:23 elric Exp $
+.\"	$NetBSD: krb5_verify_init_creds.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_user.3 b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_user.3
index 7c495fb8b..90646d670 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_user.3
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krb5_verify_user.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5_verify_user.3,v 1.1.1.2 2011/04/14 14:09:24 elric Exp $
+.\"	$NetBSD: krb5_verify_user.3,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2001 - 2006 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst-test.c
index 308ba8441..e0cf075f3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: krbhst-test.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: krbhst-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst.c b/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst.c
index e78746816..6ae17fd81 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/krbhst.c
@@ -1,10 +1,12 @@
-/*	$NetBSD: krbhst.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: krbhst.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 - 2003 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -49,6 +51,14 @@ string_to_proto(const char *string)
     return -1;
 }
 
+static int
+is_invalid_tld_srv_target(const char *target)
+{
+    return (strncmp("your-dns-needs-immediate-attention.",
+		    target, 35) == 0
+	    && strchr(&target[35], '.') == NULL);
+}
+
 /*
  * set `res' and `count' to the result of looking up SRV RR in DNS for
  * `proto', `proto', `realm' using `dns_type'.
@@ -101,26 +111,38 @@ srv_find_realm(krb5_context context, krb5_krbhst_info ***res, int *count,
     *res = malloc(num_srv * sizeof(**res));
     if(*res == NULL) {
 	rk_dns_free_data(r);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     rk_dns_srv_order(r);
 
     for(num_srv = 0, rr = r->head; rr; rr = rr->next)
 	if(rr->type == rk_ns_t_srv) {
-	    krb5_krbhst_info *hi;
-	    size_t len = strlen(rr->u.srv->target);
+	    krb5_krbhst_info *hi = NULL;
+	    size_t len;
+	    int invalid_tld = 1;
 
-	    hi = calloc(1, sizeof(*hi) + len);
+	    /* Test for top-level domain controlled interruptions */
+	    if (!is_invalid_tld_srv_target(rr->u.srv->target)) {
+		invalid_tld = 0;
+		len = strlen(rr->u.srv->target);
+		hi = calloc(1, sizeof(*hi) + len);
+	    }
 	    if(hi == NULL) {
 		rk_dns_free_data(r);
 		while(--num_srv >= 0)
 		    free((*res)[num_srv]);
 		free(*res);
 		*res = NULL;
-		return ENOMEM;
+		if (invalid_tld) {
+		    krb5_warnx(context,
+			       "Domain lookup failed: "
+			       "Realm %s needs immediate attention "
+			       "see https://icann.org/namecollision",
+			       realm);
+		    return KRB5_KDC_UNREACH;
+		}
+		return krb5_enomem(context);
 	    }
 	    (*res)[num_srv++] = hi;
 
@@ -155,9 +177,11 @@ struct krb5_krbhst_data {
 #define KD_CONFIG_EXISTS	32
 #define KD_LARGE_MSG		64
 #define KD_PLUGIN	       128
+#define KD_HOSTNAMES	       256
     krb5_error_code (*get_next)(krb5_context, struct krb5_krbhst_data *,
 				krb5_krbhst_info**);
 
+    char *hostname;
     unsigned int fallback_count;
 
     struct krb5_krbhst_info *hosts, **index, **end;
@@ -181,11 +205,17 @@ krbhst_get_default_proto(struct krb5_krbhst_data *kd)
     return KRB5_KRBHST_UDP;
 }
 
+static int
+krbhst_get_default_port(struct krb5_krbhst_data *kd)
+{
+    return kd->def_port;
+}
+
 /*
  *
  */
 
-const char *
+KRB5_LIB_FUNCTION const char * KRB5_LIB_CALL
 _krb5_krbhst_get_realm(krb5_krbhst_handle handle)
 {
     return handle->realm;
@@ -220,6 +250,7 @@ parse_hostspec(krb5_context context, struct krb5_krbhst_data *kd,
 	hi->proto = KRB5_KRBHST_TCP;
 	p += 4;
     } else if(strncmp(p, "udp/", 4) == 0) {
+	hi->proto = KRB5_KRBHST_UDP;
 	p += 4;
     }
 
@@ -255,7 +286,7 @@ parse_hostspec(krb5_context context, struct krb5_krbhst_data *kd,
     return hi;
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_krbhst_info(krb5_krbhst_info *hi)
 {
     if (hi->ai != NULL)
@@ -263,7 +294,7 @@ _krb5_free_krbhst_info(krb5_krbhst_info *hi)
     free(hi);
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_krbhost_info_move(krb5_context context,
 			krb5_krbhst_info *from,
 			krb5_krbhst_info **to)
@@ -271,11 +302,8 @@ _krb5_krbhost_info_move(krb5_context context,
     size_t hostnamelen = strlen(from->hostname);
     /* trailing NUL is included in structure */
     *to = calloc(1, sizeof(**to) + hostnamelen);
-    if(*to == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*to == NULL)
+	return krb5_enomem(context);
 
     (*to)->proto = from->proto;
     (*to)->port = from->port;
@@ -312,7 +340,7 @@ append_host_string(krb5_context context, struct krb5_krbhst_data *kd,
 
     hi = parse_hostspec(context, kd, host, def_port, port);
     if(hi == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
 
     append_host_hostinfo(kd, hi);
     return 0;
@@ -377,39 +405,11 @@ krb5_krbhst_get_addrinfo(krb5_context context, krb5_krbhst_info *host,
     if (host->ai == NULL) {
 	struct addrinfo hints;
 	char portstr[NI_MAXSERV];
-	char *hostname = host->hostname;
 
 	snprintf (portstr, sizeof(portstr), "%d", host->port);
 	make_hints(&hints, host->proto);
 
-	/**
-	 * First try this as an IP address, this allows us to add a
-	 * dot at the end to stop using the search domains.
-	 */
-
-	hints.ai_flags |= AI_NUMERICHOST | AI_NUMERICSERV;
-
 	ret = getaddrinfo(host->hostname, portstr, &hints, &host->ai);
-	if (ret == 0)
-	    goto out;
-
-	/**
-	 * If the hostname contains a dot, assumes it's a FQDN and
-	 * don't use search domains since that might be painfully slow
-	 * when machine is disconnected from that network.
-	 */
-
-	hints.ai_flags &= ~(AI_NUMERICHOST);
-
-	if (strchr(hostname, '.') && hostname[strlen(hostname) - 1] != '.') {
-	    ret = asprintf(&hostname, "%s.", host->hostname);
-	    if (ret < 0 || hostname == NULL)
-		return ENOMEM;
-	}
-
-	ret = getaddrinfo(hostname, portstr, &hints, &host->ai);
-	if (hostname != host->hostname)
-	    free(hostname);
 	if (ret) {
 	    ret = krb5_eai_to_heim_errno(ret, errno);
 	    goto out;
@@ -440,6 +440,9 @@ srv_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
     krb5_krbhst_info **res;
     int count, i;
 
+    if (krb5_realm_is_lkdc(kd->realm))
+	return;
+
     ret = srv_find_realm(context, &res, &count, kd->realm, "SRV", proto, service,
 			 kd->port);
     _krb5_debug(context, 2, "searching DNS for realm %s %s.%s -> %d",
@@ -494,14 +497,23 @@ fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
     struct addrinfo hints;
     char portstr[NI_MAXSERV];
 
+    ret = krb5_config_get_bool_default(context, NULL, KRB5_FALLBACK_DEFAULT,
+				       "libdefaults", "use_fallback", NULL);
+    if (!ret) {
+	kd->flags |= KD_FALLBACK;
+	return 0;
+    }
+
     _krb5_debug(context, 2, "fallback lookup %d for realm %s (service %s)",
 		kd->fallback_count, kd->realm, serv_string);
 
     /*
      * Don't try forever in case the DNS server keep returning us
      * entries (like wildcard entries or the .nu TLD)
+     *
+     * Also don't try LKDC realms since fallback wont work on them at all.
      */
-    if(kd->fallback_count >= 5) {
+    if(kd->fallback_count >= 5 || krb5_realm_is_lkdc(kd->realm)) {
 	kd->flags |= KD_FALLBACK;
 	return 0;
     }
@@ -513,7 +525,7 @@ fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
 		       serv_string, kd->fallback_count, kd->realm);
 
     if (ret < 0 || host == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
 
     make_hints(&hints, proto);
     snprintf(portstr, sizeof(portstr), "%d", port);
@@ -524,12 +536,26 @@ fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
 	kd->flags |= KD_FALLBACK;
     } else {
 	struct krb5_krbhst_info *hi;
-	size_t hostlen = strlen(host);
+	size_t hostlen;
 
+	/* Check for ICANN gTLD Name Collision address (127.0.53.53) */
+	if (ai->ai_family == AF_INET) {
+	    struct sockaddr_in *sin = (struct sockaddr_in *)ai->ai_addr;
+	    if (sin->sin_addr.s_addr == htonl(0x7f003535)) {
+		krb5_warnx(context,
+			   "Fallback lookup failed: "
+			   "Realm %s needs immediate attention "
+			   "see https://icann.org/namecollision",
+			   kd->realm);
+		return KRB5_KDC_UNREACH;
+	    }
+	}
+
+	hostlen = strlen(host);
 	hi = calloc(1, sizeof(*hi) + hostlen);
 	if(hi == NULL) {
 	    free(host);
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 
 	hi->proto = proto;
@@ -549,24 +575,18 @@ fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
  */
 
 static krb5_error_code
-add_locate(void *ctx, int type, struct sockaddr *addr)
+add_plugin_host(struct krb5_krbhst_data *kd,
+		const char *host,
+		const char *port,
+		int portnum,
+		int proto)
 {
     struct krb5_krbhst_info *hi;
-    struct krb5_krbhst_data *kd = ctx;
-    char host[NI_MAXHOST], port[NI_MAXSERV];
     struct addrinfo hints, *ai;
-    socklen_t socklen;
     size_t hostlen;
     int ret;
 
-    socklen = socket_sockaddr_size(addr);
-
-    ret = getnameinfo(addr, socklen, host, sizeof(host), port, sizeof(port),
-		      NI_NUMERICHOST|NI_NUMERICSERV);
-    if (ret != 0)
-	return 0;
-
-    make_hints(&hints, krbhst_get_default_proto(kd));
+    make_hints(&hints, proto);
     ret = getaddrinfo(host, port, &hints, &ai);
     if (ret)
 	return 0;
@@ -574,11 +594,13 @@ add_locate(void *ctx, int type, struct sockaddr *addr)
     hostlen = strlen(host);
 
     hi = calloc(1, sizeof(*hi) + hostlen);
-    if(hi == NULL)
+    if (hi == NULL) {
+        freeaddrinfo(ai);
 	return ENOMEM;
+    }
 
-    hi->proto = krbhst_get_default_proto(kd);
-    hi->port  = hi->def_port = socket_get_port(addr);
+    hi->proto = proto;
+    hi->port  = hi->def_port = portnum;
     hi->ai    = ai;
     memmove(hi->hostname, host, hostlen);
     hi->hostname[hostlen] = '\0';
@@ -587,44 +609,103 @@ add_locate(void *ctx, int type, struct sockaddr *addr)
     return 0;
 }
 
+static krb5_error_code
+add_locate(void *ctx, int type, struct sockaddr *addr)
+{
+    struct krb5_krbhst_data *kd = ctx;
+    char host[NI_MAXHOST], port[NI_MAXSERV];
+    socklen_t socklen;
+    krb5_error_code ret;
+    int proto, portnum;
+
+    socklen = socket_sockaddr_size(addr);
+    portnum = socket_get_port(addr);
+
+    ret = getnameinfo(addr, socklen, host, sizeof(host), port, sizeof(port),
+		      NI_NUMERICHOST|NI_NUMERICSERV);
+    if (ret != 0)
+	return 0;
+
+    if (kd->port)
+	snprintf(port, sizeof(port), "%d", kd->port);
+    else if (atoi(port) == 0)
+	snprintf(port, sizeof(port), "%d", krbhst_get_default_port(kd));
+
+    proto = krbhst_get_default_proto(kd);
+
+    ret = add_plugin_host(kd, host, port, portnum, proto);
+    if (ret)
+	return ret;
+
+    /*
+     * This is really kind of broken and should be solved a different
+     * way, some sites block UDP, and we don't, in the general case,
+     * fall back to TCP, that should also be done. But since that
+     * should require us to invert the whole "find kdc" stack, let put
+     * this in for now. 
+     */
+
+    if (proto == KRB5_KRBHST_UDP) {
+	ret = add_plugin_host(kd, host, port, portnum, KRB5_KRBHST_TCP);
+	if (ret)
+	    return ret;
+    }
+
+    return 0;
+}
+
+struct plctx {
+    enum locate_service_type type;
+    struct krb5_krbhst_data *kd;
+    unsigned long flags;
+};
+
+static KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+plcallback(krb5_context context,
+	   const void *plug, void *plugctx, void *userctx)
+{
+    const krb5plugin_service_locate_ftable *locate = plug;
+    struct plctx *plctx = userctx;
+    
+    if (locate->minor_version >= KRB5_PLUGIN_LOCATE_VERSION_2)
+	return locate->lookup(plugctx, plctx->flags, plctx->type, plctx->kd->realm, 0, 0, add_locate, plctx->kd);
+    
+    if (plctx->flags & KRB5_PLF_ALLOW_HOMEDIR)
+	return locate->old_lookup(plugctx, plctx->type, plctx->kd->realm, 0, 0, add_locate, plctx->kd);
+    
+    return KRB5_PLUGIN_NO_HANDLE;
+}
+
 static void
 plugin_get_hosts(krb5_context context,
 		 struct krb5_krbhst_data *kd,
 		 enum locate_service_type type)
 {
-    struct krb5_plugin *list = NULL, *e;
-    krb5_error_code ret;
+    struct plctx ctx = { type, kd, 0 };
 
-    ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA,
-			    KRB5_PLUGIN_LOCATE, &list);
-    if(ret != 0 || list == NULL)
-	return;
+    if (_krb5_homedir_access(context))
+	ctx.flags |= KRB5_PLF_ALLOW_HOMEDIR;
 
-    for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
-	krb5plugin_service_locate_ftable *service;
-	void *ctx;
-
-	service = _krb5_plugin_get_symbol(e);
-	if (service->minor_version != 0)
-	    continue;
-
-	(*service->init)(context, &ctx);
-	ret = (*service->lookup)(ctx, type, kd->realm, 0, 0, add_locate, kd);
-	(*service->fini)(ctx);
-	if (ret && ret != KRB5_PLUGIN_NO_HANDLE) {
-	    krb5_set_error_message(context, ret,
-				   N_("Locate plugin failed to lookup realm %s: %d", ""),
-				   kd->realm, ret);
-	    break;
-	} else if (ret == 0) {
-	    _krb5_debug(context, 2, "plugin found result for realm %s", kd->realm);
-	    kd->flags |= KD_CONFIG_EXISTS;
-	}
-
-    }
-    _krb5_plugin_free(list);
+    _krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_LOCATE,
+		       KRB5_PLUGIN_LOCATE_VERSION_0,
+		       0, &ctx, plcallback);
 }
 
+/*
+ *
+ */
+
+static void
+hostnames_get_hosts(krb5_context context,
+		    struct krb5_krbhst_data *kd,
+		    const char *type)
+{
+    kd->flags |= KD_HOSTNAMES;
+    if (kd->hostname)
+	append_host_string(context, kd, kd->hostname, kd->def_port, kd->port);
+}
+
+
 /*
  *
  */
@@ -636,6 +717,12 @@ kdc_get_next(krb5_context context,
 {
     krb5_error_code ret;
 
+    if ((kd->flags & KD_HOSTNAMES) == 0) {
+	hostnames_get_hosts(context, kd, "kdc");
+	if(get_next(kd, host))
+	    return 0;
+    }
+
     if ((kd->flags & KD_PLUGIN) == 0) {
 	plugin_get_hosts(context, kd, locate_service_kdc);
 	kd->flags |= KD_PLUGIN;
@@ -808,60 +895,20 @@ kpasswd_get_next(krb5_context context,
     return KRB5_KDC_UNREACH;
 }
 
-static krb5_error_code
-krb524_get_next(krb5_context context,
-		struct krb5_krbhst_data *kd,
-		krb5_krbhst_info **host)
+static void
+krbhost_dealloc(void *ptr)
 {
-    if ((kd->flags & KD_PLUGIN) == 0) {
-	plugin_get_hosts(context, kd, locate_service_krb524);
-	kd->flags |= KD_PLUGIN;
-	if(get_next(kd, host))
-	    return 0;
+    struct krb5_krbhst_data *handle = (struct krb5_krbhst_data *)ptr;
+    krb5_krbhst_info *h, *next;
+
+    for (h = handle->hosts; h != NULL; h = next) {
+	next = h->next;
+	_krb5_free_krbhst_info(h);
     }
+    if (handle->hostname)
+	free(handle->hostname);
 
-    if((kd->flags & KD_CONFIG) == 0) {
-	config_get_hosts(context, kd, "krb524_server");
-	if(get_next(kd, host))
-	    return 0;
-	kd->flags |= KD_CONFIG;
-    }
-
-    if (kd->flags & KD_CONFIG_EXISTS) {
-	_krb5_debug(context, 1,
-		    "Configuration exists for realm %s, wont go to DNS",
-		    kd->realm);
-	return KRB5_KDC_UNREACH;
-    }
-
-    if(context->srv_lookup) {
-	if((kd->flags & KD_SRV_UDP) == 0) {
-	    srv_get_hosts(context, kd, "udp", "krb524");
-	    kd->flags |= KD_SRV_UDP;
-	    if(get_next(kd, host))
-		return 0;
-	}
-
-	if((kd->flags & KD_SRV_TCP) == 0) {
-	    srv_get_hosts(context, kd, "tcp", "krb524");
-	    kd->flags |= KD_SRV_TCP;
-	    if(get_next(kd, host))
-		return 0;
-	}
-    }
-
-    /* no matches -> try kdc */
-
-    if (krbhst_empty(kd)) {
-	kd->flags = 0;
-	kd->port  = kd->def_port;
-	kd->get_next = kdc_get_next;
-	return (*kd->get_next)(context, kd, host);
-    }
-
-    _krb5_debug(context, 0, "No kpasswd entries found for realm %s", kd->realm);
-
-    return KRB5_KDC_UNREACH;
+    free(handle->realm);
 }
 
 static struct krb5_krbhst_data*
@@ -872,11 +919,11 @@ common_init(krb5_context context,
 {
     struct krb5_krbhst_data *kd;
 
-    if((kd = calloc(1, sizeof(*kd))) == NULL)
+    if ((kd = heim_alloc(sizeof(*kd), "krbhst-context", krbhost_dealloc)) == NULL)
 	return NULL;
 
     if((kd->realm = strdup(realm)) == NULL) {
-	free(kd);
+	heim_release(kd);
 	return NULL;
     }
 
@@ -919,6 +966,8 @@ krb5_krbhst_init_flags(krb5_context context,
     int def_port;
     const char *service;
 
+    *handle = NULL;
+
     switch(type) {
     case KRB5_KRBHST_KDC:
 	next = kdc_get_next;
@@ -937,11 +986,6 @@ krb5_krbhst_init_flags(krb5_context context,
 					     KPASSWD_PORT));
 	service = "change_password";
 	break;
-    case KRB5_KRBHST_KRB524:
-	next = krb524_get_next;
-	def_port = ntohs(krb5_getportbyname (context, "krb524", "udp", 4444));
-	service = "524";
-	break;
     default:
 	krb5_set_error_message(context, ENOTTY,
 			       N_("unknown krbhst type (%u)", ""), type);
@@ -989,6 +1033,22 @@ krb5_krbhst_next_as_string(krb5_context context,
     return krb5_krbhst_format_string(context, host, hostname, hostlen);
 }
 
+/*
+ *
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_krbhst_set_hostname(krb5_context context,
+			 krb5_krbhst_handle handle,
+			 const char *hostname)
+{
+    if (handle->hostname)
+	free(handle->hostname);
+    handle->hostname = strdup(hostname);
+    if (handle->hostname == NULL)
+	return ENOMEM;
+    return 0;
+}
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_krbhst_reset(krb5_context context, krb5_krbhst_handle handle)
@@ -999,20 +1059,11 @@ krb5_krbhst_reset(krb5_context context, krb5_krbhst_handle handle)
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_krbhst_free(krb5_context context, krb5_krbhst_handle handle)
 {
-    krb5_krbhst_info *h, *next;
-
-    if (handle == NULL)
-	return;
-
-    for (h = handle->hosts; h != NULL; h = next) {
-	next = h->next;
-	_krb5_free_krbhst_info(h);
-    }
-
-    free(handle->realm);
-    free(handle);
+    heim_release(handle);
 }
 
+#ifndef HEIMDAL_SMALLER
+
 /* backwards compatibility ahead */
 
 static krb5_error_code
@@ -1039,7 +1090,7 @@ gethostlist(krb5_context context, const char *realm,
     *hostlist = calloc(nhost + 1, sizeof(**hostlist));
     if(*hostlist == NULL) {
 	krb5_krbhst_free(context, handle);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     krb5_krbhst_reset(context, handle);
@@ -1049,7 +1100,7 @@ gethostlist(krb5_context context, const char *realm,
 	if(((*hostlist)[nhost++] = strdup(host)) == NULL) {
 	    krb5_free_krbhst(context, *hostlist);
 	    krb5_krbhst_free(context, handle);
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
     }
     (*hostlist)[nhost] = NULL;
@@ -1093,7 +1144,6 @@ krb5_get_krb524hst (krb5_context context,
     return gethostlist(context, *realm, KRB5_KRBHST_KRB524, hostlist);
 }
 
-
 /*
  * return an malloced list of KDC's for `realm' in `hostlist'
  */
@@ -1121,3 +1171,5 @@ krb5_free_krbhst (krb5_context context,
     free (hostlist);
     return 0;
 }
+
+#endif /* HEIMDAL_SMALLER */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok.c b/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok.c
index 17764f76a..749b10845 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kuserok.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: kuserok.c,v 1.2.4.1 2017/09/11 04:58:44 snj Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -34,9 +34,230 @@
  */
 
 #include "krb5_locl.h"
+#include "kuserok_plugin.h"
 #include <dirent.h>
 
-#ifndef _WIN32
+#ifndef SYSTEM_K5LOGIN_DIR
+/*
+ * System k5login location.  File namess in this directory are expected
+ * to be usernames and to contain a list of principals allowed to login
+ * as the user named the same as the file.
+ */
+#define SYSTEM_K5LOGIN_DIR SYSCONFDIR "/k5login.d"
+#endif
+
+/* Plugin framework bits */
+
+struct plctx {
+    const char           *rule;
+    const char           *k5login_dir;
+    const char           *luser;
+    krb5_const_principal principal;
+    unsigned int         flags;
+    krb5_boolean         result;
+};
+
+static krb5_error_code KRB5_LIB_CALL
+plcallback(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    const krb5plugin_kuserok_ftable *locate = plug;
+    struct plctx *plctx = userctx;
+
+    return locate->kuserok(plugctx, context, plctx->rule, plctx->flags,
+			   plctx->k5login_dir, plctx->luser, plctx->principal,
+			   &plctx->result);
+}
+
+static krb5_error_code plugin_reg_ret;
+static krb5plugin_kuserok_ftable kuserok_simple_plug;
+static krb5plugin_kuserok_ftable kuserok_sys_k5login_plug;
+static krb5plugin_kuserok_ftable kuserok_user_k5login_plug;
+static krb5plugin_kuserok_ftable kuserok_deny_plug;
+
+static void
+reg_def_plugins_once(void *ctx)
+{
+    krb5_error_code ret;
+    krb5_context context = ctx;
+
+    plugin_reg_ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
+					  KRB5_PLUGIN_KUSEROK,
+					  &kuserok_simple_plug);
+    ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
+                               KRB5_PLUGIN_KUSEROK, &kuserok_sys_k5login_plug);
+    if (!plugin_reg_ret)
+	plugin_reg_ret = ret;
+    ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
+                               KRB5_PLUGIN_KUSEROK, &kuserok_user_k5login_plug);
+    if (!plugin_reg_ret)
+	plugin_reg_ret = ret;
+    ret = krb5_plugin_register(context, PLUGIN_TYPE_DATA,
+                               KRB5_PLUGIN_KUSEROK, &kuserok_deny_plug);
+    if (!plugin_reg_ret)
+	plugin_reg_ret = ret;
+}
+
+/**
+ * This function is designed to be portable for Win32 and POSIX.  The
+ * design does lead to multiple getpwnam_r() calls, but this is probably
+ * not a big deal.
+ *
+ * Inputs:
+ *
+ * @param context            A krb5_context
+ * @param filename	     Name of item to introspection
+ * @param is_system_location TRUE if the dir/file are system locations or
+ *                     	     FALSE if they are user home directory locations
+ * @param dir                Directory (optional)
+ * @param dirlstat           A pointer to struct stat for the directory (optional)
+ * @param file               File (optional)
+ * @param owner              Name of user that is expected to own the file
+ */
+
+static krb5_error_code
+check_owner_dir(krb5_context context,
+		const char *filename,
+		krb5_boolean is_system_location,
+		DIR *dir,
+		struct stat *dirlstat,
+		const char *owner)
+{
+#ifdef _WIN32
+    /*
+     * XXX Implement this!
+     *
+     * The thing to do is to call _get_osfhandle() on fileno(file) and
+     * dirfd(dir) to get HANDLEs to the same, then call
+     * GetSecurityInfo() on those HANDLEs to get the security descriptor
+     * (SD), then check the owner and DACL.  Checking the DACL sounds
+     * like a lot of work (what, derive a mode from the ACL the way
+     * NFSv4 servers do?).  Checking the owner means doing an LSARPC
+     * lookup at least (to get the user's SID). 
+     */
+    if (is_system_location || owner == NULL)
+	return 0;
+    krb5_set_error_message(context, EACCES,
+			   "User k5login files not supported on Windows");
+    return EACCES;
+#else
+    struct passwd pw, *pwd = NULL;
+    char pwbuf[2048];
+    struct stat st;
+
+    heim_assert(owner != NULL, "no directory owner ?");
+
+    if (rk_getpwnam_r(owner, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
+	krb5_set_error_message(context, errno,
+			       "User unknown %s (getpwnam_r())", owner);
+	return EACCES;
+    }
+    if (pwd == NULL) {
+	krb5_set_error_message(context, EACCES, "no user %s", owner);
+	return EACCES;
+    }
+
+    if (fstat(dirfd(dir), &st) == -1) {
+	krb5_set_error_message(context, EACCES,
+			       "fstat(%s) of k5login.d failed",
+			       filename);
+	return EACCES;
+    }
+    if (!S_ISDIR(st.st_mode)) {
+	krb5_set_error_message(context, ENOTDIR, "%s not a directory",
+			       filename);
+	return ENOTDIR;
+    }
+    if (st.st_dev != dirlstat->st_dev || st.st_ino != dirlstat->st_ino) {
+	krb5_set_error_message(context, EACCES,
+			       "%s was renamed during kuserok "
+			       "operation", filename);
+	return EACCES;
+    }
+    if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+	krb5_set_error_message(context, EACCES,
+			       "%s has world and/or group write "
+			       "permissions", filename);
+	return EACCES;
+    }
+    if (pwd->pw_uid != st.st_uid && st.st_uid != 0) {
+	krb5_set_error_message(context, EACCES,
+			       "%s not owned by the user (%s) or root",
+			       filename, owner);
+	return EACCES;
+    }
+    
+    return 0;
+#endif
+}
+
+static krb5_error_code
+check_owner_file(krb5_context context,
+		 const char *filename,
+		 FILE *file, const char *owner)
+{
+#ifdef _WIN32
+    /*
+     * XXX Implement this!
+     *
+     * The thing to do is to call _get_osfhandle() on fileno(file) and
+     * dirfd(dir) to get HANDLEs to the same, then call
+     * GetSecurityInfo() on those HANDLEs to get the security descriptor
+     * (SD), then check the owner and DACL.  Checking the DACL sounds
+     * like a lot of work (what, derive a mode from the ACL the way
+     * NFSv4 servers do?).  Checking the owner means doing an LSARPC
+     * lookup at least (to get the user's SID). 
+     */
+    if (owner == NULL)
+	return 0;
+
+    krb5_set_error_message(context, EACCES,
+			   "User k5login files not supported on Windows");
+    return EACCES;
+#else
+    struct passwd pw, *pwd = NULL;
+    char pwbuf[2048];
+    struct stat st;
+
+    if (owner == NULL)
+	return 0;
+
+    if (rk_getpwnam_r(owner, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
+	krb5_set_error_message(context, errno,
+			       "User unknown %s (getpwnam_r())", owner);
+	return EACCES;
+    }
+    if (pwd == NULL) {
+	krb5_set_error_message(context, EACCES, "no user %s", owner);
+	return EACCES;
+    }
+
+    if (fstat(fileno(file), &st) == -1) {
+	krb5_set_error_message(context, EACCES, "fstat(%s) of k5login failed",
+			       filename);
+	return EACCES;
+    }
+    if (S_ISDIR(st.st_mode)) {
+	krb5_set_error_message(context, EISDIR, "k5login: %s is a directory",
+			       filename);
+	return EISDIR;
+    }
+    if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+	krb5_set_error_message(context, EISDIR,
+			       "k5login %s has world and/or group write "
+			       "permissions", filename);
+	return EACCES;
+    }
+    if (pwd->pw_uid != st.st_uid && st.st_uid != 0) {
+	krb5_set_error_message(context, EACCES,
+			       "k5login %s not owned by the user or root",
+			       filename);
+	return EACCES;
+    }
+
+    return 0;
+#endif
+}
+
 
 /* see if principal is mentioned in the filename access file, return
    TRUE (in result) if so, FALSE otherwise */
@@ -44,160 +265,152 @@
 static krb5_error_code
 check_one_file(krb5_context context,
 	       const char *filename,
-	       struct passwd *pwd,
-	       krb5_principal principal,
+	       const char *owner,
+	       krb5_boolean is_system_location,
+	       krb5_const_principal principal,
 	       krb5_boolean *result)
 {
     FILE *f;
     char buf[BUFSIZ];
     krb5_error_code ret;
-    struct stat st;
 
     *result = FALSE;
 
-    f = fopen (filename, "r");
+    f = fopen(filename, "r");
     if (f == NULL)
 	return errno;
     rk_cloexec_file(f);
 
-    /* check type and mode of file */
-    if (fstat(fileno(f), &st) != 0) {
-	fclose (f);
-	return errno;
-    }
-    if (S_ISDIR(st.st_mode)) {
-	fclose (f);
-	return EISDIR;
-    }
-    if (st.st_uid != pwd->pw_uid && st.st_uid != 0) {
-	fclose (f);
-	return EACCES;
-    }
-    if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
-	fclose (f);
-	return EACCES;
-    }
+    ret = check_owner_file(context, filename, f, owner);
+    if (ret)
+	goto out;
 
-    while (fgets (buf, sizeof(buf), f) != NULL) {
+    while (fgets(buf, sizeof(buf), f) != NULL) {
 	krb5_principal tmp;
 	char *newline = buf + strcspn(buf, "\n");
 
-	if(*newline != '\n') {
+	if (*newline != '\n') {
 	    int c;
 	    c = fgetc(f);
-	    if(c != EOF) {
-		while(c != EOF && c != '\n')
+	    if (c != EOF) {
+		while (c != EOF && c != '\n')
 		    c = fgetc(f);
 		/* line was too long, so ignore it */
 		continue;
 	    }
 	}
 	*newline = '\0';
-	ret = krb5_parse_name (context, buf, &tmp);
+	ret = krb5_parse_name(context, buf, &tmp);
 	if (ret)
 	    continue;
-	*result = krb5_principal_compare (context, principal, tmp);
-	krb5_free_principal (context, tmp);
+	*result = krb5_principal_compare(context, principal, tmp);
+	krb5_free_principal(context, tmp);
 	if (*result) {
 	    fclose (f);
 	    return 0;
 	}
     }
-    fclose (f);
+
+out:
+    fclose(f);
     return 0;
 }
 
 static krb5_error_code
 check_directory(krb5_context context,
 		const char *dirname,
-		struct passwd *pwd,
-		krb5_principal principal,
+		const char *owner,
+	        krb5_boolean is_system_location,
+		krb5_const_principal principal,
 		krb5_boolean *result)
 {
     DIR *d;
     struct dirent *dent;
     char filename[MAXPATHLEN];
+    size_t len;
     krb5_error_code ret = 0;
     struct stat st;
 
     *result = FALSE;
 
-    if(lstat(dirname, &st) < 0)
+    if (lstat(dirname, &st) < 0)
 	return errno;
 
-    if (!S_ISDIR(st.st_mode))
+    if (!S_ISDIR(st.st_mode)) {
+	krb5_set_error_message(context, ENOTDIR, "k5login.d not a directory");
 	return ENOTDIR;
-
-    if (st.st_uid != pwd->pw_uid && st.st_uid != 0)
-	return EACCES;
-    if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0)
-	return EACCES;
-
-    if((d = opendir(dirname)) == NULL)
-	return errno;
-
-    {
-	int fd;
-	struct stat st2;
-
-	fd = dirfd(d);
-	if(fstat(fd, &st2) < 0) {
-	    closedir(d);
-	    return errno;
-	}
-	if(st.st_dev != st2.st_dev || st.st_ino != st2.st_ino) {
-	    closedir(d);
-	    return EACCES;
-	}
     }
 
-    while((dent = readdir(d)) != NULL) {
-	if(strcmp(dent->d_name, ".") == 0 ||
+    if ((d = opendir(dirname)) == NULL) {
+	krb5_set_error_message(context, ENOTDIR, "Could not open k5login.d");
+	return errno;
+    }
+
+    ret = check_owner_dir(context, dirname, is_system_location, d, &st, owner);
+    if (ret)
+	goto out;
+
+    while ((dent = readdir(d)) != NULL) {
+	/*
+	 * XXX: Should we also skip files whose names start with "."?
+	 * Vim ".filename.swp" files are also good candidates to skip.
+	 * Once we ignore "#*" and "*~", it is not clear what other
+	 * heuristics to apply.
+	 */
+	if (strcmp(dent->d_name, ".") == 0 ||
 	   strcmp(dent->d_name, "..") == 0 ||
 	   dent->d_name[0] == '#' ||			  /* emacs autosave */
 	   dent->d_name[strlen(dent->d_name) - 1] == '~') /* emacs backup */
 	    continue;
-	snprintf(filename, sizeof(filename), "%s/%s", dirname, dent->d_name);
-	ret = check_one_file(context, filename, pwd, principal, result);
-	if(ret == 0 && *result == TRUE)
-	    break;
+	len = snprintf(filename, sizeof(filename), "%s/%s", dirname, dent->d_name);
+	/* Skip too-long filenames that got truncated by snprintf() */
+	if (len < sizeof(filename)) {
+	    ret = check_one_file(context, filename, owner, is_system_location,
+				 principal, result);
+	    if (ret == 0 && *result == TRUE)
+		break;
+	}
 	ret = 0; /* don't propagate errors upstream */
     }
+
+out:
     closedir(d);
     return ret;
 }
 
-#endif  /* !_WIN32 */
-
-static krb5_boolean
-match_local_principals(krb5_context context,
-		       krb5_principal principal,
-		       const char *luser)
+static krb5_error_code
+check_an2ln(krb5_context context,
+	    krb5_const_principal principal,
+	    const char *luser,
+	    krb5_boolean *result)
 {
     krb5_error_code ret;
-    krb5_realm *realms, *r;
-    krb5_boolean result = FALSE;
+    char *lname;
 
+#if 0
+    /* XXX Should we make this an option? */
     /* multi-component principals can never match */
-    if(krb5_principal_get_comp_string(context, principal, 1) != NULL)
-	return FALSE;
-
-    ret = krb5_get_default_realms (context, &realms);
-    if (ret)
-	return FALSE;
-
-    for (r = realms; *r != NULL; ++r) {
-	if(strcmp(krb5_principal_get_realm(context, principal),
-		  *r) != 0)
-	    continue;
-	if(strcmp(krb5_principal_get_comp_string(context, principal, 0),
-		  luser) == 0) {
-	    result = TRUE;
-	    break;
-	}
+    if (krb5_principal_get_comp_string(context, principal, 1) != NULL) {
+	*result =  FALSE;
+	return 0;
     }
-    krb5_free_host_realm (context, realms);
-    return result;
+#endif
+
+    lname = malloc(strlen(luser) + 1);
+    if (lname == NULL)
+	return krb5_enomem(context);
+    ret = krb5_aname_to_localname(context, principal, strlen(luser)+1, lname);
+    if (ret)
+	goto out;
+    if (strcmp(lname, luser) == 0)
+	*result = TRUE;
+    else
+	*result = FALSE;
+
+out:
+    free(lname);
+    return 0;
+
 }
 
 /**
@@ -206,8 +419,8 @@ match_local_principals(krb5_context context,
  *
  * The user may have a ~/.k5login file listing principals that are
  * allowed to login as that user. If that file does not exist, all
- * principals with a first component identical to the username, and a
- * realm considered local, are allowed access.
+ * principals with a only one component that is identical to the
+ * username, and a realm considered local, are allowed access.
  *
  * The .k5login file must contain one principal per line, be owned by
  * user and not be writable by group or other (but must be readable by
@@ -236,70 +449,297 @@ match_local_principals(krb5_context context,
  */
 
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
-krb5_kuserok (krb5_context context,
-	      krb5_principal principal,
-	      const char *luser)
+krb5_kuserok(krb5_context context,
+	     krb5_principal principal,
+	     const char *luser)
 {
-#ifndef _WIN32
-    char *buf;
-    size_t buflen;
-    struct passwd *pwd = NULL;
-    char *profile_dir = NULL;
+    return _krb5_kuserok(context, principal, luser, TRUE);
+}
+
+
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+_krb5_kuserok(krb5_context context,
+	      krb5_principal principal,
+	      const char *luser,
+	      krb5_boolean an2ln_ok)
+{
+    static heim_base_once_t reg_def_plugins = HEIM_BASE_ONCE_INIT;
     krb5_error_code ret;
-    krb5_boolean result = FALSE;
+    struct plctx ctx;
+    char **rules;
 
-    krb5_boolean found_file = FALSE;
+    /*
+     * XXX we should have a struct with a krb5_context field and a
+     * krb5_error_code fied and pass the address of that as the ctx
+     * argument of heim_base_once_f().  For now we use a static to
+     * communicate failures.  Actually, we ignore failures anyways,
+     * since we can't return them.
+     */
+    heim_base_once_f(&reg_def_plugins, context, reg_def_plugins_once);
 
-#ifdef POSIX_GETPWNAM_R
-    char pwbuf[2048];
-    struct passwd pw;
+    ctx.flags = 0;
+    ctx.luser = luser;
+    ctx.principal = principal;
+    ctx.result = FALSE;
 
-    if(getpwnam_r(luser, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0)
-	return FALSE;
-#else
-    pwd = getpwnam (luser);
-#endif
-    if (pwd == NULL)
-	return FALSE;
-    profile_dir = pwd->pw_dir;
+    ctx.k5login_dir = krb5_config_get_string(context, NULL, "libdefaults",
+					     "k5login_directory", NULL);
 
-#define KLOGIN "/.k5login"
-    buflen = strlen(profile_dir) + sizeof(KLOGIN) + 2; /* 2 for .d */
-    buf = malloc(buflen);
-    if(buf == NULL)
-	return FALSE;
-    /* check user's ~/.k5login */
-    strlcpy(buf, profile_dir, buflen);
-    strlcat(buf, KLOGIN, buflen);
-    ret = check_one_file(context, buf, pwd, principal, &result);
+    if (an2ln_ok)
+	ctx.flags |= KUSEROK_ANAME_TO_LNAME_OK;
 
-    if(ret == 0 && result == TRUE) {
-	free(buf);
-	return TRUE;
+    if (krb5_config_get_bool_default(context, NULL, FALSE, "libdefaults",
+				     "k5login_authoritative", NULL))
+	ctx.flags |= KUSEROK_K5LOGIN_IS_AUTHORITATIVE;
+
+    if ((ctx.flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) && plugin_reg_ret)
+	return plugin_reg_ret; /* fail safe */
+
+    rules = krb5_config_get_strings(context, NULL, "libdefaults",
+				    "kuserok", NULL);
+    if (rules == NULL) {
+	/* Default: check ~/.k5login */
+	ctx.rule = "USER-K5LOGIN";
+
+	ret = plcallback(context, &kuserok_user_k5login_plug, NULL, &ctx);
+	if (ret == 0)
+	    goto out;
+
+	ctx.rule = "SIMPLE";
+	ret = plcallback(context, &kuserok_simple_plug, NULL, &ctx);
+	if (ret == 0)
+	    goto out;
+
+	ctx.result = FALSE;
+    } else {
+	size_t n;
+
+	for (n = 0; rules[n]; n++) {
+	    ctx.rule = rules[n];
+
+	    ret = _krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_KUSEROK,
+				     KRB5_PLUGIN_KUSEROK_VERSION_0, 0,
+				     &ctx, plcallback);
+	    if (ret != KRB5_PLUGIN_NO_HANDLE) 
+		goto out;
+	}
     }
 
-    if(ret != ENOENT)
-	found_file = TRUE;
+out:
+    krb5_config_free_strings(rules);
 
-    strlcat(buf, ".d", buflen);
-    ret = check_directory(context, buf, pwd, principal, &result);
-    free(buf);
-    if(ret == 0 && result == TRUE)
-	return TRUE;
+    return ctx.result;
+}
 
-    if(ret != ENOENT && ret != ENOTDIR)
-	found_file = TRUE;
+/*
+ * Simple kuserok: check that the lname for the aname matches luser.
+ */
 
-    /* finally if no files exist, allow all principals matching
-       <localuser>@<LOCALREALM> */
-    if(found_file == FALSE)
-	return match_local_principals(context, principal, luser);
+static krb5_error_code KRB5_LIB_CALL
+kuserok_simple_plug_f(void *plug_ctx, krb5_context context, const char *rule,
+		      unsigned int flags, const char *k5login_dir,
+		      const char *luser, krb5_const_principal principal,
+		      krb5_boolean *result)
+{
+    krb5_error_code ret;
 
-    return FALSE;
+    if (strcmp(rule, "SIMPLE") != 0 || (flags & KUSEROK_ANAME_TO_LNAME_OK) == 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    ret = check_an2ln(context, principal, luser, result);
+    if (ret == 0 && *result == FALSE)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    return 0;
+}
+
+/*
+ * Check k5login files in a system location, rather than in home
+ * directories.
+ */
+
+static krb5_error_code KRB5_LIB_CALL
+kuserok_sys_k5login_plug_f(void *plug_ctx, krb5_context context,
+			   const char *rule, unsigned int flags,
+			   const char *k5login_dir, const char *luser,
+			   krb5_const_principal principal, krb5_boolean *result)
+{
+    char filename[MAXPATHLEN];
+    size_t len;
+    const char *profile_dir = NULL;
+    krb5_error_code ret;
+
+    *result = FALSE;
+
+    if (strcmp(rule, "SYSTEM-K5LOGIN") != 0 &&
+	strncmp(rule, "SYSTEM-K5LOGIN:", strlen("SYSTEM-K5LOGIN:")) != 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    profile_dir = strchr(rule, ':');
+    if (profile_dir == NULL)
+	profile_dir = k5login_dir ? k5login_dir : SYSTEM_K5LOGIN_DIR;
+    else
+	profile_dir++;
+
+    len = snprintf(filename, sizeof(filename), "%s/%s", profile_dir, luser);
+    if (len < sizeof(filename)) {
+	ret = check_one_file(context, filename, NULL, TRUE, principal, result);
+
+	if (ret == 0 &&
+	    ((flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) || *result == TRUE))
+	    return 0;
+    }
+
+    *result = FALSE;
+    return KRB5_PLUGIN_NO_HANDLE;
+}
+
+/*
+ * Check ~luser/.k5login and/or ~/luser/.k5login.d
+ */
+
+static krb5_error_code KRB5_LIB_CALL
+kuserok_user_k5login_plug_f(void *plug_ctx, krb5_context context,
+			    const char *rule, unsigned int flags,
+			    const char *k5login_dir, const char *luser,
+			    krb5_const_principal principal,
+			    krb5_boolean *result)
+{
+#ifdef _WIN32
+    return KRB5_PLUGIN_NO_HANDLE;
 #else
-    /* The .k5login file may be on a remote profile and we don't have
-       access to the profile until we have a token handle for the
-       user's credentials. */
-    return match_local_principals(context, principal, luser);
+    char *path;
+    char *path_exp;
+    const char *profile_dir = NULL;
+    krb5_error_code ret;
+    krb5_boolean found_file = FALSE;
+    struct passwd pw, *pwd = NULL;
+    char pwbuf[2048];
+
+    if (strcmp(rule, "USER-K5LOGIN") != 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    profile_dir = k5login_dir;
+    if (profile_dir == NULL) {
+	/* Don't deadlock with gssd or anything of the sort */
+	if (!_krb5_homedir_access(context))
+	    return KRB5_PLUGIN_NO_HANDLE;
+
+	if (rk_getpwnam_r(luser, &pw, pwbuf, sizeof(pwbuf), &pwd) != 0) {
+	    krb5_set_error_message(context, errno, "User unknown (getpwnam_r())");
+	    return KRB5_PLUGIN_NO_HANDLE;
+	}
+	if (pwd == NULL) {
+	    krb5_set_error_message(context, errno, "User unknown (getpwnam())");
+	    return KRB5_PLUGIN_NO_HANDLE;
+	}
+	profile_dir = pwd->pw_dir;
+    }
+
+#define KLOGIN "/.k5login"
+
+    if (asprintf(&path, "%s/.k5login.d", profile_dir) == -1)
+	return krb5_enomem(context);
+
+    ret = _krb5_expand_path_tokensv(context, path, 1, &path_exp,
+				    "luser", luser, NULL);
+    free(path);
+    if (ret)
+	return ret;
+    path = path_exp;
+
+    /* check user's ~/.k5login */
+    path[strlen(path) - strlen(".d")] = '\0';
+    ret = check_one_file(context, path, luser, FALSE, principal, result);
+
+    /*
+     * A match in ~/.k5login is sufficient.  A non-match, falls through to the
+     * .k5login.d code below.
+     */
+    if (ret == 0 && *result == TRUE) {
+	free(path);
+	return 0;
+    }
+    if (ret != ENOENT)
+	found_file = TRUE;
+
+    /*
+     * A match in ~/.k5login.d/somefile is sufficient.  A non-match, falls
+     * through to the code below that handles negative results.
+     *
+     * XXX: put back the .d; clever|hackish? you decide
+     */
+    path[strlen(path)] = '.';
+    ret = check_directory(context, path, luser, FALSE, principal, result);
+    free(path);
+    if (ret == 0 && *result == TRUE)
+	return 0;
+    if (ret != ENOENT && ret != ENOTDIR)
+	found_file = TRUE;
+
+    /*
+     * When either ~/.k5login or ~/.k5login.d/ exists, but neither matches
+     * and we're authoritative, we're done.  Otherwise, give other plugins
+     * a chance.
+     */
+    *result = FALSE;
+    if (found_file && (flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE))
+	return 0;
+    return KRB5_PLUGIN_NO_HANDLE;
 #endif
 }
+
+static krb5_error_code KRB5_LIB_CALL
+kuserok_deny_plug_f(void *plug_ctx, krb5_context context, const char *rule,
+		    unsigned int flags, const char *k5login_dir,
+		    const char *luser, krb5_const_principal principal,
+		    krb5_boolean *result)
+{
+    if (strcmp(rule, "DENY") != 0)
+	return KRB5_PLUGIN_NO_HANDLE;
+
+    *result = FALSE;
+    return 0;
+}
+
+static krb5_error_code KRB5_LIB_CALL
+kuser_ok_null_plugin_init(krb5_context context, void **ctx)
+{
+    *ctx = NULL;
+    return 0;
+}
+
+static void KRB5_LIB_CALL
+kuser_ok_null_plugin_fini(void *ctx)
+{
+    return;
+}
+
+static krb5plugin_kuserok_ftable kuserok_simple_plug = {
+    KRB5_PLUGIN_KUSEROK_VERSION_0,
+    kuser_ok_null_plugin_init,
+    kuser_ok_null_plugin_fini,
+    kuserok_simple_plug_f,
+};
+
+static krb5plugin_kuserok_ftable kuserok_sys_k5login_plug = {
+    KRB5_PLUGIN_KUSEROK_VERSION_0,
+    kuser_ok_null_plugin_init,
+    kuser_ok_null_plugin_fini,
+    kuserok_sys_k5login_plug_f,
+};
+
+static krb5plugin_kuserok_ftable kuserok_user_k5login_plug = {
+    KRB5_PLUGIN_KUSEROK_VERSION_0,
+    kuser_ok_null_plugin_init,
+    kuser_ok_null_plugin_fini,
+    kuserok_user_k5login_plug_f,
+};
+
+static krb5plugin_kuserok_ftable kuserok_deny_plug = {
+    KRB5_PLUGIN_KUSEROK_VERSION_0,
+    kuser_ok_null_plugin_init,
+    kuser_ok_null_plugin_fini,
+    kuserok_deny_plug_f,
+};
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok_plugin.h
new file mode 100644
index 000000000..b812aff99
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/kuserok_plugin.h
@@ -0,0 +1,93 @@
+/*	$NetBSD: kuserok_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef HEIMDAL_KRB5_KUSEROK_PLUGIN_H
+#define HEIMDAL_KRB5_KUSEROK_PLUGIN_H 1
+
+#define KRB5_PLUGIN_KUSEROK "krb5_plugin_kuserok"
+#define KRB5_PLUGIN_KUSEROK_VERSION_0 0
+
+/** @struct krb5plugin_kuserok_ftable_desc
+ *
+ * @brief Description of the krb5_kuserok(3) plugin facility.
+ *
+ * The krb5_kuserok(3) function is pluggable.  The plugin is named
+ * KRB5_PLUGIN_KUSEROK ("krb5_plugin_kuserok"), with a single minor
+ * version, KRB5_PLUGIN_KUSEROK_VERSION_0 (0).
+ *
+ * The plugin for krb5_kuserok(3) consists of a data symbol referencing
+ * a structure of type krb5plugin_kuserok_ftable, with four fields:
+ *
+ * @param init          Plugin initialization function (see krb5-plugin(7))
+ *
+ * @param minor_version The plugin minor version number (0)
+ *
+ * @param fini          Plugin finalization function
+ *
+ * @param kuserok       Plugin kuserok function
+ *
+ * The kuserok field is the plugin entry point that performs the
+ * traditional kuserok operation however the plugin desires.  It is
+ * invoked in no particular order relative to other kuserok plugins, but
+ * it has a 'rule' argument that indicates which plugin is intended to
+ * act on the rule.  The plugin kuserok function must return
+ * KRB5_PLUGIN_NO_HANDLE if the rule is not applicable to it.
+ *
+ * The plugin kuserok function has the following arguments, in this
+ * order:
+ *
+ * -# plug_ctx, the context value output by the plugin's init function
+ * -# context, a krb5_context
+ * -# rule, the kuserok rule being evaluated (from krb5.conf(5))
+ * -# flags
+ * -# k5login_dir, configured location of k5login per-user files if any
+ * -# luser, name of the local user account to which principal is attempting to access.
+ * -# principal, the krb5_principal trying to access the luser account
+ * -# result, a krb5_boolean pointer where the plugin will output its result
+ *
+ * @ingroup krb5_support
+ */
+typedef struct krb5plugin_kuserok_ftable_desc {
+    int			minor_version;
+    krb5_error_code	(KRB5_LIB_CALL *init)(krb5_context, void **);
+    void		(KRB5_LIB_CALL *fini)(void *);
+    krb5_error_code	(KRB5_LIB_CALL *kuserok)(void *, krb5_context, const char *,
+				   unsigned int, const char *, const char *,
+				   krb5_const_principal,
+				   krb5_boolean *);
+} krb5plugin_kuserok_ftable;
+
+#define KUSEROK_ANAME_TO_LNAME_OK        1
+#define KUSEROK_K5LOGIN_IS_AUTHORITATIVE 2
+
+#endif /* HEIMDAL_KRB5_KUSEROK_PLUGIN_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/libkrb5-exports.def.in b/crypto/external/bsd/heimdal/dist/lib/krb5/libkrb5-exports.def.in
index fa35a62db..01f9f78c3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/libkrb5-exports.def.in
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/libkrb5-exports.def.in
@@ -1,12 +1,6 @@
 EXPORTS
-#ifdef KRB4
-	krb524_convert_creds_kdc
-	krb524_convert_creds_kdc_ccache
-        krb5_425_conv_principal
-        krb5_425_conv_principal_ext
-        krb5_425_conv_principal_ext2
-        krb5_524_conv_principal
-#endif
+        krb524_convert_creds_kdc
+        krb524_convert_creds_kdc_ccache
 	krb5_abort
 	krb5_abortx
 	krb5_acl_match_file
@@ -356,6 +350,7 @@ EXPORTS
 	krb5_get_init_creds_opt_set_address_list
 	krb5_get_init_creds_opt_set_addressless
 	krb5_get_init_creds_opt_set_anonymous
+	krb5_get_init_creds_opt_set_change_password_prompt
 	krb5_get_init_creds_opt_set_canonicalize
 	krb5_get_init_creds_opt_set_default_flags
 	krb5_get_init_creds_opt_set_etype_list
@@ -395,6 +390,7 @@ EXPORTS
 	krb5_init_ets
 	krb5_initlog
 	krb5_is_config_principal
+	krb5_is_enctype_weak
 	krb5_is_thread_safe
 #ifdef HAVE_KCM
 	krb5_kcm_call
@@ -445,6 +441,7 @@ EXPORTS
 	krb5_make_principal
 	krb5_max_sockaddr_size
 	krb5_mk_error
+	krb5_mk_error_ext
 	krb5_mk_priv
 	krb5_mk_rep
 	krb5_mk_req
@@ -456,7 +453,7 @@ EXPORTS
 	krb5_net_write_block
 	krb5_ntlm_alloc
 	krb5_ntlm_free
-	krb5_ntlm_init_get_challange
+	krb5_ntlm_init_get_challenge
 	krb5_ntlm_init_get_flags
 	krb5_ntlm_init_get_opaque
 	krb5_ntlm_init_get_targetinfo
@@ -502,6 +499,7 @@ EXPORTS
 	krb5_principal_get_type
 	krb5_principal_is_krbtgt
 	krb5_principal_match
+	krb5_principal_set_comp_string
 	krb5_principal_set_realm
 	krb5_principal_set_type
 	krb5_print_address
@@ -555,6 +553,7 @@ EXPORTS
 	krb5_ret_data
 	krb5_ret_int16
 	krb5_ret_int32
+	krb5_ret_int64
 	krb5_ret_int8
 	krb5_ret_keyblock
 	krb5_ret_principal
@@ -564,6 +563,7 @@ EXPORTS
 	krb5_ret_times
 	krb5_ret_uint16
 	krb5_ret_uint32
+	krb5_ret_uint64
 	krb5_ret_uint8
 	krb5_salttype_to_string
 	krb5_sendauth
@@ -578,6 +578,7 @@ EXPORTS
 	krb5_sendto_kdc
 	krb5_sendto_kdc_flags
 	krb5_set_config_files
+	krb5_set_debug_dest
 	krb5_set_default_in_tkt_etypes
 	krb5_set_default_realm
 	krb5_set_dns_canonicalize_hostname
@@ -608,6 +609,8 @@ EXPORTS
 	krb5_storage_from_fd
 	krb5_storage_from_mem
 	krb5_storage_from_readonly_mem
+	krb5_storage_from_socket
+	krb5_storage_fsync
 	krb5_storage_get_byteorder
 	krb5_storage_get_eof_code
 	krb5_storage_is_flags
@@ -628,6 +631,7 @@ EXPORTS
 	krb5_store_data
 	krb5_store_int16
 	krb5_store_int32
+	krb5_store_int64
 	krb5_store_int8
 	krb5_store_keyblock
 	krb5_store_principal
@@ -637,6 +641,7 @@ EXPORTS
 	krb5_store_times
 	krb5_store_uint16
 	krb5_store_uint32
+	krb5_store_uint64
 	krb5_store_uint8
 	krb5_string_to_deltat
 	krb5_string_to_enctype
@@ -742,36 +747,21 @@ EXPORTS
 	_krb5_get_krbtgt
 	_krb5_build_authenticator
 
-#ifdef KRB4
-        ; V4 compat glue
-	_krb5_krb_tf_setup
-	_krb5_krb_dest_tkt
-	_krb5_krb_life_to_time
-	_krb5_krb_decomp_ticket
-	_krb5_krb_create_ticket
-	_krb5_krb_create_ciph
-	_krb5_krb_create_auth_reply
-	_krb5_krb_rd_req
-	_krb5_krb_free_auth_data
-	_krb5_krb_time_to_life
-	_krb5_krb_cr_err_reply
-#endif
-
 	; Shared with libkdc
-	_krb5_AES_string_to_default_iterator
+	_krb5_AES_SHA1_string_to_default_iterator
+	_krb5_AES_SHA2_string_to_default_iterator
 	_krb5_dh_group_ok
 	_krb5_get_host_realm_int
 	_krb5_get_int
+        _krb5_get_int64
 	_krb5_pac_sign
 	_krb5_parse_moduli
 	_krb5_pk_kdf
 	_krb5_pk_load_id
 	_krb5_pk_mk_ContentInfo
 	_krb5_pk_octetstring2key
-	_krb5_plugin_find
-	_krb5_plugin_free
-	_krb5_plugin_get_next
-	_krb5_plugin_get_symbol
+	_krb5_plugin_run_f
+	_krb5_enctype_requires_random_salt
 	_krb5_principal2principalname
 	_krb5_principalname2krb5_principal
 	_krb5_put_int
@@ -782,7 +772,33 @@ EXPORTS
 	krb5_get_init_creds_opt_set_pkinit_user_certs
 	krb5_pk_enterprise_cert
 
+	krb5_auth_con_getsendsubkey
+	krb5_init_creds_free
+	krb5_init_creds_get
+	krb5_init_creds_get_creds
+	krb5_init_creds_get_error
+	krb5_init_creds_init
+	krb5_init_creds_set_fast_ccache
+	krb5_init_creds_set_keytab
+	krb5_init_creds_set_password
+	krb5_init_creds_set_service
+	krb5_init_creds_store
+	krb5_process_last_request
+
 	; testing
 ;!	_krb5_aes_cts_encrypt
 	_krb5_n_fold
 	_krb5_expand_default_cc_name
+
+	; FAST
+	_krb5_fast_cf2
+	_krb5_fast_armor_key
+
+	; Recent additions
+	krb5_cc_type_dcc;
+	krb5_dcc_ops;
+	_krb5_plugin_find;
+	_krb5_plugin_free;
+	_krb5_expand_path_tokensv;
+        _krb5_find_capath;
+        _krb5_free_capath;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/locate_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/locate_plugin.h
index 67f4ca70b..2a5785026 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/locate_plugin.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/locate_plugin.h
@@ -1,10 +1,12 @@
-/*	$NetBSD: locate_plugin.h,v 1.1.1.2 2011/04/14 14:09:24 elric Exp $	*/
+/*	$NetBSD: locate_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
+ * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -39,6 +41,10 @@
 #define HEIMDAL_KRB5_LOCATE_PLUGIN_H 1
 
 #define KRB5_PLUGIN_LOCATE "service_locator"
+#define KRB5_PLUGIN_LOCATE_VERSION 1
+#define KRB5_PLUGIN_LOCATE_VERSION_0 0
+#define KRB5_PLUGIN_LOCATE_VERSION_1 1
+#define KRB5_PLUGIN_LOCATE_VERSION_2 2
 
 enum locate_service_type {
     locate_service_kdc = 1,
@@ -49,7 +55,15 @@ enum locate_service_type {
 };
 
 typedef krb5_error_code
-(*krb5plugin_service_locate_lookup) (void *, enum locate_service_type,
+(*krb5plugin_service_locate_lookup) (void *, unsigned long, enum locate_service_type,
+				     const char *, int, int,
+				     int (*)(void *,int,struct sockaddr *),
+				     void *);
+
+#define KRB5_PLF_ALLOW_HOMEDIR	    1
+
+typedef krb5_error_code
+(*krb5plugin_service_locate_lookup_old) (void *, enum locate_service_type,
 				     const char *, int, int,
 				     int (*)(void *,int,struct sockaddr *),
 				     void *);
@@ -59,7 +73,8 @@ typedef struct krb5plugin_service_locate_ftable {
     int			minor_version;
     krb5_error_code	(*init)(krb5_context, void **);
     void		(*fini)(void *);
-    krb5plugin_service_locate_lookup lookup;
+    krb5plugin_service_locate_lookup_old old_lookup;
+    krb5plugin_service_locate_lookup lookup; /* version 2 */
 } krb5plugin_service_locate_ftable;
 
 #endif /* HEIMDAL_KRB5_LOCATE_PLUGIN_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/log.c b/crypto/external/bsd/heimdal/dist/lib/krb5/log.c
index f84188a56..80ed31e44 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/log.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/log.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: log.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: log.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
@@ -123,17 +123,12 @@ krb5_initlog(krb5_context context,
 	     krb5_log_facility **fac)
 {
     krb5_log_facility *f = calloc(1, sizeof(*f));
-    if(f == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (f == NULL)
+	return krb5_enomem(context);
     f->program = strdup(program);
     if(f->program == NULL){
 	free(f);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     *fac = f;
     return 0;
@@ -149,11 +144,8 @@ krb5_addlog_func(krb5_context context,
 		 void *data)
 {
     struct facility *fp = log_realloc(fac);
-    if(fp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (fp == NULL)
+	return krb5_enomem(context);
     fp->min = min;
     fp->max = max;
     fp->log_func = log_func;
@@ -192,11 +184,8 @@ open_syslog(krb5_context context,
     struct _heimdal_syslog_data *sd = malloc(sizeof(*sd));
     int i;
 
-    if(sd == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (sd == NULL)
+	return krb5_enomem(context);
     i = find_value(sev, syslogvals);
     if(i == -1)
 	i = LOG_ERR;
@@ -215,6 +204,7 @@ struct file_data{
     const char *mode;
     FILE *fd;
     int keep_open;
+    int freefilename;
 };
 
 static void KRB5_CALLCONV
@@ -249,23 +239,27 @@ close_file(void *data)
     struct file_data *f = data;
     if(f->keep_open && f->filename)
 	fclose(f->fd);
+    if (f->filename && f->freefilename)
+	free((char *)f->filename);
     free(data);
 }
 
 static krb5_error_code
 open_file(krb5_context context, krb5_log_facility *fac, int min, int max,
-	  const char *filename, const char *mode, FILE *f, int keep_open)
+	  const char *filename, const char *mode, FILE *f, int keep_open,
+	  int freefilename)
 {
     struct file_data *fd = malloc(sizeof(*fd));
-    if(fd == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+    if (fd == NULL) {
+	if (freefilename && filename)
+	    free((char *)filename);
+	return krb5_enomem(context);
     }
     fd->filename = filename;
     fd->mode = mode;
     fd->fd = f;
     fd->keep_open = keep_open;
+    fd->freefilename = freefilename;
 
     return krb5_addlog_func(context, fac, min, max, log_file, close_file, fd);
 }
@@ -279,10 +273,13 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
     int min = 0, max = -1, n;
     char c;
     const char *p = orig;
+#ifdef _WIN32
+    const char *q;
+#endif
 
     n = sscanf(p, "%d%c%d/", &min, &c, &max);
     if(n == 2){
-	if(c == '/') {
+	if(ISPATHSEP(c)) {
 	    if(min < 0){
 		max = -min;
 		min = 0;
@@ -292,6 +289,12 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 	}
     }
     if(n){
+#ifdef _WIN32
+	q = strrchr(p, '\\');
+	if (q != NULL)
+	    p = q;
+	else
+#endif
 	p = strchr(p, '/');
 	if(p == NULL) {
 	    krb5_set_error_message(context, HEIM_ERR_LOG_PARSE,
@@ -301,26 +304,23 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 	p++;
     }
     if(strcmp(p, "STDERR") == 0){
-	ret = open_file(context, f, min, max, NULL, NULL, stderr, 1);
+	ret = open_file(context, f, min, max, NULL, NULL, stderr, 1, 0);
     }else if(strcmp(p, "CONSOLE") == 0){
-	ret = open_file(context, f, min, max, "/dev/console", "w", NULL, 0);
+	ret = open_file(context, f, min, max, "/dev/console", "w", NULL, 0, 0);
     }else if(strncmp(p, "FILE", 4) == 0 && (p[4] == ':' || p[4] == '=')){
 	char *fn;
 	FILE *file = NULL;
 	int keep_open = 0;
 	fn = strdup(p + 5);
-	if(fn == NULL) {
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (fn == NULL)
+	    return krb5_enomem(context);
 	if(p[4] == '='){
 	    int i = open(fn, O_WRONLY | O_CREAT |
 			 O_TRUNC | O_APPEND, 0666);
 	    if(i < 0) {
 		ret = errno;
 		krb5_set_error_message(context, ret,
-				       N_("open(%s) logile: %s", ""), fn,
+				       N_("open(%s) logfile: %s", ""), fn,
 				       strerror(ret));
 		free(fn);
 		return ret;
@@ -338,9 +338,9 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 	    }
 	    keep_open = 1;
 	}
-	ret = open_file(context, f, min, max, fn, "a", file, keep_open);
+	ret = open_file(context, f, min, max, fn, "a", file, keep_open, 1);
     }else if(strncmp(p, "DEVICE", 6) == 0 && (p[6] == ':' || p[6] == '=')){
-	ret = open_file(context, f, min, max, strdup(p + 7), "w", NULL, 0);
+	ret = open_file(context, f, min, max, strdup(p + 7), "w", NULL, 0, 1);
     }else if(strncmp(p, "SYSLOG", 6) == 0 && (p[6] == '\0' || p[6] == ':')){
 	char severity[128] = "";
 	char facility[128] = "";
@@ -413,7 +413,7 @@ krb5_vlog_msg(krb5_context context,
 	      int level,
 	      const char *fmt,
 	      va_list ap)
-     __attribute__((format (printf, 5, 0)))
+     __attribute__ ((__format__ (__printf__, 5, 0)))
 {
 
     char *msg = NULL;
@@ -451,7 +451,7 @@ krb5_vlog(krb5_context context,
 	  int level,
 	  const char *fmt,
 	  va_list ap)
-     __attribute__((format (printf, 4, 0)))
+     __attribute__ ((__format__ (__printf__, 4, 0)))
 {
     return krb5_vlog_msg(context, fac, NULL, level, fmt, ap);
 }
@@ -463,7 +463,7 @@ krb5_log_msg(krb5_context context,
 	     char **reply,
 	     const char *fmt,
 	     ...)
-     __attribute__((format (printf, 5, 6)))
+     __attribute__ ((__format__ (__printf__, 5, 6)))
 {
     va_list ap;
     krb5_error_code ret;
@@ -481,7 +481,7 @@ krb5_log(krb5_context context,
 	 int level,
 	 const char *fmt,
 	 ...)
-     __attribute__((format (printf, 4, 5)))
+     __attribute__ ((__format__ (__printf__, 4, 5)))
 {
     va_list ap;
     krb5_error_code ret;
@@ -497,7 +497,7 @@ _krb5_debug(krb5_context context,
 	    int level,
 	    const char *fmt,
 	    ...)
-    __attribute__((format (printf, 3, 4)))
+    __attribute__ ((__format__ (__printf__, 3, 4)))
 {
     va_list ap;
 
@@ -509,10 +509,28 @@ _krb5_debug(krb5_context context,
     va_end(ap);
 }
 
-krb5_boolean KRB5_LIB_FUNCTION
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 _krb5_have_debug(krb5_context context, int level)
 {
     if (context == NULL || context->debug_dest == NULL)
 	return 0 ;
     return 1;
 }
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_set_debug_dest(krb5_context context, const char *program,
+                    const char *log_spec)
+{
+    krb5_error_code ret;
+
+    if (context->debug_dest == NULL) {
+        ret = krb5_initlog(context, program, &context->debug_dest);
+        if (ret)
+            return ret;
+    }
+
+    ret = krb5_addlog_dest(context, context->debug_dest, log_spec);
+    if (ret)
+        return ret;
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mcache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mcache.c
index a3966a80d..59d221a04 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mcache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mcache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mcache.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mcache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -49,6 +49,7 @@ typedef struct krb5_mcache {
     struct krb5_mcache *next;
     time_t mtime;
     krb5_deltat kdc_offset;
+    HEIMDAL_MUTEX mutex;
 } krb5_mcache;
 
 static HEIMDAL_MUTEX mcc_mutex = HEIMDAL_MUTEX_INITIALIZER;
@@ -101,6 +102,7 @@ mcc_alloc(const char *name)
     m->mtime = time(NULL);
     m->kdc_offset = 0;
     m->next = mcc_head;
+    HEIMDAL_MUTEX_init(&(m->mutex));
     mcc_head = m;
     HEIMDAL_MUTEX_unlock(&mcc_mutex);
     return m;
@@ -118,10 +120,12 @@ mcc_resolve(krb5_context context, krb5_ccache *id, const char *res)
     HEIMDAL_MUTEX_unlock(&mcc_mutex);
 
     if (m != NULL) {
-	m->refcnt++;
-	(*id)->data.data = m;
-	(*id)->data.length = sizeof(*m);
-	return 0;
+    	HEIMDAL_MUTEX_lock(&(m->mutex));
+    	m->refcnt++;
+    	HEIMDAL_MUTEX_unlock(&(m->mutex));
+    	(*id)->data.data = m;
+    	(*id)->data.length = sizeof(*m);
+    	return 0;
     }
 
     m = mcc_alloc(res);
@@ -157,29 +161,73 @@ mcc_gen_new(krb5_context context, krb5_ccache *id)
     return 0;
 }
 
+static void KRB5_CALLCONV
+mcc_destroy_internal(krb5_context context,
+		     krb5_mcache *m)
+{
+    struct link *l;
+
+    if (m->primary_principal != NULL) {
+	krb5_free_principal (context, m->primary_principal);
+	m->primary_principal = NULL;
+    }
+    m->dead = 1;
+
+    l = m->creds;
+    while (l != NULL) {
+	struct link *old;
+
+	krb5_free_cred_contents (context, &l->cred);
+	old = l;
+	l = l->next;
+	free (old);
+    }
+
+    m->creds = NULL;
+    return;
+}
+
 static krb5_error_code KRB5_CALLCONV
 mcc_initialize(krb5_context context,
 	       krb5_ccache id,
 	       krb5_principal primary_principal)
 {
     krb5_mcache *m = MCACHE(id);
+    krb5_error_code ret = 0;
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    heim_assert(m->refcnt != 0, "resurection released mcache");
+    /*
+     * It's important to destroy any existing
+     * creds here, that matches the baheviour
+     * of all other backends and also the
+     * MEMORY: backend in MIT.
+     */
+    mcc_destroy_internal(context, m);
     m->dead = 0;
+    m->kdc_offset = 0;
     m->mtime = time(NULL);
-    return krb5_copy_principal (context,
-				primary_principal,
-				&m->primary_principal);
+    ret = krb5_copy_principal (context,
+			       primary_principal,
+			       &m->primary_principal);
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
+    return ret;
 }
 
 static int
 mcc_close_internal(krb5_mcache *m)
 {
-    if (--m->refcnt != 0)
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    heim_assert(m->refcnt != 0, "closed dead cache mcache");
+    if (--m->refcnt != 0) {
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
 	return 0;
-
+    }
     if (MISDEAD(m)) {
 	free (m->name);
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
 	return 1;
     }
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -187,8 +235,12 @@ static krb5_error_code KRB5_CALLCONV
 mcc_close(krb5_context context,
 	  krb5_ccache id)
 {
-    if (mcc_close_internal(MCACHE(id)))
+    krb5_mcache *m = MCACHE(id);
+
+    if (mcc_close_internal(MCACHE(id))) {
+	HEIMDAL_MUTEX_destroy(&(m->mutex));
 	krb5_data_free(&id->data);
+    }
     return 0;
 }
 
@@ -197,10 +249,13 @@ mcc_destroy(krb5_context context,
 	    krb5_ccache id)
 {
     krb5_mcache **n, *m = MCACHE(id);
-    struct link *l;
 
+    HEIMDAL_MUTEX_lock(&(m->mutex));
     if (m->refcnt == 0)
-	krb5_abortx(context, "mcc_destroy: refcnt already 0");
+    {
+    	HEIMDAL_MUTEX_unlock(&(m->mutex));
+    	krb5_abortx(context, "mcc_destroy: refcnt already 0");
+    }
 
     if (!MISDEAD(m)) {
 	/* if this is an active mcache, remove it from the linked
@@ -213,23 +268,9 @@ mcc_destroy(krb5_context context,
 	    }
 	}
 	HEIMDAL_MUTEX_unlock(&mcc_mutex);
-	if (m->primary_principal != NULL) {
-	    krb5_free_principal (context, m->primary_principal);
-	    m->primary_principal = NULL;
-	}
-	m->dead = 1;
-
-	l = m->creds;
-	while (l != NULL) {
-	    struct link *old;
-
-	    krb5_free_cred_contents (context, &l->cred);
-	    old = l;
-	    l = l->next;
-	    free (old);
-	}
-	m->creds = NULL;
+	mcc_destroy_internal(context, m);
     }
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -242,25 +283,32 @@ mcc_store_cred(krb5_context context,
     krb5_error_code ret;
     struct link *l;
 
+    HEIMDAL_MUTEX_lock(&(m->mutex));
     if (MISDEAD(m))
-	return ENOENT;
+    {
+    	HEIMDAL_MUTEX_unlock(&(m->mutex));
+    	return ENOENT;
+    }
 
     l = malloc (sizeof(*l));
     if (l == NULL) {
-	krb5_set_error_message(context, KRB5_CC_NOMEM,
-			       N_("malloc: out of memory", ""));
-	return KRB5_CC_NOMEM;
+    	krb5_set_error_message(context, KRB5_CC_NOMEM,
+    			N_("malloc: out of memory", ""));
+    	HEIMDAL_MUTEX_unlock(&(m->mutex));
+    	return KRB5_CC_NOMEM;
     }
     l->next = m->creds;
     m->creds = l;
     memset (&l->cred, 0, sizeof(l->cred));
     ret = krb5_copy_creds_contents (context, creds, &l->cred);
     if (ret) {
-	m->creds = l->next;
-	free (l);
-	return ret;
+    	m->creds = l->next;
+    	free (l);
+    	HEIMDAL_MUTEX_unlock(&(m->mutex));
+    	return ret;
     }
     m->mtime = time(NULL);
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -270,25 +318,35 @@ mcc_get_principal(krb5_context context,
 		  krb5_principal *principal)
 {
     krb5_mcache *m = MCACHE(id);
+    krb5_error_code ret = 0;
 
-    if (MISDEAD(m) || m->primary_principal == NULL)
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    if (MISDEAD(m) || m->primary_principal == NULL) {
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
 	return ENOENT;
-    return krb5_copy_principal (context,
-				m->primary_principal,
-				principal);
+    }
+    ret = krb5_copy_principal (context,
+			       m->primary_principal,
+			       principal);
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
+    return ret;
 }
 
 static krb5_error_code KRB5_CALLCONV
 mcc_get_first (krb5_context context,
-	       krb5_ccache id,
-	       krb5_cc_cursor *cursor)
+		krb5_ccache id,
+		krb5_cc_cursor *cursor)
 {
     krb5_mcache *m = MCACHE(id);
 
-    if (MISDEAD(m))
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    if (MISDEAD(m)) {
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
 	return ENOENT;
-
+    }
     *cursor = m->creds;
+
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -301,8 +359,12 @@ mcc_get_next (krb5_context context,
     krb5_mcache *m = MCACHE(id);
     struct link *l;
 
-    if (MISDEAD(m))
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    if (MISDEAD(m)) {
+	HEIMDAL_MUTEX_unlock(&(m->mutex));
 	return ENOENT;
+    }
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
 
     l = *cursor;
     if (l != NULL) {
@@ -330,6 +392,9 @@ mcc_remove_cred(krb5_context context,
 {
     krb5_mcache *m = MCACHE(id);
     struct link **q, *p;
+
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+
     for(q = &m->creds, p = *q; p; p = *q) {
 	if(krb5_compare_creds(context, which, mcreds, &p->cred)) {
 	    *q = p->next;
@@ -339,6 +404,7 @@ mcc_remove_cred(krb5_context context,
 	} else
 	    q = &p->next;
     }
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -360,16 +426,16 @@ mcc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
     struct mcache_iter *iter;
 
     iter = calloc(1, sizeof(*iter));
-    if (iter == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (iter == NULL)
+	return krb5_enomem(context);
 
     HEIMDAL_MUTEX_lock(&mcc_mutex);
     iter->cache = mcc_head;
-    if (iter->cache)
+    if (iter->cache) {
+	HEIMDAL_MUTEX_lock(&(iter->cache->mutex));
 	iter->cache->refcnt++;
+	HEIMDAL_MUTEX_unlock(&(iter->cache->mutex));
+    }
     HEIMDAL_MUTEX_unlock(&mcc_mutex);
 
     *cursor = iter;
@@ -389,7 +455,12 @@ mcc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
     HEIMDAL_MUTEX_lock(&mcc_mutex);
     m = iter->cache;
     if (m->next)
-	m->next->refcnt++;
+    {
+    	HEIMDAL_MUTEX_lock(&(m->next->mutex));
+    	m->next->refcnt++;
+    	HEIMDAL_MUTEX_unlock(&(m->next->mutex));
+    }
+
     iter->cache = m->next;
     HEIMDAL_MUTEX_unlock(&mcc_mutex);
 
@@ -409,7 +480,7 @@ mcc_end_cache_get(krb5_context context, krb5_cc_cursor cursor)
     struct mcache_iter *iter = cursor;
 
     if (iter->cache)
-	mcc_close_internal(iter->cache);
+    	mcc_close_internal(iter->cache);
     iter->cache = NULL;
     free(iter);
     return 0;
@@ -433,6 +504,8 @@ mcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
 	}
     }
 
+    HEIMDAL_MUTEX_lock(&(mfrom->mutex));
+    HEIMDAL_MUTEX_lock(&(mto->mutex));
     /* swap creds */
     creds = mto->creds;
     mto->creds = mfrom->creds;
@@ -444,6 +517,8 @@ mcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
 
     mto->mtime = mfrom->mtime = time(NULL);
 
+    HEIMDAL_MUTEX_unlock(&(mfrom->mutex));
+    HEIMDAL_MUTEX_unlock(&(mto->mutex));
     HEIMDAL_MUTEX_unlock(&mcc_mutex);
     mcc_destroy(context, from);
 
@@ -454,18 +529,18 @@ static krb5_error_code KRB5_CALLCONV
 mcc_default_name(krb5_context context, char **str)
 {
     *str = strdup("MEMORY:");
-    if (*str == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*str == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
 static krb5_error_code KRB5_CALLCONV
 mcc_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
 {
-    *mtime = MCACHE(id)->mtime;
+    krb5_mcache *m = MCACHE(id);
+    HEIMDAL_MUTEX_lock(&(m->mutex));
+    *mtime = m->mtime;
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -473,7 +548,9 @@ static krb5_error_code KRB5_CALLCONV
 mcc_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat kdc_offset)
 {
     krb5_mcache *m = MCACHE(id);
+    HEIMDAL_MUTEX_lock(&(m->mutex));
     m->kdc_offset = kdc_offset;
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
@@ -481,7 +558,9 @@ static krb5_error_code KRB5_CALLCONV
 mcc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset)
 {
     krb5_mcache *m = MCACHE(id);
+    HEIMDAL_MUTEX_lock(&(m->mutex));
     *kdc_offset = m->kdc_offset;
+    HEIMDAL_MUTEX_unlock(&(m->mutex));
     return 0;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/misc.c b/crypto/external/bsd/heimdal/dist/lib/krb5/misc.c
index 550a8a680..009c7fc3e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/misc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/misc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: misc.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: misc.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -50,55 +50,38 @@ _krb5_s4u2self_to_checksumdata(krb5_context context,
     size_t i;
 
     sp = krb5_storage_emem();
-    if (sp == NULL) {
-	krb5_clear_error_message(context);
-	return ENOMEM;
-    }
+    if (sp == NULL)
+	return krb5_enomem(context);
     krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE);
     ret = krb5_store_int32(sp, self->name.name_type);
-    if (ret)
-	goto out;
+    if (ret) {
+	krb5_clear_error_message(context);
+	return ret;
+    }
     for (i = 0; i < self->name.name_string.len; i++) {
 	size = strlen(self->name.name_string.val[i]);
 	ssize = krb5_storage_write(sp, self->name.name_string.val[i], size);
-	if (ssize != (krb5_ssize_t)size) {
-	    ret = ENOMEM;
-	    goto out;
-	}
+	if (ssize != (krb5_ssize_t)size)
+	    return krb5_enomem(context);
     }
     size = strlen(self->realm);
     ssize = krb5_storage_write(sp, self->realm, size);
-    if (ssize != (krb5_ssize_t)size) {
-	ret = ENOMEM;
-	goto out;
-    }
+    if (ssize != (krb5_ssize_t)size)
+	return krb5_enomem(context);
     size = strlen(self->auth);
     ssize = krb5_storage_write(sp, self->auth, size);
-    if (ssize != (krb5_ssize_t)size) {
-	ret = ENOMEM;
-	goto out;
-    }
+    if (ssize != (krb5_ssize_t)size)
+	return krb5_enomem(context);
 
     ret = krb5_storage_to_data(sp, data);
     krb5_storage_free(sp);
     return ret;
-
-out:
-    krb5_clear_error_message(context);
-    return ret;
 }
 
-krb5_error_code
-krb5_enomem(krb5_context context)
-{
-    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-    return ENOMEM;
-}
-
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_debug_backtrace(krb5_context context)
 {
-#if defined(HAVE_BACKTRACE) && !defined(HEIMDAL_SMALLER)
+#if defined(HAVE_BACKTRACE) && defined(HAVE_BACKTRACE_SYMBOLS) && !defined(HEIMDAL_SMALLER)
     void *stack[128];
     char **strs = NULL;
     int i, frames = backtrace(stack, sizeof(stack) / sizeof(stack[0]));
@@ -112,7 +95,7 @@ _krb5_debug_backtrace(krb5_context context)
 #endif
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_einval(krb5_context context, const char *func, unsigned long argn)
 {
 #ifndef HEIMDAL_SMALLER
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mit_glue.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mit_glue.c
index b1368adb3..0500dbe20 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mit_glue.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mit_glue.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mit_glue.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mit_glue.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -98,7 +98,7 @@ krb5_c_get_checksum(krb5_context context, const krb5_checksum *cksum,
     if (data) {
 	*data = malloc(sizeof(**data));
 	if (*data == NULL)
-	    return ENOMEM;
+	    return krb5_enomem(context);
 
 	ret = der_copy_octet_string(&cksum->checksum, *data);
 	if (ret) {
@@ -169,7 +169,7 @@ krb5_copy_checksum (krb5_context context,
 {
     *new = malloc(sizeof(**new));
     if (*new == NULL)
-	return ENOMEM;
+	return krb5_enomem(context);
     return copy_Checksum(old, *new);
 }
 
@@ -380,7 +380,8 @@ krb5_c_prf(krb5_context context,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_c_random_make_octets(krb5_context context, krb5_data * data)
 {
-    return krb5_generate_random_keyblock(context, data->length, data->data);
+    krb5_generate_random_block(data->data, data->length);
+    return 0;
 }
 
 /**
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_error.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_error.c
index 6d99f22a0..5e99ee53d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_error.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mk_error.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -36,15 +36,16 @@
 #include "krb5_locl.h"
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_mk_error(krb5_context context,
-	      krb5_error_code error_code,
-	      const char *e_text,
-	      const krb5_data *e_data,
-	      const krb5_principal client,
-	      const krb5_principal server,
-	      time_t *client_time,
-	      int *client_usec,
-	      krb5_data *reply)
+krb5_mk_error_ext(krb5_context context,
+		  krb5_error_code error_code,
+		  const char *e_text,
+		  const krb5_data *e_data,
+		  const krb5_principal server,
+		  const PrincipalName *client_name,
+		  const Realm *client_realm,
+		  time_t *client_time,
+		  int *client_usec,
+		  krb5_data *reply)
 {
     const char *e_text2 = NULL;
     KRB_ERROR msg;
@@ -80,10 +81,8 @@ krb5_mk_error(krb5_context context,
 	static char unspec[] = "<unspecified realm>";
 	msg.realm = unspec;
     }
-    if(client){
-	msg.crealm = &client->realm;
-	msg.cname = &client->name;
-    }
+    msg.crealm = rk_UNCONST(client_realm);
+    msg.cname = rk_UNCONST(client_name);
 
     ASN1_MALLOC_ENCODE(KRB_ERROR, reply->data, reply->length, &msg, &len, ret);
     if (e_text2)
@@ -94,3 +93,27 @@ krb5_mk_error(krb5_context context,
 	krb5_abortx(context, "internal error in ASN.1 encoder");
     return 0;
 }
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_mk_error(krb5_context context,
+	      krb5_error_code error_code,
+	      const char *e_text,
+	      const krb5_data *e_data,
+	      const krb5_principal client,
+	      const krb5_principal server,
+	      time_t *client_time,
+	      int *client_usec,
+	      krb5_data *reply)
+{
+    const PrincipalName *client_name = NULL;
+    const Realm *client_realm = NULL;
+
+    if (client) {
+	client_realm = &client->realm;
+	client_name = &client->name;
+    }
+
+    return krb5_mk_error_ext(context, error_code, e_text, e_data,
+			     server, client_name, client_realm,
+			     client_time, client_usec, reply);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_priv.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_priv.c
index 413b226f8..bd02c07d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_priv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_priv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_priv.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mk_priv.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -137,10 +137,8 @@ krb5_mk_priv(krb5_context context,
 
     ret = krb5_data_copy(outbuf, buf + buf_size - len, len);
     if (ret) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	free(buf);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     free (buf);
     if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE)
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_rep.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_rep.c
index 4719d811d..b54a26bbb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_rep.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_rep.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_rep.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mk_rep.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -69,9 +69,7 @@ krb5_mk_rep(krb5_context context,
 				 &body.subkey);
 	if (ret) {
 	    free_EncAPRepPart(&body);
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
     } else
 	body.subkey = NULL;
@@ -82,9 +80,8 @@ krb5_mk_rep(krb5_context context,
 				      &auth_context->local_seqnumber);
 	ALLOC(body.seq_number, 1);
 	if (body.seq_number == NULL) {
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 	    free_EncAPRepPart(&body);
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	*(body.seq_number) = auth_context->local_seqnumber;
     } else
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req.c
index 0e8175586..d59fd7c21 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_req.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: mk_req.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req_ext.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req_ext.c
index a05bb28ff..b6133a2bf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req_ext.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_req_ext.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_req_ext.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: mk_req_ext.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #include "krb5_locl.h"
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_mk_req_internal(krb5_context context,
 		      krb5_auth_context *auth_context,
 		      const krb5_flags ap_req_options,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_safe.c b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_safe.c
index 256b11331..50b085992 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/mk_safe.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/mk_safe.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mk_safe.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: mk_safe.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold-test.c
index ae56afccd..cde548b08 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: n-fold-test.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: n-fold-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -89,7 +89,7 @@ static struct testcase {
       0x08, 0xa5, 0x08, 0x41, 0x22, 0x9a, 0xd7, 0x98, 0xfa, 0xb9, 0x54,
       0x0c, 0x1b}
     },
-    {NULL, 0}
+    {NULL, 0, {0}}
 };
 
 int
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold.c b/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold.c
index 59c266d85..d4e84756f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/n-fold.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: n-fold.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: n-fold.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -34,68 +34,79 @@
 
 #include "krb5_locl.h"
 
-static krb5_error_code
-rr13(unsigned char *buf, size_t len)
+static void
+rr13(uint8_t *dst1, uint8_t *dst2, uint8_t *src, size_t len)
 {
-    unsigned char *tmp;
     int bytes = (len + 7) / 8;
     int i;
-    if(len == 0)
-	return 0;
-    {
-	const int bits = 13 % len;
-	const int lbit = len % 8;
+    const int bits = 13 % len;
 
-	tmp = malloc(bytes);
-	if (tmp == NULL)
-	    return ENOMEM;
-	memcpy(tmp, buf, bytes);
-	if(lbit) {
-	    /* pad final byte with inital bits */
-	    tmp[bytes - 1] &= 0xff << (8 - lbit);
-	    for(i = lbit; i < 8; i += len)
-		tmp[bytes - 1] |= buf[0] >> i;
-	}
-	for(i = 0; i < bytes; i++) {
-	    int bb;
-	    int b1, s1, b2, s2;
-	    /* calculate first bit position of this byte */
-	    bb = 8 * i - bits;
-	    while(bb < 0)
-		bb += len;
-	    /* byte offset and shift count */
-	    b1 = bb / 8;
-	    s1 = bb % 8;
+    for (i = 0; i < bytes; i++) {
+	int bb;
+	int b1, s1, b2, s2;
+	/* calculate first bit position of this byte */
+	bb = 8 * i - bits;
+	while(bb < 0)
+	    bb += len;
+	/* byte offset and shift count */
+	b1 = bb / 8;
+	s1 = bb % 8;
 
-	    if(bb + 8 > bytes * 8)
-		/* watch for wraparound */
-		s2 = (len + 8 - s1) % 8;
-	    else
-		s2 = 8 - s1;
-	    b2 = (b1 + 1) % bytes;
-	    buf[i] = (tmp[b1] << s1) | (tmp[b2] >> s2);
-	}
-	free(tmp);
+	if (bb + 8 > bytes * 8)
+	    /* watch for wraparound */
+	    s2 = (len + 8 - s1) % 8;
+	else
+	    s2 = 8 - s1;
+	b2 = (b1 + 1) % bytes;
+	dst1[i] = (src[b1] << s1) | (src[b2] >> s2);
+	dst2[i] = dst1[i];
     }
-    return 0;
+
+    return;
 }
 
-/* Add `b' to `a', both being one's complement numbers. */
+/*
+ * Add `b' to `a', both being one's complement numbers.
+ * This function assumes that inputs *a, *b are aligned
+ * to 4 bytes.
+ */
 static void
-add1(unsigned char *a, unsigned char *b, size_t len)
+add1(uint8_t *a, uint8_t *b, size_t len)
 {
     int i;
     int carry = 0;
-    for(i = len - 1; i >= 0; i--){
-	int x = a[i] + b[i] + carry;
+    uint32_t x;
+    uint32_t left, right;
+
+    for (i = len - 1; (i+1) % 4; i--) {
+	x = a[i] + b[i] + carry;
 	carry = x > 0xff;
 	a[i] = x & 0xff;
     }
-    for(i = len - 1; carry && i >= 0; i--){
-	int x = a[i] + carry;
+
+    for (i = len / 4 - 1; i >= 0; i--) {
+	left = ntohl(((uint32_t *)a)[i]);
+	right = ntohl(((uint32_t *)b)[i]);
+	x = left + right + carry;
+	carry = x < left || x < right;
+	((uint32_t *)a)[i]  = x;
+    }
+
+    for (i = len - 1; (i+1) % 4; i--) {
+	x = a[i] + carry;
 	carry = x > 0xff;
 	a[i] = x & 0xff;
     }
+
+    for (i = len / 4 - 1; carry && i >= 0; i--) {
+        left = ((uint32_t *)a)[i];
+        x = left + carry;
+        carry = x < left;
+        ((uint32_t *)a)[i] = x;
+    }
+
+    for (i = len / 4 - 1; i >=0; i--)
+        ((uint32_t *)a)[i] = htonl(((uint32_t *)a)[i]);
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -103,25 +114,25 @@ _krb5_n_fold(const void *str, size_t len, void *key, size_t size)
 {
     /* if len < size we need at most N * len bytes, ie < 2 * size;
        if len > size we need at most 2 * len */
-    krb5_error_code ret = 0;
     size_t maxlen = 2 * max(size, len);
     size_t l = 0;
-    unsigned char *tmp = malloc(maxlen);
-    unsigned char *buf = malloc(len);
+    uint8_t *tmp;
+    uint8_t *tmpbuf;
+    uint8_t *buf1;
+    uint8_t *buf2;
 
-    if (tmp == NULL || buf == NULL) {
-        ret = ENOMEM;
-	goto out;
-    }
+    tmp = malloc(maxlen + 2 * len);
+    if (tmp == NULL)
+        return ENOMEM;
+
+    buf1 = tmp + maxlen;
+    buf2 = tmp + maxlen + len;
 
-    memcpy(buf, str, len);
     memset(key, 0, size);
+    memcpy(buf1, str, len);
+    memcpy(tmp, buf1, len);
     do {
-	memcpy(tmp + l, buf, len);
 	l += len;
-	ret = rr13(buf, len * 8);
-	if (ret)
-	    goto out;
 	while(l >= size) {
 	    add1(key, tmp, size);
 	    l -= size;
@@ -129,15 +140,13 @@ _krb5_n_fold(const void *str, size_t len, void *key, size_t size)
 		break;
 	    memmove(tmp, tmp + size, l);
 	}
+	rr13(tmp + l, buf2, buf1, len * 8);
+	tmpbuf = buf1;
+	buf1 = buf2;
+	buf2 = tmpbuf;
     } while(l != 0);
-out:
-    if (buf) {
-        memset(buf, 0, len);
-	free(buf);
-    }
-    if (tmp) {
-        memset(tmp, 0, maxlen);
-	free(tmp);
-    }
-    return ret;
+
+    memset(tmp, 0, maxlen + 2 * len);
+    free(tmp);
+    return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/net_read.c b/crypto/external/bsd/heimdal/dist/lib/krb5/net_read.c
index 56d21cd86..15d3f4b00 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/net_read.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/net_read.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: net_read.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: net_read.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 2002 Kungliga Tekniska Högskolan
@@ -35,6 +35,15 @@
 
 #include "krb5_locl.h"
 
+/**
+ * Read \a len bytes from socket \a p_fd into buffer \a buf.
+ * Block until \a len bytes are read or until an error.
+ *
+ * @return If successful, the number of bytes read: \a len.
+ *         On end-of-file, 0.
+ *         On error, less than 0 (if single-threaded, the error can be found
+ *         in the errno global variable).
+ */
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
 krb5_net_read (krb5_context context,
 	       void *p_fd,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/net_write.c b/crypto/external/bsd/heimdal/dist/lib/krb5/net_write.c
index 76aab3e3b..ecb4ec3b8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/net_write.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/net_write.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: net_write.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: net_write.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/pac.c b/crypto/external/bsd/heimdal/dist/lib/krb5/pac.c
index 0f0ef3c04..17c8cb9be 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/pac.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/pac.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pac.c,v 1.2 2014/05/12 15:21:46 christos Exp $	*/
+/*	$NetBSD: pac.c,v 1.3 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -407,7 +407,7 @@ krb5_pac_get_types(krb5_context context,
 {
     size_t i;
 
-    *types = calloc(p->pac->numbuffers, sizeof(*types));
+    *types = calloc(p->pac->numbuffers, sizeof(**types));
     if (*types == NULL) {
 	*len = 0;
 	return krb5_enomem(context);
@@ -551,6 +551,8 @@ create_checksum(krb5_context context,
     if (cksumtype == (uint32_t)CKSUMTYPE_HMAC_MD5) {
 	ret = HMAC_MD5_any_checksum(context, key, data, datalen,
 				    KRB5_KU_OTHER_CKSUM, &cksum);
+        if (ret)
+            return ret;
     } else {
 	ret = krb5_crypto_init(context, key, 0, &crypto);
 	if (ret)
@@ -597,11 +599,12 @@ verify_logonname(krb5_context context,
 		 krb5_const_principal principal)
 {
     krb5_error_code ret;
-    krb5_principal p2;
     uint32_t time1, time2;
     krb5_storage *sp;
     uint16_t len;
-    char *s;
+    char *s = NULL;
+    char *principal_string = NULL;
+    char *logon_string = NULL;
 
     sp = krb5_storage_from_readonly_mem((const char *)data->data + logon_name->offset_lo,
 					logon_name->buffersize);
@@ -617,7 +620,13 @@ verify_logonname(krb5_context context,
 	uint64_t t1, t2;
 	t1 = unix2nttime(authtime);
 	t2 = ((uint64_t)time2 << 32) | time1;
-	if (t1 != t2) {
+	/*
+	 * When neither the ticket nor the PAC set an explicit authtime,
+	 * both times are zero, but relative to different time scales.
+	 * So we must compare "not set" values without converting to a
+	 * common time reference.
+         */
+	if (t1 != t2 && (t2 != 0 && authtime != 0)) {
 	    krb5_storage_free(sp);
 	    krb5_set_error_message(context, EINVAL, "PAC timestamp mismatch");
 	    return EINVAL;
@@ -666,29 +675,36 @@ verify_logonname(krb5_context context,
 	    return ret;
 	}
 	u8len += 1; /* Add space for NUL */
-	s = malloc(u8len);
-	if (s == NULL) {
+	logon_string = malloc(u8len);
+	if (logon_string == NULL) {
 	    free(ucs2);
 	    return krb5_enomem(context);
 	}
-	ret = wind_ucs2utf8(ucs2, ucs2len, s, &u8len);
+	ret = wind_ucs2utf8(ucs2, ucs2len, logon_string, &u8len);
 	free(ucs2);
 	if (ret) {
-	    free(s);
+	    free(logon_string);
 	    krb5_set_error_message(context, ret, "Failed to convert to UTF-8");
 	    return ret;
 	}
     }
-    ret = krb5_parse_name_flags(context, s, KRB5_PRINCIPAL_PARSE_NO_REALM, &p2);
-    free(s);
-    if (ret)
+    ret = krb5_unparse_name_flags(context, principal,
+				  KRB5_PRINCIPAL_UNPARSE_NO_REALM |
+				  KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+				  &principal_string);
+    if (ret) {
+	free(logon_string);
 	return ret;
-
-    if (krb5_principal_compare_any_realm(context, principal, p2) != TRUE) {
-	ret = EINVAL;
-	krb5_set_error_message(context, ret, "PAC logon name mismatch");
     }
-    krb5_free_principal(context, p2);
+
+    ret = strcmp(logon_string, principal_string);
+    if (ret != 0) {
+	ret = EINVAL;
+	krb5_set_error_message(context, ret, "PAC logon name [%s] mismatch principal name [%s]",
+			       logon_string, principal_string);
+    }
+    free(logon_string);
+    free(principal_string);
     return ret;
 out:
     return ret;
@@ -724,7 +740,9 @@ build_logon_name(krb5_context context,
     CHECK(ret, krb5_store_uint32(sp, t >> 32), out);
 
     ret = krb5_unparse_name_flags(context, principal,
-				  KRB5_PRINCIPAL_UNPARSE_NO_REALM, &s);
+				  KRB5_PRINCIPAL_UNPARSE_NO_REALM |
+				  KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+				  &s);
     if (ret)
 	goto out;
 
@@ -735,8 +753,8 @@ build_logon_name(krb5_context context,
 
 	ret = wind_utf8ucs2_length(s, &ucs2_len);
 	if (ret) {
+	    krb5_set_error_message(context, ret, "Principal %s is not valid UTF-8", s);
 	    free(s);
-	    krb5_set_error_message(context, ret, "Failed to count length of UTF-8 string");
 	    return ret;
 	}
 
@@ -747,12 +765,13 @@ build_logon_name(krb5_context context,
 	}
 
 	ret = wind_utf8ucs2(s, ucs2, &ucs2_len);
-	free(s);
 	if (ret) {
 	    free(ucs2);
-	    krb5_set_error_message(context, ret, "Failed to convert string to UCS-2");
+	    krb5_set_error_message(context, ret, "Principal %s is not valid UTF-8", s);
+	    free(s);
 	    return ret;
-	}
+	} else 
+	    free(s);
 
 	s2_len = (ucs2_len + 1) * 2;
 	s2 = malloc(s2_len);
@@ -851,15 +870,14 @@ krb5_pac_verify(krb5_context context,
     {
 	krb5_data *copy;
 
+	if (pac->server_checksum->buffersize < 4 ||
+            pac->privsvr_checksum->buffersize < 4)
+	    return EINVAL;
+
 	ret = krb5_copy_data(context, &pac->data, &copy);
 	if (ret)
 	    return ret;
 
-	if (pac->server_checksum->buffersize < 4)
-	    return EINVAL;
-	if (pac->privsvr_checksum->buffersize < 4)
-	    return EINVAL;
-
 	memset((char *)copy->data + pac->server_checksum->offset_lo + 4,
 	       0,
 	       pac->server_checksum->buffersize - 4);
@@ -950,7 +968,7 @@ pac_checksum(krb5_context context,
     return 0;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pac_sign(krb5_context context,
 	       krb5_pac p,
 	       time_t authtime,
@@ -971,6 +989,40 @@ _krb5_pac_sign(krb5_context context,
 
     krb5_data_zero(&logon);
 
+    for (i = 0; i < p->pac->numbuffers; i++) {
+	if (p->pac->buffers[i].type == PAC_SERVER_CHECKSUM) {
+	    if (p->server_checksum == NULL) {
+		p->server_checksum = &p->pac->buffers[i];
+	    }
+	    if (p->server_checksum != &p->pac->buffers[i]) {
+		ret = EINVAL;
+		krb5_set_error_message(context, ret,
+				       N_("PAC have two server checksums", ""));
+		goto out;
+	    }
+	} else if (p->pac->buffers[i].type == PAC_PRIVSVR_CHECKSUM) {
+	    if (p->privsvr_checksum == NULL) {
+		p->privsvr_checksum = &p->pac->buffers[i];
+	    }
+	    if (p->privsvr_checksum != &p->pac->buffers[i]) {
+		ret = EINVAL;
+		krb5_set_error_message(context, ret,
+				       N_("PAC have two KDC checksums", ""));
+		goto out;
+	    }
+	} else if (p->pac->buffers[i].type == PAC_LOGON_NAME) {
+	    if (p->logon_name == NULL) {
+		p->logon_name = &p->pac->buffers[i];
+	    }
+	    if (p->logon_name != &p->pac->buffers[i]) {
+		ret = EINVAL;
+		krb5_set_error_message(context, ret,
+				       N_("PAC have two logon names", ""));
+		goto out;
+	    }
+	}
+    }
+
     if (p->logon_name == NULL)
 	num++;
     if (p->server_checksum == NULL)
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/padata.c b/crypto/external/bsd/heimdal/dist/lib/krb5/padata.c
index b953c9584..c0452763f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/padata.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/padata.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: padata.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: padata.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
@@ -51,11 +51,8 @@ krb5_padata_add(krb5_context context, METHOD_DATA *md,
     PA_DATA *pa;
 
     pa = realloc (md->val, (md->len + 1) * sizeof(*md->val));
-    if (pa == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (pa == NULL)
+	return krb5_enomem(context);
     md->val = pa;
 
     pa[md->len].padata_type = type;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/parse-name-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/parse-name-test.c
index f0ce40dc1..ec506e290 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/parse-name-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/parse-name-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse-name-test.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: parse-name-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/pcache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/pcache.c
index 524fa3bc8..1634afbd8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/pcache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/pcache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pcache.c,v 1.1.1.1 2011/04/13 18:15:36 elric Exp $	*/
+/*	$NetBSD: pcache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2010, Secure Endpoints Inc.
@@ -38,31 +38,35 @@
 #endif
 #include <assert.h>
 
-krb5_error_code
+/*
+ * cc_plugin_register_to_context is executed once per krb5_init_context().
+ * Its job is to register the plugin's krb5_cc_ops structure with the
+ * krb5_context.
+ */
+
+static krb5_error_code KRB5_LIB_CALL
+cc_plugin_register_to_context(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    krb5_cc_ops *ccops = (krb5_cc_ops *)plugctx;
+    krb5_error_code ret;
+
+    if (ccops == NULL || ccops->version < KRB5_CC_OPS_VERSION)
+       return KRB5_PLUGIN_NO_HANDLE;
+
+    ret = krb5_cc_register(context, ccops, TRUE);
+    if (ret != 0)
+       *((krb5_error_code *)userctx) = ret;
+
+    return KRB5_PLUGIN_NO_HANDLE;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_load_ccache_plugins(krb5_context context)
 {
-    struct krb5_plugin * plist = NULL;
-    struct krb5_plugin *p;
-    krb5_error_code code;
+    krb5_error_code userctx = 0;
 
-    code = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, KRB5_PLUGIN_CCACHE,
-                             &plist);
-    if (code)
-        return code;
+    (void)_krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_CCACHE,
+			     0, 0, &userctx, cc_plugin_register_to_context);
 
-    for (p = plist; p != NULL; p = _krb5_plugin_get_next(p)) {
-        krb5_cc_ops * ccops;
-        krb5_error_code c_load;
-
-        ccops = _krb5_plugin_get_symbol(p);
-        if (ccops != NULL && ccops->version == KRB5_CC_OPS_VERSION) {
-            c_load = krb5_cc_register(context, ccops, TRUE);
-            if (c_load != 0)
-                code = c_load;
-        }
-    }
-
-    _krb5_plugin_free(plist);
-
-    return code;
+    return userctx;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit-ec.c b/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit-ec.c
new file mode 100644
index 000000000..168059f9f
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit-ec.c
@@ -0,0 +1,244 @@
+/*	$NetBSD: pkinit-ec.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2016 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+#include <krb5/roken.h>
+
+#ifdef PKINIT
+
+/*
+ * As with the other *-ec.c files in Heimdal, this is a bit of a hack.
+ *
+ * The idea is to use OpenSSL for EC because hcrypto doesn't have the
+ * required functionality at this time.  To do this we segregate
+ * EC-using code into separate source files and then we arrange for them
+ * to get the OpenSSL headers and not the conflicting hcrypto ones.
+ *
+ * Because of auto-generated *-private.h headers, we end up needing to
+ * make sure various types are defined before we include them, thus the
+ * strange header include order here.
+ */
+
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/evp.h>
+#include <openssl/bn.h>
+#define HEIM_NO_CRYPTO_HDRS
+#else
+#include <hcrypto/des.h>
+#endif
+
+/*
+ * NO_HCRYPTO_POLLUTION -> don't refer to hcrypto type/function names
+ * that we don't need in this file and which would clash with OpenSSL's
+ * in ways that are difficult to address in cleaner ways.
+ *
+ * In the medium- to long-term what we should do is move all PK in
+ * Heimdal to the newer EVP interfaces for PK and then nothing outside
+ * lib/hcrypto should ever have to include OpenSSL headers, and -more
+ * specifically- the only thing that should ever have to include OpenSSL
+ * headers is the OpenSSL backend to hcrypto.
+ */
+#define NO_HCRYPTO_POLLUTION
+
+#include "krb5_locl.h"
+#include <krb5/cms_asn1.h>
+#include <krb5/pkcs8_asn1.h>
+#include <krb5/pkcs9_asn1.h>
+#include <krb5/pkcs12_asn1.h>
+#include <krb5/pkinit_asn1.h>
+#include <krb5/asn1_err.h>
+
+#include <krb5/der.h>
+
+krb5_error_code
+_krb5_build_authpack_subjectPK_EC(krb5_context context,
+                                  krb5_pk_init_ctx ctx,
+                                  AuthPack *a)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    krb5_error_code ret;
+    ECParameters ecp;
+    unsigned char *p;
+    size_t size;
+    int xlen;
+
+    /* copy in public key, XXX find the best curve that the server support or use the clients curve if possible */
+
+    ecp.element = choice_ECParameters_namedCurve;
+    ret = der_copy_oid(&asn1_oid_id_ec_group_secp256r1,
+                       &ecp.u.namedCurve);
+    if (ret)
+        return ret;
+
+    ALLOC(a->clientPublicValue->algorithm.parameters, 1);
+    if (a->clientPublicValue->algorithm.parameters == NULL) {
+        free_ECParameters(&ecp);
+        return krb5_enomem(context);
+    }
+    ASN1_MALLOC_ENCODE(ECParameters, p, xlen, &ecp, &size, ret);
+    free_ECParameters(&ecp);
+    if (ret)
+        return ret;
+    if ((int)size != xlen)
+        krb5_abortx(context, "asn1 internal error");
+
+    a->clientPublicValue->algorithm.parameters->data = p;
+    a->clientPublicValue->algorithm.parameters->length = size;
+
+    /* copy in public key */
+
+    ret = der_copy_oid(&asn1_oid_id_ecPublicKey,
+                       &a->clientPublicValue->algorithm.algorithm);
+    if (ret)
+        return ret;
+
+    ctx->u.eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+    if (ctx->u.eckey == NULL)
+        return krb5_enomem(context);
+
+    ret = EC_KEY_generate_key(ctx->u.eckey);
+    if (ret != 1)
+        return EINVAL;
+
+    xlen = i2o_ECPublicKey(ctx->u.eckey, NULL);
+    if (xlen <= 0)
+        return EINVAL;
+
+    p = malloc(xlen);
+    if (p == NULL)
+        return krb5_enomem(context);
+
+    a->clientPublicValue->subjectPublicKey.data = p;
+
+    xlen = i2o_ECPublicKey(ctx->u.eckey, &p);
+    if (xlen <= 0) {
+        a->clientPublicValue->subjectPublicKey.data = NULL;
+        free(p);
+        return EINVAL;
+    }
+
+    a->clientPublicValue->subjectPublicKey.length = xlen * 8;
+
+    return 0;
+
+    /* XXX verify that this is right with RFC3279 */
+#else
+    krb5_set_error_message(context, ENOTSUP,
+                           N_("PKINIT: ECDH not supported", ""));
+    return ENOTSUP;
+#endif
+}
+
+krb5_error_code
+_krb5_pk_rd_pa_reply_ecdh_compute_key(krb5_context context,
+                                      krb5_pk_init_ctx ctx,
+                                      const unsigned char *in,
+                                      size_t in_sz,
+                                      unsigned char **out,
+                                      int *out_sz)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    krb5_error_code ret = 0;
+    int dh_gen_keylen;
+
+    const EC_GROUP *group;
+    EC_KEY *public = NULL;
+
+    group = EC_KEY_get0_group(ctx->u.eckey);
+
+    public = EC_KEY_new();
+    if (public == NULL)
+        return krb5_enomem(context);
+    if (EC_KEY_set_group(public, group) != 1) {
+        EC_KEY_free(public);
+        return krb5_enomem(context);
+    }
+
+    if (o2i_ECPublicKey(&public, &in, in_sz) == NULL) {
+        EC_KEY_free(public);
+        ret = KRB5KRB_ERR_GENERIC;
+        krb5_set_error_message(context, ret,
+                               N_("PKINIT: Can't parse ECDH public key", ""));
+        return ret;
+    }
+
+    *out_sz = (EC_GROUP_get_degree(group) + 7) / 8;
+    if (*out_sz < 0)
+        return EOVERFLOW;
+    *out = malloc(*out_sz);
+    if (*out == NULL) {
+        EC_KEY_free(public);
+        return krb5_enomem(context);
+    }
+    dh_gen_keylen = ECDH_compute_key(*out, *out_sz,
+                                     EC_KEY_get0_public_key(public),
+                                     ctx->u.eckey, NULL);
+    EC_KEY_free(public);
+    if (dh_gen_keylen <= 0) {
+        ret = KRB5KRB_ERR_GENERIC;
+        dh_gen_keylen = 0;
+        krb5_set_error_message(context, ret,
+                               N_("PKINIT: Can't compute ECDH public key", ""));
+        free(*out);
+        *out = NULL;
+        *out_sz = 0;
+    }
+    *out_sz = dh_gen_keylen;
+
+    return ret;
+#else
+    krb5_set_error_message(context, ENOTSUP,
+                           N_("PKINIT: ECDH not supported", ""));
+    return ENOTSUP;
+#endif
+}
+
+void
+_krb5_pk_eckey_free(void *eckey)
+{
+#ifdef HAVE_HCRYPTO_W_OPENSSL
+    EC_KEY_free(eckey);
+#endif
+}
+
+#else
+
+static char lib_krb5_pkinit_ec_c = '\0';
+
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit.c b/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit.c
index 434149936..39fa59605 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/pkinit.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: pkinit.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $	*/
+/*	$NetBSD: pkinit.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
- * Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -60,34 +60,13 @@ struct krb5_pk_cert {
     hx509_cert cert;
 };
 
-struct krb5_pk_init_ctx_data {
-    struct krb5_pk_identity *id;
-    enum { USE_RSA, USE_DH, USE_ECDH } keyex;
-    union {
-	DH *dh;
-#ifdef HAVE_OPENSSL
-	EC_KEY *eckey;
-#endif
-    } u;
-    krb5_data *clientDHNonce;
-    struct krb5_dh_moduli **m;
-    hx509_peer_info peer;
-    enum krb5_pk_type type;
-    unsigned int require_binding:1;
-    unsigned int require_eku:1;
-    unsigned int require_krbtgt_otherName:1;
-    unsigned int require_hostname_match:1;
-    unsigned int trustedCertifiers:1;
-    unsigned int anonymous:1;
-};
-
 static void
 pk_copy_error(krb5_context context,
 	      hx509_context hx509ctx,
 	      int hxret,
 	      const char *fmt,
 	      ...)
-    __attribute__ ((format (printf, 4, 5)));
+    __attribute__ ((__format__ (__printf__, 4, 5)));
 
 /*
  *
@@ -185,10 +164,10 @@ find_cert(krb5_context context, struct krb5_pk_identity *id,
 	  hx509_query *q, hx509_cert *cert)
 {
     struct certfind cf[4] = {
-	{ "MobileMe EKU" },
-	{ "PKINIT EKU" },
-	{ "MS EKU" },
-	{ "any (or no)" }
+	{ "MobileMe EKU", NULL },
+	{ "PKINIT EKU", NULL },
+	{ "MS EKU", NULL },
+	{ "any (or no)", NULL }
     };
     int ret = HX509_CERT_NOT_FOUND;
     size_t i, start = 1;
@@ -330,8 +309,10 @@ cert2epi(hx509_context context, void *ctx, hx509_cert c)
 			   id.issuerAndSerialNumber->length,
 			   &iasn, &size, ret);
 	free_IssuerAndSerialNumber(&iasn);
-	if (ret)
+	if (ret) {
+            free_ExternalPrincipalIdentifier(&id);
 	    return ret;
+        }
 	if (id.issuerAndSerialNumber->length != size)
 	    abort();
     }
@@ -401,9 +382,7 @@ build_auth_pack(krb5_context context,
 
     ALLOC(a->pkAuthenticator.paChecksum, 1);
     if (a->pkAuthenticator.paChecksum == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = krb5_data_copy(a->pkAuthenticator.paChecksum,
@@ -438,11 +417,8 @@ build_auth_pack(krb5_context context,
 	    return ret;
 
 	ctx->u.dh = DH_new();
-	if (ctx->u.dh == NULL) {
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
-	}
+	if (ctx->u.dh == NULL)
+	    return krb5_enomem(context);
 
 	ret = select_dh_group(context, ctx->u.dh, dh_min_bits, ctx->m);
 	if (ret)
@@ -540,74 +516,14 @@ build_auth_pack(krb5_context context,
 		return ret;
 	    if (size != dhbuf.length)
 		krb5_abortx(context, "asn1 internal error");
+            a->clientPublicValue->subjectPublicKey.length = dhbuf.length * 8;
+            a->clientPublicValue->subjectPublicKey.data = dhbuf.data;
 	} else if (ctx->keyex == USE_ECDH) {
-#ifdef HAVE_OPENSSL
-	    ECParameters ecp;
-	    unsigned char *p;
-	    int xlen;
-
-	    /* copy in public key, XXX find the best curve that the server support or use the clients curve if possible */
-
-	    ecp.element = choice_ECParameters_namedCurve;
-	    ret = der_copy_oid(&asn1_oid_id_ec_group_secp256r1,
-			       &ecp.u.namedCurve);
-	    if (ret)
-		return ret;
-
-	    ALLOC(a->clientPublicValue->algorithm.parameters, 1);
-	    if (a->clientPublicValue->algorithm.parameters == NULL) {
-		free_ECParameters(&ecp);
-		return ENOMEM;
-	    }
-	    ASN1_MALLOC_ENCODE(ECParameters, p, xlen, &ecp, &size, ret);
-	    free_ECParameters(&ecp);
-	    if (ret)
-		return ret;
-	    if ((int)size != xlen)
-		krb5_abortx(context, "asn1 internal error");
-
-	    a->clientPublicValue->algorithm.parameters->data = p;
-	    a->clientPublicValue->algorithm.parameters->length = size;
-
-	    /* copy in public key */
-
-	    ret = der_copy_oid(&asn1_oid_id_ecPublicKey,
-			       &a->clientPublicValue->algorithm.algorithm);
-	    if (ret)
-		return ret;
-
-	    ctx->u.eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-	    if (ctx->u.eckey == NULL)
-		return ENOMEM;
-
-	    ret = EC_KEY_generate_key(ctx->u.eckey);
-	    if (ret != 1)
-		return EINVAL;
-
-	    /* encode onto dhkey */
-
-	    xlen = i2o_ECPublicKey(ctx->u.eckey, NULL);
-	    if (xlen <= 0)
-		abort();
-
-	    dhbuf.data = malloc(xlen);
-	    if (dhbuf.data == NULL)
-		abort();
-	    dhbuf.length = xlen;
-	    p = dhbuf.data;
-
-	    xlen = i2o_ECPublicKey(ctx->u.eckey, &p);
-	    if (xlen <= 0)
-		abort();
-
-	    /* XXX verify that this is right with RFC3279 */
-#else
-	    return EINVAL;
-#endif
+            ret = _krb5_build_authpack_subjectPK_EC(context, ctx, a);
+            if (ret)
+                return ret;
 	} else
 	    krb5_abortx(context, "internal error");
-	a->clientPublicValue->subjectPublicKey.length = dhbuf.length * 8;
-	a->clientPublicValue->subjectPublicKey.data = dhbuf.data;
     }
 
     {
@@ -770,9 +686,7 @@ pk_mk_padata(krb5_context context,
 
 	    req.trustedCertifiers = calloc(1, sizeof(*req.trustedCertifiers));
 	    if (req.trustedCertifiers == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_message(context, ret,
-				       N_("malloc: out of memory", ""));
+		ret = krb5_enomem(context);
 		free_PA_PK_AS_REQ(&req);
 		goto out;
 	    }
@@ -987,9 +901,7 @@ get_reply_key_win(krb5_context context,
     *key = malloc (sizeof (**key));
     if (*key == NULL) {
 	free_ReplyKeyPack_Win2k(&key_pack);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = copy_EncryptionKey(&key_pack.replyKey, *key);
@@ -1052,9 +964,7 @@ get_reply_key(krb5_context context,
     *key = malloc (sizeof (**key));
     if (*key == NULL) {
 	free_ReplyKeyPack(&key_pack);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = copy_EncryptionKey(&key_pack.replyKey, *key);
@@ -1091,6 +1001,7 @@ pk_verify_host(krb5_context context,
     if (ctx->require_krbtgt_otherName) {
 	hx509_octet_string_list list;
 	size_t i;
+	int matched = 0;
 
 	ret = hx509_cert_find_subjectAltName_otherName(context->hx509ctx,
 						       host->cert,
@@ -1105,7 +1016,14 @@ pk_verify_host(krb5_context context,
 	    return ret;
 	}
 
-	for (i = 0; i < list.len; i++) {
+	/*
+	 * subjectAltNames are multi-valued, and a single KDC may serve
+	 * multiple realms. The SAN validation here must accept
+	 * the KDC's cert if *any* of the SANs match the expected KDC.
+	 * It is OK for *some* of the SANs to not match, provided at least
+	 * one does.
+	 */
+	for (i = 0; matched == 0 && i < list.len; i++) {
 	    KRB5PrincipalName r;
 
 	    ret = decode_KRB5PrincipalName(list.val[i].data,
@@ -1121,22 +1039,22 @@ pk_verify_host(krb5_context context,
 		break;
 	    }
 
-	    if (r.principalName.name_string.len != 2 ||
-		strcmp(r.principalName.name_string.val[0], KRB5_TGS_NAME) != 0 ||
-		strcmp(r.principalName.name_string.val[1], realm) != 0 ||
-		strcmp(r.realm, realm) != 0)
-		{
-		    ret = KRB5_KDC_ERR_INVALID_CERTIFICATE;
-		    krb5_set_error_message(context, ret,
-					   N_("KDC have wrong realm name in "
-					      "the certificate", ""));
-		}
+	    if (r.principalName.name_string.len == 2 &&
+		strcmp(r.principalName.name_string.val[0], KRB5_TGS_NAME) == 0
+		&& strcmp(r.principalName.name_string.val[1], realm) == 0
+		&& strcmp(r.realm, realm) == 0)
+		matched = 1;
 
 	    free_KRB5PrincipalName(&r);
-	    if (ret)
-		break;
 	}
 	hx509_free_octet_string_list(&list);
+	if (matched == 0) {
+	    ret = KRB5_KDC_ERR_INVALID_CERTIFICATE;
+	    /* XXX: Lost in translation... */
+	    krb5_set_error_message(context, ret,
+				   N_("KDC have wrong realm name in "
+				      "the certificate", ""));
+	}
     }
     if (ret)
 	return ret;
@@ -1217,8 +1135,10 @@ pk_rd_pa_reply_enckey(krb5_context context,
 
 	    ret = der_put_length_and_tag (ptr + ph - 1, ph, content.length,
 					  ASN1_C_UNIV, CONS, UT_Sequence, &l);
-	    if (ret)
+	    if (ret) {
+                free(ptr);
 		return ret;
+            }
 	    free(content.data);
 	    content.data = ptr;
 	    content.length += ph;
@@ -1429,8 +1349,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 
 	dh_gen_key = malloc(size);
 	if (dh_gen_key == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 
@@ -1449,53 +1368,11 @@ pk_rd_pa_reply_dh(krb5_context context,
 	}
 
     } else {
-#ifdef HAVE_OPENSSL
-	const EC_GROUP *group;
-	EC_KEY *public = NULL;
-
-	group = EC_KEY_get0_group(ctx->u.eckey);
-
-	public = EC_KEY_new();
-	if (public == NULL) {
-	    ret = ENOMEM;
-	    goto out;
-	}
-	if (EC_KEY_set_group(public, group) != 1) {
-	    EC_KEY_free(public);
-	    ret = ENOMEM;
-	    goto out;
-	}
-
-	if (o2i_ECPublicKey(&public, &p, size) == NULL) {
-	    EC_KEY_free(public);
-	    ret = KRB5KRB_ERR_GENERIC;
-	    krb5_set_error_message(context, ret,
-				   N_("PKINIT: Can't parse ECDH public key", ""));
-	    goto out;
-	}
-
-	size = (EC_GROUP_get_degree(group) + 7) / 8;
-	dh_gen_key = malloc(size);
-	if (dh_gen_key == NULL) {
-	    EC_KEY_free(public);
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
-	    goto out;
-	}
-	dh_gen_keylen = ECDH_compute_key(dh_gen_key, size,
-					 EC_KEY_get0_public_key(public), ctx->u.eckey, NULL);
-	EC_KEY_free(public);
-	if (dh_gen_keylen == -1) {
-	    ret = KRB5KRB_ERR_GENERIC;
-	    dh_gen_keylen = 0;
-	    krb5_set_error_message(context, ret,
-				   N_("PKINIT: Can't compute ECDH public key", ""));
-	    goto out;
-	}
-#else
-	ret = EINVAL;
-#endif
+        ret = _krb5_pk_rd_pa_reply_ecdh_compute_key(context, ctx, p,
+                                                    size, &dh_gen_key,
+                                                    &dh_gen_keylen);
+        if (ret)
+          goto out;
     }
 
     if (dh_gen_keylen <= 0) {
@@ -1508,9 +1385,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 
     *key = malloc (sizeof (**key));
     if (*key == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret,
-			       N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -1862,11 +1737,8 @@ _krb5_pk_load_id(krb5_context context,
     /* load cert */
 
     id = calloc(1, sizeof(*id));
-    if (id == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (id == NULL)
+	return krb5_enomem(context);
 
     if (user_id) {
 	hx509_lock lock;
@@ -2035,7 +1907,7 @@ parse_integer(krb5_context context, char **p, const char *file, int lineno,
     return 0;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_parse_moduli_line(krb5_context context,
 			const char *file,
 			int lineno,
@@ -2049,11 +1921,8 @@ _krb5_parse_moduli_line(krb5_context context,
     *m = NULL;
 
     m1 = calloc(1, sizeof(*m1));
-    if (m1 == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (m1 == NULL)
+	return krb5_enomem(context);
 
     while (isspace((unsigned char)*p))
 	p++;
@@ -2072,8 +1941,7 @@ _krb5_parse_moduli_line(krb5_context context,
     }
     m1->name = strdup(p1);
     if (m1->name == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memeory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -2115,7 +1983,7 @@ _krb5_parse_moduli_line(krb5_context context,
     return ret;
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_moduli(struct krb5_dh_moduli **moduli)
 {
     int i;
@@ -2183,7 +2051,7 @@ static const char *default_moduli_rfc3526_MODP_group14 =
     "EF15E5FB" "4AAC0B8C" "1CCAA4BE" "754AB572" "8AE9130C" "4C7D0288"
     "0AB9472D" "45565534" "7FFFFFFF" "FFFFFFFF";
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_parse_moduli(krb5_context context, const char *file,
 		   struct krb5_dh_moduli ***moduli)
 {
@@ -2197,11 +2065,8 @@ _krb5_parse_moduli(krb5_context context, const char *file,
     *moduli = NULL;
 
     m = calloc(1, sizeof(m[0]) * 3);
-    if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (m == NULL)
+	return krb5_enomem(context);
 
     strlcpy(buf, default_moduli_rfc3526_MODP_group14, sizeof(buf));
     ret = _krb5_parse_moduli_line(context, "builtin", 1, buf,  &m[0]);
@@ -2227,7 +2092,7 @@ _krb5_parse_moduli(krb5_context context, const char *file,
     {
         char * exp_file;
 
-        if (_krb5_expand_path_tokens(context, file, &exp_file) == 0) {
+	if (_krb5_expand_path_tokens(context, file, 1, &exp_file) == 0) {
             f = fopen(exp_file, "r");
             krb5_xfree(exp_file);
         } else {
@@ -2253,9 +2118,7 @@ _krb5_parse_moduli(krb5_context context, const char *file,
 	m2 = realloc(m, (n + 2) * sizeof(m[0]));
 	if (m2 == NULL) {
 	    _krb5_free_moduli(m);
-	    krb5_set_error_message(context, ENOMEM,
-				   N_("malloc: out of memory", ""));
-	    return ENOMEM;
+	    return krb5_enomem(context);
 	}
 	m = m2;
 
@@ -2277,7 +2140,7 @@ _krb5_parse_moduli(krb5_context context, const char *file,
     return 0;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_dh_group_ok(krb5_context context, unsigned long bits,
 		  heim_integer *p, heim_integer *g, heim_integer *q,
 		  struct krb5_dh_moduli **moduli,
@@ -2331,10 +2194,8 @@ _krb5_get_init_creds_opt_free_pkinit(krb5_get_init_creds_opt *opt)
     case USE_RSA:
 	break;
     case USE_ECDH:
-#ifdef HAVE_OPENSSL
 	if (ctx->u.eckey)
-	    EC_KEY_free(ctx->u.eckey);
-#endif
+            _krb5_pk_eckey_free(ctx->u.eckey);
 	break;
     }
     if (ctx->id) {
@@ -2383,11 +2244,8 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
 
     opt->opt_private->pk_init_ctx =
 	calloc(1, sizeof(*opt->opt_private->pk_init_ctx));
-    if (opt->opt_private->pk_init_ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (opt->opt_private->pk_init_ctx == NULL)
+	return krb5_enomem(context);
     opt->opt_private->pk_init_ctx->require_binding = 0;
     opt->opt_private->pk_init_ctx->require_eku = 1;
     opt->opt_private->pk_init_ctx->require_krbtgt_otherName = 1;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/plugin.c b/crypto/external/bsd/heimdal/dist/lib/krb5/plugin.c
index f420da90d..8483070ee 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/plugin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/plugin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: plugin.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: plugin.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -63,67 +63,6 @@ struct plugin {
 
 static HEIMDAL_MUTEX plugin_mutex = HEIMDAL_MUTEX_INITIALIZER;
 static struct plugin *registered = NULL;
-static int plugins_needs_scan = 1;
-
-static const char *sysplugin_dirs[] =  {
-    LIBDIR "/plugin/krb5",
-#ifdef __APPLE__
-    "/System/Library/KerberosPlugins/KerberosFrameworkPlugins",
-#endif
-    NULL
-};
-
-/*
- *
- */
-
-void *
-_krb5_plugin_get_symbol(struct krb5_plugin *p)
-{
-    return p->symbol;
-}
-
-struct krb5_plugin *
-_krb5_plugin_get_next(struct krb5_plugin *p)
-{
-    return p->next;
-}
-
-/*
- *
- */
-
-#ifdef HAVE_DLOPEN
-
-static krb5_error_code
-loadlib(krb5_context context, char *path)
-{
-    struct plugin *e;
-
-    e = calloc(1, sizeof(*e));
-    if (e == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
-	free(path);
-	return ENOMEM;
-    }
-
-#ifndef RTLD_LAZY
-#define RTLD_LAZY 0
-#endif
-#ifndef RTLD_LOCAL
-#define RTLD_LOCAL 0
-#endif
-    e->type = DSO;
-    /* ignore error from dlopen, and just keep it as negative cache entry */
-    e->u.dso.dsohandle = dlopen(path, RTLD_LOCAL|RTLD_LAZY);
-    e->u.dso.path = path;
-
-    e->next = registered;
-    registered = e;
-
-    return 0;
-}
-#endif /* HAVE_DLOPEN */
 
 /**
  * Register a plugin symbol name of specific type.
@@ -181,128 +120,6 @@ krb5_plugin_register(krb5_context context,
     return 0;
 }
 
-static int
-is_valid_plugin_filename(const char * n)
-{
-    if (n[0] == '.' && (n[1] == '\0' || (n[1] == '.' && n[2] == '\0')))
-        return 0;
-
-#ifdef _WIN32
-    /* On Windows, we only attempt to load .dll files as plug-ins. */
-    {
-        const char * ext;
-
-        ext = strrchr(n, '.');
-        if (ext == NULL)
-            return 0;
-
-        return !stricmp(ext, ".dll");
-    }
-#else
-    return 1;
-#endif
-}
-
-static void
-trim_trailing_slash(char * path)
-{
-    size_t l;
-
-    l = strlen(path);
-    while (l > 0 && (path[l - 1] == '/'
-#ifdef BACKSLASH_PATH_DELIM
-                     || path[l - 1] == '\\'
-#endif
-               )) {
-        path[--l] = '\0';
-    }
-}
-
-static krb5_error_code
-load_plugins(krb5_context context)
-{
-    struct plugin *e;
-    krb5_error_code ret;
-    char **dirs = NULL, **di;
-    struct dirent *entry;
-    char *path;
-    DIR *d = NULL;
-
-    if (!plugins_needs_scan)
-	return 0;
-    plugins_needs_scan = 0;
-
-#ifdef HAVE_DLOPEN
-
-    dirs = krb5_config_get_strings(context, NULL, "libdefaults",
-				   "plugin_dir", NULL);
-    if (dirs == NULL)
-	dirs = rk_UNCONST(sysplugin_dirs);
-
-    for (di = dirs; *di != NULL; di++) {
-        char * dir = *di;
-
-#ifdef KRB5_USE_PATH_TOKENS
-        if (_krb5_expand_path_tokens(context, *di, &dir))
-            goto next_dir;
-#endif
-
-        trim_trailing_slash(dir);
-
-        d = opendir(dir);
-
-	if (d == NULL)
-	    goto next_dir;
-
-	rk_cloexec_dir(d);
-
-	while ((entry = readdir(d)) != NULL) {
-	    char *n = entry->d_name;
-
-	    /* skip . and .. */
-            if (!is_valid_plugin_filename(n))
-		continue;
-
-	    path = NULL;
-	    ret = 0;
-#ifdef __APPLE__
-	    { /* support loading bundles on MacOS */
-		size_t len = strlen(n);
-		if (len > 7 && strcmp(&n[len - 7],  ".bundle") == 0)
-		    ret = asprintf(&path, "%s/%s/Contents/MacOS/%.*s", dir, n, (int)(len - 7), n);
-	    }
-#endif
-	    if (ret < 0 || path == NULL)
-		ret = asprintf(&path, "%s/%s", dir, n);
-
-	    if (ret < 0 || path == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_message(context, ret, "malloc: out of memory");
-		return ret;
-	    }
-
-	    /* check if already tried */
-	    for (e = registered; e != NULL; e = e->next)
-		if (e->type == DSO && strcmp(e->u.dso.path, path) == 0)
-		    break;
-	    if (e) {
-		free(path);
-	    } else {
-		loadlib(context, path); /* store or frees path */
-	    }
-	}
-	closedir(d);
-
-    next_dir:
-        if (dir != *di)
-            free(dir);
-    }
-    if (dirs != rk_UNCONST(sysplugin_dirs))
-	krb5_config_free_strings(dirs);
-#endif /* HAVE_DLOPEN */
-    return 0;
-}
-
 static krb5_error_code
 add_symbol(krb5_context context, struct krb5_plugin **list, void *symbol)
 {
@@ -319,7 +136,7 @@ add_symbol(krb5_context context, struct krb5_plugin **list, void *symbol)
     return 0;
 }
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_plugin_find(krb5_context context,
 		  enum krb5_plugin_type type,
 		  const char *name,
@@ -332,8 +149,6 @@ _krb5_plugin_find(krb5_context context,
 
     HEIMDAL_MUTEX_lock(&plugin_mutex);
 
-    load_plugins(context);
-
     for (ret = 0, e = registered; e != NULL; e = e->next) {
 	switch(e->type) {
 	case DSO: {
@@ -368,7 +183,7 @@ _krb5_plugin_find(krb5_context context,
     return 0;
 }
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_plugin_free(struct krb5_plugin *list)
 {
     struct krb5_plugin *next;
@@ -406,8 +221,57 @@ plug_dealloc(void *ptr)
 	dlclose(p->dsohandle);
 }
 
+static char *
+resolve_origin(const char *di)
+{
+#ifdef HAVE_DLADDR
+    Dl_info dl_info;
+    const char *dname;
+    char *path, *p;
+#endif
 
-void
+    if (strncmp(di, "$ORIGIN/", sizeof("$ORIGIN/") - 1) &&
+        strcmp(di, "$ORIGIN"))
+        return strdup(di);
+
+#ifndef HAVE_DLADDR
+    return strdup(LIBDIR "/plugin/krb5");
+#else /* !HAVE_DLADDR */
+    di += sizeof("$ORIGIN") - 1;
+
+    if (dladdr(_krb5_load_plugins, &dl_info) == 0)
+        return strdup(LIBDIR "/plugin/krb5");
+
+    dname = dl_info.dli_fname;
+#ifdef _WIN32
+    p = strrchr(dname, '\\');
+    if (p == NULL)
+#endif
+	p = strrchr(dname, '/');
+    if (p) {
+        if (asprintf(&path, "%.*s%s", (int) (p - dname), dname, di) == -1)
+            return NULL;
+    } else {
+        if (asprintf(&path, "%s%s", dname, di) == -1)
+            return NULL;
+    }
+
+    return path;
+#endif /* !HAVE_DLADDR */
+}
+
+
+/**
+ * Load plugins (new system) for the given module @name (typically
+ * "krb5") from the given directory @paths.
+ *
+ * Inputs:
+ *
+ * @context A krb5_context
+ * @name    Name of plugin module (typically "krb5")
+ * @paths   Array of directory paths where to look
+ */
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_load_plugins(krb5_context context, const char *name, const char **paths)
 {
 #ifdef HAVE_DLOPEN
@@ -416,7 +280,16 @@ _krb5_load_plugins(krb5_context context, const char *name, const char **paths)
     struct dirent *entry;
     krb5_error_code ret;
     const char **di;
+    char *dirname = NULL;
     DIR *d;
+#ifdef _WIN32
+    const char * plugin_prefix;
+    size_t plugin_prefix_len;
+
+    if (asprintf(&plugin_prefix, "plugin_%s_", name) == -1)
+	return;
+    plugin_prefix_len = (plugin_prefix ? strlen(plugin_prefix) : 0);
+#endif
 
     HEIMDAL_MUTEX_lock(&plugin_mutex);
 
@@ -436,12 +309,16 @@ _krb5_load_plugins(krb5_context context, const char *name, const char **paths)
 	    heim_release(s);
 	    return;
 	}
-	heim_dict_add_value(modules, s, module);
+	heim_dict_set_value(modules, s, module);
     }
     heim_release(s);
 
     for (di = paths; *di != NULL; di++) {
-	d = opendir(*di);
+        free(dirname);
+        dirname = resolve_origin(*di);
+        if (dirname == NULL)
+            continue;
+	d = opendir(dirname);
 	if (d == NULL)
 	    continue;
 	rk_cloexec_dir(d);
@@ -457,15 +334,35 @@ _krb5_load_plugins(krb5_context context, const char *name, const char **paths)
 		continue;
 
 	    ret = 0;
+#ifdef _WIN32
+	    /*
+	     * On Windows, plugins must be loaded from the same directory as
+	     * heimdal.dll (typically the assembly directory) and must have
+	     * the name form "plugin_<module>_<name>.dll".
+	     */
+	    {
+		char *ext;
+
+		if (strnicmp(n, plugin_prefix, plugin_prefix_len))
+		    continue;
+		ext = strrchr(n, '.');
+		if (ext == NULL || stricmp(ext, ".dll"))
+		     continue;
+
+		ret = asprintf(&path, "%s\\%s", dirname, n);
+		if (ret < 0 || path == NULL)
+		    continue;
+	    }
+#endif
 #ifdef __APPLE__
 	    { /* support loading bundles on MacOS */
 		size_t len = strlen(n);
 		if (len > 7 && strcmp(&n[len - 7],  ".bundle") == 0)
-		    ret = asprintf(&path, "%s/%s/Contents/MacOS/%.*s", *di, n, (int)(len - 7), n);
+		    ret = asprintf(&path, "%s/%s/Contents/MacOS/%.*s", dirname, n, (int)(len - 7), n);
 	    }
 #endif
 	    if (ret < 0 || path == NULL)
-		ret = asprintf(&path, "%s/%s", *di, n);
+		ret = asprintf(&path, "%s/%s", dirname, n);
 
 	    if (ret < 0 || path == NULL)
 		continue;
@@ -483,24 +380,32 @@ _krb5_load_plugins(krb5_context context, const char *name, const char **paths)
 		if (p)
 		    p->dsohandle = dlopen(path, RTLD_LOCAL|RTLD_LAZY);
 
-		if (p->dsohandle) {
+		if (p && p->dsohandle) {
 		    p->path = heim_retain(spath);
 		    p->names = heim_dict_create(11);
-		    heim_dict_add_value(module, spath, p);
+		    heim_dict_set_value(module, spath, p);
 		}
 	    }
+            heim_release(p);
 	    heim_release(spath);
-	    heim_release(p);
 	    free(path);
 	}
 	closedir(d);
     }
-    heim_release(module);
+    free(dirname);
     HEIMDAL_MUTEX_unlock(&plugin_mutex);
+    heim_release(module);
+#ifdef _WIN32
+    if (plugin_prefix)
+	free(plugin_prefix);
+#endif
 #endif /* HAVE_DLOPEN */
 }
 
-void
+/**
+ * Unload plugins (new system)
+ */
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_unload_plugins(krb5_context context, const char *name)
 {
     HEIMDAL_MUTEX_lock(&plugin_mutex);
@@ -539,14 +444,15 @@ struct iter_ctx {
     heim_string_t n;
     const char *name;
     int min_version;
+    int flags;
     heim_array_t result;
-    krb5_error_code (*func)(krb5_context, const void *, void *, void *);
+    krb5_error_code (KRB5_LIB_CALL *func)(krb5_context, const void *, void *, void *);
     void *userctx;
     krb5_error_code ret;
 };
 
 static void
-search_modules(void *ctx, heim_object_t key, heim_object_t value)
+search_modules(heim_object_t key, heim_object_t value, void *ctx)
 {
     struct iter_ctx *s = ctx;
     struct plugin2 *p = value;
@@ -567,19 +473,18 @@ search_modules(void *ctx, heim_object_t key, heim_object_t value)
 	    if (ret)
 		cpm = pl->dataptr = NULL;
 	}
-	heim_dict_add_value(p->names, s->n, pl);
+	heim_dict_set_value(p->names, s->n, pl);
     } else {
 	cpm = pl->dataptr;
     }
 
     if (cpm && cpm->version >= s->min_version)
 	heim_array_append_value(s->result, pl);
-
     heim_release(pl);
 }
 
 static void
-eval_results(heim_object_t value, void *ctx)
+eval_results(heim_object_t value, void *ctx, int *stop)
 {
     struct plug *pl = value;
     struct iter_ctx *s = ctx;
@@ -588,50 +493,116 @@ eval_results(heim_object_t value, void *ctx)
 	return;
 
     s->ret = s->func(s->context, pl->dataptr, pl->ctx, s->userctx);
+    if (s->ret != KRB5_PLUGIN_NO_HANDLE
+        && !(s->flags & KRB5_PLUGIN_INVOKE_ALL))
+        *stop = 1;
 }
 
-krb5_error_code
+/**
+ * Run plugins for the given @module (e.g., "krb5") and @name (e.g.,
+ * "kuserok").  Specifically, the @func is invoked once per-plugin with
+ * four arguments: the @context, the plugin symbol value (a pointer to a
+ * struct whose first three fields are the same as struct common_plugin_method),
+ * a context value produced by the plugin's init method, and @userctx.
+ *
+ * @func should unpack arguments for a plugin function and invoke it
+ * with arguments taken from @userctx.  @func should save plugin
+ * outputs, if any, in @userctx.
+ *
+ * All loaded and registered plugins are invoked via @func until @func
+ * returns something other than KRB5_PLUGIN_NO_HANDLE.  Plugins that
+ * have nothing to do for the given arguments should return
+ * KRB5_PLUGIN_NO_HANDLE.
+ *
+ * Inputs:
+ *
+ * @context     A krb5_context
+ * @module      Name of module (typically "krb5")
+ * @name        Name of pluggable interface (e.g., "kuserok")
+ * @min_version Lowest acceptable plugin minor version number
+ * @flags       Flags (none defined at this time)
+ * @userctx     Callback data for the callback function @func
+ * @func        A callback function, invoked once per-plugin
+ *
+ * Outputs: None, other than the return value and such outputs as are
+ *          gathered by @func.
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_plugin_run_f(krb5_context context,
 		   const char *module,
 		   const char *name,
 		   int min_version,
 		   int flags,
 		   void *userctx,
-		   krb5_error_code (*func)(krb5_context, const void *, void *, void *))
+		   krb5_error_code (KRB5_LIB_CALL *func)(krb5_context, const void *, void *, void *))
 {
     heim_string_t m = heim_string_create(module);
     heim_dict_t dict;
+    void *plug_ctx;
+    struct common_plugin_method *cpm;
     struct iter_ctx s;
+    struct krb5_plugin *registered_plugins = NULL;
+    struct krb5_plugin *p;
+
+    /* Get registered plugins */
+    (void) _krb5_plugin_find(context, SYMBOL, name, &registered_plugins);
 
     HEIMDAL_MUTEX_lock(&plugin_mutex);
 
-    dict = heim_dict_copy_value(modules, m);
-    heim_release(m);
-    if (dict == NULL) {
-	HEIMDAL_MUTEX_unlock(&plugin_mutex);
-	return KRB5_PLUGIN_NO_HANDLE;
-    }
-
     s.context = context;
     s.name = name;
     s.n = heim_string_create(name);
+    s.flags = flags;
     s.min_version = min_version;
     s.result = heim_array_create();
     s.func = func;
     s.userctx = userctx;
-
-    heim_dict_iterate_f(dict, search_modules, &s);
-
-    heim_release(dict);
-
-    HEIMDAL_MUTEX_unlock(&plugin_mutex);
-
     s.ret = KRB5_PLUGIN_NO_HANDLE;
 
-    heim_array_iterate_f(s.result, eval_results, &s);
+    /* Get loaded plugins */
+    dict = heim_dict_copy_value(modules, m);
+    heim_release(m);
+
+    /* Add loaded plugins to s.result array */
+    if (dict)
+	heim_dict_iterate_f(dict, &s, search_modules);
+
+    /* We don't need to hold plugin_mutex during plugin invocation */
+    HEIMDAL_MUTEX_unlock(&plugin_mutex);
+
+    /* Invoke registered plugins (old system) */
+    for (p = registered_plugins; p; p = p->next) {
+	/*
+	 * XXX This is the wrong way to handle registered plugins, as we
+	 * call init/fini on each invocation!  We do this because we
+	 * have nowhere in the struct plugin registered list to store
+	 * the context allocated by the plugin's init function.  (But at
+	 * least we do call init/fini!)
+	 *
+	 * What we should do is adapt the old plugin system to the new
+	 * one and change how we register plugins so that we use the new
+	 * struct plug to keep track of their context structures, that
+	 * way we can init once, invoke many times, then fini.
+	 */
+	cpm = (struct common_plugin_method *)p->symbol;
+	s.ret = cpm->init(context, &plug_ctx);
+	if (s.ret)
+	    continue;
+	s.ret = s.func(s.context, p->symbol, plug_ctx, s.userctx);
+	cpm->fini(plug_ctx);
+	if (s.ret != KRB5_PLUGIN_NO_HANDLE &&
+            !(flags & KRB5_PLUGIN_INVOKE_ALL))
+	    break;
+    }
+    _krb5_plugin_free(registered_plugins);
+
+    /* Invoke loaded plugins (new system) */
+    if (s.ret == KRB5_PLUGIN_NO_HANDLE)
+	heim_array_iterate_f(s.result, &s, eval_results);
 
     heim_release(s.result);
     heim_release(s.n);
+    heim_release(dict);
 
     return s.ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/principal.c b/crypto/external/bsd/heimdal/dist/lib/krb5/principal.c
index 45785471c..c5b2a7c9f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/principal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/principal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: principal.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: principal.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -37,8 +37,8 @@
  * @page krb5_principal_intro The principal handing functions.
  *
  * A Kerberos principal is a email address looking string that
- * contains to parts separeted by a @.  The later part is the kerbero
- * realm the principal belongs to and the former is a list of 0 or
+ * contains two parts separated by @.  The second part is the kerberos
+ * realm the principal belongs to and the first is a list of 0 or
  * more components. For example
  * @verbatim
 lha@SU.SE
@@ -65,6 +65,28 @@ host/admin@H5L.ORG
 #define princ_ncomp(P, N) ((P)->name.name_string.val[(N)])
 #define princ_realm(P) ((P)->realm)
 
+static krb5_error_code
+set_default_princ_type(krb5_principal p, NAME_TYPE defnt)
+{
+    if (princ_num_comp(p) > 1 && strcmp(princ_ncomp(p, 0), KRB5_TGS_NAME) == 0)
+        princ_type(p) = KRB5_NT_SRV_INST;
+    else if (princ_num_comp(p) > 1 && strcmp(princ_ncomp(p, 0), "host") == 0)
+        princ_type(p) = KRB5_NT_SRV_HST;
+    else if (princ_num_comp(p) > 1 && strcmp(princ_ncomp(p, 0), "kca_service") == 0)
+	princ_type(p) = KRB5_NT_SRV_HST;
+    else if (princ_num_comp(p) == 2 &&
+             strcmp(princ_ncomp(p, 0), KRB5_WELLKNOWN_NAME) == 0)
+        princ_type(p) = KRB5_NT_WELLKNOWN;
+    else if (princ_num_comp(p) == 1 && strchr(princ_ncomp(p, 0), '@') != NULL)
+        princ_type(p) = KRB5_NT_SMTP_NAME;
+    else
+        princ_type(p) = defnt;
+    return 0;
+}
+
+static krb5_error_code append_component(krb5_context, krb5_principal,
+                                        const char *, size_t);
+
 /**
  * Frees a Kerberos principal allocated by the library with
  * krb5_parse_name(), krb5_make_principal() or any other related
@@ -205,99 +227,93 @@ krb5_parse_name_flags(krb5_context context,
     char c;
     int got_realm = 0;
     int first_at = 1;
-    int enterprise = (flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE);
+    int no_realm = flags & KRB5_PRINCIPAL_PARSE_NO_REALM;
+    int require_realm = flags & KRB5_PRINCIPAL_PARSE_REQUIRE_REALM;
+    int enterprise = flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+    int ignore_realm = flags & KRB5_PRINCIPAL_PARSE_IGNORE_REALM;
+    int no_def_realm = flags & KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
 
     *principal = NULL;
 
-#define RFLAGS (KRB5_PRINCIPAL_PARSE_NO_REALM|KRB5_PRINCIPAL_PARSE_REQUIRE_REALM)
-
-    if ((flags & RFLAGS) == RFLAGS) {
+    if (no_realm && require_realm) {
 	krb5_set_error_message(context, KRB5_ERR_NO_SERVICE,
 			       N_("Can't require both realm and "
 				  "no realm at the same time", ""));
 	return KRB5_ERR_NO_SERVICE;
     }
-#undef RFLAGS
 
     /* count number of component,
      * enterprise names only have one component
      */
     ncomp = 1;
     if (!enterprise) {
-	for(p = name; *p; p++){
-	    if(*p=='\\'){
-		if(!p[1]) {
+	for (p = name; *p; p++) {
+	    if (*p=='\\') {
+		if (!p[1]) {
 		    krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
 					   N_("trailing \\ in principal name", ""));
 		    return KRB5_PARSE_MALFORMED;
 		}
 		p++;
-	    } else if(*p == '/')
+	    } else if (*p == '/')
 		ncomp++;
-	    else if(*p == '@')
+	    else if (*p == '@')
 		break;
 	}
     }
     comp = calloc(ncomp, sizeof(*comp));
-    if (comp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (comp == NULL)
+	return krb5_enomem(context);
 
     n = 0;
     p = start = q = s = strdup(name);
     if (start == NULL) {
-	free (comp);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	free(comp);
+	return krb5_enomem(context);
     }
-    while(*p){
+    while (*p) {
 	c = *p++;
-	if(c == '\\'){
+	if (c == '\\') {
 	    c = *p++;
-	    if(c == 'n')
+	    if (c == 'n')
 		c = '\n';
-	    else if(c == 't')
+	    else if (c == 't')
 		c = '\t';
-	    else if(c == 'b')
+	    else if (c == 'b')
 		c = '\b';
-	    else if(c == '0')
+	    else if (c == '0')
 		c = '\0';
-	    else if(c == '\0') {
+	    else if (c == '\0') {
 		ret = KRB5_PARSE_MALFORMED;
 		krb5_set_error_message(context, ret,
 				       N_("trailing \\ in principal name", ""));
 		goto exit;
 	    }
-	}else if(enterprise && first_at) {
+	} else if (enterprise && first_at) {
 	    if (c == '@')
 		first_at = 0;
-	}else if((c == '/' && !enterprise) || c == '@'){
-	    if(got_realm){
+	} else if ((c == '/' && !enterprise) || c == '@') {
+	    if (got_realm) {
 		ret = KRB5_PARSE_MALFORMED;
 		krb5_set_error_message(context, ret,
 				       N_("part after realm in principal name", ""));
 		goto exit;
-	    }else{
+	    } else {
 		comp[n] = malloc(q - start + 1);
 		if (comp[n] == NULL) {
-		    ret = ENOMEM;
-		    krb5_set_error_message(context, ret,
-					   N_("malloc: out of memory", ""));
+		    ret = krb5_enomem(context);
 		    goto exit;
 		}
 		memcpy(comp[n], start, q - start);
 		comp[n][q - start] = 0;
 		n++;
 	    }
-	    if(c == '@')
+	    if (c == '@')
 		got_realm = 1;
 	    start = q;
 	    continue;
 	}
-	if(got_realm && (c == '/' || c == '\0')) {
+	if (got_realm && (c == '/' || c == '\0')) {
 	    ret = KRB5_PARSE_MALFORMED;
 	    krb5_set_error_message(context, ret,
 				   N_("part after realm in principal name", ""));
@@ -305,71 +321,67 @@ krb5_parse_name_flags(krb5_context context,
 	}
 	*q++ = c;
     }
-    if(got_realm){
-	if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
+    if (got_realm) {
+	if (no_realm) {
 	    ret = KRB5_PARSE_MALFORMED;
 	    krb5_set_error_message(context, ret,
 				   N_("realm found in 'short' principal "
 				      "expected to be without one", ""));
 	    goto exit;
 	}
-	realm = malloc(q - start + 1);
-	if (realm == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
-	    goto exit;
+	if (!ignore_realm) {
+	    realm = malloc(q - start + 1);
+	    if (realm == NULL) {
+		ret = krb5_enomem(context);
+		goto exit;
+	    }
+	    memcpy(realm, start, q - start);
+	    realm[q - start] = 0;
 	}
-	memcpy(realm, start, q - start);
-	realm[q - start] = 0;
-    }else{
-	if (flags & KRB5_PRINCIPAL_PARSE_REQUIRE_REALM) {
+    } else {
+	if (require_realm) {
 	    ret = KRB5_PARSE_MALFORMED;
 	    krb5_set_error_message(context, ret,
 				   N_("realm NOT found in principal "
 				      "expected to be with one", ""));
 	    goto exit;
-	} else if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
+	} else if (no_realm || no_def_realm) {
 	    realm = NULL;
 	} else {
-	    ret = krb5_get_default_realm (context, &realm);
+	    ret = krb5_get_default_realm(context, &realm);
 	    if (ret)
 		goto exit;
 	}
 
 	comp[n] = malloc(q - start + 1);
 	if (comp[n] == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto exit;
 	}
 	memcpy(comp[n], start, q - start);
 	comp[n][q - start] = 0;
 	n++;
     }
-    *principal = malloc(sizeof(**principal));
+    *principal = calloc(1, sizeof(**principal));
     if (*principal == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret,
-			       N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto exit;
     }
-    if (enterprise)
-	(*principal)->name.name_type = KRB5_NT_ENTERPRISE_PRINCIPAL;
-    else
-	(*principal)->name.name_type = KRB5_NT_PRINCIPAL;
     (*principal)->name.name_string.val = comp;
     princ_num_comp(*principal) = n;
     (*principal)->realm = realm;
+    if (enterprise)
+        princ_type(*principal) = KRB5_NT_ENTERPRISE_PRINCIPAL;
+    else
+        set_default_princ_type(*principal, KRB5_NT_PRINCIPAL);
     free(s);
     return 0;
 exit:
-    while(n>0){
+    while (n>0) {
 	free(comp[--n]);
     }
     free(comp);
-    free(realm);
+    krb5_free_default_realm(context, realm);
     free(s);
     return ret;
 }
@@ -396,7 +408,6 @@ krb5_parse_name(krb5_context context,
 
 static const char quotable_chars[] = " \n\t\b\\/@";
 static const char replace_chars[] = " ntb\\/@";
-static const char nq_chars[] = "    \\/@";
 
 #define add_char(BASE, INDEX, LEN, C) do { if((INDEX) < (LEN)) (BASE)[(INDEX)++] = (C); }while(0);
 
@@ -459,7 +470,7 @@ unparse_name_fixed(krb5_context context,
 	    return ret;
 	if(strcmp(princ_realm(principal), r) != 0)
 	    short_form = 0;
-	free(r);
+	krb5_free_default_realm(context, r);
     }
     if(!short_form && !no_realm) {
 	add_char(name, idx, len, '@');
@@ -573,11 +584,8 @@ unparse_name(krb5_context context,
     }
     len++; /* '\0' */
     *name = malloc(len);
-    if(*name == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(*name == NULL)
+	return krb5_enomem(context);
     ret = unparse_name_fixed(context, principal, *name, len, flags);
     if(ret) {
 	free(*name);
@@ -670,12 +678,29 @@ krb5_principal_set_realm(krb5_context context,
     if (princ_realm(principal))
 	free(princ_realm(principal));
 
-    princ_realm(principal) = strdup(realm);
-    if (princ_realm(principal) == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (realm == NULL)
+	princ_realm(principal) = NULL;
+    else if ((princ_realm(principal) = strdup(realm)) == NULL)
+	return krb5_enomem(context);
+    return 0;
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_principal_set_comp_string(krb5_context context,
+			       krb5_principal principal,
+			       unsigned int k,
+                               const char *component)
+{
+    char *s;
+    size_t i;
+
+    for (i = princ_num_comp(principal); i <= k; i++)
+        append_component(context, principal, "", 0);
+    s = strdup(component);
+    if (s == NULL)
+        return krb5_enomem(context);
+    free(princ_ncomp(principal, k));
+    princ_ncomp(principal, k) = s;
     return 0;
 }
 
@@ -723,6 +748,7 @@ krb5_build_principal(krb5_context context,
  * @ingroup krb5_principal
  */
 
+/* coverity[+alloc : arg-*1] */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_make_principal(krb5_context context,
 		    krb5_principal *principal,
@@ -742,7 +768,7 @@ krb5_make_principal(krb5_context context,
     ret = krb5_build_principal_va(context, principal, strlen(realm), realm, ap);
     va_end(ap);
     if(r)
-	free(r);
+	krb5_free_default_realm(context, r);
     return ret;
 }
 
@@ -755,48 +781,50 @@ append_component(krb5_context context, krb5_principal p,
     size_t len = princ_num_comp(p);
 
     tmp = realloc(princ_comp(p), (len + 1) * sizeof(*tmp));
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if(tmp == NULL)
+	return krb5_enomem(context);
     princ_comp(p) = tmp;
     princ_ncomp(p, len) = malloc(comp_len + 1);
-    if (princ_ncomp(p, len) == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (princ_ncomp(p, len) == NULL)
+	return krb5_enomem(context);
     memcpy (princ_ncomp(p, len), comp, comp_len);
     princ_ncomp(p, len)[comp_len] = '\0';
     princ_num_comp(p)++;
     return 0;
 }
 
-static void
+static krb5_error_code
 va_ext_princ(krb5_context context, krb5_principal p, va_list ap)
 {
-    while(1){
+    krb5_error_code ret = 0;
+
+    while (1){
 	const char *s;
 	int len;
-	len = va_arg(ap, int);
-	if(len == 0)
+
+	if ((len = va_arg(ap, int)) == 0)
 	    break;
 	s = va_arg(ap, const char*);
-	append_component(context, p, s, len);
+	if ((ret = append_component(context, p, s, len)) != 0)
+	    break;
     }
+    return ret;
 }
 
-static void
+static krb5_error_code
 va_princ(krb5_context context, krb5_principal p, va_list ap)
 {
-    while(1){
+    krb5_error_code ret = 0;
+
+    while (1){
 	const char *s;
-	s = va_arg(ap, const char*);
-	if(s == NULL)
+
+	if ((s = va_arg(ap, const char*)) == NULL)
+	    break;
+	if ((ret = append_component(context, p, s, strlen(s))) != 0)
 	    break;
-	append_component(context, p, s, strlen(s));
     }
+    return ret;
 }
 
 static krb5_error_code
@@ -804,30 +832,30 @@ build_principal(krb5_context context,
 		krb5_principal *principal,
 		int rlen,
 		krb5_const_realm realm,
-		void (*func)(krb5_context, krb5_principal, va_list),
+		krb5_error_code (*func)(krb5_context, krb5_principal, va_list),
 		va_list ap)
 {
+    krb5_error_code ret;
     krb5_principal p;
 
+    *principal = NULL;
     p = calloc(1, sizeof(*p));
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-    princ_type(p) = KRB5_NT_PRINCIPAL;
+    if (p == NULL)
+	return krb5_enomem(context);
 
     princ_realm(p) = strdup(realm);
-    if(p->realm == NULL){
+    if (p->realm == NULL) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
-    (*func)(context, p, ap);
-    *principal = p;
-    return 0;
+    ret = func(context, p, ap);
+    if (ret == 0) {
+	*principal = p;
+        set_default_princ_type(p, KRB5_NT_PRINCIPAL);
+    } else
+	krb5_free_principal(context, p);
+    return ret;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -885,16 +913,11 @@ krb5_copy_principal(krb5_context context,
 		    krb5_principal *outprinc)
 {
     krb5_principal p = malloc(sizeof(*p));
-    if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (p == NULL)
+	return krb5_enomem(context);
     if(copy_Principal(inprinc, p)) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     *outprinc = p;
     return 0;
@@ -967,7 +990,7 @@ krb5_principal_compare(krb5_context context,
 		       krb5_const_principal princ1,
 		       krb5_const_principal princ2)
 {
-    if(!krb5_realm_compare(context, princ1, princ2))
+    if (!krb5_realm_compare(context, princ1, princ2))
 	return FALSE;
     return krb5_principal_compare_any_realm(context, princ1, princ2);
 }
@@ -1015,32 +1038,21 @@ krb5_principal_match(krb5_context context,
     return TRUE;
 }
 
-/**
- * Create a principal for the service running on hostname. If
- * KRB5_NT_SRV_HST is used, the hostname is canonization using DNS (or
- * some other service), this is potentially insecure.
- *
- * @param context A Kerberos context.
- * @param hostname hostname to use
- * @param sname Service name to use
- * @param type name type of pricipal, use KRB5_NT_SRV_HST or KRB5_NT_UNKNOWN.
- * @param ret_princ return principal, free with krb5_free_principal().
- *
- * @return An krb5 error code, see krb5_get_error_message().
- *
- * @ingroup krb5_principal
+/*
+ * This is the original krb5_sname_to_principal(), renamed to be a
+ * helper of the new one.
  */
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_sname_to_principal (krb5_context context,
-			 const char *hostname,
-			 const char *sname,
-			 int32_t type,
-			 krb5_principal *ret_princ)
+static krb5_error_code
+krb5_sname_to_principal_old(krb5_context context,
+			    const char *realm,
+			    const char *hostname,
+			    const char *sname,
+			    int32_t type,
+			    krb5_principal *ret_princ)
 {
     krb5_error_code ret;
     char localhost[MAXHOSTNAMELEN];
-    char **realms, *host = NULL;
+    char **realms = NULL, *host = NULL;
 
     if(type != KRB5_NT_SRV_HST && type != KRB5_NT_UNKNOWN) {
 	krb5_set_error_message(context, KRB5_SNAME_UNSUPP_NAMETYPE,
@@ -1062,23 +1074,30 @@ krb5_sname_to_principal (krb5_context context,
     if(sname == NULL)
 	sname = "host";
     if(type == KRB5_NT_SRV_HST) {
-	ret = krb5_expand_hostname_realms (context, hostname,
-					   &host, &realms);
+	if (realm)
+	    ret = krb5_expand_hostname(context, hostname, &host);
+	else
+	    ret = krb5_expand_hostname_realms(context, hostname,
+					      &host, &realms);
 	if (ret)
 	    return ret;
 	strlwr(host);
 	hostname = host;
-    } else {
+	if (!realm)
+	    realm = realms[0];
+    } else if (!realm) {
 	ret = krb5_get_host_realm(context, hostname, &realms);
 	if(ret)
 	    return ret;
+	realm = realms[0];
     }
 
-    ret = krb5_make_principal(context, ret_princ, realms[0], sname,
+    ret = krb5_make_principal(context, ret_princ, realm, sname,
 			      hostname, NULL);
     if(host)
 	free(host);
-    krb5_free_host_realm(context, realms);
+    if (realms)
+	krb5_free_host_realm(context, realms);
     return ret;
 }
 
@@ -1095,9 +1114,12 @@ static const struct {
     { "X500_PRINCIPAL", KRB5_NT_X500_PRINCIPAL },
     { "SMTP_NAME", KRB5_NT_SMTP_NAME },
     { "ENTERPRISE_PRINCIPAL", KRB5_NT_ENTERPRISE_PRINCIPAL },
+    { "WELLKNOWN", KRB5_NT_WELLKNOWN },
+    { "SRV_HST_DOMAIN", KRB5_NT_SRV_HST_DOMAIN },
     { "ENT_PRINCIPAL_AND_ID", KRB5_NT_ENT_PRINCIPAL_AND_ID },
     { "MS_PRINCIPAL", KRB5_NT_MS_PRINCIPAL },
     { "MS_PRINCIPAL_AND_ID", KRB5_NT_MS_PRINCIPAL_AND_ID },
+    { "SRV_HST_NEEDS_CANON", KRB5_NT_SRV_HST_NEEDS_CANON },
     { NULL, 0 }
 };
 
@@ -1123,6 +1145,64 @@ krb5_parse_nametype(krb5_context context, const char *str, int32_t *nametype)
     return KRB5_PARSE_MALFORMED;
 }
 
+/**
+ * Returns true if name is Kerberos NULL name
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_null(krb5_context context, krb5_const_principal principal)
+{
+    if (principal->name.name_type == KRB5_NT_WELLKNOWN &&
+	principal->name.name_string.len == 2 &&
+	strcmp(principal->name.name_string.val[0], "WELLKNOWN") == 0 &&
+	strcmp(principal->name.name_string.val[1], "NULL") == 0)
+	return TRUE;
+    return FALSE;
+}
+
+const char _krb5_wellknown_lkdc[] = "WELLKNOWN:COM.APPLE.LKDC";
+static const char lkdc_prefix[] = "LKDC:";
+
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_realm_is_lkdc(const char *realm)
+{
+
+    return strncmp(realm, lkdc_prefix, sizeof(lkdc_prefix)-1) == 0 ||
+	strncmp(realm, _krb5_wellknown_lkdc, sizeof(_krb5_wellknown_lkdc) - 1) == 0;
+}
+
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_lkdc(krb5_context context, krb5_const_principal principal)
+{
+    return krb5_realm_is_lkdc(principal->realm);
+}
+
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_pku2u(krb5_context context, krb5_const_principal principal)
+{
+    return strcmp(principal->realm, KRB5_PKU2U_REALM_NAME) == 0;
+}
+
 /**
  * Check if the cname part of the principal is a krbtgt principal
  *
@@ -1134,5 +1214,873 @@ krb5_principal_is_krbtgt(krb5_context context, krb5_const_principal p)
 {
     return p->name.name_string.len == 2 &&
 	strcmp(p->name.name_string.val[0], KRB5_TGS_NAME) == 0;
-
+}
+
+/**
+ * Returns true iff name is an WELLKNOWN:ORG.H5L.HOSTBASED-SERVICE
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_gss_hostbased_service(krb5_context context,
+					krb5_const_principal principal)
+{
+    if (principal == NULL)
+	return FALSE;
+    if (principal->name.name_string.len != 2)
+	return FALSE;
+    if (strcmp(principal->name.name_string.val[1], KRB5_GSS_HOSTBASED_SERVICE_NAME) != 0)
+	return FALSE;
+    return TRUE;
+}
+
+/**
+ * Check if the cname part of the principal is a initial or renewed krbtgt principal
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_root_krbtgt(krb5_context context, krb5_const_principal p)
+{
+    return p->name.name_string.len == 2 &&
+	strcmp(p->name.name_string.val[0], KRB5_TGS_NAME) == 0 &&
+	strcmp(p->name.name_string.val[1], p->realm) == 0;
+}
+
+static int
+tolower_ascii(int c)
+{
+    if (c >= 'A' || c <= 'Z')
+        return 'a' + (c - 'A');
+    return c;
+}
+
+typedef enum krb5_name_canon_rule_type {
+	KRB5_NCRT_BOGUS = 0,
+	KRB5_NCRT_AS_IS,
+	KRB5_NCRT_QUALIFY,
+	KRB5_NCRT_NSS
+} krb5_name_canon_rule_type;
+
+#ifdef UINT8_MAX
+#define MAXDOTS UINT8_MAX
+#else
+#define MAXDOTS (255U)
+#endif
+#ifdef UINT16_MAX
+#define MAXORDER UINT16_MAX
+#else
+#define MAXORDER (65535U)
+#endif
+
+struct krb5_name_canon_rule_data {
+	krb5_name_canon_rule_type type;
+	krb5_name_canon_rule_options options;
+	uint8_t mindots;          /* match this many dots or more */
+	uint8_t maxdots;          /* match no more than this many dots */
+        uint16_t explicit_order;    /* given order */
+        uint16_t order;             /* actual order */
+	char *match_domain;         /* match this stem */
+	char *match_realm;          /* match this realm */
+	char *domain;               /* qualify with this domain */
+	char *realm;                /* qualify with this realm */
+};
+
+/**
+ * Create a principal for the given service running on the given
+ * hostname. If KRB5_NT_SRV_HST is used, the hostname is canonicalized
+ * according the configured name canonicalization rules, with
+ * canonicalization delayed in some cases.  One rule involves DNS, which
+ * is insecure unless DNSSEC is used, but we don't use DNSSEC-capable
+ * resolver APIs here, so that if DNSSEC is used we wouldn't know it.
+ *
+ * Canonicalization is immediate (not delayed) only when there is only
+ * one canonicalization rule and that rule indicates that we should do a
+ * host lookup by name (i.e., DNS).
+ *
+ * @param context A Kerberos context.
+ * @param hostname hostname to use
+ * @param sname Service name to use
+ * @param type name type of principal, use KRB5_NT_SRV_HST or KRB5_NT_UNKNOWN.
+ * @param ret_princ return principal, free with krb5_free_principal().
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
+/* coverity[+alloc : arg-*4] */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sname_to_principal(krb5_context context,
+			const char *hostname,
+			const char *sname,
+			int32_t type,
+			krb5_principal *ret_princ)
+{
+    char *realm, *remote_host;
+    krb5_error_code ret;
+    register char *cp;
+    char localname[MAXHOSTNAMELEN];
+
+    *ret_princ = NULL;
+
+    if ((type != KRB5_NT_UNKNOWN) &&
+	(type != KRB5_NT_SRV_HST))
+	return KRB5_SNAME_UNSUPP_NAMETYPE;
+
+    /* if hostname is NULL, use local hostname */
+    if (hostname == NULL) {
+	if (gethostname(localname, MAXHOSTNAMELEN))
+	    return errno;
+	hostname = localname;
+    }
+
+    /* if sname is NULL, use "host" */
+    if (sname == NULL)
+	sname = "host";
+
+    remote_host = strdup(hostname);
+    if (remote_host == NULL)
+	return krb5_enomem(context);
+
+    if (type == KRB5_NT_SRV_HST) {
+	krb5_name_canon_rule rules;
+
+	/* Lower-case the hostname, because that's the convention */
+	for (cp = remote_host; *cp; cp++)
+	    if (isupper((int) (*cp)))
+		*cp = tolower((int) (*cp));
+
+        /*
+         * If there is only one name canon rule and it says to
+         * canonicalize the old way, do that now, as we used to.
+         */
+	ret = _krb5_get_name_canon_rules(context, &rules);
+	if (ret) {
+	    _krb5_debug(context, 5, "Failed to get name canon rules: ret = %d",
+			ret);
+	    free(remote_host);
+	    return ret;
+	}
+	if (rules[0].type == KRB5_NCRT_NSS &&
+            rules[1].type == KRB5_NCRT_BOGUS) {
+	    _krb5_debug(context, 5, "Using nss for name canon immediately");
+            ret = krb5_sname_to_principal_old(context, rules[0].realm,
+                                              remote_host, sname,
+                                              KRB5_NT_SRV_HST, ret_princ);
+	    free(remote_host);
+	    return ret;
+	}
+    }
+
+    /* Remove trailing dots */
+    if (remote_host[0]) {
+	for (cp = remote_host + strlen(remote_host)-1;
+             *cp == '.' && cp > remote_host;
+             cp--) {
+            *cp = '\0';
+        }
+    }
+
+    realm = ""; /* "Referral realm" */
+
+    ret = krb5_build_principal(context, ret_princ, strlen(realm),
+				  realm, sname, remote_host,
+				  (char *)0);
+
+    if (ret == 0 && type == KRB5_NT_SRV_HST) {
+	/*
+	 * Hostname canonicalization is done elsewhere (in
+	 * krb5_get_credentials() and krb5_kt_get_entry()).
+	 *
+         * We overload the name type to indicate to those functions that
+         * this principal name requires canonicalization.
+         *
+         * We can't use the empty realm to denote the need to
+         * canonicalize the hostname too: it would mean that users who
+         * want to assert knowledge of a service's realm must also know
+         * the canonical hostname, but in practice they don't.
+	 */
+	(*ret_princ)->name.name_type = KRB5_NT_SRV_HST_NEEDS_CANON;
+
+	_krb5_debug(context, 5, "Building a delayed canon principal for %s/%s@",
+		sname, remote_host);
+    }
+
+    free(remote_host);
+    return ret;
+}
+
+static void
+tolower_str(char *s)
+{
+    for (; *s != '\0'; s++) {
+        if (isupper(*s))
+            *s = tolower_ascii(*s);
+    }
+}
+
+static krb5_error_code
+rule_parse_token(krb5_context context, krb5_name_canon_rule rule,
+		 const char *tok)
+{
+    long int n;
+    int needs_type = rule->type == KRB5_NCRT_BOGUS;
+
+    /*
+     * Rules consist of a sequence of tokens, some of which indicate
+     * what type of rule the rule is, and some of which set rule options
+     * or ancilliary data.  Last rule type token wins.
+     */
+
+    /* Rule type tokens: */
+    if (needs_type && strcmp(tok, "as-is") == 0) {
+        rule->type = KRB5_NCRT_AS_IS;
+    } else if (needs_type && strcmp(tok, "qualify") == 0) {
+        rule->type = KRB5_NCRT_QUALIFY;
+    } else if (needs_type && strcmp(tok, "nss") == 0) {
+        rule->type = KRB5_NCRT_NSS;
+    /* Rule options: */
+    } else if (strcmp(tok, "use_fast") == 0) {
+	rule->options |= KRB5_NCRO_USE_FAST;
+    } else if (strcmp(tok, "use_dnssec") == 0) {
+	rule->options |= KRB5_NCRO_USE_DNSSEC;
+    } else if (strcmp(tok, "ccache_only") == 0) {
+	rule->options |= KRB5_NCRO_GC_ONLY;
+    } else if (strcmp(tok, "no_referrals") == 0) {
+	rule->options |= KRB5_NCRO_NO_REFERRALS;
+    } else if (strcmp(tok, "use_referrals") == 0) {
+	rule->options &= ~KRB5_NCRO_NO_REFERRALS;
+        if (rule->realm == NULL) {
+            rule->realm = strdup("");
+            if (rule->realm == NULL)
+                return krb5_enomem(context);
+        }
+    } else if (strcmp(tok, "lookup_realm") == 0) {
+        rule->options |= KRB5_NCRO_LOOKUP_REALM;
+        free(rule->realm);
+        rule->realm = NULL;
+    /* Rule ancilliary data: */
+    } else if (strncmp(tok, "domain=", strlen("domain=")) == 0) {
+	free(rule->domain);
+	rule->domain = strdup(tok + strlen("domain="));
+	if (rule->domain == NULL)
+	    return krb5_enomem(context);
+        tolower_str(rule->domain);
+    } else if (strncmp(tok, "realm=", strlen("realm=")) == 0) {
+	free(rule->realm);
+	rule->realm = strdup(tok + strlen("realm="));
+	if (rule->realm == NULL)
+	    return krb5_enomem(context);
+    } else if (strncmp(tok, "match_domain=", strlen("match_domain=")) == 0) {
+	free(rule->match_domain);
+	rule->match_domain = strdup(tok + strlen("match_domain="));
+	if (rule->match_domain == NULL)
+	    return krb5_enomem(context);
+        tolower_str(rule->match_domain);
+    } else if (strncmp(tok, "match_realm=", strlen("match_realm=")) == 0) {
+	free(rule->match_realm);
+	rule->match_realm = strdup(tok + strlen("match_realm="));
+	if (rule->match_realm == NULL)
+	    return krb5_enomem(context);
+    } else if (strncmp(tok, "mindots=", strlen("mindots=")) == 0) {
+	errno = 0;
+	n = strtol(tok + strlen("mindots="), NULL, 10);
+	if (errno == 0 && n > 0 && n <= MAXDOTS)
+	    rule->mindots = n;
+    } else if (strncmp(tok, "maxdots=", strlen("maxdots=")) == 0) {
+	errno = 0;
+	n = strtol(tok + strlen("maxdots="), NULL, 10);
+	if (errno == 0 && n > 0 && n <= MAXDOTS)
+	    rule->maxdots = n;
+    } else if (strncmp(tok, "order=", strlen("order=")) == 0) {
+	errno = 0;
+	n = strtol(tok + strlen("order="), NULL, 10);
+	if (errno == 0 && n > 0 && n <= MAXORDER)
+	    rule->explicit_order = n;
+    } else {
+        _krb5_debug(context, 5,
+                    "Unrecognized name canonicalization rule token %s", tok);
+        return EINVAL;
+    }
+    return 0;
+}
+
+static int
+rule_cmp(const void *a, const void *b)
+{
+    krb5_const_name_canon_rule left = a;
+    krb5_const_name_canon_rule right = b;
+
+    if (left->type == KRB5_NCRT_BOGUS &&
+        right->type == KRB5_NCRT_BOGUS)
+        return 0;
+    if (left->type == KRB5_NCRT_BOGUS)
+        return 1;
+    if (right->type == KRB5_NCRT_BOGUS)
+        return -1;
+    if (left->explicit_order < right->explicit_order)
+        return -1;
+    if (left->explicit_order > right->explicit_order)
+        return 1;
+    return left->order - right->order;
+}
+
+static krb5_error_code
+parse_name_canon_rules(krb5_context context, char **rulestrs,
+		       krb5_name_canon_rule *rules)
+{
+    krb5_error_code ret;
+    char *tok;
+    char *cp;
+    char **cpp;
+    size_t n;
+    size_t i, k;
+    int do_sort = 0;
+    krb5_name_canon_rule r;
+
+    *rules = NULL;
+
+    for (n =0, cpp = rulestrs; cpp != NULL && *cpp != NULL; cpp++)
+	n++;
+
+    n += 2; /* Always at least one rule; two for the default case */
+
+    if ((r = calloc(n, sizeof (*r))) == NULL)
+	return krb5_enomem(context);
+
+    for (k = 0; k < n; k++) {
+        r[k].type = KRB5_NCRT_BOGUS;
+        r[k].match_domain = NULL;
+        r[k].match_realm = NULL;
+        r[k].domain = NULL;
+        r[k].realm = NULL;
+    }
+
+    for (i = 0, k = 0; i < n && rulestrs != NULL && rulestrs[i] != NULL; i++) {
+	cp = rulestrs[i];
+        r[k].explicit_order = MAXORDER; /* mark order, see below */
+        r[k].maxdots = MAXDOTS;
+        r[k].order = k;         /* default order */
+
+        /* Tokenize and parse value */
+	do {
+	    tok = cp;
+	    cp = strchr(cp, ':');   /* XXX use strtok_r() */
+	    if (cp)
+		*cp++ = '\0';       /* delimit token */
+	    ret = rule_parse_token(context, &r[k], tok);
+            if (ret == EINVAL) {
+                r[k].type = KRB5_NCRT_BOGUS;
+                break;
+            }
+            if (ret) {
+                _krb5_free_name_canon_rules(context, r);
+                return ret;
+            }
+	} while (cp && *cp);
+        if (r[k].explicit_order != MAXORDER)
+            do_sort = 1;
+
+	/* Validate parsed rule */
+	if (r[k].type == KRB5_NCRT_BOGUS ||
+	    (r[k].type == KRB5_NCRT_QUALIFY && !r[k].domain) ||
+	    (r[k].type == KRB5_NCRT_NSS && r[k].domain)) {
+	    /* Invalid rule; mark it so and clean up */
+	    r[k].type = KRB5_NCRT_BOGUS;
+	    free(r[k].match_domain);
+	    free(r[k].match_realm);
+	    free(r[k].domain);
+	    free(r[k].realm);
+	    r[k].realm = NULL;
+	    r[k].domain = NULL;
+	    r[k].match_domain = NULL;
+	    r[k].match_realm = NULL;
+            _krb5_debug(context, 5,
+                        "Ignoring invalid name canonicalization rule %lu",
+                        (unsigned long)i);
+	    continue;
+	}
+	k++; /* good rule */
+    }
+
+    if (do_sort) {
+        /*
+         * Note that we make make this a stable sort by using appareance
+         * and explicit order.
+         */
+        qsort(r, n, sizeof(r[0]), rule_cmp);
+    }
+
+    if (r[0].type == KRB5_NCRT_BOGUS) {
+        /* No rules, or no valid rules */
+        r[0].type = KRB5_NCRT_NSS;
+    }
+
+    *rules = r;
+    return 0; /* We don't communicate bad rule errors here */
+}
+
+/*
+ * This exists only because the hostname canonicalization behavior in Heimdal
+ * (and other implementations of Kerberos) has been to use getaddrinfo(),
+ * unsafe though it is, for ages.  We can't fix it in one day.
+ */
+static void
+make_rules_safe(krb5_context context, krb5_name_canon_rule rules)
+{
+    /*
+     * If the only rule were to use the name service (getaddrinfo()) then we're
+     * bound to fail.  We could try to convert that rule to an as-is rule, but
+     * when we do get a validating resolver we'd be unhappy that we did such a
+     * conversion.  Better let the user get failures and make them think about
+     * their naming rules.
+     */
+    if (rules == NULL)
+        return;
+    for (; rules[0].type != KRB5_NCRT_BOGUS; rules++) {
+        if (rules->type == KRB5_NCRT_NSS)
+            rules->options |= KRB5_NCRO_USE_DNSSEC;
+        else
+            rules->options |= KRB5_NCRO_USE_FAST;
+    }
+}
+
+/**
+ * This function returns an array of host-based service name
+ * canonicalization rules.  The array of rules is organized as a list.
+ * See the definition of krb5_name_canon_rule.
+ *
+ * @param context A Kerberos context.
+ * @param rules   Output location for array of rules.
+ */
+KRB5_LIB_FUNCTION krb5_error_code
+_krb5_get_name_canon_rules(krb5_context context, krb5_name_canon_rule *rules)
+{
+    krb5_error_code ret;
+    char **values = NULL;
+
+    *rules = context->name_canon_rules;
+    if (*rules != NULL)
+        return 0;
+
+    values = krb5_config_get_strings(context, NULL,
+                                     "libdefaults", "name_canon_rules", NULL);
+    ret = parse_name_canon_rules(context, values, rules);
+    krb5_config_free_strings(values);
+    if (ret)
+	return ret;
+
+    if (krb5_config_get_bool_default(context, NULL, FALSE,
+                                     "libdefaults", "safe_name_canon", NULL))
+        make_rules_safe(context, *rules);
+
+    heim_assert(rules != NULL && (*rules)[0].type != KRB5_NCRT_BOGUS,
+                "internal error in parsing principal name "
+                "canonicalization rules");
+
+    /* Memoize */
+    context->name_canon_rules = *rules;
+
+    return 0;
+}
+
+static krb5_error_code
+get_host_realm(krb5_context context, const char *hostname, char **realm)
+{
+    krb5_error_code ret;
+    char **hrealms = NULL;
+
+    *realm = NULL;
+    ret = krb5_get_host_realm(context, hostname, &hrealms);
+    if (ret)
+	return ret;
+    if (hrealms == NULL)
+	return KRB5_ERR_HOST_REALM_UNKNOWN; /* krb5_set_error() already done */
+    if (hrealms[0] == NULL) {
+	krb5_free_host_realm(context, hrealms);
+	return KRB5_ERR_HOST_REALM_UNKNOWN; /* krb5_set_error() already done */
+    }
+    *realm = strdup(hrealms[0]);
+    krb5_free_host_realm(context, hrealms);
+    if (*realm == NULL)
+        return krb5_enomem(context);
+    return 0;
+}
+
+static int
+is_domain_suffix(const char *domain, const char *suffix)
+{
+    size_t dlen = strlen(domain);
+    size_t slen = strlen(suffix);
+
+    if (dlen < slen + 2)
+        return 0;
+
+    if (strcasecmp(domain + (dlen - slen), suffix) != 0)
+        return 0;
+
+    if (domain[(dlen - slen) - 1] != '.')
+        return 0;
+    return 1;
+}
+
+/*
+ * Applies a name canonicalization rule to a principal.
+ *
+ * Returns zero and no out_princ if the rule does not match.
+ * Returns zero and an out_princ if the rule does match.
+ */
+static krb5_error_code
+apply_name_canon_rule(krb5_context context, krb5_name_canon_rule rules,
+                      size_t rule_idx, krb5_const_principal in_princ,
+                      krb5_principal *out_princ,
+                      krb5_name_canon_rule_options *rule_opts)
+{
+    krb5_name_canon_rule rule = &rules[rule_idx];
+    krb5_error_code ret;
+    unsigned int ndots = 0;
+    krb5_principal nss = NULL;
+    const char *sname = NULL;
+    const char *orig_hostname = NULL;
+    const char *new_hostname = NULL;
+    const char *new_realm = NULL;
+    const char *port = "";
+    const char *cp;
+    char *hostname_sans_port = NULL;
+    char *hostname_with_port = NULL;
+    char *tmp_hostname = NULL;
+    char *tmp_realm = NULL;
+
+    *out_princ = NULL; /* Signal no match */
+
+    if (rule_opts != NULL)
+	*rule_opts = rule->options;
+
+    if (rule->type == KRB5_NCRT_BOGUS)
+	return 0; /* rule doesn't apply */
+
+    sname = krb5_principal_get_comp_string(context, in_princ, 0);
+    orig_hostname = krb5_principal_get_comp_string(context, in_princ, 1);
+
+    /*
+     * Some apps want to use the very non-standard svc/hostname:port@REALM
+     * form.  We do our best to support that here :(
+     */
+    port = strchr(orig_hostname, ':');
+    if (port != NULL) {
+        hostname_sans_port = strndup(orig_hostname, port - orig_hostname);
+        if (hostname_sans_port == NULL)
+            return krb5_enomem(context);
+        orig_hostname = hostname_sans_port;
+    }
+
+    _krb5_debug(context, 5, N_("Applying a name rule (type %d) to %s", ""),
+                rule->type, orig_hostname);
+
+    if (rule->mindots > 0 || rule->maxdots > 0) {
+        for (cp = strchr(orig_hostname, '.'); cp && *cp; cp = strchr(cp + 1, '.'))
+            ndots++;
+    }
+    if (rule->mindots > 0 && ndots < rule->mindots)
+            return 0;
+    if (ndots > rule->maxdots)
+            return 0;
+
+    if (rule->match_domain != NULL &&
+        !is_domain_suffix(orig_hostname, rule->match_domain))
+        return 0;
+
+    if (rule->match_realm != NULL &&
+        strcmp(rule->match_realm, in_princ->realm) != 0)
+          return 0;
+
+    new_realm = rule->realm;
+    switch (rule->type) {
+    case KRB5_NCRT_AS_IS:
+	break;
+
+    case KRB5_NCRT_QUALIFY:
+	heim_assert(rule->domain != NULL,
+		    "missing domain for qualify name canon rule");
+        if (asprintf(&tmp_hostname, "%s.%s", orig_hostname,
+                     rule->domain) == -1 || tmp_hostname == NULL) {
+            ret = krb5_enomem(context);
+            goto out;
+        }
+        new_hostname = tmp_hostname;
+	break;
+
+    case KRB5_NCRT_NSS:
+        if ((rule->options & KRB5_NCRO_USE_DNSSEC)) {
+            ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+            krb5_set_error_message(context, ret,
+                                   "Secure hostname resolution not supported");
+            goto out;
+        }
+	_krb5_debug(context, 5, "Using name service lookups");
+	ret = krb5_sname_to_principal_old(context, rule->realm,
+					  orig_hostname, sname,
+					  KRB5_NT_SRV_HST,
+					  &nss);
+	if (rules[rule_idx + 1].type != KRB5_NCRT_BOGUS &&
+            (ret == KRB5_ERR_BAD_HOSTNAME ||
+	     ret == KRB5_ERR_HOST_REALM_UNKNOWN)) {
+	    /*
+	     * Bad hostname / realm unknown -> rule inapplicable if
+	     * there's more rules.  If it's the last rule then we want
+	     * to return all errors from krb5_sname_to_principal_old()
+	     * here.
+	     */
+            ret = 0;
+            goto out;
+        }
+        if (ret)
+            goto out;
+
+        new_hostname = krb5_principal_get_comp_string(context, nss, 1);
+        new_realm = krb5_principal_get_realm(context, nss);
+        break;
+
+    default:
+        /* Can't happen */
+        ret = 0;
+	goto out;
+    }
+
+    /*
+     * This rule applies.
+     *
+     * Copy in_princ and mutate the copy per the matched rule.
+     *
+     * This way we apply to principals with two or more components, such as
+     * domain-based names.
+     */
+    ret = krb5_copy_principal(context, in_princ, out_princ);
+    if (ret)
+        goto out;
+
+    if (new_realm == NULL && (rule->options & KRB5_NCRO_LOOKUP_REALM) != 0) {
+        ret = get_host_realm(context, new_hostname, &tmp_realm);
+        if (ret)
+            goto out;
+        new_realm = tmp_realm;
+    }
+
+    /* If we stripped off a :port, add it back in */
+    if (port != NULL && new_hostname != NULL) {
+        if (asprintf(&hostname_with_port, "%s%s", new_hostname, port) == -1 ||
+            hostname_with_port == NULL) {
+            ret = krb5_enomem(context);
+            goto out;
+        }
+        new_hostname = hostname_with_port;
+    }
+
+    if (new_realm != NULL)
+        krb5_principal_set_realm(context, *out_princ, new_realm);
+    if (new_hostname != NULL)
+        krb5_principal_set_comp_string(context, *out_princ, 1, new_hostname);
+    if (princ_type(*out_princ) == KRB5_NT_SRV_HST_NEEDS_CANON)
+        princ_type(*out_princ) = KRB5_NT_SRV_HST;
+
+    /* Trace rule application */
+    {
+	krb5_error_code ret2;
+	char *unparsed;
+
+	ret2 = krb5_unparse_name(context, *out_princ, &unparsed);
+	if (ret2) {
+	    _krb5_debug(context, 5,
+                        N_("Couldn't unparse canonicalized princicpal (%d)",
+                           ""),
+                        ret);
+	} else {
+	    _krb5_debug(context, 5,
+                        N_("Name canon rule application yields %s", ""),
+                        unparsed);
+	    free(unparsed);
+	}
+    }
+
+out:
+    free(hostname_sans_port);
+    free(hostname_with_port);
+    free(tmp_hostname);
+    free(tmp_realm);
+    krb5_free_principal(context, nss);
+    if (ret)
+	krb5_set_error_message(context, ret,
+			       N_("Name canon rule application failed", ""));
+    return ret;
+}
+
+/**
+ * Free name canonicalization rules
+ */
+KRB5_LIB_FUNCTION void
+_krb5_free_name_canon_rules(krb5_context context, krb5_name_canon_rule rules)
+{
+    size_t k;
+
+    if (rules == NULL)
+        return;
+
+    for (k = 0; rules[k].type != KRB5_NCRT_BOGUS; k++) {
+	free(rules[k].match_domain);
+	free(rules[k].match_realm);
+	free(rules[k].domain);
+	free(rules[k].realm);
+    }
+    free(rules);
+}
+
+struct krb5_name_canon_iterator_data {
+    krb5_name_canon_rule	rules;
+    krb5_const_principal	in_princ;   /* given princ */
+    krb5_const_principal	out_princ;  /* princ to be output */
+    krb5_principal		tmp_princ;  /* to be freed */
+    int				is_trivial; /* no canon to be done */
+    int				done;       /* no more rules to be applied */
+    size_t                      cursor;     /* current/next rule */
+};
+
+/**
+ * Initialize name canonicalization iterator.
+ *
+ * @param context   Kerberos context
+ * @param in_princ  principal name to be canonicalized OR
+ * @param iter	    output iterator object
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_name_canon_iterator_start(krb5_context context,
+			       krb5_const_principal in_princ,
+			       krb5_name_canon_iterator *iter)
+{
+    krb5_error_code ret;
+    krb5_name_canon_iterator state;
+
+    *iter = NULL;
+
+    state = calloc(1, sizeof (*state));
+    if (state == NULL)
+	return krb5_enomem(context);
+    state->in_princ = in_princ;
+
+    if (princ_type(state->in_princ) == KRB5_NT_SRV_HST_NEEDS_CANON) {
+	ret = _krb5_get_name_canon_rules(context, &state->rules);
+	if (ret)
+	    goto out;
+    } else {
+	/* Name needs no canon -> trivial iterator: in_princ is canonical */
+	state->is_trivial = 1;
+    }
+
+    *iter = state;
+    return 0;
+
+out:
+    krb5_free_name_canon_iterator(context, state);
+    return krb5_enomem(context);
+}
+
+/*
+ * Helper for name canon iteration.
+ */
+static krb5_error_code
+name_canon_iterate(krb5_context context,
+                   krb5_name_canon_iterator *iter,
+                   krb5_name_canon_rule_options *rule_opts)
+{
+    krb5_error_code ret;
+    krb5_name_canon_iterator state = *iter;
+
+    if (rule_opts)
+	*rule_opts = 0;
+
+    if (state == NULL)
+	return 0;
+
+    if (state->done) {
+	krb5_free_name_canon_iterator(context, state);
+	*iter = NULL;
+	return 0;
+    }
+
+    if (state->is_trivial && !state->done) {
+        state->out_princ = state->in_princ;
+	state->done = 1;
+	return 0;
+    }
+
+    heim_assert(state->rules != NULL &&
+                state->rules[state->cursor].type != KRB5_NCRT_BOGUS,
+                "Internal error during name canonicalization");
+
+    do {
+	krb5_free_principal(context, state->tmp_princ);
+	ret = apply_name_canon_rule(context, state->rules, state->cursor,
+	    state->in_princ, &state->tmp_princ, rule_opts);
+	if (ret) {
+            krb5_free_name_canon_iterator(context, state);
+            *iter = NULL;
+	    return ret;
+        }
+	state->cursor++;
+    } while (state->tmp_princ == NULL &&
+             state->rules[state->cursor].type != KRB5_NCRT_BOGUS);
+
+    if (state->rules[state->cursor].type == KRB5_NCRT_BOGUS)
+        state->done = 1;
+
+    state->out_princ = state->tmp_princ;
+    if (state->tmp_princ == NULL) {
+	krb5_free_name_canon_iterator(context, state);
+	*iter = NULL;
+	return 0;
+    }
+    return 0;
+}
+
+/**
+ * Iteratively apply name canon rules, outputing a principal and rule
+ * options each time.  Iteration completes when the @iter is NULL on
+ * return or when an error is returned.  Callers must free the iterator
+ * if they abandon it mid-way.
+ *
+ * @param context   Kerberos context
+ * @param iter	    name canon rule iterator (input/output)
+ * @param try_princ output principal name
+ * @param rule_opts output rule options
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_name_canon_iterate(krb5_context context,
+                        krb5_name_canon_iterator *iter,
+                        krb5_const_principal *try_princ,
+                        krb5_name_canon_rule_options *rule_opts)
+{
+    krb5_error_code ret;
+
+    *try_princ = NULL;
+
+    ret = name_canon_iterate(context, iter, rule_opts);
+    if (*iter)
+	*try_princ = (*iter)->out_princ;
+    return ret;
+}
+
+/**
+ * Free a name canonicalization rule iterator.
+ */
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_free_name_canon_iterator(krb5_context context,
+			      krb5_name_canon_iterator iter)
+{
+    if (iter == NULL)
+	return;
+    if (iter->tmp_princ)
+        krb5_free_principal(context, iter->tmp_princ);
+    free(iter);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/prog_setup.c b/crypto/external/bsd/heimdal/dist/lib/krb5/prog_setup.c
index 7853abc80..b9e8376ff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/prog_setup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/prog_setup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: prog_setup.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: prog_setup.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/prompter_posix.c b/crypto/external/bsd/heimdal/dist/lib/krb5/prompter_posix.c
index d38a74938..b330dbae0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/prompter_posix.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/prompter_posix.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: prompter_posix.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: prompter_posix.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/pseudo-random-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/pseudo-random-test.c
new file mode 100644
index 000000000..b15e276e4
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/pseudo-random-test.c
@@ -0,0 +1,114 @@
+/*	$NetBSD: pseudo-random-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2001 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of KTH nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
+
+#include "krb5_locl.h"
+#include <err.h>
+
+enum { MAXSIZE = 48 };
+
+static struct testcase {
+    krb5_enctype enctype;
+    unsigned char constant[MAXSIZE];
+    size_t constant_len;
+    unsigned char key[MAXSIZE];
+    unsigned char res[MAXSIZE];
+} tests[] = {
+    {ETYPE_AES128_CTS_HMAC_SHA256_128, "test", 4,
+     {0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28, 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C},
+     {0x9D, 0x18, 0x86, 0x16, 0xF6, 0x38, 0x52, 0xFE, 0x86, 0x91, 0x5B, 0xB8, 0x40, 0xB4, 0xA8, 0x86,
+      0xFF, 0x3E, 0x6B, 0xB0, 0xF8, 0x19, 0xB4, 0x9B, 0x89, 0x33, 0x93, 0xD3, 0x93, 0x85, 0x42, 0x95}},
+    {ETYPE_AES256_CTS_HMAC_SHA384_192, "test", 4,
+     {0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D, 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
+      0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0, 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52},
+     {0x98, 0x01, 0xF6, 0x9A, 0x36, 0x8C, 0x2B, 0xF6, 0x75, 0xE5, 0x95, 0x21, 0xE1, 0x77, 0xD9, 0xA0,
+      0x7F, 0x67, 0xEF, 0xE1, 0xCF, 0xDE, 0x8D, 0x3C, 0x8D, 0x6F, 0x6A, 0x02, 0x56, 0xE3, 0xB1, 0x7D,
+      0xB3, 0xC1, 0xB6, 0x2A, 0xD1, 0xB8, 0x55, 0x33, 0x60, 0xD1, 0x73, 0x67, 0xEB, 0x15, 0x14, 0xD2}},
+    {0, {0}, 0, {0}, {0}}
+};
+
+int
+main(int argc, char **argv)
+{
+    struct testcase *t;
+    krb5_context context;
+    krb5_error_code ret;
+    int val = 0;
+
+    ret = krb5_init_context (&context);
+    if (ret)
+	errx (1, "krb5_init_context failed: %d", ret);
+
+    for (t = tests; t->enctype != 0; ++t) {
+	krb5_keyblock key;
+	krb5_crypto crypto;
+	krb5_data constant, prf;
+
+	krb5_data_zero(&prf);
+
+	key.keytype = t->enctype;
+	krb5_enctype_keysize(context, t->enctype, &key.keyvalue.length);
+	key.keyvalue.data   = t->key;
+
+	ret = krb5_crypto_init(context, &key, 0, &crypto);
+	if (ret)
+	    krb5_err (context, 1, ret, "krb5_crypto_init");
+
+	constant.data = t->constant;
+	constant.length = t->constant_len;
+
+	ret = krb5_crypto_prf(context, crypto, &constant, &prf);
+	if (ret)
+	    krb5_err (context, 1, ret, "krb5_crypto_prf");
+
+	if (memcmp(prf.data, t->res, prf.length) != 0) {
+	    const unsigned char *p = prf.data;
+	    int i;
+
+	    printf ("PRF failed (enctype %d)\n", t->enctype);
+	    printf ("should be: ");
+	    for (i = 0; i < prf.length; ++i)
+		printf ("%02x", t->res[i]);
+	    printf ("\nresult was: ");
+	    for (i = 0; i < prf.length; ++i)
+		printf ("%02x", p[i]);
+	    printf ("\n");
+	    val = 1;
+	}
+	krb5_data_free(&prf);
+	krb5_crypto_destroy(context, crypto);
+    }
+    krb5_free_context(context);
+
+    return val;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_cred.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_cred.c
index 2004a5e1e..bd1396791 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_cred.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_cred.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_cred.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: rd_cred.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
@@ -98,7 +98,7 @@ krb5_rd_cred(krb5_context context,
 	goto out;
     }
 
-    if (cred.enc_part.etype == ETYPE_NULL) {
+    if (cred.enc_part.etype == (krb5_enctype)ETYPE_NULL) {
 	/* DK: MIT GSS-API Compatibility */
 	enc_krb_cred_part_data.length = cred.enc_part.cipher.length;
 	enc_krb_cred_part_data.data   = cred.enc_part.cipher.data;
@@ -224,7 +224,7 @@ krb5_rd_cred(krb5_context context,
 
 	if (enc_krb_cred_part.timestamp == NULL ||
 	    enc_krb_cred_part.usec      == NULL ||
-	    abs(*enc_krb_cred_part.timestamp - sec)
+	    labs(*enc_krb_cred_part.timestamp - sec)
 	    > context->max_skew) {
 	    krb5_clear_error_message (context);
 	    ret = KRB5KRB_AP_ERR_SKEW;
@@ -251,9 +251,7 @@ krb5_rd_cred(krb5_context context,
 			sizeof(**ret_creds));
 
     if (*ret_creds == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret,
-			       N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -263,9 +261,7 @@ krb5_rd_cred(krb5_context context,
 
 	creds = calloc(1, sizeof(*creds));
 	if(creds == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_message(context, ret,
-				   N_("malloc: out of memory", ""));
+	    ret = krb5_enomem(context);
 	    goto out;
 	}
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_error.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_error.c
index 93c28c146..dbce95960 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_error.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_error.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_error.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: rd_error.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_priv.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_priv.c
index 0858bf8e7..1c9518aeb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_priv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_priv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_priv.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: rd_priv.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -138,7 +138,7 @@ krb5_rd_priv(krb5_context context,
 	krb5_timeofday (context, &sec);
 	if (part.timestamp == NULL ||
 	    part.usec      == NULL ||
-	    abs(*part.timestamp - sec) > context->max_skew) {
+	    labs(*part.timestamp - sec) > context->max_skew) {
 	    krb5_clear_error_message (context);
 	    ret = KRB5KRB_AP_ERR_SKEW;
 	    goto failure_part;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_rep.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_rep.c
index 3f52027ec..81175793b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_rep.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_rep.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_rep.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: rd_rep.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -47,6 +47,7 @@ krb5_rd_rep(krb5_context context,
     krb5_data data;
     krb5_crypto crypto;
 
+    *repl = NULL;
     krb5_data_zero (&data);
 
     ret = decode_AP_REP(inbuf->data, inbuf->length, &ap_rep, &len);
@@ -66,35 +67,32 @@ krb5_rd_rep(krb5_context context,
     ret = krb5_crypto_init(context, auth_context->keyblock, 0, &crypto);
     if (ret)
 	goto out;
-    ret = krb5_decrypt_EncryptedData (context,
-				      crypto,
-				      KRB5_KU_AP_REQ_ENC_PART,
-				      &ap_rep.enc_part,
-				      &data);
+    ret = krb5_decrypt_EncryptedData(context,
+				     crypto,
+				     KRB5_KU_AP_REQ_ENC_PART,
+				     &ap_rep.enc_part,
+				     &data);
     krb5_crypto_destroy(context, crypto);
     if (ret)
 	goto out;
 
     *repl = malloc(sizeof(**repl));
     if (*repl == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
     ret = decode_EncAPRepPart(data.data, data.length, *repl, &len);
     if (ret) {
 	krb5_set_error_message(context, ret, N_("Failed to decode EncAPRepPart", ""));
-	return ret;
+        goto out;
     }
 
     if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
 	if ((*repl)->ctime != auth_context->authenticator->ctime ||
 	    (*repl)->cusec != auth_context->authenticator->cusec)
 	{
-	    krb5_free_ap_rep_enc_part(context, *repl);
-	    *repl = NULL;
 	    ret = KRB5KRB_AP_ERR_MUT_FAIL;
-	    krb5_clear_error_message (context);
+	    krb5_clear_error_message(context);
 	    goto out;
 	}
     }
@@ -105,8 +103,12 @@ krb5_rd_rep(krb5_context context,
 	krb5_auth_con_setremotesubkey(context, auth_context, (*repl)->subkey);
 
  out:
-    krb5_data_free (&data);
-    free_AP_REP (&ap_rep);
+    if (ret) {
+        krb5_free_ap_rep_enc_part(context, *repl);
+        *repl = NULL;
+    }
+    krb5_data_free(&data);
+    free_AP_REP(&ap_rep);
     return ret;
 }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_req.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_req.c
index 260c146b5..d22032a16 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_req.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_req.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_req.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: rd_req.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 
 /*
@@ -175,50 +175,17 @@ find_etypelist(krb5_context context,
 	       EtypeList *etypes)
 {
     krb5_error_code ret;
-    krb5_authdata *ad;
-    krb5_authdata adIfRelevant;
-    unsigned i;
-
-    memset(&adIfRelevant, 0, sizeof(adIfRelevant));
-
-    etypes->len = 0;
-    etypes->val = NULL;
-
-    ad = auth_context->authenticator->authorization_data;
-    if (ad == NULL)
-	return 0;
-
-    for (i = 0; i < ad->len; i++) {
-	if (ad->val[i].ad_type == KRB5_AUTHDATA_IF_RELEVANT) {
-	    ret = decode_AD_IF_RELEVANT(ad->val[i].ad_data.data,
-					ad->val[i].ad_data.length,
-					&adIfRelevant,
-					NULL);
-	    if (ret)
-		return ret;
-
-	    if (adIfRelevant.len == 1 &&
-		adIfRelevant.val[0].ad_type ==
-			KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION) {
-		break;
-	    }
-	    free_AD_IF_RELEVANT(&adIfRelevant);
-	    adIfRelevant.len = 0;
-	}
-    }
-
-    if (adIfRelevant.len == 0)
-	return 0;
-
-    ret = decode_EtypeList(adIfRelevant.val[0].ad_data.data,
-			   adIfRelevant.val[0].ad_data.length,
-			   etypes,
-			   NULL);
+    krb5_data data;
+  
+    ret = _krb5_get_ad(context, auth_context->authenticator->authorization_data, NULL, KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION, &data);
     if (ret)
-	krb5_clear_error_message(context);
-
-    free_AD_IF_RELEVANT(&adIfRelevant);
-
+  	return 0;
+    
+    ret = decode_EtypeList(data.data, data.length, etypes, NULL);
+    krb5_data_free(&data);
+    if (ret)
+  	krb5_clear_error_message(context);
+    
     return ret;
 }
 
@@ -278,33 +245,26 @@ krb5_verify_authenticator_checksum(krb5_context context,
 				   size_t len)
 {
     krb5_error_code ret;
-    krb5_keyblock *key;
+    krb5_keyblock *key = NULL;
     krb5_authenticator authenticator;
     krb5_crypto crypto;
 
-    ret = krb5_auth_con_getauthenticator (context,
-				      ac,
-				      &authenticator);
-    if(ret)
+    ret = krb5_auth_con_getauthenticator(context, ac, &authenticator);
+    if (ret)
 	return ret;
-    if(authenticator->cksum == NULL) {
-	krb5_free_authenticator(context, &authenticator);
-	return -17;
+    if (authenticator->cksum == NULL) {
+	ret = -17;
+        goto out;
     }
     ret = krb5_auth_con_getkey(context, ac, &key);
-    if(ret) {
-	krb5_free_authenticator(context, &authenticator);
-	return ret;
-    }
+    if (ret)
+        goto out;
     ret = krb5_crypto_init(context, key, 0, &crypto);
-    if(ret)
+    if (ret)
 	goto out;
-    ret = krb5_verify_checksum (context,
-				crypto,
-				KRB5_KU_AP_REQ_AUTH_CKSUM,
-				data,
-				len,
-				authenticator->cksum);
+    ret = krb5_verify_checksum(context, crypto,
+                               KRB5_KU_AP_REQ_AUTH_CKSUM,
+                               data, len, authenticator->cksum);
     krb5_crypto_destroy(context, crypto);
 out:
     krb5_free_authenticator(context, &authenticator);
@@ -350,6 +310,8 @@ krb5_verify_ap_req2(krb5_context context,
     krb5_error_code ret;
     EtypeList etypes;
 
+    memset(&etypes, 0, sizeof(etypes));
+
     if (ticket)
 	*ticket = NULL;
 
@@ -363,8 +325,7 @@ krb5_verify_ap_req2(krb5_context context,
 
     t = calloc(1, sizeof(*t));
     if (t == NULL) {
-	ret = ENOMEM;
-	krb5_clear_error_message (context);
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -443,7 +404,7 @@ krb5_verify_ap_req2(krb5_context context,
 
 	krb5_timeofday (context, &now);
 
-	if (abs(ac->authenticator->ctime - now) > context->max_skew) {
+	if (labs(ac->authenticator->ctime - now) > context->max_skew) {
 	    ret = KRB5KRB_AP_ERR_SKEW;
 	    krb5_clear_error_message (context);
 	    goto out;
@@ -486,7 +447,7 @@ krb5_verify_ap_req2(krb5_context context,
 
     if (ap_req_options) {
 	*ap_req_options = 0;
-	if (ac->keytype != ETYPE_NULL)
+	if (ac->keytype != (krb5_enctype)ETYPE_NULL)
 	    *ap_req_options |= AP_OPTS_USE_SUBKEY;
 	if (ap_req->ap_options.use_session_key)
 	    *ap_req_options |= AP_OPTS_USE_SESSION_KEY;
@@ -506,6 +467,7 @@ krb5_verify_ap_req2(krb5_context context,
     free_EtypeList(&etypes);
     return 0;
  out:
+    free_EtypeList(&etypes);
     if (t)
 	krb5_free_ticket (context, t);
     if (auth_context == NULL || *auth_context == NULL)
@@ -547,11 +509,8 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_in_ctx_alloc(krb5_context context, krb5_rd_req_in_ctx *ctx)
 {
     *ctx = calloc(1, sizeof(**ctx));
-    if (*ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*ctx == NULL)
+	return krb5_enomem(context);
     (*ctx)->check_pac = (context->flags & KRB5_CTX_F_CHECK_PAC) ? 1 : 0;
     return 0;
 }
@@ -682,10 +641,22 @@ krb5_rd_req_out_ctx_free(krb5_context context, krb5_rd_req_out_ctx ctx)
     free(ctx);
 }
 
-/*
+/**
+ * Process an AP_REQ message.
  *
+ * @param context        Kerberos 5 context.
+ * @param auth_context   authentication context of the peer.
+ * @param inbuf          the AP_REQ message, obtained for example with krb5_read_message().
+ * @param server         server principal.
+ * @param keytab         server keytab.
+ * @param ap_req_options set to the AP_REQ options. See the AP_OPTS_* defines.
+ * @param ticket         on success, set to the authenticated client credentials.
+ *                       Must be deallocated with krb5_free_ticket(). If not
+ *                       interested, pass a NULL value.
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
  */
-
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req(krb5_context context,
 	    krb5_auth_context *auth_context,
@@ -824,12 +795,12 @@ out:
  *        default values for the authentication context will used.
  * @param inbuf the (AP-REQ) authentication buffer
  *
- * @param server the server with authenticate as, if NULL the function
+ * @param server the server to authenticate to. If NULL the function
  *        will try to find any available credential in the keytab
  *        that will verify the reply. The function will prefer the
- *        server the server client specified in the AP-REQ, but if
+ *        server specified in the AP-REQ, but if
  *        there is no mach, it will try all keytab entries for a
- *        match. This have serious performance issues for larger keytabs.
+ *        match. This has serious performance issues for large keytabs.
  *
  * @param inctx control the behavior of the function, if NULL, the
  *        default behavior is used.
@@ -856,11 +827,8 @@ krb5_rd_req_ctx(krb5_context context,
     *outctx = NULL;
 
     o = calloc(1, sizeof(*o));
-    if (o == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (o == NULL)
+	return krb5_enomem(context);
 
     if (*auth_context == NULL) {
 	ret = krb5_auth_con_init(context, auth_context);
@@ -872,7 +840,7 @@ krb5_rd_req_ctx(krb5_context context,
     if(ret)
 	goto out;
 
-    /* Save that principal that was in the request */
+    /* Save the principal that was in the request */
     ret = _krb5_principalname2krb5_principal(context,
 					     &o->server,
 					     ap_req.ticket.sname,
@@ -984,7 +952,7 @@ krb5_rd_req_ctx(krb5_context context,
 		_krb5_kt_principal_not_found(context, ret, id, o->server,
 					     ap_req.ticket.enc_part.etype,
 					     kvno);
-		goto out;
+		break;
 	    }
 
 	    if (entry.keyblock.keytype != ap_req.ticket.enc_part.etype) {
@@ -1017,13 +985,13 @@ krb5_rd_req_ctx(krb5_context context,
 				     &o->keyblock);
 	    if (ret) {
 		krb5_kt_free_entry (context, &entry);
-		goto out;
+		break;
 	    }
 
 	    ret = krb5_copy_principal(context, entry.principal, &p);
 	    if (ret) {
 		krb5_kt_free_entry (context, &entry);
-		goto out;
+		break;
 	    }
 	    krb5_free_principal(context, o->ticket->server);
 	    o->ticket->server = p;
@@ -1033,6 +1001,8 @@ krb5_rd_req_ctx(krb5_context context,
 	    done = 1;
 	}
 	krb5_kt_end_seq_get (context, id, &cursor);
+        if (ret)
+            goto out;
     }
 
     /* If there is a PAC, verify its server signature */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_safe.c b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_safe.c
index 9ed35f395..b9a759465 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/rd_safe.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/rd_safe.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rd_safe.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: rd_safe.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
@@ -161,7 +161,7 @@ krb5_rd_safe(krb5_context context,
 
 	if (safe.safe_body.timestamp == NULL ||
 	    safe.safe_body.usec      == NULL ||
-	    abs(*safe.safe_body.timestamp - sec) > context->max_skew) {
+	    labs(*safe.safe_body.timestamp - sec) > context->max_skew) {
 	    ret = KRB5KRB_AP_ERR_SKEW;
 	    krb5_clear_error_message (context);
 	    goto failure;
@@ -193,8 +193,7 @@ krb5_rd_safe(krb5_context context,
     outbuf->length = safe.safe_body.user_data.length;
     outbuf->data   = malloc(outbuf->length);
     if (outbuf->data == NULL && outbuf->length != 0) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	krb5_data_zero(outbuf);
 	goto failure;
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/read_message.c b/crypto/external/bsd/heimdal/dist/lib/krb5/read_message.c
index 366327741..6af9989c3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/read_message.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/read_message.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: read_message.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: read_message.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/recvauth.c b/crypto/external/bsd/heimdal/dist/lib/krb5/recvauth.c
index 615820a63..5a89ee901 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/recvauth.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/recvauth.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: recvauth.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: recvauth.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
@@ -45,6 +45,24 @@ match_exact(const void *data, const char *appl_version)
     return strcmp(data, appl_version) == 0;
 }
 
+/**
+ * Perform the server side of the sendauth protocol.
+ *
+ * @param context       Kerberos 5 context.
+ * @param auth_context  authentication context of the peer.
+ * @param p_fd          socket associated to the connection.
+ * @param appl_version  server-specific string.
+ * @param server        server principal.
+ * @param flags         if KRB5_RECVAUTH_IGNORE_VERSION is set, skip the sendauth version
+ *                      part of the protocol.
+ * @param keytab        server keytab.
+ * @param ticket        on success, set to the authenticated client credentials.
+ *                      Must be deallocated with krb5_free_ticket(). If not
+ *                      interested, pass a NULL value.
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_recvauth(krb5_context context,
 	      krb5_auth_context *auth_context,
@@ -61,6 +79,11 @@ krb5_recvauth(krb5_context context,
 				       keytab, ticket);
 }
 
+/**
+ * Perform the server side of the sendauth protocol like krb5_recvauth(), but support
+ * a user-specified callback, \a match_appl_version, to perform the match of the application
+ * version \a match_data.
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_recvauth_match_version(krb5_context context,
 			    krb5_auth_context *auth_context,
@@ -99,10 +122,13 @@ krb5_recvauth_match_version(krb5_context context,
     if (ret)
 	return ret;
 
+    /*
+     * Expect SENDAUTH protocol version.
+     */
     if(!(flags & KRB5_RECVAUTH_IGNORE_VERSION)) {
 	n = krb5_net_read (context, p_fd, &len, 4);
 	if (n < 0) {
-	    ret = errno;
+	    ret = errno ? errno : EINVAL;
 	    krb5_set_error_message(context, ret, "read: %s", strerror(ret));
 	    return ret;
 	}
@@ -122,9 +148,12 @@ krb5_recvauth_match_version(krb5_context context,
 	}
     }
 
+    /*
+     * Expect application protocol version.
+     */
     n = krb5_net_read (context, p_fd, &len, 4);
     if (n < 0) {
-	ret = errno;
+	ret = errno ? errno : EINVAL;
 	krb5_set_error_message(context, ret, "read: %s", strerror(ret));
 	return ret;
     }
@@ -137,29 +166,38 @@ krb5_recvauth_match_version(krb5_context context,
     if (her_appl_version == NULL) {
 	repl = 2;
 	krb5_net_write (context, p_fd, &repl, 1);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     if (krb5_net_read (context, p_fd, her_appl_version, len) != len
 	|| !(*match_appl_version)(match_data, her_appl_version)) {
 	repl = 2;
 	krb5_net_write (context, p_fd, &repl, 1);
 	krb5_set_error_message(context, KRB5_SENDAUTH_BADAPPLVERS,
-			       N_("wrong sendauth version (%s)", ""),
+			       N_("wrong sendauth application version (%s)", ""),
 			       her_appl_version);
 	free (her_appl_version);
 	return KRB5_SENDAUTH_BADAPPLVERS;
     }
     free (her_appl_version);
 
+    /*
+     * Send OK.
+     */
     repl = 0;
     if (krb5_net_write (context, p_fd, &repl, 1) != 1) {
-	ret = errno;
+	ret = errno ? errno : EINVAL;
 	krb5_set_error_message(context, ret, "write: %s", strerror(ret));
 	return ret;
     }
 
+    /*
+     * Until here, the fields in the message were in cleartext and unauthenticated.
+     * From now on, Kerberos kicks in.
+     */
+
+    /*
+     * Expect AP_REQ.
+     */
     krb5_data_zero (&data);
     ret = krb5_read_message (context, p_fd, &data);
     if (ret)
@@ -193,15 +231,21 @@ krb5_recvauth_match_version(krb5_context context,
 	return ret;
     }
 
+    /*
+     * Send OK.
+     */
     len = 0;
     if (krb5_net_write (context, p_fd, &len, 4) != 4) {
-	ret = errno;
+	ret = errno ? errno : EINVAL;
 	krb5_set_error_message(context, ret, "write: %s", strerror(ret));
 	krb5_free_ticket(context, *ticket);
 	*ticket = NULL;
 	return ret;
     }
 
+    /*
+     * If client requires mutual authentication, send AP_REP.
+     */
     if (ap_options & AP_OPTS_MUTUAL_REQUIRED) {
 	ret = krb5_mk_rep (context, *auth_context, &data);
 	if (ret) {
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/replay.c b/crypto/external/bsd/heimdal/dist/lib/krb5/replay.c
index 712f84d63..921d13398 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/replay.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/replay.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: replay.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: replay.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
@@ -141,6 +141,7 @@ krb5_rc_initialize(krb5_context context,
 	krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
 	return ret;
     }
+    memset(&tmp, 0, sizeof(tmp));
     tmp.stamp = auth_lifespan;
     fwrite(&tmp, 1, sizeof(tmp), f);
     fclose(f);
@@ -207,6 +208,7 @@ krb5_rc_store(krb5_context context,
     time_t t;
     FILE *f;
     int ret;
+    size_t count;
 
     ent.stamp = time(NULL);
     checksum_authenticator(rep, ent.data);
@@ -219,7 +221,9 @@ krb5_rc_store(krb5_context context,
 	return ret;
     }
     rk_cloexec_file(f);
-    fread(&tmp, sizeof(ent), 1, f);
+    count = fread(&tmp, sizeof(ent), 1, f);
+    if(count != 1)
+	return KRB5_RC_IO_UNKNOWN;
     t = ent.stamp - tmp.stamp;
     while(fread(&tmp, sizeof(ent), 1, f)){
 	if(tmp.stamp < t)
@@ -303,11 +307,8 @@ krb5_get_server_rcache(krb5_context context,
     char *tmp = malloc(4 * piece->length + 1);
     char *name;
 
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (tmp == NULL)
+	return krb5_enomem(context);
     strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL);
 #ifdef HAVE_GETEUID
     ret = asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid());
@@ -315,11 +316,8 @@ krb5_get_server_rcache(krb5_context context,
     ret = asprintf(&name, "FILE:rc_%s", tmp);
 #endif
     free(tmp);
-    if(ret < 0 || name == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ret < 0 || name == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_rc_resolve_full(context, &rcache, name);
     free(name);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha1.c
similarity index 80%
rename from crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes.c
rename to crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha1.c
index 0298fadf9..48d51cfd9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha1.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: salt-aes.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: salt-aes-sha1.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -35,15 +35,15 @@
 
 #include "krb5_locl.h"
 
-int _krb5_AES_string_to_default_iterator = 4096;
+int _krb5_AES_SHA1_string_to_default_iterator = 4096;
 
 static krb5_error_code
-AES_string_to_key(krb5_context context,
-		  krb5_enctype enctype,
-		  krb5_data password,
-		  krb5_salt salt,
-		  krb5_data opaque,
-		  krb5_keyblock *key)
+AES_SHA1_string_to_key(krb5_context context,
+		       krb5_enctype enctype,
+		       krb5_data password,
+		       krb5_salt salt,
+		       krb5_data opaque,
+		       krb5_keyblock *key)
 {
     krb5_error_code ret;
     uint32_t iter;
@@ -51,7 +51,7 @@ AES_string_to_key(krb5_context context,
     struct _krb5_key_data kd;
 
     if (opaque.length == 0)
-	iter = _krb5_AES_string_to_default_iterator;
+	iter = _krb5_AES_SHA1_string_to_default_iterator;
     else if (opaque.length == 4) {
 	unsigned long v;
 	_krb5_get_int(opaque.data, &v, 4);
@@ -65,10 +65,8 @@ AES_string_to_key(krb5_context context,
 
     kd.schedule = NULL;
     ALLOC(kd.key, 1);
-    if(kd.key == NULL) {
-	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (kd.key == NULL)
+	return krb5_enomem(context);
     kd.key->keytype = enctype;
     ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
     if (ret) {
@@ -76,10 +74,11 @@ AES_string_to_key(krb5_context context,
 	return ret;
     }
 
-    ret = PKCS5_PBKDF2_HMAC_SHA1(password.data, password.length,
-				 salt.saltvalue.data, salt.saltvalue.length,
-				 iter,
-				 et->keytype->size, kd.key->keyvalue.data);
+    ret = PKCS5_PBKDF2_HMAC(password.data, password.length,
+			    salt.saltvalue.data, salt.saltvalue.length,
+			    iter,
+			    EVP_sha1(),
+			    et->keytype->size, kd.key->keyvalue.data);
     if (ret != 1) {
 	_krb5_free_key_data(context, &kd, et);
 	krb5_set_error_message(context, KRB5_PROG_KEYTYPE_NOSUPP,
@@ -95,11 +94,11 @@ AES_string_to_key(krb5_context context,
     return ret;
 }
 
-struct salt_type _krb5_AES_salt[] = {
+struct salt_type _krb5_AES_SHA1_salt[] = {
     {
 	KRB5_PW_SALT,
 	"pw-salt",
-	AES_string_to_key
+	AES_SHA1_string_to_key
     },
-    { 0 }
+    { 0, NULL, NULL }
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha2.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha2.c
new file mode 100644
index 000000000..c0d44c251
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-aes-sha2.c
@@ -0,0 +1,137 @@
+/*	$NetBSD: salt-aes-sha2.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb5_locl.h"
+
+int _krb5_AES_SHA2_string_to_default_iterator = 32768;
+
+static krb5_error_code
+AES_SHA2_string_to_key(krb5_context context,
+		       krb5_enctype enctype,
+		       krb5_data password,
+		       krb5_salt salt,
+		       krb5_data opaque,
+		       krb5_keyblock *key)
+{
+    krb5_error_code ret;
+    uint32_t iter;
+    struct _krb5_encryption_type *et = NULL;
+    struct _krb5_key_data kd;
+    krb5_data saltp;
+    size_t enctypesz;
+    const EVP_MD *md = NULL;
+
+    krb5_data_zero(&saltp);
+    kd.key = NULL;
+    kd.schedule = NULL;
+
+    if (opaque.length == 0) {
+	iter = _krb5_AES_SHA2_string_to_default_iterator;
+    } else if (opaque.length == 4) {
+	unsigned long v;
+	_krb5_get_int(opaque.data, &v, 4);
+	iter = ((uint32_t)v);
+    } else {
+	ret = KRB5_PROG_KEYTYPE_NOSUPP; /* XXX */
+	goto cleanup;
+    }
+
+    et = _krb5_find_enctype(enctype);
+    if (et == NULL) {
+	ret = KRB5_PROG_KEYTYPE_NOSUPP;
+	goto cleanup;
+    }
+
+    kd.schedule = NULL;
+    ALLOC(kd.key, 1);
+    if (kd.key == NULL) {
+	ret = krb5_enomem(context);
+	goto cleanup;
+    }
+    kd.key->keytype = enctype;
+    ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
+    if (ret) {
+	ret = krb5_enomem(context);
+	goto cleanup;
+    }
+
+    enctypesz = strlen(et->name) + 1;
+    ret = krb5_data_alloc(&saltp, enctypesz + salt.saltvalue.length);
+    if (ret) {
+	ret = krb5_enomem(context);
+	goto cleanup;
+    }
+    memcpy(saltp.data, et->name, enctypesz);
+    memcpy((unsigned char *)saltp.data + enctypesz,
+	   salt.saltvalue.data, salt.saltvalue.length);
+
+    ret = _krb5_aes_sha2_md_for_enctype(context, enctype, &md);
+    if (ret)
+	goto cleanup;
+
+    ret = PKCS5_PBKDF2_HMAC(password.data, password.length,
+			    saltp.data, saltp.length,
+			    iter, md,
+			    et->keytype->size, kd.key->keyvalue.data);
+    if (ret != 1) {
+	krb5_set_error_message(context, KRB5_PROG_KEYTYPE_NOSUPP,
+			       "Error calculating s2k");
+	ret = KRB5_PROG_KEYTYPE_NOSUPP;
+	goto cleanup;
+    }
+
+    ret = _krb5_derive_key(context, et, &kd, "kerberos", strlen("kerberos"));
+    if (ret)
+	goto cleanup;
+
+    ret = krb5_copy_keyblock_contents(context, kd.key, key);
+    if (ret)
+	goto cleanup;
+
+cleanup:
+    krb5_data_free(&saltp);
+    _krb5_free_key_data(context, &kd, et);
+
+    return ret;
+}
+
+struct salt_type _krb5_AES_SHA2_salt[] = {
+    {
+	KRB5_PW_SALT,
+	"pw-salt",
+	AES_SHA2_string_to_key
+    },
+    { 0, NULL, NULL }
+};
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-arcfour.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-arcfour.c
index 22f2caaa3..be751f712 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-arcfour.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-arcfour.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: salt-arcfour.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: salt-arcfour.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -50,8 +50,7 @@ ARCFOUR_string_to_key(krb5_context context,
 
     m = EVP_MD_CTX_create();
     if (m == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+	ret = krb5_enomem(context);
 	goto out;
     }
 
@@ -60,22 +59,20 @@ ARCFOUR_string_to_key(krb5_context context,
     ret = wind_utf8ucs2_length(password.data, &len);
     if (ret) {
 	krb5_set_error_message (context, ret,
-				N_("Password not an UCS2 string", ""));
+				N_("Password is not valid UTF-8", ""));
 	goto out;
     }
 
     s = malloc (len * sizeof(s[0]));
     if (len != 0 && s == NULL) {
-	krb5_set_error_message (context, ENOMEM,
-				N_("malloc: out of memory", ""));
-	ret = ENOMEM;
+	ret = krb5_enomem(context);
 	goto out;
     }
 
     ret = wind_utf8ucs2(password.data, s, &len);
     if (ret) {
 	krb5_set_error_message (context, ret,
-				N_("Password not an UCS2 string", ""));
+				N_("Password is not valid UTF-8", ""));
 	goto out;
     }
 
@@ -91,7 +88,7 @@ ARCFOUR_string_to_key(krb5_context context,
     key->keytype = enctype;
     ret = krb5_data_alloc (&key->keyvalue, 16);
     if (ret) {
-	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
+	krb5_enomem(context);
 	goto out;
     }
     EVP_DigestFinal_ex (m, key->keyvalue.data, NULL);
@@ -110,5 +107,5 @@ struct salt_type _krb5_arcfour_salt[] = {
 	"pw-salt",
 	ARCFOUR_string_to_key
     },
-    { 0 }
+    { 0, NULL, NULL }
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des.c
index 6626b1dd0..71bbf2daf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: salt-des.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: salt-des.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -193,10 +193,8 @@ krb5_DES_string_to_key(krb5_context context,
 
     len = password.length + salt.saltvalue.length;
     s = malloc(len);
-    if(len > 0 && s == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (len > 0 && s == NULL)
+	return krb5_enomem(context);
     memcpy(s, password.data, password.length);
     memcpy(s + password.length, salt.saltvalue.data, salt.saltvalue.length);
     DES_string_to_key_int(s, len, &tmp);
@@ -221,6 +219,6 @@ struct salt_type _krb5_des_salt[] = {
 	DES_AFS3_string_to_key
     },
 #endif
-    { 0 }
+    { 0, NULL, NULL }
 };
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des3.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des3.c
index 655da8f1c..a2d4158cd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des3.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt-des3.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: salt-des3.c,v 1.1.1.1 2011/04/13 18:15:37 elric Exp $	*/
+/*	$NetBSD: salt-des3.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -52,10 +52,8 @@ DES3_string_to_key(krb5_context context,
 
     len = password.length + salt.saltvalue.length;
     str = malloc(len);
-    if(len != 0 && str == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (len != 0 && str == NULL)
+	return krb5_enomem(context);
     memcpy(str, password.data, password.length);
     memcpy(str + password.length, salt.saltvalue.data, salt.saltvalue.length);
     {
@@ -75,7 +73,7 @@ DES3_string_to_key(krb5_context context,
 	    memcpy(keys + i, tmp + i * 8, sizeof(keys[i]));
 	    DES_set_odd_parity(keys + i);
 	    if(DES_is_weak_key(keys + i))
-		_krb5_xor(keys + i, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
+		_krb5_xor8(*(keys + i), (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
 	    DES_set_key_unchecked(keys + i, &s[i]);
 	}
 	memset(&ivec, 0, sizeof(ivec));
@@ -88,7 +86,7 @@ DES3_string_to_key(krb5_context context,
 	    memcpy(keys + i, tmp + i * 8, sizeof(keys[i]));
 	    DES_set_odd_parity(keys + i);
 	    if(DES_is_weak_key(keys + i))
-		_krb5_xor(keys + i, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
+		_krb5_xor8(*(keys + i), (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
 	}
 	memset(tmp, 0, sizeof(tmp));
     }
@@ -114,10 +112,8 @@ DES3_string_to_key_derived(krb5_context context,
     char *s;
 
     s = malloc(len);
-    if(len != 0 && s == NULL) {
-	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (len != 0 && s == NULL)
+	return krb5_enomem(context);
     memcpy(s, password.data, password.length);
     memcpy(s + password.length, salt.saltvalue.data, salt.saltvalue.length);
     ret = krb5_string_to_key_derived(context,
@@ -138,7 +134,7 @@ struct salt_type _krb5_des3_salt[] = {
 	"pw-salt",
 	DES3_string_to_key
     },
-    { 0 }
+    { 0, NULL, NULL }
 };
 #endif
 
@@ -148,5 +144,5 @@ struct salt_type _krb5_des3_salt_derived[] = {
 	"pw-salt",
 	DES3_string_to_key_derived
     },
-    { 0 }
+    { 0, NULL, NULL }
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c b/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c
index fda9ee205..02f8fd709 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: salt.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: salt.c,v 1.4 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -45,6 +45,7 @@ krb5_salttype_to_string (krb5_context context,
     struct _krb5_encryption_type *e;
     struct salt_type *st;
 
+    *string = NULL;
     e = _krb5_find_enctype (etype);
     if (e == NULL) {
 	krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
@@ -55,11 +56,8 @@ krb5_salttype_to_string (krb5_context context,
     for (st = e->keytype->string_to_key; st && st->type; st++) {
 	if (st->type == stype) {
 	    *string = strdup (st->name);
-	    if (*string == NULL) {
-		krb5_set_error_message (context, ENOMEM,
-					N_("malloc: out of memory", ""));
-		return ENOMEM;
-	    }
+	    if (*string == NULL)
+		return krb5_enomem(context);
 	    return 0;
 	}
     }
@@ -265,11 +263,8 @@ krb5_string_to_key_derived(krb5_context context,
     keylen = et->keytype->bits / 8;
 
     ALLOC(kd.key, 1);
-    if(kd.key == NULL) {
-	krb5_set_error_message (context, ENOMEM,
-				N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (kd.key == NULL)
+	return krb5_enomem(context);
     ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
     if(ret) {
 	free(kd.key);
@@ -279,13 +274,12 @@ krb5_string_to_key_derived(krb5_context context,
     tmp = malloc (keylen);
     if(tmp == NULL) {
 	krb5_free_keyblock(context, kd.key);
-	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     ret = _krb5_n_fold(str, len, tmp, keylen);
     if (ret) {
 	free(tmp);
-	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
+	krb5_enomem(context);
 	return ret;
     }
     kd.schedule = NULL;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/scache.c b/crypto/external/bsd/heimdal/dist/lib/krb5/scache.c
index f91e4d441..df267bcb8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/scache.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/scache.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: scache.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: scache.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -311,7 +311,6 @@ scc_alloc(krb5_context context, const char *name)
 	char *file;
 
 	if (*name == '\0') {
-	    krb5_error_code ret;
 	    ret = get_def_name(context, &s->name);
 	    if (ret)
 		s->name = strdup(SCACHE_DEF_NAME);
@@ -659,12 +658,10 @@ encode_creds(krb5_context context, krb5_creds *creds, krb5_data *data)
     krb5_error_code ret;
     krb5_storage *sp;
 
+    krb5_data_zero(data);
     sp = krb5_storage_emem();
-    if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (sp == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_store_creds(sp, creds);
     if (ret) {
@@ -690,11 +687,8 @@ decode_creds(krb5_context context, const void *data, size_t length,
     krb5_storage *sp;
 
     sp = krb5_storage_from_readonly_mem(data, length);
-    if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (sp == NULL)
+	return krb5_enomem(context);
 
     ret = krb5_ret_creds(sp, creds);
     krb5_storage_free(sp);
@@ -884,11 +878,8 @@ scc_get_first (krb5_context context,
     *cursor = NULL;
 
     ctx = calloc(1, sizeof(*ctx));
-    if (ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ctx == NULL)
+	return krb5_enomem(context);
 
     ret = make_database(context, s);
     if (ret) {
@@ -907,19 +898,15 @@ scc_get_first (krb5_context context,
     ret = asprintf(&name, "credIteration%pPid%d",
                    ctx, (int)getpid());
     if (ret < 0 || name == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = asprintf(&ctx->drop, "DROP TABLE %s", name);
     if (ret < 0 || ctx->drop == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	free(name);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = asprintf(&str, "CREATE TEMPORARY TABLE %s "
@@ -929,7 +916,7 @@ scc_get_first (krb5_context context,
 	free(ctx->drop);
 	free(name);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = exec_stmt(context, s->db, str, KRB5_CC_IO);
@@ -1163,11 +1150,8 @@ scc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
     *cursor = NULL;
 
     ctx = calloc(1, sizeof(*ctx));
-    if (ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ctx == NULL)
+	return krb5_enomem(context);
 
     ret = default_db(context, &ctx->db);
     if (ctx->db == NULL) {
@@ -1178,33 +1162,27 @@ scc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
     ret = asprintf(&name, "cacheIteration%pPid%d",
                    ctx, (int)getpid());
     if (ret < 0 || name == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	sqlite3_close(ctx->db);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = asprintf(&ctx->drop, "DROP TABLE %s", name);
     if (ret < 0 || ctx->drop == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	sqlite3_close(ctx->db);
 	free(name);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = asprintf(&str, "CREATE TEMPORARY TABLE %s AS SELECT name FROM caches",
 	     name);
     if (ret < 0 || str == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
 	sqlite3_close(ctx->db);
 	free(name);
 	free(ctx->drop);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
 
     ret = exec_stmt(context, ctx->db, str, KRB5_CC_IO);
@@ -1219,15 +1197,15 @@ scc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
     }
 
     ret = asprintf(&str, "SELECT name FROM %s", name);
-    free(name);
     if (ret < 0 || str == NULL) {
 	exec_stmt(context, ctx->db, ctx->drop, 0);
 	sqlite3_close(ctx->db);
 	free(name);
 	free(ctx->drop);
 	free(ctx);
-	return ENOMEM;
+	return krb5_enomem(context);
     }
+    free(name);
 
     ret = prepare_stmt(context, ctx->db, &ctx->stmt, str);
     free(str);
@@ -1375,11 +1353,8 @@ scc_get_default_name(krb5_context context, char **str)
 
     ret = asprintf(str, "SCC:%s", name);
     free(name);
-    if (ret < 0 || *str == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (ret < 0 || *str == NULL)
+	return krb5_enomem(context);
     return 0;
 }
 
@@ -1447,7 +1422,10 @@ KRB5_LIB_VARIABLE const krb5_cc_ops krb5_scc_ops = {
     scc_end_cache_get,
     scc_move,
     scc_get_default_name,
-    scc_set_default
+    scc_set_default,
+    NULL,
+    NULL,
+    NULL
 };
 
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc.c b/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc.c
index 2d81341c7..d506cc86b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc.c
@@ -1,10 +1,12 @@
-/*	$NetBSD: send_to_kdc.c,v 1.3 2014/05/12 18:46:27 christos Exp $	*/
+/*	$NetBSD: send_to_kdc.c,v 1.7 2017/01/30 00:25:15 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
+ * Portions Copyright (c) 2010 - 2013 Apple Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -36,564 +38,154 @@
 #include "krb5_locl.h"
 #include "send_to_kdc_plugin.h"
 
-struct send_to_kdc {
-    krb5_send_to_kdc_func func;
-    void *data;
-};
-
-/*
- * connect to a remote host and in the case of stream sockets, provide
- * a timeout for the connexion.
+/**
+ * @section send_to_kdc Locating and sending packets to the KDC
+ *
+ * The send to kdc code is responsible to request the list of KDC from
+ * the locate-kdc subsystem and then send requests to each of them.
+ *
+ * - Each second a new hostname is tried.
+ * - If the hostname have several addresses, the first will be tried
+ *   directly then in turn the other will be tried every 3 seconds
+ *   (host_timeout).
+ * - UDP requests are tried 3 times, and it tried with a individual timeout of kdc_timeout / 3.
+ * - TCP and HTTP requests are tried 1 time.
+ *
+ *  Total wait time shorter then (number of addresses * 3) + kdc_timeout seconds.
+ *
  */
 
-static int
-timed_connect(int s, struct addrinfo *addr, time_t tmout)
-{
-#ifdef HAVE_POLL
-    socklen_t sl;
-    int err;
-    int flags;
-    int ret;
-
-    if (addr->ai_socktype != SOCK_STREAM)
-	return connect(s, addr->ai_addr, addr->ai_addrlen);
-
-    flags = fcntl(s, F_GETFL);
-    if (flags == -1)
-	return -1;
-
-    if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
-	return -1;
-    ret = connect(s, addr->ai_addr, addr->ai_addrlen);
-    if (ret == -1 && errno != EINPROGRESS)
-	return -1;
-
-    for (;;) {
-	struct pollfd fds;
-
-	fds.fd = s;
-	fds.events = POLLIN | POLLOUT;
-	fds.revents = 0;
-
-	ret = poll(&fds, 1, tmout * 1000);
-	if (ret != -1 || errno != EINTR)
-	    break;
-    }
-    if (fcntl(s, F_SETFL, flags) == -1)
-	return -1;
-
-    if (ret != 1)
-	return -1;
-
-    sl = sizeof(err);
-    ret = getsockopt(s, SOL_SOCKET, SO_ERROR, &err, &sl);
-    if (ret == -1)
-	return -1;
-    if (err != 0)
-	return -1;
-
-    return 0;
-#else
-    return connect(s, addr->ai_addr, addr->ai_addrlen);
-#endif
-}
-
-/*
- * send the data in `req' on the socket `fd' (which is datagram iff udp)
- * waiting `tmout' for a reply and returning the reply in `rep'.
- * iff limit read up to this many bytes
- * returns 0 and data in `rep' if succesful, otherwise -1
- */
-
-static int
-recv_loop (krb5_socket_t fd,
-	   time_t tmout,
-	   int udp,
-	   size_t limit,
-	   krb5_data *rep)
-{
-     fd_set fdset;
-     struct timeval timeout;
-     int ret;
-     int nbytes;
-
-#ifndef NO_LIMIT_FD_SETSIZE
-     if (fd >= FD_SETSIZE) {
-	 return -1;
-     }
-#endif
-
-     krb5_data_zero(rep);
-     do {
-	 FD_ZERO(&fdset);
-	 FD_SET(fd, &fdset);
-	 timeout.tv_sec  = tmout;
-	 timeout.tv_usec = 0;
-	 ret = select (fd + 1, &fdset, NULL, NULL, &timeout);
-	 if (ret < 0) {
-	     if (errno == EINTR)
-		 continue;
-	     return -1;
-	 } else if (ret == 0) {
-	     return 0;
-	 } else {
-	     void *tmp;
-
-	     if (rk_SOCK_IOCTL (fd, FIONREAD, &nbytes) < 0) {
-		 krb5_data_free (rep);
-		 return -1;
-	     }
-	     if(nbytes <= 0)
-		 return 0;
-
-	     if (limit)
-		 nbytes = min((size_t)nbytes, limit - rep->length);
-
-	     tmp = realloc (rep->data, rep->length + nbytes);
-	     if (tmp == NULL) {
-		 krb5_data_free (rep);
-		 return -1;
-	     }
-	     rep->data = tmp;
-	     ret = recv (fd, (char*)tmp + rep->length, nbytes, 0);
-	     if (ret < 0) {
-		 krb5_data_free (rep);
-		 return -1;
-	     }
-	     rep->length += ret;
-	 }
-     } while(!udp && (limit == 0 || rep->length < limit));
-     return 0;
-}
-
-/*
- * Send kerberos requests and receive a reply on a udp or any other kind
- * of a datagram socket.  See `recv_loop'.
- */
-
-static int
-send_and_recv_udp(krb5_socket_t fd,
-		  time_t tmout,
-		  const krb5_data *req,
-		  krb5_data *rep)
-{
-    if (send (fd, req->data, req->length, 0) < 0)
-	return -1;
-
-    return recv_loop(fd, tmout, 1, 0, rep);
-}
-
-/*
- * `send_and_recv' for a TCP (or any other stream) socket.
- * Since there are no record limits on a stream socket the protocol here
- * is to prepend the request with 4 bytes of its length and the reply
- * is similarly encoded.
- */
-
-static int
-send_and_recv_tcp(krb5_socket_t fd,
-		  time_t tmout,
-		  const krb5_data *req,
-		  krb5_data *rep)
-{
-    unsigned char len[4];
-    unsigned long rep_len;
-    krb5_data len_data;
-
-    _krb5_put_int(len, req->length, 4);
-    if(net_write (fd, len, sizeof(len)) < 0)
-	return -1;
-    if(net_write (fd, req->data, req->length) < 0)
-	return -1;
-    if (recv_loop (fd, tmout, 0, 4, &len_data) < 0)
-	return -1;
-    if (len_data.length != 4) {
-	krb5_data_free (&len_data);
-	return -1;
-    }
-    _krb5_get_int(len_data.data, &rep_len, 4);
-    krb5_data_free (&len_data);
-    if (recv_loop (fd, tmout, 0, rep_len, rep) < 0)
-	return -1;
-    if(rep->length != rep_len) {
-	krb5_data_free (rep);
-	return -1;
-    }
-    return 0;
-}
-
-int
-_krb5_send_and_recv_tcp(krb5_socket_t fd,
-			time_t tmout,
-			const krb5_data *req,
-			krb5_data *rep)
-{
-    return send_and_recv_tcp(fd, tmout, req, rep);
-}
-
-/*
- * `send_and_recv' tailored for the HTTP protocol.
- */
-
-static int
-send_and_recv_http(krb5_socket_t fd,
-		   time_t tmout,
-		   const char *prefix,
-		   const krb5_data *req,
-		   krb5_data *rep)
-{
-    char *request = NULL;
-    char *str;
-    int ret;
-    int len = base64_encode(req->data, req->length, &str);
-
-    if(len < 0)
-	return -1;
-    ret = asprintf(&request, "GET %s%s HTTP/1.0\r\n\r\n", prefix, str);
-    free(str);
-    if (ret < 0 || request == NULL)
-	return -1;
-    ret = net_write (fd, request, strlen(request));
-    free (request);
-    if (ret < 0)
-	return ret;
-    ret = recv_loop(fd, tmout, 0, 0, rep);
-    if(ret)
-	return ret;
-    {
-	unsigned long rep_len;
-	char *s, *p;
-
-	s = realloc(rep->data, rep->length + 1);
-	if (s == NULL) {
-	    krb5_data_free (rep);
-	    return -1;
-	}
-	s[rep->length] = 0;
-	p = strstr(s, "\r\n\r\n");
-	if(p == NULL) {
-	    krb5_data_zero(rep);
-	    free(s);
-	    return -1;
-	}
-	p += 4;
-	rep->data = s;
-	rep->length -= p - s;
-	if(rep->length < 4) { /* remove length */
-	    krb5_data_zero(rep);
-	    free(s);
-	    return -1;
-	}
-	rep->length -= 4;
-	_krb5_get_int(p, &rep_len, 4);
-	if (rep_len != rep->length) {
-	    krb5_data_zero(rep);
-	    free(s);
-	    return -1;
-	}
-	memmove(rep->data, p + 4, rep->length);
-    }
-    return 0;
-}
-
 static int
 init_port(const char *s, int fallback)
 {
-    if (s) {
-	int tmp;
+    int tmp;
 
-	sscanf (s, "%d", &tmp);
-	return htons(tmp);
-    } else
-	return fallback;
+    if (s && sscanf(s, "%d", &tmp) == 1)
+        return htons(tmp);
+    return fallback;
 }
 
-/*
- * Return 0 if succesful, otherwise 1
- */
+struct send_via_plugin_s {
+    krb5_const_realm realm;
+    krb5_krbhst_info *hi;
+    time_t timeout;
+    const krb5_data *send_data;
+    krb5_data *receive;
+};
+    
 
-static int
-send_via_proxy (krb5_context context,
-		const krb5_krbhst_info *hi,
-		const krb5_data *send_data,
-		krb5_data *receive)
+static krb5_error_code KRB5_LIB_CALL
+kdccallback(krb5_context context, const void *plug, void *plugctx, void *userctx)
 {
-    char *proxy2 = strdup(context->http_proxy);
-    char *proxy  = proxy2;
-    char *prefix = NULL;
-    char *colon;
-    struct addrinfo hints;
-    struct addrinfo *ai, *a;
-    int ret;
-    krb5_socket_t s = rk_INVALID_SOCKET;
-    char portstr[NI_MAXSERV];
+    const krb5plugin_send_to_kdc_ftable *service = (const krb5plugin_send_to_kdc_ftable *)plug;
+    struct send_via_plugin_s *ctx = userctx;
 
-    if (proxy == NULL)
-	return ENOMEM;
-    if (strncmp (proxy, "http://", 7) == 0)
-	proxy += 7;
+    if (service->send_to_kdc == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+    return service->send_to_kdc(context, plugctx, ctx->hi, ctx->timeout,
+				ctx->send_data, ctx->receive);
+}
 
-    colon = strchr(proxy, ':');
-    if(colon != NULL)
-	*colon++ = '\0';
-    memset (&hints, 0, sizeof(hints));
-    hints.ai_family   = PF_UNSPEC;
-    hints.ai_socktype = SOCK_STREAM;
-    snprintf (portstr, sizeof(portstr), "%d",
-	      ntohs(init_port (colon, htons(80))));
-    ret = getaddrinfo (proxy, portstr, &hints, &ai);
-    free (proxy2);
-    if (ret)
-	return krb5_eai_to_heim_errno(ret, errno);
+static krb5_error_code KRB5_LIB_CALL
+realmcallback(krb5_context context, const void *plug, void *plugctx, void *userctx)
+{
+    const krb5plugin_send_to_kdc_ftable *service = (const krb5plugin_send_to_kdc_ftable *)plug;
+    struct send_via_plugin_s *ctx = userctx;
 
-    for (a = ai; a != NULL; a = a->ai_next) {
-	s = socket (a->ai_family, a->ai_socktype | SOCK_CLOEXEC, a->ai_protocol);
-	if (s < 0)
-	    continue;
-	rk_cloexec(s);
-	if (timed_connect (s, a, context->kdc_timeout) < 0) {
-	    rk_closesocket (s);
-	    continue;
-	}
-	break;
-    }
-    if (a == NULL) {
-	freeaddrinfo (ai);
-	return 1;
-    }
-    freeaddrinfo (ai);
-
-    ret = asprintf(&prefix, "http://%s/", hi->hostname);
-    if(ret < 0 || prefix == NULL) {
-	close(s);
-	return 1;
-    }
-    ret = send_and_recv_http(s, context->kdc_timeout,
-			     prefix, send_data, receive);
-    rk_closesocket (s);
-    free(prefix);
-    if(ret == 0 && receive->length != 0)
-	return 0;
-    return 1;
+    if (service->send_to_realm == NULL)
+	return KRB5_PLUGIN_NO_HANDLE;
+    return service->send_to_realm(context, plugctx, ctx->realm, ctx->timeout,
+				  ctx->send_data, ctx->receive);
 }
 
 static krb5_error_code
-send_via_plugin(krb5_context context,
-		krb5_krbhst_info *hi,
-		time_t timeout,
-		const krb5_data *send_data,
-		krb5_data *receive)
+kdc_via_plugin(krb5_context context,
+	       krb5_krbhst_info *hi,
+	       time_t timeout,
+	       const krb5_data *send_data,
+	       krb5_data *receive)
 {
-    struct krb5_plugin *list = NULL, *e;
-    krb5_error_code ret;
+    struct send_via_plugin_s userctx;
 
-    ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, KRB5_PLUGIN_SEND_TO_KDC, &list);
-    if(ret != 0 || list == NULL)
-	return KRB5_PLUGIN_NO_HANDLE;
+    userctx.realm = NULL;
+    userctx.hi = hi;
+    userctx.timeout = timeout;
+    userctx.send_data = send_data;
+    userctx.receive = receive;
 
-    for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
-	krb5plugin_send_to_kdc_ftable *service;
-	void *ctx;
-
-	service = _krb5_plugin_get_symbol(e);
-	if (service->minor_version != 0)
-	    continue;
-
-	(*service->init)(context, &ctx);
-	ret = (*service->send_to_kdc)(context, ctx, hi,
-				      timeout, send_data, receive);
-	(*service->fini)(ctx);
-	if (ret == 0)
-	    break;
-	if (ret != KRB5_PLUGIN_NO_HANDLE) {
-	    krb5_set_error_message(context, ret,
-				   N_("Plugin send_to_kdc failed to "
-				      "lookup with error: %d", ""), ret);
-	    break;
-	}
-    }
-    _krb5_plugin_free(list);
-    return KRB5_PLUGIN_NO_HANDLE;
+    return _krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_SEND_TO_KDC,
+			      KRB5_PLUGIN_SEND_TO_KDC_VERSION_0, 0,
+			      &userctx, kdccallback);
 }
 
-
-/*
- * Send the data `send' to one host from `handle` and get back the reply
- * in `receive'.
- */
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_sendto (krb5_context context,
-	     const krb5_data *send_data,
-	     krb5_krbhst_handle handle,
-	     krb5_data *receive)
+static krb5_error_code
+realm_via_plugin(krb5_context context,
+		 krb5_const_realm realm,
+		 time_t timeout,
+		 const krb5_data *send_data,
+		 krb5_data *receive)
 {
-     krb5_error_code ret;
-     krb5_socket_t fd;
-     size_t i;
+    struct send_via_plugin_s userctx;
 
-     krb5_data_zero(receive);
+    userctx.realm = realm;
+    userctx.hi = NULL;
+    userctx.timeout = timeout;
+    userctx.send_data = send_data;
+    userctx.receive = receive;
 
-     for (i = 0; i < context->max_retries; ++i) {
-	 krb5_krbhst_info *hi;
-
-	 while (krb5_krbhst_next(context, handle, &hi) == 0) {
-	     struct addrinfo *ai, *a;
-
-	     _krb5_debug(context, 2,
-			 "trying to communicate with host %s in realm %s",
-			 hi->hostname, _krb5_krbhst_get_realm(handle));
-
-	     if (context->send_to_kdc) {
-		 struct send_to_kdc *s = context->send_to_kdc;
-
-		 ret = (*s->func)(context, s->data, hi,
-				  context->kdc_timeout, send_data, receive);
-		 if (ret == 0 && receive->length != 0)
-		     goto out;
-		 continue;
-	     }
-
-	     ret = send_via_plugin(context, hi, context->kdc_timeout,
-				   send_data, receive);
-	     if (ret == 0 && receive->length != 0)
-		 goto out;
-	     else if (ret != KRB5_PLUGIN_NO_HANDLE)
-		 continue;
-
-	     if(hi->proto == KRB5_KRBHST_HTTP && context->http_proxy) {
-		 if (send_via_proxy (context, hi, send_data, receive) == 0) {
-		     ret = 0;
-		     goto out;
-		 }
-		 continue;
-	     }
-
-	     ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
-	     if (ret)
-		 continue;
-
-	     for (a = ai; a != NULL; a = a->ai_next) {
-		 fd = socket (a->ai_family, a->ai_socktype | SOCK_CLOEXEC, a->ai_protocol);
-		 if (rk_IS_BAD_SOCKET(fd))
-		     continue;
-		 rk_cloexec(fd);
-		 if (timed_connect (fd, a, context->kdc_timeout) < 0) {
-		     rk_closesocket (fd);
-		     continue;
-		 }
-		 switch (hi->proto) {
-		 case KRB5_KRBHST_HTTP :
-		     ret = send_and_recv_http(fd, context->kdc_timeout,
-					      "", send_data, receive);
-		     break;
-		 case KRB5_KRBHST_TCP :
-		     ret = send_and_recv_tcp (fd, context->kdc_timeout,
-					      send_data, receive);
-		     break;
-		 case KRB5_KRBHST_UDP :
-		     ret = send_and_recv_udp (fd, context->kdc_timeout,
-					      send_data, receive);
-		     break;
-		 }
-		 rk_closesocket (fd);
-		 if(ret == 0 && receive->length != 0)
-		     goto out;
-	     }
-	 }
-	 krb5_krbhst_reset(context, handle);
-     }
-     krb5_clear_error_message (context);
-     ret = KRB5_KDC_UNREACH;
-out:
-     _krb5_debug(context, 2,
-		 "result of trying to talk to realm %s = %d",
-		 _krb5_krbhst_get_realm(handle), ret);
-     return ret;
+    return _krb5_plugin_run_f(context, "krb5", KRB5_PLUGIN_SEND_TO_KDC,
+			      KRB5_PLUGIN_SEND_TO_KDC_VERSION_2, 0,
+			      &userctx, realmcallback);
 }
 
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_sendto_kdc(krb5_context context,
-		const krb5_data *send_data,
-		const krb5_realm *realm,
-		krb5_data *receive)
-{
-    return krb5_sendto_kdc_flags(context, send_data, realm, receive, 0);
-}
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_sendto_kdc_flags(krb5_context context,
-		      const krb5_data *send_data,
-		      const krb5_realm *realm,
-		      krb5_data *receive,
-		      int flags)
-{
-    krb5_error_code ret;
-    krb5_sendto_ctx ctx;
-
-    ret = krb5_sendto_ctx_alloc(context, &ctx);
-    if (ret)
-	return ret;
-    krb5_sendto_ctx_add_flags(ctx, flags);
-    krb5_sendto_ctx_set_func(ctx, _krb5_kdc_retry, NULL);
-
-    ret = krb5_sendto_context(context, ctx, send_data, *realm, receive);
-    krb5_sendto_ctx_free(context, ctx);
-    return ret;
-}
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_set_send_to_kdc_func(krb5_context context,
-			  krb5_send_to_kdc_func func,
-			  void *data)
-{
-    free(context->send_to_kdc);
-    if (func == NULL) {
-	context->send_to_kdc = NULL;
-	return 0;
-    }
-
-    context->send_to_kdc = malloc(sizeof(*context->send_to_kdc));
-    if (context->send_to_kdc == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
-
-    context->send_to_kdc->func = func;
-    context->send_to_kdc->data = data;
-    return 0;
-}
-
-KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-_krb5_copy_send_to_kdc_func(krb5_context context, krb5_context to)
-{
-    if (context->send_to_kdc)
-	return krb5_set_send_to_kdc_func(to,
-					 context->send_to_kdc->func,
-					 context->send_to_kdc->data);
-    else
-	return krb5_set_send_to_kdc_func(to, NULL, NULL);
-}
-
-
-
 struct krb5_sendto_ctx_data {
     int flags;
     int type;
     krb5_sendto_ctx_func func;
     void *data;
+    char *hostname;
+    krb5_krbhst_handle krbhst;
+
+    /* context2 */
+    const krb5_data *send_data;
+    krb5_data response;
+    heim_array_t hosts;
+    int stateflags;
+#define KRBHST_COMPLETED	1
+
+    /* prexmit */
+    krb5_sendto_prexmit prexmit_func;
+    void *prexmit_ctx;
+
+    /* stats */
+    struct {
+	struct timeval start_time;
+	struct timeval name_resolution;
+	struct timeval krbhst;
+	unsigned long sent_packets;
+	unsigned long num_hosts;
+    } stats;
+    unsigned int stid;
 };
 
+static void
+dealloc_sendto_ctx(void *ptr)
+{
+    krb5_sendto_ctx ctx = (krb5_sendto_ctx)ptr;
+    if (ctx->hostname)
+	free(ctx->hostname);
+    heim_release(ctx->hosts);
+    heim_release(ctx->krbhst);
+}
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sendto_ctx_alloc(krb5_context context, krb5_sendto_ctx *ctx)
 {
-    *ctx = calloc(1, sizeof(**ctx));
-    if (*ctx == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    *ctx = heim_alloc(sizeof(**ctx), "sendto-context", dealloc_sendto_ctx);
+    if (*ctx == NULL)
+	return krb5_enomem(context);
+    (*ctx)->hosts = heim_array_create();
+
     return 0;
 }
 
@@ -615,7 +207,6 @@ krb5_sendto_ctx_set_type(krb5_sendto_ctx ctx, int type)
     ctx->type = type;
 }
 
-
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_sendto_ctx_set_func(krb5_sendto_ctx ctx,
 			 krb5_sendto_ctx_func func,
@@ -626,88 +217,45 @@ krb5_sendto_ctx_set_func(krb5_sendto_ctx ctx,
 }
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
-krb5_sendto_ctx_free(krb5_context context, krb5_sendto_ctx ctx)
+_krb5_sendto_ctx_set_prexmit(krb5_sendto_ctx ctx,
+			     krb5_sendto_prexmit prexmit,
+			     void *data)
 {
-    memset(ctx, 0, sizeof(*ctx));
-    free(ctx);
+    ctx->prexmit_func = prexmit;
+    ctx->prexmit_ctx = data;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_sendto_context(krb5_context context,
-		    krb5_sendto_ctx ctx,
-		    const krb5_data *send_data,
-		    const krb5_realm realm,
-		    krb5_data *receive)
+krb5_sendto_set_hostname(krb5_context context,
+			 krb5_sendto_ctx ctx,
+			 const char *hostname)
 {
-    krb5_error_code ret;
-    krb5_krbhst_handle handle = NULL;
-    int type, freectx = 0;
-    int action;
-
-    krb5_data_zero(receive);
-
-    if (ctx == NULL) {
-	freectx = 1;
-	ret = krb5_sendto_ctx_alloc(context, &ctx);
-	if (ret)
-	    return ret;
+    if (ctx->hostname == NULL)
+	free(ctx->hostname);
+    ctx->hostname = strdup(hostname);
+    if (ctx->hostname == NULL) {
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
+	return ENOMEM;
     }
-
-    type = ctx->type;
-    if (type == 0) {
-	if ((ctx->flags & KRB5_KRBHST_FLAGS_MASTER) || context->use_admin_kdc)
-	    type = KRB5_KRBHST_ADMIN;
-	else
-	    type = KRB5_KRBHST_KDC;
-    }
-
-    if ((int)send_data->length > context->large_msg_size)
-	ctx->flags |= KRB5_KRBHST_FLAGS_LARGE_MSG;
-
-    /* loop until we get back a appropriate response */
-
-    do {
-	action = KRB5_SENDTO_DONE;
-
-	krb5_data_free(receive);
-
-	if (handle == NULL) {
-	    ret = krb5_krbhst_init_flags(context, realm, type,
-					 ctx->flags, &handle);
-	    if (ret) {
-		if (freectx)
-		    krb5_sendto_ctx_free(context, ctx);
-		return ret;
-	    }
-	}
-
-	ret = krb5_sendto(context, send_data, handle, receive);
-	if (ret)
-	    break;
-	if (ctx->func) {
-	    ret = (*ctx->func)(context, ctx, ctx->data, receive, &action);
-	    if (ret)
-		break;
-	}
-	if (action != KRB5_SENDTO_CONTINUE) {
-	    krb5_krbhst_free(context, handle);
-	    handle = NULL;
-	}
-    } while (action != KRB5_SENDTO_DONE);
-    if (handle)
-	krb5_krbhst_free(context, handle);
-    if (ret == KRB5_KDC_UNREACH)
-	krb5_set_error_message(context, ret,
-			       N_("unable to reach any KDC in realm %s", ""),
-			       realm);
-    if (ret)
-	krb5_data_free(receive);
-    if (freectx)
-	krb5_sendto_ctx_free(context, ctx);
-    return ret;
+    return 0;
 }
 
-krb5_error_code KRB5_CALLCONV
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_sendto_ctx_set_krb5hst(krb5_context context,
+			     krb5_sendto_ctx ctx,
+			     krb5_krbhst_handle handle)
+{
+    heim_release(ctx->krbhst);
+    ctx->krbhst = heim_retain(handle);
+}
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_sendto_ctx_free(krb5_context context, krb5_sendto_ctx ctx)
+{
+    heim_release(ctx);
+}
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_kdc_retry(krb5_context context, krb5_sendto_ctx ctx, void *data,
 		const krb5_data *reply, int *action)
 {
@@ -725,7 +273,7 @@ _krb5_kdc_retry(krb5_context context, krb5_sendto_ctx ctx, void *data,
 	if (krb5_sendto_ctx_get_flags(ctx) & KRB5_KRBHST_FLAGS_LARGE_MSG)
 	    break;
 	krb5_sendto_ctx_add_flags(ctx, KRB5_KRBHST_FLAGS_LARGE_MSG);
-	*action = KRB5_SENDTO_RESTART;
+	*action = KRB5_SENDTO_RESET;
 	break;
     }
     case KRB5KDC_ERR_SVC_UNAVAILABLE:
@@ -734,3 +282,989 @@ _krb5_kdc_retry(krb5_context context, krb5_sendto_ctx ctx, void *data,
     }
     return 0;
 }
+
+/*
+ *
+ */
+
+struct host;
+
+struct host_fun {
+    krb5_error_code (*prepare)(krb5_context, struct host *, const krb5_data *);
+    krb5_error_code (*send_fn)(krb5_context, struct host *);
+    krb5_error_code (*recv_fn)(krb5_context, struct host *, krb5_data *);
+    int ntries;
+};
+
+struct host {
+    enum host_state { CONNECT, CONNECTING, CONNECTED, WAITING_REPLY, DEAD } state;
+    krb5_krbhst_info *hi;
+    struct addrinfo *ai;
+    rk_socket_t fd;
+    struct host_fun *fun;
+    unsigned int tries;
+    time_t timeout;
+    krb5_data data;
+    unsigned int tid;
+};
+
+static void
+debug_host(krb5_context context, int level, struct host *host, const char *fmt, ...)
+	__attribute__ ((__format__ (__printf__, 4, 5)));
+
+static void
+debug_host(krb5_context context, int level, struct host *host, const char *fmt, ...)
+{
+    const char *proto = "unknown";
+    char name[NI_MAXHOST], port[NI_MAXSERV];
+    char *text = NULL;
+    va_list ap;
+    int ret;
+
+    if (!_krb5_have_debug(context, 5))
+	return;
+
+    va_start(ap, fmt);
+    ret = vasprintf(&text, fmt, ap);
+    va_end(ap);
+    if (ret == -1 || text == NULL)
+	return;
+
+    if (host->hi->proto == KRB5_KRBHST_HTTP)
+	proto = "http";
+    else if (host->hi->proto == KRB5_KRBHST_TCP)
+	proto = "tcp";
+    else if (host->hi->proto == KRB5_KRBHST_UDP)
+	proto = "udp";
+
+    if (getnameinfo(host->ai->ai_addr, host->ai->ai_addrlen,
+		    name, sizeof(name), port, sizeof(port), NI_NUMERICHOST) != 0)
+	name[0] = '\0';
+
+    _krb5_debug(context, level, "%s: %s %s:%s (%s) tid: %08x", text,
+		proto, name, port, host->hi->hostname, host->tid);
+    free(text);
+}
+
+
+static void
+deallocate_host(void *ptr)
+{
+    struct host *host = ptr;
+    if (!rk_IS_BAD_SOCKET(host->fd))
+	rk_closesocket(host->fd);
+    krb5_data_free(&host->data);
+    host->ai = NULL;
+}
+
+static void
+host_dead(krb5_context context, struct host *host, const char *msg)
+{
+    debug_host(context, 5, host, "%s", msg);
+    rk_closesocket(host->fd);
+    host->fd = rk_INVALID_SOCKET;
+    host->state = DEAD;
+}
+
+static krb5_error_code
+send_stream(krb5_context context, struct host *host)
+{
+    ssize_t len;
+
+    len = krb5_net_write(context, &host->fd, host->data.data, host->data.length);
+
+    if (len < 0)
+	return errno;
+    else if (len < host->data.length) {
+	host->data.length -= len;
+	memmove(host->data.data, ((uint8_t *)host->data.data) + len, host->data.length - len);
+	return -1;
+    } else {
+	krb5_data_free(&host->data);
+	return 0;
+    }
+}
+
+static krb5_error_code
+recv_stream(krb5_context context, struct host *host)
+{
+    krb5_error_code ret;
+    size_t oldlen;
+    ssize_t sret;
+    int nbytes;
+
+    if (rk_SOCK_IOCTL(host->fd, FIONREAD, &nbytes) != 0 || nbytes <= 0)
+	return HEIM_NET_CONN_REFUSED;
+
+    if (context->max_msg_size - host->data.length < nbytes) {
+	krb5_set_error_message(context, KRB5KRB_ERR_FIELD_TOOLONG,
+			       N_("TCP message from KDC too large %d", ""),
+			       (int)(host->data.length + nbytes));
+	return KRB5KRB_ERR_FIELD_TOOLONG;
+    }
+
+    oldlen = host->data.length;
+
+    ret = krb5_data_realloc(&host->data, oldlen + nbytes + 1 /* NUL */);
+    if (ret)
+	return ret;
+
+    sret = krb5_net_read(context, &host->fd, ((uint8_t *)host->data.data) + oldlen, nbytes);
+    if (sret <= 0) {
+	ret = errno;
+	return ret;
+    }
+    host->data.length = oldlen + sret;
+    /* zero terminate for http transport */
+    ((uint8_t *)host->data.data)[host->data.length] = '\0';
+
+    return 0;
+}
+
+/*
+ *
+ */
+
+static void
+host_next_timeout(krb5_context context, struct host *host)
+{
+    host->timeout = context->kdc_timeout / host->fun->ntries;
+    if (host->timeout == 0)
+	host->timeout = 1;
+
+    host->timeout += time(NULL);
+}
+
+/*
+ * connected host
+ */
+
+static void
+host_connected(krb5_context context, krb5_sendto_ctx ctx, struct host *host)
+{
+    krb5_error_code ret;
+
+    host->state = CONNECTED; 
+    /*
+     * Now prepare data to send to host
+     */
+    if (ctx->prexmit_func) {
+	krb5_data data;
+	    
+	krb5_data_zero(&data);
+
+	ret = ctx->prexmit_func(context, host->hi->proto,
+				ctx->prexmit_ctx, host->fd, &data);
+	if (ret == 0) {
+	    if (data.length == 0) {
+		host_dead(context, host, "prexmit function didn't send data");
+		return;
+	    }
+	    ret = host->fun->prepare(context, host, &data);
+	    krb5_data_free(&data);
+	}
+	
+    } else {
+	ret = host->fun->prepare(context, host, ctx->send_data);
+    }
+    if (ret)
+	debug_host(context, 5, host, "failed to prexmit/prepare");
+}
+
+/*
+ * connect host
+ */
+
+static void
+host_connect(krb5_context context, krb5_sendto_ctx ctx, struct host *host)
+{
+    krb5_krbhst_info *hi = host->hi;
+    struct addrinfo *ai = host->ai;
+
+    debug_host(context, 5, host, "connecting to host");
+
+    if (connect(host->fd, ai->ai_addr, ai->ai_addrlen) < 0) {
+#ifdef HAVE_WINSOCK
+	if (WSAGetLastError() == WSAEWOULDBLOCK)
+	    errno = EINPROGRESS;
+#endif /* HAVE_WINSOCK */
+	if (errno == EINPROGRESS && (hi->proto == KRB5_KRBHST_HTTP || hi->proto == KRB5_KRBHST_TCP)) {
+	    debug_host(context, 5, host, "connecting to %d", host->fd);
+	    host->state = CONNECTING;
+	} else {
+	    host_dead(context, host, "failed to connect");
+	}
+    } else {
+	host_connected(context, ctx, host);
+    }
+
+    host_next_timeout(context, host);
+}
+
+/*
+ * HTTP transport
+ */
+
+static krb5_error_code
+prepare_http(krb5_context context, struct host *host, const krb5_data *data)
+{
+    char *str = NULL, *request = NULL;
+    krb5_error_code ret;
+    int len;
+
+    heim_assert(host->data.length == 0, "prepare_http called twice");
+
+    len = rk_base64_encode(data->data, data->length, &str);
+    if(len < 0)
+	return ENOMEM;
+
+    if (context->http_proxy)
+	ret = asprintf(&request, "GET http://%s/%s HTTP/1.0\r\n\r\n", host->hi->hostname, str);
+    else
+	ret = asprintf(&request, "GET /%s HTTP/1.0\r\n\r\n", str);
+    free(str);
+    if(ret < 0 || request == NULL)
+	return ENOMEM;
+    
+    host->data.data = request;
+    host->data.length = strlen(request);
+
+    return 0;
+}
+
+static krb5_error_code
+recv_http(krb5_context context, struct host *host, krb5_data *data)
+{
+    krb5_error_code ret;
+    unsigned long rep_len;
+    size_t len;
+    char *p;
+
+    /*
+     * recv_stream returns a NUL terminated stream
+     */
+
+    ret = recv_stream(context, host);
+    if (ret)
+	return ret;
+
+    p = strstr(host->data.data, "\r\n\r\n");
+    if (p == NULL)
+	return -1;
+    p += 4;
+
+    len = host->data.length - (p - (char *)host->data.data);
+    if (len < 4)
+	return -1;
+
+    _krb5_get_int(p, &rep_len, 4);
+    if (len < rep_len)
+	return -1;
+
+    p += 4;
+
+    memmove(host->data.data, p, rep_len);
+    host->data.length = rep_len;
+
+    *data = host->data;
+    krb5_data_zero(&host->data);
+
+    return 0;
+}
+
+/*
+ * TCP transport
+ */
+
+static krb5_error_code
+prepare_tcp(krb5_context context, struct host *host, const krb5_data *data)
+{
+    krb5_error_code ret;
+    krb5_storage *sp;
+
+    heim_assert(host->data.length == 0, "prepare_tcp called twice");
+
+    sp = krb5_storage_emem();
+    if (sp == NULL)
+	return ENOMEM;
+    
+    ret = krb5_store_data(sp, *data);
+    if (ret) {
+	krb5_storage_free(sp);
+	return ret;
+    }
+    ret = krb5_storage_to_data(sp, &host->data);
+    krb5_storage_free(sp);
+
+    return ret;
+}
+
+static krb5_error_code
+recv_tcp(krb5_context context, struct host *host, krb5_data *data)
+{
+    krb5_error_code ret;
+    unsigned long pktlen;
+
+    ret = recv_stream(context, host);
+    if (ret)
+	return ret;
+
+    if (host->data.length < 4)
+	return -1;
+
+    _krb5_get_int(host->data.data, &pktlen, 4);
+    
+    if (pktlen > host->data.length - 4)
+	return -1;
+
+    memmove(host->data.data, ((uint8_t *)host->data.data) + 4, host->data.length - 4);
+    host->data.length -= 4;
+
+    *data = host->data;
+    krb5_data_zero(&host->data);
+    
+    return 0;
+}
+
+/*
+ * UDP transport
+ */
+
+static krb5_error_code
+prepare_udp(krb5_context context, struct host *host, const krb5_data *data)
+{
+    return krb5_data_copy(&host->data, data->data, data->length);
+}
+
+static krb5_error_code
+send_udp(krb5_context context, struct host *host)
+{
+    if (send(host->fd, host->data.data, host->data.length, 0) < 0)
+	return errno;
+    return 0;
+}
+
+static krb5_error_code
+recv_udp(krb5_context context, struct host *host, krb5_data *data)
+{
+    krb5_error_code ret;
+    int nbytes;
+
+
+    if (rk_SOCK_IOCTL(host->fd, FIONREAD, &nbytes) != 0 || nbytes <= 0)
+	return HEIM_NET_CONN_REFUSED;
+
+    if (context->max_msg_size < nbytes) {
+	krb5_set_error_message(context, KRB5KRB_ERR_FIELD_TOOLONG,
+			       N_("UDP message from KDC too large %d", ""),
+			       (int)nbytes);
+	return KRB5KRB_ERR_FIELD_TOOLONG;
+    }
+
+    ret = krb5_data_alloc(data, nbytes);
+    if (ret)
+	return ret;
+
+    ret = recv(host->fd, data->data, data->length, 0);
+    if (ret < 0) {
+	ret = errno;
+	krb5_data_free(data);
+	return ret;
+    }
+    data->length = ret;
+
+    return 0;
+}
+
+static struct host_fun http_fun = {
+    prepare_http,
+    send_stream,
+    recv_http,
+    1
+};
+static struct host_fun tcp_fun = {
+    prepare_tcp,
+    send_stream,
+    recv_tcp,
+    1
+};
+static struct host_fun udp_fun = {
+    prepare_udp,
+    send_udp,
+    recv_udp,
+    3
+};
+
+
+/*
+ * Host state machine
+ */
+
+static int
+eval_host_state(krb5_context context,
+		krb5_sendto_ctx ctx,
+		struct host *host,
+		int readable, int writeable)
+{
+    krb5_error_code ret;
+
+    if (host->state == CONNECT) {
+	/* check if its this host time to connect */
+	if (host->timeout < time(NULL))
+	    host_connect(context, ctx, host);
+	return 0;
+    }
+
+    if (host->state == CONNECTING && writeable)
+	host_connected(context, ctx, host);
+
+    if (readable) {
+
+	debug_host(context, 5, host, "reading packet");
+
+	ret = host->fun->recv_fn(context, host, &ctx->response);
+	if (ret == -1) {
+	    /* not done yet */
+	} else if (ret == 0) {
+	    /* if recv_foo function returns 0, we have a complete reply */
+	    debug_host(context, 5, host, "host completed");
+	    return 1;
+	} else {
+	    host_dead(context, host, "host disconnected");
+	}
+    }
+
+    /* check if there is anything to send, state might DEAD after read */
+    if (writeable && host->state == CONNECTED) {
+
+	ctx->stats.sent_packets++;
+
+	debug_host(context, 5, host, "writing packet");
+
+	ret = host->fun->send_fn(context, host);
+	if (ret == -1) {
+	    /* not done yet */
+	} else if (ret) {
+	    host_dead(context, host, "host dead, write failed");
+	} else
+	    host->state = WAITING_REPLY;
+    }
+
+    return 0;
+}
+
+/*
+ *
+ */
+
+static krb5_error_code
+submit_request(krb5_context context, krb5_sendto_ctx ctx, krb5_krbhst_info *hi)
+{
+    unsigned long submitted_host = 0;
+    krb5_boolean freeai = FALSE;
+    struct timeval nrstart, nrstop;
+    krb5_error_code ret;
+    struct addrinfo *ai = NULL, *a;
+    struct host *host;
+
+    ret = kdc_via_plugin(context, hi, context->kdc_timeout,
+			 ctx->send_data, &ctx->response);
+    if (ret == 0) {
+	return 0;
+    } else if (ret != KRB5_PLUGIN_NO_HANDLE) {
+	_krb5_debug(context, 5, "send via plugin failed %s: %d",
+		    hi->hostname, ret);
+	return ret;
+    }
+
+    /*
+     * If we have a proxy, let use the address of the proxy instead of
+     * the KDC and let the proxy deal with the resolving of the KDC.
+     */
+
+    gettimeofday(&nrstart, NULL);
+
+    if (hi->proto == KRB5_KRBHST_HTTP && context->http_proxy) {
+	char *proxy2 = strdup(context->http_proxy);
+	char *el, *proxy  = proxy2;
+	struct addrinfo hints;
+	char portstr[NI_MAXSERV];
+	unsigned short nport;
+	
+	if (proxy == NULL)
+	    return ENOMEM;
+	if (strncmp(proxy, "http://", 7) == 0)
+	    proxy += 7;
+	
+	/* check for url terminating slash */
+	el = strchr(proxy, '/');
+	if (el != NULL)
+	    *el = '\0';
+
+	/* check for port in hostname, used below as port */
+	el = strchr(proxy, ':');
+	if(el != NULL)
+	    *el++ = '\0';
+
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family   = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+
+	/* On some systems ntohs(foo(..., htons(...))) causes shadowing */
+	nport = init_port(el, htons(80));
+	snprintf(portstr, sizeof(portstr), "%d", ntohs(nport));
+
+	ret = getaddrinfo(proxy, portstr, &hints, &ai);
+	free(proxy2);
+	if (ret)
+	    return krb5_eai_to_heim_errno(ret, errno);
+	
+	freeai = TRUE;
+
+    } else {
+	ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
+	if (ret)
+	    return ret;
+    }
+
+    /* add up times */
+    gettimeofday(&nrstop, NULL);
+    timevalsub(&nrstop, &nrstart);
+    timevaladd(&ctx->stats.name_resolution, &nrstop);
+
+    ctx->stats.num_hosts++;
+
+    for (a = ai; a != NULL; a = a->ai_next) {
+	rk_socket_t fd;
+
+	fd = socket(a->ai_family, a->ai_socktype | SOCK_CLOEXEC, a->ai_protocol);
+	if (rk_IS_BAD_SOCKET(fd))
+	    continue;
+	rk_cloexec(fd);
+
+#ifndef NO_LIMIT_FD_SETSIZE
+	if (fd >= FD_SETSIZE) {
+	    _krb5_debug(context, 0, "fd too large for select");
+	    rk_closesocket(fd);
+	    continue;
+	}
+#endif
+	socket_set_nonblocking(fd, 1);
+
+	host = heim_alloc(sizeof(*host), "sendto-host", deallocate_host);
+	if (host == NULL) {
+            if (freeai)
+                freeaddrinfo(ai);
+	    rk_closesocket(fd);
+	    return ENOMEM;
+	}
+	host->hi = hi;
+	host->fd = fd;
+	host->ai = a;
+	/* next version of stid */
+	host->tid = ctx->stid = (ctx->stid & 0xffff0000) | ((ctx->stid & 0xffff) + 1);
+
+	host->state = CONNECT;
+
+	switch (host->hi->proto) {
+	case KRB5_KRBHST_HTTP :
+	    host->fun = &http_fun;
+	    break;
+	case KRB5_KRBHST_TCP :
+	    host->fun = &tcp_fun;
+	    break;
+	case KRB5_KRBHST_UDP :
+	    host->fun = &udp_fun;
+	    break;
+	default:
+	    heim_abort("undefined http transport protocol: %d", (int)host->hi->proto);
+	}
+
+	host->tries = host->fun->ntries;
+
+	/*
+	 * Connect directly next host, wait a host_timeout for each next address
+	 */
+	if (submitted_host == 0)
+	    host_connect(context, ctx, host);
+	else {
+	    debug_host(context, 5, host,
+		       "Queuing host in future (in %ds), its the %lu address on the same name",
+		       (int)(context->host_timeout * submitted_host), submitted_host + 1);
+	    host->timeout = time(NULL) + (submitted_host * context->host_timeout);
+	}
+
+	heim_array_append_value(ctx->hosts, host);
+
+	heim_release(host);
+
+	submitted_host++;
+    }
+
+    if (freeai)
+	freeaddrinfo(ai);
+
+    if (!submitted_host)
+	return KRB5_KDC_UNREACH;
+
+    return 0;
+}
+
+struct wait_ctx {
+    krb5_context context;
+    krb5_sendto_ctx ctx;
+    fd_set rfds;
+    fd_set wfds;
+    unsigned max_fd;
+    int got_reply;
+    time_t timenow;
+};
+
+static void
+wait_setup(heim_object_t obj, void *iter_ctx, int *stop)
+{
+    struct wait_ctx *wait_ctx = iter_ctx;
+    struct host *h = (struct host *)obj;
+
+    /* skip dead hosts */
+    if (h->state == DEAD)
+	return;
+
+    if (h->state == CONNECT) {
+	if (h->timeout < wait_ctx->timenow)
+	    host_connect(wait_ctx->context, wait_ctx->ctx, h);
+	return;
+    }
+
+    /* if host timed out, dec tries and (retry or kill host) */
+    if (h->timeout < wait_ctx->timenow) {
+	heim_assert(h->tries != 0, "tries should not reach 0");
+	h->tries--;
+	if (h->tries == 0) {
+	    host_dead(wait_ctx->context, h, "host timed out");
+	    return;
+	} else {
+	    debug_host(wait_ctx->context, 5, h, "retrying sending to");
+	    host_next_timeout(wait_ctx->context, h);
+	    host_connected(wait_ctx->context, wait_ctx->ctx, h);
+	}
+    }
+    
+#ifndef NO_LIMIT_FD_SETSIZE
+    heim_assert(h->fd < FD_SETSIZE, "fd too large");
+#endif
+    switch (h->state) {
+    case WAITING_REPLY:
+	FD_SET(h->fd, &wait_ctx->rfds);
+	break;
+    case CONNECTING:
+    case CONNECTED:
+	FD_SET(h->fd, &wait_ctx->rfds);
+	FD_SET(h->fd, &wait_ctx->wfds);
+	break;
+    default:
+	heim_abort("invalid sendto host state");
+    }
+    if (h->fd > wait_ctx->max_fd)
+	wait_ctx->max_fd = h->fd;
+}
+
+static int
+wait_filter_dead(heim_object_t obj, void *ctx)
+{
+    struct host *h = (struct host *)obj;
+    return (int)((h->state == DEAD) ? true : false);
+}
+
+static void
+wait_process(heim_object_t obj, void *ctx, int *stop)
+{
+    struct wait_ctx *wait_ctx = ctx;
+    struct host *h = (struct host *)obj;
+    int readable, writeable;
+    heim_assert(h->state != DEAD, "dead host resurected");
+
+#ifndef NO_LIMIT_FD_SETSIZE
+    heim_assert(h->fd < FD_SETSIZE, "fd too large");
+#endif
+    readable = FD_ISSET(h->fd, &wait_ctx->rfds);
+    writeable = FD_ISSET(h->fd, &wait_ctx->wfds);
+
+    if (readable || writeable || h->state == CONNECT)
+	wait_ctx->got_reply |= eval_host_state(wait_ctx->context, wait_ctx->ctx, h, readable, writeable);
+
+    /* if there is already a reply, just fall though the array */
+    if (wait_ctx->got_reply)
+	*stop = 1;
+}
+
+static krb5_error_code
+wait_response(krb5_context context, int *action, krb5_sendto_ctx ctx)
+{
+    struct wait_ctx wait_ctx;
+    struct timeval tv;
+    int ret;
+
+    wait_ctx.context = context;
+    wait_ctx.ctx = ctx;
+    FD_ZERO(&wait_ctx.rfds);
+    FD_ZERO(&wait_ctx.wfds);
+    wait_ctx.max_fd = 0;
+
+    /* oh, we have a reply, it must be a plugin that got it for us */
+    if (ctx->response.length) {
+	*action = KRB5_SENDTO_FILTER;
+	return 0;
+    }
+
+    wait_ctx.timenow = time(NULL);
+
+    heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_setup);
+    heim_array_filter_f(ctx->hosts, &wait_ctx, wait_filter_dead);
+
+    if (heim_array_get_length(ctx->hosts) == 0) {
+	if (ctx->stateflags & KRBHST_COMPLETED) {
+	    _krb5_debug(context, 5, "no more hosts to send/recv packets to/from "
+			 "trying to pulling more hosts");
+	    *action = KRB5_SENDTO_FAILED;
+	} else {
+	    _krb5_debug(context, 5, "no more hosts to send/recv packets to/from "
+			 "and no more hosts -> failure");
+	    *action = KRB5_SENDTO_TIMEOUT;
+	}
+	return 0;
+    }
+
+    tv.tv_sec = 1;
+    tv.tv_usec = 0;
+
+    ret = select(wait_ctx.max_fd + 1, &wait_ctx.rfds, &wait_ctx.wfds, NULL, &tv);
+    if (ret < 0)
+	return errno;
+    if (ret == 0) {
+	*action = KRB5_SENDTO_TIMEOUT;
+	return 0;
+    }
+
+    wait_ctx.got_reply = 0;
+    heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_process);
+    if (wait_ctx.got_reply)
+	*action = KRB5_SENDTO_FILTER;
+    else
+	*action = KRB5_SENDTO_CONTINUE;
+
+    return 0;
+}
+
+static void
+reset_context(krb5_context context, krb5_sendto_ctx ctx)
+{
+    krb5_data_free(&ctx->response);
+    heim_release(ctx->hosts);
+    ctx->hosts = heim_array_create();
+    ctx->stateflags = 0;
+}
+
+
+/*
+ *
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sendto_context(krb5_context context,
+		    krb5_sendto_ctx ctx,
+		    const krb5_data *send_data,
+		    krb5_const_realm realm,
+		    krb5_data *receive)
+{
+    krb5_error_code ret = 0;
+    krb5_krbhst_handle handle = NULL;
+    struct timeval nrstart, nrstop, stop_time;
+    int type, freectx = 0;
+    int action;
+    int numreset = 0;
+
+    krb5_data_zero(receive);
+    
+    if (ctx == NULL) {
+	ret = krb5_sendto_ctx_alloc(context, &ctx);
+	if (ret)
+	    goto out;
+	freectx = 1;
+    }
+
+    ctx->stid = (context->num_kdc_requests++) << 16;
+
+    memset(&ctx->stats, 0, sizeof(ctx->stats));
+    gettimeofday(&ctx->stats.start_time, NULL);
+
+    type = ctx->type;
+    if (type == 0) {
+	if ((ctx->flags & KRB5_KRBHST_FLAGS_MASTER) || context->use_admin_kdc)
+	    type = KRB5_KRBHST_ADMIN;
+	else
+	    type = KRB5_KRBHST_KDC;
+    }
+
+    ctx->send_data = send_data;
+
+    if ((int)send_data->length > context->large_msg_size)
+	ctx->flags |= KRB5_KRBHST_FLAGS_LARGE_MSG;
+
+    /* loop until we get back a appropriate response */
+
+    action = KRB5_SENDTO_INITIAL;
+
+    while (action != KRB5_SENDTO_DONE && action != KRB5_SENDTO_FAILED) {
+	krb5_krbhst_info *hi;
+
+	switch (action) {
+	case KRB5_SENDTO_INITIAL:
+	    ret = realm_via_plugin(context, realm, context->kdc_timeout,
+				   send_data, &ctx->response);
+	    if (ret == 0 || ret != KRB5_PLUGIN_NO_HANDLE) {
+		action = KRB5_SENDTO_DONE;
+		break;
+	    }
+	    action = KRB5_SENDTO_KRBHST;
+	    /* FALLTHOUGH */
+	case KRB5_SENDTO_KRBHST:
+	    if (ctx->krbhst == NULL) {
+		ret = krb5_krbhst_init_flags(context, realm, type,
+					     ctx->flags, &handle);
+		if (ret)
+		    goto out;
+
+		if (ctx->hostname) {
+		    ret = krb5_krbhst_set_hostname(context, handle, ctx->hostname);
+		    if (ret)
+			goto out;
+		}
+
+	    } else {
+		handle = heim_retain(ctx->krbhst);
+	    }
+	    action = KRB5_SENDTO_TIMEOUT;
+	    /* FALLTHOUGH */
+	case KRB5_SENDTO_TIMEOUT:
+
+	    /*
+	     * If we completed, just got to next step
+	     */
+
+	    if (ctx->stateflags & KRBHST_COMPLETED) {
+		action = KRB5_SENDTO_CONTINUE;
+		break;
+	    }
+
+	    /*
+	     * Pull out next host, if there is no more, close the
+	     * handle and mark as completed.
+	     *
+	     * Collect time spent in krbhst (dns, plugin, etc)
+	     */
+
+
+	    gettimeofday(&nrstart, NULL);
+
+	    ret = krb5_krbhst_next(context, handle, &hi);
+
+	    gettimeofday(&nrstop, NULL);
+	    timevalsub(&nrstop, &nrstart);
+	    timevaladd(&ctx->stats.krbhst, &nrstop);
+
+	    action = KRB5_SENDTO_CONTINUE;
+	    if (ret == 0) {
+		_krb5_debug(context, 5, "submissing new requests to new host");
+		if (submit_request(context, ctx, hi) != 0)
+		    action = KRB5_SENDTO_TIMEOUT;
+	    } else {
+		_krb5_debug(context, 5, "out of hosts, waiting for replies");
+		ctx->stateflags |= KRBHST_COMPLETED;
+	    }
+
+	    break;
+	case KRB5_SENDTO_CONTINUE:
+
+	    ret = wait_response(context, &action, ctx);
+	    if (ret)
+		goto out;
+
+	    break;
+	case KRB5_SENDTO_RESET:
+	    /* start over */
+	    _krb5_debug(context, 5,
+			"krb5_sendto trying over again (reset): %d",
+			numreset);
+	    reset_context(context, ctx);
+	    if (handle) {
+		krb5_krbhst_free(context, handle);
+		handle = NULL;
+	    }
+	    numreset++;
+	    if (numreset >= 3)
+		action = KRB5_SENDTO_FAILED;
+	    else
+		action = KRB5_SENDTO_KRBHST;
+
+	    break;
+	case KRB5_SENDTO_FILTER:
+	    /* default to next state, the filter function might modify this */
+	    action = KRB5_SENDTO_DONE;
+
+	    if (ctx->func) {
+		ret = (*ctx->func)(context, ctx, ctx->data,
+				   &ctx->response, &action);
+		if (ret)
+		    goto out;
+	    }
+	    break;
+	case KRB5_SENDTO_FAILED:
+	    ret = KRB5_KDC_UNREACH;
+	    break;
+	case KRB5_SENDTO_DONE:
+	    ret = 0;
+	    break;
+	default:
+	    heim_abort("invalid krb5_sendto_context state");
+	}
+    }
+
+out:
+    gettimeofday(&stop_time, NULL);
+    timevalsub(&stop_time, &ctx->stats.start_time);
+    if (ret == 0 && ctx->response.length) {
+	*receive = ctx->response;
+	krb5_data_zero(&ctx->response);
+    } else {
+	krb5_data_free(&ctx->response);
+	krb5_clear_error_message (context);
+	ret = KRB5_KDC_UNREACH;
+	krb5_set_error_message(context, ret,
+			       N_("unable to reach any KDC in realm %s", ""),
+			       realm);
+    }
+
+    _krb5_debug(context, 1,
+		"%s %s done: %d hosts %lu packets %lu:"
+		" wc: %jd.%06ld nr: %jd.%06ld kh: %jd.%06ld tid: %08x",
+		__func__, realm, ret,
+		ctx->stats.num_hosts, ctx->stats.sent_packets,
+		(intmax_t)stop_time.tv_sec,
+		(long)stop_time.tv_usec,
+		(intmax_t)ctx->stats.name_resolution.tv_sec,
+		(long)ctx->stats.name_resolution.tv_usec,
+		(intmax_t)ctx->stats.krbhst.tv_sec,
+		(long)ctx->stats.krbhst.tv_usec, ctx->stid);
+
+
+    if (freectx)
+	krb5_sendto_ctx_free(context, ctx);
+    else
+	reset_context(context, ctx);
+
+    if (handle)
+	krb5_krbhst_free(context, handle);
+
+    return ret;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc_plugin.h b/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc_plugin.h
index 1e74f4557..545c38ebb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc_plugin.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/send_to_kdc_plugin.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: send_to_kdc_plugin.h,v 1.1.1.2 2011/04/14 14:09:25 elric Exp $	*/
+/*	$NetBSD: send_to_kdc_plugin.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -42,6 +42,10 @@
 
 #define KRB5_PLUGIN_SEND_TO_KDC "send_to_kdc"
 
+#define KRB5_PLUGIN_SEND_TO_KDC_VERSION_0 0
+#define KRB5_PLUGIN_SEND_TO_KDC_VERSION_2 2
+#define KRB5_PLUGIN_SEND_TO_KDC_VERSION KRB5_PLUGIN_SEND_TO_KDC_VERSION_2
+
 typedef krb5_error_code
 (*krb5plugin_send_to_kdc_func)(krb5_context,
 			       void *,
@@ -49,12 +53,21 @@ typedef krb5_error_code
 			       time_t timeout,
 			       const krb5_data *,
 			       krb5_data *);
+typedef krb5_error_code
+(*krb5plugin_send_to_realm_func)(krb5_context,
+				 void *,
+				 krb5_const_realm,
+				 time_t timeout,
+				 const krb5_data *,
+				 krb5_data *);
+
 
 typedef struct krb5plugin_send_to_kdc_ftable {
     int			minor_version;
     krb5_error_code	(*init)(krb5_context, void **);
     void		(*fini)(void *);
     krb5plugin_send_to_kdc_func send_to_kdc;
+    krb5plugin_send_to_realm_func send_to_realm; /* added in version 2 */
 } krb5plugin_send_to_kdc_ftable;
 
 #endif /* HEIMDAL_KRB5_SEND_TO_KDC_PLUGIN_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/sendauth.c b/crypto/external/bsd/heimdal/dist/lib/krb5/sendauth.c
index 58644f386..b602c53f0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/sendauth.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/sendauth.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sendauth.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: sendauth.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
@@ -62,6 +62,29 @@
  * }
  */
 
+/**
+ * Perform the client side of the sendauth protocol.
+ *
+ * @param context        Kerberos 5 context.
+ * @param auth_context   Authentication context of the peer.
+ * @param p_fd           Socket associated to the connection.
+ * @param appl_version   Server-specific string.
+ * @param client         Client principal. If NULL, use the credentials in \a ccache.
+ * @param server         Server principal.
+ * @param ap_req_options Options for the AP_REQ message. See the AP_OPTS_* defines in krb5.h.
+ * @param in_data        FIXME
+ * @param in_creds       FIXME
+ * @param ccache         Credentials cache. If NULL, use the default credentials cache.
+ * @param ret_error      If not NULL, will be set to the error reported by server, if any.
+ *                       Must be deallocated with krb5_free_error_contents().
+ * @param rep_result     If not NULL, will be set to the EncApRepPart of the AP_REP message.
+ *                       Must be deallocated with krb5_free_ap_rep_enc_part().
+ * @param out_creds      FIXME If not NULL, will be set to FIXME. Must be deallocated with
+ *                       krb5_free_creds().
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
+ */
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sendauth(krb5_context context,
 	      krb5_auth_context *auth_context,
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/set_default_realm.c b/crypto/external/bsd/heimdal/dist/lib/krb5/set_default_realm.c
index c24d5a743..ca0399e8e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/set_default_realm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/set_default_realm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: set_default_realm.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: set_default_realm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -45,17 +45,12 @@ string_to_list (krb5_context context, const char *s, krb5_realm **list)
 {
 
     *list = malloc (2 * sizeof(**list));
-    if (*list == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (*list == NULL)
+	return krb5_enomem(context);
     (*list)[0] = strdup (s);
     if ((*list)[0] == NULL) {
 	free (*list);
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
+	return krb5_enomem(context);
     }
     (*list)[1] = NULL;
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/sock_principal.c b/crypto/external/bsd/heimdal/dist/lib/krb5/sock_principal.c
index b908c5583..80217dbc5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/sock_principal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/sock_principal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sock_principal.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: sock_principal.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/sp800-108-kdf.c b/crypto/external/bsd/heimdal/dist/lib/krb5/sp800-108-kdf.c
new file mode 100644
index 000000000..2895d3c66
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/sp800-108-kdf.c
@@ -0,0 +1,99 @@
+/*	$NetBSD: sp800-108-kdf.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2015, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "krb5_locl.h"
+
+/*
+ * SP800-108 KDF
+ */
+
+/**
+ * As described in SP800-108 5.1 (for HMAC)
+ *
+ * @param context	Kerberos 5 context
+ * @param kdf_K1	Base key material.
+ * @param kdf_label	A string that identifies the purpose for the derived key.
+ * @param kdf_context   A binary string containing parties, nonce, etc.
+ * @param md		Message digest function to use for PRF.
+ * @param kdf_K0	Derived key data.
+ *
+ * @return Return an error code for an failure or 0 on success.
+ * @ingroup krb5_crypto
+ */
+krb5_error_code
+_krb5_SP800_108_HMAC_KDF(krb5_context context,
+			 const krb5_data *kdf_K1,
+			 const krb5_data *kdf_label,
+			 const krb5_data *kdf_context,
+			 const EVP_MD *md,
+			 krb5_data *kdf_K0)
+{
+    HMAC_CTX c;
+    unsigned char *p = kdf_K0->data;
+    size_t i, n, left = kdf_K0->length;
+    unsigned char hmac[EVP_MAX_MD_SIZE];
+    unsigned int h = EVP_MD_size(md);
+    const size_t L = kdf_K0->length;
+
+    heim_assert(md != NULL, "SP800-108 KDF internal error");
+
+    HMAC_CTX_init(&c);
+
+    n = L / h;
+
+    for (i = 0; i <= n; i++) {
+	unsigned char tmp[4];
+	size_t len;
+
+	HMAC_Init_ex(&c, kdf_K1->data, kdf_K1->length, md, NULL);
+
+	_krb5_put_int(tmp, i + 1, 4);
+	HMAC_Update(&c, tmp, 4);
+	HMAC_Update(&c, kdf_label->data, kdf_label->length);
+	HMAC_Update(&c, (unsigned char *)"", 1);
+	if (kdf_context)
+	    HMAC_Update(&c, kdf_context->data, kdf_context->length);
+	_krb5_put_int(tmp, L * 8, 4);
+	HMAC_Update(&c, tmp, 4);
+
+	HMAC_Final(&c, hmac, &h);
+	len = h > left ? left : h;
+	memcpy(p, hmac, len);
+	p += len;
+	left -= len;
+    }
+
+    HMAC_CTX_cleanup(&c);
+
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.c
index 01c10c87f..212c5f552 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store-int.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store-int.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
@@ -36,7 +36,7 @@
 #include "krb5_locl.h"
 
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
-_krb5_put_int(void *buffer, unsigned long value, size_t size)
+_krb5_put_int(void *buffer, uint64_t value, size_t size)
 {
     unsigned char *p = buffer;
     int i;
@@ -48,7 +48,7 @@ _krb5_put_int(void *buffer, unsigned long value, size_t size)
 }
 
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
-_krb5_get_int(void *buffer, unsigned long *value, size_t size)
+_krb5_get_int64(void *buffer, uint64_t *value, size_t size)
 {
     unsigned char *p = buffer;
     unsigned long v = 0;
@@ -58,3 +58,12 @@ _krb5_get_int(void *buffer, unsigned long *value, size_t size)
     *value = v;
     return size;
 }
+
+KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
+_krb5_get_int(void *buffer, unsigned long *value, size_t size)
+{
+    uint64_t v64;
+    krb5_ssize_t bytes = _krb5_get_int64(buffer, &v64, size);
+    *value = v64;
+    return bytes;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.h b/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.h
index 19fc415a7..ba04d1b93 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.h
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store-int.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: store-int.h,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store-int.h,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2002 Kungliga Tekniska Högskolan
@@ -42,6 +42,7 @@ struct krb5_storage_data {
     ssize_t (*store)(struct krb5_storage_data*, const void*, size_t);
     off_t (*seek)(struct krb5_storage_data*, off_t, int);
     int (*trunc)(struct krb5_storage_data*, off_t);
+    int (*fsync)(struct krb5_storage_data*);
     void (*free)(struct krb5_storage_data*);
     krb5_flags flags;
     int eof_code;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store-test.c
index 55aaa2527..417ad0f41 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store-test.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store.c
index 6775be7dc..1e445e095 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
@@ -192,6 +192,25 @@ krb5_storage_truncate(krb5_storage *sp, off_t offset)
     return (*sp->trunc)(sp, offset);
 }
 
+/**
+ * Sync the storage buffer to its backing store.  If there is no
+ * backing store this function will return success.
+ *
+ * @param sp the storage buffer to sync
+ *
+ * @return A Kerberos 5 error code
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
+krb5_storage_fsync(krb5_storage *sp)
+{
+    if (sp->fsync != NULL)
+	return sp->fsync(sp);
+    return 0;
+}
+
 /**
  * Read to the storage buffer.
  *
@@ -272,6 +291,8 @@ krb5_storage_get_eof_code(krb5_storage *sp)
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_storage_free(krb5_storage *sp)
 {
+    if (sp == NULL)
+        return 0;
     if(sp->free)
 	(*sp->free)(sp);
     free(sp->data);
@@ -318,13 +339,13 @@ krb5_storage_to_data(krb5_storage *sp, krb5_data *data)
 
 static krb5_error_code
 krb5_store_int(krb5_storage *sp,
-	       int32_t value,
+	       int64_t value,
 	       size_t len)
 {
     int ret;
-    unsigned char v[16];
+    unsigned char v[8];
 
-    if(len > sizeof(v))
+    if (len > sizeof(v))
 	return EINVAL;
     _krb5_put_int(v, value, len);
     ret = sp->store(sp, v, len);
@@ -358,6 +379,33 @@ krb5_store_int32(krb5_storage *sp,
     return krb5_store_int(sp, value, 4);
 }
 
+/**
+ * Store a int64 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_store_int64(krb5_storage *sp,
+		 int64_t value)
+{
+    if (BYTEORDER_IS_HOST(sp))
+#ifdef WORDS_BIGENDIAN
+        ;
+#else
+	value = bswap64(value); /* There's no ntohll() */
+#endif
+    else if (BYTEORDER_IS_LE(sp))
+	value = bswap64(value);
+    return krb5_store_int(sp, value, 8);
+}
+
 /**
  * Store a uint32 to storage, byte order is controlled by the settings
  * on the storage, see krb5_storage_set_byteorder().
@@ -377,24 +425,100 @@ krb5_store_uint32(krb5_storage *sp,
     return krb5_store_int32(sp, (int32_t)value);
 }
 
+/**
+ * Store a uint64 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_store_uint64(krb5_storage *sp,
+		  uint64_t value)
+{
+    return krb5_store_int64(sp, (int64_t)value);
+}
+
 static krb5_error_code
 krb5_ret_int(krb5_storage *sp,
-	     int32_t *value,
+	     int64_t *value,
 	     size_t len)
 {
     int ret;
-    unsigned char v[4];
-    unsigned long w;
+    unsigned char v[8];
+    uint64_t w;
+    *value = 0; /* quiets warnings */
     ret = sp->fetch(sp, v, len);
     if (ret < 0)
 	return errno;
     if ((size_t)ret != len)
 	return sp->eof_code;
-    _krb5_get_int(v, &w, len);
+    _krb5_get_int64(v, &w, len);
     *value = w;
     return 0;
 }
 
+/**
+ * Read a int64 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_ret_int64(krb5_storage *sp,
+	       int64_t *value)
+{
+    krb5_error_code ret = krb5_ret_int(sp, value, 8);
+    if(ret)
+	return ret;
+    if(BYTEORDER_IS_HOST(sp))
+#ifdef WORDS_BIGENDIAN
+        ;
+#else
+	*value = bswap64(*value); /* There's no ntohll() */
+#endif
+    else if(BYTEORDER_IS_LE(sp))
+	*value = bswap64(*value);
+    return 0;
+}
+
+/**
+ * Read a uint64 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_ret_uint64(krb5_storage *sp,
+		uint64_t *value)
+{
+    krb5_error_code ret;
+    int64_t v;
+
+    ret = krb5_ret_int64(sp, &v);
+    if (ret == 0)
+	*value = (uint64_t)v;
+
+    return ret;
+}
+
 /**
  * Read a int32 from storage, byte order is controlled by the settings
  * on the storage, see krb5_storage_set_byteorder().
@@ -411,12 +535,15 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_int32(krb5_storage *sp,
 	       int32_t *value)
 {
-    krb5_error_code ret = krb5_ret_int(sp, value, 4);
-    if(ret)
+    int64_t v;
+
+    krb5_error_code ret = krb5_ret_int(sp, &v, 4);
+    if (ret)
 	return ret;
-    if(BYTEORDER_IS_HOST(sp))
+    *value = v;
+    if (BYTEORDER_IS_HOST(sp))
 	*value = htonl(*value);
-    else if(BYTEORDER_IS_LE(sp))
+    else if (BYTEORDER_IS_LE(sp))
 	*value = bswap32(*value);
     return 0;
 }
@@ -434,8 +561,7 @@ krb5_ret_int32(krb5_storage *sp,
  */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_ret_uint32(krb5_storage *sp,
-		uint32_t *value)
+krb5_ret_uint32(krb5_storage *sp, uint32_t *value)
 {
     krb5_error_code ret;
     int32_t v;
@@ -505,7 +631,7 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_int16(krb5_storage *sp,
 	       int16_t *value)
 {
-    int32_t v;
+    int64_t v;
     int ret;
     ret = krb5_ret_int(sp, &v, 2);
     if(ret)
@@ -690,8 +816,10 @@ krb5_ret_data(krb5_storage *sp,
 	return ret;
     if (size) {
 	ret = sp->fetch(sp, data->data, size);
-	if(ret != size)
+	if(ret != size) {
+            krb5_data_free(data);
 	    return (ret < 0)? errno : sp->eof_code;
+	}
     }
     return 0;
 }
@@ -794,12 +922,15 @@ krb5_ret_stringz(krb5_storage *sp,
     ssize_t ret;
 
     while((ret = sp->fetch(sp, &c, 1)) == 1){
+	krb5_error_code eret;
 	char *tmp;
 
 	len++;
-	ret = size_too_large(sp, len);
-	if (ret)
-	    break;
+	eret = size_too_large(sp, len);
+	if (eret) {
+	    free(s);
+	    return eret;
+	}
 	tmp = realloc (s, len);
 	if (tmp == NULL) {
 	    free (s);
@@ -854,6 +985,7 @@ krb5_ret_stringnl(krb5_storage *sp,
     ssize_t ret;
 
     while((ret = sp->fetch(sp, &c, 1)) == 1){
+	krb5_error_code eret;
 	char *tmp;
 
 	if (c == '\r') {
@@ -866,9 +998,11 @@ krb5_ret_stringnl(krb5_storage *sp,
 	}
 
 	len++;
-	ret = size_too_large(sp, len);
-	if (ret)
-	    break;
+	eret = size_too_large(sp, len);
+	if (eret) {
+	    free(s);
+	    return eret;
+	}
 	tmp = realloc (s, len);
 	if (tmp == NULL) {
 	    free (s);
@@ -1322,14 +1456,9 @@ krb5_store_creds(krb5_storage *sp, krb5_creds *creds)
     ret = krb5_store_int8(sp, creds->second_ticket.length != 0); /* is_skey */
     if(ret)
 	return ret;
-
-    if(krb5_storage_is_flags(sp, KRB5_STORAGE_CREDS_FLAGS_WRONG_BITORDER))
-	ret = krb5_store_int32(sp, creds->flags.i);
-    else
-	ret = krb5_store_int32(sp, bitswap32(TicketFlags2int(creds->flags.b)));
+    ret = krb5_store_int32(sp, bitswap32(TicketFlags2int(creds->flags.b)));
     if(ret)
 	return ret;
-
     ret = krb5_store_addrs(sp, creds->addresses);
     if(ret)
 	return ret;
@@ -1374,23 +1503,7 @@ krb5_ret_creds(krb5_storage *sp, krb5_creds *creds)
     if(ret) goto cleanup;
     ret = krb5_ret_int32 (sp,  &dummy32);
     if(ret) goto cleanup;
-    /*
-     * Runtime detect the what is the higher bits of the bitfield. If
-     * any of the higher bits are set in the input data, it's either a
-     * new ticket flag (and this code need to be removed), or it's a
-     * MIT cache (or new Heimdal cache), lets change it to our current
-     * format.
-     */
-    {
-	uint32_t mask = 0xffff0000;
-	creds->flags.i = 0;
-	creds->flags.b.anonymous = 1;
-	if (creds->flags.i & mask)
-	    mask = ~mask;
-	if (dummy32 & mask)
-	    dummy32 = bitswap32(dummy32);
-    }
-    creds->flags.i = dummy32;
+    creds->flags.b = int2TicketFlags(bitswap32(dummy32));
     ret = krb5_ret_addrs (sp,  &creds->addresses);
     if(ret) goto cleanup;
     ret = krb5_ret_authdata (sp,  &creds->authdata);
@@ -1549,23 +1662,7 @@ krb5_ret_creds_tag(krb5_storage *sp,
     if(ret) goto cleanup;
     ret = krb5_ret_int32 (sp,  &dummy32);
     if(ret) goto cleanup;
-    /*
-     * Runtime detect the what is the higher bits of the bitfield. If
-     * any of the higher bits are set in the input data, it's either a
-     * new ticket flag (and this code need to be removed), or it's a
-     * MIT cache (or new Heimdal cache), lets change it to our current
-     * format.
-     */
-    {
-	uint32_t mask = 0xffff0000;
-	creds->flags.i = 0;
-	creds->flags.b.anonymous = 1;
-	if (creds->flags.i & mask)
-	    mask = ~mask;
-	if (dummy32 & mask)
-	    dummy32 = bitswap32(dummy32);
-    }
-    creds->flags.i = dummy32;
+    creds->flags.b = int2TicketFlags(bitswap32(dummy32));
     if (header & SC_ADDRESSES) {
 	ret = krb5_ret_addrs (sp,  &creds->addresses);
 	if(ret) goto cleanup;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store_emem.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store_emem.c
index 62fe0cae2..16bdbe52c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store_emem.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store_emem.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store_emem.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store_emem.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -158,6 +158,7 @@ emem_free(krb5_storage *sp)
  * @sa krb5_storage_from_readonly_mem()
  * @sa krb5_storage_from_fd()
  * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_socket()
  */
 
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
@@ -191,6 +192,7 @@ krb5_storage_emem(void)
     sp->store = emem_store;
     sp->seek = emem_seek;
     sp->trunc = emem_trunc;
+    sp->fsync = NULL;
     sp->free = emem_free;
     sp->max_alloc = UINT_MAX/8;
     return sp;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store_fd.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store_fd.c
index 2dbba98a4..9e4a9882d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store_fd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store_fd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store_fd.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store_fd.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
@@ -45,13 +45,47 @@ typedef struct fd_storage {
 static ssize_t
 fd_fetch(krb5_storage * sp, void *data, size_t size)
 {
-    return net_read(FD(sp), data, size);
+    char *cbuf = (char *)data;
+    ssize_t count;
+    size_t rem = size;
+
+    /* similar pattern to net_read() to support pipes */
+    while (rem > 0) {
+	count = read (FD(sp), cbuf, rem);
+	if (count < 0) {
+	    if (errno == EINTR)
+		continue;
+	    else
+		return count;
+	} else if (count == 0) {
+	    return count;
+	}
+	cbuf += count;
+	rem -= count;
+    }
+    return size;
 }
 
 static ssize_t
 fd_store(krb5_storage * sp, const void *data, size_t size)
 {
-    return net_write(FD(sp), data, size);
+    const char *cbuf = (const char *)data;
+    ssize_t count;
+    size_t rem = size;
+
+    /* similar pattern to net_write() to support pipes */
+    while (rem > 0) {
+	count = write(FD(sp), cbuf, rem);
+	if (count < 0) {
+	    if (errno == EINTR)
+		continue;
+	    else
+		return count;
+	}
+	cbuf += count;
+	rem -= count;
+    }
+    return size;
 }
 
 static off_t
@@ -68,10 +102,20 @@ fd_trunc(krb5_storage * sp, off_t offset)
     return 0;
 }
 
+static int
+fd_sync(krb5_storage * sp)
+{
+    if (fsync(FD(sp)) == -1)
+	return errno;
+    return 0;
+}
+
 static void
 fd_free(krb5_storage * sp)
 {
-    close(FD(sp));
+    int save_errno = errno;
+    if (close(FD(sp)) == 0)
+        errno = save_errno;
 }
 
 /**
@@ -85,41 +129,48 @@ fd_free(krb5_storage * sp)
  * @sa krb5_storage_from_mem()
  * @sa krb5_storage_from_readonly_mem()
  * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_socket()
  */
 
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
-krb5_storage_from_fd(krb5_socket_t fd_in)
+krb5_storage_from_fd(int fd_in)
 {
     krb5_storage *sp;
+    int saved_errno;
     int fd;
 
-#ifdef SOCKET_IS_NOT_AN_FD
 #ifdef _MSC_VER
-    if (_get_osfhandle(fd_in) != -1) {
-	fd = dup(fd_in);
-    } else {
-	fd = _open_osfhandle(fd_in, 0);
-    }
+    /*
+     * This function used to try to pass the input to
+     * _get_osfhandle() to test if the value is a HANDLE
+     * but this doesn't work because doing so throws an
+     * exception that will result in Watson being triggered
+     * to file a Windows Error Report.
+     */
+    fd = _dup(fd_in);
 #else
-#error Dont know how to deal with fd that may or may not be a socket.
-#endif
-#else  /* SOCKET_IS_NOT_AN_FD */
     fd = dup(fd_in);
 #endif
 
     if (fd < 0)
 	return NULL;
 
+    errno = ENOMEM;
     sp = malloc(sizeof(krb5_storage));
     if (sp == NULL) {
+	saved_errno = errno;
 	close(fd);
+	errno = saved_errno;
 	return NULL;
     }
 
+    errno = ENOMEM;
     sp->data = malloc(sizeof(fd_storage));
     if (sp->data == NULL) {
+	saved_errno = errno;
 	close(fd);
 	free(sp);
+	errno = saved_errno;
 	return NULL;
     }
     sp->flags = 0;
@@ -129,6 +180,7 @@ krb5_storage_from_fd(krb5_socket_t fd_in)
     sp->store = fd_store;
     sp->seek = fd_seek;
     sp->trunc = fd_trunc;
+    sp->fsync = fd_sync;
     sp->free = fd_free;
     sp->max_alloc = UINT_MAX/8;
     return sp;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store_mem.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store_mem.c
index 55cc35583..001ae3761 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/store_mem.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store_mem.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: store_mem.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: store_mem.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2000, 2002 Kungliga Tekniska Högskolan
@@ -122,6 +122,7 @@ mem_no_trunc(krb5_storage *sp, off_t offset)
  * @sa krb5_storage_from_readonly_mem()
  * @sa krb5_storage_from_data()
  * @sa krb5_storage_from_fd()
+ * @sa krb5_storage_from_socket()
  */
 
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
@@ -146,6 +147,7 @@ krb5_storage_from_mem(void *buf, size_t len)
     sp->store = mem_store;
     sp->seek = mem_seek;
     sp->trunc = mem_trunc;
+    sp->fsync = NULL;
     sp->free = NULL;
     sp->max_alloc = UINT_MAX/8;
     return sp;
@@ -205,6 +207,7 @@ krb5_storage_from_readonly_mem(const void *buf, size_t len)
     sp->store = mem_no_store;
     sp->seek = mem_seek;
     sp->trunc = mem_no_trunc;
+    sp->fsync = NULL;
     sp->free = NULL;
     sp->max_alloc = UINT_MAX/8;
     return sp;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/store_sock.c b/crypto/external/bsd/heimdal/dist/lib/krb5/store_sock.c
new file mode 100644
index 000000000..04cdc050c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/store_sock.c
@@ -0,0 +1,161 @@
+/*	$NetBSD: store_sock.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb5_locl.h"
+#include "store-int.h"
+
+#ifdef _WIN32
+#include <winsock2.h>
+#endif
+
+typedef struct socket_storage {
+    krb5_socket_t sock;
+} socket_storage;
+
+#define SOCK(S) (((socket_storage*)(S)->data)->sock)
+
+static ssize_t
+socket_fetch(krb5_storage * sp, void *data, size_t size)
+{
+    return net_read(SOCK(sp), data, size);
+}
+
+static ssize_t
+socket_store(krb5_storage * sp, const void *data, size_t size)
+{
+    return net_write(SOCK(sp), data, size);
+}
+
+static off_t
+socket_seek(krb5_storage * sp, off_t offset, int whence)
+{
+    return lseek(SOCK(sp), offset, whence);
+}
+
+static int
+socket_trunc(krb5_storage * sp, off_t offset)
+{
+    if (ftruncate(SOCK(sp), offset) == -1)
+	return errno;
+    return 0;
+}
+
+static int
+socket_sync(krb5_storage * sp)
+{
+    if (fsync(SOCK(sp)) == -1)
+	return errno;
+    return 0;
+}
+
+static void
+socket_free(krb5_storage * sp)
+{
+    int save_errno = errno;
+    if (rk_IS_SOCKET_ERROR(rk_closesocket(SOCK(sp))))
+        errno = rk_SOCK_ERRNO;
+    else
+        errno = save_errno;
+}
+
+/**
+ *
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_emem()
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_fd()
+ */
+
+KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
+krb5_storage_from_socket(krb5_socket_t sock_in)
+{
+    krb5_storage *sp;
+    int saved_errno;
+    krb5_socket_t sock;
+
+#ifdef _WIN32
+    WSAPROTOCOL_INFO info;
+
+    if (WSADuplicateSocket(sock_in, GetCurrentProcessId(), &info) == 0)
+    {
+
+	sock = WSASocket( FROM_PROTOCOL_INFO,
+			  FROM_PROTOCOL_INFO,
+			  FROM_PROTOCOL_INFO,
+			  &info, 0, 0);
+    }
+#else
+    sock = dup(sock_in);
+#endif
+
+    if (sock == rk_INVALID_SOCKET)
+	return NULL;
+
+    errno = ENOMEM;
+    sp = malloc(sizeof(krb5_storage));
+    if (sp == NULL) {
+	saved_errno = errno;
+	rk_closesocket(sock);
+	errno = saved_errno;
+	return NULL;
+    }
+
+    errno = ENOMEM;
+    sp->data = malloc(sizeof(socket_storage));
+    if (sp->data == NULL) {
+	saved_errno = errno;
+	rk_closesocket(sock);
+	free(sp);
+	errno = saved_errno;
+	return NULL;
+    }
+    sp->flags = 0;
+    sp->eof_code = HEIM_ERR_EOF;
+    SOCK(sp) = sock;
+    sp->fetch = socket_fetch;
+    sp->store = socket_store;
+    sp->seek = socket_seek;
+    sp->trunc = socket_trunc;
+    sp->fsync = socket_sync;
+    sp->free = socket_free;
+    sp->max_alloc = UINT_MAX/8;
+    return sp;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/string-to-key-test.c b/crypto/external/bsd/heimdal/dist/lib/krb5/string-to-key-test.c
index 7d302ea07..a4ab83b3a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/string-to-key-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/string-to-key-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: string-to-key-test.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: string-to-key-test.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -88,7 +88,7 @@ static struct testcase {
      {0x6d, 0x2f, 0xcd, 0xf2, 0xd6, 0xfb, 0xbc, 0x3d, 0xdc, 0xad, 0xb5, 0xda, 0x57, 0x10, 0xa2, 0x34, 0x89, 0xb0, 0xd3, 0xb6, 0x9d, 0x5d, 0x9d, 0x4a}},
     {"Juri\xc5\xa1i\xc4\x87@ATHENA.MIT.EDU", "\xc3\x9f", ETYPE_DES3_CBC_SHA1,
      {0x16, 0xd5, 0xa4, 0x0e, 0x1c, 0xe3, 0xba, 0xcb, 0x61, 0xb9, 0xdc, 0xe0, 0x04, 0x70, 0x32, 0x4c, 0x83, 0x19, 0x73, 0xa7, 0xb9, 0x52, 0xfe, 0xb0}},
-    {NULL}
+    {NULL, NULL, 0, {0}}
 };
 
 int
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_acl.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_acl.c
index 03c111ece..84c5e95d9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_acl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_acl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_acl.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_acl.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_addr.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_addr.c
index 8a284e304..8eab1438f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_addr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_addr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_addr.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_addr.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_alname.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_alname.c
index 514903ab4..b57919ff2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_alname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_alname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_alname.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_alname.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -36,13 +36,33 @@
 #include <krb5/getarg.h>
 #include <err.h>
 
+char localname[1024];
+static size_t lname_size = sizeof (localname);
+static int lname_size_arg = 0;
+static int simple_flag = 0;
+static int verbose_flag = 0;
+static int version_flag = 0;
+static int help_flag	= 0;
+
+static struct getargs args[] = {
+    {"lname-size",	0,	arg_integer,	&lname_size_arg,
+     "set localname size (0 means use default, must be 0..1023)", "integer" },
+    {"simple",	0,	arg_flag,	&simple_flag, /* Used for scripting */
+     "map the given principal and print the resulting localname", NULL },
+    {"verbose",	0,	arg_flag,	&verbose_flag,
+     "print the actual principal name as well as the localname", NULL },
+    {"version",	0,	arg_flag,	&version_flag,
+     "print version", NULL },
+    {"help",	0,	arg_flag,	&help_flag,
+     NULL, NULL }
+};
+
 static void
 test_alname(krb5_context context, krb5_const_realm realm,
 	    const char *user, const char *inst,
 	    const char *localuser, int ok)
 {
     krb5_principal p;
-    char localname[1024];
     krb5_error_code ret;
     char *princ;
 
@@ -54,14 +74,16 @@ test_alname(krb5_context context, krb5_const_realm realm,
     if (ret)
 	krb5_err(context, 1, ret, "krb5_unparse_name");
 
-    ret = krb5_aname_to_localname(context, p, sizeof(localname), localname);
+    ret = krb5_aname_to_localname(context, p, lname_size, localname);
     krb5_free_principal(context, p);
-    free(princ);
     if (ret) {
-	if (!ok)
+	if (!ok) {
+	    free(princ);
 	    return;
+	}
 	krb5_err(context, 1, ret, "krb5_aname_to_localname: %s -> %s",
 		 princ, localuser);
+	free(princ);
     }
 
     if (strcmp(localname, localuser) != 0) {
@@ -76,16 +98,6 @@ test_alname(krb5_context context, krb5_const_realm realm,
 
 }
 
-static int version_flag = 0;
-static int help_flag	= 0;
-
-static struct getargs args[] = {
-    {"version",	0,	arg_flag,	&version_flag,
-     "print version", NULL },
-    {"help",	0,	arg_flag,	&help_flag,
-     NULL, NULL }
-};
-
 static void
 usage (int ret)
 {
@@ -121,15 +133,68 @@ main(int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
-    if (argc != 1)
-	errx(1, "first argument should be a local user that in root .k5login");
-
-    user = argv[0];
-
     ret = krb5_init_context(&context);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
 
+    if (simple_flag) {
+	krb5_principal princ;
+	char *unparsed;
+	int status = 0;
+
+	/* Map then print the result and exit */
+	if (argc != 1)
+	    errx(1, "One argument is required and it must be a principal name");
+
+	ret = krb5_parse_name(context, argv[0], &princ);
+	if (ret)
+	    krb5_err(context, 1, ret, "krb5_build_principal");
+
+	ret = krb5_unparse_name(context, princ, &unparsed);
+	if (ret)
+	    krb5_err(context, 1, ret, "krb5_unparse_name");
+
+	if (lname_size_arg > 0 && lname_size_arg < 1024)
+	    lname_size = lname_size_arg;
+	else if (lname_size_arg != 0)
+	    errx(1, "local name size must be between 0 and 1023 (inclusive)");
+
+	ret = krb5_aname_to_localname(context, princ, lname_size, localname);
+	if (ret == KRB5_NO_LOCALNAME) {
+	    if (verbose_flag)
+		fprintf(stderr, "No mapping obtained for %s\n", unparsed);
+	    exit(1);
+	}
+	switch (ret) {
+	case KRB5_PLUGIN_NO_HANDLE:
+	    fprintf(stderr, "Error: KRB5_PLUGIN_NO_HANDLE leaked!\n");
+	    status = 2;
+	    break;
+	case KRB5_CONFIG_NOTENUFSPACE:
+	    fprintf(stderr, "Error: lname-size (%lu) too small\n",
+		    (long unsigned)lname_size);
+	    status = 3;
+	    break;
+	case 0:
+	    if (verbose_flag)
+		printf("%s ", unparsed);
+	    printf("%s\n", localname);
+	    break;
+	default:
+	    krb5_err(context, 4, ret, "krb5_aname_to_localname");
+	    break;
+	}
+	free(unparsed);
+	krb5_free_principal(context, princ);
+	krb5_free_context(context);
+	exit(status);
+    }
+
+    if (argc != 1)
+	errx(1, "first argument should be a local user that is in root .k5login");
+
+    user = argv[0];
+
     ret = krb5_get_default_realm(context, &realm);
     if (ret)
 	krb5_err(context, 1, ret, "krb5_get_default_realm");
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_ap-req.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_ap-req.c
index 2f050f573..42171c7fe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_ap-req.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_ap-req.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_ap-req.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_ap-req.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_canon.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_canon.c
new file mode 100644
index 000000000..b3dbac1d2
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_canon.c
@@ -0,0 +1,179 @@
+/*	$NetBSD: test_canon.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "krb5_locl.h"
+#include <err.h>
+#include <krb5/getarg.h>
+
+#if 0
+#include <stdio.h>
+#include <string.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <krb5/krb5.h>
+#endif
+
+int
+main(int argc, char **argv)
+{
+    krb5_error_code retval;
+    krb5_context context;
+    krb5_principal princ = NULL;
+    krb5_principal me = NULL;
+    krb5_principal cmp_to_princ = NULL;
+    krb5_ccache cc = NULL;
+    krb5_creds *out_creds = NULL;
+    krb5_keytab kt = NULL;
+    krb5_keytab_entry ktent;
+    krb5_creds in_creds;
+    char *hostname = NULL;
+    char *unparsed = NULL;
+    char *unparsed_canon = NULL;
+    char *during;
+    char *cmp_to = NULL;;
+    int do_kt = 0;
+    int do_get_creds = 0;
+    int opt;
+    int ret = 1;
+
+    memset(&ktent, 0, sizeof(ktent));
+
+    while ((opt = getopt(argc, argv, "hgkc:")) != -1) {
+	switch (opt) {
+	case 'g':
+	    do_get_creds++;
+	    break;
+	case 'k':
+	    do_kt++;
+	    break;
+	case 'c':
+	    cmp_to = optarg;
+	    break;
+	case 'h':
+	default:
+	    fprintf(stderr, "Usage: %s [-g] [-k] [-c compare-to-principal] "
+		    "[principal]\n", argv[0]);
+	    return 1;
+	}
+    }
+
+    if (!do_get_creds && !do_kt && !cmp_to)
+	do_get_creds++;
+
+    if (optind < argc)
+	hostname = argv[optind];
+
+    during = "init_context";
+    retval = krb5_init_context(&context);
+    if (retval) goto err;
+
+    during = "sn2p";
+    retval = krb5_sname_to_principal(context, hostname, "host", KRB5_NT_SRV_HST, &princ);
+    if (retval) goto err;
+
+    during = "unparse of sname2princ";
+    retval = krb5_unparse_name(context, princ, &unparsed);
+    if (retval) goto err;
+    printf("krb5_sname_to_principal() output: %s\n", unparsed);
+
+    if (cmp_to) {
+	krb5_boolean eq;
+
+	during = "parsing principal name for comparison compare";
+	retval = krb5_parse_name(context, cmp_to, &cmp_to_princ);
+	if (retval) goto err;
+
+	eq = krb5_principal_compare(context, princ, cmp_to_princ);
+	printf("%s %s %s\n", unparsed, eq ? "==" : "!=", cmp_to);
+    }
+
+    if (do_get_creds) {
+	during = "ccdefault";
+	retval = krb5_cc_default(context, &cc);
+	if (retval) goto err;
+
+	during = "ccprinc";
+	retval = krb5_cc_get_principal(context, cc, &me);
+	if (retval) goto err;
+
+	memset(&in_creds, 0, sizeof(in_creds));
+	in_creds.client = me;
+	in_creds.server = princ;
+
+	during = "getcreds";
+	retval = krb5_get_credentials(context, 0, cc, &in_creds, &out_creds);
+	if (retval) goto err;
+
+	during = "unparsing principal name canonicalized by krb5_get_credentials()";
+	retval = krb5_unparse_name(context, in_creds.server, &unparsed_canon);
+	if (retval) goto err;
+	printf("Principal name as canonicalized by krb5_get_credentials() is %s\n", unparsed_canon);
+    }
+
+    if (do_kt) {
+	during = "getting keytab";
+	retval = krb5_kt_default(context, &kt);
+	if (retval) goto err;
+
+	during = "getting keytab ktent";
+	retval = krb5_kt_get_entry(context, kt, princ, 0, 0, &ktent);
+	if (retval) goto err;
+
+	during = "unparsing principal name canonicalized by krb5_kt_get_entry()";
+	retval = krb5_unparse_name(context, ktent.principal, &unparsed_canon);
+	if (retval) goto err;
+	printf("Principal name as canonicalized by krb5_kt_get_entry() is %s\n", unparsed_canon);
+    }
+
+    ret = 0;
+
+err:
+    krb5_free_principal(context, princ);
+    krb5_free_principal(context, me);
+    krb5_free_principal(context, cmp_to_princ);
+    krb5_xfree(unparsed);
+    krb5_xfree(unparsed_canon);
+    if (do_get_creds) {
+	krb5_free_creds(context, out_creds);
+	(void) krb5_cc_close(context, cc);
+    }
+    krb5_kt_free_entry(context, &ktent);
+    if (kt)
+	krb5_kt_close(context, kt);
+    krb5_free_context(context);
+    if (ret)
+	fprintf(stderr, "Failed while doing %s (%d)\n", during, retval);
+    return (ret);
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_cc.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_cc.c
index e079ad277..c09365cf0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_cc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_cc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_cc.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_cc.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
@@ -59,7 +59,7 @@ test_default_name(krb5_context context)
     p1 = estrdup(p);
 
     ret = krb5_cc_set_default_name(context, NULL);
-    if (p == NULL)
+    if (ret)
 	krb5_errx (context, 1, "krb5_cc_set_default_name failed");
 
     p = krb5_cc_default_name(context);
@@ -71,7 +71,7 @@ test_default_name(krb5_context context)
 	krb5_errx (context, 1, "krb5_cc_default_name no longer same");
 
     ret = krb5_cc_set_default_name(context, test_cc_name);
-    if (p == NULL)
+    if (ret)
 	krb5_errx (context, 1, "krb5_cc_set_default_name 1 failed");
 
     p = krb5_cc_default_name(context);
@@ -295,31 +295,31 @@ struct {
 } cc_names[] = {
     { "foo", 0, "foo" },
     { "foo%}", 0, "foo%}" },
-    { "%{uid}", 0 },
+    { "%{uid}", 0, NULL },
     { "foo%{null}", 0, "foo" },
     { "foo%{null}bar", 0, "foobar" },
-    { "%{", 1 },
-    { "%{foo %{", 1 },
-    { "%{{", 1 },
-    { "%{{}", 1 },
-    { "%{nulll}", 1 },
-    { "%{does not exist}", 1 },
-    { "%{}", 1 },
+    { "%{", 1, NULL },
+    { "%{foo %{", 1, NULL },
+    { "%{{", 1, NULL },
+    { "%{{}", 1, NULL },
+    { "%{nulll}", 1, NULL },
+    { "%{does not exist}", 1, NULL },
+    { "%{}", 1, NULL },
 #ifdef KRB5_USE_PATH_TOKENS
-    { "%{APPDATA}", 0 },
-    { "%{COMMON_APPDATA}", 0},
-    { "%{LOCAL_APPDATA}", 0},
-    { "%{SYSTEM}", 0},
-    { "%{WINDOWS}", 0},
-    { "%{TEMP}", 0},
-    { "%{USERID}", 0},
-    { "%{uid}", 0},
-    { "%{USERCONFIG}", 0},
-    { "%{COMMONCONFIG}", 0},
-    { "%{LIBDIR}", 0},
-    { "%{BINDIR}", 0},
-    { "%{LIBEXEC}", 0},
-    { "%{SBINDIR}", 0},
+    { "%{APPDATA}", 0, NULL },
+    { "%{COMMON_APPDATA}", 0, NULL},
+    { "%{LOCAL_APPDATA}", 0, NULL},
+    { "%{SYSTEM}", 0, NULL},
+    { "%{WINDOWS}", 0, NULL},
+    { "%{TEMP}", 0, NULL},
+    { "%{USERID}", 0, NULL},
+    { "%{uid}", 0, NULL},
+    { "%{USERCONFIG}", 0, NULL},
+    { "%{COMMONCONFIG}", 0, NULL},
+    { "%{LIBDIR}", 0, NULL},
+    { "%{BINDIR}", 0, NULL},
+    { "%{LIBEXEC}", 0, NULL},
+    { "%{SBINDIR}", 0, NULL},
 #endif
 };
 
@@ -551,14 +551,15 @@ test_prefix_ops(krb5_context context, const char *name, const krb5_cc_ops *ops)
 }
 
 static void
-test_cc_config(krb5_context context)
+test_cc_config(krb5_context context, const char *cc_type,
+	       const char *cc_name, size_t count)
 {
     krb5_error_code ret;
     krb5_principal p;
     krb5_ccache id;
     unsigned int i;
 
-    ret = krb5_cc_new_unique(context, "MEMORY", "bar", &id);
+    ret = krb5_cc_new_unique(context, cc_type, cc_name, &id);
     if (ret)
 	krb5_err(context, 1, ret, "krb5_cc_new_unique");
 
@@ -570,7 +571,7 @@ test_cc_config(krb5_context context)
     if (ret)
 	krb5_err(context, 1, ret, "krb5_cc_initialize");
 
-    for (i = 0; i < 1000; i++) {
+    for (i = 0; i < count; i++) {
 	krb5_data data, data2;
 	const char *name = "foo";
 	krb5_principal p1 = NULL;
@@ -581,6 +582,10 @@ test_cc_config(krb5_context context)
 	data.data = rk_UNCONST(name);
 	data.length = strlen(name);
 
+	/*
+	 * Because of how krb5_cc_set_config() this will also test
+	 * krb5_cc_remove_cred().
+	 */
 	ret = krb5_cc_set_config(context, id, p1, "FriendlyName", &data);
 	if (ret)
 	    krb5_errx(context, 1, "krb5_cc_set_config: add");
@@ -588,8 +593,16 @@ test_cc_config(krb5_context context)
 	ret = krb5_cc_get_config(context, id, p1, "FriendlyName", &data2);
 	if (ret)
 	    krb5_errx(context, 1, "krb5_cc_get_config: first");
+
+	if (data.length != data2.length ||
+	    memcmp(data.data, data2.data, data.length) != 0)
+	    krb5_errx(context, 1, "krb5_cc_get_config: did not fetch what was set");
+
 	krb5_data_free(&data2);
 
+	data.data = rk_UNCONST("bar");
+	data.length = strlen("bar");
+
 	ret = krb5_cc_set_config(context, id, p1, "FriendlyName", &data);
 	if (ret)
 	    krb5_errx(context, 1, "krb5_cc_set_config: add -second");
@@ -597,6 +610,11 @@ test_cc_config(krb5_context context)
 	ret = krb5_cc_get_config(context, id, p1, "FriendlyName", &data2);
 	if (ret)
 	    krb5_errx(context, 1, "krb5_cc_get_config: second");
+
+	if (data.length != data2.length ||
+	    memcmp(data.data, data2.data, data.length) != 0)
+	    krb5_errx(context, 1, "krb5_cc_get_config: replace failed");
+
 	krb5_data_free(&data2);
 
 	ret = krb5_cc_set_config(context, id, p1, "FriendlyName", NULL);
@@ -606,6 +624,9 @@ test_cc_config(krb5_context context)
 	ret = krb5_cc_get_config(context, id, p1, "FriendlyName", &data2);
 	if (ret == 0)
 	    krb5_errx(context, 1, "krb5_cc_get_config: non-existant");
+
+	if (data2.length)
+	    krb5_errx(context, 1, "krb5_cc_get_config: delete failed");
     }
 
     krb5_cc_destroy(context, id);
@@ -671,6 +692,7 @@ main(int argc, char **argv)
     test_init_vs_destroy(context, krb5_cc_type_api);
 #endif
     test_init_vs_destroy(context, krb5_cc_type_scc);
+    test_init_vs_destroy(context, krb5_cc_type_dcc);
     test_mcc_default();
     test_def_cc_name(context);
 
@@ -696,6 +718,10 @@ main(int argc, char **argv)
     test_cache_iter(context, krb5_cc_type_api, 0);
     test_cache_iter(context, krb5_cc_type_scc, 0);
     test_cache_iter(context, krb5_cc_type_scc, 1);
+#if 0
+    test_cache_iter(context, krb5_cc_type_dcc, 0);
+    test_cache_iter(context, krb5_cc_type_dcc, 1);
+#endif
 
     test_copy(context, krb5_cc_type_file, krb5_cc_type_file);
     test_copy(context, krb5_cc_type_memory, krb5_cc_type_memory);
@@ -705,6 +731,11 @@ main(int argc, char **argv)
     test_copy(context, krb5_cc_type_file, krb5_cc_type_scc);
     test_copy(context, krb5_cc_type_scc, krb5_cc_type_memory);
     test_copy(context, krb5_cc_type_memory, krb5_cc_type_scc);
+#if 0
+    test_copy(context, krb5_cc_type_dcc, krb5_cc_type_memory);
+    test_copy(context, krb5_cc_type_dcc, krb5_cc_type_file);
+    test_copy(context, krb5_cc_type_dcc, krb5_cc_type_scc);
+#endif
 
     test_move(context, krb5_cc_type_file);
     test_move(context, krb5_cc_type_memory);
@@ -712,6 +743,9 @@ main(int argc, char **argv)
     test_move(context, krb5_cc_type_kcm);
 #endif
     test_move(context, krb5_cc_type_scc);
+#if 0
+    test_move(context, krb5_cc_type_dcc);
+#endif
 
     test_prefix_ops(context, "FILE:/tmp/foo", &krb5_fcc_ops);
     test_prefix_ops(context, "FILE", &krb5_fcc_ops);
@@ -722,11 +756,16 @@ main(int argc, char **argv)
     test_prefix_ops(context, "SCC:", &krb5_scc_ops);
     test_prefix_ops(context, "SCC:foo", &krb5_scc_ops);
 #endif
+#if 0
+    test_prefix_ops(context, "DIR:", &krb5_dcc_ops);
+    test_prefix_ops(context, "DIR:tkt1", &krb5_dcc_ops);
+#endif
 
     krb5_cc_destroy(context, id1);
     krb5_cc_destroy(context, id2);
 
-    test_cc_config(context);
+    test_cc_config(context, "MEMORY", "bar", 1000);  /* 1000 because fast */
+    test_cc_config(context, "FILE", "/tmp/foocc", 30); /* 30 because slower */
 
     krb5_free_context(context);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_config.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_config.c
index f6d3dcec9..0fc8ff6a5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_config.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_config.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_config.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_config.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto.c
index 9fc7504a6..f1d1003a7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_crypto.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_crypto.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
@@ -160,11 +160,15 @@ main(int argc, char **argv)
     krb5_salt salt;
 
     krb5_enctype enctypes[] = {
+#if 0
 	ETYPE_DES_CBC_CRC,
 	ETYPE_DES3_CBC_SHA1,
 	ETYPE_ARCFOUR_HMAC_MD5,
+#endif
 	ETYPE_AES128_CTS_HMAC_SHA1_96,
-	ETYPE_AES256_CTS_HMAC_SHA1_96
+	ETYPE_AES256_CTS_HMAC_SHA1_96,
+        ETYPE_AES128_CTS_HMAC_SHA256_128,
+        ETYPE_AES256_CTS_HMAC_SHA384_192
     };
 
     setprogname(argv[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto_wrapping.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto_wrapping.c
index ea14fe2fc..ff88f2125 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto_wrapping.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_crypto_wrapping.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_crypto_wrapping.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_crypto_wrapping.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -133,7 +133,9 @@ main(int argc, char **argv)
 	ETYPE_DES3_CBC_SHA1,
 	ETYPE_ARCFOUR_HMAC_MD5,
 	ETYPE_AES128_CTS_HMAC_SHA1_96,
-	ETYPE_AES256_CTS_HMAC_SHA1_96
+	ETYPE_AES256_CTS_HMAC_SHA1_96,
+	KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128,
+	KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192
     };
 
     setprogname(argv[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_expand_toks.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_expand_toks.c
new file mode 100644
index 000000000..ee791cd0e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_expand_toks.c
@@ -0,0 +1,106 @@
+/*	$NetBSD: test_expand_toks.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of KTH nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
+
+#include "krb5_locl.h"
+#include <krb5/getarg.h>
+#include <err.h>
+
+static int version_flag = 0;
+static int help_flag	= 0;
+
+static struct getargs args[] = {
+    {"help",	0,	arg_flag,	&help_flag,
+     NULL, NULL }
+};
+
+static void
+usage (int ret)
+{
+    arg_printusage (args,
+		    sizeof(args)/sizeof(*args),
+		    NULL,
+		    "");
+    exit (ret);
+}
+
+int
+main(int argc, char **argv)
+{
+    krb5_context context;
+    krb5_error_code ret;
+    int optidx = 0;
+    char *expanded;
+
+    setprogname(argv[0]);
+
+    if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
+	usage(1);
+
+    if (help_flag)
+	usage (0);
+
+    if (version_flag){
+	print_version(NULL);
+	exit(0);
+    }
+
+    argc -= optidx;
+    argv += optidx;
+
+    ret = krb5_init_context(&context);
+    if (ret)
+	errx (1, "krb5_init_context failed: %d", ret);
+
+    ret = _krb5_expand_path_tokensv(context, "/tmp/%{foo}/%{bar}%{baz}/x", 0,
+                                    &expanded,
+                                    "foo", "abc",
+                                    "bar", "dce",
+                                    "baz", "fgh",
+                                    NULL);
+    if (ret)
+        krb5_err(context, ret, 1, "Token expansion failed");
+
+#ifdef _WIN32
+#define EXPANDED_SHOULD_BE "\\tmp\\abc\\dcefgh\\x"
+#else
+#define EXPANDED_SHOULD_BE "/tmp/abc/dcefgh/x"
+#endif
+
+    if (strcmp(expanded, EXPANDED_SHOULD_BE))
+        krb5_errx(context, 1, "Token expansion incorrect");
+
+    krb5_free_context(context);
+
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_forward.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_forward.c
index f78ae499f..f3c7f3e24 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_forward.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_forward.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_forward.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_forward.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_fx.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_fx.c
index c10fd9203..40867b82b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_fx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_fx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_fx.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_fx.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -84,7 +84,30 @@ struct {
 	"\x88\xbd\xb2\xa9\xf\x3e\x52\x5a\xb0\x5f\x68\xc5\x43\x9a\x4d\x5e"
 	"\x9c\x2b\xfd\x2b\x02\x24\xde\x39\xb5\x82\xf4\xbb\x05\xfe\x2\x2e",
 	32
-    }
+    },
+    {
+	"key1", "a", ETYPE_ARCFOUR_HMAC_MD5,
+	"key2", "b", ETYPE_ARCFOUR_HMAC_MD5,
+	ETYPE_ARCFOUR_HMAC_MD5,
+        "\x24\xd7\xf6\xb6\xba\xe4\xe5\xc0\x0d\x20\x82\xc5\xeb\xab\x36\x72",
+	16
+    },
+    /* We don't yet have a PRF for 1DES in Heimdal */
+    {
+	"key1", "a", ETYPE_DES_CBC_CRC,
+	"key2", "b", ETYPE_DES_CBC_CRC,
+	ETYPE_DES_CBC_CRC,
+        "\x43\xba\xe3\x73\x8c\x94\x67\xe6",
+	8
+    },
+    {
+	"key1", "a", ETYPE_DES3_CBC_SHA1,
+	"key2", "b", ETYPE_DES3_CBC_SHA1,
+	ETYPE_DES3_CBC_SHA1,
+        "\xe5\x8f\x9e\xb6\x43\x86\x2c\x13\xad\x38\xe5\x29\x31\x34\x62\xa7"
+        "\xf7\x3e\x62\x83\x4f\xe5\x4a\x01",
+	24
+    },
 };
 
 
@@ -97,6 +120,11 @@ test_cf2(krb5_context context)
     krb5_keyblock k1, k2, k3;
     krb5_crypto c1, c2;
     unsigned int i;
+    unsigned int errors = 0;
+
+    ret = krb5_allow_weak_crypto(context, 1);
+    if (ret)
+        krb5_err(context, 1, ret, "krb5_allow_weak_crypto");
 
     for (i = 0; i < sizeof(cf2)/sizeof(cf2[0]); i++) {
 	pw.data = cf2[i].p1;
@@ -142,14 +170,26 @@ test_cf2(krb5_context context)
 	p2.length = strlen(cf2[i].pepper2);
 
 	ret = krb5_crypto_fx_cf2(context, c1, c2, &p1, &p2, cf2[i].e3, &k3);
-	if (ret)
+        if (ret == KRB5_PROG_ETYPE_NOSUPP) {
+            krb5_warn(context, ret, "KRB-FX-CF2 not supported for enctype %d",
+                      cf2[i].e1);
+            continue;
+        } else if (ret) {
 	    krb5_err(context, 1, ret, "krb5_crypto_fx_cf2");
+        }
 
-	if (k3.keytype != cf2[i].e3)
-	    krb5_errx(context, 1, "length not right");
+	if (k3.keytype != cf2[i].e3) {
+            errors++;
+	    krb5_warnx(context, "length not right for enctype %d", cf2[i].e3);
+            continue;
+        }
 	if (k3.keyvalue.length != cf2[i].len ||
-	    memcmp(k3.keyvalue.data, cf2[i].key, cf2[i].len) != 0)
-	    krb5_errx(context, 1, "key not same");
+	    memcmp(k3.keyvalue.data, cf2[i].key, cf2[i].len) != 0) {
+            errors++;
+	    krb5_warnx(context, "key not same for enctypes %d %d %d",
+                       cf2[i].e1, cf2[i].e2, cf2[i].e3);
+            continue;
+        }
 
 	krb5_crypto_destroy(context, c1);
 	krb5_crypto_destroy(context, c2);
@@ -158,6 +198,9 @@ test_cf2(krb5_context context)
 	krb5_free_keyblock_contents(context, &k2);
 	krb5_free_keyblock_contents(context, &k3);
     }
+
+    if (errors)
+        krb5_errx(context, 1, "%u KRB-FX-CF2 vectors failed", errors);
 }
 
 static int version_flag = 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_get_addrs.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_get_addrs.c
index b41100009..95a13bb7f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_get_addrs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_get_addrs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_get_addrs.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_get_addrs.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_gic.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_gic.c
index 6777d0914..44a82eff6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_gic.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_gic.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_gic.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_gic.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_hostname.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_hostname.c
index 0a4088322..c2bc1bdbc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_hostname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_hostname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_hostname.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_hostname.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_keytab.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_keytab.c
index d9ce89ba5..3ddbe9bf5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_keytab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_keytab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_keytab.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_keytab.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_kuserok.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_kuserok.c
index fee10baa7..bc2158b08 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_kuserok.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_kuserok.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_kuserok.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_kuserok.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -98,9 +98,14 @@ main(int argc, char **argv)
 
     ret = krb5_kuserok(context, principal, argv[1]);
 
+    krb5_free_principal(context, principal);
     krb5_free_context(context);
 
     printf("%s is %sallowed to login as %s\n", p, ret ? "" : "NOT ", argv[1]);
+    free(p);
 
-    return 0;
+    if (ret)
+	return 0;
+
+    return 1;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_mem.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_mem.c
index 87e2e3784..2784e6994 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_mem.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_mem.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_mem.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_mem.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pac.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pac.c
index 44f737909..067ce2286 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pac.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pac.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pac.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_pac.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pkinit_dh2key.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pkinit_dh2key.c
index 03939edfa..2676fb8c4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pkinit_dh2key.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pkinit_dh2key.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pkinit_dh2key.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_pkinit_dh2key.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pknistkdf.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pknistkdf.c
index a022ef812..e361c17e4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_pknistkdf.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_pknistkdf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_pknistkdf.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: test_pknistkdf.c,v 1.4 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -246,6 +246,14 @@ test_dh2key(krb5_context context, int i, struct testcase *c)
     ret = krb5_parse_name(context, c->server, &server);
     if (ret)
 	krb5_err(context, 1, ret, "parse_name: %s", c->server);
+    /*
+     * Making krb5_build_principal*() set a reasonable default principal
+     * name type broke the test vectors here.  Rather than regenerate
+     * the vectors, and to prove that this was the issue, we coerce the
+     * name types back to their original.
+     */
+    krb5_principal_set_type(context, client, KRB5_NT_PRINCIPAL);
+    krb5_principal_set_type(context, server, KRB5_NT_PRINCIPAL);
 
     if (verbose_flag) {
 	char *str;
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_plugin.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_plugin.c
index 1e23871bf..5c0052735 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_plugin.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_plugin.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_plugin.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_plugin.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -79,7 +79,8 @@ krb5plugin_service_locate_ftable resolve = {
     0,
     resolve_init,
     resolve_fini,
-    resolve_lookup
+    resolve_lookup,
+    NULL
 };
 
 
@@ -115,11 +116,13 @@ main(int argc, char **argv)
 
     while(krb5_krbhst_next_as_string(context, handle, host, sizeof(host)) == 0){
 	found++;
- 	if (strcmp(host, "127.0.0.2") != 0)
+ 	if (!found && strcmp(host, "127.0.0.2") != 0 && strcmp(host, "tcp/127.0.0.2") != 0)
 	    krb5_errx(context, 1, "wrong address: %s", host);
     }
     if (!found)
 	krb5_errx(context, 1, "failed to find host");
+    if (found < 2)
+	krb5_errx(context, 1, "did not get the two expected results");
 
     krb5_krbhst_free(context, handle);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_prf.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_prf.c
index 73859002d..9efcd0263 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_prf.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_prf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_prf.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_prf.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_princ.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_princ.c
index 580ea8c71..5e4a31539 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_princ.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_princ.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_princ.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_princ.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_renew.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_renew.c
index 379882138..6122f67b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_renew.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_renew.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_renew.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_renew.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_rfc3961.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_rfc3961.c
index 42f93d035..6a761d67d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_rfc3961.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_rfc3961.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_rfc3961.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: test_rfc3961.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003-2005 Kungliga Tekniska Högskolan
@@ -164,7 +164,9 @@ main(int argc, char **argv)
 	ETYPE_DES3_CBC_SHA1,
 	ETYPE_ARCFOUR_HMAC_MD5,
 	ETYPE_AES128_CTS_HMAC_SHA1_96,
-	ETYPE_AES256_CTS_HMAC_SHA1_96
+	ETYPE_AES256_CTS_HMAC_SHA1_96,
+	ETYPE_AES128_CTS_HMAC_SHA256_128,
+	ETYPE_AES256_CTS_HMAC_SHA384_192
     };
 
     setprogname(argv[0]);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_set_kvno0.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_set_kvno0.c
new file mode 100644
index 000000000..5e68158be
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_set_kvno0.c
@@ -0,0 +1,181 @@
+/*	$NetBSD: test_set_kvno0.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+
+/*
+ * Copyright (c) 2011, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "krb5_locl.h"
+#include <err.h>
+#include <krb5/getarg.h>
+
+#if 0
+#include <stdio.h>
+#include <string.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <krb5/krb5.h>
+#endif
+
+int
+main(int argc, char **argv)
+{
+    krb5_error_code ret;
+    krb5_context context;
+    krb5_ccache src_cc = NULL;
+    krb5_ccache dst_cc = NULL;
+    krb5_cc_cursor cursor;
+    krb5_principal me = NULL;
+    krb5_creds cred;
+    const char *during;
+    Ticket t;
+    size_t len;
+    int make_kvno_absent = 0;
+    int opt;
+
+    memset(&cred, 0, sizeof (cred));
+    during = "init_context";
+    ret = krb5_init_context(&context);
+    if (ret) goto err;
+
+    while ((opt = getopt(argc, argv, "c:n")) != -1) {
+	switch (opt) {
+	case 'c':
+	    during = "cc_resolve of source ccache";
+	    ret = krb5_cc_resolve(context, optarg, &src_cc);
+	    if (ret) goto err;
+	    break;
+	case 'n':
+	    make_kvno_absent++;
+	    break;
+	case 'h':
+	default:
+	    fprintf(stderr, "Usage: %s [-n] [-c ccache]\n"
+		    "\tThis utility edits a ccache, setting all ticket\n"
+		    "\tenc_part kvnos to zero or absent (if -n is set).\n",
+		    argv[0]);
+	    return 1;
+	}
+    }
+
+    if (!src_cc) {
+	during = "cc_default";
+	ret = krb5_cc_default(context, &src_cc);
+	if (ret) goto err;
+    }
+
+    during = "cc_get_principal";
+    ret = krb5_cc_get_principal(context, src_cc, &me);
+    if (ret) goto err;
+
+    if (optind != argc) {
+	fprintf(stderr, "Usage: %s [-n] [-c ccache]\n"
+		"\tThis utility edits a ccache, setting all ticket\n"
+		"\tenc_part kvnos to zero or absent (if -n is set).\n",
+		argv[0]);
+	return 1;
+    }
+
+    during = "cc_new_unique of temporary ccache";
+    ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, src_cc),
+			     NULL, &dst_cc);
+
+    during = "cc_initialize of temporary ccache";
+    ret = krb5_cc_initialize(context, dst_cc, me);
+    if (ret) goto err;
+
+    during = "cc_start_seq_get";
+    ret = krb5_cc_start_seq_get(context, src_cc, &cursor);
+    if (ret) goto err;
+
+    while ((ret = krb5_cc_next_cred(context, src_cc, &cursor, &cred)) == 0) {
+	krb5_data data;
+
+	during = "decode_Ticket";
+	memset(&t, 0, sizeof (t));
+	ret = decode_Ticket(cred.ticket.data, cred.ticket.length, &t, &len);
+	if (ret == ASN1_MISSING_FIELD)
+	    continue;
+	if (ret) goto err;
+	if (t.enc_part.kvno) {
+	    *t.enc_part.kvno = 0;
+	    if (make_kvno_absent) {
+		free(t.enc_part.kvno);
+		t.enc_part.kvno = NULL;
+	    }
+	    /*
+	     * The new Ticket has to need less or same space as before, so
+	     * we reuse cred->icket.data.
+	     */
+	    during = "encode_Ticket";
+	    ASN1_MALLOC_ENCODE(Ticket, data.data, data.length, &t, &len, ret);
+	    if (ret) {
+		free_Ticket(&t);
+		goto err;
+	    }
+	    krb5_data_free(&cred.ticket);
+	    cred.ticket = data;
+	}
+	free_Ticket(&t);
+	during = "cc_store_cred";
+	ret = krb5_cc_store_cred(context, dst_cc, &cred);
+	if (ret) goto err;
+	krb5_free_cred_contents(context, &cred);
+	memset(&cred, 0, sizeof (cred));
+    }
+    during = "cc_next_cred";
+    if (ret != KRB5_CC_END) goto err;
+
+    during = "cc_end_seq_get";
+    ret = krb5_cc_end_seq_get(context, src_cc, &cursor);
+    if (ret) goto err;
+
+    during = "cc_move";
+    ret = krb5_cc_move(context, dst_cc, src_cc);
+    if (ret) goto err;
+    dst_cc = NULL;
+
+    during = "cc_switch";
+    ret = krb5_cc_switch(context, src_cc);
+    if (ret) goto err;
+
+err:
+    (void) krb5_free_principal(context, me);
+    if (src_cc)
+	(void) krb5_cc_close(context, src_cc);
+    if (dst_cc)
+	(void) krb5_cc_destroy(context, dst_cc);
+    if (ret) {
+	fprintf(stderr, "Failed while doing %s (%d)\n", during, ret);
+	ret = 1;
+    }
+    return (ret);
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_store.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_store.c
index 596142edd..ea69ecae5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_store.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_store.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_store.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_store.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -46,12 +46,12 @@ test_int8(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_int8(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_int8");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i, SEEK_SET);
 	ret = krb5_ret_int8(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_int8");
@@ -71,12 +71,12 @@ test_int16(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_int16(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_int16");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i * sizeof (v), SEEK_SET);
 	ret = krb5_ret_int16(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_int16");
@@ -96,12 +96,12 @@ test_int32(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_int32(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_int32");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i * sizeof (v), SEEK_SET);
 	ret = krb5_ret_int32(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_int32");
@@ -121,12 +121,12 @@ test_uint8(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_uint8(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_uint8");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i * sizeof (v), SEEK_SET);
 	ret = krb5_ret_uint8(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_uint8");
@@ -146,12 +146,12 @@ test_uint16(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_uint16(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_uint16");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i * sizeof (v), SEEK_SET);
 	ret = krb5_ret_uint16(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_uint16");
@@ -171,12 +171,12 @@ test_uint32(krb5_context context, krb5_storage *sp)
 
     krb5_storage_truncate(sp, 0);
 
-    for (i = 0; i < sizeof(val[0])/sizeof(val); i++) {
+    for (i = 0; i < sizeof(val)/sizeof(val[0]); i++) {
 
 	ret = krb5_store_uint32(sp, val[i]);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_store_uint32");
-	krb5_storage_seek(sp, 0, SEEK_SET);
+	krb5_storage_seek(sp, i * sizeof (v), SEEK_SET);
 	ret = krb5_ret_uint32(sp, &v);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_ret_uint32");
@@ -222,12 +222,12 @@ test_truncate(krb5_context context, krb5_storage *sp, int fd)
 static void
 check_too_large(krb5_context context, krb5_storage *sp)
 {
-    uint32_t too_big_sizes[] = { INT_MAX, INT_MAX / 2, INT_MAX / 4, INT_MAX / 8 + 1};
+    uint32_t too_big_sizes[] = { UINT_MAX, UINT_MAX / 2, UINT_MAX / 4, UINT_MAX / 8 + 1};
     krb5_error_code ret;
     krb5_data data;
     size_t n;
 
-    for (n = 0; n < sizeof(too_big_sizes) / sizeof(too_big_sizes); n++) {
+    for (n = 0; n < sizeof(too_big_sizes) / sizeof(too_big_sizes[0]); n++) {
 	krb5_storage_truncate(sp, 0);
 	krb5_store_uint32(sp, too_big_sizes[n]);
 	krb5_storage_seek(sp, 0, SEEK_SET);
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_time.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_time.c
index e2ba51dd4..4dd364e3c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_time.c,v 1.1.1.1 2011/04/13 18:15:39 elric Exp $	*/
+/*	$NetBSD: test_time.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2003 Kungliga Tekniska Högskolan
@@ -56,11 +56,11 @@ check_set_time(krb5_context context)
     if (ret)
 	krb5_err(context, 1, ret, "krb5_us_timeofday");
 
-    diff2 = abs(sec - tv.tv_sec);
+    diff2 = labs(sec - tv.tv_sec);
 
     if (diff2 < 9 || diff > 11)
-	krb5_errx(context, 1, "set time error: diff: %d",
-		  abs(sec - tv.tv_sec));
+	krb5_errx(context, 1, "set time error: diff: %ld",
+		  labs(sec - tv.tv_sec));
 }
 
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/test_x500.c b/crypto/external/bsd/heimdal/dist/lib/krb5/test_x500.c
index ec42af23b..c7c433a02 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/test_x500.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/test_x500.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_x500.c,v 1.1.1.1 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_x500.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2011 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c b/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
index 0a8c3e17a..ccd690ab8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ticket.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: ticket.c,v 1.2.4.1 2017/07/12 13:51:05 martin Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -83,11 +83,8 @@ krb5_copy_ticket(krb5_context context,
 
     *to = NULL;
     tmp = malloc(sizeof(*tmp));
-    if(tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if (tmp == NULL)
+	return krb5_enomem(context);
     if((ret = copy_EncTicketPart(&from->ticket, &tmp->ticket))){
 	free(tmp);
 	return ret;
@@ -327,6 +324,37 @@ out:
     return ret;
 }
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_get_ad(krb5_context context,
+	     const AuthorizationData *ad,
+	     krb5_keyblock *sessionkey,
+	     int type,
+	     krb5_data *data)
+{
+    krb5_boolean found = FALSE;
+    krb5_error_code ret;
+
+    krb5_data_zero(data);
+
+    if (ad == NULL) {
+	krb5_set_error_message(context, ENOENT,
+			       N_("No authorization data", ""));
+	return ENOENT; /* XXX */
+    }
+
+    ret = find_type_in_ad(context, type, data, &found, TRUE, sessionkey, ad, 0);
+    if (ret)
+	return ret;
+    if (!found) {
+	krb5_set_error_message(context, ENOENT,
+			       N_("Have no authorization data of type %d", ""),
+			       type);
+	return ENOENT; /* XXX */
+    }
+    return 0;
+}
+
+
 /**
  * Extract the authorization data type of type from the ticket. Store
  * the field in data. This function is to use for kerberos
@@ -513,88 +541,9 @@ check_client_referral(krb5_context context,
 		      krb5_const_principal mapped,
 		      krb5_keyblock const * key)
 {
-    krb5_error_code ret;
-    PA_ClientCanonicalized canon;
-    krb5_crypto crypto;
-    krb5_data data;
-    PA_DATA *pa;
-    size_t len;
-    int i = 0;
-
-    if (rep->kdc_rep.padata == NULL)
-	goto noreferral;
-
-    pa = krb5_find_padata(rep->kdc_rep.padata->val,
-			  rep->kdc_rep.padata->len,
-			  KRB5_PADATA_CLIENT_CANONICALIZED, &i);
-    if (pa == NULL)
-	goto noreferral;
-
-    ret = decode_PA_ClientCanonicalized(pa->padata_value.data,
-					pa->padata_value.length,
-					&canon, &len);
-    if (ret) {
-	krb5_set_error_message(context, ret,
-			       N_("Failed to decode ClientCanonicalized "
-				  "from realm %s", ""), requested->realm);
-	return ret;
-    }
-
-    ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
-		       &canon.names, &len, ret);
-    if (ret) {
-	free_PA_ClientCanonicalized(&canon);
-	return ret;
-    }
-    if (data.length != len)
-	krb5_abortx(context, "internal asn.1 error");
-
-    ret = krb5_crypto_init(context, key, 0, &crypto);
-    if (ret) {
-	free(data.data);
-	free_PA_ClientCanonicalized(&canon);
-	return ret;
-    }
-
-    ret = krb5_verify_checksum(context, crypto, KRB5_KU_CANONICALIZED_NAMES,
-			       data.data, data.length,
-			       &canon.canon_checksum);
-    krb5_crypto_destroy(context, crypto);
-    free(data.data);
-    if (ret) {
-	krb5_set_error_message(context, ret,
-			       N_("Failed to verify client canonicalized "
-				  "data from realm %s", ""),
-			       requested->realm);
-	free_PA_ClientCanonicalized(&canon);
-	return ret;
-    }
-
-    if (!_krb5_principal_compare_PrincipalName(context,
-					       requested,
-					       &canon.names.requested_name))
+    if (krb5_principal_compare(context, requested, mapped) == FALSE &&
+	!rep->enc_part.flags.enc_pa_rep)
     {
-	free_PA_ClientCanonicalized(&canon);
-	krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
-			       N_("Requested name doesn't match"
-				  " in client referral", ""));
-	return KRB5_PRINC_NOMATCH;
-    }
-    if (!_krb5_principal_compare_PrincipalName(context,
-					       mapped,
-					       &canon.names.mapped_name))
-    {
-	free_PA_ClientCanonicalized(&canon);
-	krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
-			       N_("Mapped name doesn't match"
-				  " in client referral", ""));
-	return KRB5_PRINC_NOMATCH;
-    }
-
-    return 0;
-
-noreferral:
-    if (krb5_principal_compare(context, requested, mapped) == FALSE) {
 	krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 			       N_("Not same client principal returned "
 				  "as requested", ""));
@@ -648,7 +597,7 @@ decrypt_tkt (krb5_context context,
     return 0;
 }
 
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_extract_ticket(krb5_context context,
 		     krb5_kdc_rep *rep,
 		     krb5_creds *creds,
@@ -658,6 +607,7 @@ _krb5_extract_ticket(krb5_context context,
 		     krb5_addresses *addrs,
 		     unsigned nonce,
 		     unsigned flags,
+		     krb5_data *request,
 		     krb5_decrypt_proc decrypt_proc,
 		     krb5_const_pointer decryptarg)
 {
@@ -676,6 +626,48 @@ _krb5_extract_ticket(krb5_context context,
     if (ret)
 	goto out;
 
+    if (rep->enc_part.flags.enc_pa_rep && request) {
+	krb5_crypto crypto = NULL;
+	Checksum cksum;
+	PA_DATA *pa = NULL;
+	int idx = 0;
+
+	_krb5_debug(context, 5, "processing enc-ap-rep");
+
+	if (rep->enc_part.encrypted_pa_data == NULL ||
+	    (pa = krb5_find_padata(rep->enc_part.encrypted_pa_data->val,
+				   rep->enc_part.encrypted_pa_data->len,
+				   KRB5_PADATA_REQ_ENC_PA_REP,
+				   &idx)) == NULL)
+	{
+	    _krb5_debug(context, 5, "KRB5_PADATA_REQ_ENC_PA_REP missing");
+	    ret = KRB5KRB_AP_ERR_MODIFIED;
+	    goto out;
+	}
+	
+	ret = krb5_crypto_init(context, key, 0, &crypto);
+	if (ret)
+	    goto out;
+	
+	ret = decode_Checksum(pa->padata_value.data,
+			      pa->padata_value.length,
+			      &cksum, NULL);
+	if (ret) {
+	    krb5_crypto_destroy(context, crypto);
+	    goto out;
+	}
+	
+	ret = krb5_verify_checksum(context, crypto,
+				   KRB5_KU_AS_REQ,
+				   request->data, request->length,
+				   &cksum);
+	krb5_crypto_destroy(context, crypto);
+	free_Checksum(&cksum);
+	_krb5_debug(context, 5, "enc-ap-rep: %svalid", (ret == 0) ? "" : "in");
+	if (ret)
+	    goto out;
+    }
+
     /* save session key */
 
     creds->session.keyvalue.length = 0;
@@ -690,10 +682,10 @@ _krb5_extract_ticket(krb5_context context,
     }
 
     /* compare client and save */
-    ret = _krb5_principalname2krb5_principal (context,
-					      &tmp_principal,
-					      rep->kdc_rep.cname,
-					      rep->kdc_rep.crealm);
+    ret = _krb5_principalname2krb5_principal(context,
+					     &tmp_principal,
+					     rep->kdc_rep.cname,
+					     rep->kdc_rep.crealm);
     if (ret)
 	goto out;
 
@@ -715,8 +707,8 @@ _krb5_extract_ticket(krb5_context context,
     /* check server referral and save principal */
     ret = _krb5_principalname2krb5_principal (context,
 					      &tmp_principal,
-					      rep->kdc_rep.ticket.sname,
-					      rep->kdc_rep.ticket.realm);
+					      rep->enc_part.sname,
+					      rep->enc_part.srealm);
     if (ret)
 	goto out;
     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
@@ -778,12 +770,12 @@ _krb5_extract_ticket(krb5_context context,
 	tmp_time = rep->enc_part.authtime;
 
     if (creds->times.starttime == 0
-	&& abs(tmp_time - sec_now) > context->max_skew) {
+	&& labs(tmp_time - sec_now) > context->max_skew) {
 	ret = KRB5KRB_AP_ERR_SKEW;
 	krb5_set_error_message (context, ret,
-				N_("time skew (%d) larger than max (%d)", ""),
-			       abs(tmp_time - sec_now),
-			       (int)context->max_skew);
+				N_("time skew (%ld) larger than max (%ld)", ""),
+			       labs(tmp_time - sec_now),
+			       (long)context->max_skew);
 	goto out;
     }
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/time.c b/crypto/external/bsd/heimdal/dist/lib/krb5/time.c
index 7e268d537..335ed2741 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: time.c,v 1.1.1.1 2011/04/13 18:15:38 elric Exp $	*/
+/*	$NetBSD: time.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/transited.c b/crypto/external/bsd/heimdal/dist/lib/krb5/transited.c
index 0ebc5ca9f..53540abaa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/transited.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/transited.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: transited.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: transited.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
@@ -400,6 +400,208 @@ krb5_domain_x500_encode(char **realms, unsigned int num_realms,
     return 0;
 }
 
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_free_capath(krb5_context context, char **capath)
+{
+    char **s;
+
+    for (s = capath; s && *s; ++s)
+        free(*s);
+    free(capath);
+}
+
+struct hier_iter {
+    const char *local_realm;
+    const char *server_realm;
+    const char *lr;     /* Pointer into tail of local realm */
+    const char *sr;     /* Pointer into tail of server realm */
+    size_t llen;        /* Length of local_realm */
+    size_t slen;        /* Length of server_realm */
+    size_t len;         /* Length of common suffix */
+    size_t num;         /* Path element count */
+};
+
+/*
+ * Step up from local_realm to common suffix, or else down to server_realm.
+ */
+static const char *
+hier_next(struct hier_iter *state)
+{
+    const char *lr = state->lr;
+    const char *sr = state->sr;
+    const char *lsuffix = state->local_realm + state->llen - state->len;
+    const char *server_realm = state->server_realm;
+
+    if (lr != NULL) {
+        while (lr < lsuffix)
+            if (*lr++ == '.')
+                return state->lr = lr;
+        state->lr = NULL;
+    }
+    if (sr != NULL) {
+        while (--sr >= server_realm)
+            if (sr == server_realm || sr[-1] == '.')
+                return state->sr = sr;
+        state->sr = NULL;
+    }
+    return NULL;
+}
+
+static void
+hier_init(struct hier_iter *state, const char *local_realm, const char *server_realm)
+{
+    size_t llen;
+    size_t slen;
+    size_t len = 0;
+    const char *lr;
+    const char *sr;
+
+    state->local_realm = local_realm;
+    state->server_realm = server_realm;
+    state->llen = llen = strlen(local_realm);
+    state->slen = slen = strlen(server_realm);
+    state->len = 0;
+    state->num = 0;
+
+    if (slen == 0 || llen == 0)
+        return;
+
+    /* Find first difference from the back */
+    for (lr = local_realm + llen, sr = server_realm + slen;
+         lr != local_realm && sr != server_realm;
+         --lr, --sr) {
+        if (lr[-1] != sr[-1])
+            break;
+        if (lr[-1] == '.')
+            len = llen - (lr - local_realm);
+    }
+
+    /* Nothing in common? */
+    if (*lr == '\0')
+        return;
+
+    /* Everything in common? */
+    if (llen == slen && lr == local_realm)
+        return;
+
+    /* Is one realm is a suffix of the other? */
+    if ((llen < slen && lr == local_realm && sr[-1] == '.') ||
+        (llen > slen && sr == server_realm && lr[-1] == '.'))
+        len = llen - (lr - local_realm);
+
+    state->len = len;
+    /* `lr` starts at local realm and walks up the tree to common suffix */
+    state->lr = local_realm;
+    /* `sr` starts at common suffix in server realm and walks down the tree */
+    state->sr = server_realm + slen - len;
+
+    /* Count elements and reset */
+    while (hier_next(state) != NULL)
+        ++state->num;
+    state->lr = local_realm;
+    state->sr = server_realm + slen - len;
+}
+
+/*
+ * Find a referral path from client_realm to server_realm via local_realm.
+ * Either via [capaths] or hierarchicaly.
+ */
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_find_capath(krb5_context context,
+                  const char *client_realm,
+                  const char *local_realm,
+                  const char *server_realm,
+                  krb5_boolean use_hierarchical,
+                  char ***rpath,
+                  size_t *npath)
+{
+    char **confpath;
+    char **capath;
+    struct hier_iter hier_state;
+    char **rp;
+    const char *r;
+
+    *rpath = NULL;
+    *npath = 0;
+
+    confpath = krb5_config_get_strings(context, NULL, "capaths",
+                                       client_realm, server_realm, NULL);
+    if (confpath == NULL)
+        confpath = krb5_config_get_strings(context, NULL, "capaths",
+                                           local_realm, server_realm, NULL);
+    /*
+     * With a [capaths] setting from the client to the server we look for our
+     * own realm in the list.  If our own realm is not present, we return the
+     * full list.  Otherwise, we return our realm's successors, or possibly
+     * NULL.  Ignoring a [capaths] settings risks loops plus would violate
+     * explicit policy and the principle of least surpise.
+     */
+    if (confpath != NULL) {
+        char **start = confpath;
+        size_t i;
+        size_t n;
+
+	for (rp = start; *rp; rp++)
+            if (strcmp(*rp, local_realm) == 0)
+                start = rp+1;
+        n = rp - start;
+
+        if (n == 0) {
+            krb5_config_free_strings(confpath);
+            return 0;
+        }
+
+        capath = calloc(n + 1, sizeof(*capath));
+        if (capath == NULL) {
+            krb5_config_free_strings(confpath);
+            return krb5_enomem(context);
+        }
+
+	for (i = 0, rp = start; *rp; rp++) {
+            if ((capath[i++] = strdup(*rp)) == NULL) {
+                _krb5_free_capath(context, capath);
+                krb5_config_free_strings(confpath);
+                return krb5_enomem(context);
+            }
+        }
+        krb5_config_free_strings(confpath);
+        capath[i] = NULL;
+        *rpath = capath;
+        *npath = n;
+        return 0;
+    }
+
+    /* The use_hierarchical flag makes hierarchical path lookup unconditional */
+    if (! use_hierarchical &&
+        ! krb5_config_get_bool_default(context, NULL, TRUE, "libdefaults",
+                                       "allow_hierarchical_capaths", NULL))
+        return 0;
+
+    /*
+     * When validating transit paths, local_realm == client_realm.  Otherwise,
+     * with hierarchical referrals, they may differ, and we may be building a
+     * path forward from our own realm!
+     */
+    hier_init(&hier_state, local_realm, server_realm);
+    if (hier_state.num == 0)
+        return 0;
+
+    rp = capath = calloc(hier_state.num + 1, sizeof(*capath));
+    if (capath == NULL)
+        return krb5_enomem(context);
+    while ((r = hier_next(&hier_state)) != NULL) {
+        if ((*rp++ = strdup(r)) == NULL) {
+            _krb5_free_capath(context, capath);
+            return krb5_enomem(context);
+        }
+    }
+
+    *rp = NULL;
+    *rpath = capath;
+    *npath = hier_state.num;
+    return 0;
+}
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_check_transited(krb5_context context,
 		     krb5_const_realm client_realm,
@@ -408,35 +610,36 @@ krb5_check_transited(krb5_context context,
 		     unsigned int num_realms,
 		     int *bad_realm)
 {
-    char **tr_realms;
-    char **p;
-    size_t i;
+    krb5_error_code ret = 0;
+    char **capath = NULL;
+    size_t num_capath = 0;
+    size_t i = 0;
+    size_t j = 0;
 
-    if(num_realms == 0)
-	return 0;
+    /* In transit checks hierarchical capaths are optional */
+    ret = _krb5_find_capath(context, client_realm, client_realm, server_realm,
+                            FALSE, &capath, &num_capath);
+    if (ret)
+        return ret;
 
-    tr_realms = krb5_config_get_strings(context, NULL,
-					"capaths",
-					client_realm,
-					server_realm,
-					NULL);
-    for(i = 0; i < num_realms; i++) {
-	for(p = tr_realms; p && *p; p++) {
-	    if(strcmp(*p, realms[i]) == 0)
+    for (i = 0; i < num_realms; i++) {
+	for (j = 0; j < num_capath; ++j) {
+	    if (strcmp(realms[i], capath[j]) == 0)
 		break;
 	}
-	if(p == NULL || *p == NULL) {
-	    krb5_config_free_strings(tr_realms);
+	if (j == num_capath) {
+            _krb5_free_capath(context, capath);
 	    krb5_set_error_message (context, KRB5KRB_AP_ERR_ILL_CR_TKT,
 				    N_("no transit allowed "
-				       "through realm %s", ""),
-				    realms[i]);
-	    if(bad_realm)
+				       "through realm %s from %s to %s", ""),
+				       realms[i], client_realm, server_realm);
+	    if (bad_realm)
 		*bad_realm = i;
 	    return KRB5KRB_AP_ERR_ILL_CR_TKT;
 	}
     }
-    krb5_config_free_strings(tr_realms);
+
+    _krb5_free_capath(context, capath);
     return 0;
 }
 
@@ -489,4 +692,3 @@ main(int argc, char **argv)
     return 0;
 }
 #endif
-
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_init.c b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_init.c
index d5026b9db..99b796dcb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_init.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_init.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verify_init.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: verify_init.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
@@ -57,16 +57,19 @@ static krb5_boolean
 fail_verify_is_ok (krb5_context context,
 		   krb5_verify_init_creds_opt *options)
 {
-    if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
-	 && options->ap_req_nofail != 0)
-	|| krb5_config_get_bool (context,
-				 NULL,
-				 "libdefaults",
-				 "verify_ap_req_nofail",
-				 NULL))
+
+    if (options && (options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL)
+	&& options->ap_req_nofail != 0)
 	return FALSE;
-    else
-	return TRUE;
+
+    if (krb5_config_get_bool(context,
+			     NULL,
+			     "libdefaults",
+			     "verify_ap_req_nofail",
+			     NULL))
+	return FALSE;
+
+    return TRUE;
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.8 b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.8
index 1475f61a5..9766b8f74 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.8
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: verify_krb5_conf.8,v 1.1.1.2 2011/04/14 14:09:27 elric Exp $
+.\"	$NetBSD: verify_krb5_conf.8,v 1.2 2017/01/28 21:31:49 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.c b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.c
index 4167e4a44..2c3b57c99 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_krb5_conf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verify_krb5_conf.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: verify_krb5_conf.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
@@ -165,22 +165,22 @@ check_host(krb5_context context, const char *path, char *data)
 
     /* XXX data could be a list of hosts that this code can't handle */
     /* XXX copied from krbhst.c */
-    if(strncmp(p, "http://", 7) == 0){
+    if (strncmp(p, "http://", 7) == 0){
         p += 7;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "http", sizeof(service));
 	defport = 80;
-    } else if(strncmp(p, "http/", 5) == 0) {
+    } else if (strncmp(p, "http/", 5) == 0) {
         p += 5;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "http", sizeof(service));
 	defport = 80;
-    }else if(strncmp(p, "tcp/", 4) == 0){
+    } else if (strncmp(p, "tcp/", 4) == 0){
         p += 4;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "kerberos", sizeof(service));
 	defport = 88;
-    } else if(strncmp(p, "udp/", 4) == 0) {
+    } else if (strncmp(p, "udp/", 4) == 0) {
         p += 4;
 	hints.ai_socktype = SOCK_DGRAM;
 	strlcpy(service, "kerberos", sizeof(service));
@@ -190,14 +190,14 @@ check_host(krb5_context context, const char *path, char *data)
 	strlcpy(service, "kerberos", sizeof(service));
 	defport = 88;
     }
-    if(strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
+    if (strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
 	return 1;
     }
     hostname[strcspn(hostname, "/")] = '\0';
-    if(p != NULL) {
+    if (p != NULL) {
 	char *end;
 	int tmp = strtol(p, &end, 0);
-	if(end == p) {
+	if (end == p) {
 	    krb5_warnx(context, "%s: failed to parse port number in %s",
 		       path, data);
 	    return 1;
@@ -206,14 +206,15 @@ check_host(krb5_context context, const char *path, char *data)
 	snprintf(service, sizeof(service), "%u", defport);
     }
     ret = getaddrinfo(hostname, service, &hints, &ai);
-    if(ret == EAI_SERVICE && !isdigit((unsigned char)service[0])) {
+    if (ret == EAI_SERVICE && !isdigit((unsigned char)service[0])) {
 	snprintf(service, sizeof(service), "%u", defport);
 	ret = getaddrinfo(hostname, service, &hints, &ai);
     }
-    if(ret != 0) {
+    if (ret != 0) {
 	krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname);
 	return 1;
     }
+    freeaddrinfo(ai);
     return 0;
 }
 
@@ -291,10 +292,13 @@ check_log(krb5_context context, const char *path, char *data)
     int min = 0, max = -1, n;
     char c;
     const char *p = data;
+#ifdef _WIN32
+    const char *q;
+#endif
 
     n = sscanf(p, "%d%c%d/", &min, &c, &max);
     if(n == 2){
-	if(c == '/') {
+	if(ISPATHSEP(c)) {
 	    if(min < 0){
 		max = -min;
 		min = 0;
@@ -304,6 +308,12 @@ check_log(krb5_context context, const char *path, char *data)
 	}
     }
     if(n){
+#ifdef _WIN32
+	q = strrchr(p, '\\');
+	if (q != NULL)
+	    p = q;
+	else
+#endif
 	p = strchr(p, '/');
 	if(p == NULL) {
 	    krb5_warnx(context, "%s: failed to parse \"%s\"", path, data);
@@ -329,7 +339,7 @@ check_log(krb5_context context, const char *path, char *data)
 	    strlcpy(severity, "ERR", sizeof(severity));
  	if(*facility == '\0')
 	    strlcpy(facility, "AUTH", sizeof(facility));
-	if(find_value(severity, syslogvals) == -1) {
+	if(find_value(facility, syslogvals) == -1) {
 	    krb5_warnx(context, "%s: unknown syslog facility \"%s\"",
 		       path, facility);
 	    ret++;
@@ -355,227 +365,302 @@ struct entry {
 };
 
 struct entry all_strings[] = {
-    { "", krb5_config_string, NULL },
-    { NULL }
+    { "", krb5_config_string, NULL, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry all_boolean[] = {
-    { "", krb5_config_string, check_boolean },
-    { NULL }
+    { "", krb5_config_string, check_boolean, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 
 struct entry v4_name_convert_entries[] = {
-    { "host", krb5_config_list, all_strings },
-    { "plain", krb5_config_list, all_strings },
-    { NULL }
+    { "host", krb5_config_list, all_strings, 0 },
+    { "plain", krb5_config_list, all_strings, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry libdefaults_entries[] = {
-    { "accept_null_addresses", krb5_config_string, check_boolean },
-    { "allow_weak_crypto", krb5_config_string, check_boolean },
+    { "accept_null_addresses", krb5_config_string, check_boolean, 0 },
+    { "allow_weak_crypto", krb5_config_string, check_boolean, 0 },
     { "capath", krb5_config_list, all_strings, 1 },
-    { "check_pac", krb5_config_string, check_boolean },
-    { "clockskew", krb5_config_string, check_time },
-    { "date_format", krb5_config_string, NULL },
-    { "default_cc_name", krb5_config_string, NULL },
-    { "default_etypes", krb5_config_string, NULL },
-    { "default_etypes_des", krb5_config_string, NULL },
-    { "default_keytab_modify_name", krb5_config_string, NULL },
-    { "default_keytab_name", krb5_config_string, NULL },
-    { "default_realm", krb5_config_string, NULL },
-    { "dns_canonize_hostname", krb5_config_string, check_boolean },
-    { "dns_proxy", krb5_config_string, NULL },
-    { "dns_lookup_kdc", krb5_config_string, check_boolean },
-    { "dns_lookup_realm", krb5_config_string, check_boolean },
-    { "dns_lookup_realm_labels", krb5_config_string, NULL },
-    { "egd_socket", krb5_config_string, NULL },
-    { "encrypt", krb5_config_string, check_boolean },
-    { "extra_addresses", krb5_config_string, NULL },
-    { "fcache_version", krb5_config_string, check_numeric },
-    { "fcc-mit-ticketflags", krb5_config_string, check_boolean },
-    { "forward", krb5_config_string, check_boolean },
-    { "forwardable", krb5_config_string, check_boolean },
-    { "http_proxy", krb5_config_string, check_host /* XXX */ },
-    { "ignore_addresses", krb5_config_string, NULL },
-    { "kdc_timeout", krb5_config_string, check_time },
-    { "kdc_timesync", krb5_config_string, check_boolean },
-    { "log_utc", krb5_config_string, check_boolean },
-    { "maxretries", krb5_config_string, check_numeric },
-    { "scan_interfaces", krb5_config_string, check_boolean },
-    { "srv_lookup", krb5_config_string, check_boolean },
-    { "srv_try_txt", krb5_config_string, check_boolean },
-    { "ticket_lifetime", krb5_config_string, check_time },
-    { "time_format", krb5_config_string, NULL },
-    { "transited_realms_reject", krb5_config_string, NULL },
-    { "no-addresses", krb5_config_string, check_boolean },
-    { "v4_instance_resolve", krb5_config_string, check_boolean },
-    { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
-    { "verify_ap_req_nofail", krb5_config_string, check_boolean },
-    { "max_retries", krb5_config_string, check_time },
-    { "renew_lifetime", krb5_config_string, check_time },
-    { "proxiable", krb5_config_string, check_boolean },
-    { "warn_pwexpire", krb5_config_string, check_time },
+    { "ccapi_library", krb5_config_string, NULL, 0 },
+    { "check_pac", krb5_config_string, check_boolean, 0 },
+    { "check-rd-req-server", krb5_config_string, check_boolean, 0 },
+    { "clockskew", krb5_config_string, check_time, 0 },
+    { "date_format", krb5_config_string, NULL, 0 },
+    { "default_as_etypes", krb5_config_string, NULL, 0 },
+    { "default_cc_name", krb5_config_string, NULL, 0 },
+    { "default_cc_type", krb5_config_string, NULL, 0 },
+    { "default_etypes", krb5_config_string, NULL, 0 },
+    { "default_etypes_des", krb5_config_string, NULL, 0 },
+    { "default_keytab_modify_name", krb5_config_string, NULL, 0 },
+    { "default_keytab_name", krb5_config_string, NULL, 0 },
+    { "default_keytab_modify_name", krb5_config_string, NULL, 0 },
+    { "default_realm", krb5_config_string, NULL, 0 },
+    { "default_tgs_etypes", krb5_config_string, NULL, 0 },
+    { "dns_canonize_hostname", krb5_config_string, check_boolean, 0 },
+    { "dns_proxy", krb5_config_string, NULL, 0 },
+    { "dns_lookup_kdc", krb5_config_string, check_boolean, 0 },
+    { "dns_lookup_realm", krb5_config_string, check_boolean, 0 },
+    { "dns_lookup_realm_labels", krb5_config_string, NULL, 0 },
+    { "egd_socket", krb5_config_string, NULL, 0 },
+    { "encrypt", krb5_config_string, check_boolean, 0 },
+    { "extra_addresses", krb5_config_string, NULL, 0 },
+    { "fcache_version", krb5_config_string, check_numeric, 0 },
+    { "fcache_strict_checking", krb5_config_string, check_boolean, 0 },
+    { "fcc-mit-ticketflags", krb5_config_string, check_boolean, 0 },
+    { "forward", krb5_config_string, check_boolean, 0 },
+    { "forwardable", krb5_config_string, check_boolean, 0 },
+    { "allow_hierarchical_capaths", krb5_config_string, check_boolean, 0 },
+    { "host_timeout", krb5_config_string, check_time, 0 },
+    { "http_proxy", krb5_config_string, check_host /* XXX */, 0 },
+    { "ignore_addresses", krb5_config_string, NULL, 0 },
+    { "k5login_authoritative", krb5_config_string, check_boolean, 0 },
+    { "k5login_directory", krb5_config_string, NULL, 0 },
+    { "kdc_timeout", krb5_config_string, check_time, 0 },
+    { "kdc_timesync", krb5_config_string, check_boolean, 0 },
+    { "kuserok", krb5_config_string, NULL, 0 },
+    { "large_message_size", krb5_config_string, check_numeric, 0 },
+    { "log_utc", krb5_config_string, check_boolean, 0 },
+    { "max_retries", krb5_config_string, check_numeric, 0 },
+    { "maximum_message_size", krb5_config_string, check_numeric, 0 },
+    { "moduli", krb5_config_string, NULL, 0 },
+    { "name_canon_rules", krb5_config_string, NULL, 0 },
+    { "no-addresses", krb5_config_string, check_boolean, 0 },
+    { "pkinit_dh_min_bits", krb5_config_string, NULL, 0 },
+    { "proxiable", krb5_config_string, check_boolean, 0 },
+    { "renew_lifetime", krb5_config_string, check_time, 0 },
+    { "scan_interfaces", krb5_config_string, check_boolean, 0 },
+    { "srv_lookup", krb5_config_string, check_boolean, 0 },
+    { "srv_try_txt", krb5_config_string, check_boolean, 0 },
+    { "ticket_lifetime", krb5_config_string, check_time, 0 },
+    { "time_format", krb5_config_string, NULL, 0 },
+    { "transited_realms_reject", krb5_config_string, NULL, 0 },
+    { "use_fallback", krb5_config_string, check_boolean, 0 },
+    { "v4_instance_resolve", krb5_config_string, check_boolean, 0 },
+    { "v4_name_convert", krb5_config_list, v4_name_convert_entries, 0 },
+    { "verify_ap_req_nofail", krb5_config_string, check_boolean, 0 },
+    { "warn_pwexpire", krb5_config_string, check_time, 0 },
+
     /* MIT stuff */
-    { "permitted_enctypes", krb5_config_string, mit_entry },
-    { "default_tgs_enctypes", krb5_config_string, mit_entry },
-    { "default_tkt_enctypes", krb5_config_string, mit_entry },
-    { NULL }
+    { "permitted_enctypes", krb5_config_string, mit_entry, 0 },
+    { "default_tgs_enctypes", krb5_config_string, mit_entry, 0 },
+    { "default_tkt_enctypes", krb5_config_string, mit_entry, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry appdefaults_entries[] = {
-    { "afslog", krb5_config_string, check_boolean },
-    { "afs-use-524", krb5_config_string, check_524 },
-    { "encrypt", krb5_config_string, check_boolean },
-    { "forward", krb5_config_string, check_boolean },
-    { "forwardable", krb5_config_string, check_boolean },
-    { "proxiable", krb5_config_string, check_boolean },
-    { "ticket_lifetime", krb5_config_string, check_time },
-    { "renew_lifetime", krb5_config_string, check_time },
-    { "no-addresses", krb5_config_string, check_boolean },
-    { "krb4_get_tickets", krb5_config_string, check_boolean },
-    { "pkinit_anchors", krb5_config_string, NULL },
-    { "pkinit_win2k", krb5_config_string, NULL },
-    { "pkinit_win2k_require_binding", krb5_config_string, NULL },
-    { "pkinit_require_eku", krb5_config_string, NULL },
-    { "pkinit_require_krbtgt_otherName", krb5_config_string, NULL },
-    { "pkinit_require_hostname_match", krb5_config_string, NULL },
+    { "afslog", krb5_config_string, check_boolean, 0 },
+    { "afs-use-524", krb5_config_string, check_524, 0 },
 #if 0
-    { "anonymous", krb5_config_string, check_boolean },
+    { "anonymous", krb5_config_string, check_boolean, 0 },
 #endif
-    { "", krb5_config_list, appdefaults_entries },
-    { NULL }
+    { "encrypt", krb5_config_string, check_boolean, 0 },
+    { "forward", krb5_config_string, check_boolean, 0 },
+    { "forwardable", krb5_config_string, check_boolean, 0 },
+    { "krb4_get_tickets", krb5_config_string, check_boolean, 0 },
+    { "proxiable", krb5_config_string, check_boolean, 0 },
+    { "renew_lifetime", krb5_config_string, check_time, 0 },
+    { "no-addresses", krb5_config_string, check_boolean, 0 },
+    { "pkinit_anchors", krb5_config_string, NULL, 0 },
+    { "pkinit_pool", krb5_config_string, NULL, 0 },
+    { "pkinit_require_eku", krb5_config_string, NULL, 0 },
+    { "pkinit_require_hostname_match", krb5_config_string, NULL, 0 },
+    { "pkinit_require_krbtgt_otherName", krb5_config_string, NULL, 0 },
+    { "pkinit_revoke", krb5_config_string, NULL, 0 },
+    { "pkinit_trustedCertifiers", krb5_config_string, check_boolean, 0 },
+    { "pkinit_win2k", krb5_config_string, NULL, 0 },
+    { "pkinit_win2k_require_binding", krb5_config_string, NULL, 0 },
+    { "ticket_lifetime", krb5_config_string, check_time, 0 },
+    { "", krb5_config_list, appdefaults_entries, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry realms_entries[] = {
-    { "forwardable", krb5_config_string, check_boolean },
-    { "proxiable", krb5_config_string, check_boolean },
-    { "ticket_lifetime", krb5_config_string, check_time },
-    { "renew_lifetime", krb5_config_string, check_time },
-    { "warn_pwexpire", krb5_config_string, check_time },
-    { "kdc", krb5_config_string, check_host },
-    { "admin_server", krb5_config_string, check_host },
-    { "kpasswd_server", krb5_config_string, check_host },
-    { "krb524_server", krb5_config_string, check_host },
-    { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
-    { "v4_instance_convert", krb5_config_list, all_strings },
-    { "v4_domains", krb5_config_string, NULL },
-    { "default_domain", krb5_config_string, NULL },
-    { "win2k_pkinit", krb5_config_string, NULL },
+    { "admin_server", krb5_config_string, check_host, 0 },
+    { "auth_to_local", krb5_config_string, NULL, 0 },
+    { "auth_to_local_names", krb5_config_string, NULL, 0 },
+    { "default_domain", krb5_config_string, NULL, 0 },
+    { "forwardable", krb5_config_string, check_boolean, 0 },
+    { "allow_hierarchical_capaths", krb5_config_string, check_boolean, 0 },
+    { "kdc", krb5_config_string, check_host, 0 },
+    { "kpasswd_server", krb5_config_string, check_host, 0 },
+    { "krb524_server", krb5_config_string, check_host, 0 },
+    { "kx509_ca", krb5_config_string, NULL, 0 },
+    { "kx509_include_pkinit_san", krb5_config_string, check_boolean, 0 },
+    { "name_canon_rules", krb5_config_string, NULL, 0 },
+    { "no-addresses", krb5_config_string, check_boolean, 0 },
+    { "pkinit_anchors", krb5_config_string, NULL, 0 },
+    { "pkinit_require_eku", krb5_config_string, NULL, 0 },
+    { "pkinit_require_hostname_match", krb5_config_string, NULL, 0 },
+    { "pkinit_require_krbtgt_otherName", krb5_config_string, NULL, 0 },
+    { "pkinit_trustedCertifiers", krb5_config_string, check_boolean, 0 },
+    { "pkinit_win2k", krb5_config_string, NULL, 0 },
+    { "pkinit_win2k_require_binding", krb5_config_string, NULL, 0 },
+    { "proxiable", krb5_config_string, check_boolean, 0 },
+    { "renew_lifetime", krb5_config_string, check_time, 0 },
+    { "require_initial_kca_tickets", krb5_config_string, check_boolean, 0 },
+    { "ticket_lifetime", krb5_config_string, check_time, 0 },
+    { "v4_domains", krb5_config_string, NULL, 0 },
+    { "v4_instance_convert", krb5_config_list, all_strings, 0 },
+    { "v4_name_convert", krb5_config_list, v4_name_convert_entries, 0 },
+    { "warn_pwexpire", krb5_config_string, check_time, 0 },
+    { "win2k_pkinit", krb5_config_string, NULL, 0 },
+
     /* MIT stuff */
-    { "admin_keytab", krb5_config_string, mit_entry },
-    { "acl_file", krb5_config_string, mit_entry },
-    { "dict_file", krb5_config_string, mit_entry },
-    { "kadmind_port", krb5_config_string, mit_entry },
-    { "kpasswd_port", krb5_config_string, mit_entry },
-    { "master_key_name", krb5_config_string, mit_entry },
-    { "master_key_type", krb5_config_string, mit_entry },
-    { "key_stash_file", krb5_config_string, mit_entry },
-    { "max_life", krb5_config_string, mit_entry },
-    { "max_renewable_life", krb5_config_string, mit_entry },
-    { "default_principal_expiration", krb5_config_string, mit_entry },
-    { "default_principal_flags", krb5_config_string, mit_entry },
-    { "supported_enctypes", krb5_config_string, mit_entry },
-    { "database_name", krb5_config_string, mit_entry },
-    { NULL }
+    { "admin_keytab", krb5_config_string, mit_entry, 0 },
+    { "acl_file", krb5_config_string, mit_entry, 0 },
+    { "database_name", krb5_config_string, mit_entry, 0 },
+    { "default_principal_expiration", krb5_config_string, mit_entry, 0 },
+    { "default_principal_flags", krb5_config_string, mit_entry, 0 },
+    { "dict_file", krb5_config_string, mit_entry, 0 },
+    { "kadmind_port", krb5_config_string, mit_entry, 0 },
+    { "kpasswd_port", krb5_config_string, mit_entry, 0 },
+    { "master_kdc", krb5_config_string, mit_entry, 0 },
+    { "master_key_name", krb5_config_string, mit_entry, 0 },
+    { "master_key_type", krb5_config_string, mit_entry, 0 },
+    { "key_stash_file", krb5_config_string, mit_entry, 0 },
+    { "max_life", krb5_config_string, mit_entry, 0 },
+    { "max_renewable_life", krb5_config_string, mit_entry, 0 },
+    { "supported_enctypes", krb5_config_string, mit_entry, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry realms_foobar[] = {
-    { "", krb5_config_list, realms_entries },
-    { NULL }
+    { "", krb5_config_list, realms_entries, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 
 struct entry kdc_database_entries[] = {
-    { "realm", krb5_config_string, NULL },
-    { "dbname", krb5_config_string, NULL },
-    { "mkey_file", krb5_config_string, NULL },
-    { "acl_file", krb5_config_string, NULL },
-    { "log_file", krb5_config_string, NULL },
-    { NULL }
+    { "acl_file", krb5_config_string, NULL, 0 },
+    { "dbname", krb5_config_string, NULL, 0 },
+    { "log_file", krb5_config_string, NULL, 0 },
+    { "mkey_file", krb5_config_string, NULL, 0 },
+    { "realm", krb5_config_string, NULL, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry kdc_entries[] = {
-    { "database", krb5_config_list, kdc_database_entries },
-    { "key-file", krb5_config_string, NULL },
-    { "logging", krb5_config_string, check_log },
-    { "max-request", krb5_config_string, check_bytes },
-    { "require-preauth", krb5_config_string, check_boolean },
-    { "ports", krb5_config_string, NULL },
-    { "addresses", krb5_config_string, NULL },
-    { "enable-kerberos4", krb5_config_string, check_boolean },
-    { "enable-524", krb5_config_string, check_boolean },
-    { "enable-http", krb5_config_string, check_boolean },
-    { "check-ticket-addresses", krb5_config_string, check_boolean },
-    { "allow-null-ticket-addresses", krb5_config_string, check_boolean },
-    { "allow-anonymous", krb5_config_string, check_boolean },
-    { "v4_realm", krb5_config_string, NULL },
+    { "addresses", krb5_config_string, NULL, 0 },
+    { "allow-anonymous", krb5_config_string, check_boolean, 0 },
+    { "allow-null-ticket-addresses", krb5_config_string, check_boolean, 0 },
+    { "check-ticket-addresses", krb5_config_string, check_boolean, 0 },
+    { "database", krb5_config_list, kdc_database_entries, 0 },
+    { "detach", krb5_config_string, check_boolean, 0 },
+    { "digests_allowed", krb5_config_string, NULL, 0 },
+    { "disable-des", krb5_config_string, check_boolean, 0 },
+    { "enable-524", krb5_config_string, check_boolean, 0 },
+    { "enable-digest", krb5_config_string, check_boolean, 0 },
     { "enable-kaserver", krb5_config_string, check_boolean, 1 },
-    { "encode_as_rep_as_tgs_rep", krb5_config_string, check_boolean },
-    { "kdc_warn_pwexpire", krb5_config_string, check_time },
-    { "use_2b", krb5_config_list, NULL },
-    { "enable-pkinit", krb5_config_string, check_boolean },
-    { "pkinit_identity", krb5_config_string, NULL },
-    { "pkinit_anchors", krb5_config_string, NULL },
-    { "pkinit_pool", krb5_config_string, NULL },
-    { "pkinit_revoke", krb5_config_string, NULL },
-    { "pkinit_kdc_ocsp", krb5_config_string, NULL },
-    { "pkinit_principal_in_certificate", krb5_config_string, NULL },
-    { "pkinit_dh_min_bits", krb5_config_string, NULL },
-    { "pkinit_allow_proxy_certificate", krb5_config_string, NULL },
-    { "hdb-ldap-create-base", krb5_config_string, NULL },
-    { "v4-realm", krb5_config_string, NULL },
-    { NULL }
+    { "enable-kerberos4", krb5_config_string, check_boolean, 1 },
+    { "enable-kx509", krb5_config_string, check_boolean, 0 },
+    { "enable-http", krb5_config_string, check_boolean, 0 },
+    { "enable-pkinit", krb5_config_string, check_boolean, 0 },
+    { "encode_as_rep_as_tgs_rep", krb5_config_string, check_boolean, 0 },
+    { "enforce-transited-policy", krb5_config_string, NULL, 1 },
+    { "hdb-ldap-create-base", krb5_config_string, NULL, 0 },
+    { "iprop-acl", krb5_config_string, NULL, 0 },
+    { "iprop-stats", krb5_config_string, NULL, 0 },
+    { "kdc-request-log", krb5_config_string, NULL, 0 },
+    { "kdc_warn_pwexpire", krb5_config_string, check_time, 0 },
+    { "key-file", krb5_config_string, NULL, 0 },
+    { "kx509_ca", krb5_config_string, NULL, 0 },
+    { "kx509_include_pkinit_san", krb5_config_string, check_boolean, 0 },
+    { "kx509_template", krb5_config_string, NULL, 0 },
+    { "logging", krb5_config_string, check_log, 0 },
+    { "max-kdc-datagram-reply-length", krb5_config_string, check_bytes, 0 },
+    { "max-request", krb5_config_string, check_bytes, 0 },
+    { "pkinit_allow_proxy_certificate", krb5_config_string, check_boolean, 0 },
+    { "pkinit_anchors", krb5_config_string, NULL, 0 },
+    { "pkinit_dh_min_bits", krb5_config_string, check_numeric, 0 },
+    { "pkinit_identity", krb5_config_string, NULL, 0 },
+    { "pkinit_kdc_friendly_name", krb5_config_string, NULL, 0 },
+    { "pkinit_kdc_ocsp", krb5_config_string, NULL, 0 },
+    { "pkinit_mappings_file", krb5_config_string, NULL, 0 },
+    { "pkinit_pool", krb5_config_string, NULL, 0 },
+    { "pkinit_principal_in_certificate", krb5_config_string, check_boolean, 0 },
+    { "pkinit_revoke", krb5_config_string, NULL, 0 },
+    { "pkinit_win2k_require_binding", krb5_config_string, check_boolean, 0 },
+    { "ports", krb5_config_string, NULL, 0 },
+    { "preauth-use-strongest-session-key", krb5_config_string, check_boolean, 0 },
+    { "require_initial_kca_tickets", krb5_config_string, check_boolean, 0 },
+    { "require-preauth", krb5_config_string, check_boolean, 0 },
+    { "svc-use-strongest-session-key", krb5_config_string, check_boolean, 0 },
+    { "tgt-use-strongest-session-key", krb5_config_string, check_boolean, 0 },
+    { "transited-policy", krb5_config_string, NULL, 0 },
+    { "use_2b", krb5_config_list, NULL, 0 },
+    { "use-strongest-server-key", krb5_config_string, check_boolean, 0 },
+    { "v4_realm", krb5_config_string, NULL, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry kadmin_entries[] = {
-    { "password_lifetime", krb5_config_string, check_time },
-    { "default_keys", krb5_config_string, NULL },
-    { "use_v4_salt", krb5_config_string, NULL },
-    { "require-preauth", krb5_config_string, check_boolean },
-    { NULL }
+    { "allow_self_change_password", krb5_config_string, check_boolean, 0 },
+    { "default_keys", krb5_config_string, NULL, 0 },
+    { "password_lifetime", krb5_config_string, check_time, 0 },
+    { "require-preauth", krb5_config_string, check_boolean, 0 },
+    { "save-password", krb5_config_string, check_boolean, 0 },
+    { "use_v4_salt", krb5_config_string, NULL, 0 },
+    { NULL, 0, NULL, 0 }
 };
 struct entry log_strings[] = {
-    { "", krb5_config_string, check_log },
-    { NULL }
+    { "", krb5_config_string, check_log, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 
 /* MIT stuff */
 struct entry kdcdefaults_entries[] = {
-    { "kdc_ports", krb5_config_string, mit_entry },
-    { "v4_mode", krb5_config_string, mit_entry },
-    { NULL }
+    { "kdc_ports", krb5_config_string, mit_entry, 0 },
+    { "v4_mode", krb5_config_string, mit_entry, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry capaths_entries[] = {
-    { "", krb5_config_list, all_strings },
-    { NULL }
+    { "", krb5_config_list, all_strings, 0 },
+    { NULL, 0, NULL, 0 }
+};
+
+struct entry kcm_entries[] = {
+    { "detach", krb5_config_string, check_boolean, 0 },
+    { "disallow-getting-krbtgt", krb5_config_string, check_boolean, 0 },
+    { "logging", krb5_config_string, NULL, 0 },
+    { "max-request", krb5_config_string, NULL, 0 },
+    { "system_ccache", krb5_config_string, NULL, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry password_quality_entries[] = {
-    { "policies", krb5_config_string, NULL },
-    { "external_program", krb5_config_string, NULL },
-    { "min_classes", krb5_config_string, check_numeric },
-    { "min_length", krb5_config_string, check_numeric },
-    { "", krb5_config_list, all_strings },
-    { NULL }
+    { "check_function", krb5_config_string, NULL, 0 },
+    { "check_library", krb5_config_string, NULL, 0 },
+    { "external_program", krb5_config_string, NULL, 0 },
+    { "min_classes", krb5_config_string, check_numeric, 0 },
+    { "min_length", krb5_config_string, check_numeric, 0 },
+    { "policies", krb5_config_string, NULL, 0 },
+    { "policy_libraries", krb5_config_string, NULL, 0 },
+    { "", krb5_config_list, all_strings, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 struct entry toplevel_sections[] = {
-    { "libdefaults" , krb5_config_list, libdefaults_entries },
-    { "realms", krb5_config_list, realms_foobar },
-    { "domain_realm", krb5_config_list, all_strings },
-    { "logging", krb5_config_list, log_strings },
-    { "kdc", krb5_config_list, kdc_entries },
-    { "kadmin", krb5_config_list, kadmin_entries },
-    { "appdefaults", krb5_config_list, appdefaults_entries },
-    { "gssapi", krb5_config_list, NULL },
-    { "capaths", krb5_config_list, capaths_entries },
-    { "password_quality", krb5_config_list, password_quality_entries },
+    { "appdefaults", krb5_config_list, appdefaults_entries, 0 },
+    { "capaths", krb5_config_list, capaths_entries, 0 },
+    { "domain_realm", krb5_config_list, all_strings, 0 },
+    { "gssapi", krb5_config_list, NULL, 0 },
+    { "kadmin", krb5_config_list, kadmin_entries, 0 },
+    { "kcm", krb5_config_list, kcm_entries, 0 },
+    { "kdc", krb5_config_list, kdc_entries, 0 },
+    { "libdefaults" , krb5_config_list, libdefaults_entries, 0 },
+    { "logging", krb5_config_list, log_strings, 0 },
+    { "password_quality", krb5_config_list, password_quality_entries, 0 },
+    { "realms", krb5_config_list, realms_foobar, 0 },
+
     /* MIT stuff */
-    { "kdcdefaults", krb5_config_list, kdcdefaults_entries },
-    { NULL }
+    { "kdcdefaults", krb5_config_list, kdcdefaults_entries, 0 },
+    { NULL, 0, NULL, 0 }
 };
 
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_user.c b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_user.c
index a22722cca..5a47043a2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/verify_user.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/verify_user.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verify_user.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: verify_user.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
@@ -102,11 +102,8 @@ KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_verify_opt_alloc(krb5_context context, krb5_verify_opt **opt)
 {
     *opt = calloc(1, sizeof(**opt));
-    if ((*opt) == NULL) {
-	krb5_set_error_message(context, ENOMEM,
-			       N_("malloc: out of memory", ""));
-	return ENOMEM;
-    }
+    if ((*opt) == NULL)
+	return krb5_enomem(context);
     krb5_verify_opt_init(*opt);
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/version-script.map b/crypto/external/bsd/heimdal/dist/lib/krb5/version-script.map
index 383fd4063..8088409ff 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/version-script.map
@@ -2,10 +2,6 @@ HEIMDAL_KRB5_2.0 {
 	global:
 		krb524_convert_creds_kdc;
 		krb524_convert_creds_kdc_ccache;
-		krb5_425_conv_principal;
-		krb5_425_conv_principal_ext2;
-		krb5_425_conv_principal_ext;
-		krb5_524_conv_principal;
 		krb5_abort;
 		krb5_abortx;
 		krb5_acl_match_file;
@@ -42,6 +38,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_auth_con_getrcache;
 		krb5_auth_con_getremoteseqnumber;
 		krb5_auth_con_getremotesubkey;
+		krb5_auth_con_getsendsubkey;
 		krb5_auth_con_init;
 		krb5_auth_con_removeflags;
 		krb5_auth_con_setaddrs;
@@ -349,6 +346,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_get_init_creds_opt_set_address_list;
 		krb5_get_init_creds_opt_set_addressless;
 		krb5_get_init_creds_opt_set_anonymous;
+		krb5_get_init_creds_opt_set_change_password_prompt;
 		krb5_get_init_creds_opt_set_canonicalize;
 		krb5_get_init_creds_opt_set_default_flags;
 		krb5_get_init_creds_opt_set_etype_list;
@@ -387,6 +385,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_init_ets;
 		krb5_initlog;
 		krb5_is_config_principal;
+		krb5_is_enctype_weak;
 		krb5_is_thread_safe;
 		krb5_kcm_call;
 		krb5_kcm_storage_request;
@@ -435,6 +434,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_make_principal;
 		krb5_max_sockaddr_size;
 		krb5_mk_error;
+		krb5_mk_error_ext;
 		krb5_mk_priv;
 		krb5_mk_rep;
 		krb5_mk_req;
@@ -446,7 +446,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_net_write_block;
 		krb5_ntlm_alloc;
 		krb5_ntlm_free;
-		krb5_ntlm_init_get_challange;
+		krb5_ntlm_init_get_challenge;
 		krb5_ntlm_init_get_flags;
 		krb5_ntlm_init_get_opaque;
 		krb5_ntlm_init_get_targetinfo;
@@ -491,6 +491,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_principal_get_realm;
 		krb5_principal_get_type;
 		krb5_principal_match;
+		krb5_principal_set_comp_string;
 		krb5_principal_set_realm;
 		krb5_principal_set_type;
 		krb5_principal_is_krbtgt;
@@ -545,6 +546,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_ret_data;
 		krb5_ret_int16;
 		krb5_ret_int32;
+		krb5_ret_int64;
 		krb5_ret_int8;
 		krb5_ret_keyblock;
 		krb5_ret_principal;
@@ -554,6 +556,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_ret_times;
 		krb5_ret_uint16;
 		krb5_ret_uint32;
+		krb5_ret_uint64;
 		krb5_ret_uint8;
 		krb5_salttype_to_string;
 		krb5_sendauth;
@@ -568,6 +571,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_sendto_kdc;
 		krb5_sendto_kdc_flags;
 		krb5_set_config_files;
+		krb5_set_debug_dest;
 		krb5_set_default_in_tkt_etypes;
 		krb5_set_default_realm;
 		krb5_set_dns_canonicalize_hostname;
@@ -598,6 +602,8 @@ HEIMDAL_KRB5_2.0 {
 		krb5_storage_from_fd;
 		krb5_storage_from_mem;
 		krb5_storage_from_readonly_mem;
+		krb5_storage_from_socket;
+		krb5_storage_fsync;
 		krb5_storage_get_byteorder;
 		krb5_storage_get_eof_code;
 		krb5_storage_is_flags;
@@ -618,6 +624,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_store_data;
 		krb5_store_int16;
 		krb5_store_int32;
+		krb5_store_int64;
 		krb5_store_int8;
 		krb5_store_keyblock;
 		krb5_store_principal;
@@ -627,6 +634,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_store_times;
 		krb5_store_uint16;
 		krb5_store_uint32;
+		krb5_store_uint64;
 		krb5_store_uint8;
 		krb5_string_to_deltat;
 		krb5_string_to_enctype;
@@ -702,6 +710,7 @@ HEIMDAL_KRB5_2.0 {
 		initialize_k524_error_table;
 
 		# variables
+		krb5_dcc_ops;
 		krb5_mcc_ops;
 		krb5_acc_ops;
 		krb5_fcc_ops;
@@ -716,36 +725,29 @@ HEIMDAL_KRB5_2.0 {
 		krb5_config_file;
 		krb5_defkeyname;
 		krb5_cc_type_api;
+		krb5_cc_type_dcc;
 		krb5_cc_type_file;
 		krb5_cc_type_memory;
 		krb5_cc_type_kcm;
 		krb5_cc_type_scc;
 
+		# shared with HDB
+		_krb5_plugin_run_f;
+		_krb5_enctype_requires_random_salt;
+
 		# Shared with GSSAPI krb5
 		_krb5_crc_init_table;		
 		_krb5_crc_update;		
 		_krb5_get_krbtgt;
 		_krb5_build_authenticator;
 
-		# V4 compat glue
-		_krb5_krb_tf_setup;
-		_krb5_krb_dest_tkt;
-		_krb5_krb_life_to_time;
-		_krb5_krb_decomp_ticket;
-		_krb5_krb_decomp_ticket;
-		_krb5_krb_create_ticket;
-		_krb5_krb_create_ciph;
-		_krb5_krb_create_auth_reply;
-		_krb5_krb_rd_req;
-		_krb5_krb_free_auth_data;
-		_krb5_krb_time_to_life;
-		_krb5_krb_cr_err_reply;
-
 		# Shared with libkdc
-		_krb5_AES_string_to_default_iterator;
+		_krb5_AES_SHA1_string_to_default_iterator;
+		_krb5_AES_SHA2_string_to_default_iterator;
 		_krb5_dh_group_ok;
 		_krb5_get_host_realm_int;
 		_krb5_get_int;
+		_krb5_get_int64;
 		_krb5_pac_sign;
 		_krb5_parse_moduli;
 		_krb5_pk_kdf;
@@ -754,8 +756,7 @@ HEIMDAL_KRB5_2.0 {
 		_krb5_pk_octetstring2key;
 		_krb5_plugin_find;
 		_krb5_plugin_free;
-		_krb5_plugin_get_next;
-		_krb5_plugin_get_symbol;
+		_krb5_plugin_run_f;
 		_krb5_principal2principalname;
 		_krb5_principalname2krb5_principal;
 		_krb5_put_int;
@@ -773,11 +774,32 @@ HEIMDAL_KRB5_2.0 {
 		# kinit helper
 		krb5_get_init_creds_opt_set_pkinit_user_certs;
 		krb5_pk_enterprise_cert;
+		krb5_process_last_request;
+		krb5_init_creds_init;
+		krb5_init_creds_set_service;
+		krb5_init_creds_set_fast_ccache;
+		krb5_init_creds_set_keytab;
+		krb5_init_creds_get;
+		krb5_init_creds_get_creds;
+		krb5_init_creds_get_error;
+		krb5_init_creds_set_password;
+		krb5_init_creds_store;
+		krb5_init_creds_free;
 
 		# testing
 		_krb5_aes_cts_encrypt;
 		_krb5_n_fold;
 		_krb5_expand_default_cc_name;
+		_krb5_expand_path_tokensv;
+		
+		# FAST
+		_krb5_fast_cf2;
+		_krb5_fast_armor_key;
+
+                # TGS
+                _krb5_find_capath;
+                _krb5_free_capath;
+
 	local:
 		*;
 };
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/version.c b/crypto/external/bsd/heimdal/dist/lib/krb5/version.c
index c2363e053..a5ec92337 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/version.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/version.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: version.c,v 1.1.1.1 2011/04/13 18:15:39 elric Exp $	*/
+/*	$NetBSD: version.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/warn.c b/crypto/external/bsd/heimdal/dist/lib/krb5/warn.c
index a8fbdeb56..1e532e580 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/warn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/warn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: warn.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: warn.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -38,7 +38,7 @@
 
 static krb5_error_code _warnerr(krb5_context context, int do_errtext,
 	 krb5_error_code code, int level, const char *fmt, va_list ap)
-	__attribute__((__format__(__printf__, 5, 0)));
+	__attribute__ ((__format__ (__printf__, 5, 0)));
 
 static krb5_error_code
 _warnerr(krb5_context context, int do_errtext,
@@ -88,6 +88,12 @@ _warnerr(krb5_context context, int do_errtext,
     ret = _warnerr(context, ETEXT, CODE, LEVEL, fmt, ap); 		\
     va_end(ap);
 
+#define FUNC_NORET(ETEXT, CODE, LEVEL)					\
+    va_list ap;								\
+    va_start(ap, fmt);							\
+    (void) _warnerr(context, ETEXT, CODE, LEVEL, fmt, ap); 		\
+    va_end(ap);
+
 #undef __attribute__
 #define __attribute__(X)
 
@@ -106,7 +112,7 @@ _warnerr(krb5_context context, int do_errtext,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vwarn(krb5_context context, krb5_error_code code,
 	   const char *fmt, va_list ap)
-     __attribute__ ((format (printf, 3, 0)))
+     __attribute__ ((__format__ (__printf__, 3, 0)))
 {
     return _warnerr(context, 1, code, 1, fmt, ap);
 }
@@ -124,7 +130,7 @@ krb5_vwarn(krb5_context context, krb5_error_code code,
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_warn(krb5_context context, krb5_error_code code, const char *fmt, ...)
-     __attribute__ ((format (printf, 3, 4)))
+     __attribute__ ((__format__ (__printf__, 3, 4)))
 {
     FUNC(1, code, 1);
     return ret;
@@ -142,7 +148,7 @@ krb5_warn(krb5_context context, krb5_error_code code, const char *fmt, ...)
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vwarnx(krb5_context context, const char *fmt, va_list ap)
-     __attribute__ ((format (printf, 2, 0)))
+     __attribute__ ((__format__ (__printf__, 2, 0)))
 {
     return _warnerr(context, 0, 0, 1, fmt, ap);
 }
@@ -158,7 +164,7 @@ krb5_vwarnx(krb5_context context, const char *fmt, va_list ap)
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_warnx(krb5_context context, const char *fmt, ...)
-     __attribute__ ((format (printf, 2, 3)))
+     __attribute__ ((__format__ (__printf__, 2, 3)))
 {
     FUNC(0, 0, 1);
     return ret;
@@ -180,7 +186,7 @@ krb5_warnx(krb5_context context, const char *fmt, ...)
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verr(krb5_context context, int eval, krb5_error_code code,
 	  const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 4, 0)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 4, 0)))
 {
     _warnerr(context, 1, code, 0, fmt, ap);
     exit(eval);
@@ -202,9 +208,9 @@ krb5_verr(krb5_context context, int eval, krb5_error_code code,
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_err(krb5_context context, int eval, krb5_error_code code,
 	 const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 4, 5)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 4, 5)))
 {
-    FUNC(1, code, 0);
+    FUNC_NORET(1, code, 0);
     exit(eval);
     UNREACHABLE(return 0);
 }
@@ -222,7 +228,7 @@ krb5_err(krb5_context context, int eval, krb5_error_code code,
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verrx(krb5_context context, int eval, const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 3, 0)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 0)))
 {
     _warnerr(context, 0, 0, 0, fmt, ap);
     exit(eval);
@@ -241,9 +247,9 @@ krb5_verrx(krb5_context context, int eval, const char *fmt, va_list ap)
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_errx(krb5_context context, int eval, const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 3, 4)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 4)))
 {
-    FUNC(0, 0, 0);
+    FUNC_NORET(0, 0, 0);
     exit(eval);
     UNREACHABLE(return 0);
 }
@@ -263,7 +269,7 @@ krb5_errx(krb5_context context, int eval, const char *fmt, ...)
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vabort(krb5_context context, krb5_error_code code,
 	    const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 3, 0)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 0)))
 {
     _warnerr(context, 1, code, 0, fmt, ap);
     abort();
@@ -277,22 +283,23 @@ krb5_vabort(krb5_context context, krb5_error_code code,
  * @param context A Kerberos 5 context
  * @param code error code of the last error
  * @param fmt message to print
+ * @param ... arguments for format string
  *
  * @ingroup krb5_error
  */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_abort(krb5_context context, krb5_error_code code, const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 3, 4)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 4)))
 {
-    FUNC(1, code, 0);
+    FUNC_NORET(1, code, 0);
     abort();
     UNREACHABLE(return 0);
 }
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vabortx(krb5_context context, const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 2, 0)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 0)))
 {
     _warnerr(context, 0, 0, 0, fmt, ap);
     abort();
@@ -303,17 +310,17 @@ krb5_vabortx(krb5_context context, const char *fmt, va_list ap)
  * Log a warning to the log, default stderr, and then abort.
  *
  * @param context A Kerberos 5 context
- * @param code error code of the last error
- * @param fmt message to print
+ * @param fmt printf format string of message to print
+ * @param ... arguments for format string
  *
  * @ingroup krb5_error
  */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_abortx(krb5_context context, const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 2, 3)))
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 3)))
 {
-    FUNC(0, 0, 0);
+    FUNC_NORET(0, 0, 0);
     abort();
     UNREACHABLE(return 0);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/write_message.c b/crypto/external/bsd/heimdal/dist/lib/krb5/write_message.c
index 628ed1bba..cccabb849 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/write_message.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/write_message.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: write_message.c,v 1.1.1.1 2011/04/13 18:15:39 elric Exp $	*/
+/*	$NetBSD: write_message.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/ntlm/Makefile.am
index f1429a907..9a4200bc7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/Makefile.am
@@ -2,11 +2,9 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_hcrypto)
-
 lib_LTLIBRARIES = libheimntlm.la
 
-dist_include_HEADERS = heimntlm.h heimntlm-protos.h
+dist_include_HEADERS = heimntlm.h $(srcdir)/heimntlm-protos.h
 
 nodist_include_HEADERS = ntlm_err.h
 
@@ -23,10 +21,11 @@ $(libheimntlm_la_OBJECTS): $(srcdir)/version-script.map
 
 libheimntlm_la_LIBADD = \
 	../krb5/libkrb5.la \
+	$(top_builddir)/lib/wind/libwind.la \
 	$(LIB_hcrypto) \
 	$(LIBADD_roken)
 
-$(srcdir)/heimntlm-protos.h:
+$(srcdir)/heimntlm-protos.h: $(dist_libheimntlm_la_SOURCES)
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -o heimntlm-protos.h $(dist_libheimntlm_la_SOURCES) || rm -f heimntlm-protos.h
 
 $(libheimntlm_la_OBJECTS): $(srcdir)/heimntlm-protos.h ntlm_err.h
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/ntlm/NTMakefile
index 40ed64449..527fc8912 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/NTMakefile
@@ -75,7 +75,7 @@ test-binaries: $(OBJ)\test_ntlm.exe
 
 test-run:
 	cd $(OBJ)
-	test_ntlm.exe
+	-test_ntlm.exe
 	cd $(SRCDIR)
 
 $(OBJ)\test_ntlm.exe: $(OBJ)\test_ntlm.obj $(LIBHEIMNTLM) $(LIBHEIMDAL) $(LIBVERS) $(LIBROKEN)
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/apop.c b/crypto/external/bsd/heimdal/dist/lib/ntlm/apop.c
index f8446a011..784cb67e9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/apop.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/apop.c
@@ -1,38 +1,38 @@
-/*	$NetBSD: apop.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: apop.c,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
 
 /*
  * Copyright (c) 2010 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
  *
  * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
  *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
  *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
  *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
  *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
  */
 
 #include <sys/types.h>
@@ -57,9 +57,9 @@ heim_generate_challenge(const char *hostname)
 	hostname = host;
     }
 
-    t = time(NULL);
+    t = (uint32_t)time(NULL);
     num = rk_random();
-
+    
     asprintf(&str, "<%lu%lu@%s>", (unsigned long)t,
 	     (unsigned long)num, hostname);
 
@@ -74,8 +74,8 @@ heim_apop_create(const char *challenge, const char *password)
     CC_MD5_CTX ctx;
 
     CC_MD5_Init(&ctx);
-    CC_MD5_Update(&ctx, challenge, strlen(challenge));
-    CC_MD5_Update(&ctx, password, strlen(password));
+    CC_MD5_Update(&ctx, challenge, (CC_LONG)strlen(challenge));
+    CC_MD5_Update(&ctx, password, (CC_LONG)strlen(password));
 
     CC_MD5_Final(hash, &ctx);
 
@@ -104,7 +104,7 @@ heim_apop_verify(const char *challenge, const char *password, const char *respon
     return 0;
 }
 
-struct heim_cram_md5 {
+struct heim_cram_md5_data {
     CC_MD5_CTX ipad;
     CC_MD5_CTX opad;
 };
@@ -116,13 +116,13 @@ heim_cram_md5_export(const char *password, heim_CRAM_MD5_STATE *state)
     size_t keylen = strlen(password);
     uint8_t key[CC_MD5_BLOCK_BYTES];
     uint8_t pad[CC_MD5_BLOCK_BYTES];
-    struct heim_cram_md5 ctx;
+    struct heim_cram_md5_data ctx;
     size_t n;
 
     memset(&ctx, 0, sizeof(ctx));
 
     if (keylen > CC_MD5_BLOCK_BYTES) {
-	CC_MD5(password, keylen, key);
+	CC_MD5(password, (CC_LONG)keylen, key);
 	keylen = sizeof(keylen);
     } else {
 	memcpy(key, password, keylen);
@@ -165,8 +165,7 @@ heim_cram_md5_import(void *data, size_t len)
 {
     heim_CRAM_MD5_STATE state;
     heim_cram_md5 ctx;
-    unsigned n;
-
+    
     if (len != sizeof(state))
 	return NULL;
 
@@ -200,7 +199,7 @@ heim_cram_md5_verify_ctx(heim_cram_md5 ctx, const char *challenge, const char *r
     char *str = NULL;
     int res;
 
-    CC_MD5_Update(&ctx->ipad, challenge, strlen(challenge));
+    CC_MD5_Update(&ctx->ipad, challenge, (CC_LONG)strlen(challenge));
     CC_MD5_Final(hash, &ctx->ipad);
 
     CC_MD5_Update(&ctx->opad, hash, sizeof(hash));
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/digest.c b/crypto/external/bsd/heimdal/dist/lib/ntlm/digest.c
index e9f951ebb..239f2de98 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/digest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/digest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: digest.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: digest.c,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -47,7 +47,11 @@
 #include <krb5/ntlm_err.h>
 
 struct heim_digest_desc {
-    int server;
+#define F_SERVER	1
+#define F_HAVE_HASH	2
+#define F_HAVE_HA1	4
+#define F_USE_PREFIX	8
+    int flags;
     int type;
     char *password;
     uint8_t SecretHash[CC_MD5_DIGEST_LENGTH];
@@ -55,6 +59,8 @@ struct heim_digest_desc {
     char *serverRealm;
     char *serverQOP;
     char *serverMethod;
+    char *serverMaxbuf;
+    char *serverOpaque;
     char *clientUsername;
     char *clientResponse;
     char *clientURI;
@@ -64,20 +70,30 @@ struct heim_digest_desc {
     char *clientNC;
     char *serverAlgorithm;
     char *auth_id;
+    
+    /* internally allocated objects returned to caller */
+    char *serverChallenge;
+    char *clientReply;
+    char *serverReply;
 };
 
 #define FREE_AND_CLEAR(x) do { if ((x)) { free((x)); (x) = NULL; } } while(0)
 #define MEMSET_FREE_AND_CLEAR(x) do { if ((x)) { memset(x, 0, strlen(x)); free((x)); (x) = NULL; } } while(0)
 
+static const char digest_prefix[] = "Digest ";
+
 static void
 clear_context(heim_digest_t context)
 {
     MEMSET_FREE_AND_CLEAR(context->password);
     memset(context->SecretHash, 0, sizeof(context->SecretHash));
+    context->flags &= ~(F_HAVE_HASH);
     FREE_AND_CLEAR(context->serverNonce);
     FREE_AND_CLEAR(context->serverRealm);
     FREE_AND_CLEAR(context->serverQOP);
     FREE_AND_CLEAR(context->serverMethod);
+    FREE_AND_CLEAR(context->serverMaxbuf);
+    FREE_AND_CLEAR(context->serverOpaque);
     FREE_AND_CLEAR(context->clientUsername);
     FREE_AND_CLEAR(context->clientResponse);
     FREE_AND_CLEAR(context->clientURI);
@@ -87,40 +103,66 @@ clear_context(heim_digest_t context)
     FREE_AND_CLEAR(context->clientNC);
     FREE_AND_CLEAR(context->serverAlgorithm);
     FREE_AND_CLEAR(context->auth_id);
+    
+    FREE_AND_CLEAR(context->serverChallenge);
+    FREE_AND_CLEAR(context->clientReply);
+    FREE_AND_CLEAR(context->serverReply);
+}
+
+static void
+digest_userhash(const char *user, const char *realm, const char *password,
+		unsigned char md[CC_MD5_DIGEST_LENGTH])
+{
+    CC_MD5_CTX ctx;
+
+    CC_MD5_Init(&ctx);
+    CC_MD5_Update(&ctx, user, (CC_LONG)strlen(user));
+    CC_MD5_Update(&ctx, ":", 1);
+    CC_MD5_Update(&ctx, realm, (CC_LONG)strlen(realm));
+    CC_MD5_Update(&ctx, ":", 1);
+    CC_MD5_Update(&ctx, password, (CC_LONG)strlen(password));
+    CC_MD5_Final(md, &ctx);
 }
 
 static char *
-build_A1_hash(int type,
-	      const char *username, const char *password,
-	      const char *realm, const char *serverNonce,
-	      const char *clientNonce,
-	      const char *auth_id)
+build_A1_hash(heim_digest_t context)
 {
     unsigned char md[CC_MD5_DIGEST_LENGTH];
     CC_MD5_CTX ctx;
     char *A1;
 
-    CC_MD5_Init(&ctx);
-    CC_MD5_Update(&ctx, username, strlen(username));
-    CC_MD5_Update(&ctx, ":", 1);
-    CC_MD5_Update(&ctx, realm, strlen(realm));
-    CC_MD5_Update(&ctx, ":", 1);
-    CC_MD5_Update(&ctx, password, strlen(password));
-    CC_MD5_Final(md, &ctx);
+    if (context->flags & F_HAVE_HA1) {
+	memcpy(md, context->SecretHash, sizeof(md));
+    } else if (context->flags & F_HAVE_HASH) {
+	memcpy(md, context->SecretHash, sizeof(md));
+    } else if (context->password) {
+	if (context->clientUsername == NULL)
+	    return NULL;
+	if (context->serverRealm == NULL)
+	    return NULL;
+	digest_userhash(context->clientUsername,
+			context->serverRealm,
+			context->password,
+			md);
+    } else
+	return NULL;
+    
+    if ((context->type == HEIM_DIGEST_TYPE_RFC2617_MD5_SESS || context->type == HEIM_DIGEST_TYPE_RFC2831) && (context->flags & F_HAVE_HA1) == 0) {
+	if (context->serverNonce == NULL)
+	    return NULL;
 
-    if (type != HEIM_DIGEST_TYPE_RFC2069) {
 	CC_MD5_Init(&ctx);
 	CC_MD5_Update(&ctx, md, sizeof(md));
 	memset(md, 0, sizeof(md));
 	CC_MD5_Update(&ctx, ":", 1);
-	CC_MD5_Update(&ctx, serverNonce, strlen(serverNonce));
-	if (clientNonce) {
+	CC_MD5_Update(&ctx, context->serverNonce, (CC_LONG)strlen(context->serverNonce));
+	if (context->clientNonce) {
 	    CC_MD5_Update(&ctx, ":", 1);
-	    CC_MD5_Update(&ctx, clientNonce, strlen(clientNonce));
+	    CC_MD5_Update(&ctx, context->clientNonce, (CC_LONG)strlen(context->clientNonce));
 	}
-	if (auth_id) {
+	if (context->type == HEIM_DIGEST_TYPE_RFC2831 && context->auth_id) {
 	    CC_MD5_Update(&ctx, ":", 1);
-	    CC_MD5_Update(&ctx, auth_id, strlen(auth_id));
+	    CC_MD5_Update(&ctx, context->auth_id, (CC_LONG)strlen(context->auth_id));
 	}
 	CC_MD5_Final(md, &ctx);
     }
@@ -137,24 +179,26 @@ build_A2_hash(heim_digest_t context, const char *method)
     unsigned char md[CC_MD5_DIGEST_LENGTH];
     CC_MD5_CTX ctx;
     char *A2;
-
+  
     CC_MD5_Init(&ctx);
     if (method)
-	CC_MD5_Update(&ctx, method, strlen(method));
+	CC_MD5_Update(&ctx, method, (CC_LONG)strlen(method));
     CC_MD5_Update(&ctx, ":", 1);
-    CC_MD5_Update(&ctx, context->clientURI, strlen(context->clientURI));
-
+    CC_MD5_Update(&ctx, context->clientURI, (CC_LONG)strlen(context->clientURI));
+	
     /* conf|int */
-    if (context->type != HEIM_DIGEST_TYPE_RFC2069) {
-	if (strcmp(context->clientQOP, "auth") != 0) {
+    if (context->type == HEIM_DIGEST_TYPE_RFC2831) {
+	if (strcasecmp(context->clientQOP, "auth-int") == 0 || strcasecmp(context->clientQOP, "auth-conf") == 0) {
 	    /* XXX if we have a body hash, use that */
 	    static char conf_zeros[] = ":00000000000000000000000000000000";
 	    CC_MD5_Update(&ctx, conf_zeros, sizeof(conf_zeros) - 1);
 	}
     } else {
 	/* support auth-int ? */
+	if (context->clientQOP && strcasecmp(context->clientQOP, "auth") != 0)
+	    return NULL;
     }
-
+	
     CC_MD5_Final(md, &ctx);
 
     hex_encode(md, sizeof(md), &A2);
@@ -196,7 +240,7 @@ free_values(struct md5_value *val)
 static char *
 values_find(struct md5_value **val, const char *v)
 {
-    struct md5_value *cur = *val;
+    struct md5_value *cur;
     char *str;
 
     while (*val != NULL) {
@@ -267,7 +311,7 @@ parse_values(const char *string, struct md5_value **val)
 	    goto error;
 	p2 += sz;
 	p1 = p2;
-
+		
 	if (*p2 == '"') {
 	    p1++;
 	    while (*p2 == '"') {
@@ -294,7 +338,7 @@ parse_values(const char *string, struct md5_value **val)
 	    goto nomem;
 	strncpy(v->mv_value, p1, p2 - p1);
 	v->mv_value[p2 - p1] = '\0';
-
+		
 	if (p2[0] == '\0')
 	    break;
 	if (p2[0] == '"')
@@ -327,6 +371,24 @@ parse_values(const char *string, struct md5_value **val)
     return ENOMEM;
 }
 
+/*
+ *
+ */
+
+static const char *
+check_prefix(heim_digest_t context, const char *challenge)
+{
+    if (strncasecmp(digest_prefix, challenge, sizeof(digest_prefix) - 1) == 0) {
+	
+	challenge += sizeof(digest_prefix) - 1;
+	while (*challenge == 0x20) /* remove extra space */
+	    challenge++;
+	context->flags |= F_USE_PREFIX;
+    }
+
+    return challenge;
+}
+
 /*
  *
  */
@@ -339,16 +401,89 @@ heim_digest_create(int server, int type)
     context = calloc(1, sizeof(*context));
     if (context == NULL)
 	return NULL;
-    context->server = server;
+    context->flags |= F_SERVER;
     context->type = type;
 
     return context;
 }
 
+static char *
+generate_nonce(void)
+{
+    uint8_t rand[8];
+    char *nonce;
+    
+    if (CCRandomCopyBytes(kCCRandomDefault, rand, sizeof(rand)) != kCCSuccess)
+	return NULL;
+    
+    if (rk_hex_encode(rand, sizeof(rand), &nonce) < 0)
+	return NULL;
+
+    return nonce;
+}
+
+/**
+ * Generate a challange, needs to set serverRealm before calling this function.
+ *
+ * If type is set to HEIM_DIGEST_TYPE_AUTO, the HEIM_DIGEST_TYPE_RFC2831 will be used instead.
+ *
+ * For RFC2617 and RFC2831 QOP is required, so if any qop other then "auth" is requested, it need to be set with heim_diest_set_key().
+ *
+ * @return returns the challenge or NULL on error or failure to build the string. the lifetime
+ *         of the string is manage by heim_digest and last until the the context is
+ *         freed or until next call to heim_digest_generate_challenge().
+ */
+
 const char *
 heim_digest_generate_challenge(heim_digest_t context)
 {
-    return NULL;
+    char *challenge = NULL;
+    
+    if (context->serverRealm == NULL)
+	return NULL;
+    
+    if (context->serverNonce == NULL) {
+	if ((context->serverNonce = generate_nonce()) == NULL)
+	    return NULL;
+    }
+    
+    if (context->serverQOP == NULL) {
+	if ((context->serverQOP = strdup("auth")) == NULL)
+	    return NULL;
+    }
+    
+    if (context->serverMaxbuf == NULL) {
+	if ((context->serverMaxbuf = strdup("65536")) == NULL)
+	    return NULL;
+    }
+
+    switch(context->type) {
+	case HEIM_DIGEST_TYPE_RFC2617_MD5:
+	    asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",algorithm=md5,qop=\"%s\"",
+		     context->serverRealm, context->serverNonce,
+		     context->serverQOP);
+	    break;
+	case HEIM_DIGEST_TYPE_RFC2617_MD5_SESS:
+	    asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",algorithm=md5-sess,qop=\"%s\"",
+		     context->serverRealm, context->serverNonce, context->serverQOP);
+	    break;
+	case HEIM_DIGEST_TYPE_RFC2069:
+	    asprintf(&challenge, "realm=\"%s\",nonce=\"%s\"",
+		     context->serverRealm, context->serverNonce);
+	    break;
+	case HEIM_DIGEST_TYPE_AUTO:
+	    context->type = HEIM_DIGEST_TYPE_RFC2831;
+	    /* FALL THOUGH */
+	case HEIM_DIGEST_TYPE_RFC2831:
+	    asprintf(&challenge, "realm=\"%s\",nonce=\"%s\",qop=\"%s\",algorithm=md5-sess,charset=utf-8,maxbuf=%s",
+		     context->serverRealm, context->serverNonce, context->serverQOP, context->serverMaxbuf);
+	    break;
+    }
+
+    FREE_AND_CLEAR(context->serverChallenge);
+    context->serverChallenge = challenge;
+    
+    return challenge;
 }
 
 int
@@ -356,6 +491,8 @@ heim_digest_parse_challenge(heim_digest_t context, const char *challenge)
 {
     struct md5_value *val = NULL;
     int ret, type;
+    
+    challenge = check_prefix(context, challenge);
 
     ret = parse_values(challenge, &val);
     if (ret)
@@ -369,29 +506,28 @@ heim_digest_parse_challenge(heim_digest_t context, const char *challenge)
     context->serverRealm = values_find(&val, "realm");
     if (context->serverRealm == NULL) goto out;
 
-    context->serverQOP = values_find(&val, "qop");
-    if (context->serverQOP == NULL)
-	context->serverQOP = strdup("auth");
-    if (context->serverQOP == NULL) goto out;
-
     /* check alg */
 
     context->serverAlgorithm = values_find(&val, "algorithm");
     if (context->serverAlgorithm == NULL || strcasecmp(context->serverAlgorithm, "md5") == 0) {
-	type = HEIM_DIGEST_TYPE_RFC2069;
+	type = HEIM_DIGEST_TYPE_RFC2617_MD5;
     } else if (strcasecmp(context->serverAlgorithm, "md5-sess") == 0) {
-	type = HEIM_DIGEST_TYPE_MD5_SESS;
+	type = HEIM_DIGEST_TYPE_RFC2617_OR_RFC2831;
     } else {
 	goto out;
     }
 
-    if (context->type != HEIM_DIGEST_TYPE_AUTO && context->type != type)
+    context->serverQOP = values_find(&val, "qop");
+    if (context->serverQOP == NULL)
+	type = HEIM_DIGEST_TYPE_RFC2069;
+    
+    context->serverOpaque = values_find(&val, "opaque");
+
+    if (context->type != HEIM_DIGEST_TYPE_AUTO && (context->type & type) == 0)
 	goto out;
-    else
+    else if (context->type == HEIM_DIGEST_TYPE_AUTO)
 	context->type = type;
 
-
-
     ret = 0;
  out:
     free_values(val);
@@ -400,6 +536,19 @@ heim_digest_parse_challenge(heim_digest_t context, const char *challenge)
     return ret;
 }
 
+
+static void
+set_auth_method(heim_digest_t context)
+{
+    
+    if (context->serverMethod == NULL) {
+	if (context->type == HEIM_DIGEST_TYPE_RFC2831)
+	    context->serverMethod = strdup("AUTHENTICATE");
+	else
+	    context->serverMethod = strdup("GET");
+    }
+}
+
 int
 heim_digest_parse_response(heim_digest_t context, const char *response)
 {
@@ -407,20 +556,41 @@ heim_digest_parse_response(heim_digest_t context, const char *response)
     char *nonce;
     int ret;
 
+    response = check_prefix(context, response);
+
     ret = parse_values(response, &val);
     if (ret)
 	goto out;
 
     ret = 1;
 
-    if (context->type == HEIM_DIGEST_TYPE_AUTO)
+    if (context->type == HEIM_DIGEST_TYPE_AUTO) {
 	goto out;
+    } else if (context->type == HEIM_DIGEST_TYPE_RFC2617_OR_RFC2831) {
+	context->clientURI = values_find(&val, "uri");
+	if (context->clientURI) {
+	    context->type = HEIM_DIGEST_TYPE_RFC2617_MD5_SESS;
+	} else {
+	    context->clientURI = values_find(&val, "digest-uri");
+	    context->type = HEIM_DIGEST_TYPE_RFC2831;
+	}
+    } else if (context->type == HEIM_DIGEST_TYPE_RFC2831) {
+	context->clientURI = values_find(&val, "digest-uri");
+    } else {
+	context->clientURI = values_find(&val, "uri");
+    }
+
+    if (context->clientURI == NULL)
+        goto out;
 
     context->clientUsername = values_find(&val, "username");
     if (context->clientUsername == NULL) goto out;
 
+    /* if client sent realm, make sure its the same of serverRealm if its set */
     context->clientRealm = values_find(&val, "realm");
-
+    if (context->clientRealm && context->serverRealm && strcmp(context->clientRealm, context->serverRealm) != 0)
+	goto out;
+    
     context->clientResponse = values_find(&val, "response");
     if (context->clientResponse == NULL) goto out;
 
@@ -433,13 +603,38 @@ heim_digest_parse_response(heim_digest_t context, const char *response)
     }
     free(nonce);
 
-    context->clientQOP = values_find(&val, "qop");
-    if (context->clientQOP == NULL)
-	context->clientQOP = strdup("auth");
-    if (context->clientQOP == NULL) goto out;
-
-
     if (context->type != HEIM_DIGEST_TYPE_RFC2069) {
+
+	context->clientQOP = values_find(&val, "qop");
+	if (context->clientQOP == NULL) goto out;
+	
+	/*
+	 * If we have serverQOP, lets check that clientQOP exists
+	 * in the list of server entries.
+	 */
+	
+	if (context->serverQOP) {
+	    Boolean found = false;
+	    char *b, *e;
+	    size_t len, clen = strlen(context->clientQOP);
+	    
+	    b = context->serverQOP;
+	    while (b && !found) {
+		e = strchr(b, ',');
+		if (e == NULL)
+		    len = strlen(b);
+		else {
+		    len = e - b;
+		    e += 1;
+		}
+		if (clen == len && strncmp(b, context->clientQOP, len) == 0)
+		    found = true;
+		b = e;
+	    }
+	    if (!found)
+		goto out;
+	}
+
 	context->clientNC = values_find(&val, "nc");
 	if (context->clientNC == NULL) goto out;
 
@@ -447,11 +642,7 @@ heim_digest_parse_response(heim_digest_t context, const char *response)
 	if (context->clientNonce == NULL) goto out;
     }
 
-    if (context->type == HEIM_DIGEST_TYPE_RFC2069)
-	context->clientURI = values_find(&val, "uri");
-    else
-	context->clientURI = values_find(&val, "digest-uri");
-    if (context->clientURI == NULL) goto out;
+    set_auth_method(context);
 
     ret = 0;
  out:
@@ -459,33 +650,18 @@ heim_digest_parse_response(heim_digest_t context, const char *response)
     return ret;
 }
 
-const char *
-heim_digest_get_key(heim_digest_t context, const char *key)
+char *
+heim_digest_userhash(const char *user, const char *realm, const char *password)
 {
-    if (strcmp(key, "username") == 0) {
-        return context->clientUsername;
-    } else if (strcmp(key, "realm") == 0) {
-        return context->clientRealm;
-    } else {
-	return NULL;
-    }
-}
+    unsigned char md[CC_MD5_DIGEST_LENGTH];
+    char *str = NULL;
 
-int
-heim_digest_set_key(heim_digest_t context, const char *key, const char *value)
-{
-    if (strcmp(key, "password") == 0) {
-	FREE_AND_CLEAR(context->password);
-	if ((context->password = strdup(value)) == NULL)
-	    return ENOMEM;
-    } else if (strcmp(key, "method") == 0) {
-	FREE_AND_CLEAR(context->serverMethod);
-	if ((context->serverMethod = strdup(value)) != NULL)
-	    return ENOMEM;
-    } else {
-	return EINVAL;
-    }
-    return 0;
+    digest_userhash(user, realm, password, md);
+
+    hex_encode(md, sizeof(md), &str);
+    if (str)
+      strlwr(str);
+    return str;
 }
 
 static char *
@@ -500,19 +676,19 @@ build_digest(heim_digest_t context, const char *a1, const char *method)
       return NULL;
 
     CC_MD5_Init(&ctx);
-    CC_MD5_Update(&ctx, a1, strlen(a1));
+    CC_MD5_Update(&ctx, a1, (CC_LONG)strlen(a1));
     CC_MD5_Update(&ctx, ":", 1);
-    CC_MD5_Update(&ctx, context->serverNonce, strlen(context->serverNonce));
+    CC_MD5_Update(&ctx, context->serverNonce, (CC_LONG)strlen(context->serverNonce));
     if (context->type != HEIM_DIGEST_TYPE_RFC2069) {
 	CC_MD5_Update(&ctx, ":", 1);
-	CC_MD5_Update(&ctx, context->clientNC, strlen(context->clientNC));
+	CC_MD5_Update(&ctx, context->clientNC, (CC_LONG)strlen(context->clientNC));
 	CC_MD5_Update(&ctx, ":", 1);
-	CC_MD5_Update(&ctx, context->clientNonce, strlen(context->clientNonce));
+	CC_MD5_Update(&ctx, context->clientNonce, (CC_LONG)strlen(context->clientNonce));
 	CC_MD5_Update(&ctx, ":", 1);
-	CC_MD5_Update(&ctx, context->clientQOP, strlen(context->clientQOP));
+	CC_MD5_Update(&ctx, context->clientQOP, (CC_LONG)strlen(context->clientQOP));
     }
     CC_MD5_Update(&ctx, ":", 1);
-    CC_MD5_Update(&ctx, a2, strlen(a2));
+    CC_MD5_Update(&ctx, a2, (CC_LONG)strlen(a2));
     CC_MD5_Final(md, &ctx);
 
     free(a2);
@@ -524,35 +700,146 @@ build_digest(heim_digest_t context, const char *a1, const char *method)
     return str;
 }
 
-const char *
-heim_digest_create_response(heim_digest_t context)
+static void
+build_server_response(heim_digest_t context, char *a1, char **response)
 {
-    return NULL;
+    char *str;
+    
+    str = build_digest(context, a1, NULL);
+    if (str == NULL)
+	return;
+    
+    FREE_AND_CLEAR(context->serverReply);
+    asprintf(&context->serverReply, "%srspauth=%s",
+	     (context->flags & F_USE_PREFIX) ? digest_prefix : "",
+	     str);
+    free(str);
+    if (response)
+	*response = context->serverReply;
+}
+
+
+/**
+ * Create response from server to client to server, server verification is in response.
+ * clientUsername and clientURI have to be given.
+ * If realm is not set, its used from server.
+ */
+
+const char *
+heim_digest_create_response(heim_digest_t context, char **response)
+{
+    char *a1, *str, *cnonce = NULL, *opaque = NULL, *uri = NULL, *nc = NULL;
+    
+    if (response)
+	*response = NULL;
+    
+    if (context->clientUsername == NULL || context->clientURI == NULL)
+	return NULL;
+    
+    if (context->clientRealm == NULL) {
+	if (context->serverRealm == NULL)
+	    return NULL;
+	if ((context->clientRealm = strdup(context->serverRealm)) == NULL)
+	    return NULL;
+    }
+    
+    if (context->type != HEIM_DIGEST_TYPE_RFC2069) {
+	if (context->clientNC == NULL) {
+	    if ((context->clientNC = strdup("00000001")) == NULL)
+		return NULL;
+	}
+	if (context->clientNonce == NULL) {
+	    if ((context->clientNonce = generate_nonce()) == NULL)
+		return NULL;
+	}
+
+	/**
+	 * If using non RFC2069, appropriate QOP should be set.
+	 *
+	 * Pick QOP from server if not given, if its a list, pick the first entry
+	 */
+	if (context->clientQOP == NULL) {
+	    char *r;
+	    if (context->serverQOP == NULL)
+		return NULL;
+	    r = strchr(context->serverQOP, ',');
+	    if (r == NULL) {
+		if ((context->clientQOP = strdup(context->serverQOP)) == NULL)
+			return NULL;
+	    } else {
+		size_t len = (r - context->serverQOP) + 1;
+		if ((context->clientQOP = malloc(len)) == NULL)
+		    return NULL;
+		strlcpy(context->clientQOP, context->serverQOP, len);
+	    }
+	}
+    }
+	    
+    set_auth_method(context);
+    
+    a1 = build_A1_hash(context);
+    if (a1 == NULL)
+	return NULL;
+    
+    str = build_digest(context, a1, context->serverMethod);
+    if (str == NULL) {
+	MEMSET_FREE_AND_CLEAR(a1);
+	return NULL;
+    }
+    
+    MEMSET_FREE_AND_CLEAR(context->clientResponse);
+    context->clientResponse = str;
+    
+    if (context->clientURI) {
+	const char *name = "digest-uri";
+	if (context->type != HEIM_DIGEST_TYPE_RFC2831)
+	    name = "uri";
+	asprintf(&uri, ",%s=\"%s\"", name, context->clientURI);
+    }
+    
+    if (context->serverOpaque)
+	asprintf(&opaque, ",opaque=\"%s\"", context->serverOpaque);
+    
+    if (context->clientNonce)
+	asprintf(&cnonce, ",cnonce=\"%s\"", context->clientNonce);
+
+    if (context->clientNC)
+	asprintf(&nc, ",nc=%s", context->clientNC);
+    
+    asprintf(&context->clientReply,
+	     "username=%s,realm=%s,nonce=\"%s\",qop=\"%s\"%s%s%s,response=\"%s\"%s",
+	     context->clientUsername, context->clientRealm,
+	     context->serverNonce,
+	     context->clientQOP,
+	     uri ? uri : "",
+	     cnonce ? cnonce : "",
+	     nc ? nc : "",
+	     context->clientResponse,
+	     opaque ? opaque : "");
+    
+    build_server_response(context, a1, response);
+    MEMSET_FREE_AND_CLEAR(a1);
+    FREE_AND_CLEAR(uri);
+    FREE_AND_CLEAR(opaque);
+    FREE_AND_CLEAR(cnonce);
+    FREE_AND_CLEAR(nc);
+    
+    return context->clientReply;
 }
 
 int
 heim_digest_verify(heim_digest_t context, char **response)
 {
-    CC_MD5_CTX ctx;
-    char *a1, *a2;
-    uint8_t md[CC_MD5_DIGEST_LENGTH];
+    char *a1;
     char *str;
     int res;
 
     if (response)
 	*response = NULL;
+    
+    set_auth_method(context);
 
-    if (context->serverMethod == NULL) {
-	if (context->type != HEIM_DIGEST_TYPE_RFC2069)
-	    context->serverMethod = strdup("AUTHENTICATE");
-	else
-	    context->serverMethod = strdup("GET");
-    }
-
-    a1 = build_A1_hash(context->type,
-		       context->clientUsername, context->password,
-		       context->serverRealm, context->serverNonce,
-		       context->clientNonce, context->auth_id);
+    a1 = build_A1_hash(context);
     if (a1 == NULL)
       return ENOMEM;
 
@@ -570,21 +857,42 @@ heim_digest_verify(heim_digest_t context, char **response)
     }
 
     /* build server_response */
-    if (response) {
-	str = build_digest(context, a1, NULL);
-	if (str == NULL) {
-	    MEMSET_FREE_AND_CLEAR(a1);
-	    return ENOMEM;
-	}
-
-	asprintf(response, "rspauth=%s", str);
-	free(str);
-    }
+    build_server_response(context, a1, response);
     MEMSET_FREE_AND_CLEAR(a1);
+    /* XXX break ABI and return internally allocated string instead */
+    if (response)
+	*response = strdup(*response);
 
     return 0;
 }
 
+/**
+ * Create a rspauth= response.
+ * Assumes that the A1hash/password serverNonce, clientNC, clientNonce, clientQOP is set.
+ *
+ * @return the rspauth string (including rspauth), return key are stored in serverReply and will be invalid after another call to heim_digest_*
+ */
+
+const char *
+heim_digest_server_response(heim_digest_t context)
+{
+    char *a1;
+    
+    if (context->serverNonce == NULL)
+	return NULL;
+    if (context->clientURI == NULL)
+	return NULL;
+
+    a1 = build_A1_hash(context);
+    if (a1 == NULL)
+	return NULL;
+    
+    build_server_response(context, a1, NULL);
+    MEMSET_FREE_AND_CLEAR(a1);
+    
+    return context->serverReply;
+}
+
 void
 heim_digest_get_session_key(heim_digest_t context, void **key, size_t *keySize)
 {
@@ -597,3 +905,92 @@ heim_digest_release(heim_digest_t context)
     free(context);
 }
 
+struct {
+    char *name;
+    size_t offset;
+} keys[] = {
+#define KVN(value) { #value, offsetof(struct heim_digest_desc, value) }
+    KVN(serverNonce),
+    KVN(serverRealm),
+    KVN(serverQOP),
+    KVN(serverMethod),
+    { "method", offsetof(struct heim_digest_desc, serverMethod) },
+    KVN(serverMaxbuf),
+    KVN(clientUsername),
+    { "username", offsetof(struct heim_digest_desc, clientUsername) },
+    KVN(clientResponse),
+    KVN(clientURI),
+    { "uri", offsetof(struct heim_digest_desc, clientURI) },
+    KVN(clientRealm),
+    { "realm", offsetof(struct heim_digest_desc, clientRealm) },
+    KVN(clientNonce),
+    KVN(clientQOP),
+    KVN(clientNC),
+    KVN(serverAlgorithm),
+    KVN(auth_id)
+#undef KVN
+};
+
+const char *
+heim_digest_get_key(heim_digest_t context, const char *key)
+{
+    size_t n;
+
+    for (n = 0; n < sizeof(keys) / sizeof(keys[0]); n++) {
+	if (strcasecmp(key, keys[n].name) == 0) {
+	    char **ptr = (char **)((((char *)context) + keys[n].offset));
+	    return *ptr;
+	}
+    }
+    return NULL;
+}
+
+int
+heim_digest_set_key(heim_digest_t context, const char *key, const char *value)
+{
+
+    if (strcmp(key, "password") == 0) {
+	FREE_AND_CLEAR(context->password);
+	if ((context->password = strdup(value)) == NULL)
+	    return ENOMEM;
+	context->flags &= ~(F_HAVE_HASH|F_HAVE_HA1);
+    } else if (strcmp(key, "userhash") == 0) {
+	ssize_t ret;
+	FREE_AND_CLEAR(context->password);
+
+	ret = hex_decode(value, context->SecretHash, sizeof(context->SecretHash));
+	if (ret != sizeof(context->SecretHash))
+	    return EINVAL;
+	context->flags &= ~F_HAVE_HA1;
+	context->flags |= F_HAVE_HASH;
+    } else if (strcmp(key, "H(A1)") == 0) {
+	ssize_t ret;
+	FREE_AND_CLEAR(context->password);
+	
+	ret = hex_decode(value, context->SecretHash, sizeof(context->SecretHash));
+	if (ret != sizeof(context->SecretHash))
+	    return EINVAL;
+	context->flags &= ~F_HAVE_HASH;
+	context->flags |= F_HAVE_HA1;
+    } else if (strcmp(key, "method") == 0) {
+	FREE_AND_CLEAR(context->serverMethod);
+	if ((context->serverMethod = strdup(value)) == NULL)
+	    return ENOMEM;
+    } else {
+	size_t n;
+
+	for (n = 0; n < sizeof(keys) / sizeof(keys[0]); n++) {
+	    if (strcasecmp(key, keys[n].name) == 0) {
+		char **ptr = (char **)((((char *)context) + keys[n].offset));
+		FREE_AND_CLEAR(*ptr);
+		if (((*ptr) = strdup(value)) == NULL)
+		    return ENOMEM;
+		break;
+	    }
+	}
+	if (n == sizeof(keys) / sizeof(keys[0]))
+	    return ENOENT;
+    }
+    return 0;
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/heim-auth.h b/crypto/external/bsd/heimdal/dist/lib/ntlm/heim-auth.h
index c8e47955b..3403e0ac3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/heim-auth.h
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/heim-auth.h
@@ -1,4 +1,9 @@
-/*	$NetBSD: heim-auth.h,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: heim-auth.h,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 
 /*
  * Generate challange for APOP and CRAM-MD5
@@ -26,7 +31,7 @@ typedef struct heim_HMAC_MD5_STATE_s {
     uint32_t ostate[4];
 } heim_CRAM_MD5_STATE;
 
-typedef struct heim_cram_md5 *heim_cram_md5;
+typedef struct heim_cram_md5_data *heim_cram_md5;
 
 char *
 heim_cram_md5_create(const char *challenge, const char *password);
@@ -58,7 +63,6 @@ heim_cram_md5_free(heim_cram_md5 ctx);
  * response = read_from_client();
  *
  * heim_digest_parse_response(d, response);
- *
  * const char *user = heim_digest_get_key(d, "username");
  * heim_digest_set_key(d, "password", "sommar17");
  *
@@ -76,8 +80,15 @@ heim_digest_create(int server, int type);
 
 #define HEIM_DIGEST_TYPE_AUTO				0
 #define HEIM_DIGEST_TYPE_RFC2069			1
+#define HEIM_DIGEST_TYPE_RFC2617_MD5			2
+#define HEIM_DIGEST_TYPE_RFC2617_MD5_SESS		4
+#define HEIM_DIGEST_TYPE_RFC2831			8
+
+#define HEIM_DIGEST_TYPE_RFC2617_OR_RFC2831		12
+
+/* old deprecated names, use the two above instead */
 #define HEIM_DIGEST_TYPE_MD5				2
-#define HEIM_DIGEST_TYPE_MD5_SESS			3
+#define HEIM_DIGEST_TYPE_MD5_SESS			4
 
 void
 heim_digest_init_set_key(heim_digest_t context, const char *key, const char *value);
@@ -107,10 +118,20 @@ int
 heim_digest_verify(heim_digest_t context, char **response);
 
 const char *
-heim_digest_create_response(heim_digest_t context);
+heim_digest_create_response(heim_digest_t context, char **response);
 
 void
 heim_digest_get_session_key(heim_digest_t context, void **key, size_t *keySize);
 
 void
 heim_digest_release(heim_digest_t context);
+
+char *
+heim_digest_userhash(const char *user, const char *realm, const char *password);
+
+const char *
+heim_digest_server_response(heim_digest_t context);
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/heimntlm.h b/crypto/external/bsd/heimdal/dist/lib/ntlm/heimntlm.h
index c14405216..2143b99c5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/heimntlm.h
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/heimntlm.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: heimntlm.h,v 1.1.1.2 2011/04/14 14:09:27 elric Exp $	*/
+/*	$NetBSD: heimntlm.h,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
@@ -72,8 +72,8 @@ struct ntlm_buf {
 #define NTLM_TARGET_DOMAIN		0x00010000
 #define NTLM_TARGET_SERVER		0x00020000
 
-#define NTLM_TARGET_SHARE		0x00040000
-#define NTLM_NEG_NTLM2_SESSION		0x00080000
+#define NTLM_TARGET_SHARE		0x00040000 /* mbz */
+#define NTLM_NEG_NTLM2_SESSION		0x00080000 /* EXTENDED_SESSIONSECURITY */
 #define NTLM_NEG_NTLM2			0x00080000
 
 #define NTLM_NEG_IDENTIFY		0x00100000
@@ -97,7 +97,9 @@ struct ntlm_buf {
  * heim_ntlm_free_targetinfo().
  */
 
+/* avflags */
 #define NTLM_TI_AV_FLAG_GUEST		0x00000001
+#define NTLM_TI_AV_FLAG_MIC		0x00000002
 
 struct ntlm_targetinfo {
     char *servername; /**< */
@@ -106,6 +108,9 @@ struct ntlm_targetinfo {
     char *dnsservername; /**< */
     char *dnstreename; /**< */
     uint32_t avflags; /**< */
+    char *targetname;
+    struct ntlm_buf channel_bindings;
+    uint64_t timestamp;
 };
 
 /**
@@ -151,8 +156,12 @@ struct ntlm_type3 {
     struct ntlm_buf sessionkey; /**< */
     char *ws; /**< */
     uint32_t os[2]; /**< */
+    size_t mic_offset;
+    uint8_t mic[16];
 };
 
+extern time_t heim_ntlm_time_skew;
+
 #include <krb5/ntlm_err.h>
 #include <krb5/heimntlm-protos.h>
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm.c b/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm.c
index 943df5912..654dd7b11 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ntlm.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: ntlm.c,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -46,9 +46,12 @@
 #include <limits.h>
 
 #include <krb5/roken.h>
+
+#include <krb5/wind.h>
 #include <krb5/parse_units.h>
 #include <krb5/krb5.h>
 
+
 #define HC_DEPRECATED_CRYPTO
 
 #include <krb5/krb5-types.h>
@@ -105,6 +108,8 @@ struct sec_buffer {
 
 static const unsigned char ntlmsigature[8] = "NTLMSSP\x00";
 
+time_t heim_ntlm_time_skew = 300;
+
 /*
  *
  */
@@ -118,6 +123,25 @@ static const unsigned char ntlmsigature[8] = "NTLMSSP\x00";
 	}								\
     } while(/*CONSTCOND*/0)
 
+#define CHECK_SIZE(f, e)						\
+    do {								\
+	ssize_t sret = f;						\
+	if (sret != (ssize_t)(e)) {					\
+	    ret = HNTLM_ERR_DECODE;					\
+	    goto out;							\
+	}								\
+    } while(/*CONSTCOND*/0)
+
+#define CHECK_OFFSET(f, e)						\
+    do {								\
+	off_t sret = f;							\
+	if (sret != (e)) {						\
+	    ret = HNTLM_ERR_DECODE;					\
+	    goto out;							\
+	}								\
+    } while(/*CONSTCOND*/0)
+
+
 static struct units ntlm_flag_units[] = {
 #define ntlm_flag(x) { #x, NTLM_##x }
     ntlm_flag(ENC_56),
@@ -184,35 +208,67 @@ heim_ntlm_free_buf(struct ntlm_buf *p)
 static int
 ascii2ucs2le(const char *string, int up, struct ntlm_buf *buf)
 {
-    unsigned char *p;
-    size_t len, i;
+    uint16_t *data;
+    size_t len, n;
+    uint8_t *p;
+    int ret;
 
-    len = strlen(string);
-    if (len / 2 > UINT_MAX)
+    ret = wind_utf8ucs2_length(string, &len);
+    if (ret)
+	return ret;
+    if (len > UINT_MAX / sizeof(data[0]))
 	return ERANGE;
 
+    data = malloc(len * sizeof(data[0]));
+    if (data == NULL)
+	return ENOMEM;
+
+    ret = wind_utf8ucs2(string, data, &len);
+    if (ret) {
+	free(data);
+	return ret;
+    }
+    
+    if (len == 0) {
+	free(data);
+	buf->data = NULL;
+	buf->length = 0;
+	return 0;
+    }
+
+    /* uppercase string, only handle ascii right now */
+    if (up) {
+	for (n = 0; n < len ; n++) {
+	    if (data[n] < 128)
+		data[n] = toupper((int)data[n]);
+	}
+    }
+
     buf->length = len * 2;
-    buf->data = malloc(buf->length);
+    p = buf->data = malloc(buf->length);
     if (buf->data == NULL && len != 0) {
+	free(data);
 	heim_ntlm_free_buf(buf);
 	return ENOMEM;
     }
 
-    p = buf->data;
-    for (i = 0; i < len; i++) {
-	unsigned char t = (unsigned char)string[i];
-	if (t & 0x80) {
-	    heim_ntlm_free_buf(buf);
-	    return EINVAL;
-	}
-	if (up)
-	    t = toupper(t);
-	p[(i * 2) + 0] = t;
-	p[(i * 2) + 1] = 0;
+    for (n = 0; n < len ; n++) {
+	p[(n * 2) + 0] = (data[n]     ) & 0xff;
+	p[(n * 2) + 1] = (data[n] >> 8) & 0xff;
     }
+    memset(data, 0, sizeof(data[0]) * len);
+    free(data);
+
     return 0;
 }
 
+/*
+ * Sizes in bytes
+ */
+
+#define SIZE_SEC_BUFFER		(2+2+4)
+#define SIZE_OS_VERSION		(8)
+
 /*
  *
  */
@@ -244,13 +300,20 @@ out:
  * wire, but using utf8 in memory.
  */
 
-static krb5_error_code
+static size_t
 len_string(int ucs2, const char *s)
 {
-    size_t len = strlen(s);
-    if (ucs2)
-	len *= 2;
-    return len;
+    if (ucs2) {
+	size_t len;
+	int ret;
+
+	ret = wind_utf8ucs2_length(s, &len);
+	if (ret == 0)
+	    return len * 2;
+	return strlen(s) * 5 * 2;
+    } else {
+	return strlen(s);
+    }
 }
 
 /*
@@ -261,28 +324,50 @@ static krb5_error_code
 ret_string(krb5_storage *sp, int ucs2, size_t len, char **s)
 {
     krb5_error_code ret;
+    uint16_t *data = NULL;
 
     *s = malloc(len + 1);
     if (*s == NULL)
 	return ENOMEM;
-    CHECK(krb5_storage_read(sp, *s, len), len);
+    CHECK_SIZE(krb5_storage_read(sp, *s, len), len);
 
     (*s)[len] = '\0';
 
     if (ucs2) {
-	size_t i;
-	for (i = 0; i < len / 2; i++) {
-	    (*s)[i] = (*s)[i * 2];
-	    if ((*s)[i * 2 + 1]) {
-		free(*s);
-		*s = NULL;
-		return EINVAL;
-	    }
+	unsigned int flags = WIND_RW_LE;
+	size_t utf16len = len / 2;
+	size_t utf8len;
+
+	data = malloc(utf16len * sizeof(data[0])); 
+	if (data == NULL) {
+	    free(*s); *s = NULL;
+	    ret = ENOMEM;
+	    goto out;
 	}
-	(*s)[i] = '\0';
+
+	ret = wind_ucs2read(*s, len, &flags, data, &utf16len);
+	free(*s); *s = NULL;
+	if (ret) {
+	    goto out;
+	}
+
+	CHECK(wind_ucs2utf8_length(data, utf16len, &utf8len), 0);
+
+	utf8len += 1;
+	
+	*s = malloc(utf8len);
+	if (s == NULL) {
+	    ret = ENOMEM;
+	    goto out;
+	}
+
+	CHECK(wind_ucs2utf8(data, utf16len, *s, &utf8len), 0);
     }
     ret = 0;
  out:
+    if (data)
+	free(data);
+
     return ret;
 }
 
@@ -292,10 +377,10 @@ static krb5_error_code
 ret_sec_string(krb5_storage *sp, int ucs2, struct sec_buffer *desc, char **s)
 {
     krb5_error_code ret = 0;
-    CHECK(krb5_storage_seek(sp, desc->offset, SEEK_SET), desc->offset);
+    CHECK_OFFSET(krb5_storage_seek(sp, desc->offset, SEEK_SET), desc->offset);
     CHECK(ret_string(sp, ucs2, desc->length, s), 0);
  out:
-    return ret;
+    return ret; 
 }
 
 static krb5_error_code
@@ -313,7 +398,7 @@ put_string(krb5_storage *sp, int ucs2, const char *s)
 	buf.length = strlen(s);
     }
 
-    CHECK(krb5_storage_write(sp, buf.data, buf.length), buf.length);
+    CHECK_SIZE(krb5_storage_write(sp, buf.data, buf.length), buf.length);
     if (ucs2)
 	heim_ntlm_free_buf(&buf);
     ret = 0;
@@ -332,8 +417,8 @@ ret_buf(krb5_storage *sp, struct sec_buffer *desc, struct ntlm_buf *buf)
 
     buf->data = malloc(desc->length);
     buf->length = desc->length;
-    CHECK(krb5_storage_seek(sp, desc->offset, SEEK_SET), desc->offset);
-    CHECK(krb5_storage_read(sp, buf->data, buf->length), buf->length);
+    CHECK_OFFSET(krb5_storage_seek(sp, desc->offset, SEEK_SET), desc->offset);
+    CHECK_SIZE(krb5_storage_read(sp, buf->data, buf->length), buf->length);
     ret = 0;
 out:
     return ret;
@@ -343,7 +428,7 @@ static krb5_error_code
 put_buf(krb5_storage *sp, const struct ntlm_buf *buf)
 {
     krb5_error_code ret;
-    CHECK(krb5_storage_write(sp, buf->data, buf->length), buf->length);
+    CHECK_SIZE(krb5_storage_write(sp, buf->data, buf->length), buf->length);
     ret = 0;
 out:
     return ret;
@@ -365,6 +450,8 @@ heim_ntlm_free_targetinfo(struct ntlm_targetinfo *ti)
     free(ti->dnsdomainname);
     free(ti->dnsservername);
     free(ti->dnstreename);
+    free(ti->targetname);
+    heim_ntlm_free_buf(&ti->channel_bindings);
     memset(ti, 0, sizeof(*ti));
 }
 
@@ -425,6 +512,20 @@ heim_ntlm_encode_targetinfo(const struct ntlm_targetinfo *ti,
 	CHECK(krb5_store_uint16(out, 4), 0);
 	CHECK(krb5_store_uint32(out, ti->avflags), 0);
     }
+    if (ti->timestamp) {
+	CHECK(krb5_store_uint16(out, 7), 0);
+	CHECK(krb5_store_uint16(out, 8), 0);
+	CHECK(krb5_store_uint32(out, ti->timestamp & 0xffffffff), 0);
+	CHECK(krb5_store_uint32(out, (ti->timestamp >> 32) & 0xffffffff), 0);
+    }	
+    if (ti->targetname) {
+	CHECK(encode_ti_string(out, 9, ucs2, ti->targetname), 0);
+    }
+    if (ti->channel_bindings.length) {
+	CHECK(krb5_store_uint16(out, 10), 0);
+	CHECK(krb5_store_uint16(out, ti->channel_bindings.length), 0);
+	CHECK_SIZE(krb5_storage_write(out, ti->channel_bindings.data, ti->channel_bindings.length), ti->channel_bindings.length);
+    }
 
     /* end tag */
     CHECK(krb5_store_int16(out, 0), 0);
@@ -499,6 +600,26 @@ heim_ntlm_decode_targetinfo(const struct ntlm_buf *data,
 	case 6:
 	    CHECK(krb5_ret_uint32(in, &ti->avflags), 0);
 	    break;
+	case 7: {
+	    uint32_t tmp;
+	    CHECK(krb5_ret_uint32(in, &tmp), 0);
+	    ti->timestamp = tmp;
+	    CHECK(krb5_ret_uint32(in, &tmp), 0);
+	    ti->timestamp |= ((uint64_t)tmp) << 32;
+	    break;
+	}	
+	case 9:
+	    CHECK(ret_string(in, 1, len, &ti->targetname), 0);
+	    break;
+	case 10:
+	    ti->channel_bindings.data = malloc(len);
+	    if (ti->channel_bindings.data == NULL) {
+		ret = ENOMEM;
+		goto out;
+	    }
+	    ti->channel_bindings.length = len;
+	    CHECK_SIZE(krb5_storage_read(in, ti->channel_bindings.data, len), len);
+	    break;
 	default:
 	    krb5_storage_seek(in, len, SEEK_CUR);
 	    break;
@@ -510,6 +631,21 @@ heim_ntlm_decode_targetinfo(const struct ntlm_buf *data,
     return ret;
 }
 
+static krb5_error_code
+encode_os_version(krb5_storage *out)
+{
+    krb5_error_code ret;
+    CHECK(krb5_store_uint8(out, 0x06), 0);
+    CHECK(krb5_store_uint8(out, 0x01), 0);
+    CHECK(krb5_store_uint16(out, 0x1db0), 0);
+    CHECK(krb5_store_uint8(out, 0x0f), 0); /* ntlm version 15 */
+    CHECK(krb5_store_uint8(out, 0x00), 0);
+    CHECK(krb5_store_uint8(out, 0x00), 0);
+    CHECK(krb5_store_uint8(out, 0x00), 0);
+ out:
+    return ret;
+}
+
 /**
  * Frees the ntlm_type1 message
  *
@@ -536,6 +672,7 @@ heim_ntlm_decode_type1(const struct ntlm_buf *buf, struct ntlm_type1 *data)
     uint32_t type;
     struct sec_buffer domain, hostname;
     krb5_storage *in;
+    int ucs2;
 
     memset(data, 0, sizeof(*data));
 
@@ -546,25 +683,30 @@ heim_ntlm_decode_type1(const struct ntlm_buf *buf, struct ntlm_type1 *data)
     }
     krb5_storage_set_byteorder(in, KRB5_STORAGE_BYTEORDER_LE);
 
-    CHECK(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
+    CHECK_SIZE(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
     CHECK(memcmp(ntlmsigature, sig, sizeof(ntlmsigature)), 0);
     CHECK(krb5_ret_uint32(in, &type), 0);
     CHECK(type, 1);
     CHECK(krb5_ret_uint32(in, &data->flags), 0);
-    if (data->flags & NTLM_OEM_SUPPLIED_DOMAIN)
-	CHECK(ret_sec_buffer(in, &domain), 0);
-    if (data->flags & NTLM_OEM_SUPPLIED_WORKSTATION)
-	CHECK(ret_sec_buffer(in, &hostname), 0);
-#if 0
-    if (domain.offset > 32) {
+
+    ucs2 = !!(data->flags & NTLM_NEG_UNICODE);
+
+    /*
+     * domain and hostname are unconditionally encoded regardless of
+     * NTLMSSP_NEGOTIATE_OEM_{HOSTNAME,WORKSTATION}_SUPPLIED flag
+     */
+    CHECK(ret_sec_buffer(in, &domain), 0);
+    CHECK(ret_sec_buffer(in, &hostname), 0);
+
+    if (data->flags & NTLM_NEG_VERSION) {
 	CHECK(krb5_ret_uint32(in, &data->os[0]), 0);
 	CHECK(krb5_ret_uint32(in, &data->os[1]), 0);
     }
-#endif
+
     if (data->flags & NTLM_OEM_SUPPLIED_DOMAIN)
-	CHECK(ret_sec_string(in, 0, &domain, &data->domain), 0);
+	CHECK(ret_sec_string(in, ucs2, &domain, &data->domain), 0);
     if (data->flags & NTLM_OEM_SUPPLIED_WORKSTATION)
-	CHECK(ret_sec_string(in, 0, &hostname, &data->hostname), 0);
+	CHECK(ret_sec_string(in, ucs2, &hostname, &data->hostname), 0);
 
 out:
     if (in)
@@ -595,35 +737,41 @@ heim_ntlm_encode_type1(const struct ntlm_type1 *type1, struct ntlm_buf *data)
     struct sec_buffer domain, hostname;
     krb5_storage *out;
     uint32_t base, flags;
+    int ucs2 = 0;
 
     flags = type1->flags;
     base = 16;
 
+    if (flags & NTLM_NEG_UNICODE)
+	ucs2 = 1;
+
     if (type1->domain) {
-	base += 8;
+	base += SIZE_SEC_BUFFER;
 	flags |= NTLM_OEM_SUPPLIED_DOMAIN;
     }
     if (type1->hostname) {
-	base += 8;
+	base += SIZE_SEC_BUFFER;
 	flags |= NTLM_OEM_SUPPLIED_WORKSTATION;
     }
-    if (type1->os[0])
-	base += 8;
+    if (flags & NTLM_NEG_VERSION)
+	base += SIZE_OS_VERSION; /* os */
 
-    domain.offset = base;
     if (type1->domain) {
-	domain.length = len_string(0, type1->domain);
+	domain.offset = base;
+	domain.length = len_string(ucs2, type1->domain);
 	domain.allocated = domain.length;
     } else {
+	domain.offset = 0;
 	domain.length = 0;
 	domain.allocated = 0;
     }
 
-    hostname.offset = domain.allocated + domain.offset;
     if (type1->hostname) {
-	hostname.length = len_string(0, type1->hostname);
+	hostname.offset = domain.allocated + domain.offset;
+	hostname.length = len_string(ucs2, type1->hostname);
 	hostname.allocated = hostname.length;
     } else {
+	hostname.offset = 0;
 	hostname.length = 0;
 	hostname.allocated = 0;
     }
@@ -633,21 +781,21 @@ heim_ntlm_encode_type1(const struct ntlm_type1 *type1, struct ntlm_buf *data)
 	return ENOMEM;
 
     krb5_storage_set_byteorder(out, KRB5_STORAGE_BYTEORDER_LE);
-    CHECK(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
+    CHECK_SIZE(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
 	  sizeof(ntlmsigature));
     CHECK(krb5_store_uint32(out, 1), 0);
     CHECK(krb5_store_uint32(out, flags), 0);
 
     CHECK(store_sec_buffer(out, &domain), 0);
     CHECK(store_sec_buffer(out, &hostname), 0);
-#if 0
-	CHECK(krb5_store_uint32(out, type1->os[0]), 0);
-	CHECK(krb5_store_uint32(out, type1->os[1]), 0);
-#endif
+
+    if (flags & NTLM_NEG_VERSION) {
+	CHECK(encode_os_version(out), 0);
+    }
     if (type1->domain)
-	CHECK(put_string(out, 0, type1->domain), 0);
+	CHECK(put_string(out, ucs2, type1->domain), 0);
     if (type1->hostname)
-	CHECK(put_string(out, 0, type1->hostname), 0);
+	CHECK(put_string(out, ucs2, type1->hostname), 0);
 
     {
 	krb5_data d;
@@ -697,7 +845,7 @@ heim_ntlm_decode_type2(const struct ntlm_buf *buf, struct ntlm_type2 *type2)
     }
     krb5_storage_set_byteorder(in, KRB5_STORAGE_BYTEORDER_LE);
 
-    CHECK(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
+    CHECK_SIZE(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
     CHECK(memcmp(ntlmsigature, sig, sizeof(ntlmsigature)), 0);
     CHECK(krb5_ret_uint32(in, &type), 0);
     CHECK(type, 2);
@@ -706,7 +854,7 @@ heim_ntlm_decode_type2(const struct ntlm_buf *buf, struct ntlm_type2 *type2)
     CHECK(krb5_ret_uint32(in, &type2->flags), 0);
     if (type2->flags & NTLM_NEG_UNICODE)
 	ucs2 = 1;
-    CHECK(krb5_storage_read(in, type2->challenge, sizeof(type2->challenge)),
+    CHECK_SIZE(krb5_storage_read(in, type2->challenge, sizeof(type2->challenge)),
 	  sizeof(type2->challenge));
     CHECK(krb5_ret_uint32(in, &ctx[0]), 0); /* context */
     CHECK(krb5_ret_uint32(in, &ctx[1]), 0);
@@ -755,7 +903,7 @@ heim_ntlm_encode_type2(const struct ntlm_type2 *type2, struct ntlm_buf *data)
     base = 48;
 
     if (type2->flags & NTLM_NEG_VERSION)
-	base += 8;
+	base += SIZE_OS_VERSION;
 
     if (type2->flags & NTLM_NEG_UNICODE)
 	ucs2 = 1;
@@ -773,23 +921,22 @@ heim_ntlm_encode_type2(const struct ntlm_type2 *type2, struct ntlm_buf *data)
 	return ENOMEM;
 
     krb5_storage_set_byteorder(out, KRB5_STORAGE_BYTEORDER_LE);
-    CHECK(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
+    CHECK_SIZE(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
 	  sizeof(ntlmsigature));
     CHECK(krb5_store_uint32(out, 2), 0);
     CHECK(store_sec_buffer(out, &targetname), 0);
     CHECK(krb5_store_uint32(out, type2->flags), 0);
-    CHECK(krb5_storage_write(out, type2->challenge, sizeof(type2->challenge)),
+    CHECK_SIZE(krb5_storage_write(out, type2->challenge, sizeof(type2->challenge)),
 	  sizeof(type2->challenge));
     CHECK(krb5_store_uint32(out, 0), 0); /* context */
     CHECK(krb5_store_uint32(out, 0), 0);
     CHECK(store_sec_buffer(out, &targetinfo), 0);
     /* os version */
     if (type2->flags & NTLM_NEG_VERSION) {
-	CHECK(krb5_store_uint32(out, type2->os[0]), 0);
-	CHECK(krb5_store_uint32(out, type2->os[1]), 0);
+	CHECK(encode_os_version(out), 0);
     }
     CHECK(put_string(out, ucs2, type2->targetname), 0);
-    CHECK(krb5_storage_write(out, type2->targetinfo.data,
+    CHECK_SIZE(krb5_storage_write(out, type2->targetinfo.data,
 			     type2->targetinfo.length),
 	  type2->targetinfo.length);
 
@@ -843,7 +990,7 @@ heim_ntlm_decode_type3(const struct ntlm_buf *buf,
     uint32_t type;
     krb5_storage *in;
     struct sec_buffer lm, ntlm, target, username, sessionkey, ws;
-    uint32_t min_offset = 72;
+    uint32_t min_offset = 0xffffffff;
 
     memset(type3, 0, sizeof(*type3));
     memset(&sessionkey, 0, sizeof(sessionkey));
@@ -855,7 +1002,7 @@ heim_ntlm_decode_type3(const struct ntlm_buf *buf,
     }
     krb5_storage_set_byteorder(in, KRB5_STORAGE_BYTEORDER_LE);
 
-    CHECK(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
+    CHECK_SIZE(krb5_storage_read(in, sig, sizeof(sig)), sizeof(sig));
     CHECK(memcmp(ntlmsigature, sig, sizeof(ntlmsigature)), 0);
     CHECK(krb5_ret_uint32(in, &type), 0);
     CHECK(type, 3);
@@ -866,24 +1013,27 @@ heim_ntlm_decode_type3(const struct ntlm_buf *buf,
     if (ntlm.allocated)
 	min_offset = min(min_offset, ntlm.offset);
     CHECK(ret_sec_buffer(in, &target), 0);
-    if (target.allocated)
-	min_offset = min(min_offset, target.offset);
+    min_offset = min(min_offset, target.offset);
     CHECK(ret_sec_buffer(in, &username), 0);
-    if (username.allocated)
-	min_offset = min(min_offset, username.offset);
+    min_offset = min(min_offset, username.offset);
     CHECK(ret_sec_buffer(in, &ws), 0);
     if (ws.allocated)
 	min_offset = min(min_offset, ws.offset);
 
-    if (min_offset > 52) {
+    if (min_offset >= 52) {
 	CHECK(ret_sec_buffer(in, &sessionkey), 0);
-	min_offset = max(min_offset, sessionkey.offset);
+	min_offset = min(min_offset, sessionkey.offset);
 	CHECK(krb5_ret_uint32(in, &type3->flags), 0);
     }
-    if (min_offset > 52 + 8 + 4 + 8) {
+    if (min_offset >= 52 + SIZE_SEC_BUFFER + 4 + SIZE_OS_VERSION) {
 	CHECK(krb5_ret_uint32(in, &type3->os[0]), 0);
 	CHECK(krb5_ret_uint32(in, &type3->os[1]), 0);
     }
+    if (min_offset >= 52 + SIZE_SEC_BUFFER + 4 + SIZE_OS_VERSION + 16) {
+	type3->mic_offset = 52 + SIZE_SEC_BUFFER + 4 + SIZE_OS_VERSION;
+	CHECK_SIZE(krb5_storage_read(in, type3->mic, sizeof(type3->mic)), sizeof(type3->mic));
+    } else
+	type3->mic_offset = 0;
     CHECK(ret_buf(in, &lm, &type3->lm), 0);
     CHECK(ret_buf(in, &ntlm, &type3->ntlm), 0);
     CHECK(ret_sec_string(in, ucs2, &target, &type3->targetname), 0);
@@ -906,6 +1056,7 @@ out:
  *
  * @param type3 the ntlm_type3 message to encode.
  * @param data is the return buffer with the encoded message, should be
+ * @param[out] mic_offset offset of message integrity code
  * freed with heim_ntlm_free_buf().
  *
  * @return In case of success 0 is return, an errors, a errno in what
@@ -915,7 +1066,7 @@ out:
  */
 
 int
-heim_ntlm_encode_type3(const struct ntlm_type3 *type3, struct ntlm_buf *data)
+heim_ntlm_encode_type3(const struct ntlm_type3 *type3, struct ntlm_buf *data, size_t *mic_offset)
 {
     struct sec_buffer lm, ntlm, target, username, sessionkey, ws;
     krb5_error_code ret;
@@ -934,9 +1085,12 @@ heim_ntlm_encode_type3(const struct ntlm_type3 *type3, struct ntlm_buf *data)
 
     base += 8; /* sessionkey sec buf */
     base += 4; /* flags */
+    if (type3->flags & NTLM_NEG_VERSION)
+	base += SIZE_OS_VERSION; /* os flags */
 
-    if (type3->os[0]) {
-	base += 8;
+    if (mic_offset) {
+	*mic_offset = base;
+	base += 16;
     }
 
     if (type3->flags & NTLM_NEG_UNICODE)
@@ -971,7 +1125,7 @@ heim_ntlm_encode_type3(const struct ntlm_type3 *type3, struct ntlm_buf *data)
 	return ENOMEM;
 
     krb5_storage_set_byteorder(out, KRB5_STORAGE_BYTEORDER_LE);
-    CHECK(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
+    CHECK_SIZE(krb5_storage_write(out, ntlmsigature, sizeof(ntlmsigature)),
 	  sizeof(ntlmsigature));
     CHECK(krb5_store_uint32(out, 3), 0);
 
@@ -983,10 +1137,15 @@ heim_ntlm_encode_type3(const struct ntlm_type3 *type3, struct ntlm_buf *data)
     CHECK(store_sec_buffer(out, &sessionkey), 0);
     CHECK(krb5_store_uint32(out, type3->flags), 0);
 
-#if 0
-    CHECK(krb5_store_uint32(out, 0), 0); /* os0 */
-    CHECK(krb5_store_uint32(out, 0), 0); /* os1 */
-#endif
+    /* os version */
+    if (type3->flags & NTLM_NEG_VERSION) {
+	CHECK(encode_os_version(out), 0);
+    }
+
+    if (mic_offset) {
+	static const uint8_t buf[16] = { 0 };
+	CHECK_SIZE(krb5_storage_write(out, buf, sizeof(buf)), sizeof(buf));
+    }
 
     CHECK(put_string(out, ucs2, type3->targetname), 0);
     CHECK(put_string(out, ucs2, type3->username), 0);
@@ -1057,10 +1216,10 @@ heim_ntlm_nt_key(const char *password, struct ntlm_buf *key)
     EVP_MD_CTX *m;
     int ret;
 
-    key->data = malloc(MD5_DIGEST_LENGTH);
+    key->data = malloc(MD4_DIGEST_LENGTH);
     if (key->data == NULL)
 	return ENOMEM;
-    key->length = MD5_DIGEST_LENGTH;
+    key->length = MD4_DIGEST_LENGTH;
 
     ret = ascii2ucs2le(password, 0, &buf);
     if (ret) {
@@ -1135,7 +1294,7 @@ heim_ntlm_v1_base_session(void *key, size_t len,
 	session->length = 0;
 	return ENOMEM;
     }
-
+    
     m = EVP_MD_CTX_create();
     if (m == NULL) {
 	heim_ntlm_free_buf(session);
@@ -1184,6 +1343,9 @@ heim_ntlm_keyex_wrap(struct ntlm_buf *base_session,
     EVP_CIPHER_CTX c;
     int ret;
 
+    if (base_session->length != MD4_DIGEST_LENGTH)
+	return HNTLM_ERR_INVALID_LENGTH;
+
     session->length = MD4_DIGEST_LENGTH;
     session->data = malloc(session->length);
     if (session->data == NULL) {
@@ -1224,8 +1386,6 @@ heim_ntlm_keyex_wrap(struct ntlm_buf *base_session,
 
 }
 
-
-
 /**
  * Generates an NTLMv1 session random with assosited session master key.
  *
@@ -1315,6 +1475,8 @@ heim_ntlm_keyex_unwrap(struct ntlm_buf *baseKey,
 
     memset(session, 0, sizeof(*session));
 
+    if (encryptedSession->length != MD4_DIGEST_LENGTH)
+	return HNTLM_ERR_INVALID_LENGTH;
     if (baseKey->length != MD4_DIGEST_LENGTH)
 	return HNTLM_ERR_INVALID_LENGTH;
 
@@ -1346,6 +1508,7 @@ heim_ntlm_keyex_unwrap(struct ntlm_buf *baseKey,
  * @param len length of key
  * @param username name of the user, as sent in the message, assumed to be in UTF8.
  * @param target the name of the target, assumed to be in UTF8.
+ * @param upper_case_target upper case the target, should not be used only for legacy systems
  * @param ntlmv2 the ntlmv2 session key
  *
  * @return 0 on success, or an error code on failure.
@@ -1357,6 +1520,7 @@ int
 heim_ntlm_ntlmv2_key(const void *key, size_t len,
 		     const char *username,
 		     const char *target,
+		     int upper_case_target,
 		     unsigned char ntlmv2[16])
 {
     int ret;
@@ -1373,8 +1537,8 @@ heim_ntlm_ntlmv2_key(const void *key, size_t len,
 	    goto out;
 	HMAC_Update(&c, buf.data, buf.length);
 	free(buf.data);
-	/* uppercase target and turn into ucs2-le */
-	ret = ascii2ucs2le(target, 1, &buf);
+	/* turn target into ucs2-le */
+	ret = ascii2ucs2le(target, upper_case_target, &buf);
 	if (ret)
 	    goto out;
 	HMAC_Update(&c, buf.data, buf.length);
@@ -1383,6 +1547,7 @@ heim_ntlm_ntlmv2_key(const void *key, size_t len,
     HMAC_Final(&c, ntlmv2, &hmaclen);
  out:
     HMAC_CTX_cleanup(&c);
+    memset(&c, 0, sizeof(c));
 
     return ret;
 }
@@ -1393,16 +1558,16 @@ heim_ntlm_ntlmv2_key(const void *key, size_t len,
 
 #define NTTIME_EPOCH 0x019DB1DED53E8000LL
 
-static uint64_t
-unix2nttime(time_t unix_time)
+uint64_t
+heim_ntlm_unix2ts_time(time_t unix_time)
 {
     long long wt;
     wt = unix_time * (uint64_t)10000000 + (uint64_t)NTTIME_EPOCH;
     return wt;
 }
 
-static time_t
-nt2unixtime(uint64_t t)
+time_t
+heim_ntlm_ts2unixtime(uint64_t t)
 {
     t = ((t - (uint64_t)NTTIME_EPOCH) / (uint64_t)10000000);
     if (t > (((uint64_t)(time_t)(~(uint64_t)0)) >> 1))
@@ -1442,7 +1607,7 @@ heim_ntlm_calculate_lm2(const void *key, size_t len,
 
     /* calculate ntlmv2 key */
 
-    heim_ntlm_ntlmv2_key(key, len, username, target, ntlmv2);
+    heim_ntlm_ntlmv2_key(key, len, username, target, 0, ntlmv2);
 
     answer->data = malloc(24);
     if (answer->data == NULL)
@@ -1452,7 +1617,7 @@ heim_ntlm_calculate_lm2(const void *key, size_t len,
     heim_ntlm_derive_ntlm2_sess(ntlmv2, clientchallenge, 8,
 				serverchallenge, answer->data);
 
-    memcpy(((uint8_t *)answer->data) + 16, clientchallenge, 8);
+    memcpy(((unsigned char *)answer->data) + 16, clientchallenge, 8);
 
     return 0;
 }
@@ -1492,14 +1657,14 @@ heim_ntlm_calculate_ntlm2(const void *key, size_t len,
     unsigned char clientchallenge[8];
     uint64_t t;
 
-    t = unix2nttime(time(NULL));
+    t = heim_ntlm_unix2ts_time(time(NULL));
 
     if (RAND_bytes(clientchallenge, sizeof(clientchallenge)) != 1)
 	return HNTLM_ERR_RAND;
 
     /* calculate ntlmv2 key */
 
-    heim_ntlm_ntlmv2_key(key, len, username, target, ntlmv2);
+    heim_ntlm_ntlmv2_key(key, len, username, target, 0, ntlmv2);
 
     /* calculate and build ntlmv2 answer */
 
@@ -1514,12 +1679,19 @@ heim_ntlm_calculate_ntlm2(const void *key, size_t len,
     CHECK(krb5_store_uint32(sp, t & 0xffffffff), 0);
     CHECK(krb5_store_uint32(sp, t >> 32), 0);
 
-    CHECK(krb5_storage_write(sp, clientchallenge, 8), 8);
+    CHECK_SIZE(krb5_storage_write(sp, clientchallenge, 8), 8);
 
-    CHECK(krb5_store_uint32(sp, 0), 0);  /* unknown but zero will work */
-    CHECK(krb5_storage_write(sp, infotarget->data, infotarget->length),
+    CHECK(krb5_store_uint32(sp, 0), 0);  /* Z(4) */
+    CHECK_SIZE(krb5_storage_write(sp, infotarget->data, infotarget->length),
 	  infotarget->length);
-    CHECK(krb5_store_uint32(sp, 0), 0); /* unknown but zero will work */
+
+    /*
+     * These last 4 bytes(Z(4)) are not documented by MicroSoft and
+     * SnowLeopard doesn't send them, Lion expected them to be there,
+     * so we have to continue to send them. That is ok, since everyone
+     * else (except Snow) seems to do that too.
+     */
+    CHECK(krb5_store_uint32(sp, 0), 0); /* Z(4) */
 
     CHECK(krb5_storage_to_data(sp, &data), 0);
     krb5_storage_free(sp);
@@ -1533,8 +1705,8 @@ heim_ntlm_calculate_ntlm2(const void *key, size_t len,
 	return ENOMEM;
     }
 
-    CHECK(krb5_storage_write(sp, ntlmv2answer, 16), 16);
-    CHECK(krb5_storage_write(sp, data.data, data.length), data.length);
+    CHECK_SIZE(krb5_storage_write(sp, ntlmv2answer, 16), 16);
+    CHECK_SIZE(krb5_storage_write(sp, data.data, data.length), data.length);
     krb5_data_free(&data);
 
     CHECK(krb5_storage_to_data(sp, &data), 0);
@@ -1553,6 +1725,110 @@ out:
 
 static const int authtimediff = 3600 * 2; /* 2 hours */
 
+static int
+verify_ntlm2(const void *key, size_t len,
+	     const char *username,
+	     const char *target,
+	     int upper_case_target,
+	     time_t now,
+	     const unsigned char serverchallenge[8],
+	     const struct ntlm_buf *answer,
+	     struct ntlm_buf *infotarget,
+	     unsigned char ntlmv2[16])
+{
+    krb5_error_code ret;
+    unsigned char clientanswer[16];
+    unsigned char clientnonce[8];
+    unsigned char serveranswer[16];
+    krb5_storage *sp;
+    uint64_t t;
+    time_t authtime;
+    uint32_t temp;
+
+    infotarget->length = 0;
+    infotarget->data = NULL;
+
+    if (answer->length < 16)
+	return HNTLM_ERR_INVALID_LENGTH;
+
+    if (now == 0)
+	now = time(NULL);
+
+    /* calculate ntlmv2 key */
+
+    heim_ntlm_ntlmv2_key(key, len, username, target, upper_case_target, ntlmv2);
+
+    /* calculate and build ntlmv2 answer */
+
+    sp = krb5_storage_from_readonly_mem(answer->data, answer->length);
+    if (sp == NULL)
+	return ENOMEM;
+    krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE);
+
+    CHECK_SIZE(krb5_storage_read(sp, clientanswer, 16), 16);
+
+    CHECK(krb5_ret_uint32(sp, &temp), 0);
+    CHECK(temp, 0x00000101);
+    CHECK(krb5_ret_uint32(sp, &temp), 0);
+    CHECK(temp, 0);
+    /* timestamp le 64 bit ts */
+    CHECK(krb5_ret_uint32(sp, &temp), 0);
+    t = temp;
+    CHECK(krb5_ret_uint32(sp, &temp), 0);
+    t |= ((uint64_t)temp)<< 32;
+
+    authtime = heim_ntlm_ts2unixtime(t);
+
+    if (labs((int)(authtime - now)) > authtimediff) {
+	ret = HNTLM_ERR_TIME_SKEW;
+	goto out;
+    }
+
+    /* client challenge */
+    CHECK_SIZE(krb5_storage_read(sp, clientnonce, 8), 8);
+
+    CHECK(krb5_ret_uint32(sp, &temp), 0); /* Z(4) */
+
+    /* let pick up targetinfo */
+    infotarget->length = answer->length - (size_t)krb5_storage_seek(sp, 0, SEEK_CUR);
+    if (infotarget->length < 4) {
+	ret = HNTLM_ERR_INVALID_LENGTH;
+	goto out;
+    }
+    infotarget->data = malloc(infotarget->length);
+    if (infotarget->data == NULL) {
+	ret = ENOMEM;
+	goto out;
+    }
+    CHECK_SIZE(krb5_storage_read(sp, infotarget->data, infotarget->length),
+	  infotarget->length);
+
+    krb5_storage_free(sp);
+    sp = NULL;
+
+    if (answer->length < 16) {
+	ret = HNTLM_ERR_INVALID_LENGTH;
+	goto out;
+    }
+
+    heim_ntlm_derive_ntlm2_sess(ntlmv2,
+				((unsigned char *)answer->data) + 16, answer->length - 16,
+				serverchallenge,
+				serveranswer);
+
+    if (memcmp(serveranswer, clientanswer, 16) != 0) {
+	heim_ntlm_free_buf(infotarget);
+	return HNTLM_ERR_AUTH;
+    }
+
+    return 0;
+out:
+    heim_ntlm_free_buf(infotarget);
+    if (sp)
+	krb5_storage_free(sp);
+    return ret;
+}
+
 /**
  * Verify NTLMv2 response.
  *
@@ -1582,96 +1858,32 @@ heim_ntlm_verify_ntlm2(const void *key, size_t len,
 		       struct ntlm_buf *infotarget,
 		       unsigned char ntlmv2[16])
 {
-    krb5_error_code ret;
-    unsigned char clientanswer[16];
-    unsigned char clientnonce[8];
-    unsigned char serveranswer[16];
-    krb5_storage *sp;
-    time_t authtime;
-    uint32_t temp;
-    uint64_t t;
+    int ret;
+    
+    /**
+     * First check with the domain as the client passed it to the function.
+     */
 
-    infotarget->length = 0;
-    infotarget->data = NULL;
+    ret = verify_ntlm2(key, len, username, target, 0, now,
+		       serverchallenge, answer, infotarget, ntlmv2);
 
-    if (answer->length < 16)
-	return HNTLM_ERR_INVALID_LENGTH;
+    /**
+     * Second check with domain uppercased.
+     */
 
-    if (now == 0)
-	now = time(NULL);
+    if (ret)
+	ret = verify_ntlm2(key, len, username, target, 1, now,
+			   serverchallenge, answer, infotarget, ntlmv2);
 
-    /* calculate ntlmv2 key */
-
-    heim_ntlm_ntlmv2_key(key, len, username, target, ntlmv2);
-
-    /* calculate and build ntlmv2 answer */
-
-    sp = krb5_storage_from_readonly_mem(answer->data, answer->length);
-    if (sp == NULL)
-	return ENOMEM;
-    krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE);
-
-    CHECK(krb5_storage_read(sp, clientanswer, 16), 16);
-
-    CHECK(krb5_ret_uint32(sp, &temp), 0);
-    CHECK(temp, 0x00000101);
-    CHECK(krb5_ret_uint32(sp, &temp), 0);
-    CHECK(temp, 0);
-    /* timestamp le 64 bit ts */
-    CHECK(krb5_ret_uint32(sp, &temp), 0);
-    t = temp;
-    CHECK(krb5_ret_uint32(sp, &temp), 0);
-    t |= ((uint64_t)temp)<< 32;
-
-    authtime = nt2unixtime(t);
-
-    if (abs((int)(authtime - now)) > authtimediff) {
-	ret = HNTLM_ERR_TIME_SKEW;
-	goto out;
-    }
-
-    /* client challenge */
-    CHECK(krb5_storage_read(sp, clientnonce, 8), 8);
-
-    CHECK(krb5_ret_uint32(sp, &temp), 0); /* unknown */
-
-    /* should really unparse the infotarget, but lets pick up everything */
-    infotarget->length = answer->length - krb5_storage_seek(sp, 0, SEEK_CUR);
-    infotarget->data = malloc(infotarget->length);
-    if (infotarget->data == NULL) {
-	ret = ENOMEM;
-	goto out;
-    }
-    CHECK(krb5_storage_read(sp, infotarget->data, infotarget->length),
-	  infotarget->length);
-    /* XXX remove the unknown ?? */
-    krb5_storage_free(sp);
-    sp = NULL;
-
-    if (answer->length < 16) {
-	ret = HNTLM_ERR_INVALID_LENGTH;
-	goto out;
-    }
-
-    heim_ntlm_derive_ntlm2_sess(ntlmv2,
-				((unsigned char *)answer->data) + 16, answer->length - 16,
-				serverchallenge,
-				serveranswer);
-
-    if (memcmp(serveranswer, clientanswer, 16) != 0) {
-	heim_ntlm_free_buf(infotarget);
-	return HNTLM_ERR_AUTH;
-    }
-
-    return 0;
-out:
-    heim_ntlm_free_buf(infotarget);
-    if (sp)
-	krb5_storage_free(sp);
+    /**
+     * Third check with empty domain.
+     */
+    if (ret)
+	ret = verify_ntlm2(key, len, username, "", 0, now,
+			   serverchallenge, answer, infotarget, ntlmv2);
     return ret;
 }
 
-
 /*
  * Calculate the NTLM2 Session Response
  *
@@ -1801,5 +2013,5 @@ heim_ntlm_derive_ntlm2_sess(const unsigned char sessionkey[16],
     HMAC_Update(&c, clnt_nonce, clnt_nonce_length);
     HMAC_Final(&c, derivedkey, &hmaclen);
     HMAC_CTX_cleanup(&c);
+    memset(&c, 0, sizeof(c));
 }
-
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm_err.et b/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm_err.et
index 0fd6e00a2..fd39aa31f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm_err.et
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/ntlm_err.et
@@ -14,11 +14,47 @@ error_code RAND,		"Random generator failed"
 error_code AUTH,		"NTLM authentication failed"
 error_code TIME_SKEW,		"Client time skewed to server"
 error_code OEM,			"Client set OEM string"
-error_code MISSING_NAME_SEPARATOR, "missing @ or \ in name"
+error_code MISSING_NAME_SEPARATOR, "missing @ or \\\\ in name"
 error_code MISSING_BUFFER, 	"missing expected buffer"
 error_code INVALID_APOP, 	"Invalid APOP response"
 error_code INVALID_CRAM_MD5, 	"Invalid CRAM-MD5 response"
 error_code INVALID_DIGEST_MD5, 	"Invalid DIGEST-MD5 response"
 error_code INVALID_DIGEST_MD5_RSPAUTH, 	"Invalid DIGEST-MD5 rspauth"
+error_code INVALID_CHANNEL_BINDINGS, "Invalid channel bindings"
+error_code INVALID_MIC, 	"Invalid MIC"
+error_code INVALID_SESSIONKEY, 	"Invalid session key"
+
+
+#
+# NTLM/GSS error codes
+#
+index 64
+error_code NOT_CONFIGURED,		"NTLM not configured"
+
+error_code INVALID_CHALLANGE,		"Invalid client challenge"
+error_code INVALID_LMv1_RESPONSE,	"Invalid client LMv1 response"
+error_code INVALID_NT_RESPONSE,		"Invalid client NT response"
+error_code INVALID_LMv2_RESPONSE,	"Invalid client LMv2 response"
+error_code INVALID_NTv1_RESPONSE,	"Invalid client NTv1 response"
+error_code INVALID_NTv2_RESPONSE,	"Invalid client NTv2 response"
+error_code INVALID_NTv1_ANSWER,		"Invalid client NTv1 answer"
+error_code INVALID_NTv2_ANSWER,		"Invalid client NTv2 answer"
+error_code INVALID_SESSION_KEY,		"Invalid session key"
+
+error_code INVALID_NO_GUEST,		"Invalid guest login request"
+
+error_code NO_NETR_CONFIGURED,		"No NETR configured"
+
+
+#
+# Scram errors
+#
+prefix HSCRAM_ERR
+index 128
+
+error_code INVALID_MESSAGE,		"Invalid SCRAM message"
+error_code INVALID_PROOF,		"Invalid SCRAM proof"
+error_code INVALID_ROLE,		"Invalid SCRAM role"
+
 
 end
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/test_commonauth.c b/crypto/external/bsd/heimdal/dist/lib/ntlm/test_commonauth.c
index 2ac4c41cd..88e8f6626 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/test_commonauth.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/test_commonauth.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_commonauth.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: test_commonauth.c,v 1.1.1.3 2017/01/28 20:46:52 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
@@ -39,13 +39,14 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <krb5/roken.h>
+#include <err.h>
 #include "heim-auth.h"
 
 static int
 test_sasl_digest_md5(void)
 {
     heim_digest_t ctx;
-    const char *user;
+    const char *user, *challenge, *resp;
     char *r;
 
     if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_AUTO)) == NULL)
@@ -53,16 +54,26 @@ test_sasl_digest_md5(void)
 
     if (heim_digest_parse_challenge(ctx, "realm=\"elwood.innosoft.com\",nonce=\"OA6MG9tEQGm2hh\",qop=\"auth\",algorithm=md5-sess,charset=utf-8"))
 	abort();
+
+    /* check that server detects changing QOP */
+    if (!heim_digest_parse_response(ctx, "charset=utf-8,username=\"chris\",realm=\"elwood.innosoft.com\",nonce=\"OA6MG9tEQGm2hh\",nc=00000001,cnonce=\"OA6MHXh6VqTrRk\",digest-uri=\"imap/elwood.innosoft.com\",response=d388dad90d4bbd760a152321f2143af7,qop=auth-int"))
+	errx(1, "don't detect changing qop");
+    
+    /* should pass */
     if (heim_digest_parse_response(ctx, "charset=utf-8,username=\"chris\",realm=\"elwood.innosoft.com\",nonce=\"OA6MG9tEQGm2hh\",nc=00000001,cnonce=\"OA6MHXh6VqTrRk\",digest-uri=\"imap/elwood.innosoft.com\",response=d388dad90d4bbd760a152321f2143af7,qop=auth"))
 	abort();
-
+    
     if ((user = heim_digest_get_key(ctx, "username")) == NULL)
 	abort();
     if (strcmp(user, "chris") != 0)
 	abort();
 
-    heim_digest_set_key(ctx, "password", "secret");
+    /*
+     * check password
+     */
 
+    heim_digest_set_key(ctx, "password", "secret");
+    
     if (heim_digest_verify(ctx, &r))
 	abort();
 
@@ -71,16 +82,133 @@ test_sasl_digest_md5(void)
 
     free(r);
 
+    /*
+     * Also check userhash
+     */
+
+    r = heim_digest_userhash("chris", "elwood.innosoft.com", "secret");
+    if (strcmp(r, "eb5a750053e4d2c34aa84bbc9b0b6ee7") != 0)
+	abort();
+
+    heim_digest_set_key(ctx, "userhash", r);
+    free(r);
+    
+    if (heim_digest_verify(ctx, &r))
+	abort();
+
+    if (strcmp(r, "rspauth=ea40f60335c427b5527b84dbabcdfffd") != 0)
+	abort();
+
+    free(r);
+
+    /* check that it failes */
+
+    heim_digest_set_key(ctx, "username", "notright");
+    heim_digest_set_key(ctx, "password", "secret");
+    
+    if (heim_digest_verify(ctx, &r) == 0)
+	abort();
+
+    if ((user = heim_digest_get_key(ctx, "username")) == NULL)
+	abort();
+    if (strcmp(user, "notright") != 0)
+	abort();
+
+
+    /* Done */
+
+    heim_digest_release(ctx);
+    
+    
+    /*
+     * Check heim_digest_generate_challenge()
+     */
+    
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_RFC2831)) == NULL)
+	abort();
+    
+    heim_digest_set_key(ctx, "serverRealm", "elwood.innosoft.com");
+    heim_digest_set_key(ctx, "serverNonce", "OA6MG9tEQGm2hh");
+    heim_digest_set_key(ctx, "serverQOP", "auth,auth-int");
+    
+    challenge = heim_digest_generate_challenge(ctx);
+    if (challenge == NULL)
+	abort();
+    
+    if (heim_digest_parse_challenge(ctx, challenge))
+	abort();
+
+    /* check that server detects changing QOP */
+    if (!heim_digest_parse_response(ctx, "charset=utf-8,username=\"chris\",realm=\"elwood.innosoft.com\",nonce=\"OA6MG9tEQGm2hh\",nc=00000001,cnonce=\"OA6MHXh6VqTrRk\",digest-uri=\"imap/elwood.innosoft.com\",response=d388dad90d4bbd760a152321f2143af7,qop=auth-conf"))
+	abort();
+    
+    if (heim_digest_parse_response(ctx, "charset=utf-8,username=\"chris\",realm=\"elwood.innosoft.com\",nonce=\"OA6MG9tEQGm2hh\",nc=00000001,cnonce=\"OA6MHXh6VqTrRk\",digest-uri=\"imap/elwood.innosoft.com\",response=d388dad90d4bbd760a152321f2143af7,qop=auth"))
+	abort();
+    
+    heim_digest_set_key(ctx, "password", "secret");
+    
+    if (heim_digest_verify(ctx, &r))
+	abort();
+    
+    if (strcmp(r, "rspauth=ea40f60335c427b5527b84dbabcdfffd") != 0)
+	abort();
+    
+    free(r);
+
     heim_digest_release(ctx);
 
+    /*
+     * Validate heim_digest_service_response()
+     */
+    
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_RFC2831)) == NULL)
+	abort();
+    
+    heim_digest_set_key(ctx, "clientNonce", "OA6MHXh6VqTrRk");
+    heim_digest_set_key(ctx, "clientQOP", "auth");
+    heim_digest_set_key(ctx, "clientNC", "00000001");
+    heim_digest_set_key(ctx, "serverNonce", "OA6MG9tEQGm2hh");
+    heim_digest_set_key(ctx, "clientURI", "imap/elwood.innosoft.com");
+    heim_digest_set_key(ctx, "serverRealm", "elwood.innosoft.com");
+    heim_digest_set_key(ctx, "serverNonce", "OA6MG9tEQGm2hh");
+    heim_digest_set_key(ctx, "H(A1)", "a2549853149b0536f01f0b850c643c57");
+    
+    resp = heim_digest_server_response(ctx);
+
+    if (resp == NULL || strcmp(resp, "rspauth=ea40f60335c427b5527b84dbabcdfffd") != 0)
+	abort();
+
+    heim_digest_release(ctx);
+
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_RFC2831)) == NULL)
+	abort();
+    
+    heim_digest_set_key(ctx, "clientNonce", "OA6MHXh6VqTrRk");
+    heim_digest_set_key(ctx, "clientQOP", "auth");
+    heim_digest_set_key(ctx, "clientNC", "00000001");
+    heim_digest_set_key(ctx, "serverNonce", "OA6MG9tEQGm2hh");
+    heim_digest_set_key(ctx, "clientURI", "imap/elwood.innosoft.com");
+    heim_digest_set_key(ctx, "serverRealm", "elwood.innosoft.com");
+    heim_digest_set_key(ctx, "serverNonce", "OA6MG9tEQGm2hh");
+    heim_digest_set_key(ctx, "password", "secret");
+    heim_digest_set_key(ctx, "username", "chris");
+
+    resp = heim_digest_server_response(ctx);
+    
+    if (resp == NULL || strcmp(resp, "rspauth=ea40f60335c427b5527b84dbabcdfffd") != 0)
+	abort();
+    
+    heim_digest_release(ctx);
+    
     return 0;
 }
 
 static int
 test_http_digest_md5(void)
 {
-    heim_digest_t ctx;
-    const char *user;
+    heim_digest_t ctx, ctx2;
+    const char *user, *chal, *resp;
+    char *serverresp, *serverresp2;
 
     if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_AUTO)) == NULL)
 	abort();
@@ -97,19 +225,104 @@ test_http_digest_md5(void)
 				   "response=\"1949323746fe6a43ef61f9606e7febea\","
 				   "opaque=\"5ccc069c403ebaf9f0171e9517f40e41\""))
 	abort();
-
+    
     if ((user = heim_digest_get_key(ctx, "username")) == NULL)
 	abort();
     if (strcmp(user, "Mufasa") != 0)
 	abort();
 
-    heim_digest_set_key(ctx, "password", "CircleOfLife");
+    if ((user = heim_digest_get_key(ctx, "clientUsername")) == NULL)
+	abort();
+    if (strcmp(user, "Mufasa") != 0)
+	abort();
 
+    heim_digest_set_key(ctx, "password", "CircleOfLife");
+    
     if (heim_digest_verify(ctx, NULL))
 	abort();
 
+    /* Verify failure */
+
+    heim_digest_set_key(ctx, "username", "Oskar");
+    
+    if (heim_digest_verify(ctx, NULL) == 0)
+	abort();
+
+    heim_digest_release(ctx);
+    
+    /*
+     * Check myself
+     */
+
+    /* server */
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_RFC2831)) == NULL)
+	abort();
+    
+    heim_digest_set_key(ctx, "serverRealm", "myrealmhahaha");
+    heim_digest_set_key(ctx, "serverQOP", "auth,auth-int");
+    
+    chal = heim_digest_generate_challenge(ctx);
+    if (chal == NULL)
+	abort();
+    
+    /* client */
+    if ((ctx2 = heim_digest_create(1, HEIM_DIGEST_TYPE_RFC2831)) == NULL)
+	abort();
+    
+    if (heim_digest_parse_challenge(ctx2, chal))
+	abort();
+    
+    heim_digest_set_key(ctx2, "username", "lha");
+    heim_digest_set_key(ctx2, "password", "passw0rd");
+    heim_digest_set_key(ctx2, "uri", "/uri");
+    
+    resp = heim_digest_create_response(ctx2, &serverresp);
+    if (resp == NULL)
+	abort();
+    
+    /* server */
+    if (heim_digest_parse_response(ctx, resp))
+	abort();
+    
+    heim_digest_set_key(ctx,  "password", "passw0rd");
+    heim_digest_verify(ctx, &serverresp2);
+
+    
+    /* client */
+    if (strcmp(serverresp, serverresp2) != 0)
+	abort();
+    
+    heim_digest_release(ctx);
+    heim_digest_release(ctx2);
+    
+    /*
+     * check prefix
+     */
+    
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_AUTO)) == NULL)
+	abort();
+    
+    if (heim_digest_parse_challenge(ctx, "Digest realm=\"testrealm@host.com\","
+				    "nonce=\"dcd98b7102dd2f0e8b11d0f600bfb0c093\","
+				    "opaque=\"5ccc069c403ebaf9f0171e9517f40e41\""))
+	abort();
+
     heim_digest_release(ctx);
 
+    /*
+     * check prefix
+     */
+    
+    if ((ctx = heim_digest_create(1, HEIM_DIGEST_TYPE_AUTO)) == NULL)
+	abort();
+    
+    if (heim_digest_parse_challenge(ctx, "Digest  realm=\"testrealm@host.com\","
+				    "nonce=\"dcd98b7102dd2f0e8b11d0f600bfb0c093\","
+				    "opaque=\"5ccc069c403ebaf9f0171e9517f40e41\""))
+	abort();
+    
+    heim_digest_release(ctx);
+    
     return 0;
 }
 
@@ -160,7 +373,6 @@ test_cram_md5(void)
 	abort();
 
     heim_cram_md5_export(secret, &state);
-
     /* here you can store the memcpy-ed version of state somewhere else */
 
     ctx = heim_cram_md5_import(&state, sizeof(state));
@@ -185,7 +397,6 @@ test_apop(void)
     const char *resp = "c4c9334bac560ecc979e58001b3e22fb";
     char *t;
 
-
     t = heim_apop_create(chal, secret);
     if (t == NULL)
 	abort();
@@ -212,7 +423,5 @@ main(int argc, char **argv)
     ret |= test_cram_md5();
     ret |= test_apop();
 
-    system("bash");
-
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/ntlm/test_ntlm.c b/crypto/external/bsd/heimdal/dist/lib/ntlm/test_ntlm.c
index 1a94495ab..c9853085f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/ntlm/test_ntlm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/ntlm/test_ntlm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_ntlm.c,v 1.1.1.1 2011/04/13 18:15:39 elric Exp $	*/
+/*	$NetBSD: test_ntlm.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
@@ -43,11 +43,14 @@
 #include <krb5/krb5-types.h> /* or <inttypes.h> */
 #include <krb5/heimntlm.h>
 
+static int dumpdata_flag;
+
 static int
 test_parse(void)
 {
     const char *user = "foo",
 	*domain = "mydomain",
+	*hostname = "myhostname",
 	*password = "digestpassword",
 	*target = "DOMAIN";
     struct ntlm_type1 type1;
@@ -58,9 +61,9 @@ test_parse(void)
 
     memset(&type1, 0, sizeof(type1));
 
-    type1.flags = NTLM_NEG_UNICODE|NTLM_NEG_TARGET|NTLM_NEG_NTLM;
+    type1.flags = NTLM_NEG_UNICODE|NTLM_NEG_TARGET|NTLM_NEG_NTLM|NTLM_NEG_VERSION;
     type1.domain = rk_UNCONST(domain);
-    type1.hostname = NULL;
+    type1.hostname = rk_UNCONST(hostname);
     type1.os[0] = 0;
     type1.os[1] = 0;
 
@@ -70,11 +73,20 @@ test_parse(void)
 
     memset(&type1, 0, sizeof(type1));
 
+    if (dumpdata_flag)
+	rk_dumpdata("ntlm-type1", data.data, data.length);
+
     ret = heim_ntlm_decode_type1(&data, &type1);
     free(data.data);
     if (ret)
 	errx(1, "heim_ntlm_encode_type1");
 
+    if (strcmp(type1.domain, domain) != 0)
+	errx(1, "parser got domain wrong: %s", type1.domain);
+
+    if (strcmp(type1.hostname, hostname) != 0)
+	errx(1, "parser got hostname wrong: %s", type1.hostname);
+
     heim_ntlm_free_type1(&type1);
 
     /*
@@ -97,6 +109,9 @@ test_parse(void)
 
     memset(&type2, 0, sizeof(type2));
 
+    if (dumpdata_flag)
+	rk_dumpdata("ntlm-type2", data.data, data.length);
+
     ret = heim_ntlm_decode_type2(&data, &type2);
     free(data.data);
     if (ret)
@@ -125,7 +140,7 @@ test_parse(void)
 	free(key.data);
     }
 
-    ret = heim_ntlm_encode_type3(&type3, &data);
+    ret = heim_ntlm_encode_type3(&type3, &data, NULL);
     if (ret)
 	errx(1, "heim_ntlm_encode_type3");
 
@@ -133,6 +148,9 @@ test_parse(void)
 
     memset(&type3, 0, sizeof(type3));
 
+    if (dumpdata_flag)
+	rk_dumpdata("ntlm-type3", data.data, data.length);
+
     ret = heim_ntlm_decode_type3(&data, 1, &type3);
     free(data.data);
     if (ret)
@@ -290,18 +308,107 @@ test_ntlm2_session_resp(void)
     return 0;
 }
 
+static int
+test_ntlmv2(void)
+{
+    unsigned char type3[413] = 
+	"\x4e\x54\x4c\x4d\x53\x53\x50\x00\x03\x00\x00\x00\x18\x00\x18\x00"
+	"\x80\x00\x00\x00\x9e\x00\x9e\x00\x98\x00\x00\x00\x14\x00\x14\x00"
+	"\x48\x00\x00\x00\x10\x00\x10\x00\x5c\x00\x00\x00\x14\x00\x14\x00"
+	"\x6c\x00\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00\x05\x82\x88\xa2"
+	"\x05\x01\x28\x0a\x00\x00\x00\x0f\x43\x00\x4f\x00\x4c\x00\x4c\x00"
+	"\x45\x00\x59\x00\x2d\x00\x58\x00\x50\x00\x34\x00\x54\x00\x45\x00"
+	"\x53\x00\x54\x00\x55\x00\x53\x00\x45\x00\x52\x00\x43\x00\x4f\x00"
+	"\x4c\x00\x4c\x00\x45\x00\x59\x00\x2d\x00\x58\x00\x50\x00\x34\x00"
+	"\x2f\x96\xec\x0a\xf7\x9f\x2e\x24\xba\x09\x48\x10\xa5\x22\xd4\xe1"
+	"\x16\x6a\xca\x58\x74\x9a\xc1\x4f\x54\x6f\xee\x40\x96\xce\x43\x6e"
+	"\xdf\x99\x20\x71\x6c\x9a\xda\x2a\x01\x01\x00\x00\x00\x00\x00\x00"
+	"\x8d\xc0\x57\xc9\x79\x5e\xcb\x01\x16\x6a\xca\x58\x74\x9a\xc1\x4f"
+	"\x00\x00\x00\x00\x02\x00\x14\x00\x4e\x00\x55\x00\x54\x00\x43\x00"
+	"\x52\x00\x41\x00\x43\x00\x4b\x00\x45\x00\x52\x00\x01\x00\x14\x00"
+	"\x4e\x00\x55\x00\x54\x00\x43\x00\x52\x00\x41\x00\x43\x00\x4b\x00"
+	"\x45\x00\x52\x00\x04\x00\x12\x00\x61\x00\x70\x00\x70\x00\x6c\x00"
+	"\x65\x00\x2e\x00\x63\x00\x6f\x00\x6d\x00\x03\x00\x20\x00\x68\x00"
+	"\x75\x00\x6d\x00\x6d\x00\x65\x00\x6c\x00\x2e\x00\x61\x00\x70\x00"
+	"\x70\x00\x6c\x00\x65\x00\x2e\x00\x63\x00\x6f\x00\x6d\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f"
+	"\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20"
+	"\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20"
+	"\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32"
+	"\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64"
+	"\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32"
+	"\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00";
+    const unsigned char challenge[8] = 
+	"\xe4\x9c\x6a\x12\xe1\xbd\xde\x6a";
+    unsigned char sessionkey[16];
+
+    const char key[16] = "\xD1\x83\x98\x3E\xAE\xA7\xBE\x99\x59\xC8\xF4\xC1\x98\xED\x0E\x68";
+
+    struct ntlm_buf data;
+    struct ntlm_type3 t3;
+    int ret;
+
+    struct ntlm_targetinfo ti;
+
+    unsigned char timsg[114] = 
+	"\002\000\024\000N\000U\000T\000C\000R\000A\000C\000K\000E\000R\000\001\000\024\000N\000U\000T\000C\000R\000A\000C\000K\000E\000R\000\004\000\022\000a\000p\000p\000l\000e\000.\000c\000o\000m\000\003\000 \000h\000u\000m\000m\000e\000l\000.\000a\000p\000p\000l\000e\000.\000c\000o\000m\000\000\000\000\000\000\000\000";
+
+
+    data.data = type3;
+    data.length = sizeof(type3);
+
+    ret = heim_ntlm_decode_type3(&data, 1, &t3);
+    if (ret)
+	errx(1, "heim_ntlm_decode_type3");
+    
+    memset(&ti, 0, sizeof(ti));
+
+    data.data = timsg;
+    data.length = sizeof(timsg);
+
+    ret = heim_ntlm_decode_targetinfo(&data, 1, &ti);
+    if (ret)
+	return ret;
+
+    ret = heim_ntlm_verify_ntlm2(key, sizeof(key),
+				 t3.username,
+				 t3.targetname,
+				 1285615547,
+				 challenge,
+				 &t3.ntlm,
+				 &data,
+				 sessionkey);
+    if (ret)
+	errx(1, "verify_ntlmv2");
+
+    if (sizeof(timsg) != data.length || memcmp(timsg, data.data, sizeof(timsg)) != 0)
+	errx(1, "target info wrong: %d != %d",
+	     (int)sizeof(timsg), (int)data.length);
+
+    heim_ntlm_free_type3(&t3);
+    heim_ntlm_free_targetinfo(&ti);
+
+    return 0;
+}
+
 static int
 test_targetinfo(void)
 {
     struct ntlm_targetinfo ti;
     struct ntlm_buf buf;
     const char *dnsservername = "dnsservername";
+    const char *targetname = "targetname";
+    const char z16[16] = { 0 };
     int ret;
 
     memset(&ti, 0, sizeof(ti));
 
     ti.dnsservername = rk_UNCONST(dnsservername);
     ti.avflags = 1;
+    ti.targetname = rk_UNCONST(targetname);
+    ti.channel_bindings.data = rk_UNCONST(z16);
+    ti.channel_bindings.length = sizeof(z16);
+
     ret = heim_ntlm_encode_targetinfo(&ti, 1, &buf);
     if (ret)
 	return ret;
@@ -317,12 +424,133 @@ test_targetinfo(void)
 	errx(1, "ti.dnshostname != %s", dnsservername);
     if (ti.avflags != 1)
 	errx(1, "ti.avflags != 1");
+    if (ti.targetname == NULL ||
+	strcmp(ti.targetname, targetname) != 0)
+	errx(1, "ti.targetname != %s", targetname);
+
+    if (ti.channel_bindings.length != sizeof(z16) ||
+	memcmp(ti.channel_bindings.data, z16, sizeof(z16)) != 0)
+	errx(1, "ti.channel_bindings != Z(16)");
 
     heim_ntlm_free_targetinfo(&ti);
 
     return 0;
 }
 
+static int
+test_string2key(void)
+{
+    const char *pw = "山田";
+    struct ntlm_buf buf;
+
+    unsigned char key[16] = {
+	0xc6, 0x5d, 0xc7, 0x61, 0xa1, 0x34, 0x17, 0xa1,
+	0x17, 0x08, 0x9c, 0x1b, 0xb0, 0x0d, 0x0f, 0x19
+    };
+
+    if (heim_ntlm_nt_key(pw, &buf) != 0)
+	errx(1, "heim_ntlmv_nt_key(jp)");
+
+    if (buf.length != 16 || memcmp(buf.data, key, 16) != 0)
+	errx(1, "compare failed");
+
+    heim_ntlm_free_buf(&buf);
+
+    return 0;
+}
+
+static int
+test_jp(void)
+{
+    char buf2[220] =
+	"\x4e\x54\x4c\x4d\x53\x53\x50\x00\x02\x00\x00\x00\x06\x00\x06\x00"
+	"\x38\x00\x00\x00\x05\x02\x89\x62\x62\x94\xb1\xf3\x56\x80\xb0\xf9"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x9e\x00\x9e\x00\x3e\x00\x00\x00"
+	"\x06\x01\xb0\x1d\x00\x00\x00\x0f\x43\x00\x4f\x00\x53\x00\x02\x00"
+	"\x06\x00\x43\x00\x4f\x00\x53\x00\x01\x00\x12\x00\x43\x00\x4f\x00"
+	"\x53\x00\x57\x00\x49\x00\x4e\x00\x37\x00\x4a\x00\x50\x00\x04\x00"
+	"\x1a\x00\x63\x00\x6f\x00\x73\x00\x2e\x00\x61\x00\x70\x00\x70\x00"
+	"\x6c\x00\x65\x00\x2e\x00\x63\x00\x6f\x00\x6d\x00\x03\x00\x2e\x00"
+	"\x63\x00\x6f\x00\x73\x00\x77\x00\x69\x00\x6e\x00\x37\x00\x6a\x00"
+	"\x70\x00\x2e\x00\x63\x00\x6f\x00\x73\x00\x2e\x00\x61\x00\x70\x00"
+	"\x70\x00\x6c\x00\x65\x00\x2e\x00\x63\x00\x6f\x00\x6d\x00\x05\x00"
+	"\x1a\x00\x63\x00\x6f\x00\x73\x00\x2e\x00\x61\x00\x70\x00\x70\x00"
+	"\x6c\x00\x65\x00\x2e\x00\x63\x00\x6f\x00\x6d\x00\x07\x00\x08\x00"
+	"\x94\x51\xf0\xbd\xdc\x61\xcb\x01\x00\x00\x00\x00";
+
+    char buf3[362] =
+	"\x4e\x54\x4c\x4d\x53\x53\x50\x00\x03\x00\x00\x00\x18\x00\x18\x00"
+	"\x74\x00\x00\x00\xce\x00\xce\x00\x8c\x00\x00\x00\x1a\x00\x1a\x00"
+	"\x40\x00\x00\x00\x04\x00\x04\x00\x5a\x00\x00\x00\x16\x00\x16\x00"
+	"\x5e\x00\x00\x00\x10\x00\x10\x00\x5a\x01\x00\x00\x05\x02\x89\x62"
+	"\x31\x00\x37\x00\x2e\x00\x32\x00\x30\x00\x31\x00\x2e\x00\x35\x00"
+	"\x37\x00\x2e\x00\x31\x00\x32\x00\x31\x00\x71\x5c\x30\x75\x77\x00"
+	"\x6f\x00\x72\x00\x6b\x00\x73\x00\x74\x00\x61\x00\x74\x00\x69\x00"
+	"\x6f\x00\x6e\x00\xab\xad\xeb\x72\x01\xd4\x5f\xdf\x59\x07\x5f\xa9"
+	"\xfd\x54\x98\x2d\xfa\x17\xbb\xf1\x3c\x8f\xf5\x20\xe6\x8f\xd7\x0a"
+	"\xc9\x19\x3e\x94\x61\x31\xdb\x0f\x55\xe8\xe2\x53\x01\x01\x00\x00"
+	"\x00\x00\x00\x00\x00\x06\x3e\x30\xe4\x61\xcb\x01\x71\x98\x10\x6b"
+	"\x4c\x82\xec\xb3\x00\x00\x00\x00\x02\x00\x06\x00\x43\x00\x4f\x00"
+	"\x53\x00\x01\x00\x12\x00\x43\x00\x4f\x00\x53\x00\x57\x00\x49\x00"
+	"\x4e\x00\x37\x00\x4a\x00\x50\x00\x04\x00\x1a\x00\x63\x00\x6f\x00"
+	"\x73\x00\x2e\x00\x61\x00\x70\x00\x70\x00\x6c\x00\x65\x00\x2e\x00"
+	"\x63\x00\x6f\x00\x6d\x00\x03\x00\x2e\x00\x63\x00\x6f\x00\x73\x00"
+	"\x77\x00\x69\x00\x6e\x00\x37\x00\x6a\x00\x70\x00\x2e\x00\x63\x00"
+	"\x6f\x00\x73\x00\x2e\x00\x61\x00\x70\x00\x70\x00\x6c\x00\x65\x00"
+	"\x2e\x00\x63\x00\x6f\x00\x6d\x00\x05\x00\x1a\x00\x63\x00\x6f\x00"
+	"\x73\x00\x2e\x00\x61\x00\x70\x00\x70\x00\x6c\x00\x65\x00\x2e\x00"
+	"\x63\x00\x6f\x00\x6d\x00\x07\x00\x08\x00\xab\xec\xcc\x30\xe4\x61"
+	"\xcb\x01\x00\x00\x00\x00\x00\x00\x00\x00\xbc\x2e\xba\x3f\xd1\xb1"
+	"\xa7\x70\x00\x9d\x55\xa0\x59\x74\x2b\x78";
+
+
+    struct ntlm_type2 type2;
+    struct ntlm_type3 type3;
+    struct ntlm_buf data;
+    int ret;
+
+    data.length = sizeof(buf2);
+    data.data = buf2;
+
+    memset(&type2, 0, sizeof(type2));
+
+    ret = heim_ntlm_decode_type2(&data, &type2);
+    if (ret)
+	errx(1, "heim_ntlm_decode_type2(jp): %d", ret);
+
+    data.data = NULL;
+    data.length = 0;
+
+    ret = heim_ntlm_encode_type2(&type2, &data);
+    if (ret)
+	errx(1, "heim_ntlm_encode_type2(jp): %d", ret);
+
+    heim_ntlm_free_type2(&type2);
+    heim_ntlm_free_buf(&data);
+
+    data.length = sizeof(buf3);
+    data.data = buf3;
+
+    memset(&type3, 0, sizeof(type3));
+
+    ret = heim_ntlm_decode_type3(&data, 1, &type3);
+    if (ret)
+	errx(1, "heim_ntlm_decode_type2(jp): %d", ret);
+
+    data.data = NULL;
+    data.length = 0;
+
+    ret = heim_ntlm_encode_type3(&type3, &data, NULL);
+    if (ret)
+	errx(1, "heim_ntlm_decode_type2(jp): %d", ret);
+
+    heim_ntlm_free_type3(&type3);
+    heim_ntlm_free_buf(&data);
+
+    return 0;
+}
+
+
 static int verbose_flag = 0;
 static int version_flag = 0;
 static int help_flag	= 0;
@@ -344,11 +572,11 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int ret = 0, optind = 0;
+    int ret = 0, optidx = 0;
 
     setprogname(argv[0]);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
@@ -359,24 +587,33 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
-
     if (verbose_flag)
 	printf("test_parse\n");
+    ret |= test_parse();
 
-    ret += test_parse();
     if (verbose_flag)
 	printf("test_keys\n");
+    ret |= test_keys();
 
-    ret += test_keys();
     if (verbose_flag)
 	printf("test_ntlm2_session_resp\n");
-    ret += test_ntlm2_session_resp();
+    ret |= test_ntlm2_session_resp();
 
     if (verbose_flag)
 	printf("test_targetinfo\n");
-    ret += test_targetinfo();
+    ret |= test_targetinfo();
+	
+    if (verbose_flag)
+	printf("test_ntlmv2\n");
+    ret |= test_ntlmv2();
+
+    if (verbose_flag)
+	printf("test_string2key\n");
+    ret |= test_string2key();
+
+    if (verbose_flag)
+	printf("test_jp\n");
+    ret |= test_jp();
 
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/otp/Makefile.am
index 99ed48c60..cf3338f47 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/Makefile.am
@@ -2,7 +2,10 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-AM_CPPFLAGS += $(INCLUDE_hcrypto) $(ROKEN_RENAME)
+AM_CPPFLAGS += $(ROKEN_RENAME)
+if HAVE_DBHEADER
+AM_CPPFLAGS += -I$(DBHEADER)
+endif
 
 noinst_PROGRAMS = otptest
 
@@ -16,16 +19,16 @@ lib_LTLIBRARIES = libotp.la
 libotp_la_LDFLAGS = -version-info 1:5:1
 libotp_la_LIBADD  = $(LIB_hcrypto) $(LIB_roken)
 
-if HAVE_DB1
-ndbm_wrap = ndbm_wrap.c ndbm_wrap.h
-libotp_la_LIBADD += $(LIB_db_create)
-else
 if HAVE_DB3
 ndbm_wrap = ndbm_wrap.c ndbm_wrap.h
-libotp_la_LIBADD += $(LIB_db_create)
+libotp_la_LIBADD += $(DB3LIB)
+else
+if HAVE_DB1
+ndbm_wrap = ndbm_wrap.c ndbm_wrap.h
+libotp_la_LIBADD += $(DB1LIB)
 else
 ndbm_wrap =
-libotp_la_LIBADD += $(LIB_NDBM)
+libotp_la_LIBADD += $(NDBMLIB)
 endif
 endif
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp.c
index 659f407ed..499ad7ff8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp.h b/crypto/external/bsd/heimdal/dist/lib/otp/otp.h
index f8743add8..5453205d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp.h
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp.h,v 1.1.1.2 2011/04/14 14:09:28 elric Exp $	*/
+/*	$NetBSD: otp.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_challenge.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_challenge.c
index dbe1ec93d..fabb26bdf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_challenge.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_challenge.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_challenge.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_challenge.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp_challenge.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_db.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_db.c
index dc969dd49..362692f53 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_db.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_db.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_db.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_db.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp_db.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_locl.h b/crypto/external/bsd/heimdal/dist/lib/otp/otp_locl.h
index abdf95251..4ea8a9bbc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_locl.h,v 1.1.1.2 2011/04/14 14:09:28 elric Exp $	*/
+/*	$NetBSD: otp_locl.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.c
index 6708a9e7a..0a58e6f1d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_md.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_md.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.h b/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.h
index b944deb84..e0881ad82 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.h
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_md.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_md.h,v 1.1.1.2 2011/04/14 14:09:28 elric Exp $	*/
+/*	$NetBSD: otp_md.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_parse.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_parse.c
index ddd6a6dc4..38f490e48 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_parse.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_parse.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_parse.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_parse.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2000, 2005-2007 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp_parse.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_print.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_print.c
index 3269387fe..8ba5a341a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_print.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_print.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_print.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_print.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp_print.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otp_verify.c b/crypto/external/bsd/heimdal/dist/lib/otp/otp_verify.c
index 854a34066..d7114e842 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otp_verify.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otp_verify.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otp_verify.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $	*/
+/*	$NetBSD: otp_verify.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
@@ -35,7 +35,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
-__RCSID("NetBSD");
+__RCSID("$NetBSD: otp_verify.c,v 1.2 2017/01/28 21:31:50 christos Exp $");
 #endif
 
 #include "otp_locl.h"
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/otptest.c b/crypto/external/bsd/heimdal/dist/lib/otp/otptest.c
index 0290a2783..927617113 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/otptest.c
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/otptest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: otptest.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: otptest.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
@@ -109,7 +109,7 @@ test (void)
     {"sha", "OTP's are good", "correct", 0, "d51f3e99bf8e6f0b", "RUST WELT KICK FELL TAIL FRAU"},
     {"sha", "OTP's are good", "correct", 1, "82aeb52d943774e4", "FLIT DOSE ALSO MEW DRUM DEFY"},
     {"sha", "OTP's are good", "correct", 99, "4f296a74fe1567ec", "AURA ALOE HURL WING BERG WAIT"},
-    {NULL}
+    {NULL, NULL, NULL, 0, NULL, NULL}
   };
 
   struct test *t;
diff --git a/crypto/external/bsd/heimdal/dist/lib/otp/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/otp/roken_rename.h
index d2450a20f..b02a35815 100644
--- a/crypto/external/bsd/heimdal/dist/lib/otp/roken_rename.h
+++ b/crypto/external/bsd/heimdal/dist/lib/otp/roken_rename.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_rename.h,v 1.1.1.2 2011/04/14 14:09:28 elric Exp $	*/
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ChangeLog b/crypto/external/bsd/heimdal/dist/lib/roken/ChangeLog
index 518987b26..d52dc405d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ChangeLog
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ChangeLog
@@ -306,7 +306,7 @@
 	
 2005-08-25  Love Hörnquist Åstrand  <lha@it.su.se>
 
-	* strpool.c (rk_strpoolprintf): remove debug printf, plug memory
+	* strpool.c (rk_strpoolprintf): remove debug __printf__, plug memory
 	leak
 	
 2005-08-23  Love Hörnquist Åstrand  <lha@it.su.se>
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/roken/Makefile.am
index d38598d36..29d140d52 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/Makefile.am
@@ -20,14 +20,18 @@ if HAVE_DBHEADER
 AM_CPPFLAGS += -I$(DBHEADER)
 endif
 
-noinst_PROGRAMS = snprintf-test resolve-test rkpty
+noinst_PROGRAMS = snprintf-test resolve-test rkpty test-detach
+
+CHECK_LOCAL = snprintf-test resolve-test rkpty make-roken
 
 check_PROGRAMS = 				\
 		base64-test			\
 		getaddrinfo-test		\
 		getifaddrs-test			\
+		getxxyyy-test			\
 		hex-test			\
 		test-readenv			\
+		resolve-test			\
 		parse_bytes-test		\
 		parse_reply-test		\
 		parse_time-test			\
@@ -49,6 +53,8 @@ parse_reply_test_CFLAGS  = -DTEST_RESOLVE
 
 test_readenv_SOURCES = test-readenv.c test-mem.c
 
+test_detach_SOURCES = test-detach.c
+
 rkpty_LDADD = $(LIB_openpty) $(LDADD)
 
 parse_time_test_SOURCES = parse_time-test.c test-mem.c
@@ -63,6 +69,9 @@ tsearch_test_SOURCES	= tsearch-test.c
 tsearch_test_LDADD = libtest.la $(LDADD)
 tsearch_test_CFLAGS	= -DTEST_TSEARCH
 
+getxxyyy_test_SOURCES	= getxxyyy.c
+getxxyyy_test_CFLAGS	= -DTEST_GETXXYYY
+
 resolve_test_SOURCES = resolve-test.c
 
 libroken_la_SOURCES =		\
@@ -71,6 +80,7 @@ libroken_la_SOURCES =		\
 	concat.c		\
 	cloexec.c		\
 	ct.c			\
+	detach.c		\
 	doxygen.c		\
 	dumpdata.c		\
 	environment.c		\
@@ -83,6 +93,7 @@ libroken_la_SOURCES =		\
 	getarg.c		\
 	getnameinfo_verified.c	\
 	getprogname.c		\
+	getxxyyy.c		\
 	h_errno.c		\
 	hex.c			\
 	hostent_find_fqdn.c	\
@@ -90,6 +101,7 @@ libroken_la_SOURCES =		\
 	k_getpwnam.c		\
 	k_getpwuid.c		\
 	mini_inetd.c		\
+	mkdir.c                 \
 	net_read.c		\
 	net_write.c		\
 	parse_bytes.c		\
@@ -128,7 +140,7 @@ EXTRA_libroken_la_SOURCES =	\
 	search.hin		\
 	vis.hin	
 
-libroken_la_LIBADD = @LTLIBOBJS@ $(LIB_crypt)
+libroken_la_LIBADD = @LTLIBOBJS@ $(LIB_crypt) $(LIB_pidfile)
 
 $(LTLIBOBJS) $(libroken_la_OBJECTS): roken.h $(XHEADERS)
 
@@ -233,7 +245,23 @@ EXTRA_DIST = \
 	NTMakefile \
 	roken.awk roken.h.in \
 	$(man_MANS) \
-	test-mem.h \
+	dirent.c \
+	dirent.hin \
+	dirent-test.c \
+	dlfcn.hin \
+	dlfcn_w32.c \
+	getifaddrs_w32.c \
 	ndbm_wrap.c \
 	ndbm_wrap.h \
+	rename.c \
+	simple_exec_w32.c \
+	sleep.c \
+	sockstartup_w32.c \
+	stdbool.hin \
+	stdint.hin \
+	syslogc.c \
+	syslog.hin \
+	test-mem.h \
+	test-mini_inetd.c \
+	win32_alloc.c \
 	version-script.map
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/roken/NTMakefile
index fab0a0cc0..57ef7506f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/NTMakefile
@@ -39,6 +39,7 @@ libroken_la_OBJS =			\
 	$(OBJ)\concat.obj		\
 	$(OBJ)\cloexec.obj		\
 	$(OBJ)\ct.obj			\
+	$(OBJ)\detach.obj		\
 	$(OBJ)\dirent.obj		\
 	$(OBJ)\dlfcn_w32.obj		\
 	$(OBJ)\dumpdata.obj		\
@@ -69,6 +70,8 @@ libroken_la_OBJS =			\
 	$(OBJ)\issuid.obj		\
 	$(OBJ)\localtime_r.obj		\
 	$(OBJ)\lstat.obj		\
+	$(OBJ)\memset_s.obj 		\
+	$(OBJ)\mkdir.obj                \
 	$(OBJ)\mini_inetd.obj		\
 	$(OBJ)\mkstemp.obj		\
 	$(OBJ)\net_read.obj		\
@@ -94,11 +97,14 @@ libroken_la_OBJS =			\
 	$(OBJ)\strerror_r.obj		\
 	$(OBJ)\strlcat.obj		\
 	$(OBJ)\strlcpy.obj		\
+	$(OBJ)\strndup.obj		\
 	$(OBJ)\strpool.obj		\
 	$(OBJ)\strptime.obj		\
 	$(OBJ)\strsep.obj		\
 	$(OBJ)\strsep_copy.obj		\
 	$(OBJ)\strtok_r.obj		\
+	$(OBJ)\strtoll.obj		\
+	$(OBJ)\strtoull.obj		\
 	$(OBJ)\syslogc.obj		\
 	$(OBJ)\timegm.obj		\
 	$(OBJ)\timeval.obj		\
@@ -113,6 +119,8 @@ libroken_la_OBJS =			\
 	$(OBJ)\warn.obj			\
 	$(OBJ)\warnerr.obj		\
 	$(OBJ)\warnx.obj		\
+        $(OBJ)\win32_alloc.obj          \
+	$(OBJ)\writev.obj               \
 	$(OBJ)\xfree.obj
 
 !if $(NMAKE_WINVER) < 0x0600
@@ -160,6 +168,9 @@ INCFILES = 			\
 	$(INCDIR)\stdbool.h	\
 	$(INCDIR)\syslog.h	\
 	$(INCDIR)\vis.h		\
+!ifndef HAVE_STDINT_H
+	$(INCDIR)\stdint.h	\
+!endif
 	$(INCDIR)\xdbm.h
 
 clean::
@@ -179,6 +190,7 @@ TEST_PROGS =			    \
 	$(OBJ)\getaddrinfo-test.exe \
 	$(OBJ)\getifaddrs-test.exe  \
 	$(OBJ)\hex-test.exe	    \
+	$(OBJ)\test-detach.exe	    \
 	$(OBJ)\test-readenv.exe	    \
 	$(OBJ)\parse_bytes-test.exe \
 	$(OBJ)\parse_reply-test.exe \
@@ -230,7 +242,7 @@ $(OBJ)\snprintf-test.exe: $(OBJ)\snprintf-test.obj $(OBJ)\libtest.lib $(LIBROKEN
 $(OBJ)\resolve-test.exe: $(OBJ)\resolve-test.obj $(LIBROKEN)
 	$(EXECONLINK) DnsAPI.lib
 
-$(OBJ)\base64-test.exe: $(OBJ)\base64-test.obj $(OBJ)\base64.obj
+$(OBJ)\base64-test.exe: $(OBJ)\base64-test.obj $(OBJ)\base64.obj $(LIBROKEN)
 	$(EXECONLINK)
 
 $(OBJ)\getaddrinfo-test.exe: $(OBJ)\getaddrinfo-test.obj $(LIBROKEN)
@@ -242,6 +254,9 @@ $(OBJ)\hex-test.exe: $(OBJ)\hex-test.obj $(LIBROKEN)
 $(OBJ)\parse_bytes-test.exe: $(OBJ)\parse_bytes-test.obj $(LIBROKEN)
 	$(EXECONLINK)
 
+$(OBJ)\test-detach.exe: $(OBJ)\test-detach.obj $(OBJ)\detach.obj $(LIBROKEN)
+	$(EXECONLINK)
+
 $(OBJ)\dirent-test.exe: $(OBJ)\dirent-test.obj $(LIBROKEN)
 	$(EXECONLINK)
 
@@ -255,19 +270,19 @@ test-binaries: $(TEST_PROGS) $(TMP_PROGS)
 
 test-run:
 	cd $(OBJ)
-	test-mini_inetd.exe
-	dirent-test.exe
-	base64-test.exe
-	getaddrinfo-test.exe
-	getifaddrs-test.exe
-	hex-test.exe
-	test-readenv.exe
-	parse_bytes-test.exe
+	-test-mini_inetd.exe
+	-dirent-test.exe
+	-base64-test.exe
+	-getaddrinfo-test.exe
+	-getifaddrs-test.exe
+	-hex-test.exe
+	-test-readenv.exe
+	-parse_bytes-test.exe
 # Need to rewrite this test:
-#	parse_reply-test.exe
-	parse_time-test.exe
-	snprintf-test.exe
-	strpftime-test.exe
+#	-parse_reply-test.exe
+	-parse_time-test.exe
+	-snprintf-test.exe
+	-strpftime-test.exe
 	cd $(SRCDIR)
 
 test:: test-binaries test-run
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/base64-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/base64-test.c
index 95bc12f05..42aa4999c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/base64-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/base64-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: base64-test.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: base64-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -55,12 +55,12 @@ main(int argc, char **argv)
 	{ "4444", 4, "NDQ0NA==" },
 	{ "55555", 5, "NTU1NTU=" },
 	{ "abc:def", 7, "YWJjOmRlZg==" },
-	{ NULL }
+	{ NULL, 0, NULL }
     };
     for(t = tests; t->data; t++) {
 	char *str;
 	int len;
-	len = base64_encode(t->data, t->len, &str);
+	len = rk_base64_encode(t->data, t->len, &str);
 	if(strcmp(str, t->result) != 0) {
 	    fprintf(stderr, "failed test %d: %s != %s\n", numtest,
 		    str, t->result);
@@ -68,7 +68,7 @@ main(int argc, char **argv)
 	}
 	free(str);
 	str = strdup(t->result);
-	len = base64_decode(t->result, str);
+	len = rk_base64_decode(t->result, str);
 	if(len != t->len) {
 	    fprintf(stderr, "failed test %d: len %lu != %lu\n", numtest,
 		    (unsigned long)len, (unsigned long)t->len);
@@ -83,12 +83,12 @@ main(int argc, char **argv)
 
     {
 	char str[32];
-	if(base64_decode("M=M=", str) != -1) {
+	if(rk_base64_decode("M=M=", str) != -1) {
 	    fprintf(stderr, "failed test %d: successful decode of `M=M='\n",
 		    numtest++);
 	    numerr++;
 	}
-	if(base64_decode("MQ===", str) != -1) {
+	if(rk_base64_decode("MQ===", str) != -1) {
 	    fprintf(stderr, "failed test %d: successful decode of `MQ==='\n",
 		    numtest++);
 	    numerr++;
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/base64.c b/crypto/external/bsd/heimdal/dist/lib/roken/base64.c
index e0688ccb3..96bcc653b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/base64.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/base64.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: base64.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: base64.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2001 Kungliga Tekniska Högskolan
@@ -54,7 +54,7 @@ pos(char c)
 }
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_encode(const void *data, int size, char **str)
+rk_base64_encode(const void *data, int size, char **str)
 {
     char *s, *p;
     int i;
@@ -123,7 +123,7 @@ token_decode(const char *token)
 }
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_decode(const char *str, void *data)
+rk_base64_decode(const char *str, void *data)
 {
     const char *p;
     unsigned char *q;
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/base64.h b/crypto/external/bsd/heimdal/dist/lib/roken/base64.h
index 0868a2592..024f04df3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/base64.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/base64.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: base64.h,v 1.1.1.2 2011/04/14 14:09:29 elric Exp $	*/
+/*	$NetBSD: base64.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
@@ -49,9 +49,9 @@
 #endif
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_encode(const void *, int, char **);
+rk_base64_encode(const void *, int, char **);
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_decode(const char *, void *);
+rk_base64_decode(const char *, void *);
 
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/bswap.c b/crypto/external/bsd/heimdal/dist/lib/roken/bswap.c
index e64fba353..71b9b20cc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/bswap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/bswap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bswap.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: bswap.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 Kungliga Tekniska Högskolan
@@ -36,6 +36,23 @@
 #include <config.h>
 #include <krb5/roken.h>
 
+#ifndef HAVE_BSWAP64
+
+ROKEN_LIB_FUNCTION uint64_t ROKEN_LIB_CALL
+bswap64 (uint64_t val)
+{
+    return
+        (val & 0xffULL) << 56 |
+	(val & 0xff00ULL) << 40 |
+	(val & 0xff0000ULL) << 24 |
+	(val & 0xff000000ULL) << 8 |
+	(val & 0xff00000000ULL) >> 8 |
+	(val & 0xff0000000000ULL) >> 24 |
+	(val & 0xff000000000000ULL) >> 40 |
+	(val & 0xff00000000000000ULL) >> 56 ;
+}
+#endif
+
 #ifndef HAVE_BSWAP32
 
 ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/chown.c b/crypto/external/bsd/heimdal/dist/lib/roken/chown.c
index 712cfc1e2..14f975f06 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/chown.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/chown.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: chown.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: chown.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/cloexec.c b/crypto/external/bsd/heimdal/dist/lib/roken/cloexec.c
index c959937d0..ef8a2c228 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/cloexec.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/cloexec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: cloexec.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: cloexec.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -66,3 +66,12 @@ rk_cloexec_dir(DIR * d)
     rk_cloexec(dirfd(d));
 #endif
 }
+
+void ROKEN_LIB_FUNCTION
+rk_cloexec_socket(rk_socket_t s)
+{
+#ifndef _WIN32
+    rk_cloexec((int)s);
+#endif
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/closefrom.c b/crypto/external/bsd/heimdal/dist/lib/roken/closefrom.c
index 109944d38..1065151c0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/closefrom.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/closefrom.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: closefrom.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: closefrom.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/concat.c b/crypto/external/bsd/heimdal/dist/lib/roken/concat.c
index b88fe473a..a99a5aeb7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/concat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/concat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: concat.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: concat.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/copyhostent.c b/crypto/external/bsd/heimdal/dist/lib/roken/copyhostent.c
index 09cafdcd0..18d0bcc18 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/copyhostent.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/copyhostent.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: copyhostent.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: copyhostent.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ct.c b/crypto/external/bsd/heimdal/dist/lib/roken/ct.c
index 32301b852..5ee6cdf6d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ct.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ct.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ct.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: ct.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
@@ -44,6 +44,12 @@
  * ct_memcmp() can't be used to order memory regions like memcmp(),
  * for example, use ct_memcmp() with qsort().
  *
+ * We use volatile to avoid optimizations where the compiler and/or
+ * linker turn this ct_memcmp() into a plain memcmp().  The pointers
+ * themselves are also marked volatile (not just the memory pointed at)
+ * because in some GCC versions there is a bug which can be worked
+ * around by doing this.
+ *
  * @param p1 memory region 1 to compare
  * @param p2 memory region 2 to compare
  * @param len length of memory
@@ -54,9 +60,21 @@
  */
 
 int
-ct_memcmp(const void *p1, const void *p2, size_t len)
+ct_memcmp(const volatile void * volatile p1,
+          const volatile void * volatile p2,
+          size_t len)
 {
-    const unsigned char *s1 = p1, *s2 = p2;
+    /*
+     * There's no need for s1 and s2 to be volatile; only p1 and p2 have
+     * to be in order to work around GCC bugs.
+     *
+     * However, s1 and s2 do have to point to volatile, as we don't know
+     * if the object was originally defined as volatile, and if it was
+     * then we'd get undefined behavior here if s1/s2 were declared to
+     * point to non-volatile memory.
+     */
+    const volatile unsigned char *s1 = p1;
+    const volatile unsigned char *s2 = p2;
     size_t i;
     int r = 0;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/daemon.c b/crypto/external/bsd/heimdal/dist/lib/roken/daemon.c
index 36607b9c0..980608044 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/daemon.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/daemon.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: daemon.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: daemon.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*-
  * Copyright (c) 1990, 1993
@@ -74,7 +74,7 @@ daemon(int nochdir, int noclose)
 	dup2(fd, STDOUT_FILENO);
 	dup2(fd, STDERR_FILENO);
 	if (fd > 2)
-	    close (fd);
+	    (void) close(fd);
     }
     return (0);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/detach.c b/crypto/external/bsd/heimdal/dist/lib/roken/detach.c
new file mode 100644
index 000000000..1b0f21a84
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/detach.c
@@ -0,0 +1,215 @@
+/*	$NetBSD: detach.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2015
+ *	Cryptonector LLC.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Cryptonector LLC may not be used to endorse or promote products
+ *    derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+#include <errno.h>
+#include <fcntl.h>
+#ifdef WIN32
+#include <io.h>
+#include <stdlib.h>
+#else
+#include <unistd.h>
+#endif
+#include <krb5/roken.h>
+
+#ifdef WIN32
+#define dup2 _dup2
+#endif
+
+static int pipefds[2] = {-1, -1};
+
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+roken_detach_prep(int argc, char **argv, char *special_arg)
+{
+    pid_t child;
+    char buf[1];
+    ssize_t bytes;
+    int status;
+
+    pipefds[0] = -1;
+    pipefds[1] = -1;
+
+#ifdef WIN32
+    if (_pipe(pipefds, 4, O_BINARY) == -1)
+        err(1, "failed to setup to detach daemon (_pipe failed)");
+#else
+    if (pipe(pipefds) == -1)
+        err(1, "failed to setup to detach daemon (pipe failed)");
+#endif
+
+#ifndef WIN32
+    fflush(stdout);
+    child = fork();
+#else
+    {
+        intptr_t child_handle;
+	int write_side;
+        size_t i;
+	char *fildes;
+        char **new_argv;
+
+        new_argv = calloc(argc + 2, sizeof(*new_argv));
+        if (new_argv == NULL)
+            err(1, "Out of memory");
+
+	write_side = _dup(pipefds[1]); /* The new fd will be inherited */
+	if (write_side == -1)
+            err(1, "Out of memory");
+
+	if (asprintf(&fildes, "%d", write_side) == -1 ||
+	    fildes == NULL)
+            err(1, "failed to setup to detach daemon (_dup failed)");
+
+        new_argv[0] = argv[0];
+        new_argv[1] = special_arg;
+        new_argv[2] = fildes;
+        for (i = 1; argv[i] != NULL; i++)
+            new_argv[i + 1] = argv[i];
+	new_argv[argc + 2] = NULL;
+
+	_flushall();
+	child_handle = spawnvp(_P_NOWAIT, argv[0], new_argv);
+	if (child_handle == -1)
+	  child = (pid_t)-1;
+	else
+	  child = GetProcessId((HANDLE)child_handle);
+    }
+#endif
+    if (child == (pid_t)-1)
+        err(1, "failed to setup to fork daemon (fork failed)");
+
+#ifndef WIN32
+    if (child == 0) {
+        int fd;
+
+        (void) close(pipefds[0]);
+        pipefds[0] = -1;
+        /*
+         * Keep stdout/stderr for now so output and errors prior to
+         * detach_finish() can be seen by the user.
+         */
+        fd = open(_PATH_DEVNULL, O_RDWR, 0);
+        if (fd == -1)
+            err(1, "failed to open /dev/null");
+        (void) dup2(fd, STDIN_FILENO);
+        if (fd > STDERR_FILENO)
+            (void) close(fd);
+        return;
+    }
+#endif
+
+    (void) close(pipefds[1]);
+    pipefds[1] = -1;
+    do {
+        bytes = read(pipefds[0], buf, sizeof(buf));
+    } while (bytes == -1 && errno == EINTR);
+    (void) close(pipefds[0]);
+    pipefds[0] = -1;
+    if (bytes == -1) {
+        /*
+         * No need to wait for the process.  We've killed it.  If it
+         * doesn't want to exit, we'd have to wait potentially forever,
+         * but we want to indicate failure to the user as soon as
+         * possible.  A wait with timeout would end the same way
+         * (attempting to kill the process).
+         */
+        err(1, "failed to setup daemon child (read from child pipe)");
+    }
+    if (bytes == 0) {
+        warnx("daemon child preparation failed, waiting for child");
+        status = wait_for_process(child);
+        if (SE_IS_ERROR(status) || SE_PROCSTATUS(status) != 0)
+            errx(SE_PROCSTATUS(status),
+                 "daemon child preparation failed (child exited)");
+    }
+    _exit(0);
+}
+
+#ifdef WIN32
+#ifdef dup2
+#undef dup2
+#endif
+#define dup2 _dup2
+#endif
+
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+roken_detach_finish(const char *dir, int daemon_child_fd)
+{
+    char buf[1] = "";
+    ssize_t bytes;
+    int fd;
+
+    rk_pidfile(NULL);
+    if (pipefds[1] == -1 && daemon_child_fd != -1)
+        pipefds[1] = daemon_child_fd;
+    if (pipefds[0] != -1)
+	(void) close(pipefds[0]);
+    if (pipefds[1] == -1)
+        return;
+
+#ifdef HAVE_SETSID
+    if (setsid() == -1)
+        err(1, "failed to detach from tty");
+#endif
+
+#ifndef WIN32
+    /*
+     * Hopefully we've written any pidfiles by now, if they had to be in
+     * the current directory...
+     *
+     * The daemons do re-open logs and so on, therefore this chdir()
+     * call needs to be optional for testing.
+     */
+    if (dir != NULL && chdir(dir) == -1)
+        err(1, "failed to chdir to /");
+#endif
+
+    do {
+        bytes = write(pipefds[1], buf, sizeof(buf));
+    } while (bytes == -1 && errno == EINTR);
+    if (bytes == -1)
+        err(1, "failed to signal parent while detaching");
+    (void) close(pipefds[1]);
+    if (bytes != sizeof(buf))
+        errx(1, "failed to signal parent while detaching");
+
+    fd = open(_PATH_DEVNULL, O_RDWR, 0);
+    if (fd == -1)
+        err(1, "failed to open /dev/null");
+    /*
+     * Maybe we should check that our output got written, if redirected
+     * to a file.  File utils normally do this.
+     */
+    (void) dup2(fd, STDOUT_FILENO);
+    (void) dup2(fd, STDERR_FILENO);
+    if (fd > 2)
+        (void) close(fd);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/dirent-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/dirent-test.c
index 0a489c92b..f0678218f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/dirent-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/dirent-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dirent-test.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: dirent-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/dirent.c b/crypto/external/bsd/heimdal/dist/lib/roken/dirent.c
index 9362cac6e..c72a31920 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/dirent.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/dirent.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dirent.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: dirent.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
@@ -113,7 +113,7 @@ opendir(const char * path)
     struct _finddata_t fd;
     intptr_t           fd_handle;
     const char         *filespec;
-    char               path_buffer[1024];
+    char               path_buffer[1024]="";
 
     memset(&fd, 0, sizeof(fd));
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn.hin b/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn.hin
index bca8cb054..cc93bf366 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn.hin
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn.hin
@@ -32,6 +32,8 @@
 #ifndef __dlfcn_h__
 #define __dlfcn_h__
 
+#include <windows.h>
+
 #ifndef ROKEN_LIB_FUNCTION
 #ifdef _WIN32
 #define ROKEN_LIB_FUNCTION
@@ -49,7 +51,7 @@ typedef int (__stdcall *DLSYM_RET_TYPE)();
 #endif
 
 #ifdef __cplusplus
-extern "C" 
+extern "C" {
 #endif
 
 /* Implementation based on
@@ -75,6 +77,14 @@ dlopen(const char *, int);
 ROKEN_LIB_FUNCTION DLSYM_RET_TYPE ROKEN_LIB_CALL
 dlsym(void *, const char *);
 
+typedef struct Dl_info {
+    char    *dli_fname;
+    char    _dli_buf[MAX_PATH + 2];
+} Dl_info, Dl_info_t;
+
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+dladdr(void *addr, Dl_info *dli);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn_w32.c b/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn_w32.c
index 361b12305..08c14c841 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn_w32.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/dlfcn_w32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dlfcn_w32.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: dlfcn_w32.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
@@ -146,7 +146,7 @@ dlopen(const char *fn, int flags)
 
     old_error_mode = SetErrorMode(SEM_FAILCRITICALERRORS);
 
-    hm = LoadLibrary(fn);
+    hm = LoadLibraryEx(fn, 0, LOAD_WITH_ALTERED_SEARCH_PATH);
 
     if (hm == NULL) {
 	set_error_from_last();
@@ -165,3 +165,23 @@ dlsym(void * vhm, const char * func_name)
     return (DLSYM_RET_TYPE)(ULONG_PTR)GetProcAddress(hm, func_name);
 }
 
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+dladdr(void *addr, Dl_info *dli)
+{
+    HMODULE hm;
+    DWORD nsize;
+
+    memset(dli, 0, sizeof(*dli));
+    dli->dli_fname = dli->_dli_buf;
+
+    if (!GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
+                           GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+			   (LPCTSTR)(ULONG_PTR)addr, &hm))
+        return 0;
+
+    nsize = GetModuleFileName(hm, dli->_dli_buf, sizeof(dli->_dli_buf));
+    dli->_dli_buf[sizeof(dli->_dli_buf) - 1] = '\0';
+    if (nsize >= sizeof(dli->_dli_buf))
+        return 0; /* truncated? can't be... */
+    return 1;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/roken/doxygen.c
index 53ca095d4..92b788fa7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/dumpdata.c b/crypto/external/bsd/heimdal/dist/lib/roken/dumpdata.c
index ef80ddcdb..01851bd60 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/dumpdata.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/dumpdata.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dumpdata.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: dumpdata.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -83,14 +83,16 @@ rk_undumpdata(const char *filename, void **buf, size_t *size)
     sret = net_read(fd, *buf, *size);
     if (sret < 0)
 	ret = errno;
-    else if (sret != (ssize_t)*size) {
+    else if (sret != (ssize_t)*size)
 	ret = EINVAL;
-	free(*buf);
-	*buf = NULL;
-    } else
+    else
 	ret = 0;
 
- out:
+  out:
+    if (ret) {
+	free(*buf);
+	*buf = NULL;
+    }
     close(fd);
     return ret;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.3 b/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.3
index 9ef8e0811..4217b366d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.3
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: ecalloc.3,v 1.1.1.3 2014/04/24 12:45:52 pettai Exp $
+.\"	$NetBSD: ecalloc.3,v 1.2 2017/01/28 21:31:50 christos Exp $
 .\"
 .\" Copyright (c) 2001, 2003 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.c b/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.c
index c1d71e4c6..6e4a6f321 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ecalloc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ecalloc.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: ecalloc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/emalloc.c b/crypto/external/bsd/heimdal/dist/lib/roken/emalloc.c
index 7cbacfbcf..3b3d653b3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/emalloc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/emalloc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: emalloc.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: emalloc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/environment.c b/crypto/external/bsd/heimdal/dist/lib/roken/environment.c
index 4ec046de4..b32c3bb86 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/environment.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/environment.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: environment.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: environment.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000, 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/eread.c b/crypto/external/bsd/heimdal/dist/lib/roken/eread.c
index 565f9eae5..df0e52a2a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/eread.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/eread.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: eread.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: eread.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/erealloc.c b/crypto/external/bsd/heimdal/dist/lib/roken/erealloc.c
index fe5757e86..9aec9e58b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/erealloc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/erealloc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: erealloc.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: erealloc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/err.c b/crypto/external/bsd/heimdal/dist/lib/roken/err.c
index 3afdcf03f..a130a2ab3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/err.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/err.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: err.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: err.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/err.hin b/crypto/external/bsd/heimdal/dist/lib/roken/err.hin
index c5dd7ab42..e44994fb9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/err.hin
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/err.hin
@@ -58,33 +58,33 @@
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 verr(int eval, const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 2, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 0)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 err(int eval, const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 2, 3)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 3)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 verrx(int eval, const char *fmt, va_list ap)
-     __attribute__ ((noreturn, format (printf, 2, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 0)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 errx(int eval, const char *fmt, ...)
-     __attribute__ ((noreturn, format (printf, 2, 3)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 3)));
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 vwarn(const char *fmt, va_list ap)
-     __attribute__ ((format (printf, 1, 0)));
+     __attribute__ ((__format__ (__printf__, 1, 0)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 warn(const char *fmt, ...)
-     __attribute__ ((format (printf, 1, 2)));
+     __attribute__ ((__format__ (__printf__, 1, 2)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 vwarnx(const char *fmt, va_list ap)
-     __attribute__ ((format (printf, 1, 0)));
+     __attribute__ ((__format__ (__printf__, 1, 0)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 warnx(const char *fmt, ...)
-     __attribute__ ((format (printf, 1, 2)));
+     __attribute__ ((__format__ (__printf__, 1, 2)));
 
 #endif /* __ERR_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/errx.c b/crypto/external/bsd/heimdal/dist/lib/roken/errx.c
index 9684c41e5..0502b69ef 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/errx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/errx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: errx.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: errx.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/esetenv.c b/crypto/external/bsd/heimdal/dist/lib/roken/esetenv.c
index 02f3f397f..b8f66e538 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/esetenv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/esetenv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: esetenv.c,v 1.1.1.1 2011/04/13 18:15:40 elric Exp $	*/
+/*	$NetBSD: esetenv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000, 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/estrdup.c b/crypto/external/bsd/heimdal/dist/lib/roken/estrdup.c
index 593ca378d..c638f2a9b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/estrdup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/estrdup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: estrdup.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: estrdup.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ewrite.c b/crypto/external/bsd/heimdal/dist/lib/roken/ewrite.c
index baa79b0dc..09f614a88 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ewrite.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ewrite.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ewrite.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: ewrite.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/fchown.c b/crypto/external/bsd/heimdal/dist/lib/roken/fchown.c
index 683616e74..a325e7957 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/fchown.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/fchown.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: fchown.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: fchown.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/flock.c b/crypto/external/bsd/heimdal/dist/lib/roken/flock.c
index 721df6308..040e1cc2f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/flock.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/flock.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: flock.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: flock.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/fnmatch.c b/crypto/external/bsd/heimdal/dist/lib/roken/fnmatch.c
index 2f032a990..169ae2cc0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/fnmatch.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/fnmatch.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: fnmatch.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: fnmatch.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*	NetBSD: fnmatch.c,v 1.11 1995/02/27 03:43:06 cgd Exp	*/
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/freeaddrinfo.c b/crypto/external/bsd/heimdal/dist/lib/roken/freeaddrinfo.c
index 3e64a9ae7..94f9edb6a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/freeaddrinfo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/freeaddrinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: freeaddrinfo.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: freeaddrinfo.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/freehostent.c b/crypto/external/bsd/heimdal/dist/lib/roken/freehostent.c
index db1ed6f07..16cd2039a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/freehostent.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/freehostent.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: freehostent.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: freehostent.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/gai_strerror.c b/crypto/external/bsd/heimdal/dist/lib/roken/gai_strerror.c
index 3a9d7a26e..7458ef9a7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/gai_strerror.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/gai_strerror.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gai_strerror.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: gai_strerror.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/get_default_username.c b/crypto/external/bsd/heimdal/dist/lib/roken/get_default_username.c
index 9862a6227..728ad771e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/get_default_username.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/get_default_username.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_default_username.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: get_default_username.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/get_window_size.c b/crypto/external/bsd/heimdal/dist/lib/roken/get_window_size.c
index d7600faaf..31db96134 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/get_window_size.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/get_window_size.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: get_window_size.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: get_window_size.c,v 1.4 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo-test.c
index 09d9a9d84..80905c40b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getaddrinfo-test.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getaddrinfo-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo.c b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo.c
index 4b5036a3f..8f116e508 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getaddrinfo.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getaddrinfo.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo_hostspec.c b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo_hostspec.c
index 147d0ddd6..eb5e6fac1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo_hostspec.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getaddrinfo_hostspec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getaddrinfo_hostspec.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: getaddrinfo_hostspec.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.3 b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.3
index 3c5d9d778..7ded8d9fc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.3
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: getarg.3,v 1.1.1.3 2014/04/24 12:45:52 pettai Exp $
+.\"	$NetBSD: getarg.3,v 1.2 2017/01/28 21:31:50 christos Exp $
 .\"
 .\" Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -336,7 +336,7 @@ the options come in the correct order.
 .Pp
 Options with multiple arguments should be handled better.
 .Pp
-Should be integreated with SL.
+Should be integrated with SL.
 .Pp
 It's very confusing that the struct you pass in is called getargS.
 .Sh SEE ALSO
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.c b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.c
index b24f392da..6a6685fbc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getarg.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: getarg.c,v 1.5 2017/01/29 19:23:28 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -39,7 +39,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <krb5/roken.h>
-#include <krb5/getarg.h>
+#include <getarg.h>
 
 #define ISFLAG(X) ((X).type == arg_flag || (X).type == arg_negative_flag)
 
@@ -597,7 +597,7 @@ struct getargs args[] = {
 int main(int argc, char **argv)
 {
     int goptind = 0;
-    while(getarg(args, 5, argc, argv, &goptind))
+    while (getarg(args, 5, argc, argv, &goptind))
 	printf("Bad arg: %s\n", argv[goptind]);
     printf("flag1 = %d\n", flag1);
     printf("flag2 = %d\n", flag2);
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.h b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.h
index 43c2f2605..c2145d7e8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getarg.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getarg.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: getarg.h,v 1.1.1.2 2011/04/14 14:09:29 elric Exp $	*/
+/*	$NetBSD: getarg.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getcap.c b/crypto/external/bsd/heimdal/dist/lib/roken/getcap.c
index 7e9e678da..dc0c7064f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getcap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getcap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getcap.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: getcap.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*	NetBSD: getcap.c,v 1.29 1999/03/29 09:27:29 abs Exp	*/
 
@@ -54,9 +54,6 @@
 #include <unistd.h>
 
 #define	BFRAG		1024
-#if 0
-#define	BSIZE		1024
-#endif
 #define	ESC		('[' & 037)	/* ASCII ESC */
 #define	MAX_RECURSION	32		/* maximum getent recursion */
 #define	SFRAG		100		/* cgetstr mallocs in SFRAG chunks */
@@ -69,15 +66,6 @@ static size_t	 topreclen;	/* toprec length */
 static char	*toprec;	/* Additional record specified by cgetset() */
 static int	 gottoprec;	/* Flag indicating retrieval of toprecord */
 
-#if 0 /*
-       * Don't use db support unless it's build into libc but we don't
-       * check for that now, so just disable the code.
-       */
-#if defined(HAVE_DBOPEN) && defined(HAVE_DB_H)
-#define USE_DB
-#endif
-#endif
-
 #ifdef USE_DB
 static int	cdbget (DB *, char **, const char *);
 #endif
@@ -90,10 +78,6 @@ ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL cgetcap(char *buf, const char *cap, int
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetent(char **buf, char **db_array, const char *name);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetmatch(const char *buf, const char *name);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetclose(void);
-#if 0
-int cgetfirst(char **buf, char **db_array);
-int cgetnext(char **bp, char **db_array);
-#endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetstr(char *buf, const char *cap, char **str);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetustr(char *buf, const char *cap, char **str);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL cgetnum(char *buf, const char *cap, long *num);
@@ -252,12 +236,12 @@ getent(char **cap, size_t *len, char **db_array, int fd,
      * Check if we have a top record from cgetset().
      */
     if (depth == 0 && toprec != NULL && cgetmatch(toprec, name) == 0) {
-	size_t len = topreclen + BFRAG;
-	if ((record = malloc (len)) == NULL) {
+	size_t tmplen = topreclen + BFRAG;
+	if ((record = malloc (tmplen)) == NULL) {
 	    errno = ENOMEM;
 	    return (-2);
 	}
-	(void)strlcpy(record, toprec, len);
+	(void)strlcpy(record, toprec, tmplen);
 	db_p = db_array;
 	rp = record + topreclen + 1;
 	r_end = rp + BFRAG;
@@ -298,6 +282,7 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 		!= NULL) {
 		free(record);
 		retval = cdbget(capdbp, &record, name);
+                /* record is no longer for us to free here */
 		if (retval < 0) {
 		    /* no record available */
 		    (void)capdbp->close(capdbp);
@@ -418,17 +403,20 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 				 */
 		    if (rp >= r_end) {
 			u_int pos;
+                        char *tmp;
 			size_t newsize;
 
 			pos = rp - record;
 			newsize = r_end - record + BFRAG;
-			record = realloc(record, newsize);
-			if (record == NULL) {
+			tmp = realloc(record, newsize);
+			if (tmp == NULL) {
 			    errno = ENOMEM;
 			    if (myfd)
 				(void)close(fd);
+                            free(record);
 			    return (-2);
 			}
+                        record = tmp;
 			r_end = record + newsize;
 			rp = record + pos;
 		    }
@@ -466,8 +454,10 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 	    break;
     }
 
-    if (!foundit)
+    if (!foundit) {
+        free(record);
 	return (-1);
+    }
 
     /*
      * Got the capability record, but now we have to expand all tc=name
@@ -559,19 +549,22 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 	    if (diff >= r_end - rp) {
 		u_int pos, tcpos, tcposend;
 		size_t newsize;
+                char *tmp;
 
 		pos = rp - record;
 		newsize = r_end - record + diff + BFRAG;
 		tcpos = tcstart - record;
 		tcposend = tcend - record;
-		record = realloc(record, newsize);
-		if (record == NULL) {
+		tmp = realloc(record, newsize);
+		if (tmp == NULL) {
 		    errno = ENOMEM;
 		    if (myfd)
 			(void)close(fd);
 		    free(icap);
+                    free(record);
 		    return (-2);
 		}
+                record = tmp;
 		r_end = record + newsize;
 		rp = record + pos;
 		tcstart = record + tcpos;
@@ -602,12 +595,15 @@ getent(char **cap, size_t *len, char **db_array, int fd,
     if (myfd)
 	(void)close(fd);
     *len = rp - record - 1;	/* don't count NUL */
-    if (r_end > rp)
-	if ((record =
-	     realloc(record, (size_t)(rp - record))) == NULL) {
+    if (r_end > rp) {
+        char *tmp = realloc(record, (size_t)(rp - record));
+	if (tmp == NULL) {
 	    errno = ENOMEM;
+            free(record);
 	    return (-2);
 	}
+        record = tmp;
+    }
 
     *cap = record;
     if (tc_not_resolved)
@@ -689,15 +685,6 @@ cgetmatch(const char *buf, const char *name)
     }
 }
 
-#if 0
-int
-cgetfirst(char **buf, char **db_array)
-{
-    (void)cgetclose();
-    return (cgetnext(buf, db_array));
-}
-#endif
-
 static FILE *pfp;
 static int slash;
 static char **dbp;
@@ -715,131 +702,6 @@ cgetclose(void)
     return(0);
 }
 
-#if 0
-/*
- * Cgetnext() gets either the first or next entry in the logical database
- * specified by db_array.  It returns 0 upon completion of the database, 1
- * upon returning an entry with more remaining, and -1 if an error occurs.
- */
-int
-cgetnext(char **bp, char **db_array)
-{
-    size_t len;
-    int status, done;
-    char *cp, *line, *rp, *np, buf[BSIZE], nbuf[BSIZE];
-    size_t dummy;
-
-    if (dbp == NULL)
-	dbp = db_array;
-
-    if (pfp == NULL && (pfp = fopen(*dbp, "r")) == NULL) {
-	(void)cgetclose();
-	return (-1);
-    }
-    for(;;) {
-	if (toprec && !gottoprec) {
-	    gottoprec = 1;
-	    line = toprec;
-	} else {
-	    line = fgetln(pfp, &len);
-	    if (line == NULL && pfp) {
-		if (ferror(pfp)) {
-		    (void)cgetclose();
-		    return (-1);
-		} else {
-		    (void)fclose(pfp);
-		    pfp = NULL;
-		    if (*++dbp == NULL) {
-			(void)cgetclose();
-			return (0);
-		    } else if ((pfp =
-				fopen(*dbp, "r")) == NULL) {
-			(void)cgetclose();
-			return (-1);
-		    } else
-			continue;
-		}
-	    } else
-		line[len - 1] = '\0';
-	    if (len == 1) {
-		slash = 0;
-		continue;
-	    }
-	    if (isspace((unsigned char)*line) ||
-		*line == ':' || *line == '#' || slash) {
-		if (line[len - 2] == '\\')
-		    slash = 1;
-		else
-		    slash = 0;
-		continue;
-	    }
-	    if (line[len - 2] == '\\')
-		slash = 1;
-	    else
-		slash = 0;
-	}
-
-
-	/*
-	 * Line points to a name line.
-	 */
-	done = 0;
-	np = nbuf;
-	for (;;) {
-	    for (cp = line; *cp != '\0'; cp++) {
-		if (*cp == ':') {
-		    *np++ = ':';
-		    done = 1;
-		    break;
-		}
-		if (*cp == '\\')
-		    break;
-		*np++ = *cp;
-	    }
-	    if (done) {
-		*np = '\0';
-		break;
-	    } else { /* name field extends beyond the line */
-		line = fgetln(pfp, &len);
-		if (line == NULL && pfp) {
-		    if (ferror(pfp)) {
-			(void)cgetclose();
-			return (-1);
-		    }
-		    (void)fclose(pfp);
-		    pfp = NULL;
-		    *np = '\0';
-		    break;
-		} else
-		    line[len - 1] = '\0';
-	    }
-	}
-	rp = buf;
-	for(cp = nbuf; *cp != '\0'; cp++)
-	    if (*cp == '|' || *cp == ':')
-		break;
-	    else
-		*rp++ = *cp;
-
-	*rp = '\0';
-	/*
-	 * XXX
-	 * Last argument of getent here should be nbuf if we want true
-	 * sequential access in the case of duplicates.
-	 * With NULL, getent will return the first entry found
-	 * rather than the duplicate entry record.  This is a
-	 * matter of semantics that should be resolved.
-	 */
-	status = getent(bp, &dummy, db_array, -1, buf, 0, NULL);
-	if (status == -2 || status == -3)
-	    (void)cgetclose();
-
-	return (status + 1);
-    }
-    /* NOTREACHED */
-}
-#endif
-
 /*
  * Cgetstr retrieves the value of the string capability cap from the
  * capability record pointed to by buf.  A pointer to a decoded, NUL
@@ -1038,9 +900,14 @@ cgetustr(char *buf, const char *cap, char **str)
     /*
      * Give back any extra memory and return value and success.
      */
-    if (m_room != 0)
-	if ((mem = realloc(mem, (size_t)(mp - mem))) == NULL)
+    if (m_room != 0) {
+        char *tmp = realloc(mem, (size_t)(mp - mem));
+	if (tmp == NULL) {
+            free(mem);
 	    return (-2);
+        }
+        mem = tmp;
+    }
     *str = mem;
     return (len);
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getcwd.c b/crypto/external/bsd/heimdal/dist/lib/roken/getcwd.c
index 04209f369..3d1867e0b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getcwd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getcwd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getcwd.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getcwd.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getdtablesize.c b/crypto/external/bsd/heimdal/dist/lib/roken/getdtablesize.c
index 7274a0764..a33ce39da 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getdtablesize.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getdtablesize.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getdtablesize.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getdtablesize.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getegid.c b/crypto/external/bsd/heimdal/dist/lib/roken/getegid.c
index 485b17ad2..8bbe603b3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getegid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getegid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getegid.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getegid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/geteuid.c b/crypto/external/bsd/heimdal/dist/lib/roken/geteuid.c
index ed8ffddb9..1cc8fc7ca 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/geteuid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/geteuid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: geteuid.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: geteuid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getgid.c b/crypto/external/bsd/heimdal/dist/lib/roken/getgid.c
index 10b2cba5a..569fedaab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getgid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getgid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getgid.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getgid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/gethostname.c b/crypto/external/bsd/heimdal/dist/lib/roken/gethostname.c
index 53f4e7e5c..55b901140 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/gethostname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/gethostname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gethostname.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: gethostname.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs-test.c
index 91bc65cb8..59f6c151f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getifaddrs-test.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: getifaddrs-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2009 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs.c b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs.c
index c3770ff7f..27ee59ae5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getifaddrs.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: getifaddrs.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2002, 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs_w32.c b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs_w32.c
index 77a865e01..b4ab68a6f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs_w32.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getifaddrs_w32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getifaddrs_w32.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: getifaddrs_w32.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyaddr.c b/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyaddr.c
index ac76a744b..abd4d1b70 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyaddr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyaddr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getipnodebyaddr.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getipnodebyaddr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyname.c b/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyname.c
index 02b48f4bd..d58271591 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getipnodebyname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getipnodebyname.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getipnodebyname.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo.c b/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo.c
index 39ca615b0..7f1e6b2eb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getnameinfo.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getnameinfo.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo_verified.c b/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo_verified.c
index 0e2f2ec56..c165a28b5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo_verified.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getnameinfo_verified.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getnameinfo_verified.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getnameinfo_verified.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getopt.c b/crypto/external/bsd/heimdal/dist/lib/roken/getopt.c
index a4e0ca876..5de7f0686 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getopt.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getopt.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getopt.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getopt.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1987, 1993
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getprogname.c b/crypto/external/bsd/heimdal/dist/lib/roken/getprogname.c
index a54316d7a..1c7304deb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getprogname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getprogname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getprogname.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getprogname.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/gettimeofday.c b/crypto/external/bsd/heimdal/dist/lib/roken/gettimeofday.c
index 0b41ad4d3..31ebe566d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/gettimeofday.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/gettimeofday.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: gettimeofday.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: gettimeofday.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getuid.c b/crypto/external/bsd/heimdal/dist/lib/roken/getuid.c
index 789f52e91..8926c8acb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getuid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getuid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getuid.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getuid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getusershell.c b/crypto/external/bsd/heimdal/dist/lib/roken/getusershell.c
index 6874450da..5773128a4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/getusershell.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getusershell.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: getusershell.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: getusershell.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1985, 1993
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/getxxyyy.c b/crypto/external/bsd/heimdal/dist/lib/roken/getxxyyy.c
new file mode 100644
index 000000000..ca8894c01
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/getxxyyy.c
@@ -0,0 +1,186 @@
+/*	$NetBSD: getxxyyy.c,v 1.2.8.1 2017/09/11 04:58:44 snj Exp $	*/
+
+/*
+ * Copyright (c) 2011 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#include <krb5/roken.h>
+
+#ifdef TEST_GETXXYYY
+#undef rk_getpwnam_r
+#undef rk_getpwuid_r
+
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwnam_r(const char *, struct passwd *, char *, size_t, struct passwd **);
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwuid_r(uid_t, struct passwd *, char *, size_t, struct passwd **);
+#endif
+
+#if !defined(POSIX_GETPWUID_R) || !defined(POSIX_GETPWNAM_R) || defined(TEST_GETXXYYY)
+static void
+copypw(struct passwd *pwd, char *buffer, size_t bufsize, const struct passwd *p)
+{
+     memset(pwd, 0, sizeof(*pwd));
+
+#define APPEND(el)					\
+do {							\
+     slen = strlen(p->el) + 1;				\
+     if (slen > bufsize) return (errno = ENOMEM);	\
+     memcpy(buffer, p->el, slen);			\
+     pwd->el = buffer;					\
+     buffer += slen;					\
+     bufsize -= slen;					\
+} while(0)
+     
+     APPEND(pw_name);
+     if (p->pw_passwd)
+	 APPEND(pw_name);
+     pwd->pw_uid = p->pw_uid;
+     pwd->pw_gid = p->pw_gid;
+     APPEND(pw_gecos);
+     APPEND(pw_dir);
+     APPEND(pw_shell);
+}
+
+#if !defined(POSIX_GETPWUID_R) || defined(TEST_GETXXYYY)
+/*
+ * At least limit the race between threads
+ */
+
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwnam_r(const char *name, struct passwd *pwd, char *buffer,
+	      size_t bufsize, struct passwd **result)
+{
+     struct passwd *p;
+     size_t slen, n = 0;
+     
+     *result = NULL;
+
+     p = getpwnam(name);
+     if(p == NULL)
+	 return (errno = ENOENT);
+	 
+     copypw(pwd, buffer, bufsize, p);
+
+     *result = pwd;
+
+     return 0;
+}
+
+#if !defined(POSIX_GETPWNAM_R) || defined(TEST_GETXXYYY)
+
+/*
+ * At least limit the race between threads
+ */
+
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwnam_r(const char *name, struct passwd *pwd, char *buffer,
+	      size_t bufsize, struct passwd **result)
+{
+     struct passwd *p;
+     size_t slen, n = 0;
+     
+     *result = NULL;
+
+     p = getpwnam(name);
+     if(p == NULL)
+	 return (errno = ENOENT);
+	 
+     copypw(pwd, buffer, bufsize, p);
+
+     *result = pwd;
+
+     return 0;
+}
+
+#endif /* POSIX_GETPWNAM_R */
+
+#ifdef TEST_GETXXYYY
+
+#include <err.h>
+
+int verbose_flag = 0;
+
+static void
+print_result(struct passwd *p)
+{
+    if (!verbose_flag)
+	return;
+    printf("%s\n", p->pw_name);
+    printf("%d\n", (int)p->pw_uid);
+    printf("%s\n", p->pw_shell);
+    printf("%s\n", p->pw_dir);
+}
+
+int
+main(int argc, char **argv)
+{
+    struct passwd pwd, *result;
+    char buf[1024];
+    int ret;
+    const char *user;
+
+    user = getenv("USER");
+    if (!user)
+	user = "root";
+
+    ret = rk_getpwnam_r(user, &pwd, buf, sizeof(buf), &result);
+    if (ret)
+	errx(1, "rk_getpwnam_r");
+    print_result(result);
+
+    ret = rk_getpwnam_r(user, &pwd, buf, 1, &result);
+    if (ret == 0)
+	errx(1, "rk_getpwnam_r too small buf");
+
+    ret = rk_getpwnam_r("no-user-here-promise", &pwd, buf, sizeof(buf), &result);
+    if (ret == 0)
+	errx(1, "rk_getpwnam_r no user");
+
+    ret = rk_getpwuid_r(0, &pwd, buf, sizeof(buf), &result);
+    if (ret)
+	errx(1, "rk_getpwuid_r");
+    print_result(result);
+
+    ret = rk_getpwuid_r(0, &pwd, buf, 1, &result);
+    if (ret == 0)
+	errx(1, "rk_getpwuid_r too small buf");
+
+    ret = rk_getpwuid_r(-1234, &pwd, buf, sizeof(buf), &result);
+    if (ret == 0)
+	errx(1, "rk_getpwuid_r no user");
+    return 0;
+}
+
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/glob.c b/crypto/external/bsd/heimdal/dist/lib/roken/glob.c
index 7aa7093ac..a9477aa12 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/glob.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/glob.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: glob.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: glob.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -406,7 +406,7 @@ static int
 glob0(const Char *pattern, glob_t *pglob)
 {
 	const Char *qpatnext;
-	int c, err, oldpathc;
+	int c, ret, oldpathc;
 	Char *bufnext, patbuf[MaxPathLen+1];
 	size_t limit = 0;
 
@@ -466,8 +466,8 @@ glob0(const Char *pattern, glob_t *pglob)
 	qprintf("glob0:", patbuf);
 #endif
 
-	if ((err = glob1(patbuf, pglob, &limit)) != 0)
-		return(err);
+	if ((ret = glob1(patbuf, pglob, &limit)) != 0)
+		return(ret);
 
 	/*
 	 * If there was no match we are going to append the pattern
@@ -574,7 +574,7 @@ glob3(Char *pathbuf, Char *pathend, Char *pattern, Char *restpattern,
 {
 	struct dirent *dp;
 	DIR *dirp;
-	int err;
+	int ret;
 	char buf[MaxPathLen];
 
 	/*
@@ -599,7 +599,7 @@ glob3(Char *pathbuf, Char *pathend, Char *pattern, Char *restpattern,
 		return(0);
 	}
 
-	err = 0;
+	ret = 0;
 
 	/* Search directory for matching names. */
 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
@@ -620,8 +620,8 @@ glob3(Char *pathbuf, Char *pathend, Char *pattern, Char *restpattern,
 			*pathend = CHAR_EOS;
 			continue;
 		}
-		err = glob2(pathbuf, --dc, restpattern, pglob, limit);
-		if (err)
+		ret = glob2(pathbuf, --dc, restpattern, pglob, limit);
+		if (ret)
 			break;
 	}
 
@@ -629,7 +629,7 @@ glob3(Char *pathbuf, Char *pathend, Char *pattern, Char *restpattern,
 		(*pglob->gl_closedir)(dirp);
 	else
 		closedir(dirp);
-	return(err);
+	return(ret);
 }
 
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/h_errno.c b/crypto/external/bsd/heimdal/dist/lib/roken/h_errno.c
index 82a3ec512..69930065e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/h_errno.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/h_errno.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: h_errno.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: h_errno.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/hex-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/hex-test.c
index 31fb5f318..fa0e89e09 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/hex-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/hex-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hex-test.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: hex-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001, 2005 Kungliga Tekniska Högskolan
@@ -57,7 +57,7 @@ main(int argc, char **argv)
 	{ "abcdef", 6, "616263646566" },
 	{ "abcdefg", 7, "61626364656667" },
 	{ "=", 1, "3D" },
-	{ NULL }
+	{ NULL, 0, NULL }
     };
     for(t = tests; t->data; t++) {
 	char *str;
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/hex.c b/crypto/external/bsd/heimdal/dist/lib/roken/hex.c
index ffa251850..5275c3a00 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/hex.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/hex.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hex.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: hex.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004-2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/hex.h b/crypto/external/bsd/heimdal/dist/lib/roken/hex.h
index 6c9076c69..f160dde0c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/hex.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/hex.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: hex.h,v 1.1.1.2 2011/04/14 14:09:30 elric Exp $	*/
+/*	$NetBSD: hex.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/hostent_find_fqdn.c b/crypto/external/bsd/heimdal/dist/lib/roken/hostent_find_fqdn.c
index 0df58a60d..b1883a6fd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/hostent_find_fqdn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/hostent_find_fqdn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hostent_find_fqdn.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: hostent_find_fqdn.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/hstrerror.c b/crypto/external/bsd/heimdal/dist/lib/roken/hstrerror.c
index de1b8c379..ab0020563 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/hstrerror.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/hstrerror.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: hstrerror.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: hstrerror.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/inet_aton.c b/crypto/external/bsd/heimdal/dist/lib/roken/inet_aton.c
index bc38c1b59..0559a6c87 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/inet_aton.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/inet_aton.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inet_aton.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: inet_aton.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/inet_ntop.c b/crypto/external/bsd/heimdal/dist/lib/roken/inet_ntop.c
index 64c118fa6..79d99db17 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/inet_ntop.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/inet_ntop.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inet_ntop.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: inet_ntop.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/inet_pton.c b/crypto/external/bsd/heimdal/dist/lib/roken/inet_pton.c
index 1b57248f6..935cb9caf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/inet_pton.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/inet_pton.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: inet_pton.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: inet_pton.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/initgroups.c b/crypto/external/bsd/heimdal/dist/lib/roken/initgroups.c
index fa6ebe376..b6238576f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/initgroups.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/initgroups.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: initgroups.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: initgroups.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/innetgr.c b/crypto/external/bsd/heimdal/dist/lib/roken/innetgr.c
index 771050d90..041c304f0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/innetgr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/innetgr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: innetgr.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: innetgr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/iruserok.c b/crypto/external/bsd/heimdal/dist/lib/roken/iruserok.c
index e3153818c..75f6c4f60 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/iruserok.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/iruserok.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: iruserok.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: iruserok.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993, 1994
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/issuid.c b/crypto/external/bsd/heimdal/dist/lib/roken/issuid.c
index 99697d6d5..b0b7be095 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/issuid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/issuid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: issuid.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: issuid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2001 Kungliga Tekniska Högskolan
@@ -35,24 +35,183 @@
 
 #include <config.h>
 
+#ifdef HAVE_SYS_AUXV_H
+#include <sys/auxv.h>
+#endif
+
+#include <errno.h>
+
 #include <krb5/roken.h>
 
+/* NetBSD calls AT_UID AT_RUID.  Everyone else calls it AT_UID. */
+#if defined(AT_EUID) && defined(AT_RUID) && !defined(AT_UID)
+#define AT_UID AT_RUID
+#endif
+#if defined(AT_EGID) && defined(AT_RGID) && !defined(AT_GID)
+#define AT_GID AT_RGID
+#endif
+
+#ifdef __GLIBC__
+#ifdef __GLIBC_PREREQ
+#define HAVE_GLIBC_API_VERSION_SUPPORT(maj, min) __GLIBC_PREREQ(maj, min)
+#else
+#define HAVE_GLIBC_API_VERSION_SUPPORT(maj, min) \
+    ((__GLIBC << 16) + GLIBC_MINOR >= ((maj) << 16) + (min))
+#endif
+
+#if HAVE_GLIBC_API_VERSION_SUPPORT(2, 19)
+#define GETAUXVAL_SETS_ERRNO
+#endif
+#endif
+
+#ifdef HAVE_GETAUXVAL
+static unsigned long
+rk_getauxval(unsigned long type)
+{
+    errno = 0;
+#ifdef GETAUXVAL_SETS_ERRNO
+    return getauxval(type);
+#else
+    unsigned long ret = getauxval(type);
+
+    if (ret == 0)
+        errno = ENOENT;
+    return ret;
+#endif
+}
+#define USE_RK_GETAUXVAL
+#endif
+
+/**
+ * Returns non-zero if the caller's process started as set-uid or
+ * set-gid (and therefore the environment cannot be trusted).
+ *
+ * @return Non-zero if the environment is not trusted.
+ */
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 issuid(void)
 {
+    /*
+     * We want to use issetugid(), but issetugid() is not the same on
+     * all OSes.
+     *
+     * On Illumos derivatives, OpenBSD, and Solaris issetugid() returns
+     * true IFF the program exec()ed was set-uid or set-gid.
+     *
+     * On NetBSD and FreeBSD issetugid() returns true if the program
+     * exec()ed was set-uid or set-gid, or if the process has switched
+     * UIDs/GIDs or otherwise changed privileges or is a descendant of
+     * such a process and has not exec()ed since.
+     *
+     * What we want here is to know only if the program exec()ed was
+     * set-uid or set-gid, so we can decide whether to trust the
+     * enviroment variables.  We don't care if this was a process that
+     * started as root and later changed UIDs/privs whatever: since it
+     * started out as privileged, it inherited an environment from a
+     * privileged pre-exec self, and so on, so the environment is
+     * trusted.
+     *
+     * Therefore the FreeBSD/NetBSD issetugid() does us no good.
+     *
+     * Linux, meanwhile, has no issetugid() (at least glibc doesn't
+     * anyways).
+     *
+     * Systems that support ELF put an "auxilliary vector" on the stack
+     * prior to starting the RTLD, and this vector includes (optionally)
+     * information about the process' EUID, RUID, EGID, RGID, and so on
+     * at the time of exec(), which we can use to construct proper
+     * issetugid() functionality.
+     *
+     * Where available, we use the ELF auxilliary vector as a fallback
+     * if issetugid() is not available.
+     *
+     * All of this is as of late March 2015, and might become stale in
+     * the future.
+     */
+
+#ifdef USE_RK_GETAUXVAL
+    /* If we have getauxval(), use that */
+
+#if (defined(AT_EUID) && defined(AT_UID) || (defined(AT_EGID) && defined(AT_GID)))
+    int seen = 0;
+#endif
+
+#if defined(AT_EUID) && defined(AT_UID)
+    {
+        unsigned long euid;
+        unsigned long uid;
+
+        euid = rk_getauxval(AT_EUID);
+        if (errno == 0)
+            seen |= 1;
+        uid = rk_getauxval(AT_UID);
+        if (errno == 0)
+            seen |= 2;
+        if (euid != uid)
+            return 1;
+    }
+#endif
+#if defined(AT_EGID) && defined(AT_GID)
+    {
+        unsigned long egid;
+        unsigned long gid;
+
+        egid = rk_getauxval(AT_EGID);
+        if (errno == 0)
+            seen |= 4;
+        gid = rk_getauxval(AT_GID);
+        if (errno == 0)
+            seen |= 8;
+        if (egid != gid)
+            return 2;
+    }
+#endif
+#ifdef AT_SECURE
+    /* AT_SECURE is set if the program was set-id. */
+    if (rk_getauxval(AT_SECURE) != 0)
+        return 1;
+#endif
+
+#if (defined(AT_EUID) && defined(AT_UID) || (defined(AT_EGID) && defined(AT_GID)))
+    if (seen == 15)
+        return 0;
+#endif
+
+    /* rk_getauxval() does set errno */
+    if (errno == 0)
+        return 0;
+    /*
+     * Fall through if we have getauxval() but we didn't have (or don't
+     * know if we don't have) the aux entries that we needed.
+     */
+#endif /* USE_RK_GETAUXVAL */
+
 #if defined(HAVE_ISSETUGID)
+    /*
+     * If we have issetugid(), use it.
+     *
+     * We may lose on some BSDs.  This manifests as, for example,
+     * gss_store_cred() not honoring KRB5CCNAME.
+     */
     return issetugid();
-#else /* !HAVE_ISSETUGID */
+#endif /* USE_RK_GETAUXVAL */
+
+    /*
+     * Paranoia: for extra safety we ought to default to returning 1.
+     * But who knows what that might break where users link statically
+     * and use a.out, say.  Also, on Windows we should always return 0.
+     *
+     * For now we stick to returning zero by default.
+     */
 
 #if defined(HAVE_GETUID) && defined(HAVE_GETEUID)
-    if(getuid() != geteuid())
+    if (getuid() != geteuid())
 	return 1;
 #endif
 #if defined(HAVE_GETGID) && defined(HAVE_GETEGID)
-    if(getgid() != getegid())
+    if (getgid() != getegid())
 	return 2;
 #endif
 
     return 0;
-#endif /* HAVE_ISSETUGID */
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwnam.c b/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwnam.c
index 3d9c7e00a..d4d70217f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwnam.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwnam.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: k_getpwnam.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: k_getpwnam.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwuid.c b/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwuid.c
index 57f14312d..a08600ee2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwuid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/k_getpwuid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: k_getpwuid.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: k_getpwuid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/localtime_r.c b/crypto/external/bsd/heimdal/dist/lib/roken/localtime_r.c
index f9cb6ee9e..3ab3576ce 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/localtime_r.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/localtime_r.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: localtime_r.c,v 1.1.1.1 2011/04/13 18:15:41 elric Exp $	*/
+/*	$NetBSD: localtime_r.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/lstat.c b/crypto/external/bsd/heimdal/dist/lib/roken/lstat.c
index f38487430..3c864f8b6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/lstat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/lstat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: lstat.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: lstat.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/memmove.c b/crypto/external/bsd/heimdal/dist/lib/roken/memmove.c
index fecc8028b..c10603d43 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/memmove.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/memmove.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: memmove.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: memmove.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/heimdal/dllmain.c b/crypto/external/bsd/heimdal/dist/lib/roken/memset_s.c
similarity index 79%
rename from crypto/external/bsd/heimdal/dist/lib/heimdal/dllmain.c
rename to crypto/external/bsd/heimdal/dist/lib/roken/memset_s.c
index ddd91ac2c..a01f5ca5c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/heimdal/dllmain.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/memset_s.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: dllmain.c,v 1.1.1.2 2014/04/24 12:45:40 pettai Exp $	*/
+/*	$NetBSD: memset_s.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
- * Copyright (c) 2009, Secure Endpoints Inc.
+ * Copyright (c) 2015, Your File System Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,12 +31,23 @@
  *
  **********************************************************************/
 
-#include<windows.h>
+#include <config.h>
+#include <krb5/roken.h>
 
-BOOL WINAPI
-DllMain(__in  HINSTANCE hinstDLL,
-	__in  DWORD fdwReason,
-	__in  LPVOID lpvReserved)
+int ROKEN_LIB_FUNCTION
+memset_s(void *s, size_t smax, int c, size_t n)
 {
-    return TRUE;
+    volatile unsigned char *p = s;
+
+#ifdef _WIN32
+    if (c == 0) {
+	SecureZeroMemory(s, n);
+	return 0;
+    }
+#endif
+
+    while (n--) 
+    	*p++ = c; 
+
+    return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/mini_inetd.c b/crypto/external/bsd/heimdal/dist/lib/roken/mini_inetd.c
index b8ec966f2..19b6ae80d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/mini_inetd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/mini_inetd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mini_inetd.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: mini_inetd.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/base/string.c b/crypto/external/bsd/heimdal/dist/lib/roken/mkdir.c
similarity index 53%
rename from crypto/external/bsd/heimdal/dist/base/string.c
rename to crypto/external/bsd/heimdal/dist/lib/roken/mkdir.c
index 59d7d9f41..27f6b1056 100644
--- a/crypto/external/bsd/heimdal/dist/base/string.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/mkdir.c
@@ -1,12 +1,10 @@
-/*	$NetBSD: string.c,v 1.1.1.1 2011/04/13 18:14:32 elric Exp $	*/
+/*	$NetBSD: mkdir.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
- * Copyright (c) 2010 Kungliga Tekniska Högskolan
+ * Copyright (c) 2013 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
- * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
- *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -35,83 +33,26 @@
  * SUCH DAMAGE.
  */
 
-#include "baselocl.h"
-#include <string.h>
+#include <config.h>
 
-static void
-string_dealloc(void *ptr)
+#ifdef HAVE_DIRECT_H
+#include <direct.h>
+#endif
+
+#include <krb5/roken.h>
+#ifdef MKDIR_DOES_NOT_HAVE_MODE
+ #undef mkdir
+#else
+ #undef rk_mkdir
+#endif
+
+int ROKEN_LIB_FUNCTION
+rk_mkdir(const char *pathname, mode_t mode)
 {
-}
-
-static int
-string_cmp(void *a, void *b)
-{
-    return strcmp(a, b);
-}
-
-static unsigned long
-string_hash(void *ptr)
-{
-    const char *s = ptr;
-    unsigned long n;
-
-    for (n = 0; *s; ++s)
-	n += *s;
-    return n;
-}
-
-struct heim_type_data _heim_string_object = {
-    HEIM_TID_STRING,
-    "string-object",
-    NULL,
-    string_dealloc,
-    NULL,
-    string_cmp,
-    string_hash
-};
-
-/**
- * Create a string object
- *
- * @param string the string to create, must be an utf8 string
- *
- * @return string object
- */
-
-heim_string_t
-heim_string_create(const char *string)
-{
-    size_t len = strlen(string);
-    heim_string_t s;
-
-    s = _heim_alloc_object(&_heim_string_object, len + 1);
-    if (s)
-	memcpy(s, string, len + 1);
-    return s;
-}
-
-/**
- * Return the type ID of string objects
- *
- * @return type id of string objects
- */
-
-heim_tid_t
-heim_string_get_type_id(void)
-{
-    return HEIM_TID_STRING;
-}
-
-/**
- * Get the string value of the content.
- *
- * @param string the string object to get the value from
- *
- * @return a utf8 string
- */
-
-const char *
-heim_string_get_utf8(heim_string_t string)
-{
-    return (const char *)string;
+#ifndef MKDIR_DOES_NOT_HAVE_MODE
+    return mkdir(pathname, mode);
+#else
+    /* Windows does not provide the ability to set access permissions */
+    return _mkdir(pathname);
+#endif
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/mkstemp.c b/crypto/external/bsd/heimdal/dist/lib/roken/mkstemp.c
index 23afeb0bf..a651786fa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/mkstemp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/mkstemp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mkstemp.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: mkstemp.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.c b/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.c
index b5b8f7ce1..119dd6767 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ndbm_wrap.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: ndbm_wrap.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2002 Kungliga Tekniska Högskolan
@@ -113,20 +113,20 @@ static datum
 dbm_get (DB *db, int flags)
 {
     DBT key, value;
-    datum datum;
+    datum d;
 #ifdef HAVE_DB3
     if(cursor == NULL)
 	db->cursor(db, NULL, &cursor, 0);
     if(cursor->c_get(cursor, &key, &value, flags) != 0) {
-	datum.dptr = NULL;
-	datum.dsize = 0;
+	d.dptr = NULL;
+	d.dsize = 0;
     } else
-	DBT2DATUM(&value, &datum);
+	DBT2DATUM(&value, &d);
 #else
     db->seq(db, &key, &value, flags);
-    DBT2DATUM(&value, &datum);
+    DBT2DATUM(&value, &d);
 #endif
-    return datum;
+    return d;
 }
 
 #ifndef DB_FIRST
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.h b/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.h
index 051163445..205065e1a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/ndbm_wrap.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ndbm_wrap.h,v 1.1.1.2 2011/04/14 14:09:30 elric Exp $	*/
+/*	$NetBSD: ndbm_wrap.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/net_read.c b/crypto/external/bsd/heimdal/dist/lib/roken/net_read.c
index 522160c45..d4fde717f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/net_read.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/net_read.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: net_read.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: net_read.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/net_write.c b/crypto/external/bsd/heimdal/dist/lib/roken/net_write.c
index afadc8107..147863be4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/net_write.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/net_write.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: net_write.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: net_write.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes-test.c
index 3f9038c73..961dd3893 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_bytes-test.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: parse_bytes-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
@@ -65,7 +65,6 @@ main(int argc, char **argv)
     for (i = 0; i < sizeof(tests)/sizeof(tests[0]); ++i) {
 	char buf[256];
 	int val = parse_bytes (tests[i].str, tests[i].def_unit);
-	int len;
 
 	if (val != tests[i].val) {
 	    printf ("parse_bytes (%s, %s) = %d != %d\n",
@@ -75,7 +74,7 @@ main(int argc, char **argv)
 	    ++ret;
 	}
 	if (tests[i].canonicalp) {
-	    len = unparse_bytes (tests[i].val, buf, sizeof(buf));
+	    (void) unparse_bytes (tests[i].val, buf, sizeof(buf));
 	    if (strcmp (tests[i].str, buf) != 0) {
 		printf ("unparse_bytes (%d) = \"%s\" != \"%s\"\n",
 			tests[i].val, buf, tests[i].str);
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.c
index cb1391bd3..f28e57f85 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_bytes.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: parse_bytes.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.h b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.h
index e98c4827e..4d784c201 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_bytes.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_bytes.h,v 1.1.1.2 2011/04/14 14:09:30 elric Exp $	*/
+/*	$NetBSD: parse_bytes.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_reply-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_reply-test.c
index 997d0c5a1..fa7f969e1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_reply-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_reply-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_reply-test.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: parse_reply-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time-test.c
index e875fc8ba..2d1d27ad5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_time-test.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: parse_time-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -51,7 +51,8 @@ static struct testcase {
     { 8, 60,		"1 minute" },
     { 6, 3600,	 	"1 hour" },
     { 15, 3601,	 	"1 hour 1 second" },
-    { 16, 3602,	 	"1 hour 2 seconds" }
+    { 16, 3602,	 	"1 hour 2 seconds" },
+    { 9, 300,	 	"5 minutes" },
 };
 
 int
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.3 b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.3
index 6abc09f04..70ae00129 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.3
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: parse_time.3,v 1.1.1.3 2014/04/24 12:45:52 pettai Exp $
+.\"	$NetBSD: parse_time.3,v 1.2 2017/01/28 21:31:50 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -30,9 +30,9 @@
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
-.\" Id
+.\" Id: parse_time.3,v 1.3 2013/06/17 18:57:45 robert Exp 
 .\"
-.Dd October 31, 2004
+.Dd November 17, 2013
 .Dt PARSE_TIME 3
 .Os
 .Sh NAME
@@ -56,28 +56,28 @@ The roken library (libroken, -lroken)
 .Sh DESCRIPTION
 The
 .Fn parse_time
-function converts a the period of time specified in
+function converts the period of time specified
 into a number of seconds.
 The
 .Fa timespec
 can be any number of
 .Aq number unit
 pairs separated by comma and whitespace. The number can be
-negative. Number without explicit units are taken as being
+negative. Numbers without explicit units are taken as being
 .Fa def_unit .
 .Pp
 The
 .Fn unparse_time
 and
 .Fn unparse_time_approx
-does the opposite of
+do the opposite of
 .Fn parse_time ,
 that is they take a number of seconds and express that as human
-readable string.
+readable strings.
 .Fa unparse_time
 produces an exact time, while
 .Fa unparse_time_approx
-restricts the result to only include one units.
+restricts the result to include only one unit.
 .Pp
 .Fn print_time_table
 prints a descriptive list of available units on the passed file
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.c
index a34a2a6a2..0af4a048f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_time.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: parse_time.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.h b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.h
index 51211707e..9a7ac3502 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_time.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_time.h,v 1.1.1.2 2011/04/14 14:09:31 elric Exp $	*/
+/*	$NetBSD: parse_time.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.c b/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.c
index c41254433..21c31feec 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_units.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: parse_units.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.h b/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.h
index 961ec9d8b..af3d9ecb7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/parse_units.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: parse_units.h,v 1.1.1.2 2011/04/14 14:09:31 elric Exp $	*/
+/*	$NetBSD: parse_units.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/putenv.c b/crypto/external/bsd/heimdal/dist/lib/roken/putenv.c
index 9d5e7c466..a74f88035 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/putenv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/putenv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: putenv.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: putenv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/qsort.c b/crypto/external/bsd/heimdal/dist/lib/roken/qsort.c
index 93477427b..987d8ff15 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/qsort.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/qsort.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: qsort.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: qsort.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rand.c b/crypto/external/bsd/heimdal/dist/lib/roken/rand.c
index 91c0b5891..c8ae609a2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rand.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rand.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rand.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: rand.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
@@ -32,9 +32,14 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+#include <config.h>
 
 #include <krb5/roken.h>
 
+#ifdef HAVE_WIN32_RAND_S
+static int hasRand_s = 1;
+#endif
+
 void ROKEN_LIB_FUNCTION
 rk_random_init(void)
 {
@@ -45,6 +50,32 @@ rk_random_init(void)
 #elif defined(HAVE_RANDOM)
     srandom(time(NULL));
 #else
+# ifdef HAVE_WIN32_RAND_S
+    OSVERSIONINFO osInfo;
+
+    osInfo.dwOSVersionInfoSize = sizeof(osInfo);
+    hasRand_s =
+	(GetVersionEx(&osInfo)
+	  && ((osInfo.dwMajorVersion > 5) ||
+	       (osInfo.dwMajorVersion == 5) && (osInfo.dwMinorVersion >= 1)));
+# endif
     srand (time(NULL));
 #endif
 }
+
+#ifdef HAVE_WIN32_RAND_S
+unsigned int ROKEN_LIB_FUNCTION
+rk_random(void)
+{
+    if (hasRand_s) {
+	unsigned int n;
+	int code;
+
+	code = rand_s(&n);
+	if (code == 0)
+	    return n;
+    }
+
+    return rand();
+}
+#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rcmd.c b/crypto/external/bsd/heimdal/dist/lib/roken/rcmd.c
index 0eb00f1d5..b64c438b2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rcmd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rcmd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rcmd.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: rcmd.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/readv.c b/crypto/external/bsd/heimdal/dist/lib/roken/readv.c
index dc5af0662..ba5d7f8bc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/readv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/readv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: readv.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: readv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/realloc.c b/crypto/external/bsd/heimdal/dist/lib/roken/realloc.c
index 20856a69d..f73df08c4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/realloc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/realloc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: realloc.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: realloc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
@@ -38,6 +38,7 @@
 
 #include <stdlib.h>
 #include <krb5/roken.h>
+#undef realloc
 
 ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
 rk_realloc(void *ptr, size_t size)
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/recvmsg.c b/crypto/external/bsd/heimdal/dist/lib/roken/recvmsg.c
index 67f750bfd..ec7201ae6 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/recvmsg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/recvmsg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: recvmsg.c,v 1.1.1.1 2011/04/13 18:15:42 elric Exp $	*/
+/*	$NetBSD: recvmsg.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rename.c b/crypto/external/bsd/heimdal/dist/lib/roken/rename.c
index bbb9ef3f2..2aa092981 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rename.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rename.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rename.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: rename.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2010, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/resolve-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/resolve-test.c
index 8a3e5aad5..759b761c5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/resolve-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/resolve-test.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: resolve-test.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: resolve-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
- * Copyright (c) 1995 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2016 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -38,6 +38,7 @@
 
 #include <krb5/roken.h>
 #include <krb5/getarg.h>
+#include <assert.h>
 #ifdef HAVE_ARPA_NAMESER_H
 #include <arpa/nameser.h>
 #endif
@@ -46,11 +47,15 @@
 #endif
 #include <krb5/resolve.h>
 
+static int srv_rr_order = 1;
 static int loop_integer = 1;
 static int version_flag = 0;
 static int help_flag	= 0;
 
 static struct getargs args[] = {
+    {"srv-rr-order", 0,
+     arg_negative_flag,                 &srv_rr_order,
+     "do not test SRV RR ordering", NULL },
     {"loop",	0,	arg_integer,	&loop_integer,
      "loop resolving", NULL },
     {"version",	0,	arg_flag,	&version_flag,
@@ -69,6 +74,107 @@ usage (int ret)
     exit (ret);
 }
 
+#define NUMRRS 16
+
+static
+int
+test_rk_dns_srv_order(size_t run)
+{
+    struct rk_dns_reply reply;
+    struct rk_resource_record rrs[NUMRRS];
+    struct rk_resource_record *rr;
+    struct rk_srv_record srvs[NUMRRS];
+    size_t i, prio0;
+    int fail = 0;
+
+    (void) memset(&reply, 0, sizeof(reply));
+    (void) memset(srvs, 0, sizeof(srvs));
+    (void) memset(rrs, 0, sizeof(rrs));
+
+    /* Test with two equal weight zero SRV records */
+    rrs[0].type = rk_ns_t_srv;
+    rrs[0].u.srv = &srvs[0];
+    rrs[0].next = &rrs[1];
+    srvs[0].priority = 10;
+    srvs[0].weight = 0;
+
+    rrs[1].type = rk_ns_t_srv;
+    rrs[1].u.srv = &srvs[1];
+    rrs[1].next = NULL;
+    srvs[1].priority = 10;
+    srvs[1].weight = 0;
+    reply.head = &rrs[0];
+
+    rk_dns_srv_order(&reply);
+    assert(reply.head != NULL);
+    printf("%p %p\n", &rrs[0], rrs[0].next);
+
+    /*
+     * Test four priority groups with priority 1--5 and weigths 0--3 in the
+     * first two groups, and 1--4 in the last two groups.  Test multiple zero
+     * weights, by further coercing the weight to zero if <= run/2.
+     */
+    for (i = 0; i < NUMRRS; i++) {
+        rrs[i].type = rk_ns_t_srv;
+        rrs[i].u.srv = &srvs[i];
+        srvs[i].priority = 1 + i / 4;
+        srvs[i].weight = i % 4 + i / 8;
+        if (srvs[i].weight <= run/2)
+            srvs[i].weight = 0;
+    }
+    /* Shuffle the RRs */
+    for (i = 0; i < NUMRRS - 1; i++) {
+        struct rk_resource_record tmp;
+	size_t j = rk_random() % (NUMRRS - i);
+
+        if (j > 0) {
+            tmp = rrs[i+j];
+            rrs[i+j] = rrs[i];
+            rrs[i] = tmp;
+        }
+    }
+    for (i = 0; i < NUMRRS; i++)
+        rrs[i].next = &rrs[i + 1];
+    rrs[i - 1].next = NULL;
+    reply.head = &rrs[0];
+
+    for (i = 0, rr = reply.head; i < NUMRRS; i++) {
+        if (rr == NULL)
+            break;
+        printf("SRV RR order run %lu input: prio %lu weight %lu\n",
+               (unsigned long)run, (unsigned long)rr->u.srv->priority,
+               (unsigned long)rr->u.srv->weight);
+        rr = rr->next;
+    }
+
+    rk_dns_srv_order(&reply);
+    assert(reply.head != NULL);
+
+    /*
+     * After sorting, ensure monotone priority ordering with jumps by 1 at
+     * group boundaries.
+     */
+    prio0 = 0;
+    for (i = 0, rr = reply.head; i < NUMRRS; i++) {
+        if (rr == NULL)
+            break;
+        if (rr->u.srv->priority < prio0 ||
+	    (rr->u.srv->priority != prio0 &&
+	     (i % 4 != 0 || rr->u.srv->priority > prio0 + 1))) {
+            printf("SRV RR order run %lu failed\n", run);
+            fail = 1;
+        }
+	prio0 = rr->u.srv->priority;
+        printf("SRV RR order run %lu output: prio %lu weight %lu\n",
+               (unsigned long)run, (unsigned long)rr->u.srv->priority,
+               (unsigned long)rr->u.srv->weight);
+        rr = rr->next;
+    }
+    assert(i == NUMRRS);
+
+    return fail;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -77,14 +183,15 @@ main(int argc, char **argv)
     int optidx = 0, i, exit_code = 0;
 
     setprogname (argv[0]);
+    rk_random_init();
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
+    if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
 	usage (0);
 
-    if(version_flag){
+    if (version_flag) {
 	printf("some version\n");
 	exit(0);
     }
@@ -92,23 +199,38 @@ main(int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
-    if (argc != 2)
+    if (argc != 2 && argc != 0 && !srv_rr_order)
 	usage(1);
 
+    if (srv_rr_order) {
+        exit_code += test_rk_dns_srv_order(0);
+        exit_code += test_rk_dns_srv_order(1);
+        exit_code += test_rk_dns_srv_order(2);
+        exit_code += test_rk_dns_srv_order(3);
+        exit_code += test_rk_dns_srv_order(4);
+        exit_code += test_rk_dns_srv_order(5);
+    }
+
+    if (srv_rr_order && argc == 0)
+        exit(exit_code ? 1 : 0);
+
+    if (argc != 2)
+        usage(1);
+
     for (i = 0; i < loop_integer; i++) {
 
 	r = rk_dns_lookup(argv[0], argv[1]);
-	if(r == NULL){
+	if (r == NULL) {
 	    printf("No reply.\n");
 	    exit_code = 1;
 	    break;
 	}
-	if(r->q.type == rk_ns_t_srv)
+	if (r->q.type == rk_ns_t_srv)
 	    rk_dns_srv_order(r);
 
-	for(rr = r->head; rr;rr=rr->next){
+	for (rr = r->head; rr;rr=rr->next) {
 	    printf("%-30s %-5s %-6d ", rr->domain, rk_dns_type_to_string(rr->type), rr->ttl);
-	    switch(rr->type){
+	    switch (rr->type) {
 	    case rk_ns_t_ns:
 	    case rk_ns_t_cname:
 	    case rk_ns_t_ptr:
@@ -118,11 +240,11 @@ main(int argc, char **argv)
 		printf("%s\n", inet_ntoa(*rr->u.a));
 		break;
 	    case rk_ns_t_mx:
-	    case rk_ns_t_afsdb:{
+	    case rk_ns_t_afsdb: {
 		printf("%d %s\n", rr->u.mx->preference, rr->u.mx->domain);
 		break;
 	    }
-	    case rk_ns_t_srv:{
+	    case rk_ns_t_srv: {
 		struct rk_srv_record *srv = rr->u.srv;
 		printf("%d %d %d %s\n", srv->priority, srv->weight,
 		       srv->port, srv->target);
@@ -132,45 +254,47 @@ main(int argc, char **argv)
 		printf("%s\n", rr->u.txt);
 		break;
 	    }
-	    case rk_ns_t_sig : {
+	    case rk_ns_t_sig: {
 		struct rk_sig_record *sig = rr->u.sig;
 		const char *type_string = rk_dns_type_to_string (sig->type);
 
-		printf ("type %u (%s), algorithm %u, labels %u, orig_ttl %u, sig_expiration %u, sig_inception %u, key_tag %u, signer %s\n",
-			sig->type, type_string ? type_string : "",
-			sig->algorithm, sig->labels, sig->orig_ttl,
-			sig->sig_expiration, sig->sig_inception, sig->key_tag,
-			sig->signer);
+		printf("type %u (%s), algorithm %u, labels %u, orig_ttl %u, "
+		       "sig_expiration %u, sig_inception %u, key_tag %u, "
+		       "signer %s\n",
+		       sig->type, type_string ? type_string : "",
+		       sig->algorithm, sig->labels, sig->orig_ttl,
+		       sig->sig_expiration, sig->sig_inception, sig->key_tag,
+		       sig->signer);
 		break;
 	    }
-	    case rk_ns_t_key : {
+	    case rk_ns_t_key: {
 		struct rk_key_record *key = rr->u.key;
 
-		printf ("flags %u, protocol %u, algorithm %u\n",
-			key->flags, key->protocol, key->algorithm);
+		printf("flags %u, protocol %u, algorithm %u\n",
+		       key->flags, key->protocol, key->algorithm);
 		break;
 	    }
-	    case rk_ns_t_sshfp : {
+	    case rk_ns_t_sshfp: {
 		struct rk_sshfp_record *sshfp = rr->u.sshfp;
-		size_t i;
+		size_t j;
 
 		printf ("alg %u type %u length %lu data ", sshfp->algorithm,
 			sshfp->type,  (unsigned long)sshfp->sshfp_len);
-		for (i = 0; i < sshfp->sshfp_len; i++)
-		    printf("%02X", sshfp->sshfp_data[i]);
+		for (j = 0; j < sshfp->sshfp_len; j++)
+		    printf("%02X", sshfp->sshfp_data[j]);
 		printf("\n");
 
 		break;
 	    }
-	    case rk_ns_t_ds : {
+	    case rk_ns_t_ds: {
 		struct rk_ds_record *ds = rr->u.ds;
-		size_t i;
+		size_t j;
 
-		printf ("key tag %u alg %u type %u length %lu data ",
-			ds->key_tag, ds->algorithm, ds->digest_type,
-			(unsigned long)ds->digest_len);
-		for (i = 0; i < ds->digest_len; i++)
-		    printf("%02X", ds->digest_data[i]);
+		printf("key tag %u alg %u type %u length %lu data ",
+		       ds->key_tag, ds->algorithm, ds->digest_type,
+		       (unsigned long)ds->digest_len);
+		for (j = 0; j < ds->digest_len; j++)
+		    printf("%02X", ds->digest_data[j]);
 		printf("\n");
 
 		break;
@@ -183,5 +307,5 @@ main(int argc, char **argv)
 	rk_dns_free_data(r);
     }
 
-    return exit_code;
+    return exit_code ? 1 : 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/resolve.c b/crypto/external/bsd/heimdal/dist/lib/roken/resolve.c
index 8955cddf1..081a01b7e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/resolve.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/resolve.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: resolve.c,v 1.4 2014/04/24 14:49:43 pettai Exp $	*/
+/*	$NetBSD: resolve.c,v 1.5 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2006 Kungliga Tekniska Högskolan
@@ -661,40 +661,59 @@ rk_dns_srv_order(struct rk_dns_reply *r)
 
     headp = &r->head;
 
-    for(ss = srvs; ss < srvs + num_srv; ) {
-	int sum, rnd, count;
+    for (ss = srvs; ss < srvs + num_srv; ) {
+	int sum, zeros, rnd, count; /* zeros -> weight scaling */
 	struct rk_resource_record **ee, **tt;
-	/* find the last record with the same priority and count the
-           sum of all weights */
-	for(sum = 0, tt = ss; tt < srvs + num_srv; tt++) {
+
+	/*
+	 * find the last record with the same priority and count the sum of all
+	 * weights
+	 */
+	for (sum = 0, zeros = 0, tt = ss; tt < srvs + num_srv; tt++) {
 	    assert(*tt != NULL);
 	    if((*tt)->u.srv->priority != (*ss)->u.srv->priority)
 		break;
 	    sum += (*tt)->u.srv->weight;
+	    if ((*tt)->u.srv->weight == 0)
+		zeros++;
 	}
+	/* make sure scale (`zeros') is > 0 then scale out */
+	sum += zeros ? 1 : zeros++;
+	sum *= zeros;
 	ee = tt;
-	/* ss is now the first record of this priority and ee is the
-           first of the next */
-	while(ss < ee) {
-	    rnd = rk_random() % (sum + 1);
-	    for(count = 0, tt = ss; ; tt++) {
-		if(*tt == NULL)
-		    continue;
-		count += (*tt)->u.srv->weight;
-		if(count >= rnd)
+
+	/*
+	 * ss is now the first record of this priority and ee is the first of
+	 * the next or the first past the end of srvs
+	 */
+	while (ss < ee) {
+	    rnd = rk_random() % sum + 1;
+	    for (count = 0, tt = ss; tt < ee; tt++) {
+		if (*tt == NULL)
+		    continue;   /* this one's already been picked */
+		if ((*tt)->u.srv->weight == 0)
+		    count++;
+		else
+		    count += (*tt)->u.srv->weight * zeros;
+		if (count >= rnd)
 		    break;
 	    }
-
 	    assert(tt < ee);
 
-	    /* insert the selected record at the tail (of the head) of
-               the list */
+	    /* push the selected record */
 	    (*tt)->next = *headp;
 	    *headp = *tt;
 	    headp = &(*tt)->next;
-	    sum -= (*tt)->u.srv->weight;
+	    /*
+	     * reduce the sum so the next iteration is sure to reach the random
+	     * total after examining all the remaining records.
+	     */
+	    if ((*tt)->u.srv->weight == 0)
+		sum--;
+	    else
+		sum -= (*tt)->u.srv->weight * zeros;
 	    *tt = NULL;
-	    while(ss < ee && *ss == NULL)
+	    while (ss < ee && *ss == NULL)
 		ss++;
 	}
     }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/resolve.h b/crypto/external/bsd/heimdal/dist/lib/roken/resolve.h
index 6e3217d6d..44b429480 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/resolve.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/resolve.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: resolve.h,v 1.1.1.2 2011/04/14 14:09:31 elric Exp $	*/
+/*	$NetBSD: resolve.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rkpty.c b/crypto/external/bsd/heimdal/dist/lib/roken/rkpty.c
index 9ab0281bc..9baf5f1e5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rkpty.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rkpty.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rkpty.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: rkpty.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -101,7 +101,7 @@ open_pty(void)
     printf("implement open_pty\n");
     exit(77);
 #endif
-#if defined(HAVE_OPENPTY) || defined(__linux) || defined(__osf__) /* XXX */
+#if defined(HAVE_OPENPTY) || defined(__osf__) /* XXX */
     if(openpty(&master, &slave, line, 0, 0) == 0)
 	return;
 #endif /* HAVE_OPENPTY .... */
@@ -235,7 +235,7 @@ eval_parent(pid_t pid)
 		     c->str, c->lineno);
 	    else if (alarmset)
 		errx(1, "got a signal %d waiting for %s (line %u)",
-		     alarmset, c->str, c->lineno);
+		     (int)alarmset, c->str, c->lineno);
 	    if (sret <= 0)
 		errx(1, "end command while waiting for %s (line %u)",
 		     c->str, c->lineno);
@@ -307,9 +307,9 @@ eval_parent(pid_t pid)
 
 static struct getargs args[] = {
     { "timeout", 	't', arg_integer, &timeout, "timout", "seconds" },
-    { "verbose", 	'v', arg_counter, &verbose, "verbose debugging" },
-    { "version",	0, arg_flag,	&version_flag, "print version" },
-    { "help",		0, arg_flag,	&help_flag, NULL }
+    { "verbose", 	'v', arg_counter, &verbose, "verbose debugging", NULL },
+    { "version",	0, arg_flag,	&version_flag, "print version", NULL },
+    { "help",		0, arg_flag,	&help_flag, NULL, NULL }
 };
 
 static void
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/roken-common.h b/crypto/external/bsd/heimdal/dist/lib/roken/roken-common.h
index 56daab592..dd0002bdd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/roken-common.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/roken-common.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken-common.h,v 1.1.1.2 2011/04/14 14:09:31 elric Exp $	*/
+/*	$NetBSD: roken-common.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2005 Kungliga Tekniska Högskolan
@@ -124,7 +124,15 @@
 #define O_ACCMODE	003
 #endif
 
-#ifndef _WIN32
+#ifndef O_NOFOLLOW
+#define O_NOFOLLOW 0
+#endif
+
+#ifdef _WIN32
+
+#define _PATH_DEVNULL "\\\\.\\NUL"
+
+#else
 
 #ifndef _PATH_DEV
 #define _PATH_DEV "/dev/"
@@ -153,7 +161,11 @@
 #endif	/* !_WIN32 */
 
 #ifndef PATH_MAX
+#ifdef MAX_PATH
 #define PATH_MAX MAX_PATH
+#else
+#define PATH_MAX 4096
+#endif
 #endif
 
 #ifndef RETSIGTYPE
@@ -403,6 +415,10 @@ socket_set_debug (rk_socket_t);
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 socket_set_tos (rk_socket_t, int);
 
+#define socket_set_nonblocking rk_socket_set_nonblocking
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+socket_set_nonblocking(rk_socket_t, int);
+
 #define socket_set_reuseaddr rk_socket_set_reuseaddr
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 socket_set_reuseaddr (rk_socket_t, int);
@@ -454,7 +470,7 @@ free_environment(char **);
 #define warnerr rk_warnerr
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 rk_warnerr(int doerrno, const char *fmt, va_list ap)
-    __attribute__ ((format (printf, 2, 0)));
+    __attribute__ ((__format__ (__printf__, 2, 0)));
 
 ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
 rk_realloc(void *, size_t);
@@ -466,7 +482,7 @@ rk_strpoolcollect(struct rk_strpool *);
 
 ROKEN_LIB_FUNCTION struct rk_strpool * ROKEN_LIB_CALL
 rk_strpoolprintf(struct rk_strpool *, const char *, ...)
-    __attribute__ ((format (printf, 2, 3)));
+    __attribute__ ((__format__ (__printf__, 2, 3)));
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 rk_strpoolfree(struct rk_strpool *);
@@ -489,12 +505,20 @@ rk_cloexec_file(FILE *);
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
 rk_cloexec_dir(DIR *);
 
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+rk_cloexec_socket(rk_socket_t);
+
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-ct_memcmp(const void *, const void *, size_t);
+ct_memcmp(const volatile void * volatile,
+          const volatile void * volatile,
+          size_t);
 
 void ROKEN_LIB_FUNCTION
 rk_random_init(void);
 
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_mkdir(const char *, mode_t);
+
 ROKEN_CPP_END
 
 #endif /* __ROKEN_COMMON_H__ */
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/roken.awk b/crypto/external/bsd/heimdal/dist/lib/roken/roken.awk
index 228ed9b52..4f849e6c0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/roken.awk
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/roken.awk
@@ -9,6 +9,9 @@ BEGIN {
 	print "#ifdef HAVE_SYS_SOCKET_H"
 	print "#include <sys/socket.h>"
 	print "#endif"
+	print "#ifdef HAVE_ERRNO_H"
+	print "#include <errno.h>"
+	print "#endif"
 	print ""
 	print "int main(int argc, char **argv)"
 	print "{"
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/roken.h.in b/crypto/external/bsd/heimdal/dist/lib/roken/roken.h.in
index ab8c8741a..d5c7c0177 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/roken.h.in
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/roken.h.in
@@ -3,22 +3,22 @@
  * Copyright (c) 1995-2005 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
- * 
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 
+ *
  * 3. Neither the name of the Institute nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -32,6 +32,12 @@
  * SUCH DAMAGE.
  */
 
+#if defined(_WIN32) && _MSC_VER >= 1400
+/* _CRT_RAND_S must be defined before including stdlib.h */
+# define _CRT_RAND_S
+# define HAVE_WIN32_RAND_S 1
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
@@ -39,6 +45,7 @@
 #include <stdint.h>
 #endif
 #include <string.h>
+#include <limits.h>
 #include <signal.h>
 
 #ifndef ROKEN_LIB_FUNCTION
@@ -65,10 +72,8 @@
 #include <ws2tcpip.h>
 
 /*
- * error codes for inet_ntop/inet_pton 
+ * error codes for inet_ntop/inet_pton
  */
-#define EAFNOSUPPORT WSAEAFNOSUPPORT
-
 typedef SOCKET rk_socket_t;
 
 #define rk_closesocket(x) closesocket(x)
@@ -79,23 +84,6 @@ typedef SOCKET rk_socket_t;
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL rk_SOCK_IOCTL(SOCKET s, long cmd, int * argp);
 
-/* Microsoft VC 2010 POSIX definitions */
-#ifndef ENOTSOCK
-#define ENOTSOCK		128
-#endif
-#ifndef ENOTSUP
-#define ENOTSUP                 129
-#endif
-#ifndef EOVERFLOW
-#define EOVERFLOW               132
-#endif
-#ifndef ETIMEDOUT
-#define ETIMEDOUT               138
-#endif
-#ifndef EWOULDBLOCK
-#define EWOULDBLOCK             140
-#endif
-
 #define rk_SOCK_INIT() rk_WSAStartup()
 #define rk_SOCK_EXIT() rk_WSACleanup()
 
@@ -116,13 +104,17 @@ typedef int rk_socket_t;
 #define rk_SOCK_INIT() 0
 #define rk_SOCK_EXIT() do { } while(0)
 
-#endif
+#endif  /* WinSock */
 
 #ifndef IN_LOOPBACKNET
 #define IN_LOOPBACKNET 127
 #endif
 
 #ifdef _MSC_VER
+#ifndef HAVE_STDINT_H
+#include <intsafe.h>
+#endif
+
 /* Declarations for Microsoft Visual C runtime on Windows */
 
 #include<process.h>
@@ -196,6 +188,9 @@ struct sockaddr_dl;
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
+#ifdef HAVE_SYS_ERRNO_H
+#include <sys/errno.h>
+#endif
 #ifdef HAVE_SYS_BITYPES_H
 #include <sys/bitypes.h>
 #endif
@@ -274,6 +269,10 @@ struct sockaddr_dl;
 #include <dirent.h>
 #endif
 
+#ifdef HAVE_DIRECT_H
+#include <direct.h>
+#endif
+
 #ifdef BACKSLASH_PATH_DELIM
 #define rk_PATH_DELIM '\\'
 #endif
@@ -367,6 +366,49 @@ rk_vsnprintf (char *str, size_t sz, const char *format, va_list args);
  S_ISBLK(m)
 */
 
+/* The following symbolic constants are provided for rk_mkdir mode */
+
+#define S_IRWXU 00700 /* user (file owner) has read, write and execute permission */
+#define S_IRUSR 00400 /* user has read permission */
+#define S_IWUSR 00200 /* user has write permission */
+#define S_IXUSR 00100 /* user has execute permission */
+#define S_IRWXG 00070 /* group has read, write and execute permission */
+#define S_IRGRP 00040 /* group has read permission */
+#define S_IWGRP 00020 /* group has write permission */
+#define S_IXGRP 00010 /* group has execute permission */
+#define S_IRWXO 00007 /* others have read, write and execute permission */
+#define S_IROTH 00004 /* others have read permission */
+#define S_IWOTH 00002 /* others have write permission */
+#define S_IXOTH 00001 /* others have execute permission */
+
+#if !defined(ROKEN_NO_DEFINE_ALLOCATORS)
+/* Ensure that a common memory allocator is used by all */
+#define calloc  rk_calloc
+#define free    rk_free
+#define malloc  rk_malloc
+#define realloc rk_realloc
+#define strdup  rk_strdup
+#define wcsdup  rk_wcsdup
+#endif
+
+ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
+rk_calloc(size_t, size_t);
+
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+rk_free(void *);
+
+ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
+rk_malloc(size_t);
+
+ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
+rk_realloc(void *, size_t);
+
+ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL
+rk_strdup(const char *);
+
+ROKEN_LIB_FUNCTION unsigned short * ROKEN_LIB_CALL
+rk_wcsdup(const unsigned short *);
+
 #endif  /* _MSC_VER */
 
 #ifdef HAVE_WINSOCK
@@ -429,16 +471,16 @@ ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL endusershell(void);
 #endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
      rk_snprintf (char *, size_t, const char *, ...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
 #endif
 
 #if !defined(HAVE_VSNPRINTF) || defined(NEED_VSNPRINTF_PROTO)
 #ifndef HAVE_VSNPRINTF
 #define vsnprintf rk_vsnprintf
 #endif
-ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL 
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
      rk_vsnprintf (char *, size_t, const char *, va_list)
-     __attribute__((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
 #endif
 
 #if !defined(HAVE_ASPRINTF) || defined(NEED_ASPRINTF_PROTO)
@@ -447,7 +489,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 #endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
      rk_asprintf (char **, const char *, ...)
-     __attribute__ ((format (printf, 2, 3)));
+     __attribute__ ((__format__ (__printf__, 2, 3)));
 #endif
 
 #if !defined(HAVE_VASPRINTF) || defined(NEED_VASPRINTF_PROTO)
@@ -456,7 +498,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 #endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
     rk_vasprintf (char **, const char *, va_list)
-     __attribute__((format (printf, 2, 0)));
+     __attribute__ ((__format__ (__printf__, 2, 0)));
 #endif
 
 #if !defined(HAVE_ASNPRINTF) || defined(NEED_ASNPRINTF_PROTO)
@@ -465,7 +507,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 #endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
     rk_asnprintf (char **, size_t, const char *, ...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
 #endif
 
 #if !defined(HAVE_VASNPRINTF) || defined(NEED_VASNPRINTF_PROTO)
@@ -474,7 +516,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 #endif
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
     vasnprintf (char **, size_t, const char *, va_list)
-     __attribute__((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
 #endif
 
 #ifndef HAVE_STRDUP
@@ -601,6 +643,20 @@ ROKEN_LIB_FUNCTION struct passwd * ROKEN_LIB_CALL k_getpwnam (const char *);
 ROKEN_LIB_FUNCTION struct passwd * ROKEN_LIB_CALL k_getpwuid (uid_t);
 #endif
 
+#ifdef POSIX_GETPWNAM_R
+#define rk_getpwnam_r(_n, _pw, _b, _sz, _pwd) getpwnam_r(_n, _pw, _b, _sz, _pwd)
+#else
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwnam_r(const char *, struct passwd *, char *, size_t, struct passwd **);
+#endif
+
+#ifdef POSIX_GETPWUID_R
+#define rk_getpwuid_r(_u, _pw, _b, _sz, _pwd) getpwuid_r(_u, _pw, _b, _sz, _pwd)
+#else
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
+rk_getpwuid_r(uid_t, struct passwd *, char *, size_t, struct passwd **);
+#endif
+
 ROKEN_LIB_FUNCTION const char * ROKEN_LIB_CALL get_default_username (void);
 
 #ifndef HAVE_SETEUID
@@ -648,6 +704,13 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL rk_rename(const char *, const char *);
 #define rk_rename(__rk_rn_from,__rk_rn_to) rename(__rk_rn_from,__rk_rn_to)
 #endif
 
+#ifdef MKDIR_DOES_NOT_HAVE_MODE
+#define mkdir rk_mkdir
+#else
+#define rk_mkdir(__rk_rn_name, __rk_rn_mode) mkdir(__rk_rn_name,__rk_rn_mode)
+#endif
+
+
 #if !defined(HAVE_DAEMON) || defined(NEED_DAEMON_PROTO)
 #ifndef HAVE_DAEMON
 #define daemon rk_daemon
@@ -677,7 +740,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL innetgr(const char*, const char*,
 
 #ifndef HAVE_IRUSEROK
 #define iruserok rk_iruserok
-ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL iruserok(unsigned, int, 
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL iruserok(unsigned, int,
     const char *, const char *);
 #endif
 
@@ -700,13 +763,15 @@ ROKEN_LIB_FUNCTION ssize_t ROKEN_LIB_CALL
 readv(int, const struct iovec *, int);
 #endif
 
-#ifndef HAVE_PIDFILE
 #ifdef NO_PIDFILES
-#define pidfile(x) ((void) 0)
+#define rk_pidfile(x) ((void) 0)
 #else
-#define pidfile rk_pidfile
-ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL pidfile (const char*);
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL rk_pidfile (const char*);
 #endif
+
+#ifndef HAVE_BSWAP64
+#define bswap64 rk_bswap64
+ROKEN_LIB_FUNCTION uint64_t ROKEN_LIB_CALL bswap64(uint64_t);
 #endif
 
 #ifndef HAVE_BSWAP32
@@ -760,6 +825,9 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL roken_vconcat (char *, size_t, va_list);
 ROKEN_LIB_FUNCTION size_t ROKEN_LIB_CALL
     roken_vmconcat (char **, size_t, va_list);
 
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL roken_detach_prep(int, char **, char *);
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL roken_detach_finish(const char *, int);
+
 ROKEN_LIB_FUNCTION ssize_t ROKEN_LIB_CALL
     net_write (rk_socket_t, const void *, size_t);
 
@@ -923,6 +991,9 @@ gai_strerror(int);
 ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
 sleep(unsigned int seconds);
 
+ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
+usleep(unsigned int useconds);
+
 #endif
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
@@ -932,7 +1003,7 @@ getnameinfo_verified(const struct sockaddr *, socklen_t,
 		     int);
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-roken_getaddrinfo_hostspec(const char *, int, struct addrinfo **); 
+roken_getaddrinfo_hostspec(const char *, int, struct addrinfo **);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 roken_getaddrinfo_hostspec2(const char *, int, int, struct addrinfo **);
 
@@ -979,7 +1050,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 roken_gethostby_setup(const char*, const char*);
 ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL
 roken_gethostbyname(const char*);
-ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL 
+ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL
 roken_gethostbyaddr(const void*, size_t, int);
 
 #ifdef GETSERVBYNAME_PROTO_COMPATIBLE
@@ -1026,6 +1097,22 @@ ROKEN_LIB_FUNCTION struct tm * ROKEN_LIB_CALL
 localtime_r(const time_t *, struct tm *);
 #endif
 
+#if !defined(HAVE_STRTOLL) || defined(NEED_STRTOLL_PROTO)
+#ifndef HAVE_STRTOLL
+#define strtoll rk_strtoll
+#endif
+ROKEN_LIB_FUNCTION long long ROKEN_LIB_CALL
+strtoll(const char * nptr, char ** endptr, int base);
+#endif
+
+#if !defined(HAVE_STRTOULL) || defined(NEED_STRTOULL_PROTO)
+#ifndef HAVE_STRTOULL
+#define strtoull rk_strtoull
+#endif
+ROKEN_LIB_FUNCTION unsigned long long ROKEN_LIB_CALL
+strtoull(const char * nptr, char ** endptr, int base);
+#endif
+
 #if !defined(HAVE_STRSVIS) || defined(NEED_STRSVIS_PROTO)
 #ifndef HAVE_STRSVIS
 #define strsvis rk_strsvis
@@ -1108,12 +1195,23 @@ void
 rk_qsort(void *, size_t, size_t, int (*)(const void *, const void *));
 #endif
 
+#ifndef HAVE_MEMSET_S
+#define memset_s rk_memset_s
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL memset_s(void *s, size_t smax,
+					int c, size_t n);
+#endif
+
 #if defined(HAVE_ARC4RANDOM)
-#define rk_random() arc4random()
+# define rk_random() arc4random()
 #elif defined(HAVE_RANDOM)
-#define rk_random() random()
+# define rk_random() random()
 #else
-#define rk_random() rand()
+# ifdef HAVE_WIN32_RAND_S
+ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
+rk_random(void);
+# else
+#  define rk_random() rand()
+# endif
 #endif
 
 #ifndef HAVE_TDELETE
@@ -1135,6 +1233,33 @@ rk_qsort(void *, size_t, size_t, int (*)(const void *, const void *));
 int ROKEN_LIB_FUNCTION rk_socket(int, int, int);
 #endif
 
+/* Microsoft VC 2010 POSIX definitions */
+#ifndef EAFNOSUPPORT
+#define EAFNOSUPPORT            102
+#endif
+#ifndef EINPROGRESS
+#define EINPROGRESS             112
+#endif
+#ifndef ELOOP
+#define ELOOP			114
+#endif
+#ifndef ENOTSOCK
+#define ENOTSOCK		128
+#endif
+#ifndef ENOTSUP
+#define ENOTSUP                 129
+#endif
+#ifndef EOVERFLOW
+#define EOVERFLOW               132
+#endif
+#ifndef ETIMEDOUT
+#define ETIMEDOUT               138
+#endif
+#ifndef EWOULDBLOCK
+#define EWOULDBLOCK             140
+#endif
+
+
 #ifdef SOCKET_WRAPPER_REPLACE
 #include <socket_wrapper.h>
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/roken_gethostby.c b/crypto/external/bsd/heimdal/dist/lib/roken/roken_gethostby.c
index 582d89e1b..c5f704ef8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/roken_gethostby.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/roken_gethostby.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_gethostby.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: roken_gethostby.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
@@ -79,7 +79,8 @@ setup_int(const char *proxy_host, short proxy_port,
 	if(make_address(dns_host, &dns_addr.sin_addr) != 0)
 	    return -1;
 	dns_addr.sin_port = htons(dns_port);
-	asprintf(&dns_req, "%s", dns_path);
+	if (asprintf(&dns_req, "%s", dns_path) < 0)
+	    return -1;
     }
     dns_addr.sin_family = AF_INET;
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.3 b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.3
index ff4b0e9c9..368cd4274 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.3
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: rtbl.3,v 1.3 2014/04/24 13:45:34 pettai Exp $
+.\"	$NetBSD: rtbl.3,v 1.4 2017/01/28 21:31:50 christos Exp $
 .\"
 .\" Copyright (c) 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.c b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.c
index 0b1764b16..b3f239a9c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rtbl.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: rtbl.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000, 2002, 2004 Kungliga Tekniska Högskolan
@@ -36,6 +36,7 @@
 #include <config.h>
 
 #include <krb5/roken.h>
+#include <ctype.h>
 #include <krb5/rtbl.h>
 
 struct column_entry {
@@ -170,7 +171,7 @@ rtbl_new_row(rtbl_t table)
 	if(table->columns[c]->num_rows == max_rows)
 	    continue;
 	tmp = realloc(table->columns[c]->rows,
-		      max_rows * sizeof(table->columns[c]->rows));
+		      max_rows * sizeof(table->columns[c]->rows[0]));
 	if(tmp == NULL)
 	    return ENOMEM;
 	table->columns[c]->rows = tmp;
@@ -190,7 +191,7 @@ column_compute_width (rtbl_t table, struct column_data *column)
     if(table->flags & RTBL_HEADER_STYLE_NONE)
 	column->width = 0;
     else
-	column->width = strlen (column->header);
+	column->width = (int)strlen (column->header);
     for (i = 0; i < column->num_rows; i++)
 	column->width = max (column->width, (int) strlen (column->rows[i].data));
 }
@@ -364,6 +365,18 @@ rtbl_add_column_entryv (rtbl_t table, const char *column, const char *fmt, ...)
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_format (rtbl_t table, FILE * f)
 {
+    char *str = rtbl_format_str(table);
+    if (str == NULL)
+	return ENOMEM;
+    fprintf(f, "%s", str);
+    free(str);
+    return 0;
+}
+
+static char *
+rtbl_format_pretty(rtbl_t table)
+{
+    struct rk_strpool *p = NULL;
     size_t i, j;
 
     for (i = 0; i < table->num_columns; i++)
@@ -373,16 +386,18 @@ rtbl_format (rtbl_t table, FILE * f)
 	    struct column_data *c = table->columns[i];
 
 	    if(table->column_separator != NULL && i > 0)
-		fprintf (f, "%s", table->column_separator);
-	    fprintf (f, "%s", get_column_prefix (table, c));
-	    if(i == table->num_columns - 1 && c->suffix == NULL)
+		p = rk_strpoolprintf(p, "%s", table->column_separator);
+	    p = rk_strpoolprintf(p, "%s", get_column_prefix (table, c));
+	    if (c == NULL) {
+		/* do nothing if no column */
+	    } else if(i == table->num_columns - 1 && c->suffix == NULL)
 		/* last column, so no need to pad with spaces */
-		fprintf (f, "%-*s", 0, c->header);
+		p = rk_strpoolprintf(p, "%-*s", 0, c->header);
 	    else
-		fprintf (f, "%-*s", (int)c->width, c->header);
-	    fprintf (f, "%s", get_column_suffix (table, c));
+		p = rk_strpoolprintf(p, "%-*s", (int)c->width, c->header);
+	    p = rk_strpoolprintf(p, "%s", get_column_suffix (table, c));
 	}
-	fprintf (f, "\n");
+	p = rk_strpoolprintf(p, "\n");
     }
 
     for (j = 0;; j++) {
@@ -405,7 +420,7 @@ rtbl_format (rtbl_t table, FILE * f)
 	    struct column_data *c = table->columns[i];
 
 	    if(table->column_separator != NULL && i > 0)
-		fprintf (f, "%s", table->column_separator);
+		p = rk_strpoolprintf(p, "%s", table->column_separator);
 
 	    w = c->width;
 
@@ -416,16 +431,72 @@ rtbl_format (rtbl_t table, FILE * f)
 		else
 		    w = -w;
 	    }
-	    fprintf (f, "%s", get_column_prefix (table, c));
+	    p = rk_strpoolprintf(p, "%s", get_column_prefix (table, c));
 	    if (c->num_rows <= j)
-		fprintf (f, "%*s", w, "");
+		p = rk_strpoolprintf(p, "%*s", w, "");
 	    else
-		fprintf (f, "%*s", w, c->rows[j].data);
-	    fprintf (f, "%s", get_column_suffix (table, c));
+		p = rk_strpoolprintf(p, "%*s", w, c->rows[j].data);
+	    p = rk_strpoolprintf(p, "%s", get_column_suffix (table, c));
 	}
-	fprintf (f, "\n");
+	p = rk_strpoolprintf(p, "\n");
     }
-    return 0;
+
+    return rk_strpoolcollect(p);
+}
+
+static char *
+rtbl_format_json(rtbl_t table)
+{
+    struct rk_strpool *p = NULL;
+    size_t i, j;
+    int comma;
+
+    p = rk_strpoolprintf(p, "[");
+    for (j = 0;; j++) {
+	int flag = 0;
+
+	/* are there any more rows left? */
+	for (i = 0; flag == 0 && i < table->num_columns; ++i) {
+	    struct column_data *c = table->columns[i];
+
+	    if (c->num_rows > j) {
+		++flag;
+		break;
+	    }
+	}
+	if (flag == 0)
+	    break;
+
+	p = rk_strpoolprintf(p, "%s{", j > 0 ? "," : "");
+
+	comma = 0;
+	for (i = 0; i < table->num_columns; i++) {
+	    struct column_data *c = table->columns[i];
+
+	    if (c->num_rows > j) {
+		char *header = c->header;
+		while (isspace((int)header[0])) /* trim off prefixed whitespace */
+		    header++;
+		p = rk_strpoolprintf(p, "%s\"%s\" : \"%s\"",
+				     comma ? "," : "", header,
+				     c->rows[j].data);
+		comma = 1;
+	    }
+	}
+	p = rk_strpoolprintf(p, "}");
+    }
+    p = rk_strpoolprintf(p, "]");
+
+    return rk_strpoolcollect(p);
+}
+
+ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL
+rtbl_format_str (rtbl_t table)
+{
+    if (table->flags & RTBL_JSON)
+	return rtbl_format_json(table);
+
+    return rtbl_format_pretty(table);
 }
 
 #ifdef TEST
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.h b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.h
index 707c1498d..1d2dfae97 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/rtbl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rtbl.h,v 1.1.1.2 2011/04/14 14:09:31 elric Exp $	*/
+/*	$NetBSD: rtbl.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000,2004 Kungliga Tekniska Högskolan
@@ -63,6 +63,7 @@ typedef struct rtbl_data *rtbl_t;
 
 /* flags */
 #define RTBL_HEADER_STYLE_NONE	1
+#define RTBL_JSON		2
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_add_column (rtbl_t, const char*, unsigned int);
@@ -73,14 +74,14 @@ rtbl_add_column_by_id (rtbl_t, unsigned int, const char*, unsigned int);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_add_column_entryv_by_id (rtbl_t table, unsigned int id,
 			      const char *fmt, ...)
-	__attribute__ ((format (printf, 3, 0)));
+	__attribute__ ((__format__ (__printf__, 3, 0)));
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_add_column_entry (rtbl_t, const char*, const char*);
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_add_column_entryv (rtbl_t, const char*, const char*, ...)
-	__attribute__ ((format (printf, 3, 0)));
+	__attribute__ ((__format__ (__printf__, 3, 0)));
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_add_column_entry_by_id (rtbl_t, unsigned int, const char*);
@@ -94,6 +95,9 @@ rtbl_destroy (rtbl_t);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 rtbl_format (rtbl_t, FILE*);
 
+ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL
+rtbl_format_str (rtbl_t);
+
 ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
 rtbl_get_flags (rtbl_t);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/sendmsg.c b/crypto/external/bsd/heimdal/dist/lib/roken/sendmsg.c
index 85d016ea2..d929fd018 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/sendmsg.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/sendmsg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sendmsg.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: sendmsg.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/setegid.c b/crypto/external/bsd/heimdal/dist/lib/roken/setegid.c
index c9e5e4bfc..5ac87ba29 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/setegid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/setegid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: setegid.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: setegid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/setenv.c b/crypto/external/bsd/heimdal/dist/lib/roken/setenv.c
index 88e858efa..92167f0e4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/setenv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/setenv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: setenv.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: setenv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/seteuid.c b/crypto/external/bsd/heimdal/dist/lib/roken/seteuid.c
index 5e09da925..2141aad7c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/seteuid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/seteuid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: seteuid.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: seteuid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/setprogname.c b/crypto/external/bsd/heimdal/dist/lib/roken/setprogname.c
index c107e3124..bac804fcf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/setprogname.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/setprogname.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: setprogname.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: setprogname.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/signal.c b/crypto/external/bsd/heimdal/dist/lib/roken/signal.c
index 6b7fe66f2..0e7d07f69 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/signal.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/signal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: signal.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: signal.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec.c b/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec.c
index 9e2aeddeb..7932aa0d5 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: simple_exec.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: simple_exec.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2001, 2004 Kungliga Tekniska Högskolan
@@ -146,17 +146,31 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 pipe_execv(FILE **stdin_fd, FILE **stdout_fd, FILE **stderr_fd,
 	   const char *file, ...)
 {
-    int in_fd[2], out_fd[2], err_fd[2];
+    int in_fd[2] = {-1, -1};
+    int out_fd[2] = {-1, -1};
+    int err_fd[2] = {-1, -1};
     pid_t pid;
     va_list ap;
     char **argv;
+    int ret = 0;
 
     if(stdin_fd != NULL)
-	pipe(in_fd);
-    if(stdout_fd != NULL)
-	pipe(out_fd);
-    if(stderr_fd != NULL)
-	pipe(err_fd);
+	ret = pipe(in_fd);
+    if(ret != -1 && stdout_fd != NULL)
+	ret = pipe(out_fd);
+    if(ret != -1 && stderr_fd != NULL)
+	ret = pipe(err_fd);
+
+    if (ret == -1) {
+	close(in_fd[0]);
+	close(in_fd[1]);
+	close(out_fd[0]);
+	close(out_fd[1]);
+	close(err_fd[0]);
+	close(err_fd[1]);
+	return SE_E_UNSPECIFIED;
+    }
+
     pid = fork();
     switch(pid) {
     case 0:
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec_w32.c b/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec_w32.c
index 5f6bad45b..531f72f80 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec_w32.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/simple_exec_w32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: simple_exec_w32.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: simple_exec_w32.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
@@ -186,6 +186,7 @@ collect_commandline(const char * fn, va_list * ap)
 		    free(cmd);
 		return NULL;
 	    }
+	    cmd = nc;
 	}
 
 	if (cmd == NULL)
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/sleep.c b/crypto/external/bsd/heimdal/dist/lib/roken/sleep.c
index f863d1d93..458dc2f02 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/sleep.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/sleep.c
@@ -1,7 +1,7 @@
-/*	$NetBSD: sleep.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: sleep.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
- * Copyright (c) 2009, Secure Endpoints Inc.
+ * Copyright (c) 2009, 2014, Secure Endpoints Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -42,6 +42,16 @@
 ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
 sleep(unsigned int seconds)
 {
-    SleepEx(1000 * (DWORD) seconds, FALSE);
+    if (SleepEx(1000 * (DWORD) seconds, FALSE) != 0)
+	return -1;
+    return 0;
+}
+
+/* We can only sleep in millisecond increments */
+ROKEN_LIB_FUNCTION unsigned int ROKEN_LIB_CALL
+usleep(unsigned int useconds)
+{
+    if (SleepEx((DWORD)(useconds / 1000), FALSE) != 0)
+	return -1;
     return 0;
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/snprintf-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/snprintf-test.c
index b9b4a0b0f..751ecbc4b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/snprintf-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/snprintf-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: snprintf-test.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: snprintf-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
@@ -36,6 +36,9 @@
 #include <krb5/roken.h>
 #include <limits.h>
 
+extern int rk_snprintf(char *, size_t, const char *, ...);
+extern int rk_vsnprintf(char *, size_t, const char *, va_list);
+
 static int
 try (const char *format, ...)
 {
@@ -134,9 +137,10 @@ cmp_with_sprintf_long_long (void)
 {
     int tot = 0;
     long long long_long_values[] = {
-	((long long)LONG_MIN) -1, LONG_MIN, -17, -1,
-	0,
-	1, 17, 4711, 65535, LONG_MAX, ((long long)LONG_MAX) + 1};
+	((long long)LONG_MIN) - (sizeof(long long) > sizeof(long)),
+        LONG_MIN, -17, -1, 0, 1, 17, 4711, 65535, LONG_MAX,
+        ((long long)LONG_MAX) + (sizeof(long long) > sizeof(long))
+    };
     int i;
 
     for (i = 0; i < sizeof(long_long_values) / sizeof(long_long_values[0]); ++i) {
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/snprintf.c b/crypto/external/bsd/heimdal/dist/lib/roken/snprintf.c
index 450ebba36..663f52598 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/snprintf.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/snprintf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: snprintf.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: snprintf.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan
@@ -119,6 +119,10 @@ typedef unsigned long u_longest;
 typedef long longest;
 #endif
 
+#ifndef HAVE_UINTPTR_T
+typedef u_longest uintptr_t;
+#endif
+
 
 
 static size_t
@@ -274,7 +278,7 @@ append_string (struct snprintf_state *state,
 	len += pad(state, width, ' ');
 
     if (prec != -1) {
-	while (*arg && prec--) {
+	while (prec-- && *arg) {
 	    (*state->append_char) (state, *arg++);
 	    ++len;
 	}
@@ -500,7 +504,7 @@ xyzprintf (struct snprintf_state *state, const char *char_format, va_list ap)
 		break;
 	    }
 	    case 'p' : {
-		u_longest arg = (u_longest)va_arg(ap, void*);
+		uintptr_t arg = (uintptr_t)va_arg(ap, void*);
 
 		len += append_number (state, arg, 0x10, "0123456789ABCDEF",
 				      width, prec, flags, 0);
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/socket.c b/crypto/external/bsd/heimdal/dist/lib/roken/socket.c
index a73e68e99..b1bbfac30 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/socket.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/socket.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: socket.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: socket.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan
@@ -261,6 +261,28 @@ socket_set_tos (rk_socket_t sock, int tos)
 #endif
 }
 
+/*
+ * Set the non-blocking-ness of the socket.
+ */
+
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+socket_set_nonblocking(rk_socket_t sock, int nonblock)
+{
+#if defined(O_NONBLOCK)
+    int flags = fcntl(sock, F_GETFL, 0);
+    if (flags == -1)
+	return;
+    if (nonblock)
+	flags |= O_NONBLOCK;
+    else
+	flags &= ~O_NONBLOCK;
+    fcntl(sock, F_SETFL, flags);
+#elif defined(FIOBIO)
+    int flags = !!nonblock;
+    return ioctl(sock, FIOBIO, &flags);
+#endif
+}
+
 /*
  * set the reuse of addresses on `sock' to `val'.
  */
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.c b/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.c
index 7a905da50..dd133b35c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: socket_wrapper.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: socket_wrapper.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (C) Jelmer Vernooij 2005 <jelmer@samba.org>
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.h b/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.h
index a833f65a6..37acc6dde 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/socket_wrapper.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: socket_wrapper.h,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: socket_wrapper.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (C) Jelmer Vernooij 2005 <jelmer@samba.org>
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/sockstartup_w32.c b/crypto/external/bsd/heimdal/dist/lib/roken/sockstartup_w32.c
index 6c0a59f2b..1761ba9ba 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/sockstartup_w32.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/sockstartup_w32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sockstartup_w32.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: sockstartup_w32.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/stdint.hin b/crypto/external/bsd/heimdal/dist/lib/roken/stdint.hin
new file mode 100644
index 000000000..4a8387a4e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/stdint.hin
@@ -0,0 +1,15 @@
+#ifndef _STDINT_H
+#define _STDINT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef long long int64_t;
+typedef unsigned long long uint64_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _STDINT_H */
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strcasecmp.c b/crypto/external/bsd/heimdal/dist/lib/roken/strcasecmp.c
index a8e86367e..5f6bf8ffe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strcasecmp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strcasecmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strcasecmp.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strcasecmp.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strcollect.c b/crypto/external/bsd/heimdal/dist/lib/roken/strcollect.c
index 6461d42ca..9367ea598 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strcollect.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strcollect.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strcollect.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strcollect.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strdup.c b/crypto/external/bsd/heimdal/dist/lib/roken/strdup.c
index c97ff8d59..d576ea976 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strdup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strdup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strdup.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strdup.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strerror.c b/crypto/external/bsd/heimdal/dist/lib/roken/strerror.c
index 46f7f70fa..10d588915 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strerror.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strerror.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strerror.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strerror.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strerror_r.c b/crypto/external/bsd/heimdal/dist/lib/roken/strerror_r.c
index eacbca9cf..86451efcd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strerror_r.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strerror_r.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strerror_r.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strerror_r.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strftime.c b/crypto/external/bsd/heimdal/dist/lib/roken/strftime.c
index c31658997..1def31902 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strftime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strftime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strftime.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: strftime.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strlcat.c b/crypto/external/bsd/heimdal/dist/lib/roken/strlcat.c
index 125771ce3..d9aa2e093 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strlcat.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strlcat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strlcat.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strlcat.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strlcpy.c b/crypto/external/bsd/heimdal/dist/lib/roken/strlcpy.c
index bc3b14af9..ba5a250a4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strlcpy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strlcpy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strlcpy.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strlcpy.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995-2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strlwr.c b/crypto/external/bsd/heimdal/dist/lib/roken/strlwr.c
index 90b564dca..dd5ff99e8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strlwr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strlwr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strlwr.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strlwr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strncasecmp.c b/crypto/external/bsd/heimdal/dist/lib/roken/strncasecmp.c
index 86af034ab..8b8fe5934 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strncasecmp.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strncasecmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strncasecmp.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strncasecmp.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strndup.c b/crypto/external/bsd/heimdal/dist/lib/roken/strndup.c
index 54c3bd270..56d8eb89a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strndup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strndup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strndup.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strndup.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strnlen.c b/crypto/external/bsd/heimdal/dist/lib/roken/strnlen.c
index eb46b2cbc..d6aa0e671 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strnlen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strnlen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strnlen.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strnlen.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.c
index 89058b37b..9075e17cf 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strpftime-test.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strpftime-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.h b/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.h
index a08c5ddec..7d2aa4cb8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strpftime-test.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: strpftime-test.h,v 1.1.1.2 2011/04/14 14:09:32 elric Exp $	*/
+/*	$NetBSD: strpftime-test.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2007 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strpool.c b/crypto/external/bsd/heimdal/dist/lib/roken/strpool.c
index dcfd13e24..962f0d1e7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strpool.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strpool.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strpool.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strpool.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strptime.c b/crypto/external/bsd/heimdal/dist/lib/roken/strptime.c
index 975fd763c..702b106ce 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strptime.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strptime.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strptime.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strptime.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999, 2003, 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strsep.c b/crypto/external/bsd/heimdal/dist/lib/roken/strsep.c
index 2293b54cb..1a534fbaa 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strsep.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strsep.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strsep.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strsep.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strsep_copy.c b/crypto/external/bsd/heimdal/dist/lib/roken/strsep_copy.c
index 9e1619b73..e507b4a15 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strsep_copy.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strsep_copy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strsep_copy.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: strsep_copy.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2000, 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strtok_r.c b/crypto/external/bsd/heimdal/dist/lib/roken/strtok_r.c
index ca56067ec..2645de805 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strtok_r.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strtok_r.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strtok_r.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strtok_r.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strtoll.c b/crypto/external/bsd/heimdal/dist/lib/roken/strtoll.c
new file mode 100644
index 000000000..40a3f01b9
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strtoll.c
@@ -0,0 +1,151 @@
+/*	$NetBSD: strtoll.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
+
+/*
+ * Copyright (c) 1992, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Copyright (c) 2011 The FreeBSD Foundation
+ * All rights reserved.
+ * Portions of this software were developed by David Chisnall
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#include <string.h>
+
+#include <krb5/roken.h>
+
+/* #include <sys/cdefs.h> */
+
+#include <limits.h>
+#include <errno.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+/*
+ * Convert a string to a long long integer.
+ *
+ * Assumes that the upper and lower case
+ * alphabets and digits are each contiguous.
+ */
+ROKEN_LIB_FUNCTION long long ROKEN_LIB_CALL
+strtoll(const char * nptr, char ** endptr, int base)
+{
+    const char *s;
+    unsigned long long acc;
+    char c;
+    unsigned long long cutoff;
+    int neg, any, cutlim;
+
+    /*
+     * Skip white space and pick up leading +/- sign if any.
+     * If base is 0, allow 0x for hex and 0 for octal, else
+     * assume decimal; if base is already 16, allow 0x.
+     */
+    s = nptr;
+    do {
+	c = *s++;
+    } while (isspace((unsigned char)c));
+    if (c == '-') {
+	neg = 1;
+	c = *s++;
+    } else {
+	neg = 0;
+	if (c == '+')
+	    c = *s++;
+    }
+    if ((base == 0 || base == 16) &&
+        c == '0' && (*s == 'x' || *s == 'X') &&
+        ((s[1] >= '0' && s[1] <= '9') ||
+        (s[1] >= 'A' && s[1] <= 'F') ||
+        (s[1] >= 'a' && s[1] <= 'f'))) {
+	c = s[1];
+	s += 2;
+	base = 16;
+    }
+    if (base == 0)
+	base = c == '0' ? 8 : 10;
+    acc = any = 0;
+    if (base < 2 || base > 36)
+	goto noconv;
+
+    /*
+     * Compute the cutoff value between legal numbers and illegal
+     * numbers.  That is the largest legal value, divided by the
+     * base.  An input number that is greater than this value, if
+     * followed by a legal input character, is too big.  One that
+     * is equal to this value may be valid or not; the limit
+     * between valid and invalid numbers is then based on the last
+     * digit.  For instance, if the range for quads is
+     * [-9223372036854775808..9223372036854775807] and the input base
+     * is 10, cutoff will be set to 922337203685477580 and cutlim to
+     * either 7 (neg==0) or 8 (neg==1), meaning that if we have
+     * accumulated a value > 922337203685477580, or equal but the
+     * next digit is > 7 (or 8), the number is too big, and we will
+     * return a range error.
+     *
+     * Set 'any' if any `digits' consumed; make it negative to indicate
+     * overflow.
+     */
+    cutoff = neg ? (unsigned long long)-(LLONG_MIN + LLONG_MAX) + LLONG_MAX
+        : LLONG_MAX;
+    cutlim = cutoff % base;
+    cutoff /= base;
+    for ( ; ; c = *s++) {
+	if (c >= '0' && c <= '9')
+	    c -= '0';
+	else if (c >= 'A' && c <= 'Z')
+	    c -= 'A' - 10;
+	else if (c >= 'a' && c <= 'z')
+	    c -= 'a' - 10;
+	else
+	    break;
+	if (c >= base)
+	    break;
+	if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
+	    any = -1;
+	else {
+	    any = 1;
+	    acc *= base;
+	    acc += c;
+	}
+    }
+    if (any < 0) {
+	acc = neg ? LLONG_MIN : LLONG_MAX;
+	errno = ERANGE;
+    } else if (!any) {
+noconv:
+	errno = EINVAL;
+    } else if (neg)
+	acc = -acc;
+    if (endptr != NULL)
+	*endptr = (char *)(any ? s - 1 : nptr);
+    return (acc);
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strtoull.c b/crypto/external/bsd/heimdal/dist/lib/roken/strtoull.c
new file mode 100644
index 000000000..edfd57867
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strtoull.c
@@ -0,0 +1,129 @@
+/*	$NetBSD: strtoull.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
+
+/*-
+ * Copyright (c) 1992, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Copyright (c) 2011 The FreeBSD Foundation
+ * All rights reserved.
+ * Portions of this software were developed by David Chisnall
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <config.h>
+
+#include <string.h>
+
+#include <krb5/roken.h>
+
+/* #include <sys/cdefs.h> */
+
+#include <limits.h>
+#include <errno.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+/*
+ * Convert a string to an unsigned long long integer.
+ *
+ * Assumes that the upper and lower case
+ * alphabets and digits are each contiguous.
+ */
+ROKEN_LIB_FUNCTION unsigned long long ROKEN_LIB_CALL
+strtoull(const char * nptr, char ** endptr, int base)
+{
+    const char *s;
+    unsigned long long acc;
+    char c;
+    unsigned long long cutoff;
+    int neg, any, cutlim;
+
+    /*
+     * See strtoq for comments as to the logic used.
+     */
+    s = nptr;
+    do {
+	c = *s++;
+    } while (isspace((unsigned char)c));
+    if (c == '-') {
+	neg = 1;
+	c = *s++;
+    } else {
+	neg = 0;
+	if (c == '+')
+	    c = *s++;
+    }
+    if ((base == 0 || base == 16) &&
+        c == '0' && (*s == 'x' || *s == 'X') &&
+        ((s[1] >= '0' && s[1] <= '9') ||
+        (s[1] >= 'A' && s[1] <= 'F') ||
+        (s[1] >= 'a' && s[1] <= 'f'))) {
+	c = s[1];
+	s += 2;
+	base = 16;
+    }
+    if (base == 0)
+	base = c == '0' ? 8 : 10;
+    acc = any = 0;
+    if (base < 2 || base > 36)
+	goto noconv;
+
+    cutoff = ULLONG_MAX / base;
+    cutlim = ULLONG_MAX % base;
+    for ( ; ; c = *s++) {
+	if (c >= '0' && c <= '9')
+	    c -= '0';
+	else if (c >= 'A' && c <= 'Z')
+	    c -= 'A' - 10;
+	else if (c >= 'a' && c <= 'z')
+	    c -= 'a' - 10;
+	else
+	    break;
+	if (c >= base)
+	    break;
+	if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
+	    any = -1;
+	else {
+	    any = 1;
+	    acc *= base;
+	    acc += c;
+	}
+    }
+    if (any < 0) {
+	acc = ULLONG_MAX;
+	errno = ERANGE;
+    } else if (!any) {
+noconv:
+	errno = EINVAL;
+    } else if (neg)
+	acc = -acc;
+    if (endptr != NULL)
+	*endptr = (char *)(any ? s - 1 : nptr);
+    return (acc);
+}
+
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/strupr.c b/crypto/external/bsd/heimdal/dist/lib/roken/strupr.c
index 344591207..21f1d08fe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/strupr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/strupr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strupr.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: strupr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/swab.c b/crypto/external/bsd/heimdal/dist/lib/roken/swab.c
index 6343dc534..0d639152a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/swab.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/swab.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: swab.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: swab.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/syslogc.c b/crypto/external/bsd/heimdal/dist/lib/roken/syslogc.c
index f26e8d826..6605465c7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/syslogc.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/syslogc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: syslogc.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: syslogc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/test-detach.c b/crypto/external/bsd/heimdal/dist/lib/roken/test-detach.c
new file mode 100644
index 000000000..e6626e738
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/test-detach.c
@@ -0,0 +1,84 @@
+/*	$NetBSD: test-detach.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
+
+/***********************************************************************
+ * Copyright (c) 2015, Cryptonector LLC
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ **********************************************************************/
+
+#include <config.h>
+
+#include <sys/types.h>
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <string.h>
+#ifdef WIN32
+#include <process.h>
+#ifdef getpid
+#undef getpid
+#endif
+#define getpid _getpid
+#else
+#include <unistd.h>
+#endif
+#include <krb5/roken.h>
+
+int main(int argc, char **argv)
+{
+    char *ends;
+    long n;
+    int fd = -1;
+
+    if (argc > 1) {
+	if (argc != 3)
+	    errx(1, "Usage: test-detach [--daemon-child fd]");
+	fprintf(stderr, "Child started (argv[1] = %s, argv[2] = %s)!\n", argv[1], argv[2]);
+        errno = 0;
+        n = strtol(argv[2], &ends, 10);
+        fd = n;
+        if (errno != 0)
+	    err(1, "Usage: test-detach [--daemon-child fd]");
+        if (n < 0 || ends == NULL || *ends != '\0' || n != fd)
+	    errx(1, "Usage: test-detach [--daemon-child fd]");
+    } else {
+	fprintf(stderr, "Parent started as %ld\n", (long)getpid());
+	roken_detach_prep(argc, argv, "--daemon-child");
+    }
+    fprintf(stderr, "Now should be the child: %ld\n", (long)getpid());
+    roken_detach_finish(NULL, fd);
+    /*
+     * These printfs will not appear: stderr will have been replaced
+     * with /dev/null.
+     */
+    fprintf(stderr, "Now should be the child: %ld, wrote to parent\n", (long)getpid());
+    sleep(5);
+    fprintf(stderr, "Daemon child done\n");
+    return 0;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.c b/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.c
index f56c73cef..27eeb87f7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-mem.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: test-mem.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2004 Kungliga Tekniska Högskolan
@@ -72,13 +72,16 @@ static RETSIGTYPE
 segv_handler(int sig)
 {
     int fd;
+    ssize_t ret;
     char msg[] = "SIGSEGV i current test: ";
 
     fd = open("/dev/stdout", O_WRONLY, 0600);
     if (fd >= 0) {
-	(void)write(fd, msg, sizeof(msg) - 1);
-	(void)write(fd, testname, strlen(testname));
-	(void)write(fd, "\n", 1);
+	ret = write(fd, msg, sizeof(msg) - 1);
+	if (ret != -1)
+	    ret = write(fd, testname, strlen(testname));
+	if (ret != -1)
+	    ret = write(fd, "\n", 1);
 	close(fd);
     }
     _exit(1);
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.h b/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.h
index 54a769a71..44205118b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/test-mem.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-mem.h,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: test-mem.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/test-mini_inetd.c b/crypto/external/bsd/heimdal/dist/lib/roken/test-mini_inetd.c
index 310f44d55..6fb69e6c0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/test-mini_inetd.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/test-mini_inetd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-mini_inetd.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: test-mini_inetd.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /***********************************************************************
  * Copyright (c) 2009, Secure Endpoints Inc.
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/test-readenv.c b/crypto/external/bsd/heimdal/dist/lib/roken/test-readenv.c
index b11a863f8..be033bd2b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/test-readenv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/test-readenv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-readenv.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: test-readenv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2005 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/timegm.c b/crypto/external/bsd/heimdal/dist/lib/roken/timegm.c
index 2397dc933..4f1b0ad08 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/timegm.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/timegm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: timegm.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: timegm.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1997, 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/timeval.c b/crypto/external/bsd/heimdal/dist/lib/roken/timeval.c
index c54415174..4b47f8ef0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/timeval.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/timeval.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: timeval.c,v 1.1.1.1 2011/04/13 18:15:43 elric Exp $	*/
+/*	$NetBSD: timeval.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/tm2time.c b/crypto/external/bsd/heimdal/dist/lib/roken/tm2time.c
index 5b3a2cce2..707bb5254 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/tm2time.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/tm2time.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tm2time.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: tm2time.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/tsearch-test.c b/crypto/external/bsd/heimdal/dist/lib/roken/tsearch-test.c
index 5f079070b..941159762 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/tsearch-test.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/tsearch-test.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tsearch-test.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: tsearch-test.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Tree search generalized from Knuth (6.2.2) Algorithm T just like
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/tsearch.c b/crypto/external/bsd/heimdal/dist/lib/roken/tsearch.c
index 69bc5cbbe..2722f52d0 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/tsearch.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/tsearch.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tsearch.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: tsearch.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Tree search generalized from Knuth (6.2.2) Algorithm T just like
@@ -119,14 +119,13 @@ rk_tdelete(const void * vkey, void ** vrootp,
 	int (*compar)(const void *, const void *))
 {
 	node_t **rootp = (node_t **)vrootp;
-	node_t *p, *q, *r;
+	node_t *q, *r;
 	int cmp;
 
-	if (rootp == NULL || (p = *rootp) == NULL)
+	if (rootp == NULL || *rootp == NULL)
 		return NULL;
 
 	while ((cmp = (*compar)(vkey, (*rootp)->key)) != 0) {
-		p = *rootp;
 		rootp = (cmp < 0) ?
 		    &(*rootp)->llink :		/* follow llink branch */
 		    &(*rootp)->rlink;		/* follow rlink branch */
@@ -150,7 +149,7 @@ rk_tdelete(const void * vkey, void ** vrootp,
 	}
 	free(*rootp);				/* D4: Free node */
 	*rootp = q;				/* link parent to new node */
-	return p;
+	return *rootp;
 }
 
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/unsetenv.c b/crypto/external/bsd/heimdal/dist/lib/roken/unsetenv.c
index ebefdaed5..9f978f2d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/unsetenv.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/unsetenv.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: unsetenv.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: unsetenv.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/unvis.c b/crypto/external/bsd/heimdal/dist/lib/roken/unvis.c
index 8a415a53a..80755027a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/unvis.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/unvis.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: unvis.c,v 1.1.1.2 2014/04/24 12:45:52 pettai Exp $	*/
+/*	$NetBSD: unvis.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*	NetBSD: unvis.c,v 1.19 2000/01/22 22:19:13 mycroft Exp	*/
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/verify.c b/crypto/external/bsd/heimdal/dist/lib/roken/verify.c
index 9efd52fe2..21284e803 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/verify.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/verify.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verify.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: verify.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/verr.c b/crypto/external/bsd/heimdal/dist/lib/roken/verr.c
index 5f06e2863..2ffeb7076 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/verr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/verr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verr.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: verr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/verrx.c b/crypto/external/bsd/heimdal/dist/lib/roken/verrx.c
index 8555baff6..f22de1b11 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/verrx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/verrx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: verrx.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: verrx.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/version-script.map b/crypto/external/bsd/heimdal/dist/lib/roken/version-script.map
index 9229a373c..ccd5925d2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/version-script.map
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/version-script.map
@@ -2,8 +2,6 @@ HEIMDAL_ROKEN_1.0 {
 	global:
 		arg_printusage;
 		arg_printusage_i18n;
-		base64_decode;
-		base64_encode;
 		cgetcap;
 		cgetclose;
 		cgetmatch;
@@ -36,13 +34,17 @@ HEIMDAL_ROKEN_1.0 {
 		print_units_table;
 		rk_asnprintf;
 		rk_asprintf;
+		rk_base64_decode;
+		rk_base64_encode;
 		rk_bswap16;
 		rk_bswap32;
+		rk_bswap64;
 		rk_cgetent;
 		rk_cgetstr;
 		rk_cloexec;
 		rk_cloexec_file;
                 rk_cloexec_dir;
+                rk_cloexec_socket;
 		rk_closefrom;
 		rk_copyhostent;
 		rk_dns_free_data;
@@ -79,6 +81,8 @@ HEIMDAL_ROKEN_1.0 {
 		rk_inet_ntop;
 		rk_inet_pton;
 		rk_localtime_r;
+		rk_memset_s;
+		rk_mkdir;
 		rk_mkstemp;
 		rk_pid_file_delete;
 		rk_pid_file_write;
@@ -105,6 +109,7 @@ HEIMDAL_ROKEN_1.0 {
 		rk_socket_set_any;
 		rk_socket_set_debug;
 		rk_socket_set_ipv6only;
+		rk_socket_set_nonblocking;
 		rk_socket_set_port;
 		rk_socket_set_portrange;
 		rk_socket_set_reuseaddr;
@@ -123,17 +128,14 @@ HEIMDAL_ROKEN_1.0 {
 		rk_strptime;
 		rk_strsep_copy;
 		rk_strsvis;
-		rk_strsvis;
 		rk_strsvisx;
-		rk_strunvis;
+		rk_strtoll;
+		rk_strtoull;
 		rk_strunvis;
 		rk_strunvisx;
 		rk_strupr;
 		rk_strvis;
-		rk_strvis;
 		rk_strvisx;
-		rk_strvisx;
-		rk_svis;
 		rk_svis;
 		rk_timegm;
 		rk_timevaladd;
@@ -148,7 +150,6 @@ HEIMDAL_ROKEN_1.0 {
 		rk_vasnprintf;
 		rk_vasprintf;
 		rk_vis;
-		rk_vis;
 		rk_vsnprintf;
 		rk_vstrcollect;
 		rk_wait_for_process;
@@ -156,6 +157,8 @@ HEIMDAL_ROKEN_1.0 {
 		rk_warnerr;
 		rk_xfree;
 		roken_concat;
+		roken_detach_prep;
+		roken_detach_finish;
 		roken_getaddrinfo_hostspec2;
 		roken_getaddrinfo_hostspec;
 		roken_gethostby_setup;
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/vis.c b/crypto/external/bsd/heimdal/dist/lib/roken/vis.c
index fafec4d60..b286b467c 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/vis.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/vis.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vis.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: vis.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*	NetBSD: vis.c,v 1.37 2008/07/25 22:29:23 dsl Exp	*/
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/vsyslog.c b/crypto/external/bsd/heimdal/dist/lib/roken/vsyslog.c
index 502c62c96..fcdf5e929 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/vsyslog.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/vsyslog.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vsyslog.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: vsyslog.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/vwarn.c b/crypto/external/bsd/heimdal/dist/lib/roken/vwarn.c
index 99b31120b..345ab9592 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/vwarn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/vwarn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vwarn.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: vwarn.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/vwarnx.c b/crypto/external/bsd/heimdal/dist/lib/roken/vwarnx.c
index aa3600236..bb2f065ac 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/vwarnx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/vwarnx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vwarnx.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: vwarnx.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/warn.c b/crypto/external/bsd/heimdal/dist/lib/roken/warn.c
index 0f04b4ce8..9074c8356 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/warn.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/warn.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: warn.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: warn.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/warnerr.c b/crypto/external/bsd/heimdal/dist/lib/roken/warnerr.c
index e58a5c0cd..fdf32ef3d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/warnerr.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/warnerr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: warnerr.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: warnerr.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/warnx.c b/crypto/external/bsd/heimdal/dist/lib/roken/warnx.c
index 80c92d763..05d189da2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/warnx.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/warnx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: warnx.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: warnx.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/win32_alloc.c b/crypto/external/bsd/heimdal/dist/lib/roken/win32_alloc.c
new file mode 100644
index 000000000..656e3c6cd
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/win32_alloc.c
@@ -0,0 +1,78 @@
+/*	$NetBSD: win32_alloc.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
+
+/***********************************************************************
+ * Copyright (c) 2012, Secure Endpoints Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ **********************************************************************/
+#include <config.h>
+#include <krb5/roken.h>
+#undef calloc
+#undef malloc
+#undef free
+#undef strdup
+#undef wcsdup
+
+/*
+ * Windows executables and dlls suffer when memory is
+ * allocated with one allocator and deallocated with
+ * another because each allocator is backed by a separate
+ * heap.  Reduce the exposure by ensuring that all
+ * binaries that are built using roken will build against
+ * same allocator.
+ */
+
+ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
+rk_calloc(size_t elements, size_t size)
+{
+    return calloc( elements, size);
+}
+
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
+rk_free(void * ptr)
+{
+    free( ptr);
+}
+
+ROKEN_LIB_FUNCTION void * ROKEN_LIB_CALL
+rk_malloc(size_t size)
+{
+    return malloc( size);
+}
+
+ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL
+rk_strdup(const char *str)
+{
+    return strdup( str);
+}
+
+ROKEN_LIB_FUNCTION unsigned short * ROKEN_LIB_CALL
+rk_wcsdup(const unsigned short *str)
+{
+    return wcsdup( str);
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/write_pid.c b/crypto/external/bsd/heimdal/dist/lib/roken/write_pid.c
index 1f9b63b2a..5c5bd986d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/write_pid.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/write_pid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: write_pid.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: write_pid.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan
@@ -37,56 +37,84 @@
 
 #include <krb5/roken.h>
 
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
+
 ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL
-pid_file_write (const char *progname)
+pid_file_write(const char *progname)
 {
+    const char *pidfile_dir = NULL;
     char *ret = NULL;
     FILE *fp;
 
-    if (asprintf (&ret, "%s%s.pid", _PATH_VARRUN, progname) < 0 || ret == NULL)
+    /*
+     * Maybe we could have a version of this function (and pidfile())
+     * where we get a directory from the caller.  That would allow us to
+     * have command-line options for the daemons for this.
+     *
+     * For now we use an environment variable.
+     */
+    if (!issuid())
+        pidfile_dir = getenv("HEIM_PIDFILE_DIR");
+    if (pidfile_dir == NULL)
+        pidfile_dir = _PATH_VARRUN;
+
+    if (asprintf(&ret, "%s%s.pid", pidfile_dir, progname) < 0 || ret == NULL)
 	return NULL;
-    fp = fopen (ret, "w");
+    fp = fopen(ret, "w");
     if (fp == NULL) {
-	free (ret);
+	free(ret);
 	return NULL;
     }
-    fprintf (fp, "%u", (unsigned)getpid());
-    fclose (fp);
+    fprintf(fp, "%lu\n", (unsigned long)getpid());
+    fclose(fp);
     return ret;
 }
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
-pid_file_delete (char **filename)
+pid_file_delete(char **filename)
 {
     if (*filename != NULL) {
-	unlink (*filename);
-	free (*filename);
+	unlink(*filename);
+	free(*filename);
 	*filename = NULL;
     }
 }
 
-#ifndef HAVE_PIDFILE
 static char *pidfile_path;
+static pid_t pidfile_pid;
 
 static void
 pidfile_cleanup(void)
 {
-    if(pidfile_path != NULL)
+    if (pidfile_path != NULL && pidfile_pid == getpid())
 	pid_file_delete(&pidfile_path);
 }
 
 ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL
-pidfile(const char *basename)
+rk_pidfile(const char *bname)
 {
-    if(pidfile_path != NULL)
+    /*
+     * If the OS has a pidfile(), call that, but still call
+     * pid_file_write().  Even if both want to write the same file,
+     * writing it twice will still work.
+     */
+#ifdef HAVE_PIDFILE
+    pidfile(bname);
+#endif
+
+    if (pidfile_path != NULL)
 	return;
-    if(basename == NULL)
-	basename = getprogname();
-    pidfile_path = pid_file_write(basename);
+    if (bname == NULL)
+	bname = getprogname();
+    pidfile_path = pid_file_write(bname);
+    pidfile_pid = getpid();
 #if defined(HAVE_ATEXIT)
-    atexit(pidfile_cleanup);
+    if (pidfile_path != NULL)
+        atexit(pidfile_cleanup);
 #elif defined(HAVE_ON_EXIT)
-    on_exit(pidfile_cleanup);
+    if (pidfile_path != NULL)
+        on_exit(pidfile_cleanup);
 #endif
 }
-#endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/writev.c b/crypto/external/bsd/heimdal/dist/lib/roken/writev.c
index b7d48d62e..19e4f55d8 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/writev.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/writev.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: writev.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: writev.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/xdbm.h b/crypto/external/bsd/heimdal/dist/lib/roken/xdbm.h
index 4f0da1274..494982b78 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/xdbm.h
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/xdbm.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: xdbm.h,v 1.1.1.2 2011/04/14 14:09:32 elric Exp $	*/
+/*	$NetBSD: xdbm.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/roken/xfree.c b/crypto/external/bsd/heimdal/dist/lib/roken/xfree.c
index 9831a350c..1d6f1f842 100644
--- a/crypto/external/bsd/heimdal/dist/lib/roken/xfree.c
+++ b/crypto/external/bsd/heimdal/dist/lib/roken/xfree.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: xfree.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: xfree.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/sl/Makefile.am
index 157839281..9549347a9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/Makefile.am
@@ -3,7 +3,7 @@
 include $(top_srcdir)/Makefile.am.common
 
 if do_roken_rename
-ES = strtok_r.c snprintf.c strdup.c strupr.c getprogname.c
+ES = strtok_r.c snprintf.c strdup.c strupr.c
 endif
 
 AM_CPPFLAGS += $(ROKEN_RENAME)
@@ -29,7 +29,7 @@ libexec_heimdal_PROGRAMS = slc
 
 slc_SOURCES = slc-gram.y slc-lex.l slc.h
 
-CLEANFILES = snprintf.c strtok_r.c strdup.c strupr.c getprogname.c slc-lex.c
+CLEANFILES = snprintf.c strtok_r.c strdup.c strupr.c slc-lex.c
 
 LDADD =	libsl.la $(LIB_roken)
 
@@ -43,8 +43,6 @@ strdup.c:
 	$(LN_S) $(srcdir)/../roken/strdup.c .
 strupr.c:
 	$(LN_S) $(srcdir)/../roken/strupr.c .
-getprogname.c:
-	$(LN_S) $(srcdir)/../roken/getprogname.c .
 
 slc-lex.c: slc-gram.h
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/sl/NTMakefile
index 285c5d7f1..ac398c7e4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/NTMakefile
@@ -68,7 +68,7 @@ test-binaries: $(OBJ)\test_sl.exe
 
 test-run:
 	cd $(OBJ)
-	test_sl.exe
+	-test_sl.exe
 	cd $(SRC)\$(RELDIR)
 
 test:: test-binaries test-run
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/roken_rename.h b/crypto/external/bsd/heimdal/dist/lib/sl/roken_rename.h
index c96670d62..7dbabaab7 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/roken_rename.h
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/roken_rename.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: roken_rename.h,v 1.1.1.2 2011/04/14 14:09:33 elric Exp $	*/
+/*	$NetBSD: roken_rename.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2001 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/sl.c b/crypto/external/bsd/heimdal/dist/lib/sl/sl.c
index a23014c0c..756f94eab 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/sl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/sl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sl.c,v 1.1.1.2 2014/04/24 12:45:53 pettai Exp $	*/
+/*	$NetBSD: sl.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2006 Kungliga Tekniska Högskolan
@@ -55,8 +55,11 @@ mandoc_template(SL_cmd *cmds,
     t = time(NULL);
     strftime(timestr, sizeof(timestr), "%b %d, %Y", localtime(&t));
     printf(".Dd %s\n", timestr);
-    p = strrchr(getprogname(), '/');
-    if(p) p++; else p = getprogname();
+#ifdef HAVE_GETPROGNAME
+    p = getprogname();
+#else
+    p = "unknown-application";
+#endif
     strncpy(cmd, p, sizeof(cmd));
     cmd[sizeof(cmd)-1] = '\0';
     strupr(cmd);
@@ -329,7 +332,7 @@ sl_command_loop(SL_cmd *cmds, const char *prompt, void **data)
     if (argc >= 1) {
 	ret = sl_command(cmds, argc, argv);
 	if(ret == -1) {
-	    printf ("Unrecognized command: %s\n", argv[0]);
+	    sl_did_you_mean(cmds, argv[0]);
 	    ret = 0;
 	}
     }
@@ -395,3 +398,102 @@ sl_slc_help (SL_cmd *cmds, int argc, char **argv)
 	}
     }
 }
+
+/* OptimalStringAlignmentDistance */
+
+static int
+osad(const char *s1, const char *s2)
+{
+    size_t l1 = strlen(s1), l2 = strlen(s2), i, j;
+    int *row0, *row1, *row2, *tmp, cost;
+
+    row0 = calloc(sizeof(int), l2 + 1);
+    row1 = calloc(sizeof(int), l2 + 1);
+    row2 = calloc(sizeof(int), l2 + 1);
+
+    for (j = 0; j < l2 + 1; j++)
+        row1[j] = j;
+
+    for (i = 0; i < l1; i++) {
+
+        row2[0] = i + 1;
+
+        for (j = 0; j < l2; j++) {
+
+	    row2[j + 1] = row1[j] + (s1[i] != s2[j]); /* substitute */
+	    
+	    if (row2[j + 1] > row1[j + 1] + 1) /* delete */
+		row2[j + 1] = row1[j + 1] + 1;
+	    if (row2[j + 1] > row2[j] + 1) /* insert */
+		row2[j + 1] = row2[j] + 1;
+	    if (j > 0 && i > 0 && s1[i - 1] != s2[j - 1] && s1[i - 1] == s2[j] && s1[i] == s2[j - 1] && row2[j + 1] < row0[j - 1]) /* transposition */
+	        row2[j + 1] = row0[j - 1] + 1;
+	}
+
+	tmp = row0;
+	row0 = row1;
+	row1 = row2;
+	row2 = tmp;
+    }
+
+    cost = row1[l2];
+
+    free(row0);
+    free(row1);
+    free(row2);
+
+    return cost;
+}
+
+/**
+ * Will propose a list of command that are almost matching the command
+ * used, if there is no matching, will ask the user to use "help".
+ *
+ * @param cmds command array to use for matching
+ * @param match the command that didn't exists
+ */
+
+void
+sl_did_you_mean(SL_cmd *cmds, const char *match)
+{
+    int *metrics, best_match = INT_MAX;
+    SL_cmd *c;
+    size_t n;
+
+    for (n = 0, c = cmds; c->name; c++, n++)
+        ;
+    metrics = calloc(n, sizeof(metrics[0]));
+    if (metrics == NULL)
+        return;
+
+    for (n = 0; cmds[n].name; n++) {
+        metrics[n] = osad(match, cmds[n].name);
+	if (metrics[n] < best_match)
+	    best_match = metrics[n];
+    }
+    if (best_match == INT_MAX) {
+        free(metrics);
+        fprintf(stderr, "What kind of command is %s", match);
+        return;
+    }
+
+    /* if match distance is low, propose that for the user */
+    if (best_match < 7) {
+
+	fprintf(stderr, "error: %s is not a known command, did you mean ?\n", match);
+	for (n = 0; cmds[n].name; n++) {
+	    if (metrics[n] == best_match) {
+		fprintf(stderr, "\t%s\n", cmds[n].name);
+	    }
+	}
+	fprintf(stderr, "\n");
+
+    } else {
+
+	fprintf(stderr, "error: %s is not a command, use \"help\" for more list of commands.\n", match);
+    }
+
+    free(metrics);
+
+    return;
+}
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/sl.h b/crypto/external/bsd/heimdal/dist/lib/sl/sl.h
index 24af08b78..a72522d31 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/sl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/sl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sl.h,v 1.1.1.3 2014/04/24 12:45:53 pettai Exp $	*/
+/*	$NetBSD: sl.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2004 Kungliga Tekniska Högskolan
@@ -63,6 +63,8 @@ int sl_make_argv(char*, int*, char***);
 void sl_apropos (SL_cmd *cmd, const char *topic);
 SL_cmd *sl_match (SL_cmd *cmds, char *cmd, int exactp);
 void sl_slc_help (SL_cmd *cmds, int argc, char **argv);
+void sl_did_you_mean(SL_cmd *cmds, const char *match);
+
 
 #ifdef __cplusplus
 }
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/sl_locl.h b/crypto/external/bsd/heimdal/dist/lib/sl/sl_locl.h
index b87b1a60f..ae12412de 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/sl_locl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/sl_locl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sl_locl.h,v 1.1.1.2 2011/04/14 14:09:33 elric Exp $	*/
+/*	$NetBSD: sl_locl.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/slc-gram.y b/crypto/external/bsd/heimdal/dist/lib/sl/slc-gram.y
index 353ea48ed..4887266e1 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/slc-gram.y
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/slc-gram.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: slc-gram.y,v 1.1.1.2 2014/04/24 12:45:53 pettai Exp $	*/
+/*	$NetBSD: slc-gram.y,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 %{
 /*
@@ -330,6 +330,7 @@ gen_command(struct assignment *as)
     cprint(1, "    { ");
     fprintf(cfile, "\"%s\", ", a->u.value);
     fprintf(cfile, "%s_wrap, ", f);
+    free(f);
     b = find(as, "argument");
     if(b)
 	fprintf(cfile, "\"%s %s\", ", a->u.value, b->u.value);
@@ -343,7 +344,7 @@ gen_command(struct assignment *as)
     fprintf(cfile, " },\n");
     for(a = a->next; a != NULL; a = a->next)
 	if(strcmp(a->name, "name") == 0)
-	    cprint(1, "    { \"%s\" },\n", a->u.value);
+	    cprint(1, "    { \"%s\", NULL, NULL, NULL },\n", a->u.value);
     cprint(0, "\n");
 }
 
@@ -362,6 +363,7 @@ make_name(struct assignment *as)
     struct assignment *lopt;
     struct assignment *type;
     char *s;
+    int ret;
 
     lopt = find(as, "long");
     if(lopt == NULL)
@@ -371,9 +373,11 @@ make_name(struct assignment *as)
 
     type = find(as, "type");
     if(strcmp(type->u.value, "-flag") == 0)
-	asprintf(&s, "%s_flag", lopt->u.value);
+	ret = asprintf(&s, "%s_flag", lopt->u.value);
     else
-	asprintf(&s, "%s_%s", lopt->u.value, type->u.value);
+	ret = asprintf(&s, "%s_%s", lopt->u.value, type->u.value);
+    if (ret == -1)
+	return NULL;
     gen_name(s);
     return s;
 }
@@ -448,7 +452,7 @@ struct type_handler {
 	  defval_neg_flag,
 	  NULL
 	},
-	{ NULL }
+	{ NULL, NULL, NULL, NULL, NULL }
 };
 
 static struct type_handler *find_handler(struct assignment *type)
@@ -712,7 +716,7 @@ gen(struct assignment *as)
     cprint(0, "SL_cmd commands[] = {\n");
     for(a = as; a != NULL; a = a->next)
 	gen_command(a->u.assignment);
-    cprint(1, "{ NULL }\n");
+    cprint(1, "{ NULL, NULL, NULL, NULL }\n");
     cprint(0, "};\n");
 
     hprint(0, "extern SL_cmd commands[];\n");
@@ -721,8 +725,8 @@ gen(struct assignment *as)
 int version_flag;
 int help_flag;
 struct getargs args[] = {
-    { "version", 0, arg_flag, &version_flag },
-    { "help", 0, arg_flag, &help_flag }
+    { "version", 0, arg_flag, &version_flag, NULL, NULL },
+    { "help", 0, arg_flag, &help_flag, NULL, NULL }
 };
 int num_args = sizeof(args) / sizeof(args[0]);
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/slc-lex.l b/crypto/external/bsd/heimdal/dist/lib/sl/slc-lex.l
index 5f861cdbe..6cd39c179 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/slc-lex.l
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/slc-lex.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: slc-lex.l,v 1.1.1.2 2011/04/14 14:09:33 elric Exp $	*/
+/*	$NetBSD: slc-lex.l,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 %{
 /*
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/slc.h b/crypto/external/bsd/heimdal/dist/lib/sl/slc.h
index 612ee4cce..0e8456b48 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/slc.h
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/slc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: slc.h,v 1.1.1.2 2011/04/14 14:09:33 elric Exp $	*/
+/*	$NetBSD: slc.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/sl/test_sl.c b/crypto/external/bsd/heimdal/dist/lib/sl/test_sl.c
index e7ae64361..cb0662b38 100644
--- a/crypto/external/bsd/heimdal/dist/lib/sl/test_sl.c
+++ b/crypto/external/bsd/heimdal/dist/lib/sl/test_sl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test_sl.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: test_sl.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2006 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/vers/Makefile.am b/crypto/external/bsd/heimdal/dist/lib/vers/Makefile.am
index 842d72ce1..5c35dbc26 100644
--- a/crypto/external/bsd/heimdal/dist/lib/vers/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/lib/vers/Makefile.am
@@ -10,4 +10,4 @@ CHECK_LOCAL		= no-check-local
 
 libvers_la_SOURCES      = print_version.c
 
-EXTRA_DIST = NTMakefile $(build_HEADERZ)
+EXTRA_DIST = NTMakefile $(build_HEADERZ) make-print-version.c
diff --git a/crypto/external/bsd/heimdal/dist/lib/vers/make-print-version.c b/crypto/external/bsd/heimdal/dist/lib/vers/make-print-version.c
index 80d9c32bf..e853d7855 100644
--- a/crypto/external/bsd/heimdal/dist/lib/vers/make-print-version.c
+++ b/crypto/external/bsd/heimdal/dist/lib/vers/make-print-version.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: make-print-version.c,v 1.1.1.1 2011/04/13 18:15:44 elric Exp $	*/
+/*	$NetBSD: make-print-version.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2003 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/vers/print_version.c b/crypto/external/bsd/heimdal/dist/lib/vers/print_version.c
index 0f369ef2f..817e5720d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/vers/print_version.c
+++ b/crypto/external/bsd/heimdal/dist/lib/vers/print_version.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: print_version.c,v 1.3 2014/04/24 13:45:34 pettai Exp $	*/
+/*	$NetBSD: print_version.c,v 1.4 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1998 - 2006 Kungliga Tekniska Högskolan
@@ -35,8 +35,9 @@
 
 
 #include <config.h>
+#include <krb5/krb5-types.h>
 
-#define VERSION_HIDDEN static
+#define VERSION_HIDDEN static HEIMDAL_UNUSED_ATTRIBUTE
 
 #include <krb5/roken.h>
 
@@ -53,7 +54,7 @@ print_version(const char *progname)
     if(*package_list == '\0')
 	package_list = "no version information";
     fprintf(stderr, "%s (%s)\n", progname, package_list);
-    fprintf(stderr, "Copyright 1995-2011 Kungliga Tekniska Högskolan\n");
+    fprintf(stderr, "Copyright 1995-2014 Kungliga Tekniska Högskolan\n");
 #ifdef PACKAGE_BUGREPORT
     fprintf(stderr, "Send bug-reports to %s\n", PACKAGE_BUGREPORT);
 #endif
diff --git a/crypto/external/bsd/heimdal/dist/lib/vers/vers.h b/crypto/external/bsd/heimdal/dist/lib/vers/vers.h
index d4eabe0ed..2fdc0ff90 100644
--- a/crypto/external/bsd/heimdal/dist/lib/vers/vers.h
+++ b/crypto/external/bsd/heimdal/dist/lib/vers/vers.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: vers.h,v 1.1.1.2 2011/04/14 14:09:33 elric Exp $	*/
+/*	$NetBSD: vers.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/NTMakefile b/crypto/external/bsd/heimdal/dist/lib/wind/NTMakefile
index a7a32e671..c6ec7c247 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/NTMakefile
@@ -135,14 +135,14 @@ test-binaries: $(TEST_BINARIES)
 
 test-run:
 	cd $(OBJ)
-	test-bidi.exe
-	test-map.exe
-	test-rw.exe
-	test-normalize.exe $(SRCDIR)\NormalizationTest.txt
-	test-prohibited.exe
-	test-punycode.exe
-	test-ldap.exe
-	test-utf8.exe
+	-test-bidi.exe
+	-test-map.exe
+	-test-rw.exe
+	-test-normalize.exe $(SRCDIR)\NormalizationTest.txt
+	-test-prohibited.exe
+	-test-punycode.exe
+	-test-ldap.exe
+	-test-utf8.exe
 	cd $(SRCDIR)
 
 all:: $(INCFILES) $(LIBWIND)
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/bidi.c b/crypto/external/bsd/heimdal/dist/lib/wind/bidi.c
index 4b7f71eeb..ab95a24fb 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/bidi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/bidi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: bidi.c,v 1.1.1.1 2011/04/13 18:15:45 elric Exp $	*/
+/*	$NetBSD: bidi.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -53,7 +53,7 @@ range_entry_cmp(const void *a, const void *b)
 static int
 is_ral(uint32_t cp)
 {
-    struct range_entry ee = {cp};
+    struct range_entry ee = {cp, 0};
     void *s = bsearch(&ee, _wind_ral_table, _wind_ral_table_size,
 		      sizeof(_wind_ral_table[0]),
 		      range_entry_cmp);
@@ -63,7 +63,7 @@ is_ral(uint32_t cp)
 static int
 is_l(uint32_t cp)
 {
-    struct range_entry ee = {cp};
+    struct range_entry ee = {cp, 0};
     void *s = bsearch(&ee, _wind_l_table, _wind_l_table_size,
 		      sizeof(_wind_l_table[0]),
 		      range_entry_cmp);
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/combining.c b/crypto/external/bsd/heimdal/dist/lib/wind/combining.c
index 07fd8576b..524dd2cdc 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/combining.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/combining.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: combining.c,v 1.1.1.1 2011/04/13 18:15:45 elric Exp $	*/
+/*	$NetBSD: combining.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
@@ -51,7 +51,7 @@ translation_cmp(const void *key, const void *data)
 int
 _wind_combining_class(uint32_t code_point)
 {
-    struct translation ts = {code_point};
+    struct translation ts = {code_point, 0};
     void *s = bsearch(&ts, _wind_combining_table, _wind_combining_table_size,
 		      sizeof(_wind_combining_table[0]),
 		      translation_cmp);
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/doxygen.c b/crypto/external/bsd/heimdal/dist/lib/wind/doxygen.c
index 4a6639db1..d99965605 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/doxygen.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/doxygen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: doxygen.c,v 1.1.1.1 2011/04/13 18:15:58 elric Exp $	*/
+/*	$NetBSD: doxygen.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/errorlist.c b/crypto/external/bsd/heimdal/dist/lib/wind/errorlist.c
index 95bbf804f..2775ac27a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/errorlist.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/errorlist.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: errorlist.c,v 1.1.1.1 2011/04/13 18:15:58 elric Exp $	*/
+/*	$NetBSD: errorlist.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -53,7 +53,7 @@ error_entry_cmp(const void *a, const void *b)
 int
 _wind_stringprep_error(const uint32_t cp, wind_profile_flags flags)
 {
-    struct error_entry ee = {cp};
+    struct error_entry ee = {cp, 0, 0};
     const struct error_entry *s;
 
     s = (const struct error_entry *)
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/gen-bidi.py b/crypto/external/bsd/heimdal/dist/lib/wind/gen-bidi.py
index 409fc4949..3518fbd59 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/gen-bidi.py
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/gen-bidi.py
@@ -70,8 +70,8 @@ extern const size_t _wind_l_table_size;
 
 bidi_c.file.write(
 '''
-#include <stdlib.h>
 #include "bidi_table.h"
+#include <stdlib.h>
 
 ''')
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/gen-combining.py b/crypto/external/bsd/heimdal/dist/lib/wind/gen-combining.py
index 962015c28..c7f32937a 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/gen-combining.py
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/gen-combining.py
@@ -73,8 +73,8 @@ extern const size_t _wind_combining_table_size;
 
 combining_c.file.write(
 '''
-#include <stdlib.h>
 #include "combining_table.h"
+#include <stdlib.h>
 
 const struct translation _wind_combining_table[] = {
 ''')
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/gen-errorlist.py b/crypto/external/bsd/heimdal/dist/lib/wind/gen-errorlist.py
index c028df999..36552544d 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/gen-errorlist.py
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/gen-errorlist.py
@@ -77,8 +77,8 @@ extern const size_t _wind_errorlist_table_size;
 
 errorlist_c.file.write(
 '''
-#include <stdlib.h>
 #include "errorlist_table.h"
+#include <stdlib.h>
 
 const struct error_entry _wind_errorlist_table[] = {
 ''')
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/gen-normalize.py b/crypto/external/bsd/heimdal/dist/lib/wind/gen-normalize.py
index 401c7d8b7..176c1270f 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/gen-normalize.py
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/gen-normalize.py
@@ -97,8 +97,8 @@ extern const unsigned short _wind_canon_next_table[];
 
 normalize_c.file.write(
 '''
-#include <stdlib.h>
 #include "normalize_table.h"
+#include <stdlib.h>
 
 const struct translation _wind_normalize_table[] = {
 ''')
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/idn-lookup.c b/crypto/external/bsd/heimdal/dist/lib/wind/idn-lookup.c
index ff027e96b..ea8622ef4 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/idn-lookup.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/idn-lookup.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: idn-lookup.c,v 1.1.1.1 2011/04/13 18:15:58 elric Exp $	*/
+/*	$NetBSD: idn-lookup.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/ldap.c b/crypto/external/bsd/heimdal/dist/lib/wind/ldap.c
index 8ce838543..aadfd456b 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/ldap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/ldap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ldap.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: ldap.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/libwind-exports.def b/crypto/external/bsd/heimdal/dist/lib/wind/libwind-exports.def
index 91224e3a3..32dab4b76 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/libwind-exports.def
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/libwind-exports.def
@@ -11,6 +11,7 @@ EXPORTS
 	wind_utf8ucs2_length
 	wind_ucs2utf8_length
 	wind_ucs2read
+        wind_ucs2write
 
         initialize_wind_error_table_r   ;!
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/map.c b/crypto/external/bsd/heimdal/dist/lib/wind/map.c
index 34bc88703..1186076df 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/map.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/map.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: map.c,v 1.1.1.1 2011/04/13 18:15:58 elric Exp $	*/
+/*	$NetBSD: map.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -60,7 +60,7 @@ _wind_stringprep_map(const uint32_t *in, size_t in_len,
     unsigned o = 0;
 
     for (i = 0; i < in_len; ++i) {
-	struct translation ts = {in[i]};
+	struct translation ts = {in[i], 0, 0, 0};
 	const struct translation *s;
 
 	s = (const struct translation *)
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/normalize.c b/crypto/external/bsd/heimdal/dist/lib/wind/normalize.c
index d41d30959..4d818ebbe 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/normalize.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/normalize.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: normalize.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: normalize.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -129,7 +129,7 @@ compat_decomp(const uint32_t *in, size_t in_len,
     unsigned o = 0;
 
     for (i = 0; i < in_len; ++i) {
-	struct translation ts = {in[i]};
+	struct translation ts = {in[i], 0, 0};
 	size_t sub_len = *out_len - o;
 	int ret;
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/punycode.c b/crypto/external/bsd/heimdal/dist/lib/wind/punycode.c
index fee5ee049..74166466e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/punycode.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/punycode.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: punycode.c,v 1.1.1.1 2011/04/13 18:15:58 elric Exp $	*/
+/*	$NetBSD: punycode.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/stringprep.c b/crypto/external/bsd/heimdal/dist/lib/wind/stringprep.c
index 6228f4ec0..5ea489dae 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/stringprep.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/stringprep.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: stringprep.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: stringprep.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, 2006, 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-bidi.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-bidi.c
index 6d2b576e3..071b82526 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-bidi.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-bidi.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-bidi.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: test-bidi.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-ldap.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-ldap.c
index d7c6b079e..c327d2213 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-ldap.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-ldap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-ldap.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: test-ldap.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-map.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-map.c
index 9dfa9717b..0855a58c9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-map.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-map.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-map.c,v 1.1.1.1 2011/04/13 18:16:00 elric Exp $	*/
+/*	$NetBSD: test-map.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-normalize.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-normalize.c
index 9b8eff6fc..157324933 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-normalize.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-normalize.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-normalize.c,v 1.1.1.1 2011/04/13 18:16:00 elric Exp $	*/
+/*	$NetBSD: test-normalize.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -49,7 +49,7 @@
 static size_t
 parse_vector(char *buf, uint32_t *v)
 {
-    char *last;
+    char *last = NULL;
     unsigned ret = 0;
     const char *n;
     unsigned u;
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-prohibited.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-prohibited.c
index f3aa4f706..1f5f3225e 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-prohibited.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-prohibited.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-prohibited.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: test-prohibited.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-punycode.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-punycode.c
index 8e0ffe253..86da759f9 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-punycode.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-punycode.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-punycode.c,v 1.1.1.1 2011/04/13 18:16:00 elric Exp $	*/
+/*	$NetBSD: test-punycode.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-rw.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-rw.c
index bf8129c44..0820a57bd 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-rw.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-rw.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-rw.c,v 1.1.1.1 2011/04/13 18:16:00 elric Exp $	*/
+/*	$NetBSD: test-rw.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/test-utf8.c b/crypto/external/bsd/heimdal/dist/lib/wind/test-utf8.c
index 98919d59c..a41ad5469 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/test-utf8.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/test-utf8.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: test-utf8.c,v 1.1.1.1 2011/04/13 18:16:00 elric Exp $	*/
+/*	$NetBSD: test-utf8.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
@@ -80,24 +80,24 @@ struct testcase {
 };
 
 static const struct testcase testcases[] = {
-    {"", 0, {0}},
-    {"\x01", 1, {1}},
-    {"\x7F", 1, {0x7F}},
-    {"\x01\x7F", 2, {0x01, 0x7F}},
-    {"\xC0\x80", 1, {0}},
-    {"\xC0\x81", 1, {1}},
-    {"\xC1\x80", 1, {0x40}},
-    {"\xDF\xBF", 1, {0x7FF}},
-    {"\xE0\x80\x80", 1, {0}},
-    {"\xE0\x80\x81", 1, {1}},
-    {"\xE0\x81\x80", 1, {0x40}},
-    {"\xE1\x80\x80", 1, {0x1000}},
-    {"\xEF\xBF\xBF", 1, {0xFFFF}},
-    {"\xF0\x80\x80\x80", 1, {0}},
-    {"\xF0\x80\x80\x81", 1, {1}},
-    {"\xF0\x80\x81\x80", 1, {0x40}},
-    {"\xF0\x81\x80\x80", 1, {0x1000}},
-    {"\xF1\x80\x80\x80", 1, {0x40000}},
+    {"", 0, {0}, 0},
+    {"\x01", 1, {1}, 0},
+    {"\x7F", 1, {0x7F}, 0},
+    {"\x01\x7F", 2, {0x01, 0x7F}, 0},
+    {"\xC0\x80", 1, {0}, 0},
+    {"\xC0\x81", 1, {1}, 0},
+    {"\xC1\x80", 1, {0x40}, 0},
+    {"\xDF\xBF", 1, {0x7FF}, 0},
+    {"\xE0\x80\x80", 1, {0}, 0},
+    {"\xE0\x80\x81", 1, {1}, 0},
+    {"\xE0\x81\x80", 1, {0x40}, 0},
+    {"\xE1\x80\x80", 1, {0x1000}, 0},
+    {"\xEF\xBF\xBF", 1, {0xFFFF}, 0},
+    {"\xF0\x80\x80\x80", 1, {0}, 0},
+    {"\xF0\x80\x80\x81", 1, {1}, 0},
+    {"\xF0\x80\x81\x80", 1, {0x40}, 0},
+    {"\xF0\x81\x80\x80", 1, {0x1000}, 0},
+    {"\xF1\x80\x80\x80", 1, {0x40000}, 0},
     {"\xF7\xBF\xBF\xBF", 1, {0X1FFFFF}, 1},
 };
 
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/utf8.c b/crypto/external/bsd/heimdal/dist/lib/wind/utf8.c
index 998f55e6b..95fd4cde2 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/utf8.c
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/utf8.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: utf8.c,v 1.1.1.2 2014/04/24 12:45:56 pettai Exp $	*/
+/*	$NetBSD: utf8.c,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004, 2006, 2007, 2008 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/wind.h b/crypto/external/bsd/heimdal/dist/lib/wind/wind.h
index ba2cc815e..b18b969ee 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/wind.h
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/wind.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: wind.h,v 1.1.1.2 2011/04/14 14:09:49 elric Exp $	*/
+/*	$NetBSD: wind.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/lib/wind/windlocl.h b/crypto/external/bsd/heimdal/dist/lib/wind/windlocl.h
index 60a6a9108..846462ee3 100644
--- a/crypto/external/bsd/heimdal/dist/lib/wind/windlocl.h
+++ b/crypto/external/bsd/heimdal/dist/lib/wind/windlocl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: windlocl.h,v 1.1.1.2 2011/04/14 14:09:49 elric Exp $	*/
+/*	$NetBSD: windlocl.h,v 1.2 2017/01/28 21:31:50 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 Kungliga Tekniska Högskolan
diff --git a/crypto/external/bsd/heimdal/dist/packages/Makefile.am b/crypto/external/bsd/heimdal/dist/packages/Makefile.am
index 37ee1a9c2..b5dcf2d8e 100644
--- a/crypto/external/bsd/heimdal/dist/packages/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/packages/Makefile.am
@@ -4,4 +4,4 @@ include $(top_srcdir)/Makefile.am.common
 
 SUBDIRS=  mac
 
-EXTRA_DIST = windows
+EXTRA_DIST = windows NTMakefile
diff --git a/crypto/external/bsd/heimdal/dist/packages/mac/Resources/English.lproj/Welcome.rtf b/crypto/external/bsd/heimdal/dist/packages/mac/Resources/English.lproj/Welcome.rtf
index 884487209..03843da57 100644
--- a/crypto/external/bsd/heimdal/dist/packages/mac/Resources/English.lproj/Welcome.rtf
+++ b/crypto/external/bsd/heimdal/dist/packages/mac/Resources/English.lproj/Welcome.rtf
@@ -5,4 +5,4 @@
 \pard\tx1440\tx2880\tx4320\tx5760\tx7200\ql\qnatural
 
 \f0\fs28 \cf0 Welcome to the Heimdal Installation Program.\
-}
\ No newline at end of file
+}
diff --git a/crypto/external/bsd/heimdal/dist/packages/mac/mac.sh b/crypto/external/bsd/heimdal/dist/packages/mac/mac.sh
index a391f9a10..b35c3f78c 100644
--- a/crypto/external/bsd/heimdal/dist/packages/mac/mac.sh
+++ b/crypto/external/bsd/heimdal/dist/packages/mac/mac.sh
@@ -24,8 +24,12 @@ env \
   CFLAGS="-arch i386 -arch x86_64" \
   LDFLAGS="-arch i386 -arch x86_64" \
   ${config} --disable-dependency-tracking > log || exit 1
+
 echo "Build"
+env \
+  CODE_SIGN_IDENTITY="Developer ID Application:" \
 make all > /dev/null || exit 1
+
 echo "Run regression suite"
 make check > /dev/null || exit 1
 echo "Install"
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/NTMakefile b/crypto/external/bsd/heimdal/dist/packages/windows/NTMakefile
index afa7f425d..858e3deb3 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/NTMakefile
@@ -37,4 +37,4 @@ SUBDIRS=sdk
 # Note: the assembly directory is built as a child of the \lib
 # directory since the application manifest is required at that point.
 
-# The installer directory is built separately at the end of the build.
\ No newline at end of file
+# The installer directory is built separately at the end of the build.
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/Heimdal.Kerberos.manifest.in b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/Heimdal.Kerberos.manifest.in
index dc14415a7..515b441c8 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/Heimdal.Kerberos.manifest.in
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/Heimdal.Kerberos.manifest.in
@@ -8,8 +8,12 @@
   <file name="com_err.dll" hashalg="SHA1" />
   <file name="heimntlm.dll" hashalg="SHA1" />
   <file name="gssapi.dll" hashalg="SHA1" />
+  <file name="libhdb.dll" hashalg="SHA1" />
+  <file name="libkadm5srv.dll" hashalg="SHA1" />
   <file name="heimdal.pdb" hashalg="SHA1" />
   <file name="com_err.pdb" hashalg="SHA1" />
   <file name="heimntlm.pdb" hashalg="SHA1" />
   <file name="gssapi.pdb" hashalg="SHA1" />
+  <file name="libhdb.pdb" hashalg="SHA1" />
+  <file name="libkadm5srv.pdb" hashalg="SHA1" />
 </assembly>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/NTMakefile b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/NTMakefile
index 25248fe57..183856e0e 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/NTMakefile
@@ -41,7 +41,7 @@ RELDIR=packages\windows\assembly
 # ..to derive the public key token.
 #
 !ifndef CODESIGN_PKT
-!  error CODESIGN_PKT should be set to the public key token for codesigning certificate
+!  error CODESIGN_PKT should be set to the public key token for codesigning certificate.  (See Windows\README).
 !endif
 
 prep:: mk-asm-dirs
@@ -49,7 +49,7 @@ prep:: mk-asm-dirs
 # ----------------------------------------------------------------------
 # Heimdal.Kerberos Assembly
 
-ASMKRBDIR=$(ASMDIR)\Heimdal.Kerberos
+ASMKRBDIR=$(ASMDIR)\$(ASMKRBNAME)
 ASMKRBVER=$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(VER_PRODUCT_AUX).$(VER_PRODUCT_PATCH)
 ASMKRBVER_OLD_BEGIN=$(VER_OLD_BEGIN_MAJOR).$(VER_OLD_BEGIN_MINOR).$(VER_OLD_BEGIN_AUX).$(VER_OLD_BEGIN_PATCH)
 ASMKRBVER_OLD_END=$(VER_OLD_END_MAJOR).$(VER_OLD_END_MINOR).$(VER_OLD_END_AUX).$(VER_OLD_END_PATCH)
@@ -60,16 +60,31 @@ ASMKRBBINS=\
 	$(ASMKRBDIR)\com_err.dll	\
 	$(ASMKRBDIR)\heimntlm.dll	\
 	$(ASMKRBDIR)\gssapi.dll		\
+	$(ASMKRBDIR)\libhdb.dll		\
+	$(ASMKRBDIR)\libkadm5srv.dll	\
 	$(ASMKRBDIR)\heimdal.pdb	\
 	$(ASMKRBDIR)\com_err.pdb	\
 	$(ASMKRBDIR)\heimntlm.pdb	\
-	$(ASMKRBDIR)\gssapi.pdb
+	$(ASMKRBDIR)\gssapi.pdb		\
+	$(ASMKRBDIR)\libhdb.pdb		\
+	$(ASMKRBDIR)\libkadm5srv.pdb
+
+!if ("$(CPU)" == "i386")
+ARCH=32
+!elseif ("$(CPU)" == "x86")
+ARCH=32
+!else
+ARCH=64
+!endif
 
 $(ASMKRBDIR)\$(ASMKRBMAN).nohash: Heimdal.Kerberos.manifest.in
 	$(SED)  -e "s,[@]name[@],$(ASMKRBNAME),g" \
+		-e "s,[@]krbname[@],$(ASMKRBNAME),g" \
 		-e "s,[@]cpu[@],$(MCPU),g" \
 		-e "s,[@]version[@],$(ASMKRBVER),g" \
-		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
+		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" \
+		-e "s,[@]arch[@],$(ARCH),g" \
+		< $** > $@
 
 $(ASMKRBDIR)\$(ASMKRBMAN) $(ASMKRBDIR)\$(ASMKRBMAN).cdf: \
 		$(ASMKRBDIR)\$(ASMKRBMAN).nohash $(ASMKRBBINS)
@@ -81,8 +96,7 @@ $(ASMKRBDIR)\$(ASMKRBNAME).cat: $(ASMKRBDIR)\$(ASMKRBMAN).cdf
 	cd $(ASMKRBDIR)
 	$(MAKECAT) $**
 	$(_CODESIGN)
-#	$(RM) $(ASMKRBMAN).cdf
-#	$(RM) $(ASMKRBMAN).nohash
+	$(_CODESIGN_SHA256)
 	cd $(SRCDIR)
 
 asm-krb: \
@@ -96,8 +110,13 @@ all:: asm-krb
 clean::
 	-$(RM) $(ASMKRBDIR)\*.*
 
+!ifdef APPVEYOR
+test::
+	true
+!else
 test::
 	$(MT) -manifest $(ASMKRBDIR)\$(ASMKRBMAN) -validate_manifest
+!endif
 
 {$(BINDIR)}.dll{$(ASMKRBDIR)}.dll:
 	$(CP) $< $@
@@ -120,13 +139,18 @@ $(APPMANIFEST): Heimdal.Application.manifest.in
 		-e "s,[@]cpu[@],$(MCPU),g" \
 		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
 
+!ifdef APPVEYOR
+test::
+	true
+!else
 test::
 	$(MT) -manifest $(APPMANIFEST) -validate_manifest
+!endif
 
 # ----------------------------------------------------------------------
 # Publisher configuration files
 
-POLKRB=policy.$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).Heimdal.Kerberos
+POLKRB=policy.$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(ASMKRBNAME)
 POLKRBDIR=$(ASMDIR)\$(POLKRB)
 POLKRBFILE=$(POLKRBDIR)\$(ASMKRBVER).pol
 POLKRBCAT=$(POLKRBDIR)\$(ASMKRBVER).cat
@@ -147,6 +171,7 @@ $(POLKRBCAT): $(POLKRBFILE).cdf
 	cd $(POLKRBDIR)
 	$(MAKECAT) $**
 	$(_CODESIGN)
+	$(_CODESIGN_SHA256)
 	cd $(SRCDIR)
 
 all:: $(POLKRBFILE) $(POLKRBCAT)
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/policy.Heimdal.Kerberos.in b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/policy.Heimdal.Kerberos.in
index b56e9a7af..ad97997d0 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/assembly/policy.Heimdal.Kerberos.in
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/assembly/policy.Heimdal.Kerberos.in
@@ -16,4 +16,4 @@
                        newVersion="@krbversion@"/>
     </dependentAssembly>
   </dependency>
-</assembly>
\ No newline at end of file
+</assembly>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/NTMakefile b/crypto/external/bsd/heimdal/dist/packages/windows/installer/NTMakefile
index 03c368b63..d7c7af9d0 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/installer/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/NTMakefile
@@ -1,6 +1,6 @@
 ########################################################################
 #
-# Copyright (c) 2010, Secure Endpoints Inc.
+# Copyright (c) 2010-2013, Secure Endpoints Inc.
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -31,7 +31,7 @@
 
 RELDIR=packages\windows\installer
 
-!include ../../../windows/NTMakefile.w32
+!include ..\..\..\windows/NTMakefile.w32
 
 !ifdef BUILD_INSTALLERS
 
@@ -54,49 +54,84 @@ DEBUGOPT=-$(BUILD)
 ######################################################################
 # Heimdal Merge Modules
 
+!if exist(..\..\..\thirdparty\installer\heimdal-assemblies.wxs)
+ASM_WXS=..\..\..\thirdparty\installer\heimdal-assemblies.wxs
+!else
+ASM_WXS=heimdal-assemblies.wxs
+!endif
+
 ASSEMBLYMODULE=$(INSTDIR)\Heimdal.msm
 
 $(ASSEMBLYMODULE): $(OBJ)\heimdal-assemblies.wixobj
 	$(LIGHT) -out $@ $**
 
-$(OBJ)\heimdal-assemblies.wixobj: heimdal-assemblies.wxs
+$(OBJ)\heimdal-assemblies.wixobj: $(ASM_WXS)
 	$(CANDLE) -arch $(PLATFORM) -o $@ $**	\
 		-dVersion=$(VERSION)		\
 		-dBinDir=$(BINDIR)		\
+		-dAsmKrbName=$(ASMKRBNAME)		\
 		-dPlatform=$(PLATFORM)
 
 $(SDKREDISTDIR)\Heimdal.msm: $(ASSEMBLYMODULE)
 	$(CP) $** $@
 
+!if exist(..\..\..\thirdparty\installer\heimdal-policy.wxs)
+POLICY_WXS=..\..\..\thirdparty\installer\heimdal-policy.wxs
+!else
+POLICY_WXS=heimdal-policy.wxs
+!endif
+
 POLICYMODULE=$(INSTDIR)\Heimdal.Policy.msm
 
 $(POLICYMODULE): $(OBJ)\heimdal-policy.wixobj
 	$(LIGHT) -out $@ $**
 
-$(OBJ)\heimdal-policy.wixobj: heimdal-policy.wxs
+$(OBJ)\heimdal-policy.wixobj: $(POLICY_WXS)
 	$(CANDLE) -arch $(PLATFORM) -o $@ $**	\
 		-dVersion=$(VERSION)		\
 		-dBinDir=$(BINDIR)		\
+		-dAsmKrbName=$(ASMKRBNAME)		\
 		-dPlatform=$(PLATFORM)		\
 		-dPolPrefix=$(POLPREFIX)
 
-$(SDKREDISTDIR)\Heimdal.Policy.msm: $(POLICYMODULE)
+COMMANDMODULE=$(INSTDIR)\Heimdal.Command.msm
+
+$(COMMANDMODULE): $(OBJ)\heimdal-command.wixobj
+	$(LIGHT) -out $@ $**
+
+# OBJECT COMPILED BELOW
+
+$(SDKREDISTDIR)\Heimdal.Command.msm: $(COMMANDMODULE)
 	$(CP) $** $@
 
+GSSMODULE=$(INSTDIR)\Heimdal.GSS.msm
+
+$(GSSMODULE): $(OBJ)\heimdal-gss.wixobj
+	$(LIGHT) -out $@ $**
+
+# OBJECT COMPILED BELOW
+
 all:: $(ASSEMBLYMODULE) $(SDKREDISTDIR)\Heimdal.msm
 
-all:: $(POLICYMODULE) $(SDKREDISTDIR)\Heimdal.Policy.msm
+all:: $(POLICYMODULE)
+
+all:: $(COMMANDMODULE) $(SDKREDISTDIR)\Heimdal.Command.msm
+
+all:: $(GSSMODULE)
 
 clean::
 	-$(RM) $(ASSEMBLYMODULE)
 	-$(RM) $(POLICYMODULE)
-	-$(RM) $(SDKREDISTDIR)\Heimdal.msm
-	-$(RM) $(SDKREDISTDIR)\Heimdal.Policy.msm
+	-$(RM) $(COMMANDMODULE)
+	-$(RM) $(GSSMODULE)
+	-$(RM) $(SDKREDISTDIR)\*.*
 
 ######################################################################
 # Runtime modules
 
-!if [ $(PERL) $(SRC)\cf\w32-detect-vc-version.pl $(CC) ]==15
+!if [ $(PERL) $(SRC)\cf\w32-detect-vc-version.pl $(CC) ]==16
+VCVER=VC100
+!elseif [ $(PERL) $(SRC)\cf\w32-detect-vc-version.pl $(CC) ]==15
 VCVER=VC90
 !elseif [ $(PERL) $(SRC)\cf\w32-detect-vc-version.pl $(CC) ]==14
 VCVER=VC80
@@ -104,6 +139,14 @@ VCVER=VC80
 !  error Cant determine Visual C compiler version
 !endif
 
+$(SDKREDISTDIR)\heimdal-version.mak:
+   @echo HEIMDAL_VCVER=$(VCVER)  > $@
+!if "$(BUILD)"!="rel"
+   @echo HEIMDAL_CRT_DEBUG=yes   >> $@
+!endif
+
+all:: $(SDKREDISTDIR)\heimdal-version.mak
+
 !if "$(BUILD)"=="rel"
 CRTNAME=CRT
 !else
@@ -120,10 +163,13 @@ MMDIR=$(SystemDrive)\Program Files (x86)\Common Files\Merge Modules
 !if exist("$(MMDIR)")
 
 RUNTIMEMODULE32="$(MMDIR)\Microsoft_$(VCVER)_$(CRTNAME)_x86.msm"
+!if "$(VCVER)"=="VC100"
+RUNTIMEMODULE64="$(MMDIR)\Microsoft_$(VCVER)_$(CRTNAME)_x64.msm"
+!else
 RUNTIMEMODULE64="$(MMDIR)\Microsoft_$(VCVER)_$(CRTNAME)_x86_x64.msm"
+!endif
 
 !else
-
 RUNTIMEMODULE32="$(MSSDK)\Redist\VC\microsoft.vcxx.crt.x86_msm.msm"
 RUNTIMEMODULE64="$(MSSDK)\Redist\VC\microsoft.vcxx.crt.x64_msm.msm"
 
@@ -139,7 +185,8 @@ CANDLEOPTS=	\
 	-dDocDir=$(DOCDIR)			\
 	-dSrcDir=$(SRC)				\
 	-dPlatform=$(PLATFORM)			\
-	-dPolPrefix=$(POLPREFIX)		\
+	-dAsmKrbName=$(ASMKRBNAME)		\
+	-dPolPrefix=$(POLPREFIX)
 
 !if "$(CPU)"=="AMD64"
 
@@ -149,19 +196,25 @@ CANDLEOPTS=$(CANDLEOPTS) -dTarget64	\
 	-dInstDir32=$(INSTDIR32)	\
 	-dInstDir64=$(INSTDIR)			\
 	-dRuntimeModule32=$(RUNTIMEMODULE32)	\
-	-dRuntimeModule64=$(RUNTIMEMODULE64)	\
+	-dRuntimeModule64=$(RUNTIMEMODULE64)
 
 !ifdef MULTIPLATFORM_INSTALLER
-CANDLEOPTS=$(CANDLEOPTS) -dTarget32
+CANDLEOPTS_MULTI= -dTarget32
 TYPEOPT=-full
+
+INSTDEPS= \
+	$(INSTDIR32)\Heimdal.msm \
+	$(INSTDIR32)\Heimdal.GSS.msm	\
+	$(INSTDIR32)\Heimdal.Policy.msm	\
+	$(ASSEMBLYMODULE) $(GSSMODULE) $(POLICYMODULE)
 !else
 !  message Excluding 32-bit components from installer
 TYPEOPT=
+
+INSTDEPS= \
+	$(ASSEMBLYMODULE) $(GSSMODULE) $(POLICYMODULE)
 !endif
 
-INSTDEPS=$(INSTDIR32)\Heimdal.msm \
-	$(INSTDIR32)\Heimdal.Policy.msm	\
-	$(ASSEMBLYMODULE) $(POLICYMODULE)
 
 !else
 
@@ -169,15 +222,8 @@ CANDLEOPTS=$(CANDLEOPTS) -dTarget32		\
 	-dInstDir32=$(INSTDIR)			\
 	-dRuntimeModule32=$(RUNTIMEMODULE32)	\
 
-!endif
-
-!if exist($(SRC)\thirdparty)
-THIRDPARTYOBJS=$(INSTDIR)\apicache.wixobj $(INSTDIR)\lsacache.wixobj
-THIRDPARTYOPTS=-dApiCache=1 -dLsaCache=1
-
-!if "$(CPU)"=="AMD64"
-THIRDPARTYOBJS=$(THIRDPARTYOBJS) $(INSTDIR32)\apicache.wixobj $(INSTDIR32)\lsacache.wixobj
-!endif
+INSTDEPS= \
+	$(ASSEMBLYMODULE) $(GSSMODULE) $(POLICYMODULE)
 !endif
 
 !if exist($(SRC)\thirdparty\MKShim)
@@ -201,6 +247,26 @@ $(INSTALLER): $(WIXOBJ) $(THIRDPARTYOBJS) $(INSTDEPS) lang\en-us.wxl
 
 $(WIXOBJ): heimdal-installer.wxs
 	$(CANDLE) -arch $(PLATFORM) -o $@ heimdal-installer.wxs \
+		$(CANDLEOPTS) $(CANDLEOPTS_MULTI) $(THIRDPARTYOPTS)
+
+!if exist(thirdparty\installer\heimdal-command.wxs)
+CMD_WXS=thirdparty\installer\heimdal-command.wxs
+!else
+CMD_WXS=heimdal-command.wxs
+!endif
+
+$(OBJ)\heimdal-command.wixobj: $(CMD_WXS)
+	$(CANDLE) -arch $(PLATFORM) -o $@ $(CMD_WXS) \
+		$(CANDLEOPTS) $(THIRDPARTYOPTS)
+
+!if exist(thirdparty\installer\heimdal-gss.wxs)
+GSS_WXS=thirdparty\installer\heimdal-gss.wxs
+!else
+GSS_WXS=heimdal-gss.wxs
+!endif
+
+$(OBJ)\heimdal-gss.wixobj: $(GSS_WXS)
+	$(CANDLE) -arch $(PLATFORM) -o $@ $(GSS_WXS) \
 		$(CANDLEOPTS) $(THIRDPARTYOPTS)
 
 all:: $(INSTALLER)
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-assemblies.wxs b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-assemblies.wxs
index c4403f61c..b846218d8 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-assemblies.wxs
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-assemblies.wxs
@@ -3,15 +3,15 @@
 
   <?if $(var.Platform)=x64 ?>
 
-  <?define Win64=yes ?>
-  <?define GuidPackage=4F062DF3-5C5F-44E9-8F9B-E8D2684ED608 ?>
-  <?define GuidKerberos=78905402-0F4B-48E1-924C-B0E18657C5C5 ?>
+    <?define Win64=yes ?>
+    <?define GuidPackage=4F062DF3-5C5F-44E9-8F9B-E8D2684ED608 ?>
+    <?define GuidKerberos=78905402-0F4B-48E1-924C-B0E18657C5C5 ?>
 
   <?else?>
 
-  <?define Win64=no ?>
-  <?define GuidPackage=AD5288E3-A024-4BD3-ABBE-4999AF130169 ?>
-  <?define GuidKerberos=C5919968-FEC4-4D17-89A4-8697B95F115E ?>
+    <?define Win64=no ?>
+    <?define GuidPackage=AD5288E3-A024-4BD3-ABBE-4999AF130169 ?>
+    <?define GuidKerberos=C5919968-FEC4-4D17-89A4-8697B95F115E ?>
 
   <?endif?>
 
@@ -19,13 +19,13 @@
 
     <Package Id="$(var.GuidPackage)"
              InstallerVersion="200"
-             Languages="1033" Manufacturer="Heimdal"
+	     Languages="1033" Manufacturer="www.h5l.org"
              SummaryCodepage="1252" AdminImage="no"
              Platform="$(var.Platform)" />
 
     <Directory Id='TARGETDIR' Name='SourceDir'>
-      <Directory Id="dir.Heimdal.Kerberos" Name="Heimdal.Kerberos"
-                 FileSource="$(var.BinDir)\Heimdal.Kerberos">
+      <Directory Id="dir.Heimdal.Kerberos" Name="$(var.AsmKrbName)"
+		 FileSource="$(var.BinDir)\$(var.AsmKrbName)">
         <Component Id="comp.Heimdal.Kerberos"
                    Guid="$(var.GuidKerberos)"
                    Win64="$(var.Win64)">
@@ -34,15 +34,19 @@
           <File Name="com_err.dll" />
           <File Name="heimntlm.dll" />
           <File Name="gssapi.dll" />
+	  <File Name="libhdb.dll" />
+	  <File Name="libkadm5srv.dll" />
           <File Name="heimdal.pdb" />
           <File Name="com_err.pdb" />
           <File Name="heimntlm.pdb" />
           <File Name="gssapi.pdb" />
-          <File Name="Heimdal.Kerberos.cat" />
-          <File Name="Heimdal.Kerberos.manifest" Id="id.Heimdal.Kerberos.manifest" />
+	  <File Name="libhdb.pdb" />
+	  <File Name="libkadm5srv.pdb" />
+	  <File Name="$(var.AsmKrbName).cat" />
+	  <File Name="$(var.AsmKrbName).manifest" Id="id.Heimdal.Kerberos.manifest" />
         </Component>
       </Directory>
     </Directory>
 
   </Module>
-</Wix>
\ No newline at end of file
+</Wix>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-command.wxs b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-command.wxs
new file mode 100644
index 000000000..451cd6086
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-command.wxs
@@ -0,0 +1,277 @@
+<?xml version='1.0' encoding='windows-1252'?>
+<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>
+
+  <?if $(var.Platform)=x64 ?>
+
+  <?define Win64=yes ?>
+
+  <?define ToolsBinDir=dirBin64 ?>
+  <?define GuidKinit=BAA5BD92-163E-4AA5-8C99-EA2100F3D9DE ?>
+  <?define GuidKdestroy=289C2C0D-F41D-4E46-9819-6B9B63F83418 ?>
+  <?define GuidKtutil=28B09087-4731-41F4-B734-C71E84EC31FC ?>
+  <?define GuidKdigest=D13DA4C0-B1BB-4C02-8ED2-5DFC7D16B19D ?>
+  <?define GuidKpasswd=20A984EC-5BCB-4B93-A3A9-7AACBDC625E9 ?>
+  <?define GuidKvno=2B932C2B-9167-4051-BDF7-A104E9983CE6 ?>
+  <?define GuidKcpytkt=17734691-7CB3-4E9A-AADC-6D4205795F43 ?>
+  <?define GuidKdeltkt=3E853905-8CDA-4E14-8EBA-C0C4EEDB811A ?>
+  <?define GuidHeimtools=F411A9F1-A186-40CB-B55B-CADBE0166268 ?>
+
+  <?define GuidPackage={49114B84-F013-4473-B8FA-E77FAE565C4E} ?>
+  <?define GuidKerberos={0ECC969D-76EB-474F-9CC5-91AD22944520} ?>
+
+  <?else?>
+
+  <?define Win64=no ?>
+
+  <?define ToolsBinDir=dirBin32 ?>
+  <?define GuidKinit=038F19D7-F7C9-4B6A-8359-321CD1FAD347 ?>
+  <?define GuidKdestroy=07D96FBC-2251-4EBC-AA68-12C6C52F44E6 ?>
+  <?define GuidKtutil=CE082458-E2C5-4744-A423-88C23AD3C81C ?>
+  <?define GuidKdigest=3FFBFAB0-FB37-411C-AF4E-53BCC468D7D1 ?>
+  <?define GuidKpasswd=B66C04B5-EE1D-48C3-A25B-4DCAAA8F459B ?>
+  <?define GuidKvno=4C6015BE-1347-4D12-8841-FF90E0B9D6A8 ?>
+  <?define GuidKcpytkt=CBCDFC80-601B-4F26-A020-7D1278735B95 ?>
+  <?define GuidKdeltkt=6450EE72-E472-4709-B457-B579BFB2472B ?>
+  <?define GuidHeimtools=11800964-4A5F-466E-B2FE-DD2EFC54DDB9 ?>
+
+  <?define GuidPackage={AF31DA8A-4D8C-4248-B685-3D60FE8CA3AE} ?>
+  <?define GuidKerberos={FC7C866C-4E6A-4C48-A7E2-151C7C86E375} ?>
+  <?endif?>
+
+  <Module Id="Heimdal" Language="0" Version="$(var.Version)">
+
+    <Package Id="$(var.GuidPackage)"
+	     InstallerVersion="200"
+	     Languages="1033" Manufacturer="Heimdal"
+	     SummaryCodepage="1252" AdminImage="no"
+	     Platform="$(var.Platform)" />
+
+    <Directory Id='TARGETDIR' Name='SourceDir' DiskId='1'>
+
+      <?ifdef Target32 ?>
+      <Directory Id='ProgramFilesFolder'>
+	<Directory Id='INSTALLDIR32' Name='Heimdal'>
+	  <Directory Id='dirBin32' Name='bin'>
+	  </Directory>
+	</Directory>
+      </Directory>
+      <?endif?>
+
+      <?ifdef Target64?>
+      <Directory Id='ProgramFiles64Folder'>
+	<Directory Id='INSTALLDIR64' Name='Heimdal'>
+	  <Directory Id='dirBin64' Name='bin'>
+	  </Directory>
+	</Directory>
+      </Directory>
+      <?endif?>
+
+    </Directory>
+
+    <?ifdef Target32?>
+    <DirectoryRef Id='dirBin32' DiskId='1'>
+      <Component Id='comp.SearchPath.32'
+		 Guid='BA6C1A53-E479-4E87-9B61-7BA793DBAE56' Win64='no'>
+	<RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	  <RegistryValue Name='InstallPath' Type='string'
+			 Value='[dirBin32]' KeyPath='yes' />
+	</RegistryKey>
+	<Environment Id='env.Path.32' Name='PATH' Action='set' Part='last'
+		     Separator=';' Value='[dirBin32]' System='yes' />
+      </Component>
+
+    </DirectoryRef>
+    <?endif?>
+
+    <?ifdef Target64?>
+    <DirectoryRef Id='dirBin64' DiskId='1'>
+      <Component Id='comp.SearchPath.64'
+		 Guid='2F189729-2253-47A1-AA68-06FE3A9697A7' Win64='yes'>
+	<RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	  <RegistryValue Name='InstallPath' Type='string'
+			 Value='[dirBin64]' KeyPath='yes' />
+	</RegistryKey>
+	<Environment Id='env.Path' Name='PATH' Action='set' Part='last'
+		     Separator=';' Value='[dirBin64]' System='yes' />
+      </Component>
+
+    </DirectoryRef>
+    <?endif?>
+
+    <DirectoryRef Id='$(var.ToolsBinDir)' FileSource='$(var.BinDir)'>
+
+      <Component Id='comp.kinit'
+		 Guid='$(var.GuidKinit)'
+		 Win64='$(var.Win64)'>
+	<File Name='kinit.exe' KeyPath='yes' />
+	<File Name='kinit.pdb' />
+      </Component>
+
+      <Component Id='comp.ktutil'
+		 Guid='$(var.GuidKtutil)'
+		 Win64='$(var.Win64)'>
+	<File Name='ktutil.exe' KeyPath='yes' />
+	<File Name='ktutil.pdb' />
+      </Component>
+
+      <Component Id='comp.kdestroy'
+		 Guid='$(var.GuidKdestroy)'
+		 Win64='$(var.Win64)'>
+	<File Name='kdestroy.exe' KeyPath='yes' />
+	<File Name='kdestroy.pdb' />
+      </Component>
+
+      <Component Id='comp.kdigest'
+		 Guid='$(var.GuidKdigest)'
+		 Win64='$(var.Win64)'>
+	<File Name='kdigest.exe' KeyPath='yes' />
+	<File Name='kdigest.pdb' />
+      </Component>
+
+      <Component Id='comp.kpasswd'
+		 Guid='$(var.GuidKpasswd)'
+		 Win64='$(var.Win64)'>
+	<File Name='kpasswd.exe' KeyPath='yes' />
+	<File Name='kpasswd.pdb' />
+      </Component>
+
+      <Component Id='comp.kvno'
+		 Guid='$(var.GuidKvno)'
+		 Win64='$(var.Win64)'>
+	<File Name='kvno.exe' KeyPath='yes' />
+	<File Name='kvno.pdb' />
+      </Component>
+
+      <Component Id='comp.kcpytkt'
+		 Guid='$(var.GuidKcpytkt)'
+		 Win64='$(var.Win64)'>
+	<File Name='kcpytkt.exe' KeyPath='yes' />
+	<File Name='kcpytkt.pdb' />
+      </Component>
+
+      <Component Id='comp.kdeltkt'
+		 Guid='$(var.GuidKdeltkt)'
+		 Win64='$(var.Win64)'>
+	<File Name='kdeltkt.exe' KeyPath='yes' />
+	<File Name='kdeltkt.pdb' />
+      </Component>
+
+      <Component Id='comp.heimtools'
+		 Guid='$(var.GuidHeimtools)'
+		 Win64='$(var.Win64)'>
+	<File Name='heimtools.exe' KeyPath='yes'>
+	  <CopyFile Id='klist.exe' DestinationName='klist.exe' DestinationProperty='$(var.ToolsBinDir)' />
+	  <CopyFile Id='kswitch.exe' DestinationName='kswitch.exe' DestinationProperty='$(var.ToolsBinDir)' />
+	</File>
+	<File Name='heimtools.pdb'>
+	  <CopyFile Id='klist.pdb' DestinationName='klist.pdb' />
+	  <CopyFile Id='kswitch.pdb' DestinationName='kswitch.pdb' />
+	</File>
+      </Component>
+
+      <Component Id='comp.Heimdal.chm'
+		 Guid='785F6668-EBDB-4F18-8BEF-F72ECECB43D6'>
+	<File Source='$(var.DocDir)\heimdal.chm' />
+      </Component>
+
+      <Component Id='comp.HX509.chm'
+		 Guid='CBB379D6-629D-4EB9-AC0D-0167651F14EF'>
+	<File Source='$(var.DocDir)\hx509.chm' />
+      </Component>
+
+    </DirectoryRef>
+
+    <DirectoryRef Id='TARGETDIR'>
+      <Directory Id='CommonAppDataFolder' Name='ProgramData'>
+	<Directory Id='dirCommonKerberos' Name='Kerberos' FileSource='$(var.SrcDir)'>
+
+	  <Component Id='comp.krb5.conf'
+		     Guid='ED28951F-7B17-4DF5-91D7-4DC11C810E66'
+		     Permanent='yes' NeverOverwrite='yes'>
+	    <File Name='krb5.conf' KeyPath='yes' Id='krb5_conf' />
+	    <Environment Id='KRB5_CONFIG_by_krb5.conf' Name='KRB5_CONFIG' Action='set' System='yes' Value='[#krb5_conf]' />
+	    <!-- Backwards compatibility -->
+	    <RegistryKey Root='HKLM' Key='Software\MIT\Kerberos'>
+	      <RegistryValue Name='config' Type='string' Value='[#krb5_conf]' />
+	    </RegistryKey>
+	    <Condition>Not LEGACYKRB5INI And Not LEGACYKRB5CONF And Not LEGACYKRB5REG32 And Not LEGACYKRB5REG64</Condition>
+	  </Component>
+
+	  <Component Id='comp.krb5.ini.move'
+		     Guid='316CB754-4332-4C02-95C1-4AC82590712D'>
+	    <CopyFile Id='copy_krb5.ini' Delete='yes'
+		      DestinationDirectory='dirCommonKerberos'
+		      DestinationName='krb5.conf' DestinationShortName='krb5.cnf'
+		      SourceProperty='LEGACYKRB5INI' />
+	    <Environment Id='KRB5_CONFIG_by_legacy_krb5.ini' Name='KRB5_CONFIG'
+			 Action='set' System='yes' Value='[dirCommonKerberos]krb5.conf' />
+	    <RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	      <RegistryValue Name='LegacyKrb5IniLocation' Type='string'
+			     Value='[LEGACYKRB5INI]' KeyPath='yes' />
+	    </RegistryKey>
+	    <!-- Backwards compatibility -->
+	    <RegistryKey Root='HKLM' Key='Software\MIT\Kerberos'>
+	      <RegistryValue Name='config' Type='string'
+			     Value='[dirCommonKerberos]krb5.conf' />
+	    </RegistryKey>
+	    <Condition>LEGACYKRB5INI</Condition>
+	  </Component>
+
+	  <Component Id='comp.krb5.conf.move'
+		     Guid='ADCE6801-0FD3-46E7-955A-FC9214CFE0AB'>
+	    <CopyFile Id='copy_krb5.conf' Delete='yes'
+		      DestinationDirectory='dirCommonKerberos'
+		      DestinationName='krb5.conf' DestinationShortName='krb5.cnf'
+		      SourceProperty='LEGACYKRB5CONF' />
+	    <Environment Id='KRB5_CONFIG_by_legacy_krb5.conf' Name='KRB5_CONFIG'
+			 Action='set' System='yes' Value='[dirCommonKerberos]krb5.conf' />
+	    <RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	      <RegistryValue Name='LegacyKrb5ConfLocation' Type='string'
+			     Value='[LEGACYKRB5CONF]' KeyPath='yes' />
+	    </RegistryKey>
+	    <!-- Backwards compatibility -->
+	    <RegistryKey Root='HKLM' Key='Software\MIT\Kerberos'>
+	      <RegistryValue Name='config' Type='string'
+			     Value='[dirCommonKerberos]krb5.conf' />
+	    </RegistryKey>
+	    <Condition>LEGACYKRB5CONF</Condition>
+	  </Component>
+
+	</Directory>
+      </Directory>
+      <Directory Id='WindowsFolder'>
+      </Directory>
+    </DirectoryRef>
+
+    <!-- Search for existing configuration files -->
+
+    <Property Id='LEGACYKRB5INI' >
+      <DirectorySearch Id='dirSearchKrb5Ini' Depth='1' Path='[WindowsFolder]'>
+	<FileSearch Name='krb5.ini' />
+      </DirectorySearch>
+    </Property>
+
+    <Property Id='LEGACYKRB5CONF' >
+      <DirectorySearch Id='dirSearchKrb5Conf' Depth='1' Path='[WindowsFolder]'>
+	<FileSearch Name='krb5.conf' />
+      </DirectorySearch>
+    </Property>
+
+    <Property Id='LEGACYKRB5REG32'>
+      <RegistrySearch Id='regSearchKrb5ConfUser' Key='Software\MIT\Kerberos' Name='config'
+		      Root='HKLM' Type='file' Win64='no'>
+	<FileSearch Name='krb5.ini' />
+      </RegistrySearch>
+    </Property>
+
+    <?if $(var.Platform)=x64 ?>
+    <Property Id='LEGACYKRB5REG64'>
+      <RegistrySearch Id='regSearchKrb5ConfMach' Key='Software\MIT\Kerberos' Name='config'
+		      Root='HKLM' Type='file' Win64='yes'>
+	<FileSearch Name='krb5.ini' />
+      </RegistrySearch>
+    </Property>
+    <?endif?>
+
+  </Module>
+</Wix>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-gss.wxs b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-gss.wxs
new file mode 100644
index 000000000..fd0741b10
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-gss.wxs
@@ -0,0 +1,94 @@
+<?xml version='1.0' encoding='windows-1252'?>
+<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>
+
+  <?if $(var.Platform)=x64 ?>
+
+  <?define Win64=yes ?>
+
+  <?define ToolsBinDir=dirBin64 ?>
+  <?define GuidGssDll=9368D1E7-D4CB-4BDC-A2A6-AB1C992151AD ?>
+
+  <?define GuidPackage={A19EA263-680D-4626-AF54-5A05ACCC027C} ?>
+
+  <?else?>
+
+  <?define Win64=no ?>
+
+  <?define ToolsBinDir=dirBin32 ?>
+  <?define GuidGssDll=5F38982B-A325-4A7B-A2FC-EA40314F4D00 ?>
+
+  <?define GuidPackage={F0525351-C791-4890-98BE-14B38D3E6B72} ?>
+  <?endif?>
+
+  <Module Id="Heimdal.GSS" Language="0" Version="$(var.Version)">
+
+    <Package Id="$(var.GuidPackage)"
+	     InstallerVersion="200"
+	     Languages="1033" Manufacturer="Heimdal"
+	     SummaryCodepage="1252" AdminImage="no"
+	     Platform="$(var.Platform)" />
+
+    <Directory Id='TARGETDIR' Name='SourceDir' DiskId='1'>
+
+      <?ifdef Target32 ?>
+      <Directory Id='ProgramFilesFolder'>
+	<Directory Id='INSTALLDIR32' Name='Heimdal'>
+	  <Directory Id='dirBin32' Name='bin'>
+	  </Directory>
+	</Directory>
+      </Directory>
+      <?endif?>
+
+      <?ifdef Target64?>
+      <Directory Id='ProgramFiles64Folder'>
+	<Directory Id='INSTALLDIR64' Name='Heimdal'>
+	  <Directory Id='dirBin64' Name='bin'>
+	  </Directory>
+	</Directory>
+      </Directory>
+      <?endif?>
+
+    </Directory>
+
+    <?ifdef Target32?>
+    <DirectoryRef Id='dirBin32' DiskId='1'>
+      <Component Id='comp.SearchPath.32'
+		 Guid='BA6C1A53-E479-4E87-9B61-7BA793DBAE56' Win64='no'>
+	<RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	  <RegistryValue Name='InstallPath' Type='string'
+			 Value='[dirBin32]' KeyPath='yes' />
+	</RegistryKey>
+	<Environment Id='env.Path.32' Name='PATH' Action='set' Part='last'
+		     Separator=';' Value='[dirBin32]' System='yes' />
+      </Component>
+
+    </DirectoryRef>
+    <?endif?>
+
+    <?ifdef Target64?>
+    <DirectoryRef Id='dirBin64' DiskId='1'>
+      <Component Id='comp.SearchPath.64'
+		 Guid='2F189729-2253-47A1-AA68-06FE3A9697A7' Win64='yes'>
+	<RegistryKey Root='HKLM' Key='Software\Heimdal\CurrentVersion'>
+	  <RegistryValue Name='InstallPath' Type='string'
+			 Value='[dirBin64]' KeyPath='yes' />
+	</RegistryKey>
+	<Environment Id='env.Path' Name='PATH' Action='set' Part='last'
+		     Separator=';' Value='[dirBin64]' System='yes' />
+      </Component>
+
+    </DirectoryRef>
+    <?endif?>
+
+    <DirectoryRef Id='$(var.ToolsBinDir)' FileSource='$(var.BinDir)\$(var.AsmKrbName)'>
+
+      <Component Id='comp.gssdll'
+		 Guid='$(var.GuidGssDll)'
+		 Win64='$(var.Win64)'>
+	<File Name='gssapi.dll' KeyPath='yes' />
+	<File Name='gssapi.pdb' />
+      </Component>
+
+    </DirectoryRef>
+  </Module>
+</Wix>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-installer.wxs b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-installer.wxs
index a1b159bad..0b6000d1b 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-installer.wxs
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-installer.wxs
@@ -15,7 +15,8 @@
   <?define GuidKvno=2B932C2B-9167-4051-BDF7-A104E9983CE6 ?>
   <?define GuidKcpytkt=17734691-7CB3-4E9A-AADC-6D4205795F43 ?>
   <?define GuidKdeltkt=3E853905-8CDA-4E14-8EBA-C0C4EEDB811A ?>
-  <?define GuidKcc=F411A9F1-A186-40CB-B55B-CADBE0166268 ?>
+  <?define GuidHeimtools=F411A9F1-A186-40CB-B55B-CADBE0166268 ?>
+  <?define GuidKadmin=E628E9AA-43AB-47EE-8A01-815C027555F2 ?>
 
   <?define ConfigDir=INSTALLDIR64 ?>
 
@@ -33,7 +34,8 @@
   <?define GuidKvno=4C6015BE-1347-4D12-8841-FF90E0B9D6A8 ?>
   <?define GuidKcpytkt=CBCDFC80-601B-4F26-A020-7D1278735B95 ?>
   <?define GuidKdeltkt=6450EE72-E472-4709-B457-B579BFB2472B ?>
-  <?define GuidKcc=11800964-4A5F-466E-B2FE-DD2EFC54DDB9 ?>
+  <?define GuidHeimtools=11800964-4A5F-466E-B2FE-DD2EFC54DDB9 ?>
+  <?define GuidKadmin=B31F9FFC-D588-4A3E-9AEA-C9E9137B08F0 ?>
 
   <?define ConfigDir=INSTALLDIR32 ?>
 
@@ -47,7 +49,11 @@
     <Package Id='*' Description='!(loc.Description)'
       Manufacturer='!(loc.Manufacturer)'
       InstallerVersion='300' Languages='!(loc.LanguageCode)'
-      Compressed='yes' SummaryCodepage='1252' />
+      Compressed='yes' SummaryCodepage='1252'
+      Platform='$(var.Platform)'
+      InstallScope='perMachine'
+      InstallPrivileges='elevated'
+      Keywords='Heimdal,Kerberos,GSS' />
 
     <Directory Id='TARGETDIR' Name='SourceDir' DiskId='1'>
 
@@ -55,10 +61,6 @@
       <Directory Id='ProgramFilesFolder'>
         <Directory Id='INSTALLDIR32' Name='Heimdal'>
           <Directory Id='dirBin32' Name='bin'>
-            <Directory Id='dirPlugin32' Name='plugin'>
-              <Directory Id='PLUGINDIR32' Name='krb5'>
-              </Directory>
-            </Directory>
           </Directory>
         </Directory>
       </Directory>
@@ -68,10 +70,6 @@
       <Directory Id='ProgramFiles64Folder'>
         <Directory Id='INSTALLDIR64' Name='Heimdal'>
           <Directory Id='dirBin64' Name='bin'>
-            <Directory Id='dirPlugin64' Name='plugin'>
-              <Directory Id='PLUGINDIR64' Name='krb5'>
-              </Directory>
-            </Directory>
           </Directory>
         </Directory>
       </Directory>
@@ -83,8 +81,8 @@
     <DirectoryRef Id='dirBin32' DiskId='1'>
       <Component Id='comp.SearchPath.32' Feature='feature.Main'
                  Guid='BA6C1A53-E479-4E87-9B61-7BA793DBAE56' Win64='no'>
-        <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                     Key='Software\Heimdal\CurrentVersion'>
+	<RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+		     Key='Software\Heimdal\CurrentVersion'>
           <RegistryValue Name='InstallPath' Type='string'
                          Value='[dirBin32]' KeyPath='yes' />
         </RegistryKey>
@@ -95,6 +93,9 @@
       <Merge Id='Heimdal.Assemblies.32' Language='0'
              SourceFile='$(var.InstDir32)\Heimdal.msm' />
 
+      <Merge Id='Heimdal.GSS.32' Language='0'
+	     SourceFile='$(var.InstDir32)\Heimdal.GSS.msm' />
+
       <Merge Id='Heimdal.Policy.32' Language='0'
              SourceFile='$(var.InstDir32)\Heimdal.Policy.msm' />
 
@@ -108,8 +109,8 @@
     <DirectoryRef Id='dirBin64' DiskId='1'>
       <Component Id='comp.SearchPath.64' Feature='feature.Main'
                  Guid='2F189729-2253-47A1-AA68-06FE3A9697A7' Win64='yes'>
-        <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                     Key='Software\Heimdal\CurrentVersion'>
+	<RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+		     Key='Software\Heimdal\CurrentVersion'>
           <RegistryValue Name='InstallPath' Type='string'
                          Value='[dirBin64]' KeyPath='yes' />
         </RegistryKey>
@@ -120,6 +121,9 @@
       <Merge Id='Heimdal.Assemblies.64' Language='0'
              SourceFile='$(var.InstDir64)\Heimdal.msm' />
 
+      <Merge Id='Heimdal.GSS.64' Language='0'
+	     SourceFile='$(var.InstDir64)\Heimdal.GSS.msm' />
+
       <Merge Id='Heimdal.Policy.64' Language='0'
              SourceFile='$(var.InstDir64)\Heimdal.Policy.msm' />
 
@@ -187,19 +191,26 @@
         <File Name='kdeltkt.pdb' />
       </Component>
 
-      <Component Id='comp.kcc'
-                 Guid='$(var.GuidKcc)'
+      <Component Id='comp.heimtools'
+                 Guid='$(var.GuidHeimtools)'
                  Win64='$(var.Win64)'>
-        <File Name='kcc.exe' KeyPath='yes'>
+        <File Name='heimtools.exe' KeyPath='yes'>
           <CopyFile Id='klist.exe' DestinationName='klist.exe' DestinationProperty='$(var.ToolsBinDir)' />
           <CopyFile Id='kswitch.exe' DestinationName='kswitch.exe' DestinationProperty='$(var.ToolsBinDir)' />
         </File>
-        <File Name='kcc.pdb'>
+        <File Name='heimtools.pdb'>
           <CopyFile Id='klist.pdb' DestinationName='klist.pdb' />
           <CopyFile Id='kswitch.pdb' DestinationName='kswitch.pdb' />
         </File>
       </Component>
 
+      <Component Id='comp.kadmin'
+		 Guid='$(var.GuidKadmin)'
+		 Win64='$(var.Win64)'>
+	<File Name='kadmin.exe' KeyPath='yes' />
+	<File Name='kadmin.pdb' />
+      </Component>
+
       <Component Id='comp.Heimdal.chm'
                  Guid='785F6668-EBDB-4F18-8BEF-F72ECECB43D6'>
         <File Source='$(var.DocDir)\heimdal.chm' />
@@ -212,35 +223,9 @@
 
     </DirectoryRef>
 
-    <?ifdef Target32?>
-    <DirectoryRef Id='PLUGINDIR32'>
-      <Component Id='comp.Plugin.Reg.32' Feature='feature.Main'
-                 Guid='4BC44234-70A4-4CC1-A5AF-4CA76E9F9487' Win64='no'>
-        <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                     Key='Software\Heimdal'>
-          <RegistryValue Name='plugin_dir' Type='multiString' Action='append'
-                         Value='"[PLUGINDIR32]"' KeyPath='yes' />
-        </RegistryKey>
-      </Component>
-    </DirectoryRef>
-    <?endif?>
-
-    <?ifdef Target64?>
-    <DirectoryRef Id='PLUGINDIR64'>
-      <Component Id='comp.Plugin.Reg.64' Feature='feature.Main'
-                 Guid='5A99A52E-A4CD-40F8-AFFD-AD61939FC547' Win64='yes'>
-        <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                     Key='Software\Heimdal'>
-          <RegistryValue Name='plugin_dir' Type='multiString' Action='append'
-                         Value='"[PLUGINDIR64]"' KeyPath='yes' />
-        </RegistryKey>
-      </Component>
-    </DirectoryRef>
-    <?endif?>
-
     <DirectoryRef Id='TARGETDIR'>
       <Directory Id='CommonAppDataFolder' Name='ProgramData'>
-        <Directory Id='dirCommonKerberos' Name='Kerberos' FileSource='$(var.SrcDir)'>
+	<Directory Id='dirCommonKerberos' Name='Kerberos' FileSource='$(var.SrcDir)'>
 
           <Component Id='comp.krb5.conf'
                      Guid='ED28951F-7B17-4DF5-91D7-4DC11C810E66'
@@ -248,8 +233,8 @@
             <File Name='krb5.conf' KeyPath='yes' Id='krb5_conf' />
             <Environment Id='KRB5_CONFIG_by_krb5.conf' Name='KRB5_CONFIG' Action='set' System='yes' Value='[#krb5_conf]' />
             <!-- Backwards compatibility -->
-            <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                         Key='Software\MIT\Kerberos'>
+	    <RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+			 Key='Software\MIT\Kerberos'>
               <RegistryValue Name='config' Type='string' Value='[#krb_conf]' />
             </RegistryKey>
             <Condition>Not LEGACYKRB5INI And Not LEGACYKRB5CONF And Not LEGACYKRB5REG32 And Not LEGACYKRB5REG64</Condition>
@@ -263,14 +248,14 @@
                       SourceProperty='LEGACYKRB5INI' />
             <Environment Id='KRB5_CONFIG_by_legacy_krb5.ini' Name='KRB5_CONFIG'
                          Action='set' System='yes' Value='[dirCommonKerberos]krb5.conf' />
-            <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                         Key='Software\Heimdal\CurrentVersion'>
+	    <RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+			 Key='Software\Heimdal\CurrentVersion'>
               <RegistryValue Name='LegacyKrb5IniLocation' Type='string'
                              Value='[LEGACYKRB5INI]' KeyPath='yes' />
             </RegistryKey>
             <!-- Backwards compatibility -->
-            <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                         Key='Software\MIT\Kerberos'>
+	    <RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+			 Key='Software\MIT\Kerberos'>
               <RegistryValue Name='config' Type='string'
                              Value='[dirCommonKerberos]krb5.conf' />
             </RegistryKey>
@@ -285,14 +270,14 @@
                       SourceProperty='LEGACYKRB5CONF' />
             <Environment Id='KRB5_CONFIG_by_legacy_krb5.conf' Name='KRB5_CONFIG'
                          Action='set' System='yes' Value='[dirCommonKerberos]krb5.conf' />
-            <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                         Key='Software\Heimdal\CurrentVersion'>
-              <RegistryValue Name='LegacyKrb5ConfLocation' Type='string'
+	    <RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+			 Key='Software\Heimdal\CurrentVersion'>
+	    <RegistryValue Name='LegacyKrb5ConfLocation' Type='string'
                              Value='[LEGACYKRB5CONF]' KeyPath='yes' />
             </RegistryKey>
             <!-- Backwards compatibility -->
-            <RegistryKey Action='createAndRemoveOnUninstall' Root='HKLM'
-                         Key='Software\MIT\Kerberos'>
+	    <RegistryKey ForceDeleteOnUninstall='yes' Root='HKLM'
+			 Key='Software\MIT\Kerberos'>
               <RegistryValue Name='config' Type='string'
                              Value='[dirCommonKerberos]krb5.conf' />
             </RegistryKey>
@@ -370,23 +355,8 @@
       <ComponentRef Id='comp.krb5.ini.move' />
       <ComponentRef Id='comp.ktutil' />
       <ComponentRef Id='comp.kvno' />
-      <ComponentRef Id='comp.kcc' />
-
-      <?ifdef LsaCache ?>
-      <?ifdef Target64?>
-      <ComponentGroupRef Id='comps.LSACache.64' />
-      <?else?>
-      <ComponentGroupRef Id='comps.LSACache.32' />
-      <?endif?>
-      <?endif?>
-
-      <?ifdef ApiCache ?>
-      <?ifdef Target64?>
-      <ComponentGroupRef Id='comps.APICache.64' />
-      <?else?>
-      <ComponentGroupRef Id='comps.APICache.32' />
-      <?endif?>
-      <?endif?>
+      <ComponentRef Id='comp.heimtools' />
+      <ComponentRef Id='comp.kadmin' />
 
       <?ifdef MKShim ?>
       <?ifdef Target64?>
@@ -398,10 +368,12 @@
 
       <?ifdef Target64?>
       <MergeRef Id='Heimdal.Assemblies.64' />
+      <MergeRef Id='Heimdal.GSS.64' />
       <MergeRef Id='Heimdal.Policy.64' />
       <MergeRef Id='Runtime.64' />
       <?else?>
       <MergeRef Id='Heimdal.Assemblies.32' />
+      <MergeRef Id='Heimdal.GSS.32' />
       <MergeRef Id='Heimdal.Policy.32' />
       <MergeRef Id='Runtime.32' />
       <?endif?>
@@ -415,16 +387,11 @@
                Title='!(loc.Fea32BitTitle)'
                Description='!(loc.Fea32BitDesc)'
                Level='1' TypicalDefault='install' InstallDefault='local'>
-        <?ifdef LsaCache ?>
-        <ComponentGroupRef Id='comps.LSACache.32' />
-        <?endif?>
-        <?ifdef ApiCache ?>
-        <ComponentGroupRef Id='comps.APICache.32' />
-        <?endif?>
         <?ifdef MKShim ?>
         <ComponentGroupRef Id='comp.Heimdal.MKShim.32' />
         <?endif?>
         <MergeRef Id='Heimdal.Assemblies.32' />
+	<MergeRef Id='Heimdal.GSS.32' />
         <MergeRef Id='Heimdal.Policy.32' />
         <MergeRef Id='Runtime.32' />
       </Feature>
@@ -443,9 +410,10 @@
 
     <!-- Other properties -->
 
-    <Property Id='ALLUSERS' Value='1' Secure='yes' />
-
     <UIRef Id='WixUI_FeatureTree' />
 
+    <WixVariable Id="WixUIBannerBmp" Value="images\Heimdal_banner.bmp" />
+    <WixVariable Id="WixUIDialogBmp" Value="images\Heimdal_dialog.bmp" />
+
   </Product>
 </Wix>
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-policy.wxs b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-policy.wxs
index 1ef0d965e..ef471c1f0 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-policy.wxs
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/installer/heimdal-policy.wxs
@@ -32,12 +32,13 @@
 
     <Directory Id='TARGETDIR' Name='SourceDir'>
       <Directory Id='dir.policy.Heimdal.Kerberos'
-                 Name='$(var.PolPrefix).Heimdal.Kerberos'
-                 FileSource='$(var.BinDir)\$(var.PolPrefix).Heimdal.Kerberos'>
+		 Name='$(var.PolPrefix).$(var.AsmKrbName)'
+		 FileSource='$(var.BinDir)\$(var.PolPrefix).$(var.AsmKrbName)'>
 
         <Component Id='comp.policy.Heimdal.Kerberos'
                    Guid='$(var.GuidPolKerberos)'
                    Win64='$(var.Win64)'>
+	  <Condition>VersionNT &gt; 501</Condition>
           <File Name='$(var.Version).pol' KeyPath='yes' Assembly='win32'
                 Id='policy.Kerberos' AssemblyManifest='policy.Kerberos' />
           <File Name='$(var.Version).cat' Id='policy.Kerberos.cat' />
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.bmp b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.bmp
new file mode 100644
index 000000000..8ae6818be
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.bmp differ
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.png b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.png
new file mode 100644
index 000000000..7f81af01d
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_banner.png differ
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.bmp b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.bmp
new file mode 100644
index 000000000..fa265e48e
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.bmp differ
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.png b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.png
new file mode 100644
index 000000000..53e45ffd0
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/packages/windows/installer/images/Heimdal_dialog.png differ
diff --git a/crypto/external/bsd/heimdal/dist/packages/windows/sdk/NTMakefile b/crypto/external/bsd/heimdal/dist/packages/windows/sdk/NTMakefile
index 401fc5755..3c850eeca 100644
--- a/crypto/external/bsd/heimdal/dist/packages/windows/sdk/NTMakefile
+++ b/crypto/external/bsd/heimdal/dist/packages/windows/sdk/NTMakefile
@@ -147,5 +147,6 @@ clean::
 	-$(RM) $(SDKINCDIR)\krb5\*.*
 	-$(RM) $(SDKINCDIR)\heimdal\*.*
 	-$(RM) $(SDKINCDIR)\kadm5\*.*
+	-$(RM) $(SDKINCDIR)\gssapi\*.*
 	-$(RM) $(SDKLIBDIR)\*.*
 	-$(RM) $(SDKREDISTDIR)\*.*
diff --git a/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/heimdal_krb5.pot b/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/heimdal_krb5.pot
index 914dd14e7..176e8d46a 100644
--- a/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/heimdal_krb5.pot
+++ b/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/heimdal_krb5.pot
@@ -1144,7 +1144,7 @@ msgstr ""
 
 #: lib/krb5/log.c:311
 #, c-format
-msgid "open(%s) logile: %s"
+msgid "open(%s) logfile: %s"
 msgstr ""
 
 #: lib/krb5/log.c:322
@@ -1705,7 +1705,7 @@ msgstr ""
 #: lib/krb5/transited.c:457
 #: lib/krb5/transited.c:490
 #, c-format
-msgid "no transit allowed through realm %s"
+msgid "no transit allowed through realm %s from %s to %s"
 msgstr ""
 
 #: lib/krb5/v4_glue.c:153
diff --git a/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/sv_SE.po b/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/sv_SE.po
index 68e0c3a4c..203994665 100644
--- a/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/sv_SE.po
+++ b/crypto/external/bsd/heimdal/dist/po/heimdal_krb5/sv_SE.po
@@ -1126,7 +1126,7 @@ msgstr ""
 
 #: lib/krb5/log.c:311
 #, c-format
-msgid "open(%s) logile: %s"
+msgid "open(%s) logfile: %s"
 msgstr ""
 
 #: lib/krb5/log.c:322
@@ -1675,7 +1675,7 @@ msgstr ""
 #: lib/krb5/transited.c:457
 #: lib/krb5/transited.c:490
 #, c-format
-msgid "no transit allowed through realm %s"
+msgid "no transit allowed through realm %s from %s to %s"
 msgstr ""
 
 #: lib/krb5/v4_glue.c:151
diff --git a/crypto/external/bsd/heimdal/dist/tests/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/Makefile.am
index 66deccd67..8ff43cc24 100644
--- a/crypto/external/bsd/heimdal/dist/tests/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/Makefile.am
@@ -2,7 +2,7 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-SUBDIRS = bin db kdc gss ldap can java
+SUBDIRS = bin db gss ldap can java kdc
 
 if ENABLE_SHARED
 if HAVE_DLOPEN
diff --git a/crypto/external/bsd/heimdal/dist/tests/bin/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/bin/Makefile.am
index 52b7f15d6..98bb342f7 100644
--- a/crypto/external/bsd/heimdal/dist/tests/bin/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/bin/Makefile.am
@@ -2,6 +2,14 @@ include $(top_srcdir)/Makefile.am.common
 
 noinst_SCRIPTS = setup-env
 
+noinst_PROGRAMS = intr
+
+intr_SOURCES = intr.c
+
+CHECK_LOCAL = no-check-local
+
+intr_LDADD = $(LIB_roken)
+
 do_subst = \
 	top_srcdir="$$(cd ${top_srcdir} && pwd)" ; \
 	top_builddir="$$(cd ${top_builddir} && pwd)" ; \
diff --git a/crypto/external/bsd/heimdal/dist/tests/bin/intr.c b/crypto/external/bsd/heimdal/dist/tests/bin/intr.c
new file mode 100644
index 000000000..4206de267
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/bin/intr.c
@@ -0,0 +1,58 @@
+/*	$NetBSD: intr.c,v 1.2 2017/01/28 21:31:51 christos Exp $	*/
+
+#include <config.h>
+
+#include <krb5/getarg.h>
+#include <krb5/roken.h>
+#include <time.h>
+
+static int help_flag;
+static int timeout = 3;
+
+static struct getargs args[] = {
+    { "help", 'h', arg_flag, &help_flag, NULL, NULL },
+    { "timeout", 't', arg_integer, &timeout, NULL, NULL }
+};
+
+static int nargs = sizeof(args) / sizeof(args[0]);
+
+static time_t
+handle_timeout(void *data)
+{
+    static int killed;
+
+    if (!killed++)
+        return -1;  /* kill it */
+    return -2;      /* stop waiting for it */
+}
+
+static void
+usage(int status)
+{
+    arg_printusage(args, nargs, NULL, "command");
+    exit(status);
+}
+
+
+int
+main(int argc, char **argv)
+{
+    int optidx = 0;
+
+    setprogname(argv[0]);
+
+    if (getarg(args, nargs, argc, argv, &optidx))
+        usage(1);
+
+    if (help_flag)
+        usage(0);
+
+    argc -= optidx;
+    argv += optidx;
+
+    if (argc == 0)
+        usage(1);
+
+    return simple_execvp_timed(argv[0], argv, handle_timeout, NULL,
+                               timeout);
+}
diff --git a/crypto/external/bsd/heimdal/dist/tests/bin/setup-env.in b/crypto/external/bsd/heimdal/dist/tests/bin/setup-env.in
index 8e5691c54..5c5de1265 100644
--- a/crypto/external/bsd/heimdal/dist/tests/bin/setup-env.in
+++ b/crypto/external/bsd/heimdal/dist/tests/bin/setup-env.in
@@ -1,5 +1,8 @@
 #!/bin/sh
 
+HEIM_PIDFILE_DIR="${objdir}/"
+export HEIM_PIDFILE_DIR
+
 unset KRB5_CONFIG
 unset KRB5CCNAME
 
@@ -19,30 +22,42 @@ ipropd_slave="${TESTS_ENVIRONMENT} ${top_builddir}/lib/kadm5/ipropd-slave"
 kadmin="${TESTS_ENVIRONMENT} ${top_builddir}/kadmin/kadmin"
 kadmind="${TESTS_ENVIRONMENT} ${top_builddir}/kadmin/kadmind"
 kdc="${TESTS_ENVIRONMENT} ${top_builddir}/kdc/kdc"
+kdc_tester="${TESTS_ENVIRONMENT} ${top_builddir}/kdc/kdc-tester"
 kdestroy="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kdestroy"
 kdigest="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kdigest"
 kgetcred="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kgetcred"
 kimpersonate="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kimpersonate"
 kinit="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kinit"
-klist="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kcc klist"
+klist="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/heimtools klist"
 kpasswd="${TESTS_ENVIRONMENT} ${top_builddir}/kpasswd/kpasswd"
 kpasswdd="${TESTS_ENVIRONMENT} ${top_builddir}/kpasswd/kpasswdd"
-kswitch="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/kcc kswitch"
+kswitch="${TESTS_ENVIRONMENT} ${top_builddir}/kuser/heimtools kswitch"
 ktutil="${TESTS_ENVIRONMENT} ${top_builddir}/admin/ktutil"
 gsstool="${TESTS_ENVIRONMENT} ${top_builddir}/lib/gssapi/gsstool"
 
 # regression test tools
 test_ap_req="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_ap-req"
+test_canon="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_canon"
 test_gic="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_gic"
 test_renew="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_renew"
 test_ntlm="${TESTS_ENVIRONMENT} ${top_builddir}/lib/gssapi/test_ntlm"
 test_context="${TESTS_ENVIRONMENT} ${top_builddir}/lib/gssapi/test_context"
 rkpty="${TESTS_ENVIRONMENT} ${top_builddir}/lib/roken/rkpty"
+test_set_kvno0="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_set_kvno0"
+test_alname="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_alname"
+test_kuserok="${TESTS_ENVIRONMENT} ${top_builddir}/lib/krb5/test_kuserok"
 
 # misc apps
 have_db="${top_builddir}/tests/db/have-db"
 leaks_kill="${top_srcdir}/tests/kdc/leaks-kill.sh"
 wait_kdc="${top_srcdir}/tests/kdc/wait-kdc.sh"
+getpid () {
+    if [ -f "$HEIM_PIDFILE_DIR/lt-${1}.pid" ]; then
+        cat "$HEIM_PIDFILE_DIR/lt-${1}.pid"
+    else
+        cat "$HEIM_PIDFILE_DIR/${1}.pid"
+    fi
+}
 
 if [ ! "${NO_AFS}" ] ; then
     afs_no_unlog="--no-unlog"
diff --git a/crypto/external/bsd/heimdal/dist/tests/can/check-can.in b/crypto/external/bsd/heimdal/dist/tests/can/check-can.in
index 5922c2fdb..e9a05cdcf 100644
--- a/crypto/external/bsd/heimdal/dist/tests/can/check-can.in
+++ b/crypto/external/bsd/heimdal/dist/tests/can/check-can.in
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2007 Kungliga Tekniska Högskolan
+# Copyright (c) 2007 Kungliga Tekniska Högskolan
 # (Royal Institute of Technology, Stockholm, Sweden). 
 # All rights reserved. 
 #
diff --git a/crypto/external/bsd/heimdal/dist/tests/can/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/can/krb5.conf.in
index 3ac24cdfd..d2aed73de 100644
--- a/crypto/external/bsd/heimdal/dist/tests/can/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/can/krb5.conf.in
@@ -17,8 +17,12 @@
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/current.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/can/mit-pkinit-20070607.xf b/crypto/external/bsd/heimdal/dist/tests/can/mit-pkinit-20070607.xf
index 686b4f30e..3248e99a1 100644
--- a/crypto/external/bsd/heimdal/dist/tests/can/mit-pkinit-20070607.xf
+++ b/crypto/external/bsd/heimdal/dist/tests/can/mit-pkinit-20070607.xf
@@ -23,6 +23,9 @@
 		mkey_file = @objdir@/mkey.file
 	}
 
+[hdb]
+        db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/can/test_can.in b/crypto/external/bsd/heimdal/dist/tests/can/test_can.in
index 31e88787b..f693b852d 100644
--- a/crypto/external/bsd/heimdal/dist/tests/can/test_can.in
+++ b/crypto/external/bsd/heimdal/dist/tests/can/test_can.in
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2007 Kungliga Tekniska Högskolan
+# Copyright (c) 2007 Kungliga Tekniska Högskolan
 # (Royal Institute of Technology, Stockholm, Sweden). 
 # All rights reserved. 
 #
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/db/Makefile.am
index ca4eeef49..4fa378219 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/db/Makefile.am
@@ -2,7 +2,7 @@
 
 include $(top_srcdir)/Makefile.am.common
 
-noinst_DATA = krb5.conf krb5.conf-sqlite
+noinst_DATA = krb5.conf krb5.conf-sqlite krb5.conf-db3 krb5.conf-db1 krb5.conf-lmdb
 
 noinst_SCRIPTS = have-db
 
@@ -13,6 +13,8 @@ TESTS = $(check_SCRIPTS)
 do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
 	-e 's,[@]top_builddir[@],$(top_builddir),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/db,g' \
+	-e 's,[@]default_db_type[@],$(db_type),g' \
+	-e 's,[@]db_type_preference[@],$(db_type_preference),g' \
 	-e 's,[@]EGREP[@],$(EGREP),g' 
 
 loaddump-db: loaddump-db.in Makefile
@@ -48,6 +50,18 @@ krb5.conf-sqlite: krb5.conf.in Makefile
 	$(do_subst) -e 's,[@]type[@],sqlite:,g' < $(srcdir)/krb5.conf.in > krb5.conf-sqlite.tmp
 	mv krb5.conf-sqlite.tmp krb5.conf-sqlite
 
+krb5.conf-db3: krb5.conf.in Makefile
+	$(do_subst) -e 's,[@]type[@],db3:,g' < $(srcdir)/krb5.conf.in > krb5.conf-db3.tmp
+	mv krb5.conf-db3.tmp krb5.conf-db3
+
+krb5.conf-db1: krb5.conf.in Makefile
+	$(do_subst) -e 's,[@]type[@],db1:,g' < $(srcdir)/krb5.conf.in > krb5.conf-db1.tmp
+	mv krb5.conf-db1.tmp krb5.conf-db1
+
+krb5.conf-lmdb: krb5.conf.in Makefile
+	$(do_subst) -e 's,[@]type[@],lmdb:,g' < $(srcdir)/krb5.conf.in > krb5.conf-lmdb.tmp
+	mv krb5.conf-lmdb.tmp krb5.conf-lmdb
+
 krb5-mit.conf: krb5-mit.conf.in Makefile
 	$(do_subst) < $(srcdir)/krb5-mit.conf.in > krb5-mit.conf.tmp
 	mv krb5-mit.conf.tmp krb5-mit.conf
@@ -64,6 +78,9 @@ CLEANFILES= \
 	mkey.file* \
 	krb5.conf krb5.conf.tmp \
 	krb5.conf-sqlite krb5.conf-sqlite.tmp \
+	krb5.conf-db3 krb5.conf-db3.tmp \
+	krb5.conf-db1 krb5.conf-db1.tmp \
+	krb5.conf-lmdb krb5.conf-lmdb.tmp \
 	krb5-mit.conf krb5-mit.conf.tmp \
 	tempfile \
 	log.current-db* \
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/add-modify-delete.in b/crypto/external/bsd/heimdal/dist/tests/db/add-modify-delete.in
index 48b0e48b6..276059627 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/add-modify-delete.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/add-modify-delete.in
@@ -38,6 +38,9 @@ srcdir="@srcdir@"
 objdir="@objdir@"
 EGREP="@EGREP@"
 
+default_db_type=@default_db_type@
+db_type=${1:-${default_db_type}}
+
 # If there is no useful db support compile in, disable test
 ./have-db || exit 77
 
@@ -46,7 +49,7 @@ R=EXAMPLE.ORG
 kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
 iproplog="${TESTS_ENVIRONMENT} ../../lib/kadm5/iprop-log"
 
-KRB5_CONFIG="${objdir}/krb5.conf"
+KRB5_CONFIG="${objdir}/krb5.conf-${db_type}"
 export KRB5_CONFIG
 
 rm -f current-db*
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/check-aliases.in b/crypto/external/bsd/heimdal/dist/tests/db/check-aliases.in
index e62a3e162..dbef36dfb 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/check-aliases.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/check-aliases.in
@@ -36,6 +36,9 @@ srcdir="@srcdir@"
 objdir="@objdir@"
 EGREP="@EGREP@"
 
+default_db_type=@default_db_type@
+db_type=${1:-${default_db_type}}
+
 testfailed="echo test failed; cat messages.log; exit 1"
 
 # If there is no useful db support compile in, disable test
@@ -45,7 +48,7 @@ R=TEST.H5L.SE
 
 kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l"
 
-KRB5_CONFIG="${objdir}/krb5.conf"
+KRB5_CONFIG="${objdir}/krb5.conf-${db_type}"
 export KRB5_CONFIG
 
 rm -f current-db*
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/check-dbinfo.in b/crypto/external/bsd/heimdal/dist/tests/db/check-dbinfo.in
index 1fed72e45..67bc29881 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/check-dbinfo.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/check-dbinfo.in
@@ -37,7 +37,10 @@
 srcdir="@srcdir@"
 objdir="@objdir@"
 
-KRB5_CONFIG="${objdir}/krb5.conf"
+default_db_type=@default_db_type@
+db_type=${1:-${default_db_type}}
+
+KRB5_CONFIG="${objdir}/krb5.conf-${db_type}"
 export KRB5_CONFIG
 
 ../../lib/hdb/test_dbinfo > dbinfo.out || exit 1
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/have-db.in b/crypto/external/bsd/heimdal/dist/tests/db/have-db.in
index 9d0d2636d..d43fdcc56 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/have-db.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/have-db.in
@@ -38,6 +38,18 @@ top_builddir="@top_builddir@"
 
 . ${top_builddir}/tests/bin/setup-env
 
+if [ $# != 0 ]; then
+    for type in "$@"; do
+        for have_type in \
+            `${kdc} --builtin-hdb | sed 's/^builtin hdb backends: //'`; do
+            if [ "$type" = "$have_type" ]; then
+                exit 0
+            fi
+        done
+    done
+    exit 1
+fi
+
 list=`${kdc} --builtin-hdb | sed 's/^builtin hdb backends: //'`
 oldIFS="$IFS"
 IPS=,
@@ -47,10 +59,12 @@ IFS="$oldIFS"
 while [ $# != 0 ] ; do
     case $1 in
     db:*) exit 0 ;;
+    db1:*) exit 0 ;;
     gdbm:*) exit 0 ;;
     db4:*) exit 0 ;;
     db3:*) exit 0 ;;
-    ldb:*) exit 0 ;;
+    lmdb:*) exit 0 ;;
+    sqlite:*) exit 0 ;;
     esac
     shift
 done
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/krb5-mit.conf.in b/crypto/external/bsd/heimdal/dist/tests/db/krb5-mit.conf.in
index 0a59d75cc..99ffe4a65 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/krb5-mit.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/krb5-mit.conf.in
@@ -7,8 +7,12 @@
 			realm = EXAMPLE.ORG
 			dbname = mit-db:@srcdir@/mit-db
 			mkey_file = @srcdir@/mit-db-master-stash
+                        log_file = @objdir@/current.log
 		}
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/db/krb5.conf.in
index 0e91fee7b..f5324cb5a 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/krb5.conf.in
@@ -12,17 +12,21 @@
 			realm = LABEL.TEST.H5L.SE
 			dbname = @type@@objdir@/label-db
 			mkey_file = @objdir@/mkey.file
+                        log_file = @objdir@/current.log
 		}
 		label2 = {
 			dbname = @type@@objdir@/lable2-db
 			realm = LABEL2.TEST.H5L.SE
 			mkey_file = @objdir@/mkey2.file
+                        log_file = @objdir@/current.log
 		}
 		dbname = @type@@objdir@/current-db
 		realm = EXAMPLE.ORG
 		mkey_file = @objdir@/mkey.file
-		log_file = @objdir@/log.current-db.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/loaddump-db.in b/crypto/external/bsd/heimdal/dist/tests/db/loaddump-db.in
index f7d0153bd..32b2af339 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/loaddump-db.in
+++ b/crypto/external/bsd/heimdal/dist/tests/db/loaddump-db.in
@@ -47,15 +47,13 @@ kstash="../../kdc/kstash"
 hprop="../../kdc/hprop"
 hpropd="../../kdc/hpropd"
 
-type="${1}"
-typesep="${type:+:}"
-typeconf="${type:+-}"
+default_db_type=@default_db_type@
+db_type=${1:-${default_db_type}}
 
+propdb="${hprop} --database=${db_type}:./current-db -n"
+propddb="${hpropd} --database=${db_type}:./current-db -n"
 
-propdb="${hprop} --database=${type}${typesep}./current-db -n"
-propddb="${hpropd} --database=${type}${typesep}./current-db -n"
-
-KRB5_CONFIG="${objdir}/krb5.conf${typeconf}${type}"
+KRB5_CONFIG="${objdir}/krb5.conf-${db_type}"
 export KRB5_CONFIG
 
 rm -f current-db*
@@ -78,7 +76,7 @@ cmp out-current-db-sort out-current-db2-sort || exit 1
 
 rm -f current-db*
 
-# check with no extentions
+# check with no extensions
 ${kadmin} load ${srcdir}/text-dump-0.7  || exit 1
 ${propdb} > db-dump.tmp|| exit 1
 rm -f current-db*
@@ -88,7 +86,7 @@ sort < ${srcdir}/text-dump-0.7 | \
     sed 's/[0-9]*$//' > out-text-dump-0.7-orig  || exit 1
 cmp out-text-dump-0.7-orig out-text-dump-0.7 || exit 1
 
-# check with no extentions
+# check with no extensions
 ${kadmin} load ${srcdir}/text-dump-no-ext  || exit 1
 ${propdb} > db-dump.tmp || exit 1
 ${propddb} < db-dump.tmp || exit 1
@@ -98,7 +96,7 @@ sort < ${srcdir}/text-dump-no-ext | \
     awk '{$11=""; print;}' > out-text-dump-no-ext-orig || exit 1
 cmp out-text-dump-no-ext-orig out-text-dump-no-ext || exit 1
 
-# check with known extentions
+# check with known extensions
 ${kadmin} load ${srcdir}/text-dump-known-ext  || exit 1
 ${propdb} > db-dump.tmp || exit 1
 ${propddb} < db-dump.tmp || exit 1
@@ -108,7 +106,7 @@ sort < ${srcdir}/text-dump-known-ext | \
     awk '{$11=""; print;}' > out-text-dump-known-ext-orig || exit 1
 cmp out-text-dump-known-ext-orig out-text-dump-known-ext || exit 1
 
-# check with unknown extentions
+# check with unknown extensions
 ${kadmin} load ${srcdir}/text-dump-unknown-ext  || exit 1
 ${propdb} > db-dump.tmp || exit 1
 ${propddb} < db-dump.tmp || exit 1
diff --git a/crypto/external/bsd/heimdal/dist/tests/db/text-dump-0.7 b/crypto/external/bsd/heimdal/dist/tests/db/text-dump-0.7
index f6b96b3bb..a48a7b0ab 100644
--- a/crypto/external/bsd/heimdal/dist/tests/db/text-dump-0.7
+++ b/crypto/external/bsd/heimdal/dist/tests/db/text-dump-0.7
@@ -1,4 +1,4 @@
-.\"	$NetBSD: text-dump-0.7,v 1.1.1.1 2011/04/13 18:16:01 elric Exp $
+.\"	$NetBSD: text-dump-0.7,v 1.2 2017/01/28 21:31:51 christos Exp $
 .\"
 changepw/kerberos@EXAMPLE.ORG 1::3:2376E6A4C1D5456D:-::2:2376E6A4C1D5456D:-::1:2376E6A4C1D5456D:-::18:39C3D293A6B0CEE734C7874764A8B5449F348AC00A6EA94F7451D07BE31EF239:-::16:108373F74F105875DCCE866B160886C7BC6780E526D0DAEA:-::23:D279B73431AA349F63594EA800397195:- 20050728203748:kadmin/admin@EXAMPLE.ORG 20050728203748:kadmin/admin@EXAMPLE.ORG - - - 3600 3600 639 20050728203748:743456:2
 default@EXAMPLE.ORG 0::3:3B2A671585E93D6B:3/"EXAMPLE.ORGdefault"::2:3B2A671585E93D6B:3/"EXAMPLE.ORGdefault"::1:3B2A671585E93D6B:3/"EXAMPLE.ORGdefault"::18:AF401411D3F29C204611A9BA1EF54AEDEC43A01B0123C57B994B2EE104E7F127:3/"EXAMPLE.ORGdefault"::16:02401CAD7A92760E464025760BCD3BE5DF616DD5A798C719:3/"EXAMPLE.ORGdefault"::23:31D6CFE0D16AE931B73C59D7E0C089C0:3/"EXAMPLE.ORGdefault" 20050728203748:kadmin/admin@EXAMPLE.ORG - - - - 86400 604800 254 20050728203748:863727:0
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/gss/Makefile.am
index 126a987a2..53621409e 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/Makefile.am
@@ -4,7 +4,7 @@ include $(top_srcdir)/Makefile.am.common
 
 noinst_DATA = krb5.conf
 
-SCRIPT_TESTS = check-gss check-gssmask check-context check-spnego check-ntlm
+SCRIPT_TESTS = check-basic check-gss check-gssmask check-context check-spnego check-ntlm
 
 TESTS = $(SCRIPT_TESTS)
 
@@ -12,43 +12,43 @@ check_SCRIPTS = $(SCRIPT_TESTS)
 
 port = 49188
 
-do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
+do_subst = $(heim_verbose)sed -e 's,[@]srcdir[@],$(srcdir),g' \
 	-e 's,[@]env_setup[@],$(top_builddir)/tests/bin/setup-env,g' \
 	-e 's,[@]port[@],$(port),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/gss,g'
 
 check-gss: check-gss.in Makefile
-	$(do_subst) < $(srcdir)/check-gss.in > check-gss.tmp
-	chmod +x check-gss.tmp
+	$(do_subst) < $(srcdir)/check-gss.in > check-gss.tmp && \
+	chmod +x check-gss.tmp && \
 	mv check-gss.tmp check-gss
 
 check-gssmask: check-gssmask.in Makefile
-	$(do_subst) < $(srcdir)/check-gssmask.in > check-gssmask.tmp
-	chmod +x check-gssmask.tmp
+	$(do_subst) < $(srcdir)/check-gssmask.in > check-gssmask.tmp && \
+	chmod +x check-gssmask.tmp && \
 	mv check-gssmask.tmp check-gssmask
 
 check-context: check-context.in Makefile
-	$(do_subst) < $(srcdir)/check-context.in > check-context.tmp
-	chmod +x check-context.tmp
+	$(do_subst) < $(srcdir)/check-context.in > check-context.tmp && \
+	chmod +x check-context.tmp && \
 	mv check-context.tmp check-context
 
 check-spnego: check-spnego.in Makefile
-	$(do_subst) < $(srcdir)/check-spnego.in > check-spnego.tmp
-	chmod +x check-spnego.tmp
+	$(do_subst) < $(srcdir)/check-spnego.in > check-spnego.tmp && \
+	chmod +x check-spnego.tmp && \
 	mv check-spnego.tmp check-spnego
 
 check-basic: check-basic.in Makefile
-	$(do_subst) < $(srcdir)/check-basic.in > check-basic.tmp
-	chmod +x check-basic.tmp
+	$(do_subst) < $(srcdir)/check-basic.in > check-basic.tmp && \
+	chmod +x check-basic.tmp && \
 	mv check-basic.tmp check-basic
 
 check-ntlm: check-ntlm.in Makefile
-	$(do_subst) < $(srcdir)/check-ntlm.in > check-ntlm.tmp
-	chmod +x check-ntlm.tmp
+	$(do_subst) < $(srcdir)/check-ntlm.in > check-ntlm.tmp && \
+	chmod +x check-ntlm.tmp && \
 	mv check-ntlm.tmp check-ntlm
 
 krb5.conf: krb5.conf.in Makefile
-	$(do_subst) < $(srcdir)/krb5.conf.in > krb5.conf.tmp
+	$(do_subst) < $(srcdir)/krb5.conf.in > krb5.conf.tmp && \
 	mv krb5.conf.tmp krb5.conf
 
 CLEANFILES= \
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/check-basic.in b/crypto/external/bsd/heimdal/dist/tests/gss/check-basic.in
index e9a0904b3..3b2a10f51 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/check-basic.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/check-basic.in
@@ -34,9 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
 
+. ${env_setup}
+
 # If there is no useful db support compile in, disable test
 ../db/have-db || exit 77
 
@@ -51,14 +54,12 @@ cache="FILE:krb5ccfile"
 cache2="FILE:krb5ccfile2"
 nocache="FILE:no-such-cache"
 
-kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache ${afs_no_afslog}"
-kdestroy="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache ${afs_no_unlog}"
-klist="${TESTS_ENVIRONMENT} ../../kuser/klist -c $cache"
-kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
-kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port"
+kadmin="${kadmin} -l -r $R"
+kdc="${kdc} --addresses=localhost -P $port"
 
 acquire_cred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_acquire_cred"
 test_kcred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_kcred"
+test_add_store_cred="${TESTS_ENVIRONMENT} ../../lib/gssapi/test_add_store_cred"
 
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
@@ -93,27 +94,30 @@ echo "Doing database check"
 ${kadmin} check ${R} || exit 1
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --testing --detach || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
 exitcode=0
 
 echo "initial ticket"
-${kinit} --password-file=${objdir}/foopassword user@${R} || exitcode=1
+${kinit} -c ${cache} --password-file=${objdir}/foopassword user@${R} || exitcode=1
+
+echo "copy ccache with gss_store_cred"
+${test_add_store_cred} ${cache} ${cache2} || exit 1
+${klist} -c ${cache2} || exit 1
 
 echo "keytab"
 ${acquire_cred} \
     --acquire-type=accept \
     --acquire-name=host@host.test.h5l.se || exit 1
 
+echo "keytab w/ short-form name and name canon rules"
+${acquire_cred} \
+    --acquire-type=accept \
+    --acquire-name=host@host || exit 1
+
 echo "keytab w/o name"
 ${acquire_cred} \
     --acquire-type=accept || exit 1
@@ -183,7 +187,7 @@ KRB5_KTNAME=${nokeytab}
 echo "kcred"
 ${test_kcred} || exit 1
 
-${kdestroy}
+${kdestroy} -c ${cache}
 
 KRB5_KTNAME="${keytab}"
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/check-context.in b/crypto/external/bsd/heimdal/dist/tests/gss/check-context.in
index 58651058d..4272d12ee 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/check-context.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/check-context.in
@@ -34,9 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
 
+. ${env_setup}
+
 # If there is no useful db support compile in, disable test
 ../db/have-db || exit 77
 
@@ -50,6 +53,7 @@ nokeytab="FILE:no-such-keytab"
 cache="FILE:krb5ccfile"
 
 kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache ${afs_no_afslog}"
+klist="${TESTS_ENVIRONMENT} ../../kuser/heimtools klist -c $cache"
 klist="${TESTS_ENVIRONMENT} ../../kuser/klist -c $cache"
 kgetcred="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache"
 kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
@@ -81,8 +85,6 @@ ${kadmin} \
 # add both lucid and lucid.test.h5l.se to simulate aliases
 ${kadmin} add -p p1 --use-defaults host/lucid.test.h5l.se@${R} || exit 1
 ${kadmin} ext -k ${keytab} host/lucid.test.h5l.se@${R} || exit 1
-${kadmin} add -p p1 --use-defaults host/lucid@${R} || exit 1
-${kadmin} ext -k ${keytab} host/lucid@${R} || exit 1
 
 ${kadmin} add -p p1 --use-defaults host/ok-delegate.test.h5l.se@${R} || exit 1
 ${kadmin} mod --attributes=+ok-as-delegate host/ok-delegate.test.h5l.se@${R} || exit 1
@@ -112,19 +114,31 @@ ${kadmin} check ${R} || exit 1
 echo u1 > ${objdir}/foopassword
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
 testfailed="echo test failed; cat messages.log; exit 1"
 
+echo "Test gss_acquire_cred_with_password" ; > messages.log
+${context} --client-name=user1@${R} --client-password=u1 --mech-type=krb5 \
+        host@lucid.test.h5l.se || { eval "$testfailed"; }
+# These must fail (because wrong password)
+${context} --client-name=user1@${R} --client-password=u2 --mech-type=krb5 \
+        host@lucid.test.h5l.se && { eval "$testfailed"; }
+${context} --client-name=user1@${R} --client-password=u2 --mech-type='' \
+        --mech-types=krb5 host@lucid.test.h5l.se && { eval "$testfailed"; }
+${context} --client-name=user1@${R} --client-password=u2 --mech-type=krb5 \
+        --mech-types=krb5 host@lucid.test.h5l.se && { eval "$testfailed"; }
+${context} --client-name=user1@${R} --client-password=u2 --mech-type=all \
+        --mech-types=krb5 host@lucid.test.h5l.se && { eval "$testfailed"; }
+${context} --client-name=user1@${R} --client-password=u2 \
+        --mech-type=krb5,ntlm --mech-types=krb5 host@lucid.test.h5l.se \
+        && { eval "$testfailed"; }
+# gss_acquire_cred_with_password() must not have side-effects
+${klist} && { eval "$testfailed"; }
+
 echo "Getting client initial tickets" ; > messages.log
 ${kinit} --password-file=${objdir}/foopassword --forwardable user1@${R} || \
 	{ eval "$testfailed"; }
@@ -152,12 +166,21 @@ echo "======test naming combinations"
 echo "plain"  ; > messages.log
 ${context} --name-type=hostbased-service host@lucid.test.h5l.se || \
 	{ eval "$testfailed"; }
+echo "plain w/ short-form hostname"  ; > messages.log
+${context} --name-type=hostbased-service host@lucid || \
+	{ eval "$testfailed"; }
 echo "plain (krb5)" ; > messages.log
 ${context} --name-type=krb5-principal-name host/lucid.test.h5l.se@${R} || \
 	{ eval "$testfailed"; }
 echo "plain (krb5 realmless)" ; > messages.log
 ${context} --name-type=krb5-principal-name host/lucid.test.h5l.se || \
 	{ eval "$testfailed"; }
+echo "plain (krb5 realmless short-form)" ; > messages.log
+${context} --name-type=krb5-principal-name host/lucid 2>/dev/null || \
+	{ eval "$testfailed"; }
+echo "creating short-form princ"
+${kadmin} add -p p1 --use-defaults host/lucid@${R} || exit 1
+${kadmin} ext -k ${keytab} host/lucid@${R} || exit 1
 echo "dns canon on (long name) OFF, need dns_wrapper" ; > messages.log
 #${context} --dns-canon host@lucid.test.h5l.se || \
 #	{ eval "$testfailed"; }
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/check-gssmask.in b/crypto/external/bsd/heimdal/dist/tests/gss/check-gssmask.in
index 979bd3165..8ff8ce437 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/check-gssmask.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/check-gssmask.in
@@ -34,9 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
 
+. ${env_setup}
+
 # If there is no useful db support compile in, disable test
 ../db/have-db || exit 77
 
@@ -85,14 +88,8 @@ echo "Doing database check"
 ${kadmin} check ${R} || exit 1
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/check-ntlm.in b/crypto/external/bsd/heimdal/dist/tests/gss/check-ntlm.in
index 9d86aada6..9d96ba5c8 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/check-ntlm.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/check-ntlm.in
@@ -34,9 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
 
+. ${env_setup}
+
 # If there is no useful db support compile in, disable test
 ../db/have-db || exit 77
 
@@ -103,14 +106,8 @@ echo u1 > ${objdir}/foopassword
 echo ds > ${objdir}/barpassword
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/check-spnego.in b/crypto/external/bsd/heimdal/dist/tests/gss/check-spnego.in
index 701e634f1..d955054b2 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/check-spnego.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/check-spnego.in
@@ -34,9 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
 
+. ${env_setup}
+
 # If there is no useful db support compile in, disable test
 ../db/have-db || exit 77
 
@@ -102,14 +105,8 @@ echo u1 > ${objdir}/foopassword
 echo ds > ${objdir}/barpassword
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
@@ -161,7 +158,6 @@ for arg in \
     NTLM_ACCEPTOR_CCACHE="${cacheds}-no"
     ${context} --mech-type=spnego \
         $arg \
-	--client-name=user1@TEST.H5L.SE \
         --name-type=hostbased-service \
         --ret-mech-type=krb5  \
         host@host.test.h5l.se || \
@@ -172,7 +168,6 @@ for arg in \
     NTLM_USER_FILE="${srcdir}/ntlm-user-file.txt-no"
     ${context} --mech-type=spnego \
         $arg \
-	--client-name=user1@TEST.H5L.SE \
         --name-type=hostbased-service \
         --ret-mech-type=krb5 \
         host@host.test.h5l.se || \
@@ -183,7 +178,6 @@ for arg in \
     KRB5_KTNAME="${keytab}-no"
     ${context} --mech-type=spnego \
         $arg \
-	--client-name=user1@TEST.H5L.SE \
 	--server-no-delegate \
         --name-type=hostbased-service \
         --ret-mech-type=ntlm \
@@ -195,7 +189,6 @@ for arg in \
     KRB5CCNAME="${cache}-no"
     ${context} --mech-type=spnego \
         $arg \
-	--client-name=user1@TEST.H5L.SE \
 	--server-no-delegate \
         --name-type=hostbased-service \
         --ret-mech-type=ntlm \
diff --git a/crypto/external/bsd/heimdal/dist/tests/gss/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/gss/krb5.conf.in
index 9713113e2..e32a88963 100644
--- a/crypto/external/bsd/heimdal/dist/tests/gss/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/gss/krb5.conf.in
@@ -6,6 +6,8 @@
 	default_keytab_name = @objdir@/server.keytab
 	dns_canonicalize_hostname = false
 	dns_lookup_realm = false
+	name_canon_rules = as-is:realm=TEST.H5L.SE
+	name_canon_rules = qualify:domain=test.h5l.se
 
 [realms]
 	TEST.H5L.SE = {
@@ -23,8 +25,12 @@
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/current.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/java/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/java/Makefile.am
index ada4cb06c..ee90d7056 100644
--- a/crypto/external/bsd/heimdal/dist/tests/java/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/java/Makefile.am
@@ -13,6 +13,7 @@ TESTS = $(SCRIPT_TESTS)
 port = 49188
 
 do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
+	-e 's,[@]env_setup[@],$(top_builddir)/tests/bin/setup-env,g' \
 	-e 's,[@]port[@],$(port),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/java,g'
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/java/check-kinit.in b/crypto/external/bsd/heimdal/dist/tests/java/check-kinit.in
index 075c32f84..4b6010cf7 100644
--- a/crypto/external/bsd/heimdal/dist/tests/java/check-kinit.in
+++ b/crypto/external/bsd/heimdal/dist/tests/java/check-kinit.in
@@ -35,18 +35,27 @@
 #
 
 srcdir="@srcdir@"
+env_setup="@env_setup@"
 objdir="@objdir@"
 port="@port@"
 
+. ${env_setup}
+
 # Disable test if: no data, no java, or socket wrapper
 ../db/have-db || exit 77
 sh ${srcdir}/have-java.sh || exit 77
 [ X"$SOCKET_WRAPPER_DIR" != X ] && exit 77
 
 R=TEST.H5L.SE
+server=host/localhost
+keytabfile="${objdir}/server.keytab"
+keytab="FILE:${keytabfile}"
+cache="FILE:${objdir}/cache.krb5"
 
+kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache ${afs_no_afslog}"
 kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
 kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=127.0.0.1 -P $port"
+gssclient="${TESTS_ENVIRONMENT} ../../appl/test/gssapi_client"
 
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
@@ -60,8 +69,14 @@ echo "Compile"
 javac -d "${objdir}" "${srcdir}/KerberosInit.java" || \
     { echo "Failed to compile java program: $?" ; exit 77; }
 
+echo "Compile"
+javac -d "${objdir}" "${srcdir}/../../appl/test/jgssapi_server.java" || \
+    { echo "Failed to compile java program: $?" ; exit 77; }
+
 > messages.log
 
+echo foo > ${objdir}/foopassword
+
 echo Creating database
 ${kadmin} \
     init \
@@ -71,30 +86,61 @@ ${kadmin} \
 
 ${kadmin} add -p foo --use-defaults lha@${R} || exit 1
 ${kadmin} modify --attributes=+requires-pre-auth lha@${R} || exit 1
+${kadmin} add -p kaka --use-defaults ${server}@${R} || exit 1
+${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
-
-trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
 echo "Run init"
 java \
-  -Dsun.security.krb5.debug=true \
-  -Djava.security.krb5.conf="${objdir}"/krb5.conf \
-  -Djava.security.auth.login.config="${srcdir}/jaas.conf" \
-  KerberosInit > output.tmp 2>&1 || { cat output.tmp ; exit 1; }
+    -Dsun.security.krb5.debug=true \
+    -Djava.security.krb5.conf="${objdir}"/krb5.conf \
+    -Djava.security.auth.login.config="${srcdir}/jaas.conf" \
+    KerberosInit > output.tmp 2>&1 || { cat output.tmp ; exit 1; }
+
+
+# Disabled because of:
+#
+# http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7077646
+# http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7077640
+#
+
+if false ; then
+
+    echo "start server"
+    java \
+        -Dsun.security.krb5.debug=true \
+        -Djava.security.krb5.conf="${objdir}"/krb5.conf \
+        -Djavax.security.auth.useSubjectCredsOnly=false \
+        -Djava.security.auth.login.config="${srcdir}/jaas.conf" \
+        jgssapi_server > output.tmp 2>&1 &
+    javapid=$!
+    sleep 5
+    
+    trap "kill -9 ${kdcpid} ${javapid}; echo signal killing kdc java; exit 1;" EXIT
+    
+    echo "Getting client initial tickets"; > messages.log
+    ${kinit} --password-file=${objdir}/foopassword lha@$R || \
+    	{ echo "kinit failed" ; exit 1; }
+    
+    env KRB5CCNAME=${cache} \
+        ${gssclient} --port=4717 --service=host localhost || exit 1
+    
+    sleep 5
+    
+    kill ${javapid}
+    
+    grep 'Exception in thread' output.tmp && exit 1
+fi
 
 echo "Done"
 
-echo "killing kdc (${kdcpid})"
-kill $kdcpid || exit 1
+echo "killing kdc (${kdcpid} ${javapid})"
+kill $kdcpid $javapid || exit 1
 
 trap "" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/java/jaas.conf b/crypto/external/bsd/heimdal/dist/tests/java/jaas.conf
index 18548ebac..10048254d 100644
--- a/crypto/external/bsd/heimdal/dist/tests/java/jaas.conf
+++ b/crypto/external/bsd/heimdal/dist/tests/java/jaas.conf
@@ -3,3 +3,12 @@
 kinit {
    com.sun.security.auth.module.Krb5LoginModule required;
 };
+
+com.sun.security.jgss.accept  {
+	com.sun.security.auth.module.Krb5LoginModule required
+	useKeyTab=true
+	storeKey=true
+	keyTab="server.keytab"
+	principal="host/localhost"
+	isInitiator=false;
+};
diff --git a/crypto/external/bsd/heimdal/dist/tests/java/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/java/krb5.conf.in
index 470163b51..1a1a3e54b 100644
--- a/crypto/external/bsd/heimdal/dist/tests/java/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/java/krb5.conf.in
@@ -14,8 +14,12 @@
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/current.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/kdc/Makefile.am
index ecf74e5d1..49be118c1 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/Makefile.am
@@ -1,20 +1,32 @@
 include $(top_srcdir)/Makefile.am.common
 
 noinst_DATA = \
+	an2ln-db.txt \
+	kdc-tester4.json \
 	krb5.conf \
+	krb5-authz.conf \
+	krb5-authz2.conf \
+	krb5-canon.conf \
+	krb5-canon2.conf \
+	krb5-hdb-mitdb.conf \
 	krb5-weak.conf \
 	krb5-pkinit.conf \
 	krb5-pkinit-win.conf \
+	krb5-slave2.conf \
 	krb5-slave.conf
 
 check_SCRIPTS = $(SCRIPT_TESTS) 
 
 SCRIPT_TESTS = \
+	check-authz \
+	check-canon \
 	check-cc \
 	check-delegation \
 	check-des \
 	check-digest \
+	check-fast \
 	check-kadmin \
+	check-hdb-mitdb \
 	check-kdc \
 	check-kdc-weak \
 	check-keys \
@@ -22,6 +34,7 @@ SCRIPT_TESTS = \
 	check-pkinit \
 	check-iprop \
 	check-referral \
+	check-tester \
 	check-uu
 
 TESTS = $(SCRIPT_TESTS)
@@ -36,134 +49,220 @@ else
 do_dlopen = -e 's,[@]DLOPEN[@],false,g'
 endif
 
-do_subst = sed $(do_dlopen) \
+do_subst = $(heim_verbose)sed $(do_dlopen) \
 	-e 's,[@]env_setup[@],$(top_builddir)/tests/bin/setup-env,g' \
+	-e 's,[@]top_srcdir[@],$(top_srcdir),g' \
 	-e 's,[@]srcdir[@],$(srcdir),g' \
 	-e 's,[@]port[@],$(port),g' \
 	-e 's,[@]admport[@],$(admport),g' \
 	-e 's,[@]pwport[@],$(pwport),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/kdc,g' \
 	-e 's,[@]top_builddir[@],$(top_builddir),g' \
+	-e 's,[@]db_type[@],$(db_type),g' \
 	-e 's,[@]EGREP[@],$(EGREP),g' 
 
+chmod = chmod
+
 LDADD = ../../lib/krb5/libkrb5.la $(LIB_roken)
 
+check-authz: check-authz.in Makefile krb5-authz.conf krb5-authz2.conf
+	$(do_subst) < $(srcdir)/check-authz.in > check-authz.tmp && \
+	$(chmod) +x check-authz.tmp && \
+	mv check-authz.tmp check-authz
+
+check-canon: check-canon.in Makefile krb5-canon.conf krb5-canon2.conf
+	$(do_subst) < $(srcdir)/check-canon.in > check-canon.tmp && \
+	$(chmod) +x check-canon.tmp && \
+	mv check-canon.tmp check-canon
+
 check-cc: check-cc.in Makefile
-	$(do_subst) < $(srcdir)/check-cc.in > check-cc.tmp
-	chmod +x check-cc.tmp
+	$(do_subst) < $(srcdir)/check-cc.in > check-cc.tmp && \
+	$(chmod) +x check-cc.tmp && \
 	mv check-cc.tmp check-cc
 
 check-delegation: check-delegation.in Makefile
-	$(do_subst) < $(srcdir)/check-delegation.in > check-delegation.tmp
-	chmod +x check-delegation.tmp
+	$(do_subst) < $(srcdir)/check-delegation.in > check-delegation.tmp && \
+	$(chmod) +x check-delegation.tmp && \
 	mv check-delegation.tmp check-delegation
 
 check-des: check-des.in Makefile krb5.conf
-	$(do_subst) < $(srcdir)/check-des.in > check-des.tmp
-	chmod +x check-des.tmp
+	$(do_subst) < $(srcdir)/check-des.in > check-des.tmp && \
+	$(chmod) +x check-des.tmp && \
 	mv check-des.tmp check-des
 
+check-hdb-mitdb: check-hdb-mitdb.in Makefile krb5-hdb-mitdb.conf
+	$(do_subst) < $(srcdir)/check-hdb-mitdb.in > check-hdb-mitdb.tmp && \
+	$(chmod) +x check-hdb-mitdb.tmp && \
+	mv check-hdb-mitdb.tmp check-hdb-mitdb
+
+check-fast: check-fast.in Makefile
+	$(do_subst) < $(srcdir)/check-fast.in > check-fast.tmp && \
+	$(chmod) +x check-fast.tmp && \
+	mv check-fast.tmp check-fast
+
 check-kdc: check-kdc.in Makefile
-	$(do_subst) < $(srcdir)/check-kdc.in > check-kdc.tmp
-	chmod +x check-kdc.tmp
+	$(do_subst) < $(srcdir)/check-kdc.in > check-kdc.tmp && \
+	$(chmod) +x check-kdc.tmp && \
 	mv check-kdc.tmp check-kdc
 
 check-kdc-weak: check-kdc-weak.in Makefile
-	$(do_subst) < $(srcdir)/check-kdc-weak.in > check-kdc-weak.tmp
-	chmod +x check-kdc-weak.tmp
+	$(do_subst) < $(srcdir)/check-kdc-weak.in > check-kdc-weak.tmp && \
+	$(chmod) +x check-kdc-weak.tmp && \
 	mv check-kdc-weak.tmp check-kdc-weak
 
+check-tester: check-tester.in kdc-tester4.json Makefile
+	$(do_subst) < $(srcdir)/check-tester.in > check-tester.tmp && \
+	$(chmod) +x check-tester.tmp && \
+	mv check-tester.tmp check-tester
+
 check-keys: check-keys.in Makefile
-	$(do_subst) < $(srcdir)/check-keys.in > check-keys.tmp
-	chmod +x check-keys.tmp
+	$(do_subst) < $(srcdir)/check-keys.in > check-keys.tmp && \
+	$(chmod) +x check-keys.tmp && \
 	mv check-keys.tmp check-keys
 
+check-kinit: check-kinit.in Makefile
+	$(do_subst) < $(srcdir)/check-kinit.in > check-kinit.tmp && \
+	$(chmod) +x check-kinit.tmp && \
+	mv check-kinit.tmp check-kinit
+
 check-kadmin: check-kadmin.in Makefile
-	$(do_subst) < $(srcdir)/check-kadmin.in > check-kadmin.tmp
-	chmod +x check-kadmin.tmp
+	$(do_subst) < $(srcdir)/check-kadmin.in > check-kadmin.tmp && \
+	$(chmod) +x check-kadmin.tmp && \
 	mv check-kadmin.tmp check-kadmin
 
 check-uu: check-uu.in Makefile
-	$(do_subst) < $(srcdir)/check-uu.in > check-uu.tmp
-	chmod +x check-uu.tmp
+	$(do_subst) < $(srcdir)/check-uu.in > check-uu.tmp && \
+	$(chmod) +x check-uu.tmp && \
 	mv check-uu.tmp check-uu
 
 check-pkinit: check-pkinit.in Makefile krb5-pkinit.conf
-	$(do_subst) < $(srcdir)/check-pkinit.in > check-pkinit.tmp
-	chmod +x check-pkinit.tmp
+	$(do_subst) < $(srcdir)/check-pkinit.in > check-pkinit.tmp && \
+	$(chmod) +x check-pkinit.tmp && \
 	mv check-pkinit.tmp check-pkinit
 
-check-iprop: check-iprop.in Makefile krb5.conf krb5-slave.conf
-	$(do_subst) < $(srcdir)/check-iprop.in > check-iprop.tmp
-	chmod +x check-iprop.tmp
+check-iprop: check-iprop.in Makefile krb5.conf krb5-slave.conf krb5-slave2.conf
+	$(do_subst) < $(srcdir)/check-iprop.in > check-iprop.tmp && \
+	$(chmod) +x check-iprop.tmp && \
 	mv check-iprop.tmp check-iprop
 
 check-digest: check-digest.in Makefile
-	$(do_subst) < $(srcdir)/check-digest.in > check-digest.tmp
-	chmod +x check-digest.tmp
+	$(do_subst) < $(srcdir)/check-digest.in > check-digest.tmp && \
+	$(chmod) +x check-digest.tmp && \
 	mv check-digest.tmp check-digest
 
 check-referral: check-referral.in Makefile
-	$(do_subst) < $(srcdir)/check-referral.in > check-referral.tmp
-	chmod +x check-referral.tmp
+	$(do_subst) < $(srcdir)/check-referral.in > check-referral.tmp && \
+	$(chmod) +x check-referral.tmp && \
 	mv check-referral.tmp check-referral
 
 check-kpasswdd: check-kpasswdd.in Makefile
-	$(do_subst) < $(srcdir)/check-kpasswdd.in > check-kpasswdd.tmp
-	chmod +x check-kpasswdd.tmp
+	$(do_subst) < $(srcdir)/check-kpasswdd.in > check-kpasswdd.tmp && \
+	$(chmod) +x check-kpasswdd.tmp && \
 	mv check-kpasswdd.tmp check-kpasswdd
 
+kdc-tester4.json: kdc-tester4.json.in Makefile
+	$(do_subst) < $(srcdir)/kdc-tester4.json.in > kdc-tester4.json.tmp && \
+	mv kdc-tester4.json.tmp kdc-tester4.json
+
 krb5.conf: krb5.conf.in Makefile
 	$(do_subst) \
 	   -e 's,[@]WEAK[@],false,g' \
 	   -e 's,[@]dk[@],,g' \
-	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5.conf.tmp
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5.conf.tmp && \
 	mv krb5.conf.tmp krb5.conf
 
+krb5-authz.conf: krb5-authz.conf.in Makefile
+	$(do_subst) < $(srcdir)/krb5-authz.conf.in > krb5-authz.conf.tmp && \
+	mv krb5-authz.conf.tmp krb5-authz.conf
+
+krb5-authz2.conf: krb5-authz2.conf.in Makefile
+	$(do_subst) < $(srcdir)/krb5-authz2.conf.in > krb5-authz2.conf.tmp && \
+	mv krb5-authz2.conf.tmp krb5-authz2.conf
+
+krb5-canon.conf: krb5-canon.conf.in Makefile
+	$(do_subst) \
+	   -e 's,[@]WEAK[@],false,g' \
+	   -e 's,[@]dk[@],,g' \
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5-canon.conf.in > krb5-canon.conf.tmp && \
+	mv krb5-canon.conf.tmp krb5-canon.conf
+
+krb5-canon2.conf: krb5-canon2.conf.in Makefile
+	$(do_subst) \
+	   -e 's,[@]WEAK[@],false,g' \
+	   -e 's,[@]dk[@],,g' \
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5-canon2.conf.in > krb5-canon2.conf.tmp && \
+	mv krb5-canon2.conf.tmp krb5-canon2.conf
+
+krb5-hdb-mitdb.conf: krb5-hdb-mitdb.conf.in Makefile
+	$(do_subst) \
+	   -e 's,[@]WEAK[@],false,g' \
+	   -e 's,[@]dk[@],,g' \
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5-hdb-mitdb.conf.in > krb5-hdb-mitdb.conf.tmp && \
+	mv krb5-hdb-mitdb.conf.tmp krb5-hdb-mitdb.conf
+
 krb5-weak.conf: krb5.conf.in Makefile
 	$(do_subst) \
 	   -e 's,[@]WEAK[@],true,g' \
 	   -e 's,[@]dk[@],default_keys = aes256-cts-hmac-sha1-96:pw-salt arcfour-hmac-md5:pw-salt des3-cbc-sha1:pw-salt des:pw-salt,g' \
-	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5-weak.conf.tmp
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5-weak.conf.tmp && \
 	mv krb5-weak.conf.tmp krb5-weak.conf
 
 krb5-slave.conf: krb5.conf.in Makefile
 	$(do_subst) \
 	   -e 's,[@]WEAK[@],true,g' \
 	   -e 's,[@]dk[@],,g' \
-	   -e 's,[@]kdc[@],.slave,g' < $(srcdir)/krb5.conf.in > krb5-slave.conf.tmp
+	   -e 's,[@]kdc[@],.slave,g' < $(srcdir)/krb5.conf.in > krb5-slave.conf.tmp && \
 	mv krb5-slave.conf.tmp krb5-slave.conf
 
+krb5-slave2.conf: krb5.conf.in Makefile
+	$(do_subst) \
+	   -e 's,[@]WEAK[@],true,g' \
+	   -e 's,[@]dk[@],,g' \
+	   -e 's,[@]kdc[@],.slave2,g' < $(srcdir)/krb5.conf.in > krb5-slave2.conf.tmp && \
+	mv krb5-slave2.conf.tmp krb5-slave2.conf
+
 krb5-pkinit.conf: krb5-pkinit.conf.in Makefile
-	$(do_subst) -e 's,[@]w2k[@],no,g' < $(srcdir)/krb5-pkinit.conf.in > krb5-pkinit.conf.tmp
+	$(do_subst) -e 's,[@]w2k[@],no,g' < $(srcdir)/krb5-pkinit.conf.in > krb5-pkinit.conf.tmp && \
 	mv krb5-pkinit.conf.tmp krb5-pkinit.conf
 
 krb5-pkinit-win.conf: krb5-pkinit.conf.in Makefile
-	$(do_subst) -e 's,[@]w2k[@],yes,g' < $(srcdir)/krb5-pkinit.conf.in > krb5-pkinit-win.conf.tmp
+	$(do_subst) -e 's,[@]w2k[@],yes,g' < $(srcdir)/krb5-pkinit.conf.in > krb5-pkinit-win.conf.tmp && \
 	mv krb5-pkinit-win.conf.tmp krb5-pkinit-win.conf
 
 CLEANFILES= \
 	$(TESTS) \
-	iprop-stats \
+	*.tmp \
+	acache.krb5 \
 	barpassword \
+	ca.crt \
 	cache.krb5 \
 	cdigest-reply \
-	*.tmp \
 	client-cache \
-	current-db* \
 	current*.log \
-	iprop.keytab \
+	current-db* \
 	digest-reply \
 	foopassword \
-	krb5.conf \
-	krb5-weak.conf \
-	krb5.conf.keys \
+	foopassword.rkpty \
+	iprop-stats \
+	iprop.keytab \
+	ipropd.dumpfile \
+	kdc-tester4.json \
+	kdc.crt \
+	krb5-authz.conf \
+	krb5-authz2.conf \
+	krb5-canon.conf \
+	krb5-canon2.conf \
 	krb5-cc.conf \
-	krb5-slave.conf \
-	krb5-pkinit.conf \
+	krb5-hdb-mitdb.conf \
 	krb5-pkinit-win.conf \
-	signal \
+	krb5-pkinit.conf \
+	krb5-slave2.conf \
+	krb5-slave.conf \
+	krb5-weak.conf \
+	krb5.conf \
+	krb5.conf.keys \
 	leaks-log \
+	localname \
 	malloc-log \
 	malloc-log-master \
 	malloc-log-slave \
@@ -171,44 +270,64 @@ CLEANFILES= \
 	o2cache.krb5 \
 	o2digest-reply \
 	ocache.krb5 \
-	s2digest-reply \
-	sdigest-init \
-	sdigest-reply \
-	server.keytab \
-	req-pkinit.der \
-	req-pkinit2.der \
-	req-kdc.der \
+	out-log \
 	pkinit.crt \
 	pkinit2.crt \
 	pkinit3.crt \
 	pkinit4.crt \
-	kdc.crt \
-	ca.crt \
-	uuserver.log \
+	req-kdc.der \
+	req-pkinit.der \
+	req-pkinit2.der \
+	s2digest-reply \
+	sdigest-init \
+	sdigest-reply \
+	server.keytab \
+	signal \
 	tempfile \
-	test-rc-file.rc
+	test-rc-file.rc \
+	uuserver.log
 
 EXTRA_DIST = \
 	NTMakefile \
+	an2ln-db.txt \
+	check-authz.in \
+	check-canon.in \
 	check-cc.in \
 	check-delegation.in \
 	check-des.in \
 	check-digest.in \
+	check-fast.in \
 	check-iprop.in \
 	check-kadmin.in \
+	check-kinit.in \
+	check-hdb-mitdb.in \
 	check-kdc.in \
 	check-kdc-weak.in \
 	check-keys.in \
 	check-kpasswdd.in \
 	check-pkinit.in \
 	check-referral.in \
+	check-tester.in \
 	check-uu.in \
 	donotexists.txt \
+	hdb-mitdb \
+	hdb-mitdb.kadm5 \
+	hdb-mitdb.mkey \
 	heimdal.acl \
 	iprop-acl \
+	kdc-tester1.json \
+	kdc-tester2.json \
+	kdc-tester3.json \
+	kdc-tester4.json.in \
 	krb5-pkinit.conf.in \
 	krb5.conf.in \
+	krb5-authz.conf.in \
+	krb5-authz2.conf.in \
+	krb5-canon.conf.in \
+	krb5-canon2.conf.in \
+	krb5-hdb-mitdb.conf.in \
 	krb5.conf.keys.in \
+	k5login/foo \
 	ntlm-user-file.txt \
 	leaks-kill.sh \
 	pki-mapping \
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/an2ln-db.txt b/crypto/external/bsd/heimdal/dist/tests/kdc/an2ln-db.txt
new file mode 100644
index 000000000..39e1a5018
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/an2ln-db.txt
@@ -0,0 +1,143 @@
+0575ee035f72dfb1 junk
+074897aaa3c4eace junk
+0c0015d1cb0edf2e junk
+15c02bb64902a207 junk
+1730cb4567c1bfce junk
+17c6e78171587710 junk
+21bef891f06af28e junk
+2358b67cdd649987 junk
+2b334ee5d32eb55b junk
+2f4cd4424e58822d junk
+4758f671c662b7e2 junk
+4bf0af25dd5211bd junk
+4d7f715b271ddb10 junk
+4f701fa5a4055c00 junk
+4f7634440d7bef3a junk
+5593a6bc03a68a3d junk
+5652948873ae4a9b junk
+5ababa9c833ce592 junk
+5c2fb83355b59cf1 junk
+5cf29f522abbcbe1 junk
+5d184a0f45bdaf61 junk
+70a01e2a09ba4b40 junk
+75bdfdb4c9c9b26b junk
+787aa58456e66463 junk
+788fa38b04026ca9 junk
+79ad9f69fb354592 junk
+7a686ba61c736eb1 junk
+807644c5c50f29d5 junk
+826de82aa81c3f8a junk
+85316d269114d787 junk
+86b7d20af35cffba junk
+895ca88e162d398f junk
+9008213d189aac2b junk
+98a51d5c9a172691 junk
+9af7d4a596944dcf junk
+a094067ad439189c junk
+a86904ae8f55df9e junk
+aa3ae6e252f65711 junk
+b19ffc6336a23be3 junk
+b4e37e4d23c4d7be junk
+b5c8b14d1e8ae7cb junk
+b9365f7ec3b0d52c junk
+bar/mapped1@TEST2.H5L.SE foobar
+bar/mapped2@TEST2.H5L.SE foobaz
+c118fb30610b8011 junk
+c19ffa62f50ad8f7 junk
+c9fce89738e25054 junk
+cb4555bb49891436 junk
+ccfb9930466fe627 junk
+cd2e8bc1fd014a86 junk
+d0d8dfeddf1b1eaa junk
+d22ff9ea01dfe15f junk
+d2bce251fcf6d5a3 junk
+d377b118646db95d junk
+d42fd3b12935a24a junk
+d948845a3b0068ac junk
+dbb143ecf6019b50 junk
+dbe41b5888e50c9c junk
+dd7a0a53ed569e21 junk
+dd82f76178ff0315 junk
+e1d62414205aa5a1 junk
+e3156ded04399027 junk
+e6bccd04c18fbd2e junk
+e9cb04e892e8f072 junk
+ebb5773344e4ade4 junk
+ef08d2dc9fef4f05 junk
+f59975170a04e071 junk
+f75338796ea735f0 junk
+f8cd2e85efa891af junk
+fd6e5e417b8296a7 junk
+foo/mapped1@TEST2.H5L.SE foo_mapped
+mapped1@TEST2.H5L.SE m1
+mapped1@TEST3.H5L.SE mapped1
+mapped2@TEST2.H5L.SE m2
+mapped2@TEST3.H5L.SE mapped2
+z008213d189aac2b junk
+z07644c5c50f29d5 junk
+z094067ad439189c junk
+z0a01e2a09ba4b40 junk
+z0d8dfeddf1b1eaa junk
+z118fb30610b8011 junk
+z19ffa62f50ad8f7 junk
+z19ffc6336a23be3 junk
+z1bef891f06af28e junk
+z1d62414205aa5a1 junk
+z22ff9ea01dfe15f junk
+z26de82aa81c3f8a junk
+z2bce251fcf6d5a3 junk
+z3156ded04399027 junk
+z358b67cdd649987 junk
+z377b118646db95d junk
+z42fd3b12935a24a junk
+z4e37e4d23c4d7be junk
+z5316d269114d787 junk
+z575ee035f72dfb1 junk
+z593a6bc03a68a3d junk
+z59975170a04e071 junk
+z5bdfdb4c9c9b26b junk
+z5c02bb64902a207 junk
+z5c8b14d1e8ae7cb junk
+z652948873ae4a9b junk
+z6b7d20af35cffba junk
+z6bccd04c18fbd2e junk
+z730cb4567c1bfce junk
+z74897aaa3c4eace junk
+z75338796ea735f0 junk
+z758f671c662b7e2 junk
+z7c6e78171587710 junk
+z86904ae8f55df9e junk
+z87aa58456e66463 junk
+z88fa38b04026ca9 junk
+z8a51d5c9a172691 junk
+z8cd2e85efa891af junk
+z9365f7ec3b0d52c junk
+z948845a3b0068ac junk
+z95ca88e162d398f junk
+z9ad9f69fb354592 junk
+z9cb04e892e8f072 junk
+z9fce89738e25054 junk
+za3ae6e252f65711 junk
+za686ba61c736eb1 junk
+zababa9c833ce592 junk
+zaf7d4a596944dcf junk
+zb334ee5d32eb55b junk
+zb4555bb49891436 junk
+zbb143ecf6019b50 junk
+zbb5773344e4ade4 junk
+zbe41b5888e50c9c junk
+zbf0af25dd5211bd junk
+zc0015d1cb0edf2e junk
+zc2fb83355b59cf1 junk
+zcf29f522abbcbe1 junk
+zcfb9930466fe627 junk
+zd184a0f45bdaf61 junk
+zd2e8bc1fd014a86 junk
+zd6e5e417b8296a7 junk
+zd7a0a53ed569e21 junk
+zd7f715b271ddb10 junk
+zd82f76178ff0315 junk
+zf08d2dc9fef4f05 junk
+zf4cd4424e58822d junk
+zf701fa5a4055c00 junk
+zf7634440d7bef3a junk
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-authz.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-authz.in
new file mode 100644
index 000000000..9acd7f05d
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-authz.in
@@ -0,0 +1,153 @@
+#!/bin/sh
+#
+# Copyright (c) 2007 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden). 
+# All rights reserved. 
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met: 
+#
+# 1. Redistributions of source code must retain the above copyright 
+#    notice, this list of conditions and the following disclaimer. 
+#
+# 2. Redistributions in binary form must reproduce the above copyright 
+#    notice, this list of conditions and the following disclaimer in the 
+#    documentation and/or other materials provided with the distribution. 
+#
+# 3. Neither the name of the Institute nor the names of its contributors 
+#    may be used to endorse or promote products derived from this software 
+#    without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+# SUCH DAMAGE. 
+
+top_builddir="@top_builddir@"
+env_setup="@env_setup@"
+objdir="."
+
+. ${env_setup}
+
+srcdir="${top_srcdir}/tests/kdc"
+test_alname="${test_alname} --simple"
+
+rm -f localname
+
+check_localname() {
+    stderr=
+    if test "$2" -ne 0; then
+	stderr="2>/dev/null"
+    fi
+    eval ${test_alname} "'$1'" > localname $stderr
+    status=$?
+    if test $status -ne "$2"; then
+	echo "Unexpected exit code from test_alname $1: $status"
+	exit 1
+    fi
+    if test $status -ne 0; then
+	return 0
+    fi
+    read lname < localname
+    if test "X$lname" != "X$3"; then
+	echo "Unexpected mapping of $1: $lname"
+	exit 1
+    fi
+    return 0
+}
+
+R=TEST.H5L.SE
+R2=TEST2.H5L.SE
+R3=TEST3.H5L.SE
+R4=TEST4.H5L.SE
+
+KRB5_CONFIG="${objdir}/krb5-authz.conf"
+export KRB5_CONFIG
+
+echo "Checking 1-component principal names in default realms"
+check_localname mapped1@${R} 0 foo || exit 1
+check_localname mapped2@${R} 0 bar || exit 1
+check_localname mapped1@${R2} 0 m1 || exit 1
+check_localname mapped2@${R2} 0 m2 || exit 1
+check_localname mapped1@${R3} 0 mapped1 || exit 1
+check_localname mapped2@${R3} 0 mapped2 || exit 1
+check_localname notmapped1@${R} 0 notmapped1 || exit 1
+check_localname notmapped1@${R2} 0 notmapped1 || exit 1
+check_localname notmapped1@${R3} 0 notmapped1 || exit 1
+
+echo "Checking 1-component principal names in non-default realm"
+check_localname mapped1@${R4} 1 || exit 1
+check_localname notmapped1@${R4} 1 || exit 1
+
+echo "Checking 2-component principal names"
+check_localname foo/mapped1@${R} 0 foo || exit 1
+check_localname foo/mapped2@${R} 0 bar || exit 1
+check_localname bar/mapped1@${R2} 0 foobar || exit 1
+check_localname bar/mapped2@${R2} 0 foobaz || exit 1
+check_localname foo/mapped1@${R3} 1 || exit 1
+check_localname bar/mapped1@${R3} 1 || exit 1
+check_localname foo/notmapped1@${R} 1 || exit 1
+check_localname bar/notmapped1@${R2} 1 || exit 1
+
+echo "Checking 2-component principal names in non-default realm"
+check_localname foo/mapped1@${R4} 1 || exit 1
+check_localname bar/mapped1@${R4} 1 || exit 1
+check_localname foo/notmapped1@${R4} 1 || exit 1
+check_localname bar/notmapped1@${R4} 1 || exit 1
+
+echo "Checking for overflow"
+test_alname="${test_alname} --simple --lname-size=1"
+check_localname mapped1@${R} 3 || exit 1
+check_localname mapped2@${R} 3 || exit 1
+check_localname mapped1@${R2} 3 || exit 1
+check_localname mapped2@${R2} 3 || exit 1
+check_localname mapped1@${R3} 3 || exit 1
+check_localname mapped2@${R3} 3 || exit 1
+
+echo "Checking krb5_kuserok()"
+${test_kuserok} random-princ@RANDOM-REALM foo > /dev/null || exit 1
+${test_kuserok} mapped1@${R} foo > /dev/null || exit 1
+${test_kuserok} mapped1@${R2} m1 > /dev/null || exit 1
+${test_kuserok} notmapped1@${R3} notmapped1 > /dev/null || exit 1
+${test_kuserok} this-better-not-exist@NOR-THIS foo > /dev/null && exit 1
+
+# If the user running this test has a ~/.k5login or .k5logind, test
+# based on their content
+if test -n "${HOME}" -a -n "${USER:-${LOGNAME}}" -a -s "${HOME}/.k5login"; then
+    echo "Checking ~/.k5login"
+    while read princ; do
+	${test_kuserok} "${princ}" "${USER:-${LOGNAME}}" > /dev/null || exit 1
+    done < "${HOME}/.k5login" || exit 1
+fi
+if test -n "${HOME}" -a -n "${USER:-${LOGNAME}}" -a -d "${HOME}/.k5login.d"; then
+    echo "Checking ~/.k5login.d"
+    ls -f "${HOME}/.k5login.d" | egrep -v '^(\.|\.\.|#.*|.*~|\.*.sw.)$' | while read f; do
+	f="${HOME}/.k5login.d/$f"
+	test -d "${f}" && continue
+	while read princ; do
+	    ${test_kuserok} "${princ}" "${USER:-${LOGNAME}}" > /dev/null || exit 1
+	done < "${f}" || exit 1
+    done || exit 1
+fi
+
+KRB5_CONFIG="${objdir}/krb5-authz2.conf"
+export KRB5_CONFIG
+
+echo "Checking krb5_kuserok() (with authoritative k5login files)"
+${test_kuserok} random-princ@RANDOM-REALM foo > /dev/null || exit 1
+${test_kuserok} mapped1@${R} foo > /dev/null && exit 1
+${test_kuserok} mapped1@${R2} m1 > /dev/null || exit 1
+${test_kuserok} notmapped1@${R3} notmapped1 > /dev/null || exit 1
+${test_kuserok} this-better-not-exist@NOR-THIS foo > /dev/null && exit 1
+
+rm -f messages.log
+
+exit 0
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-canon.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-canon.in
new file mode 100644
index 000000000..ef5d8275e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-canon.in
@@ -0,0 +1,210 @@
+#!/bin/sh
+#
+# Copyright (c) 2011, Secure Endpoints Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# - Redistributions of source code must retain the above copyright
+#   notice, this list of conditions and the following disclaimer.
+#
+# - Redistributions in binary form must reproduce the above copyright
+#   notice, this list of conditions and the following disclaimer in
+#   the documentation and/or other materials provided with the
+#   distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
+
+env_setup="@env_setup@"
+objdir="@objdir@"
+
+. ${env_setup}
+
+# If there is no useful db support compile in, disable test
+# (krb5_kt_get_entry() is tested in another test)
+${have_db} || exit 77
+
+R1=TEST.H5L.SE
+R2=TEST2.H5L.SE
+R3=TEST3.H5L.SE
+
+port=@port@
+
+kadmin="${kadmin} -l -r ${R1}"
+kdc="${kdc} --addresses=localhost -P $port"
+
+cache="FILE:${objdir}/cache.krb5"
+
+kinit="${kinit} -c $cache ${afs_no_afslog}"
+klist="${klist} -c $cache"
+kgetcred="${kgetcred} -c $cache"
+kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
+
+KRB5_CONFIG="${objdir}/krb5-canon.conf"
+export KRB5_CONFIG
+
+testfailed="echo test failed; ${klist}; exit 1"
+
+rm -f ${keytabfile}
+rm -f current-db*
+rm -f out-*
+rm -f mkey.file*
+
+> messages.log
+
+echo "Creating database"
+initflags="init --realm-max-ticket-life=1day --realm-max-renewable-life=1month"
+
+${kadmin} ${initflags} ${R1} || exit 1
+${kadmin} ${initflags} ${R2} || exit 1
+${kadmin} ${initflags} ${R3} || exit 1
+
+${kadmin} add -p foo --use-defaults foo@${R1} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${R1}@${R2} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R1} || exit 1
+${kadmin} add -p cross3 --use-defaults krbtgt/${R3}@${R1} || exit 1
+${kadmin} add -p cross4 --use-defaults krbtgt/${R1}@${R3} || exit 1
+${kadmin} add -p cross5 --use-defaults krbtgt/${R3}@${R2} || exit 1
+${kadmin} add -p cross6 --use-defaults krbtgt/${R2}@${R3} || exit 1
+
+${kadmin} add -p foo --use-defaults host/t1@${R1} || exit 1
+${kadmin} add -p foo --use-defaults host/t2@${R2} || exit 1
+${kadmin} add -p foo --use-defaults host/t3@${R3} || exit 1
+${kadmin} add -p foo --use-defaults host/t11.test1.h5l.se@${R1} || exit 1
+${kadmin} add -p foo --use-defaults host/t12.test1.h5l.se@${R2} || exit 1
+${kadmin} add -p foo --use-defaults host/t22.test2.h5l.se@${R2} || exit 1
+${kadmin} add -p foo --use-defaults host/t23.test2.h5l.se@${R3} || exit 1
+${kadmin} add -p foo --use-defaults host/t33.test3.h5l.se@${R3} || exit 1
+
+
+echo "Doing database check"
+${kadmin} check ${R1} || exit 1
+${kadmin} check ${R2} || exit 1
+${kadmin} check ${R3} || exit 1
+
+echo foo > ${objdir}/foopassword
+
+echo "Starting kdc" ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
+
+trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+
+ec=0
+
+echo "Getting client initial tickets";
+${kinit} --password-file=${objdir}/foopassword foo@${R1} || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "get service tickets (success)"
+for host in t1 t2 t3 t11 t12 t22 t33 ; do
+    echo "    $host"
+    ${kgetcred} --name-type=SRV_HST host $host || { ec=1 ; eval "${testfailed}"; }
+done
+echo "get service tickets (failure)"
+for host in t23 ; do
+    echo "    $host"
+    ${kgetcred} --name-type=SRV_HST host $host 2>/dev/null && { ec=1 ; eval "${testfailed}"; }
+done
+
+echo "check result"
+${klist} | grep 'host/t1@$' > /dev/null ||
+    { ec=1 ; echo "t1 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t1@${R1}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t1 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t2@$' > /dev/null ||
+    { ec=1 ; echo "t2 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t2@${R2}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t2 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t3@$' > /dev/null ||
+    { ec=1 ; echo "t3 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t3@${R3}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t3 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t11@$' > /dev/null ||
+    { ec=1 ; echo "t11 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t11.test1.h5l.se@${R1}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t11 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t12@$' > /dev/null ||
+    { ec=1 ; echo "t12 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t12.test1.h5l.se@${R2}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t12 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t22@$' > /dev/null ||
+    { ec=1 ; echo "t22 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t22.test2.h5l.se@${R2}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t22 entry not present";  eval "${testfailed}"; }
+${klist} | grep 'host/t33@$' > /dev/null ||
+    { ec=1 ; echo "t33 referral entry not present";  eval "${testfailed}"; }
+${klist} | grep "host/t33.test3.h5l.se@${R3}" > /dev/null ||
+    { ec=1 ; echo "canonicalized t33 entry not present";  eval "${testfailed}"; }
+
+
+${kdestroy}
+
+if false; then
+
+    # This may not be portable.  It'd be nice to be able to set more of the
+    # resolver configuration via the environment!
+    LOCALDOMAIN=test1.h5l.se
+    export LOCALDOMAIN
+    KRB5_CONFIG="${objdir}/krb5-canon2.conf"
+    export KRB5_CONFIG
+    
+    echo "Getting client initial tickets (round 2)";
+    ${kinit} --password-file=${objdir}/foopassword foo@${R1} || \
+    	{ ec=1 ; eval "${testfailed}"; }
+    
+    echo "get service tickets (success)"
+    for host in t1 t2 t3 t11 ; do
+        echo "    $host"
+        ${kgetcred} --name-type=SRV_HST host $host || { ec=1 ; eval "${testfailed}"; }
+    done
+    echo "get service tickets (failure)"
+    for host in t12 t22 t23 t33 ; do
+        echo "    $host"
+        ${kgetcred} --name-type=SRV_HST host $host 2> /dev/null &&
+            { ec=1 ; eval "${testfailed}"; }
+    done
+    
+    echo "check result"
+    ${klist} | grep 'host/t1@$' > /dev/null ||
+        { ec=1 ; echo "t1 referral entry not present";  eval "${testfailed}"; }
+    ${klist} | grep "host/t1@${R1}" > /dev/null ||
+        { ec=1 ; echo "canonicalized t1 entry not present";  eval "${testfailed}"; }
+    ${klist} | grep 'host/t2@$' > /dev/null ||
+        { ec=1 ; echo "t2 referral entry not present";  eval "${testfailed}"; }
+    ${klist} | grep "host/t2@${R2}" > /dev/null ||
+        { ec=1 ; echo "canonicalized t2 entry not present";  eval "${testfailed}"; }
+    ${klist} | grep 'host/t3@$' > /dev/null ||
+        { ec=1 ; echo "t3 referral entry not present";  eval "${testfailed}"; }
+    ${klist} | grep "host/t3@${R3}" > /dev/null ||
+        { ec=1 ; echo "canonicalized t3 entry not present";  eval "${testfailed}"; }
+    ${klist} | grep 'host/t11@$' > /dev/null ||
+        { ec=1 ; echo "t11 referral entry not present";  eval "${testfailed}"; }
+    ${klist} | grep "host/t11.test1.h5l.se@${R1}" > /dev/null ||
+        { ec=1 ; echo "canonicalized t11 entry not present";  eval "${testfailed}"; }
+    
+    
+    ${kdestroy}
+fi
+
+
+echo "killing kdc (${kdcpid})"
+sh ${leaks_kill} kdc $kdcpid || exit 1
+
+trap "" EXIT
+
+exit $ec
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-cc.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-cc.in
index aef5e1607..6e0258947 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-cc.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-cc.in
@@ -87,15 +87,9 @@ ${kadmin} check ${R} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-delegation.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-delegation.in
index b5acb1ee8..5fa19adba 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-delegation.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-delegation.in
@@ -101,15 +101,9 @@ ${kadmin} check ${R4} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-des.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-des.in
index 77a39b19a..301baa6ed 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-des.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-des.in
@@ -95,15 +95,9 @@ ${kadmin} check ${R} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-digest.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-digest.in
index 4ce5a7e17..d31ba323c 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-digest.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-digest.in
@@ -93,15 +93,10 @@ ${kadmin} check ${R} || exit 1
 
 echo $password > ${objdir}/foopassword
 
-echo "Starting kdc"
-env ${HEIM_MALLOC_DEBUG} ${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo "Starting kdc" ; > messages.log
+env ${HEIM_MALLOC_DEBUG} ${kdc} --detach --testing ||
+    { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; cat messages.log; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-fast.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-fast.in
new file mode 100644
index 000000000..96c00c319
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-fast.in
@@ -0,0 +1,183 @@
+#!/bin/sh
+#
+# Copyright (c) 2006 - 2011 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden). 
+# All rights reserved. 
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met: 
+#
+# 1. Redistributions of source code must retain the above copyright 
+#    notice, this list of conditions and the following disclaimer. 
+#
+# 2. Redistributions in binary form must reproduce the above copyright 
+#    notice, this list of conditions and the following disclaimer in the 
+#    documentation and/or other materials provided with the distribution. 
+#
+# 3. Neither the name of the Institute nor the names of its contributors 
+#    may be used to endorse or promote products derived from this software 
+#    without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+# SUCH DAMAGE. 
+
+top_builddir="@top_builddir@"
+env_setup="@env_setup@"
+objdir="@objdir@"
+
+. ${env_setup}
+
+KRB5_CONFIG="${1-${objdir}/krb5.conf}"
+export KRB5_CONFIG
+
+testfailed="echo test failed; cat messages.log; exit 1"
+
+# If there is no useful db support compile in, disable test
+${have_db} || exit 77
+
+R=TEST.H5L.SE
+
+port=@port@
+
+kadmin="${kadmin} -l -r $R"
+kdc="${kdc} --addresses=localhost -P $port"
+
+server=host/datan.test.h5l.se
+cache="FILE:${objdir}/cache.krb5"
+acache="FILE:${objdir}/acache.krb5"
+
+kinit="${kinit} -c $cache ${afs_no_afslog}"
+akinit="${kinit} -c $acache ${afs_no_afslog}"
+klist="${klist} -c $cache"
+aklist="${klist} -c $acache"
+kgetcred="${kgetcred} -c $cache"
+kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
+
+rm -f ${keytabfile}
+rm -f current-db*
+rm -f out-*
+rm -f mkey.file*
+
+> messages.log
+
+echo Creating database
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R} || exit 1
+
+${kadmin} add -p foo --use-defaults foo@${R} || exit 1
+${kadmin} add -p foo --use-defaults ${server}@${R} || exit 1
+
+echo "Doing database check"
+${kadmin} check ${R} || exit 1
+
+echo foo > ${objdir}/foopassword
+echo bar > ${objdir}/barpassword
+
+echo Starting kdc ; > messages.log
+env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
+
+trap "kill -9 ${kdcpid}; echo signal killing kdc; cat messages.log; exit 1;" EXIT
+
+ec=0
+
+#
+# Check armor ticket
+#
+
+echo "Getting client initial tickets"; > messages.log
+${kinit} --password-file=${objdir}/foopassword foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+echo "Checking for FAST avail"
+${klist} --hidden | grep fast_avail > /dev/null || { exit 1; }
+echo "Getting tickets"; > messages.log
+${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
+echo "Listing tickets"; > messages.log
+${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Acquire host ticket to be used as an ARMOR ticket"; > messages.log
+${akinit} --password-file=${objdir}/foopassword ${server}@${R} >/dev/null|| { exit 1; }
+echo "Checking for FAST avail (in the FAST armor cache)"; > messages.log
+${aklist} --hidden | grep fast_avail > /dev/null || { exit 1; }
+
+#
+# Client tests
+#
+
+echo "Getting client initial tickets with FAST armor ticket"; > messages.log
+${kinit} --fast-armor-cache=${acache} \
+   --password-file=${objdir}/foopassword foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Getting client initial tickets with FAST armor ticket [failure]"; > messages.log
+${kinit} --fast-armor-cache=${acache} \
+   --password-file=${objdir}/barpassword foo@$R 2>/dev/null && \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Checking for FAST avail (in the FAST acquired cache)"; > messages.log
+${klist} --hidden | grep fast_avail > /dev/null || { exit 1; }
+
+echo "Getting service ticket"
+${kgetcred} ${server}@${R} || { exit 1; }
+${kdestroy}
+
+#
+# Use MIT client tools
+#
+
+mit=/usr/local/mitkerberos/bin
+
+if [ -f ${mit}/kinit ] ; then
+   echo "Running MIT FAST tests"
+
+    kinitpty=${objdir}/foopassword.rkpty
+cat > ${kinitpty} <<EOF
+expect Password
+password foo\n
+EOF
+
+   echo "Acquire host ticket"; > messages.log
+   ${rkpty} ${kinitpty} ${mit}/kinit -c ${acache} ${server}@${R} >/dev/null|| { exit 1; }
+   (${aklist} | grep ${server} > /dev/null ) || { exit 1; }
+
+   echo "Checking for FAST avail"; > messages.log
+   ${aklist} --hidden | grep fast_avail > /dev/null || { exit 1; }
+
+   echo "Using plain to get a initial ticket"; > messages.log
+   ${rkpty} ${kinitpty} ${mit}/kinit -c ${cache} foo@${R} >/dev/null|| { exit 1; }
+   (${klist} | grep foo > /dev/null ) || { exit 1; }
+
+   echo "Using FAST to get a initial ticket"; > messages.log
+   ${rkpty} ${kinitpty} ${mit}/kinit -c ${cache} -T ${acache} foo@${R} >/dev/null || { exit 1; }
+   (${klist} | grep foo > /dev/null ) || { exit 1; }
+
+   echo "Checking for FAST avail"; > messages.log
+   ${klist} --hidden | grep fast_avail > /dev/null || { exit 1; }
+
+   echo "Getting service ticket"; > messages.log
+   ${mit}/kvno -c ${cache} ${server}@${R} || { exit 1; }
+
+fi
+
+
+echo "killing kdc (${kdcpid})"
+sh ${leaks_kill} kdc $kdcpid || exit 1
+
+trap "" EXIT
+
+exit $ec
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-hdb-mitdb.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-hdb-mitdb.in
new file mode 100644
index 000000000..13559d9c9
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-hdb-mitdb.in
@@ -0,0 +1,111 @@
+#!/bin/sh
+#
+# Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden). 
+# All rights reserved. 
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met: 
+#
+# 1. Redistributions of source code must retain the above copyright 
+#    notice, this list of conditions and the following disclaimer. 
+#
+# 2. Redistributions in binary form must reproduce the above copyright 
+#    notice, this list of conditions and the following disclaimer in the 
+#    documentation and/or other materials provided with the distribution. 
+#
+# 3. Neither the name of the Institute nor the names of its contributors 
+#    may be used to endorse or promote products derived from this software 
+#    without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+# SUCH DAMAGE. 
+
+top_builddir="@top_builddir@"
+env_setup="@env_setup@"
+objdir="@objdir@"
+
+. ${env_setup}
+
+KRB5_CONFIG="${1-${objdir}/krb5-hdb-mitdb.conf}"
+export KRB5_CONFIG
+
+testfailed="echo test failed; cat messages.log; exit 1"
+
+# If there is no ldap support compile in, disable test
+if ${kdc} --builtin-hdb | grep mit-db > /dev/null ; then
+    :
+else
+    echo "no MIT KDB support"
+    exit 77
+fi
+
+# If there is no useful db support compile in, disable test
+${have_db} || exit 77
+
+R=TEST.H5L.SE
+
+port=@port@
+
+kadmin="${kadmin} -l -r $R --config-file=${KRB5_CONFIG}"
+kdc="${kdc} --addresses=localhost -P $port"
+
+server=host/datan.test.h5l.se
+cache="FILE:${objdir}/cache.krb5"
+keytabfile=${objdir}/server.keytab
+keytab="FILE:${keytabfile}"
+
+kinit="${kinit} -c $cache ${afs_no_afslog}"
+klist="${klist} -c $cache"
+kgetcred="${kgetcred} -c $cache"
+kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
+
+rm -f ${keytabfile}
+rm -f current-db*
+rm -f out-*
+rm -f mkey.file*
+
+> messages.log
+
+echo Database should exist
+
+${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
+
+echo foo > ${objdir}/foopassword
+
+echo Starting kdc ; > messages.log
+env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
+
+trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+
+ec=0
+
+echo "Getting client initial tickets"; > messages.log
+${kinit} --password-file=${objdir}/foopassword foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+echo "Getting tickets"; > messages.log
+${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
+echo "Listing tickets"; > messages.log
+${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
+${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
+	{ ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "killing kdc (${kdcpid})"
+sh ${leaks_kill} kdc $kdcpid || exit 1
+
+trap "" EXIT
+
+exit $ec
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-iprop.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-iprop.in
index ba9aff14e..d1b48c2fb 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-iprop.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-iprop.in
@@ -35,6 +35,8 @@ top_builddir="@top_builddir@"
 env_setup="@env_setup@"
 objdir="@objdir@"
 
+db_type=@db_type@
+
 . ${env_setup}
 
 # If there is no useful db support compile in, disable test
@@ -56,6 +58,74 @@ kdc="${kdc} --addresses=localhost -P $port"
 kadmin="${kadmin} -r $R"
 kinit="${kinit} -c $cache ${afs_no_afslog}"
 
+slave_ver_from_master_old=
+slave_ver_from_master_new=
+slave_ver_old=
+slave_ver_new=
+get_iprop_ver () {
+    min_change=${1:-1}
+    slave_ver_from_master_new=`grep '^iprop/' iprop-stats | head -1 | awk '{print $3}'`
+    slave_ver_new=`grep 'up-to-date with version:' iprop-slave-status | awk '{print $4}'`
+    if [ -z "$slave_ver_from_master_new" -o -z "$slave_ver_new" ]; then
+        return 1
+    fi
+    if [ x"$slave_ver_from_master_new" != x"$slave_ver_new" ]; then
+        return 1
+    fi
+    if [ x"$slave_ver_from_master_old" != x ]; then
+        change=`expr "$slave_ver_from_master_new" - "$slave_ver_from_master_old"`
+        if [ "$change" -lt "$min_change" ]; then
+            return 1
+        fi
+    fi
+    slave_ver_from_master_old=$slave_ver_from_master_new
+    slave_ver_old=$slave_ver_new
+    return 0
+}
+
+waitsec=65
+sleeptime=2
+wait_for () {
+    msg=$1
+    shift
+    t=0
+    while ! "$@"; do
+        sleep $sleeptime;
+        t=`expr $t + $sleeptime`
+        if [ $t -gt $waitsec ]; then
+            echo "Waited too long for $msg"
+            exit 1
+        fi
+    done
+    return 0
+}
+
+check_pidfile_is_dead () {
+    if test ! -f lt-${1}.pid -a ! -f ${1}.pid; then
+        return 0
+    fi
+    _pid=`cat lt-${1}.pid ${1}.pid 2>/dev/null`
+    if [ -z "$_pid" ]; then
+        return 0
+    fi
+    if kill -0 $_pid 2>/dev/null; then
+        return 1
+    fi
+    return 0
+}
+
+wait_for_slave () {
+    wait_for "iprop versions to change and/or slave to catch up" get_iprop_ver "$@"
+}
+
+wait_for_master_down () {
+    wait_for "master to exit" check_pidfile_is_dead ipropd-master
+}
+
+wait_for_slave_down () {
+    wait_for "slave to exit" check_pidfile_is_dead ipropd-slave
+}
+
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
 
@@ -84,48 +154,111 @@ ${kadmin} -l ext -k ${keytab} iprop/slave.test.h5l.se@${R} || exit 1
 
 echo foo > ${objdir}/foopassword
 
+echo "Test log recovery"
+${kadmin} -l add --random-key --use-defaults recovtest@${R} || exit 1
+# Test theory: save the log, make a change and save the record it
+# produced, restore the log, append to it the saved record, then get
+
+# Save the log
+cp current.log current.log.tmp
+ls -l current.log.tmp | awk '{print $5}' > tmp
+read sz < tmp
+# Make a change
+${kadmin} -l mod -a requires-pre-auth recovtest@${R} || exit 1
+${kadmin} -l get recovtest@${R} | grep 'Attributes: requires-pre-auth$' > /dev/null || exit 1
+# Save the resulting log record
+ls -l current.log | awk '{print $5}' > tmp
+read nsz < tmp
+rm tmp
+dd bs=1 if=current.log skip=$sz of=current.log.tmp.saved-record count=`expr $nsz - $sz` 2>/dev/null
+# Undo the change
+${kadmin} -l mod -a -requires-pre-auth recovtest@${R} || exit 1
+${kadmin} -l get recovtest@${R} | grep 'Attributes:.$' > /dev/null || exit 1
+# Restore the log
+cp current.log current.log.save
+mv current.log.tmp current.log
+# Append the saved record
+cat current.log.tmp.saved-record >> current.log
+rm current.log.tmp.saved-record
+# Check that we still see the principal as modified
+${kadmin} -l get recovtest@${R} | grep 'Attributes: requires-pre-auth$' > /dev/null || exit 1
+
 # -- foo
 ipds=
 ipdm=
 kdcpid=
 
 > iprop-stats
+rm -f iprop-slave-status
+
+ipropd_slave="${ipropd_slave} --status-file=iprop-slave-status"
+
 trap "echo 'killing ipropd s + m + kdc'; kill -9 \${ipdm} \${ipds} \${kdcpid} >/dev/null 2>/dev/null; tail messages.log ; tail iprop-stats; exit 1;" EXIT
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
-sh ${wait_kdc} || exit 1
-
-echo "starting master"
+echo "starting master" ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 ${ipropd_master} --hostname=localhost -k ${keytab} \
-    --database=${objdir}/current-db &
-ipdm=$!
-sh ${wait_kdc} ipropd-master || exit 1
+    --database=${objdir}/current-db --detach ||
+    { echo "ipropd-master failed to start"; exit 1; }
+ipdm=`getpid ipropd-master`
 
-echo "starting slave"
+echo "starting slave" ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
-${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} localhost &
-ipds=$!
-sh ${wait_kdc} ipropd-slave || exit 1
+${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} --detach localhost ||
+    { echo "ipropd-slave failed to start"; exit 1; }
+ipds=`getpid ipropd-slave`
+sh ${wait_kdc} ipropd-slave messages.log 'slave status change: up-to-date' || exit 1
+get_iprop_ver || exit 1
 
 echo "checking slave is up"
 ${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null || exit 1
+${EGREP} 'up-to-date with version' iprop-slave-status >/dev/null || { echo "slave to up to date" ; cat iprop-slave-status ; exit 1; }
 
 # ----------------- checking: pushing lives changes
 
 echo "Add host"
 ${kadmin} -l add --random-key --use-defaults host/foo@${R} || exit 1
-sleep 2
+wait_for_slave
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
 ${kadmin} -l get host/foo@${R} > /dev/null || exit 1
 
+echo "Rollover host keys"
+${kadmin} -l cpw -r --keepold host/foo@${R} || exit 1
+${kadmin} -l cpw -r --keepold host/foo@${R} || exit 1
+${kadmin} -l cpw -r --keepold host/foo@${R} || exit 1
+wait_for_slave 3
+KRB5_CONFIG="${objdir}/krb5-slave.conf" \
+${kadmin} -l get host/foo@${R} | \
+    ${EGREP} Keytypes: | cut -d: -f2 | tr ' ' '
+' | sed 's/^.*[[]\(.*\)[]].*$/\1/' | grep '[0-9]' | sort -nu | tr -d '
+' | ${EGREP} 1234 > /dev/null || exit 1
+
+echo "Delete 3DES keys"
+${kadmin} -l del_enctype host/foo@${R} des3-cbc-sha1
+wait_for_slave
+KRB5_CONFIG="${objdir}/krb5-slave.conf" \
+${kadmin} -l get host/foo@${R} | \
+    ${EGREP} Keytypes: | cut -d: -f2 | tr ' ' '
+' | sed 's/^.*[[]\(.*\)[]].*$/\1/' | grep '[0-9]' | sort -nu | tr -d '
+' | ${EGREP} 1234 > /dev/null || exit 1
+KRB5_CONFIG="${objdir}/krb5-slave.conf" \
+${kadmin} -l get host/foo@${R} | \
+    ${EGREP} 'Keytypes:.*des3-cbc-sha1' > /dev/null && exit 1
+
+echo "Change policy host"
+${kadmin} -l modify --policy=default host/foo@${R} || exit 1
+wait_for_slave
+KRB5_CONFIG="${objdir}/krb5-slave.conf" \
+${kadmin} -l get host/foo@${R} > /dev/null 2>/dev/null || exit 1
+
 echo "Rename host"
 ${kadmin} -l rename host/foo@${R} host/bar@${R} || exit 1
-sleep 2
+wait_for_slave
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
 ${kadmin} -l get host/foo@${R} > /dev/null 2>/dev/null && exit 1
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
@@ -133,19 +266,27 @@ ${kadmin} -l get host/bar@${R} > /dev/null || exit 1
 
 echo "Delete host"
 ${kadmin} -l delete host/bar@${R} || exit 1
-sleep 2
+wait_for_slave
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
 ${kadmin} -l get host/bar@${R} > /dev/null 2>/dev/null && exit 1
 
-echo "kill slave"
+# See note below in LMDB sanity checking
+echo "Re-add host"
+${kadmin} -l add --random-key --use-defaults host/foo@${R} || exit 1
+${kadmin} -l add --random-key --use-defaults host/bar@${R} || exit 1
+
+echo "kill slave and remove log and database"
 > iprop-stats
 sh ${leaks_kill} ipropd-slave $ipds || exit 1
-sleep 2
+rm -f iprop-slave-status
 
+wait_for_slave_down
 ${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Down' iprop-stats >/dev/null || exit 1
 
 # ----------------- checking: slave is missing changes while down
 
+rm current.slave.log current-db.slave* || exit 1
+
 echo "doing changes while slave is down"
 ${kadmin} -l cpw --random-password user@${R} > /dev/null || exit 1
 ${kadmin} -l cpw --random-password user@${R} > /dev/null || exit 1
@@ -155,53 +296,67 @@ cp ${objdir}/current.log ${objdir}/current.log.tmp
 
 # ----------------- checking: checking that master and slaves resyncs
 
-echo "starting slave again"
+echo "starting slave again" ; > messages.log
 > iprop-stats
-> messages.log
 env ${HEIM_MALLOC_DEBUG} \
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
-${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} localhost &
-ipds=$!
-sh ${wait_kdc} ipropd-slave || exit 1
+${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} --detach localhost ||
+    { echo "ipropd-slave failed to start"; exit 1; }
+ipds=`getpid ipropd-slave`
 
 echo "checking slave is up again"
-${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null || exit 1
+wait_for "slave to start and connect to master" \
+    ${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null
+wait_for_slave 2
+${EGREP} 'up-to-date with version' iprop-slave-status >/dev/null || { echo "slave not up to date" ; cat iprop-slave-status ; exit 1; }
 echo "checking for replay problems"
 ${EGREP} 'Entry already exists in database' messages.log && exit 1
 
+echo "compare versions on master and slave logs (no lock)"
+KRB5_CONFIG=${objdir}/krb5-slave.conf \
+${iprop_log} last-version -n > slave-last.tmp
+${iprop_log} last-version -n > master-last.tmp
+cmp master-last.tmp slave-last.tmp || exit 1
+
 echo "kill slave and remove log and database"
 sh ${leaks_kill} ipropd-slave $ipds || exit 1
-sleep 2
+wait_for_slave_down
 
 rm current.slave.log current-db.slave* || exit 1
 > iprop-stats
-> messages.log
+rm -f iprop-slave-status
+echo "starting slave" ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
-${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} localhost &
-ipds=$!
-sh ${wait_kdc} ipropd-slave || exit 1
+${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} --detach localhost ||
+    { echo "ipropd-slave failed to start"; exit 1; }
+ipds=`getpid ipropd-slave`
+wait_for_slave 0
 
 echo "checking slave is up again"
-${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null || exit 1
+wait_for "slave to start and connect to master" \
+    ${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null
+${EGREP} 'up-to-date with version' iprop-slave-status >/dev/null || { echo "slave not up to date" ; cat iprop-slave-status ; exit 1; }
 echo "checking for replay problems"
 ${EGREP} 'Entry already exists in database' messages.log && exit 1
 
 # ----------------- checking: checking live truncation of master log
 
 ${kadmin} -l cpw --random-password user@${R} > /dev/null || exit 1
-sleep 2
+wait_for_slave
 
 echo "live truncate on master log"
-${iprop_log} truncate || exit 1
-sleep 2
+${iprop_log} truncate -K 5 || exit 1
+wait_for_slave 0
 
 echo "Killing master and slave"
 sh ${leaks_kill} ipropd-master $ipdm || exit 1
 sh ${leaks_kill} ipropd-slave $ipds || exit 1
 
-#sleep 2
-#${EGREP} "^master down at " iprop-stats > /dev/null || exit 1
+rm -f iprop-slave-status
+
+wait_for_slave_down
+wait_for_master_down
 
 echo "compare versions on master and slave logs"
 KRB5_CONFIG=${objdir}/krb5-slave.conf \
@@ -216,33 +371,39 @@ cmp master-last.tmp slave-last.tmp || exit 1
 echo "Going back to old version of the master log file"
 cp ${objdir}/current.log.tmp ${objdir}/current.log
 
-echo "starting master"
+echo "starting master"  ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 ${ipropd_master} --hostname=localhost -k ${keytab} \
-    --database=${objdir}/current-db &
-ipdm=$!
-sh ${wait_kdc} ipropd-master || exit 1
+    --database=${objdir}/current-db --detach ||
+    { echo "ipropd-master failed to start"; exit 1; }
+ipdm=`getpid ipropd-master`
 
-echo "starting slave"
+echo "starting slave" ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 KRB5_CONFIG="${objdir}/krb5-slave.conf" \
-${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} localhost &
-ipds=$!
-sh ${wait_kdc} ipropd-slave || exit 1
+${ipropd_slave} --hostname=slave.test.h5l.se -k ${keytab} --detach localhost ||
+    { echo "ipropd-slave failed to start"; exit 1; }
+ipds=`getpid ipropd-slave`
+wait_for_slave -1
 
 echo "checking slave is up again"
-${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null || exit 1
+wait_for "slave to start and connect to master" \
+    ${EGREP} 'iprop/slave.test.h5l.se@TEST.H5L.SE.*Up' iprop-stats >/dev/null
+${EGREP} 'up-to-date with version' iprop-slave-status >/dev/null || { echo "slave to up to date" ; cat iprop-slave-status ; exit 1; }
 echo "checking for replay problems"
 ${EGREP} 'Entry already exists in database' messages.log && exit 1
 
 echo "pushing one change"
 ${kadmin} -l cpw --random-password user@${R} > /dev/null || exit 1
-sleep 2
+wait_for_slave
 
 echo "Killing master"
 sh ${leaks_kill} ipropd-master $ipdm || exit 1
 
-sleep 4
+wait_for_master_down
+
+wait_for "slave to disconnect" \
+  ${EGREP} 'disconnected' iprop-slave-status >/dev/null
 
 if ! tail -30 messages.log | grep 'disconnected for server' > /dev/null; then
     echo "client didnt disconnect"
@@ -254,30 +415,30 @@ kill -0 ${ipds}  || { echo "slave no longer there"; exit 1; }
 
 > messages.log
 
-echo "Staring master again"
+echo "Staring master again" ; > messages.log
 env ${HEIM_MALLOC_DEBUG} \
 ${ipropd_master} --hostname=localhost -k ${keytab} \
-    --database=${objdir}/current-db &
-ipdm=$!
-sh ${wait_kdc} ipropd-master || exit 1
+    --database=${objdir}/current-db --detach ||
+    { echo "ipropd-master failed to start"; exit 1; }
+ipdm=`getpid ipropd-master`
 
 echo "probing for slave pid"
 kill -0 ${ipds}  || { echo "slave no longer there"; exit 1; }
 
-sh ${wait_kdc} ipropd-slave messages.log "connection successful to master" || exit 1
-
-sh ${wait_kdc} ipropd-slave messages.log "ipropd-slave started at version" || exit 1
 
 echo "pushing one change"
 ${kadmin} -l cpw --random-password user@${R} > /dev/null || exit 1
-sleep 2
+wait_for_slave
 
 echo "shutting down all services"
 
+leaked=false
+sh ${leaks_kill} kdc $kdcpid || leaked=true
+sh ${leaks_kill} ipropd-master $ipdm || leaked=true
+sh ${leaks_kill} ipropd-slave $ipds || leaked=true
+rm -f iprop-slave-status
 trap "" EXIT
-sh ${leaks_kill} kdc $kdcpid || exit 1
-sh ${leaks_kill} ipropd-master $ipdm || exit 1
-sh ${leaks_kill} ipropd-slave $ipds || exit 1
+$leaked && exit 1
 
 echo "compare versions on master and slave logs"
 KRB5_CONFIG=${objdir}/krb5-slave.conf \
@@ -285,4 +446,17 @@ ${iprop_log} last-version > slave-last.tmp
 ${iprop_log} last-version > master-last.tmp
 cmp master-last.tmp slave-last.tmp || exit 1
 
-exit $ec
+if [ "$db_type" = lmdb ]; then
+    # Sanity check that we have the same number of principals at the HDB
+    # and LMDB levels.
+    #
+    # We should also do this for the sqlite backend, but that would
+    # require a sqlite3(1) shell that is capable of opening our HDB
+    # files.  W
+    echo "checking that principals in DB == entries in LMDB"
+    princs=`${kadmin} -l list '*' | wc -l`
+    entries=`mdb_stat -n current-db.mdb | grep 'Entries:' | awk '{print $2}'`
+    [ "`expr 1 + "$princs"`" -eq "$entries" ] || exit 1
+fi
+
+exit 0
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kadmin.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kadmin.in
index fdd225cc8..d40d0ea88 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kadmin.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kadmin.in
@@ -82,24 +82,70 @@ ${kadmin} -l add -p foo --use-defaults bar@${R} || exit 1
 ${kadmin} -l add -p foo --use-defaults baz@${R} || exit 1
 ${kadmin} -l add -p foo --use-defaults bez@${R} || exit 1
 ${kadmin} -l add -p foo --use-defaults fez@${R} || exit 1
+${kadmin} -l add -p foo --use-defaults hasalias@${R} || exit 1
 ${kadmin} -l add -p foo --use-defaults pkinit@${R} || exit 1
 ${kadmin} -l modify --pkinit-acl="CN=baz,DC=test,DC=h5l,DC=se" pkinit@${R} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    kill -9 ${kadmpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid} ${kadmpid}" EXIT
 
+#----------------------------------
+echo "kinit (no admin); test mod --alias authorization"
+${kinit} --password-file=${objdir}/foopassword \
+    -S kadmin/admin@${R} hasalias@${R} || exit 1
+
+${kadmind} -d &
+kadmpid=$!
+sleep 1
+
+# Check that one non-permitted alias -> failure
+env KRB5CCNAME=${cache} \
+${kadmin} -p hasalias@${R} modify --alias=goodalias1@${R} --alias=badalias@${R} hasalias@${R} &&
+	{ echo "kadmin failed $?"; cat messages.log ; exit 1; }
+wait $kadmpid || { echo "kadmind failed $?"; cat messages.log ; exit 1; }
+
+${kadmind} -d &
+kadmpid=$!
+sleep 1
+
+# Check that all permitted aliases -> success
+env KRB5CCNAME=${cache} \
+${kadmin} -p hasalias@${R} modify --alias=goodalias1@${R} --alias=goodalias2@${R} hasalias@${R} ||
+	{ echo "kadmin failed $?"; cat messages.log ; exit 1; }
+wait $kadmpid || { echo "kadmind failed $?"; cat messages.log ; exit 1; }
+
+${kadmind} -d &
+kadmpid=$!
+sleep 1
+
+# Check that we can drop aliases
+env KRB5CCNAME=${cache} \
+${kadmin} -p hasalias@${R} modify --alias=goodalias3@${R} hasalias@${R} ||
+	{ echo "kadmin failed $?"; cat messages.log ; exit 1; }
+wait $kadmpid || { echo "kadmind failed $?"; cat messages.log ; exit 1; }
+${kadmin} -l get hasalias@${R} | grep Aliases: > kadmin.tmp
+read junk aliases < kadmin.tmp
+rm kadmin.tmp
+[ "$aliases" != "goodalias3@${R}" ] && { echo "kadmind failed $?"; cat messages.log ; exit 1; }
+
+${kadmind} -d &
+kadmpid=$!
+sleep 1
+
+env KRB5CCNAME=${cache} \
+${kadmin} -p hasalias@${R} modify --alias=goodalias1@${R} --alias=goodalias2@${R} --alias=goodalias3@${R} hasalias@${R} ||
+	{ echo "kadmin failed $?"; cat messages.log ; exit 1; }
+wait $kadmpid || { echo "kadmind failed $?"; cat messages.log ; exit 1; }
+${kadmin} -l get hasalias@${R} | grep Aliases: > kadmin.tmp
+read junk aliases < kadmin.tmp
+rm kadmin.tmp
+[ "$aliases" != "goodalias1@${R} goodalias2@${R} goodalias3@${R}" ] && { echo "FOO failed $?"; cat messages.log ; exit 1; }
+
 #----------------------------------
 ${kadmind} -d &
 kadmpid=$!
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kdc.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kdc.in
index 3f370598e..235113425 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kdc.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kdc.in
@@ -46,13 +46,32 @@ testfailed="echo test failed; cat messages.log; exit 1"
 ${have_db} || exit 77
 
 R=TEST.H5L.SE
+RH=TEST-HTTP.H5L.SE
 R2=TEST2.H5L.SE
-R3=TEST-HTTP.H5L.SE
+R3=TEST3.H5L.SE
+R4=TEST4.H5L.SE
+R5=SOME-REALM5.FR
+R6=SOME-REALM6.US
+R7=SOME-REALM7.UK
+
+H1=H1.$R
+H2=H2.$R
+H3=H3.$H2
+H4=H4.$H2
+
+r=`echo "$R" | tr '[A-Z]' '[a-z]'`
+h1=`echo "${H1}" | tr '[A-Z]' '[a-z]'`
+h2=`echo "${H2}" | tr '[A-Z]' '[a-z]'`
+h3=`echo "${H3}" | tr '[A-Z]' '[a-z]'`
+h4=`echo "${H4}" | tr '[A-Z]' '[a-z]'`
 
 port=@port@
+pwport=@pwport@
 
 kadmin="${kadmin} -l -r $R"
+kadmin5="${kadmin} -l -r $R5"
 kdc="${kdc} --addresses=localhost -P $port"
+kpasswdd="${kpasswdd} --addresses=localhost -p $pwport"
 
 server=host/datan.test.h5l.se
 server2=host/computer.example.com
@@ -77,6 +96,7 @@ kgetcred="${kgetcred} -c $cache"
 kgetcred_imp="${kgetcred} -c $cache --out-cache=${ocache}"
 kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
 kimpersonate="${kimpersonate} -k ${keytab} --ccache=${ocache}"
+test_set_kvno0="${test_set_kvno0} -c $cache"
 
 rm -f ${keytabfile}
 rm -f current-db*
@@ -104,17 +124,91 @@ ${kadmin} \
     --realm-max-renewable-life=1month \
     ${R3} || exit 1
 
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R4} || exit 1
+
+${kadmin5} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R5} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R6} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R7} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${H1} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${H2} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${H3} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${H4} || exit 1
+
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${RH} || exit 1
+
 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 
 ${kadmin} add -p foo --use-defaults foo@${R} || exit 1
+${kadmin} add -p foo --use-defaults foo/host.${r}@${R} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R2} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R3} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R4} || exit 1
+${kadmin5} add -p foo --use-defaults foo@${R5} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R6} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R7} || exit 1
+${kadmin} add -p foo --use-defaults foo@${H1} || exit 1
+${kadmin} add -p foo --use-defaults foo/host.${h1}@${H1} || exit 1
+${kadmin} add -p foo --use-defaults foo@${H2} || exit 1
+${kadmin} add -p foo --use-defaults foo/host.${h2}@${H2} || exit 1
+${kadmin} add -p foo --use-defaults foo@${H3} || exit 1
+${kadmin} add -p foo --use-defaults foo/host.${h3}@${H3} || exit 1
+${kadmin} add -p foo --use-defaults foo@${H4} || exit 1
+${kadmin} add -p foo --use-defaults foo/host.${h4}@${H4} || exit 1
 ${kadmin} add -p bar --use-defaults bar@${R} || exit 1
 ${kadmin} add -p foo --use-defaults remove@${R} || exit 1
-${kadmin} add -p kaka --use-defaults ${server}@${R} || exit 1
+${kadmin} add -p nop --use-defaults ${server}@${R} || exit 1
+${kadmin} cpw -p bla --keepold ${server}@${R} || exit 1
+${kadmin} cpw -p kaka --keepold ${server}@${R} || exit 1
 ${kadmin} add -p kaka --use-defaults ${server}-des3@${R} || exit 1
 ${kadmin} add -p kaka --use-defaults kt-des3@${R} || exit 1
+${kadmin} add -p kaka --use-defaults foo/des3-only@${R} || exit 1
+${kadmin} add -p kaka --use-defaults bar/des3-only@${R} || exit 1
+${kadmin} add -p kaka --use-defaults foo/aes-only@${R} || exit 1
 ${kadmin} add -p foo --use-defaults ${ps} || exit 1
 ${kadmin} modify --attributes=+trusted-for-delegation ${ps} || exit 1
 ${kadmin} modify --constrained-delegation=${server} ${ps} || exit 1
@@ -137,10 +231,46 @@ ${kadmin} modify --alias=${alias2}@${R} ${alias1}@${R}
 ${kadmin} add -p cross1 --use-defaults krbtgt/${R2}@${R} || exit 1
 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${R2} || exit 1
 
+${kadmin} add -p cross1 --use-defaults krbtgt/${R3}@${R2} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R3} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R2} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R4} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R3} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R3}@${R4} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${R5}@${R} || exit 1
+${kadmin5} add -p cross2 --use-defaults krbtgt/${R}@${R5} || exit 1
+
+${kadmin5} add -p cross1 --use-defaults krbtgt/${R6}@${R5} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R5}@${R6} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${R7}@${R6} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R7} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${H1}@${R} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H1} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${H2}@${R} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H2} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H2} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${H2}@${H3} || exit 1
+
+${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H4} || exit 1
+${kadmin} add -p cross2 --use-defaults krbtgt/${H4}@${H3} || exit 1
+
 ${kadmin} add -p foo --use-defaults pw-expire@${R} || exit 1
 ${kadmin} modify --pw-expiration-time=+1day  pw-expire@${R} || exit 1
 
-${kadmin} add -p foo --use-defaults foo@${R3} || exit 1
+${kadmin} add -p foo --use-defaults pw-expired@${R} || exit 1
+${kadmin} modify --pw-expiration-time=2012-06-12  pw-expired@${R} || exit 1
+
+${kadmin} add -p foo --use-defaults account-expired@${R} || exit 1
+${kadmin} modify --expiration-time=2012-06-12  account-expired@${R} || exit 1
+
+${kadmin} add -p foo --use-defaults foo@${RH} || exit 1
 
 echo "Check parser"
 ${kadmin} add -p foo --use-defaults -- -p || exit 1
@@ -149,14 +279,28 @@ ${kadmin} delete -- -p || exit 1
 echo "Doing database check"
 ${kadmin} check ${R} || exit 1
 ${kadmin} check ${R2} || exit 1
+${kadmin} check ${R3} || exit 1
+${kadmin} check ${R4} || exit 1
+${kadmin5} check ${R5} || exit 1
+${kadmin} check ${R6} || exit 1
+${kadmin} check ${R7} || exit 1
+${kadmin} check ${H1} || exit 1
+${kadmin} check ${H2} || exit 1
+${kadmin} check ${H3} || exit 1
+${kadmin} check ${H4} || exit 1
 
 echo "Extracting enctypes"
 ${ktutil} -k ${keytab} list > tempfile || exit 1
 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
+    ${EGREP} -v "$server" |                 # we did cpw for this one
     awk '$1 !~ /1/  { exit 1 }' || exit 1
+${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
+    ${EGREP} "$server" | head -1 |
+    awk '$1 !~ /3/  { exit 1 }' || exit 1
+
 
 ${kadmin} get foo@${R} > tempfile || exit 1
-enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://'`
+enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g'`
 
 enctype_sans_aes=`echo $enctypes | sed 's/aes[^ ]*//g'`
 enctype_sans_des3=`echo $enctypes | sed 's/des3-cbc-sha1//g'`
@@ -167,26 +311,52 @@ for a in ${enctype_sans_des3} ; do
    ${ktutil} -k ${keytab} remove -p kt-des3@${R} -e $a
 done
 
-echo foo > ${objdir}/foopassword
-
-echo Starting kdc
-env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
+echo "checking globbing keys rules"
+${kadmin} get foo/des3-only@${R} > tempfile || exit 1
+enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
+if [ X"$enctypes" != Xdes3-cbc-sha1 ] ; then
+    echo "des3 only is not only des3: $enctypes"
     exit 1
 fi
 
-trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+${kadmin} get foo/aes-only@${R} > tempfile || exit 1
+enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
+if [ X"$enctypes" != Xaes256-cts-hmac-sha1-96 ] ; then
+    echo "aes only is not only aes: $enctypes"
+    exit 1
+fi
+
+
+echo foo > ${objdir}/foopassword
+echo notfoo > ${objdir}/notfoopassword
+
+echo Starting kdc ; > messages.log
+env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
+${kdc} --detach --testing ||
+    { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
+
+echo Starting kpasswdd; > messages.log
+env ${HEIM_MALLOC_DEBUG} ${kpasswdd} --detach ||
+    { echo "kpasswdd failed to start"; exit 1; }
+kpasswddpid=`getpid kpasswdd`
+
+
+trap "kill -9 ${kdcpid} ${kpasswddpid}; echo signal killing kdc kpasswdd; exit 1;" EXIT
 
 ec=0
 
+echo "Getting client initial tickets with wrong password"; > messages.log
+${kinit} --password-file=${objdir}/notfoopassword \
+        foo@${R} 2>kinit-log.tmp && \
+	{ ec=1 ; eval "${testfailed}"; }
+grep 'Password incorrect' kinit-log.tmp > /dev/null || \
+	{ ec=1 ; eval "${testfailed}"; }
 echo "Getting client initial tickets"; > messages.log
 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 	{ ec=1 ; eval "${testfailed}"; }
+echo "Doing krbtgt key rollover"; > messages.log
+${kadmin} cpw -r --keepold krbtgt/${R}@${R} || exit 1
 echo "Getting tickets"; > messages.log
 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 echo "Listing tickets"; > messages.log
@@ -196,10 +366,74 @@ ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 ${kdestroy}
 
 echo "Getting client initial tickets (http transport)"; > messages.log
-${kinit} --password-file=${objdir}/foopassword foo@${R3} || \
+${kinit} --password-file=${objdir}/foopassword foo@${RH} || \
 	{ ec=1 ; eval "${testfailed}"; }
 ${kdestroy}
 
+echo "Testing capaths logic"
+${kinit} --password-file=${objdir}/foopassword \
+    -e ${aesenctype} -e ${aesenctype} \
+    foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Getting x-realm tickets with capaths for $R -> $R2"
+${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R3"
+${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R4"
+${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R5"
+${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R6"
+${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R7"
+${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Testing capaths logic (reverse order)"
+${kinit} --password-file=${objdir}/foopassword \
+    -e ${aesenctype} -e ${aesenctype} \
+    foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Getting x-realm tickets with capaths for $R -> $R4"
+${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R3"
+${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R2"
+${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R7"
+${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R6"
+${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with capaths for $R -> $R5"
+${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Testing hierarchical referral logic"
+${kinit} --password-file=${objdir}/foopassword \
+    -e ${aesenctype} -e ${aesenctype} \
+    foo@${H3} || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H1"
+${kgetcred} --hostbased --canonicalize foo host.${h1} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $R"
+${kgetcred} --hostbased --canonicalize foo host.${r} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H2"
+${kgetcred} --hostbased --canonicalize foo host.${h2} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Testing multi-hop [capaths] referral logic"
+${kinit} --password-file=${objdir}/foopassword \
+    -e ${aesenctype} -e ${aesenctype} \
+    foo@${H4} || \
+	{ ec=1 ; eval "${testfailed}"; }
+
+echo "Getting x-realm tickets with [capaths] referrals for $H4 -> $H1"
+${kgetcred} --hostbased --canonicalize foo/host.${h1}@${H4} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
 echo "Testing forwardable/renewable flag copying in TGS-REQ"
 ${kinit} -f --renewable -r 5d --password-file=${objdir}/foopassword foo@$R || \
 	{ ec=1 ; eval "${testfailed}"; }
@@ -250,6 +484,60 @@ for a in $enctypes; do
 done
 ${kdestroy}
 
+echo "Trying x-realm TGT with kvno 0 case";
+${kinit} --password-file=${objdir}/foopassword foo@$R ||
+	{ ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting cross realm tickets"; > messages.log
+${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting service ticket"; > messages.log
+${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Trying x-realm TGT with kvno 0 case with key rollover";
+${kinit} --password-file=${objdir}/foopassword foo@$R ||
+	{ ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting cross realm tickets"; > messages.log
+${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+echo "Rolling over cross realm keys"; > messages.log
+${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
+${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
+echo "Getting service ticket"; > messages.log
+echo "Start tracing kdc, then hit return"
+${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Trying x-realm TGT with no kvno case";
+${kinit} --password-file=${objdir}/foopassword foo@$R ||
+	{ ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
+echo "Getting cross realm tickets"; > messages.log
+${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
+echo "Getting service ticket"; > messages.log
+${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Trying x-realm TGT with no kvno case with key rollover";
+${kinit} --password-file=${objdir}/foopassword foo@$R ||
+	{ ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
+echo "Getting cross realm tickets"; > messages.log
+${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+echo "Rolling over cross realm keys"; > messages.log
+${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
+${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
+${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
+echo "Getting service ticket"; > messages.log
+echo "Start tracing kdc, then hit return"
+${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
 echo "try all permutations"; > messages.log
 for a in $enctypes; do
 	echo "Getting client initial tickets ($a)"; > messages.log
@@ -539,7 +827,7 @@ echo "testing removal of keytab"
 ${ktutil} -k ${keytab} destroy || { ec=1 ; eval "${testfailed}"; }
 test -f ${keytabfile} && { ec=1 ; eval "${testfailed}"; }
 
-echo "Getting client pw expire"; > messages.log
+echo "Checking client pw expire"; > messages.log
 ${kinit} --password-file=${objdir}/foopassword \
         pw-expire@${R} 2>kinit-log.tmp|| \
 	{ ec=1 ; eval "${testfailed}"; }
@@ -552,8 +840,30 @@ ${EGREP} "^e type: 6" kinit-log.tmp > /dev/null  || \
 echo "   test_gic passes"
 ${kdestroy}
 
-echo "killing kdc (${kdcpid})"
+echo "Checking password expiration" ; > messages.log
+
+kinitpty=${objdir}/foopassword.rkpty
+cat > ${kinitpty} <<EOF
+expect Password
+password foo\n
+expect Password has expired
+expect New password
+password Foobar11\n
+expect password
+password Foobar11\n
+expect Success: Password changed
+EOF
+
+echo "Checking client pw expire"; > messages.log
+${rkpty} ${kinitpty} ${kinit} pw-expired@${R}|| \
+	{ ec=1 ; eval "${testfailed}"; }
+
+${kdestroy}
+
+
+echo "killing kdc (${kdcpid}) kpasswdd (${kpasswddpid})"
 sh ${leaks_kill} kdc $kdcpid || exit 1
+sh ${leaks_kill} kpasswdd $kpasswddpid || exit 1
 
 trap "" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kinit.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kinit.in
new file mode 100644
index 000000000..e541a844d
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kinit.in
@@ -0,0 +1,149 @@
+#!/bin/bash
+#
+# Copyright (c) 2006 - 2008 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden).
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# 3. Neither the name of the Institute nor the names of its contributors
+#    may be used to endorse or promote products derived from this software
+#    without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+env_setup="@env_setup@"
+objdir="@objdir@"
+
+. ${env_setup}
+
+KRB5_CONFIG="${objdir}/krb5-kinit.conf"
+export KRB5_CONFIG
+KRB5CCNAME="${objdir}/foocc"
+export KRB5CCNAME
+
+testfailed="echo test failed; exit 1"
+
+# If there is no useful db support compile in, disable test
+${have_db} || exit 77
+
+R=TEST.H5L.SE
+
+port=@port@
+pwport=@pwport@
+
+kinit="${kinit} --password-file=${objdir}/foopassword ${afs_no_afslog} -c ${objdir}/foocc"
+klist="${klist} -c ${objdir}/foocc"
+kgetcred="${kgetcred} -c ${objdir}/foocc"
+kdestroy="${kdestroy} ${afs_no_unlog}"
+kadmin="${kadmin} -l -r $R"
+kdc="${kdc} --addresses=localhost -P $port"
+
+
+cache="FILE:${objdir}/cache.krb5"
+keytabfile=${objdir}/server.keytab
+keytab="FILE:${keytabfile}"
+
+> messages.log
+
+num_concurrent=50
+num_princs=20
+torture_time=200
+cred_life=$((torture_time / 10))
+cred_renew_life=$((torture_time / 2))
+out=${objdir}/out-kinit-torture-kgetcred
+kinit_out=${objdir}/out-kinit-torture-kinit
+
+parent_shell_proc=$$
+
+if (($# == 0)); then
+
+    echo "This is a MANUAL test."
+
+    rm -f ${keytabfile}
+    rm -f current-db*
+    rm -f out-*
+    rm -f mkey.file*
+
+    cp "${objdir}/krb5.conf" "${objdir}/krb5-kinit.conf"
+
+    echo "Creating database"
+    ${kadmin} \
+	init \
+	--realm-max-ticket-life=1day \
+	--realm-max-renewable-life=1month \
+	${R} || exit 1
+
+    echo "Adding foo"
+    ${kadmin} add -p foo --use-defaults foo@${R} || exit 1
+
+    echo "Creating torture principals"
+    for i in $(seq 0 $((num_princs - 1)) ); do
+	${kadmin} add -r --use-defaults svc${i}@${R} || exit 1
+    done
+
+    echo "Doing database check"
+    ${kadmin} check ${R} || exit 1
+
+    echo foo > ${objdir}/foopassword
+
+    echo Starting kdc ; > messages.log
+    ${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+    kdcpid=`getpid kdc`
+
+    trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+
+    ec=0
+else
+    echo "begin torture (output in $out)"
+    secs=$(date +%s)
+    cat /dev/null > "$out"
+    while (($(date +%s) < (secs + torture_time) )); do
+	echo .
+	for i in $(seq 0 1000); do
+	    printf '%d\n' $((i % num_princs))
+	done | xargs -P $num_concurrent -I '{}' ${kgetcred} "svc{}@${R}"
+	${klist} -v || exit 1
+	if ! kill -0 $parent_shell_proc; then
+	    printf 'Parent shell script exited; exiting'
+	    exit 1
+	    grep 'Matching credential .* not found' messages.log > /dev/null &&
+		echo "THAT DID NOT WORK RIGHT"
+	fi
+	sleep 5
+    done
+    ${klist} -v
+    exit 0
+fi
+
+echo "checking that we have tickets"
+${kinit} -l $cred_life -r $cred_renew_life foo@${R} || { ec=1 ; eval "${testfailed}"; }
+${klist} -v || { ec=1 ; eval "${testfailed}"; }
+echo "torturing"
+${kinit} -l $cred_life -r $cred_renew_life foo@${R} "$0" torture-me || { ec=1 ; eval "${testfailed}"; }
+
+echo "killing kdc (${kdcpid})"
+sh ${leaks_kill} kdc $kdcpid || exit 1
+
+trap "" EXIT
+
+exit $ec
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kpasswdd.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kpasswdd.in
index 355930fc7..3711ede01 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-kpasswdd.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-kpasswdd.in
@@ -101,19 +101,15 @@ ${kadmin} check ${R2} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-env ${HEIM_MALLOC_DEBUG} ${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+env ${HEIM_MALLOC_DEBUG} ${kdc} --detach --testing ||
+    { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 echo Starting kpasswdd
-env ${HEIM_MALLOC_DEBUG} ${kpasswdd} &
-kpasswddpid=$!
+env ${HEIM_MALLOC_DEBUG} ${kpasswdd} --detach ||
+    { echo "kpasswdd failed to start"; exit 1; }
+kpasswddpid=`getpid kpasswdd`
 
 trap "kill -9 ${kdcpid} ${kpasswddpid}; echo signal killing kdc; exit \$ec;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-pkinit.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-pkinit.in
index 723cc142b..92c515ffb 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-pkinit.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-pkinit.in
@@ -168,15 +168,9 @@ ${hxtool} issue-certificate \
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; cat ca.crt kdc.crt pkinit.crt ;exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-referral.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-referral.in
index 75790780c..bbb72a349 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-referral.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-referral.in
@@ -45,7 +45,7 @@ ${have_db} || exit 77
 R=TEST.H5L.SE
 R2=SUB.TEST.H5L.SE
 
-service=ldap/host.sub.test.h5l.se
+service=ldap/host.sub.test.h5l.se:389
 
 port=@port@
 
@@ -59,7 +59,6 @@ klist="${klist} -c $cache"
 kgetcred="${kgetcred} -c $cache"
 kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
 
-
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
 
@@ -100,15 +99,9 @@ ${kadmin} check ${R2} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-tester.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-tester.in
new file mode 100644
index 000000000..8f1679f50
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-tester.in
@@ -0,0 +1,118 @@
+#!/bin/sh
+#
+# Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden). 
+# All rights reserved. 
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met: 
+#
+# 1. Redistributions of source code must retain the above copyright 
+#    notice, this list of conditions and the following disclaimer. 
+#
+# 2. Redistributions in binary form must reproduce the above copyright 
+#    notice, this list of conditions and the following disclaimer in the 
+#    documentation and/or other materials provided with the distribution. 
+#
+# 3. Neither the name of the Institute nor the names of its contributors 
+#    may be used to endorse or promote products derived from this software 
+#    without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+# SUCH DAMAGE. 
+
+top_builddir="@top_builddir@"
+env_setup="@env_setup@"
+objdir="@objdir@"
+srcdir="@srcdir@"
+
+. ${env_setup}
+
+KRB5_CONFIG="${1-${objdir}/krb5.conf}"
+export KRB5_CONFIG
+
+testfailed="echo test failed; cat messages.log; exit 1"
+
+# If there is no useful db support compile in, disable test
+${have_db} || exit 77
+
+R=TEST.H5L.SE
+
+keytabfile=${objdir}/server.keytab
+keytab="FILE:${keytabfile}"
+keyfile="${hx509_data}/key.der"
+keyfile2="${hx509_data}/key2.der"
+
+kadmin="${kadmin} -l -r $R"
+
+server=host/datan.test.h5l.se
+
+rsa=yes
+pkinit=no
+if ${hxtool} info | grep 'rsa: hx509 null RSA' > /dev/null ; then
+    rsa=no
+fi
+if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
+    rsa=no
+fi
+
+if ${kinit} --help 2>&1 | grep "CA certificates" > /dev/null; then
+    pkinit=yes
+fi
+
+# If we doesn't support pkinit and have RSA, give up
+if test "$rsa" != yes ; then
+    pkinit=no
+fi
+
+rm -f ${keytabfile}
+rm -f current-db*
+rm -f out-*
+rm -f mkey.file*
+
+> messages.log
+
+echo Creating database
+${kadmin} \
+    init \
+    --realm-max-ticket-life=1day \
+    --realm-max-renewable-life=1month \
+    ${R} || exit 1
+
+${kadmin} add -p foo --use-defaults ${server}@${R} || exit 1
+${kadmin} add -p foo --use-defaults foo@${R} || exit 1
+${kadmin} ext -k ${keytab} foo@${R} || exit 1
+${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
+
+echo "password"
+${kdc_tester} ${srcdir}/kdc-tester1.json > out-log 2>&1 || exit 1
+sed 's/^/	/' out-log
+
+echo "keytab"
+${kdc_tester} ${srcdir}/kdc-tester2.json > out-log 2>&1 || exit 1
+sed 's/^/	/' out-log
+
+echo "FAST + keytab"
+${kdc_tester} ${srcdir}/kdc-tester3.json > out-log 2>&1 || exit 1
+sed 's/^/	/' out-log
+
+
+if test "$pkinit" = yes ; then
+
+    echo "pkinit"
+    ${kdc_tester} ${objdir}/kdc-tester4.json > out-log 2>&1 || exit 1
+    sed 's/^/	/' out-log
+
+fi
+
+exit $ec
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/check-uu.in b/crypto/external/bsd/heimdal/dist/tests/kdc/check-uu.in
index 267095620..c6607fa23 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/check-uu.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/check-uu.in
@@ -61,7 +61,6 @@ kdestroy2="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache2 ${afs_no_unlog}"
 uu_server="${TESTS_ENVIRONMENT} ../../appl/test/uu_server"
 uu_client="${TESTS_ENVIRONMENT} ../../appl/test/uu_client"
 
-
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
 
@@ -86,15 +85,9 @@ ${kadmin} check ${R} || exit 1
 
 echo foo > ${objdir}/foopassword
 
-echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${wait_kdc}
-if [ "$?" != 0 ] ; then
-    kill -9 ${kdcpid}
-    exit 1
-fi
+echo Starting kdc ; > messages.log
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill -9 ${kdcpid} ${uuspid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb
new file mode 100644
index 000000000..00fefb9d4
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb differ
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.kadm5 b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.kadm5
new file mode 100644
index 000000000..41663b9eb
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.kadm5 differ
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.mkey b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.mkey
new file mode 100644
index 000000000..627c0faff
Binary files /dev/null and b/crypto/external/bsd/heimdal/dist/tests/kdc/hdb-mitdb.mkey differ
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/heimdal.acl b/crypto/external/bsd/heimdal/dist/tests/kdc/heimdal.acl
index 351b99f8b..fc7133f09 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/heimdal.acl
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/heimdal.acl
@@ -3,3 +3,7 @@ bar@TEST.H5L.SE all
 baz@TEST.H5L.SE get,add *
 bez@TEST.H5L.SE get,add *@TEST.H5L.SE
 fez@TEST.H5L.SE get,add
+hasalias@TEST.H5L.SE get,mod hasalias@TEST.H5L.SE
+hasalias@TEST.H5L.SE get,add goodalias1@TEST.H5L.SE
+hasalias@TEST.H5L.SE get,add goodalias2@TEST.H5L.SE
+hasalias@TEST.H5L.SE get,add goodalias3@TEST.H5L.SE
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/k5login/foo b/crypto/external/bsd/heimdal/dist/tests/kdc/k5login/foo
new file mode 100644
index 000000000..b51a40b58
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/k5login/foo
@@ -0,0 +1 @@
+random-princ@RANDOM-REALM
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester1.json b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester1.json
new file mode 100644
index 000000000..08a7744c0
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester1.json
@@ -0,0 +1,31 @@
+[
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kinit",
+		"client" : "foo@TEST.H5L.SE",
+		"password" : "foo"
+		}
+	},
+	{
+	"op" : "kinit",
+	"client" : "foo@TEST.H5L.SE",
+	"password" : "foo",
+	"ccache" : "MEMORY:cache"
+	},
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kgetcred",
+		"server" : "host/datan.test.h5l.se@TEST.H5L.SE",
+		"ccache" : "MEMORY:cache"
+		}
+	},
+	{
+	"op" : "kdestroy",
+	"ccache" : "MEMORY:cache"
+	}
+]
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester2.json b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester2.json
new file mode 100644
index 000000000..207ae372f
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester2.json
@@ -0,0 +1,12 @@
+[
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kinit",
+		"client" : "foo@TEST.H5L.SE",
+		"keytab" : "FILE:server.keytab"
+		}
+	}
+]
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester3.json b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester3.json
new file mode 100644
index 000000000..682e4853a
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester3.json
@@ -0,0 +1,23 @@
+[
+	{
+	"op" : "kinit",
+	"client" : "host/datan.test.h5l.se@TEST.H5L.SE",
+	"keytab" : "FILE:server.keytab",
+	"ccache" : "MEMORY:fast-cc"
+	},
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kinit",
+		"client" : "foo@TEST.H5L.SE",
+		"keytab" : "FILE:server.keytab",
+		"fast-armor-cc" : "MEMORY:fast-cc"
+		}
+	},
+	{
+	"op" : "kdestroy",
+	"ccache" : "MEMORY:fast-cc"
+	}
+]
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester4.json.in b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester4.json.in
new file mode 100644
index 000000000..0cbc33731
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/kdc-tester4.json.in
@@ -0,0 +1,22 @@
+[
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kinit",
+		"client" : "foo@TEST.H5L.SE",
+		"pkinit-user-cert-id" : "FILE:@top_srcdir@/lib/hx509/data/pkinit.crt,@top_srcdir@/lib/hx509/data/pkinit.key"
+		}
+	},
+	{
+	"op" : "repeat",
+	"num" : 333,
+	"value" : {
+		"op" : "kinit",
+		"client" : "foo@TEST.H5L.SE",
+		"pkinit-user-cert-id" : "FILE:@top_srcdir@/lib/hx509/data/pkinit.crt,@top_srcdir@/lib/hx509/data/pkinit.key",
+		"pkinit-use-rsa" : true
+		}
+	}
+]
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz.conf.in
new file mode 100644
index 000000000..0d4f38b74
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz.conf.in
@@ -0,0 +1,26 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE TEST3.H5L.SE
+	no-addresses = TRUE
+	kuserok = SYSTEM-K5LOGIN:@srcdir@/k5login
+	kuserok = USER-K5LOGIN
+	kuserok = SIMPLE
+
+[appdefaults]
+
+[realms]
+	TEST.H5L.SE = {
+	    auth_to_local_names = {
+		foo/mapped1 = foo
+		foo/mapped2 = bar
+		mapped1 = foo
+		mapped2 = bar
+	    }
+	    auth_to_local = DB:@srcdir@/an2ln-db.txt DEFAULT
+	}
+
+[hdb]
+	db-dir = @objdir@
+
+[logging]
+	default = 0-/FILE:@objdir@/messages.log
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz2.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz2.conf.in
new file mode 100644
index 000000000..9a8efb0c7
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-authz2.conf.in
@@ -0,0 +1,27 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE TEST3.H5L.SE
+	no-addresses = TRUE
+	k5login_authoritative = TRUE
+	k5login_directory = @srcdir@/k5login
+	kuserok = SYSTEM-K5LOGIN
+	kuserok = SIMPLE
+
+[appdefaults]
+
+[realms]
+	TEST.H5L.SE = {
+	    auth_to_local_names = {
+		foo/mapped1 = foo
+		foo/mapped2 = bar
+		mapped1 = foo
+		mapped2 = bar
+	    }
+	    auth_to_local = DB:@srcdir@/an2ln-db.txt DEFAULT
+	}
+
+[hdb]
+	db-dir = @objdir@
+
+[logging]
+	default = 0-/FILE:@objdir@/messages.log
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon.conf.in
new file mode 100644
index 000000000..0ce45b58c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon.conf.in
@@ -0,0 +1,100 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE
+	no-addresses = TRUE
+	dns_lookup_realm = no
+	name_canon_rules = as-is:realm=TEST.H5L.SE
+	name_canon_rules = as-is:realm=TEST2.H5L.SE
+	name_canon_rules = as-is:realm=TEST3.H5L.SE
+	name_canon_rules = qualify:domain=test1.h5l.se:realm=TEST.H5L.SE
+	name_canon_rules = qualify:domain=test1.h5l.se:realm=TEST2.H5L.SE
+	name_canon_rules = qualify:domain=test2.h5l.se:realm=TEST2.H5L.SE
+	name_canon_rules = qualify:domain=test3.h5l.se:realm=TEST3.H5L.SE
+
+[appdefaults]
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	reconnect-min = 2s
+	reconnect-backoff = 2s
+	reconnect-max = 10s
+
+[realms]
+	TEST.H5L.SE = {
+		kdc = localhost:@port@
+		admin_server = localhost:@admport@
+		kpasswd_server = localhost:@pwport@
+	}
+	TEST2.H5L.SE = {
+		kdc = localhost:@port@
+		kpasswd_server = localhost:@pwport@
+	}
+	TEST3.H5L.SE = {
+		kdc = localhost:@port@
+	}
+
+[domain_realm]
+	.test1.h5l.se = TEST.H5L.SE
+	.test2.h5l.se = TEST2.H5L.SE
+	.test3.h5l.se = TEST3.H5L.SE
+	localhost = TEST.H5L.SE
+	
+
+[kdc]
+	enable-digest = true
+	allow-anonymous = true
+	digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
+        strict-nametypes = true
+
+	enable-http = true
+
+	enable-pkinit = true
+	pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
+#	pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
+	pkinit_mappings_file = @srcdir@/pki-mapping
+	pkinit_allow_proxy_certificate = true
+
+	database = {
+		label = { 
+			dbname = @objdir@/current-db@kdc@
+			realm = TEST.H5L.SE
+			mkey_file = @objdir@/mkey.file
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+		label2 = { 
+			dbname = @objdir@/current-db@kdc@
+			realm = TEST2.H5L.SE
+			mkey_file = @objdir@/mkey.file
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+	}
+
+	signal_socket = @objdir@/signal
+	iprop-stats = @objdir@/iprop-stats
+	iprop-acl = @srcdir@/iprop-acl
+
+[hdb]
+	db-dir = @objdir@
+
+[logging]
+	kdc = 0-/FILE:@objdir@/messages.log
+	default = 0-/FILE:@objdir@/messages.log
+
+[kadmin]
+	save-password = true
+	@dk@
+
+[capaths]
+	TEST.H5L.SE = {
+		TEST3.H5L.SE = .
+		TEST2.H5L.SE = .
+	}
+	TEST2.H5L.SE = {
+		TEST.H5L.SE = .
+		TEST3.H5L.SE = .
+	}
+	TEST3.H5L.SE = {
+		TEST.H5L.SE = .
+		TEST2.H5L.SE = .
+	}
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon2.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon2.conf.in
new file mode 100644
index 000000000..dae71d3e5
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-canon2.conf.in
@@ -0,0 +1,97 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE
+	no-addresses = TRUE
+	dns_lookup_realm = no
+	name_canon_rules = as-is:realm=TEST.H5L.SE
+	name_canon_rules = as-is:realm=TEST2.H5L.SE
+	name_canon_rules = as-is:realm=TEST3.H5L.SE
+	name_canon_rules = nss
+
+[appdefaults]
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	reconnect-min = 2s
+	reconnect-backoff = 2s
+	reconnect-max = 10s
+
+[realms]
+	TEST.H5L.SE = {
+		kdc = localhost:@port@
+		admin_server = localhost:@admport@
+		kpasswd_server = localhost:@pwport@
+	}
+	TEST2.H5L.SE = {
+		kdc = localhost:@port@
+		kpasswd_server = localhost:@pwport@
+	}
+	TEST3.H5L.SE = {
+		kdc = localhost:@port@
+	}
+
+[domain_realm]
+	.test1.h5l.se = TEST.H5L.SE
+	.test2.h5l.se = TEST2.H5L.SE
+	.test3.h5l.se = TEST3.H5L.SE
+	localhost = TEST.H5L.SE
+	
+
+[kdc]
+	enable-digest = true
+	allow-anonymous = true
+	digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
+        strict-nametypes = true
+
+	enable-http = true
+
+	enable-pkinit = true
+	pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
+#	pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
+	pkinit_mappings_file = @srcdir@/pki-mapping
+	pkinit_allow_proxy_certificate = true
+
+	database = {
+		label = { 
+			dbname = @objdir@/current-db@kdc@
+			realm = TEST.H5L.SE
+			mkey_file = @objdir@/mkey.file
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+		label2 = { 
+			dbname = @objdir@/current-db@kdc@
+			realm = TEST2.H5L.SE
+			mkey_file = @objdir@/mkey.file
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+	}
+
+	signal_socket = @objdir@/signal
+	iprop-stats = @objdir@/iprop-stats
+	iprop-acl = @srcdir@/iprop-acl
+
+[hdb]
+	db-dir = @objdir@
+
+[logging]
+	kdc = 0-/FILE:@objdir@/messages.log
+	default = 0-/FILE:@objdir@/messages.log
+
+[kadmin]
+	save-password = true
+	@dk@
+
+[capaths]
+	TEST.H5L.SE = {
+		TEST3.H5L.SE = .
+		TEST2.H5L.SE = .
+	}
+	TEST2.H5L.SE = {
+		TEST.H5L.SE = .
+		TEST3.H5L.SE = .
+	}
+	TEST3.H5L.SE = {
+		TEST.H5L.SE = .
+		TEST2.H5L.SE = .
+	}
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-hdb-mitdb.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-hdb-mitdb.conf.in
new file mode 100644
index 000000000..2be7eed4e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-hdb-mitdb.conf.in
@@ -0,0 +1,60 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE
+	no-addresses = TRUE
+	allow_weak_crypto = TRUE
+
+[appdefaults]
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	reconnect-min = 2s
+	reconnect-backoff = 2s
+	reconnect-max = 10s
+
+[realms]
+	TEST.H5L.SE = {
+		kdc = localhost:@port@
+		admin_server = localhost:@admport@
+		kpasswd_server = localhost:@pwport@
+	}
+
+[domain_realm]
+	.test.h5l.se = TEST.H5L.SE
+	localhost = TEST.H5L.SE
+	
+[kdc]
+	enable-digest = true
+	allow-anonymous = true
+	digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
+        strict-nametypes = true
+
+	enable-http = true
+
+	enable-pkinit = true
+	pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
+#	pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
+	pkinit_mappings_file = @srcdir@/pki-mapping
+	pkinit_allow_proxy_certificate = true
+
+	database = {
+		label = { 
+			dbname = mit-db:@srcdir@/hdb-mitdb
+			realm = TEST.H5L.SE
+			mkey_file = @srcdir@/hdb-mitdb.mkey
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+	}
+
+	signal_socket = @objdir@/signal
+	iprop-stats = @objdir@/iprop-stats
+	iprop-acl = @srcdir@/iprop-acl
+
+[logging]
+	kdc = 0-/FILE:@objdir@/messages.log
+	default = 0-/FILE:@objdir@/messages.log
+
+[kadmin]
+	save-password = true
+	@dk@
+
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-pkinit.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-pkinit.conf.in
index 57299bc4d..9be7ea400 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-pkinit.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5-pkinit.conf.in
@@ -13,6 +13,7 @@
 	}
 
 [kdc]
+        strict-nametypes = true
 	enable-pkinit = true
 	pkinit_identity = FILE:@objdir@/kdc.crt,@srcdir@/../../lib/hx509/data/key2.der
 	pkinit_anchors = FILE:@objdir@/ca.crt
@@ -22,8 +23,12 @@
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/log.current-db.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.in
index db44fdb7a..cc2dedb2d 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.in
@@ -2,6 +2,9 @@
 	default_realm = TEST.H5L.SE TEST2.H5L.SE
 	no-addresses = TRUE
 	allow_weak_crypto = @WEAK@
+	dns_lookup_kdc = no
+	dns_lookup_realm = no
+
 
 [appdefaults]
 	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
@@ -28,21 +31,51 @@
 	TEST4.H5L.SE = {
 		kdc = localhost:@port@
 	}
+	SOME-REALM5.FR = {
+		kdc = localhost:@port@
+	}
+	SOME-REALM6.US = {
+		kdc = localhost:@port@
+	}
+	SOME-REALM7.UK = {
+		kdc = localhost:@port@
+	}
 	TEST-HTTP.H5L.SE = {
 		kdc = http/localhost:@port@
 	}
+	H1.TEST.H5L.SE = {
+		kdc = localhost:@port@
+	}
+	H2.TEST.H5L.SE = {
+		kdc = localhost:@port@
+	}
+	H3.H2.TEST.H5L.SE = {
+		kdc = localhost:@port@
+	}
+	H4.H2.TEST.H5L.SE = {
+		kdc = localhost:@port@
+	}
 
 [domain_realm]
 	.test.h5l.se = TEST.H5L.SE
 	.sub.test.h5l.se = SUB.TEST.H5L.SE
+	.h1.test.h5l.se = H1.TEST.H5L.SE
+	.h2.test.h5l.se = H2.TEST.H5L.SE
+	.h3.h2.test.h5l.se = H3.H2.TEST.H5L.SE
+	.h4.h2.test.h5l.se = H4.H2.TEST.H5L.SE
 	.example.com = TEST2.H5L.SE
 	localhost = TEST.H5L.SE
+	.localdomain = TEST.H5L.SE
+	localdomain = TEST.H5L.SE
+	.localdomain6 = TEST.H5L.SE
+	localdomain6 = TEST.H5L.SE
 	
 
 [kdc]
 	enable-digest = true
 	allow-anonymous = true
 	digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
+        strict-nametypes = true
 
 	enable-http = true
 
@@ -56,38 +89,72 @@
 
 	database = {
 		label = { 
-			dbname = @objdir@/current-db@kdc@
+			dbname = @db_type@:@objdir@/current-db@kdc@
 			realm = TEST.H5L.SE
 			mkey_file = @objdir@/mkey.file
 			acl_file = @srcdir@/heimdal.acl
 			log_file = @objdir@/current@kdc@.log
 		}
 		label2 = { 
-			dbname = @objdir@/current-db@kdc@
+			dbname = @db_type@:@objdir@/current-db@kdc@
 			realm = TEST2.H5L.SE
 			mkey_file = @objdir@/mkey.file
 			acl_file = @srcdir@/heimdal.acl
 			log_file = @objdir@/current@kdc@.log
 		}
+		label3 = { 
+			dbname = sqlite:@objdir@/current-db@kdc@.sqlite3
+			realm = SOME-REALM5.FR
+			mkey_file = @objdir@/mkey.file
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
 	}
 
 	signal_socket = @objdir@/signal
 	iprop-stats = @objdir@/iprop-stats
 	iprop-acl = @srcdir@/iprop-acl
+        log-max-size = 40000
+
+[hdb]
+	db-dir = @objdir@
 
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
+	krb5 = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
 
+# If you are doing preformance measurements on OSX you want to change
+# the kdc LOG line from = to - below to keep the FILE open and avoid
+# open/write/close which is blocking (rdar:// ) on OSX.
+#	kdc = 0-/FILE=@objdir@/messages.log
+
 [kadmin]
 	save-password = true
+	default_key_rules = {
+		*/des3-only@* = des3-cbc-sha1:pw-salt
+		*/aes-only@* = aes256-cts-hmac-sha1-96:pw-salt
+	}
 	@dk@
 
 [capaths]
 	TEST.H5L.SE = {
+		TEST2.H5L.SE = .
+		SOME-REALM5.FR = 1
 		TEST3.H5L.SE = TEST2.H5L.SE
-	}
-	TEST.H5L.SE = {
 		TEST4.H5L.SE = TEST2.H5L.SE
 		TEST4.H5L.SE = TEST3.H5L.SE
+		SOME-REALM6.US = SOME-REALM5.FR
+		SOME-REALM7.UK = SOME-REALM6.US
+		SOME-REALM7.UK = SOME-REALM5.FR
 	}
+        H4.H2.TEST.H5L.SE = {
+                H1.TEST.H5L.SE = H3.H2.TEST.H5L.SE
+                H1.TEST.H5L.SE = H2.TEST.H5L.SE
+                H1.TEST.H5L.SE = TEST.H5L.SE
+
+                TEST.H5L.SE = H3.H2.TEST.H5L.SE
+                TEST.H5L.SE = H2.TEST.H5L.SE
+
+                H2.TEST.H5L.SE = H3.H2.TEST.H5L.SE
+        }
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.keys.in b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.keys.in
index 059ffcb50..16891decb 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.keys.in
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/krb5.conf.keys.in
@@ -2,13 +2,18 @@
 	allow_weak_crypto = TRUE
 
 [kdc]
+        strict-nametypes = true
 	database = {
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
 		acl_file = @srcdir@/heimdal.acl
+                log_file = @objdir@/log.current-db.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 
 [kadmin]
 	default_keys = @keys@
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/leaks-kill.sh b/crypto/external/bsd/heimdal/dist/tests/kdc/leaks-kill.sh
index e67d274f5..1474bdd18 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/leaks-kill.sh
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/leaks-kill.sh
@@ -3,30 +3,25 @@
 name=$1
 pid=$2
 
-ec=0
-
-if [ "$(uname -s)" = "Darwin" ] ; then
-    echo "leaks check on $name ($pid)"
-    leaks -exclude __CFInitialize $pid > leaks-log 2>&1 || \
-        { echo "leaks failed: $?"; cat leaks-log; exit 1; }
-
-    env pid=${pid} \
-    perl -e 'my $excluded = 0; my $num = -1; while (<>) {
-if (/Process $ENV{pid}: (\d+) leaks for \d+ total leaked bytes/) { $num = $1;}
-if (/(\d+) leaks excluded/) { $excluded = $1;}
-}
-exit 1 if ($num != 0 && $num != $excluded);
-exit 0;' leaks-log || \
-	{ echo "Memory leak in $name" ; echo ""; cat leaks-log; ec=1; }
-
-    # [ "$ec" != "0" ] && { env PS1=": leaks-debugger !!!! ; " bash ; }
-
-fi
-
 kill $pid
-sleep 3
-kill -9 $pid 2> /dev/null
+set -- .
+while kill -0 $pid 2>/dev/null
+do
+    set -- "$@" "."
+    if [ $# -gt 4 ]
+    then
+        kill kill -9 $pid 2> /dev/null
+        break
+    fi
+    sleep 1
+done
 
-rm -f leaks-log
+set -- .
+while kill -0 $pid 2>/dev/null
+do
+    set -- "$@" "."
+    if [ $# -gt 4 ]; then exit 1; fi
+    sleep 1
+done
 
-exit $ec
+exit 0
diff --git a/crypto/external/bsd/heimdal/dist/tests/kdc/wait-kdc.sh b/crypto/external/bsd/heimdal/dist/tests/kdc/wait-kdc.sh
index dc8262519..be30c0f4e 100644
--- a/crypto/external/bsd/heimdal/dist/tests/kdc/wait-kdc.sh
+++ b/crypto/external/bsd/heimdal/dist/tests/kdc/wait-kdc.sh
@@ -36,22 +36,19 @@ log=${2:-messages.log}
 waitfor="${3:-${name} started}"
 
 t=0
-waitsec=35
+waitsec=65
 
 echo "Waiting for ${name} to start, looking logfile ${log}"
 
 while true ; do
-    t=`expr ${t} + 2`
-    sleep 2
-    echo "Have waited $t seconds"
-    if tail -30 ${log} | grep "${waitfor}" > /dev/null; then
+    if grep "${waitfor}" ${log} > /dev/null; then
 	break
     fi
-    if tail -30 ${log} | grep "No sockets" ; then
+    if grep "No sockets" ${log} ; then
        echo "The ${name} failed to bind to any sockets, another ${name} running ?"
        exit 1
     fi
-    if tail -30 ${log} | grep "bind" | grep "Operation not permitted" ; then
+    if grep "bind" ${log} | grep "Operation not permitted" ; then
        echo "The ${name} failed to bind to any sockets, another ${name} running ?"
        exit 1
     fi
@@ -59,6 +56,10 @@ while true ; do
        echo "Waited for $waitsec for the ${name} to start, and it didnt happen"
        exit 2
     fi
+
+    t=`expr ${t} + 2`
+    sleep 2
+    echo "Have waited $t seconds"
 done
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/crypto/external/bsd/heimdal/dist/tests/ldap/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/ldap/Makefile.am
index 7b5f77390..fd21b91ca 100644
--- a/crypto/external/bsd/heimdal/dist/tests/ldap/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/ldap/Makefile.am
@@ -10,7 +10,9 @@ TESTS = check-ldap
 
 port = 49188
 
-do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
+do_subst = sed \
+	-e 's,[@]env_setup[@],$(top_builddir)/tests/bin/setup-env,g' \
+	-e 's,[@]srcdir[@],$(srcdir),g' \
 	-e 's,[@]port[@],$(port),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/ldap,g' \
 	-e 's,[@]EGREP[@],$(EGREP),g' 
diff --git a/crypto/external/bsd/heimdal/dist/tests/ldap/check-ldap.in b/crypto/external/bsd/heimdal/dist/tests/ldap/check-ldap.in
index d14fa27fe..c907a9cb3 100644
--- a/crypto/external/bsd/heimdal/dist/tests/ldap/check-ldap.in
+++ b/crypto/external/bsd/heimdal/dist/tests/ldap/check-ldap.in
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+# Copyright (c) 2006 - 2016 Kungliga Tekniska Högskolan
 # (Royal Institute of Technology, Stockholm, Sweden). 
 # All rights reserved. 
 #
@@ -34,8 +34,12 @@
 # Id
 #
 
+env_setup="@env_setup@"
 srcdir="@srcdir@"
 objdir="@objdir@"
+
+. ${env_setup}
+
 EGREP="@EGREP@"
 
 R=TEST.H5L.SE
@@ -52,6 +56,9 @@ kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port"
 
 testfailed="echo test failed; exit 1"
 
+KRB5_CONFIG="${objdir}/krb5.conf"
+export KRB5_CONFIG
+
 # If there is no ldap support compile in, disable test
 if ${kdc} --builtin-hdb | grep ldap > /dev/null ; then
    :
@@ -84,9 +91,6 @@ sh ${objdir}/slapd-init || exit 1
 
 trap "sh ${srcdir}/slapd-stop ; exit 1;" EXIT
 
-KRB5_CONFIG="${objdir}/krb5.conf"
-export KRB5_CONFIG
-
 rm -f current-db*
 
 > messages.log
@@ -114,15 +118,8 @@ ${kadmin} list '*' > /dev/null || exit 1
 echo foo > ${objdir}/foopassword
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    sh ${srcdir}/slapd-stop
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; sh ${srcdir}/slapd-stop ; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/ldap/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/ldap/krb5.conf.in
index ca6b86e5c..a6812170d 100644
--- a/crypto/external/bsd/heimdal/dist/tests/ldap/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/ldap/krb5.conf.in
@@ -3,6 +3,7 @@
 [libdefaults]
 	default_realm = TEST.H5L.SE
 	no-addresses = TRUE
+        plugin_dir = @objdir@/../../lib/hdb @objdir@/../../lib/hdb/.libs
 
 [realms]
 	TEST.H5L.SE = {
@@ -11,11 +12,15 @@
 
 [kdc]
 	database = {
-		dbname = ldapi://ldap-socket:OU=KerberosPrincipals,o=test,DC=h5l,DC=se
+		dbname = ldapi://.%2Fldap-socket:OU=KerberosPrincipals,o=test,DC=h5l,DC=se
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/log.current-db.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/ldap/slapd-init.in b/crypto/external/bsd/heimdal/dist/tests/ldap/slapd-init.in
index 5debddb74..e6d3f93f7 100644
--- a/crypto/external/bsd/heimdal/dist/tests/ldap/slapd-init.in
+++ b/crypto/external/bsd/heimdal/dist/tests/ldap/slapd-init.in
@@ -7,7 +7,7 @@ rm -rf db schema
 mkdir db
 
 # kill of old slapd if running
-sh ${srcdir}/slapd-stop > /dev/null
+sh "${srcdir}/slapd-stop" > /dev/null
 
 SCHEMA_NEEDED="hdb core nis cosine inetorgperson openldap samba"
 
@@ -31,9 +31,18 @@ done
 
 touch modules.conf || exit 1
 
-slapadd -d 0 -f ${srcdir}/slapd.conf < ${srcdir}/init.ldif || exit 0
+if ! slapadd -d 0 -f "${srcdir}/slapd.conf" < "${srcdir}/init.ldif"; then
+    echo "moduleload back_bdb.la"   >> modules.conf
+    if ! slapadd -d 0 -f "${srcdir}/slapd.conf" < "${srcdir}/init.ldif"; then
+        echo "modulepath /usr/lib/ldap"  > modules.conf
+        echo "moduleload back_bdb.la"   >> modules.conf
+        slapadd -d 0 -f "${srcdir}/slapd.conf" < "${srcdir}/init.ldif" || exit 1
+    fi
+fi
+
+cp "`which slapd`" . || true # fails if running
 
 echo "starting slapd"
-slapd -d0 -f ${srcdir}/slapd.conf -h ldapi://.%2Fldap-socket &
+./slapd -d0 -f "${srcdir}/slapd.conf" -h ldapi://.%2Fldap-socket &
 
 sleep 4
diff --git a/crypto/external/bsd/heimdal/dist/tests/ldap/slapd.conf b/crypto/external/bsd/heimdal/dist/tests/ldap/slapd.conf
index 077727e21..df76e82eb 100644
--- a/crypto/external/bsd/heimdal/dist/tests/ldap/slapd.conf
+++ b/crypto/external/bsd/heimdal/dist/tests/ldap/slapd.conf
@@ -20,8 +20,7 @@ include modules.conf
 
 defaultsearchbase "ou=TEST,dc=H5L,dc=SE"
 
-backend		bdb
-database        bdb
+database	bdb
 suffix		"o=TEST,dc=H5L,dc=SE"
 directory	db
 index           objectClass eq
diff --git a/crypto/external/bsd/heimdal/dist/tests/plugin/Makefile.am b/crypto/external/bsd/heimdal/dist/tests/plugin/Makefile.am
index 440d4766a..1850461b7 100644
--- a/crypto/external/bsd/heimdal/dist/tests/plugin/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tests/plugin/Makefile.am
@@ -10,6 +10,7 @@ TESTS = $(SCRIPT_TESTS)
 port = 49188
 
 do_subst = sed -e 's,[@]srcdir[@],$(srcdir),g' \
+	-e 's,[@]env_setup[@],$(top_builddir)/tests/bin/setup-env,g' \
 	-e 's,[@]port[@],$(port),g' \
 	-e 's,[@]objdir[@],$(top_builddir)/tests/plugin,g' \
 	-e 's,[@]EGREP[@],$(EGREP),g' 
diff --git a/crypto/external/bsd/heimdal/dist/tests/plugin/check-pac.in b/crypto/external/bsd/heimdal/dist/tests/plugin/check-pac.in
index 4420861bb..701255d8d 100644
--- a/crypto/external/bsd/heimdal/dist/tests/plugin/check-pac.in
+++ b/crypto/external/bsd/heimdal/dist/tests/plugin/check-pac.in
@@ -35,9 +35,12 @@
 #
 
 srcdir="@srcdir@"
+env_setup="@env_setup@"
 objdir="@objdir@"
 EGREP="@EGREP@"
 
+. ${env_setup}
+
 testfailed="echo test failed; cat messages.log; exit 1"
 
 # If there is no useful db support compile in, disable test
@@ -92,14 +95,8 @@ echo "Empty log"
 > messages.log
 
 echo Starting kdc
-${kdc} &
-kdcpid=$!
-
-sh ${srcdir}/../kdc/wait-kdc.sh
-if [ "$?" != 0 ] ; then
-    kill ${kdcpid}
-    exit 1
-fi
+${kdc} --detach --testing || { echo "kdc failed to start"; exit 1; }
+kdcpid=`getpid kdc`
 
 trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
diff --git a/crypto/external/bsd/heimdal/dist/tests/plugin/krb5.conf.in b/crypto/external/bsd/heimdal/dist/tests/plugin/krb5.conf.in
index 735b47686..9453b2236 100644
--- a/crypto/external/bsd/heimdal/dist/tests/plugin/krb5.conf.in
+++ b/crypto/external/bsd/heimdal/dist/tests/plugin/krb5.conf.in
@@ -19,8 +19,12 @@
 		dbname = @objdir@/current-db
 		realm = TEST.H5L.SE
 		mkey_file = @objdir@/mkey.file
+                log_file = @objdir@/log.current-db.log
 	}
 
+[hdb]
+	db-dir = @objdir@
+
 [logging]
 	kdc = 0-/FILE:@objdir@/messages.log
 	default = 0-/FILE:@objdir@/messages.log
diff --git a/crypto/external/bsd/heimdal/dist/tests/plugin/windc.c b/crypto/external/bsd/heimdal/dist/tests/plugin/windc.c
index 610eece8c..1bab029be 100644
--- a/crypto/external/bsd/heimdal/dist/tests/plugin/windc.c
+++ b/crypto/external/bsd/heimdal/dist/tests/plugin/windc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: windc.c,v 1.1.1.2 2014/04/24 12:45:57 pettai Exp $	*/
+/*	$NetBSD: windc.c,v 1.2 2017/01/28 21:31:51 christos Exp $	*/
 
 #include <krb5/krb5.h>
 #include <krb5/hdb.h>
@@ -71,7 +71,7 @@ client_access(void *ctx,
 	      hdb_entry_ex *client, const char *client_name,
 	      hdb_entry_ex *server, const char *server_name,
 	      KDC_REQ *req,
-	      krb5_data *e_data)
+	      METHOD_DATA *data)
 {
     krb5_warnx(context, "client_access");
     return 0;
diff --git a/crypto/external/bsd/heimdal/dist/tools/Makefile.am b/crypto/external/bsd/heimdal/dist/tools/Makefile.am
index 51aa7f610..84d039fe4 100644
--- a/crypto/external/bsd/heimdal/dist/tools/Makefile.am
+++ b/crypto/external/bsd/heimdal/dist/tools/Makefile.am
@@ -6,7 +6,16 @@ bin_SCRIPTS = krb5-config
 
 pkgconfigdir = $(libdir)/pkgconfig
 
-pkgconfig_DATA = heimdal-gssapi.pc
+pkgconfig_DATA = \
+	heimdal-gssapi.pc \
+	heimdal-krb5.pc \
+	heimdal-kadm-client.pc \
+	heimdal-kadm-server.pc \
+	kafs.pc \
+	kadm-client.pc \
+	kadm-server.pc \
+	krb5.pc \
+	krb5-gssapi.pc
 
 man_MANS = krb5-config.1
 
@@ -16,6 +25,7 @@ endif
 
 subst = sed	-e "s!@PACKAGE\@!$(PACKAGE)!g" \
 		-e "s!@VERSION\@!$(VERSION)!g" \
+		-e "s!@CANONICAL_HOST\@!$(CANONICAL_HOST)!g" \
 		-e "s!@prefix\@!$(prefix)!g" \
 		-e "s!@exec_prefix\@!$(exec_prefix)!g" \
 		-e "s!@libdir\@!$(libdir)!g" \
@@ -23,7 +33,6 @@ subst = sed	-e "s!@PACKAGE\@!$(PACKAGE)!g" \
 		-e "s!@PTHREAD_LIBADD\@!$(PTHREAD_LIBADD)!g" \
 		-e "s!@LIB_crypt\@!$(LIB_crypt)!g" \
 		-e "s!@LIB_dbopen\@!$(LIB_dbopen)!g" \
-		-e "s!@INCLUDE_hcrypto\@!$(INCLUDE_hcrypto)!g" \
 		-e "s!@LIB_hcrypto_appl\@!$(LIB_hcrypto_appl)!g" \
 		-e "s!@LIB_dlopen\@!$(LIB_dlopen)!g" \
 		-e "s!@LIB_door_create\@!$(LIB_door_create)!g" \
@@ -35,20 +44,22 @@ krb5-config: krb5-config.in
 	mv $@.new $@
 	chmod +x $@
 
-heimdal-gssapi.pc: heimdal-gssapi.pc.in
-	$(subst) $(srcdir)/heimdal-gssapi.pc.in > $@.new
+.pc.in.pc:
+	$(subst) $< > $@.new
 	mv $@.new $@
 
 EXTRA_DIST = \
 	NTMakefile \
+	cov.sh \
 	$(man_MANS) \
 	krb5-config.in \
 	heimdal-gssapi.pc.in \
-	kdc-log-analyze.pl
+	kdc-log-analyze.pl \
+	$(pkgconfig_DATA:.pc=.pc.in)
 
 CLEANFILES = \
 	krb5-config \
 	krb5-config.new \
-	heimdal-gssapi.pc \
-	heimdal-gssapi.pc.new
+	$(pkgconfig_DATA) \
+	$(pkgconfig_DATA:.pc=.pc.new)
 
diff --git a/crypto/external/bsd/heimdal/dist/tools/heimdal-gssapi.pc.in b/crypto/external/bsd/heimdal/dist/tools/heimdal-gssapi.pc.in
index 90f42a644..05e00e541 100644
--- a/crypto/external/bsd/heimdal/dist/tools/heimdal-gssapi.pc.in
+++ b/crypto/external/bsd/heimdal/dist/tools/heimdal-gssapi.pc.in
@@ -1,14 +1,14 @@
 # Id
 prefix=@prefix@
 exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=${prefix}/include
+libdir=@libdir@
+includedir=@includedir@
 
 Name: @PACKAGE@
 Description: Heimdal is an implementation of Kerberos 5, freely available under a three clause BSD style license.
 Version: @VERSION@
 URL: http://www.pdc.kth.se/heimdal/
-#Requires: foo = 1.3.1
-#Conflicts: bar <= 4.5
-Libs: -L${libdir} -lgssapi -lheimntlm -lkrb5 @LIB_pkinit@ -lcom_err @LIB_hcrypto_appl@ -lasn1 -lwind -lroken @LIB_crypt@ @LIB_dlopen@ @LIB_door_create@ @LIBS@
+Requires.private: heimdal-krb5
+Libs: -L${libdir} -lgssapi
+Libs.private: -lheimntlm @LIB_crypt@
 Cflags: -I${includedir}
diff --git a/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-client.pc.in b/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-client.pc.in
new file mode 100644
index 000000000..2eb9e3e4e
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-client.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: heimdal-kadm-client
+Description: Kadmin client library.
+Version: @VERSION@
+Requires.private: heimdal-gssapi
+Libs: -L${libdir} -lkadm5clnt
+Cflags: -I${includedir}
diff --git a/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-server.pc.in b/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-server.pc.in
new file mode 100644
index 000000000..00a78cc3a
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/heimdal-kadm-server.pc.in
@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: heimdal-kadm-server
+Description: Kadmin server library.
+Version: @VERSION@
+Requires.private: heimdal-gssapi
+Libs: -L${libdir} -lkadm5srv
+Libs.private: @LIB_dbopen@
+Cflags: -I${includedir}
diff --git a/crypto/external/bsd/heimdal/dist/tools/heimdal-krb5.pc.in b/crypto/external/bsd/heimdal/dist/tools/heimdal-krb5.pc.in
new file mode 100644
index 000000000..a1f139979
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/heimdal-krb5.pc.in
@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+vendor=Heimdal
+
+Name: heimdal-krb5
+Description: Heimdal implementation of the Kerberos network authentication.
+Version: @VERSION@
+Libs: -L${libdir} -lkrb5
+Libs.private: @LIB_pkinit@ -lcom_err @LIB_hcrypto_appl@ -lasn1 -lwind -lheimbase -lroken @LIB_crypt@ @PTHREAD_LIBADD@ @LIB_dlopen@ @LIB_door_create@ @LIBS@
+Cflags: -I${includedir}
diff --git a/crypto/external/bsd/heimdal/dist/tools/kadm-client.pc.in b/crypto/external/bsd/heimdal/dist/tools/kadm-client.pc.in
new file mode 100644
index 000000000..f8438856c
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/kadm-client.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+vendor=Heimdal
+
+Name: kadm-client
+Description: Kadmin client library.
+Version: @VERSION@
+Requires: heimdal-kadm-client
diff --git a/crypto/external/bsd/heimdal/dist/tools/kadm-server.pc.in b/crypto/external/bsd/heimdal/dist/tools/kadm-server.pc.in
new file mode 100644
index 000000000..9f1e62ec0
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/kadm-server.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+vendor=Heimdal
+
+Name: kadm-server
+Description: Kadmin server library.
+Version: @VERSION@
+Requires: heimdal-kadm-server
diff --git a/crypto/external/bsd/heimdal/dist/tools/kafs.pc.in b/crypto/external/bsd/heimdal/dist/tools/kafs.pc.in
new file mode 100644
index 000000000..bd31f263b
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/kafs.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: kafs
+Description: Libraries for application that uses kafs.
+Version: @VERSION@
+Requires.private: heimdal-krb5
+Libs: -lkafs
diff --git a/crypto/external/bsd/heimdal/dist/tools/krb5-config.1 b/crypto/external/bsd/heimdal/dist/tools/krb5-config.1
index 13bc0fd4f..6fc3e7ec0 100644
--- a/crypto/external/bsd/heimdal/dist/tools/krb5-config.1
+++ b/crypto/external/bsd/heimdal/dist/tools/krb5-config.1
@@ -1,4 +1,4 @@
-.\"	$NetBSD: krb5-config.1,v 1.1.1.2 2014/04/24 12:45:57 pettai Exp $
+.\"	$NetBSD: krb5-config.1,v 1.2 2017/01/28 21:31:51 christos Exp $
 .\"
 .\" Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
@@ -62,7 +62,9 @@ Print the exec-prefix if no
 is specified, otherwise set exec-prefix to
 .Ar dir .
 .It Fl Fl libs
-Output the set of libraries that should be linked against.
+Output the set of libraries that should be linked against.  This also
+includes rpath flags with the expectation that the C compiler is used
+for final link-edits.
 .It Fl Fl cflags
 Output the set of flags to give to the C compiler when using the
 Heimdal libraries.
diff --git a/crypto/external/bsd/heimdal/dist/tools/krb5-config.in b/crypto/external/bsd/heimdal/dist/tools/krb5-config.in
index 317270e42..77652d3bc 100644
--- a/crypto/external/bsd/heimdal/dist/tools/krb5-config.in
+++ b/crypto/external/bsd/heimdal/dist/tools/krb5-config.in
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2000 - 2008 Kungliga Tekniska Högskolan
+# Copyright (c) 2000 - 2008 Kungliga Tekniska Högskolan
 # (Royal Institute of Technology, Stockholm, Sweden). 
 # All rights reserved. 
 #
@@ -32,12 +32,19 @@
 # SUCH DAMAGE. 
 #
 
+do_all=no
 do_libs=no
+do_lib_deps=no
 do_cflags=no
 do_usage=no
 print_prefix=no
 print_exec_prefix=no
-library=krb5
+library=
+lib_krb5=no
+lib_gssapi=no
+lib_kadm_client=no
+lib_kadm_server=no
+lib_kafs=no
 
 if test $# -eq 0; then
   do_usage=yes
@@ -50,6 +57,13 @@ for i in $*; do
     do_usage=yes
     usage_exit=0
     ;;
+  --all)
+    do_all=yes
+    ;;
+  --vendor)
+    echo "Heimdal"
+    exit 0;
+    ;;
   --version)
     echo "@PACKAGE@ @VERSION@"
     exit 0
@@ -69,23 +83,31 @@ for i in $*; do
   --libs)
     do_libs=yes
     ;;
+  --deps)
+    do_lib_deps=yes
+    ;;
   --cflags)
     do_cflags=yes
     ;;
   krb5)
     library=krb5
+    lib_krb5=yes
     ;;
   gssapi)
     library=gssapi
+    lib_gssapi=yes
     ;;
   kadm-client)
     library=kadm-client
+    lib_kadm_client=yes
     ;;
   kadm-server)
     library=kadm-server
+    lib_kadm_server=yes
     ;;
   kafs)
     library=kafs
+    lib_kafs=yes
     ;;
   *)
     echo "unknown option: $i"
@@ -96,11 +118,28 @@ done
 
 if test "$do_usage" = "yes"; then
     echo "usage: $0 [options] [libraries]"
-    echo "options: [--prefix[=dir]] [--exec-prefix[=dir]] [--libs] [--cflags]"
-    echo "libraries: krb5 gssapi kadm-client kadm-server kafs"
+    echo "options:   [--help]         show this message"
+    echo "           [--all]          display version, vendor, etc."
+    echo "           [--version]      display version information"
+    echo "           [--prefix]       display the prefix of Kerberos"
+    echo "           [--exec-prefix]  display the exec_prefix of Kerberos"
+    echo "           [--cflags]       display the CFLAGS required"
+    echo "           [--libs]         display the libraries required to link"
+    echo "           [--deps]         display the dependent libs required"
+    echo "                            for static linking"
+    echo
+    echo "libraries: krb5             Kerberos 5 applications"
+    echo "           gssapi           GSSAPI applications"
+    echo "           kadm-client      libkadm5 client"
+    echo "           kadm-server      libkadm5 server"
+    echo "           kafs             kafs"
     exit $usage_exit
 fi
 
+if test X"$library" = X; then
+    lib_krb5=yes
+fi
+
 if test "$prefix" = ""; then
   prefix=@prefix@
 fi
@@ -111,38 +150,107 @@ fi
 libdir=@libdir@
 includedir=@includedir@
 
+if test "$do_all" = "yes"; then
+    echo "Version:     @PACKAGE@ @VERSION@"
+    echo "Vendor:      Heimdal"
+    echo "Prefix:      $prefix"
+    echo "Exec_prefix: $exec_prefix"
+    exit 0
+fi
+
 if test "$print_prefix" = "yes"; then
     echo $prefix
+    exit 0
 fi
 
 if test "$print_exec_prefix" = "yes"; then
     echo $exec_prefix
+    exit 0
 fi
 
+# The following rpath_flag setting code is distilled from MIT Kerberos'
+# src/config/shlib.conf.  Some of this seems ancient and likely to be
+# wrong in some cases, but right for all the cases we probably care
+# about.  Also, this will very likely be wrong depending on how the
+# caller will be doing link-edits (with what compiler-driver or
+# link-editor)!  There's no fixing this.
+#
+# In principle this doesn't belong here: application should instead use
+# krb5-config --libdir to get the directory to use for the rpath, then
+# workout the rpath flags on their own.  Of course, there's no --libdir
+# option...  And MIT's krb5-config does include rpath flags.
+#
+# Compatibility with MIT is the winning consideration for now.
+case "@CANONICAL_HOST@" in
+alpha*-dec-osf*)
+  rpath_flag='-Wl,-rpath -Wl,';;
+*-*-hpux*)
+  rpath_flag='-Wl,+b,';;
+*-*-irix* | mips-*-netbsd*)
+  rpath_flag='-Wl,-rpath -Wl,';;
+*-*-netbsd* | *-*-openbsd* | *-*-solaris*)
+  rpath_flag='-R';;
+*-*-linux* | *-*-gnu* | *-*-k*bsd*-gnu | *-*-freebsd*)
+  rpath_flag='-Wl,--enable-new-dtags -Wl,-rpath -Wl,';;
+*-*-aix*)
+  rpath_flag='-Wl,-blibpath:';;
+*)
+rpath_flag=;;
+esac
+
 if test "$do_libs" = "yes"; then
-    lib_flags="-L${libdir}"
-    case $library in
-    gssapi)
-	lib_flags="$lib_flags -lgssapi -lheimntlm"
-	;;
-    kadm-client)
+    deplibs=""
+    if test "$lib_gssapi" = yes; then
+	lib_flags="$lib_flags -lgssapi"
+	deplibs="$deplibs -lheimntlm"
+	if test X"$do_lib_deps" = Xyes; then
+	    lib_krb5=yes
+	fi
+    fi
+    if test "$lib_kadm_client" = yes; then
 	lib_flags="$lib_flags -lkadm5clnt"
-	;;
-    kadm-server)
-	lib_flags="$lib_flags -lkadm5srv @LIB_dbopen@"
-	;;
-    kafs)
+	if test X"$do_lib_deps" = Xyes; then
+	    lib_krb5=yes
+	fi
+    fi
+    if test "$lib_kadm_server" = yes; then
+	lib_flags="$lib_flags -lkadm5srv"
+	deplibs="$deplibs @LIB_dbopen@"
+	if test X"$do_lib_deps" = Xyes; then
+	    lib_krb5=yes
+	fi
+    fi
+    if test "$lib_kafs" = yes; then
 	lib_flags="$lib_flags -lkafs"
-	;;
-    esac
-    lib_flags="$lib_flags -lkrb5 @LIB_pkinit@ -lcom_err"
-    lib_flags="$lib_flags @LIB_hcrypto_appl@ -lasn1 -lwind -lheimbase -lroken"
-    lib_flags="$lib_flags @LIB_crypt@ @PTHREAD_LIBADD@ @LIB_dlopen@"
-    lib_flags="$lib_flags @LIB_door_create@ @LIBS@"
-    echo $lib_flags
+	if test X"$do_lib_deps" = Xyes; then
+	    lib_krb5=yes
+	fi
+    fi
+    if test "$lib_krb5" = yes; then
+	lib_flags="$lib_flags -lkrb5"
+    fi
+    deplibs="$deplibs @LIB_pkinit@ -lcom_err"
+    deplibs="$deplibs @LIB_hcrypto_appl@ -lasn1 -lwind -lheimbase -lroken"
+    deplibs="$deplibs @LIB_crypt@ @PTHREAD_LIBADD@ @LIB_dlopen@"
+    deplibs="$deplibs @LIB_door_create@ @LIBS@"
+    if test X"$do_lib_deps" = X"yes"; then
+	lib_flags="$lib_flags $deplibs"
+    fi
+    if test X"$libdir" != X/usr/lib; then
+	lib_flags="-L${libdir} $lib_flags"
+	if test X"$rpath_flag" != X; then
+	    lib_flags="${rpath_flag}${libdir} $lib_flags"
+	fi
+    fi
+
+    echo ${lib_flags}
 fi
 if test "$do_cflags" = "yes"; then
-    echo "-I${includedir} @INCLUDE_hcrypto@"
+    cflags=""
+    if test X"${includedir}" != X/usr/include; then
+	cflags="-I${includedir} $cflags"
+    fi
+    echo $cflags
 fi
 
 exit 0
diff --git a/crypto/external/bsd/heimdal/dist/tools/krb5-gssapi.pc.in b/crypto/external/bsd/heimdal/dist/tools/krb5-gssapi.pc.in
new file mode 100644
index 000000000..482b78f03
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/krb5-gssapi.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+vendor=Heimdal
+
+Name: krb5-gssapi
+Description: Kerberos implementation of the GSS API.
+Version: @VERSION@
+Requires: heimdal-gssapi
diff --git a/crypto/external/bsd/heimdal/dist/tools/krb5.pc.in b/crypto/external/bsd/heimdal/dist/tools/krb5.pc.in
new file mode 100644
index 000000000..5ed2007c5
--- /dev/null
+++ b/crypto/external/bsd/heimdal/dist/tools/krb5.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+vendor=Heimdal
+
+Name: krb5
+Description: Heimdal implementation of the kerberos network authentication.
+Version: @VERSION@
+Requires: heimdal-krb5
diff --git a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.config b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.config
index 6e7399c9d..7fe373a94 100644
--- a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.config
+++ b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.config
@@ -1,4 +1,12 @@
-!if exist (..\..\..\windows\NTMakefile.version)
+!if exist (..\..\..\thirdparty\NTMakefile.version)
+!  include <..\..\..\thirdparty\NTMakefile.version>
+!elseif exist (..\..\thirdparty\NTMakefile.version)
+!  include <..\..\thirdparty\NTMakefile.version>
+!elseif exist (..\thirdparty\NTMakefile.version)
+!  include <..\thirdparty\NTMakefile.version>
+!elseif exist (thirdparty\NTMakefile.version)
+!  include <thirdparty\NTMakefile.version>
+!elseif exist (..\..\..\windows\NTMakefile.version)
 !  include <..\..\..\windows\NTMakefile.version>
 !elseif exist (..\..\windows\NTMakefile.version)
 !  include <..\..\windows\NTMakefile.version>
@@ -8,6 +16,14 @@
 !  include <windows\NTMakefile.version>
 !endif
 
+!if [ $(PERL) $(SRC)\cf\w32-detect-vc-version.pl $(CC) ]==16
+HAVE_STDINT_H=1
+HAVE_INT64_T=1
+!endif
+
+
+
+
 # ------------------------------------------------------------
 # Features
 #
@@ -17,8 +33,8 @@
 # Enable Kerberos v5 support in applications
 KRB5=1
 
-# Enable Kerberos v4
-# KRB4=1
+# Enable KX509 support in the KDC
+KX509=1
 
 # Enable PKINIT
 PKINIT=1
@@ -26,6 +42,10 @@ PKINIT=1
 # Disable AFS support
 NO_AFS=1
 
+# OpenSSL (mostly not needed on Windows, but should work)
+# INCLUDE_openssl_crypto=
+# LIB_openssl_crypto=
+
 # OpenLDAP package is available
 # OPENLDAP=1
 
@@ -76,12 +96,21 @@ HAVE_SCC=1
 
 DIR_hdbdir=%{COMMON_APPDATA}/heimdal/hdb
 
-# Enable weak crypto
-WEAK_CRYPTO=1
+# Disable weak crypto
+WEAK_CRYPTO=0
+
+# Enable hcrypt fallback mechanisms
+HCRYPTO_FALLBACK=1
 
 # Disable use of GSS LOCALNAME support
 NO_LOCALNAME=1
 
+# Windows CRT mkdir does not have the mode parameter
+MKDIR_DOES_NOT_HAVE_MODE=1
+
+# Windows CRT rename does not unlink the target
+RENAME_DOES_NOT_UNLINK=1
+
 # Disable build of installers
 !ifndef NO_INSTALLERS
 BUILD_INSTALLERS=1
diff --git a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.version b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.version
index ef04b7986..51bed6e12 100644
--- a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.version
+++ b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.version
@@ -2,20 +2,13 @@
 
 VER_PACKAGE=heimdal
 VER_PACKAGE_NAME=Heimdal
-VER_PACKAGE_BUGREPORT=heimdal-bugs@h5l.org
-VER_PACKAGE_COPYRIGHT=Copyright (C) 1995-2011 Royal Institute of Technology, Stockholm, Sweden
+VER_PACKAGE_BUGREPORT=https://github.com/heimdal/heimdal/issues
+VER_PACKAGE_COPYRIGHT=Copyright (C) 1995-2016 Royal Institute of Technology, Stockholm, Sweden
 VER_PACKAGE_COMPANY=www.h5l.org
 
-# ------------------------------------------------------------
-# The current version number.  The PATCH value is only used
-# to indicate file versions and is ignored by the installer
-# engine.  To permit intermediate alpha/beta development
-# releases to be created and tested the AUX value is
-# incremented in multiples of 100.  1.5.1 == 1.5.100.0.
-
-VER_PRODUCT_MAJOR=1
-VER_PRODUCT_MINOR=5
-VER_PRODUCT_AUX=200
+VER_PRODUCT_MAJOR=7
+VER_PRODUCT_MINOR=99
+VER_PRODUCT_AUX=1
 VER_PRODUCT_PATCH=0
 
 # ------------------------------------------------------------
@@ -25,20 +18,25 @@ VER_PRODUCT_PATCH=0
 # version is 1.5.100.0 then VER_OLD_END version is
 # 1.5.99.65535.
 
-VER_OLD_BEGIN_MAJOR=1
-VER_OLD_BEGIN_MINOR=4
+VER_OLD_BEGIN_MAJOR=7
+VER_OLD_BEGIN_MINOR=99
 VER_OLD_BEGIN_AUX=0
 VER_OLD_BEGIN_PATCH=0
 
-VER_OLD_END_MAJOR=1
-VER_OLD_END_MINOR=5
-VER_OLD_END_AUX=200
+VER_OLD_END_MAJOR=7
+VER_OLD_END_MINOR=99
+VER_OLD_END_AUX=0
 VER_OLD_END_PATCH=65535
 
 VER_PACKAGE_VERSION=$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(VER_PRODUCT_AUX)
 
+# Debug build flag
+!ifndef NODEBUG
+VER_DEBUG=1
+!endif
+
 # Define to 1 if this is a pre-release build.  Undefine otherwise
-# VER_PRERELEASE=1
+VER_PRERELEASE=1
 
 # Define to a valid string if this build DOES NOT follow normal
 # release procedures.  I.e. this is a private build whose version
@@ -51,4 +49,3 @@ VER_PACKAGE_VERSION=$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(VER_PRODUCT_AUX)
 # version numbers.
 
 #VER_SPECIAL=Special build for testing ticket 12345
-
diff --git a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.w32 b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.w32
index a9e9153e1..1a35af9b0 100644
--- a/crypto/external/bsd/heimdal/dist/windows/NTMakefile.w32
+++ b/crypto/external/bsd/heimdal/dist/windows/NTMakefile.w32
@@ -80,7 +80,7 @@ OBJDIR		=$(SRC)\out\obj_$(CPU)
 INCDIR		=$(DESTDIR)\inc
 LIBDIR		=$(DESTDIR)\lib
 BINDIR		=$(DESTDIR)\bin
-PLUGINDIR	=$(BINDIR)\plugin\krb5
+PLUGINDIR	=$(BINDIR)
 DOCDIR		=$(DESTDIR)\doc
 SBINDIR		=$(BINDIR)
 LIBEXECDIR	=$(BINDIR)
@@ -123,7 +123,6 @@ LEX_CMD=flex.exe
 PYTHON=python.exe
 PERL=perl.exe
 CMP=cmp.exe
-SIGNTOOL=signtool.exe
 MAKECAT=makecat.exe
 HHC=hhc.exe
 MAKEINFO=makeinfo.exe
@@ -162,8 +161,11 @@ pthreadinc= -I$(PTHREAD_INC)
 
 cincdirs=$(cincdirs) -I$(INCDIR) -I$(INCDIR)\krb5 $(pthreadinc)
 cdefines=$(cdefines) -DHAVE_CONFIG_H
+# Windows CNG provider
+cdefines=$(cdefines) -DHCRYPTO_DEF_PROVIDER=w32crypto
 cdebug=$(cdebug) /Zi
 ldebug=$(ldebug) /DEBUG
+localcflags=$(localcflags) /Oy-
 
 # Disable warnings:
 #
@@ -244,7 +246,7 @@ RC2RES = $(RC2RES_C) -fo $@ $**
 
 REQUIRED_TOOLS= \
 	"$(AWK_CMD)" "$(YACC_CMD)" "$(LEX_CMD)" "$(PYTHON)" "$(PERL)" \
-	"$(CMP)" "$(SED)" "$(SIGNTOOL)" "$(MAKECAT)" "$(MAKEINFO)" "$(HHC)"
+	"$(CMP)" "$(SED)" "$(MAKECAT)" "$(MAKEINFO)" "$(HHC)"
 
 !ifdef BUILD_INSTALLERS
 REQUIRED_TOOLS=$(REQUIRED_TOOLS) "$(CANDLE_CMD)" "$(LIGHT_CMD)"
@@ -371,38 +373,38 @@ announce-tools:
 prep:: mkdirs
 
 mkdirs:
-!  if !exist($(OBJ))
-	$(MKDIR) $(OBJ)
+!  if !exist("$(OBJ)")
+	-$(MKDIR) "$(OBJ)"
 !  endif
-!  if !exist($(DESTDIR))
-	$(MKDIR) $(DESTDIR)
+!  if !exist("$(DESTDIR)")
+	-$(MKDIR) "$(DESTDIR)"
 !  endif
-!  if !exist($(LIBDIR))
-	$(MKDIR) $(LIBDIR)
+!  if !exist("$(LIBDIR)")
+	-$(MKDIR) "$(LIBDIR)"
 !  endif
-!  if !exist($(BINDIR))
-	$(MKDIR) $(BINDIR)
+!  if !exist("$(BINDIR)")
+	-$(MKDIR) "$(BINDIR)"
 !  endif
-!  if !exist($(PLUGINDIR))
-	$(MKDIR) $(PLUGINDIR)
+!  if !exist("$(PLUGINDIR)")
+	-$(MKDIR) "$(PLUGINDIR)"
 !  endif
-!  if !exist($(INCDIR))
-	$(MKDIR) $(INCDIR)
+!  if !exist("$(INCDIR)")
+	-$(MKDIR) "$(INCDIR)"
 !  endif
-!  if !exist($(DOCDIR))
-	$(MKDIR) $(DOCDIR)
+!  if !exist("$(DOCDIR)")
+	-$(MKDIR) "$(DOCDIR)"
 !  endif
-!  if !exist($(INCDIR)\gssapi)
-	$(MKDIR) $(INCDIR)\gssapi
+!  if !exist("$(INCDIR)\gssapi")
+	-$(MKDIR) "$(INCDIR)\gssapi"
 !  endif
-!  if !exist($(INCDIR)\hcrypto)
-	$(MKDIR) $(INCDIR)\hcrypto
+!  if !exist("$(INCDIR)\hcrypto")
+	-$(MKDIR) "$(INCDIR)\hcrypto"
 !  endif
-!  if !exist($(INCDIR)\kadm5)
-	$(MKDIR) $(INCDIR)\kadm5
+!  if !exist("$(INCDIR)\kadm5")
+	-$(MKDIR) "$(INCDIR)\kadm5"
 !  endif
-!  if !exist($(INCDIR)\krb5)
-	$(MKDIR) $(INCDIR)\krb5
+!  if !exist("$(INCDIR)\krb5")
+	-$(MKDIR) "$(INCDIR)\krb5"
 !  endif
 
 #----------------------------------------------------------------------
@@ -485,6 +487,10 @@ _VC_MANIFEST_CLEAN= \
 #----------------------------------------------------------------------
 # Code and assembly signing
 #
+#
+# SIGNTOOL is fullpath to signtool.exe from Windows v8.1 or later SDK
+# (earlier versions do not support SHA-2 signatures)
+#
 # SIGNTOOL_C is any set of options required for certificate/private
 # key selection for code signging.
 #
@@ -494,21 +500,51 @@ _VC_MANIFEST_CLEAN= \
 
 !ifdef CODESIGN
 _CODESIGN=( $(CODESIGN) $@ )
+_CODESIGN_SHA256=( $(CODESIGN_SHA256) $@ )
 !else
 
+!ifndef SIGNTOOL
+SIGNTOOL=signtool.exe
+!endif
+
 !ifdef SIGNTOOL_C
 
 !ifndef SIGNTOOL_T
-SIGNTOOL_T=/t http://timestamp.verisign.com/scripts/timstamp.dll
+SIGNTOOL_T=http://timestamp.verisign.com/scripts/timstamp.dll
+!endif
+!ifndef SIGNTOOL_T_SHA256
+SIGNTOOL_T_SHA256=http://timestamp.geotrust.com/tsa
 !endif
 
-_CODESIGN=( $(SIGNTOOL) sign $(SIGNTOOL_O) $(SIGNTOOL_T) $(SIGNTOOL_C) /v $@ )
+_CODESIGN=( $(SIGNTOOL) sign /fd sha1 $(SIGNTOOL_O) /t $(SIGNTOOL_T) $(SIGNTOOL_C) /v $@ )
+_CODESIGN_SHA256=( $(SIGNTOOL) sign /as /fd sha256 $(SIGNTOOL_O) /tr $(SIGNTOOL_T_SHA256) $(SIGNTOOL_C) /v $@ )
 !else
 _CODESIGN=( echo Skipping code sign )
+_CODESIGN_SHA256=( echo Skipping sha256 code sign )
 !endif
 
 !endif
 
+#----------------------------------------------------------------------
+# Symbol Store Support
+#
+# SYMSTORE_EXE is full path to symstore.exe
+#
+# SYMSTORE_ROOT is full path to root directory of symbol store
+#
+# SYMSTORE_COMMENT is optional comment to include in symbol store catalog entry
+#
+
+!IF DEFINED(SYMSTORE_EXE) && DEFINED(SYMSTORE_ROOT)
+!IF "$(SYMSTORE_COMMENT)" != ""
+SYMSTORE_COMMENT = |$(SYMSTORE_COMMENT)
+!ENDIF
+SYMSTORE_IMPORT= \
+$(SYMSTORE_EXE) add /s $(SYMSTORE_ROOT) /t "Heimdal" /v "$(BUILD)-$(CPU)-$(VER_PACKAGE_VERSION)" /c "$(@F)$(SYMSTORE_COMMENT)" /f $*.*
+!ELSE
+SYMSTORE_IMPORT=@echo No symbol store
+!ENDIF
+
 #----------------------------------------------------------------------
 # Convenience macros for preparing EXEs and DLLs.  These are multiline
 # macros that deal with manifests and code signing.  Unless we need to
@@ -516,22 +552,22 @@ _CODESIGN=( echo Skipping code sign )
 # prepare binaries.
 
 EXEPREP=\
-( $(_VC_MANIFEST_EMBED_EXE) && $(_VC_MANIFEST_CLEAN) && $(_CODESIGN) ) || ( $(RM) $@ && exit /b 1 )
+( $(_VC_MANIFEST_EMBED_EXE) && $(_VC_MANIFEST_CLEAN) && $(SYMSTORE_IMPORT) && $(_CODESIGN) && $(_CODESIGN_SHA256) ) || ( $(RM) $@ && exit /b 1 )
 
 EXEPREP_NOHEIM=\
-( $(_VC_MANIFEST_EMBED_EXE_NOHEIM) && $(_VC_MANIFEST_CLEAN) && $(_CODESIGN) ) || ( $(RM) $@ && exit /b 1 )
+( $(_VC_MANIFEST_EMBED_EXE_NOHEIM) && $(_VC_MANIFEST_CLEAN) && $(SYMSTORE_IMPORT) && $(_CODESIGN) && $(_CODESIGN_SHA256) ) || ( $(RM) $@ && exit /b 1 )
 
 EXEPREP_NODIST=\
-( $(_VC_MANIFEST_EMBED_EXE_NOHEIM) && $(_VC_MANIFEST_CLEAN) ) || ( $(RM) $@ && exit /b 1 )
+( $(_VC_MANIFEST_EMBED_EXE_NOHEIM) && $(_VC_MANIFEST_CLEAN) && $(SYMSTORE_IMPORT) ) || ( $(RM) $@ && exit /b 1 )
 
 DLLPREP=\
-( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) && $(_CODESIGN) ) || ( $(RM) $@ && exit /b 1 )
+( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) && $(SYMSTORE_IMPORT) && $(_CODESIGN) && $(_CODESIGN_SHA256) ) || ( $(RM) $@ && exit /b 1 )
 
 DLLPREP_NODIST=\
-( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) ) || ( $(RM) $@ && exit /b 1 )
+( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) && $(SYMSTORE_IMPORT) ) || ( $(RM) $@ && exit /b 1 )
 
 DLLPREP_MERGE=\
-( ( $(_MERGE_MANIFEST_DLL) || $(_INSERT_APPMANIFEST_DLL) ) && $(_CODESIGN) ) || ( $(RM) $@ && exit /b 1 )
+( ( $(_MERGE_MANIFEST_DLL) || $(_INSERT_APPMANIFEST_DLL) && $(SYMSTORE_IMPORT) ) && $(_CODESIGN) && $(_CODESIGN_SHA256) ) || ( $(RM) $@ && exit /b 1 )
 
 #----------------------------------------------------------------------
 # Convenience macros for import libraries and assemblies
@@ -561,7 +597,19 @@ LIBSQLITE   =$(LIBDIR)\libsqlite.lib
 LIBVERS	    =$(LIBDIR)\libvers.lib
 LIBWIND	    =$(LIBDIR)\libwind.lib
 
-ASMKRBNAME  =Heimdal.Kerberos
-ASMGSSNAME  =Heimdal.GSSAPI
+!ifdef VER_DEBUG
+ASM_DBG=.Debug
+!endif
+!ifdef VER_PRERELEASE
+ASM_PRE=.Pre
+!endif
+!ifdef VER_PRIVATE
+ASM_PVT=.Private
+!endif
+!ifdef VER_SPECIAL
+ASM_SPC=.Special
+!endif
+
+ASMKRBNAME  =Heimdal.Kerberos$(ASM_SPC)$(ASM_PVT)$(ASM_PRE)$(ASM_DBG)
 APPMANIFEST =$(INCDIR)\Heimdal.Application.$(MCPU).manifest
 
diff --git a/crypto/external/bsd/heimdal/dist/windows/README b/crypto/external/bsd/heimdal/dist/windows/README.md
similarity index 83%
rename from crypto/external/bsd/heimdal/dist/windows/README
rename to crypto/external/bsd/heimdal/dist/windows/README.md
index 9a3e34720..75d6fd5ad 100644
--- a/crypto/external/bsd/heimdal/dist/windows/README
+++ b/crypto/external/bsd/heimdal/dist/windows/README.md
@@ -35,13 +35,16 @@ work, but have not been tested.
   (Required for running tests).  These can be found in the Cygwin
   distribution.  MinGW or GnuWin32 may also be used instead of Cygwin.
   However, a recent build of `makeinfo` is required for building the
-  documentation.
+  documentation. Cygwin makeinfo 4.7 is known to work.
 
 * __Certificate for code-signing__: The Heimdal build produces a
   number of Assemblies that should be signed if they are to be
   installed via Windows Installer.  In addition, all executable
   binaries produced by the build including installers can be signed
   and timestamped if a code-signing certificate is available.
+  As of 1 January 2016 Windows 7 and above require the use of sha256
+  signatures.  The signtool.exe provided with Windows SDK 8.1 or
+  later must be used.
 
 [1]: http://wix.sourceforge.net/
 
@@ -79,23 +82,37 @@ work, but have not been tested.
     options for `signtool`.
 
     E.g.:
+
         set SIGNTOOL_C=/f c:\mycerts\codesign.pfx
 
+	set SIGNTOOL_C=/n "Certificate Subject Name" /a
+
   - `SIGNTOOL_O`: Signing parameter options for `signtool`. Optional.
 
     E.g.:
+
         set SIGNTOOL_O=/du http://example.com/myheimdal
 
-  - `SIGNTOOL_T`: Timestamp options for `signtool`.  If not specified,
-    defaults to `/t http://timestamp.verisign.com/scripts/timstamp.dll`.
+  - `SIGNTOOL_T`: SHA1 Timestamp URL for `signtool`.  If not specified,
+    defaults to `http://timestamp.verisign.com/scripts/timstamp.dll`.
 
-  - `CODESIGN`: Code signer command.  This environment variable, if
+  - `SIGNTOOL_T_SHA256`: SHA256 Timestamp URL for `signtool`.  If not
+    specified, defaults to `http://timestamp.geotrust.com/tsa`.
+
+  - `CODESIGN`: SHA1 Code signer command.  This environment variable, if
     defined, overrides the `SIGNTOOL_*` variables.  It should be
     defined to be a command that takes one parameter: the binary to be
     signed.
 
+  - `CODESIGN_SHA256`: SHA256 Code signer command.  This environment variable, if
+    defined, applies a second SHA256 signature to the parameter.  It should be
+    defined to be a command that takes one parameter: the binary to be
+    signed.
+
     E.g.:
+
         set CODESIGN=c:\scripts\mycodesigner.cmd
+	set CODESIGN_SHA256=c:\scripts\mycodesigner256.cmd
 
 * Define the code sign public key token.  This is contained in the
   environment variable `CODESIGN_PKT` and is needed to build the
@@ -113,6 +130,7 @@ work, but have not been tested.
   `publicKeyToken` value (excluding quotes).
 
   E.g.:
+
       set CODESIGN_PKT=abcdef0123456789
 
 4. Running the build
@@ -130,7 +148,7 @@ The build can also be invoked from any subdirectory that contains an
 inter-dependencies between directories and therefore it is recommended
 that a full build be invoked from the root of the source tree.
 
-Tests can be invoked as:
+Tests can be invoked, after a full build, by executing:
 
     nmake /f NTMakefile test
 
diff --git a/crypto/external/bsd/heimdal/dist/windows/maint.el b/crypto/external/bsd/heimdal/dist/windows/maint.el
deleted file mode 100644
index a76179d85..000000000
--- a/crypto/external/bsd/heimdal/dist/windows/maint.el
+++ /dev/null
@@ -1,34 +0,0 @@
-
-
-(defun generate-obj-macro (mname &optional postfix &rest slist)
-  "Generates a macro definition for an OBJs dependency based on a list of source definitions"
-
-  (let*
-      ((replist (apply 'append (mapcar (lambda (sdef)
-                                         (goto-char 0)
-                                         (let*
-                                             ((def (buffer-substring-no-properties
-                                                    (search-forward (concat sdef " = \\\n") nil t)
-                                                    (search-forward "\n\n" nil t)))
-                                              (st (split-string
-                                                   (replace-regexp-in-string "^.*\\.h.*\n" "" def)
-                                                   "\\s-+\\\\?\\|\n" t)))
-                                           st)) slist)))
-       (def-start (search-forward (concat mname " = \\\n") nil t))
-       (def-end (search-forward "\n\n" nil t))
-
-       (repl (mapconcat
-              (lambda (s)
-                (concat "\t"
-                        (replace-regexp-in-string
-                         "\\(\\s-*\\)\\(.*\\)\\.c" "\\1$(OBJ)\\\\\\2.obj" s)
-                        " \\"))
-              replist "\n"))
-       (erepl (if postfix
-                  (concat repl "\n" postfix "\n\n")
-                (concat repl "\n\n")))
-       )
-    (delete-region def-start def-end)
-    (insert erepl))
-  )
-
diff --git a/crypto/external/bsd/heimdal/dist/windows/version.rc b/crypto/external/bsd/heimdal/dist/windows/version.rc
index 2c6dd1c91..ce9d4d4e6 100644
--- a/crypto/external/bsd/heimdal/dist/windows/version.rc
+++ b/crypto/external/bsd/heimdal/dist/windows/version.rc
@@ -123,7 +123,9 @@ values as a substitute */
 	       VALUE "ProductVersion", RC_FILE_PRODUCT_VER_0409
 	       VALUE "CompanyName", RC_FILE_COMPANY_0409
 	       VALUE "LegalCopyright", RC_FILE_COPYRIGHT_0409
-
+#ifdef RC_FILE_TRADEMARK_0409
+	       VALUE "LegalTrademark", RC_FILE_TRADEMARK_0409
+#endif
 #ifdef RC_FILE_COMMENT_0409
 	       VALUE "Comments", RC_FILE_COMMENT_0409
 #endif
diff --git a/crypto/external/bsd/heimdal/heimdal2netbsd b/crypto/external/bsd/heimdal/heimdal2netbsd
index 8bfdc435f..c70714790 100755
--- a/crypto/external/bsd/heimdal/heimdal2netbsd
+++ b/crypto/external/bsd/heimdal/heimdal2netbsd
@@ -1,6 +1,6 @@
 #! /bin/sh
 #
-#	$NetBSD: heimdal2netbsd,v 1.6 2014/04/22 14:07:31 pettai Exp $
+#	$NetBSD: heimdal2netbsd,v 1.8 2017/01/28 21:31:43 christos Exp $
 #
 # Copyright (c) 2011 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -36,7 +36,7 @@
 #	$ export SRCDIR=/usr/src
 #	$ export HEIMDAL_SRCDIR=src/crypto/external/bsd/heimdal
 #	$ cd /some/where/temporary
-#	$ git clone git@github.com:heimdal/heimdal.git
+#	$ git clone git://github.com/heimdal/heimdal.git
 #	$ sh $SRCDIR/../$HEIMDAL_SRCDIR/heimdal2netbsd heimdal `pwd`
 #	$ cd $HEIMDAL_SRCDIR/dist
 #       $ cvs -d ... import $HEIMDAL_SRCDIR/dist HEIMDAL head-20110317
@@ -184,16 +184,16 @@ find $d -type f -print | xargs egrep -l '\$NetBSD:' | while read f; do
 	echo froze NetBSD RCSID for $f
 done
 
+### Remove the $'s around RCS tags
+cleantags $d
+
 # Convert unexpanded RCSID's to the NetBSD way.
-find $d -type f -print | xargs egrep -l 'RCSID\("\$Id\$"\)' | while read f; do
-	sed -e 's/RCSID("\$\Id\$")/__RCSID("\$NetBSD\$")/' \
+find $d -type f -print | xargs egrep -l 'RCSID\("Id"\)' | while read f; do
+	sed -e 's/RCSID("Id")/__RCSID("\$NetBSD\$")/' \
 	    < $f > /tmp/heimdal1f$$ && mv /tmp/heimdal1f$$ $f && \
 	echo converted RCSID to NetBSD for $f
 done
 
-### Remove the $'s around RCS tags
-cleantags $d
-
 ### Add our NetBSD RCS Id
 find $d -type f -name '*.[chly]' -print | while read c; do
 	sed 1q < $c | grep -q '\$NetBSD' || (
diff --git a/crypto/external/bsd/heimdal/include/config.h b/crypto/external/bsd/heimdal/include/config.h
index 2ee7d4b39..74db790aa 100644
--- a/crypto/external/bsd/heimdal/include/config.h
+++ b/crypto/external/bsd/heimdal/include/config.h
@@ -3,13 +3,20 @@
 
 #if HAVE_NBTOOL_CONFIG_H
 #include "nbtool_config.h"
+#define arc4random random
+#define arc4random_stir() srandom(time(NULL))
+#undef PACKAGE_NAME
+#undef PACKAGE_STRING
+#undef PACKAGE_TARNAME
+#undef PACKAGE_VERSION
+#undef PACKAGE_BUGREPORT
 #endif
 
 #ifndef RCSID
 #define RCSID(msg) \
 static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #endif
- 
+
 /* Maximum values on all known systems */
 #define MaxHostNameLen (64+4)
 #define MaxPathLen (1024+4)
@@ -119,9 +126,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `arc4random' function. */
 #define HAVE_ARC4RANDOM 1
 
-/* Define to 1 if you have the <arpa/ftp.h> header file. */
-#define HAVE_ARPA_FTP_H 1
-
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #define HAVE_ARPA_INET_H 1
 
@@ -158,6 +162,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `bswap32' function. */
 #define HAVE_BSWAP32 1
 
+/* Define to 1 if you have the `bswap64' function. */
+#define HAVE_BSWAP64 1
+
 /* Define to 1 if you have the <capability.h> header file. */
 /* #undef HAVE_CAPABILITY_H */
 
@@ -302,6 +309,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <dispatch/dispatch.h> header file. */
 /* #undef HAVE_DISPATCH_DISPATCH_H */
 
+/* Define to 1 if you have the `dladdr' function. */
+#define HAVE_DLADDR 1
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #define HAVE_DLFCN_H 1
 
@@ -323,6 +333,12 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the function `ecalloc'. */
 #define HAVE_ECALLOC 1
 
+/* Define to 1 if you have the <editline/readline.h> header file. */
+/* #undef HAVE_EDITLINE_READLINE_H */
+
+/* Define to 1 if you have the <editline/readline.h > header file. */
+/* #undef HAVE_EDITLINE_READLINE_H_ */
+
 /* Define if you have the function `emalloc'. */
 #define HAVE_EMALLOC 1
 
@@ -345,7 +361,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_ESTRDUP 1
 
 /* Define to 1 if you have the <execinfo.h> header file. */
-#undef HAVE_EXECINFO_H
+#define HAVE_EXECINFO_H 1
 
 /* Define if you have the function `fchown'. */
 #define HAVE_FCHOWN 1
@@ -365,6 +381,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <fnmatch.h> header file. */
 #define HAVE_FNMATCH_H 1
 
+/* Define to 1 if you have the `fork' function. */
+#define HAVE_FORK 1
+
 /* Have -framework Security */
 /* #undef HAVE_FRAMEWORK_SECURITY */
 
@@ -386,6 +405,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `getaddrinfo' function. */
 #define HAVE_GETADDRINFO 1
 
+/* Define to 1 if you have the `getauxval' function. */
+/* #undef HAVE_GETAUXVAL */
+
 /* Define to 1 if you have the `getconfattr' function. */
 /* #undef HAVE_GETCONFATTR */
 
@@ -449,6 +471,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `getpwnam_r' function. */
 #define HAVE_GETPWNAM_R 1
 
+/* Define to 1 if you have the `getpwuid_r' function. */
+#define HAVE_GETPWUID_R 1
+
 /* Define to 1 if you have the `getrlimit' function. */
 #define HAVE_GETRLIMIT 1
 
@@ -480,6 +505,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <grp.h> header file. */
 #define HAVE_GRP_H 1
 
+/* define to use openssl's libcrypto as the default backend for libhcrypto */
+#define HAVE_HCRYPTO_W_OPENSSL 1
+
 /* Define to 1 if you have the `hstrerror' function. */
 #define HAVE_HSTRERROR 1
 
@@ -510,9 +538,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the function `initgroups'. */
 #define HAVE_INITGROUPS 1
 
-/* Define to 1 if you have the `initstate' function. */
-#define HAVE_INITSTATE 1
-
 /* Define if you have the function `innetgr'. */
 #define HAVE_INNETGR 1
 
@@ -534,10 +559,8 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <io.h> header file. */
 /* #undef HAVE_IO_H */
 
-#if 0
 /* Define if you have IPv6. */
 #define HAVE_IPV6 1
-#endif
 
 /* Define if you have the function `iruserok'. */
 #define HAVE_IRUSEROK 1
@@ -548,12 +571,21 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you want to use the Kerberos Credentials Manager. */
 #define HAVE_KCM 1
 
+/* Define to 1 if you have the `kill' function. */
+#define HAVE_KILL 1
+
+/* Define to 1 if you have the `util' library (-lutil). */
+#define HAVE_LIBUTIL 1
+
 /* Define to 1 if you have the <libutil.h> header file. */
 /* #undef HAVE_LIBUTIL_H */
 
 /* Define to 1 if you have the <limits.h> header file. */
 #define HAVE_LIMITS_H 1
 
+/* define if you have the LMDB library */
+/* #undef HAVE_LMDB */
+
 /* Define to 1 if you have the `loadquery' function. */
 /* #undef HAVE_LOADQUERY */
 
@@ -584,6 +616,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <memory.h> header file. */
 #define HAVE_MEMORY_H 1
 
+/* Define if you have the function `memset_s'. */
+/* #undef HAVE_MEMSET_S */
+
 /* Define if you have the function `mkstemp'. */
 #define HAVE_MKSTEMP 1
 
@@ -606,10 +641,10 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_NETGROUP_H 1
 
 /* Define to 1 if you have the <netinet6/in6.h> header file. */
-#define HAVE_NETINET6_IN6_H 1
+/* #undef HAVE_NETINET6_IN6_H */
 
 /* Define to 1 if you have the <netinet6/in6_var.h> header file. */
-#define HAVE_NETINET6_IN6_VAR_H 1
+/* #undef HAVE_NETINET6_IN6_VAR_H */
 
 /* Define to 1 if you have the <netinet/in6.h> header file. */
 /* #undef HAVE_NETINET_IN6_H */
@@ -641,9 +676,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `openpty' function. */
 #define HAVE_OPENPTY 1
 
-/* define to use openssl's libcrypto */
-#define HAVE_OPENSSL 1
-
 /* Define to enable basic OSF C2 support. */
 /* #undef HAVE_OSFC2 */
 
@@ -687,9 +719,13 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_READLINE 1
 
 /* Define to 1 if you have the
-   <[readline.h])[][]_AH_CHECK_HEADER([readline/readline.h]> header file. */
+   <[readline.h])[][]_AH_CHECK_HEADER([readline/readline.h])[][]_AH_CHECK_HEADER([editline/readline.h]>
+   header file. */
 /* #undef HAVE_READLINE_H */
 
+/* Define to 1 if you have the <readline/readline.h> header file. */
+#define HAVE_READLINE_READLINE_H 1
+
 /* Define to 1 if you have the <readline/readline.h > header file. */
 /* #undef HAVE_READLINE_READLINE_H_ */
 
@@ -724,10 +760,10 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_SA_FAMILY_T 1
 
 /* Define if you want support for cache in sqlite. */
-/* #undef HAVE_SCC */
+#define HAVE_SCC 1
 
 /* Define to 1 if you have the <search.h> header file. */
-/* #undef HAVE_SEARCH_H */
+#define HAVE_SEARCH_H 1
 
 /* Define to 1 if you have the <security/pam_modules.h> header file. */
 #define HAVE_SECURITY_PAM_MODULES_H 1
@@ -786,9 +822,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the `setsockopt' function. */
 #define HAVE_SETSOCKOPT 1
 
-/* Define to 1 if you have the `setstate' function. */
-#define HAVE_SETSTATE 1
-
 /* Define to 1 if you have the `setutent' function. */
 #define HAVE_SETUTENT 1
 
@@ -820,7 +853,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_SOCKLEN_T 1
 
 /* Define if you want support for sqlite in Heimdal. */
-/* #undef HAVE_SQLITE3 */
+#define HAVE_SQLITE3 1
 
 /* Define to 1 if the system has the type `ssize_t'. */
 #define HAVE_SSIZE_T 1
@@ -897,6 +930,12 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the function `strtok_r'. */
 #define HAVE_STRTOK_R 1
 
+/* Define if you have the function strtoll. */
+#define HAVE_STRTOLL 1
+
+/* Define if you have the function strtoull. */
+#define HAVE_STRTOULL 1
+
 /* Define to 1 if the system has the type `struct addrinfo'. */
 #define HAVE_STRUCT_ADDRINFO 1
 
@@ -927,51 +966,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if struct tm has field tm_zone. */
 #define HAVE_STRUCT_TM_TM_ZONE 1
 
-/* Define if struct utmpx has field ut_exit. */
-#define HAVE_STRUCT_UTMPX_UT_EXIT 1
-
-/* Define if struct utmpx has field ut_host. */
-#define HAVE_STRUCT_UTMPX_UT_HOST 1
-
-/* Define if struct utmpx has field ut_id. */
-#define HAVE_STRUCT_UTMPX_UT_ID 1
-
-/* Define if struct utmpx has field ut_line. */
-#define HAVE_STRUCT_UTMPX_UT_LINE 1
-
-/* Define if struct utmpx has field ut_pid. */
-#define HAVE_STRUCT_UTMPX_UT_PID 1
-
-/* Define if struct utmpx has field ut_syslen. */
-/* #undef HAVE_STRUCT_UTMPX_UT_SYSLEN */
-
-/* Define if struct utmpx has field ut_tv. */
-#define HAVE_STRUCT_UTMPX_UT_TV 1
-
-/* Define if struct utmpx has field ut_type. */
-#define HAVE_STRUCT_UTMPX_UT_TYPE 1
-
-/* Define if struct utmpx has field ut_user. */
-#define HAVE_STRUCT_UTMPX_UT_USER 1
-
-/* Define if struct utmp has field ut_addr. */
-/* #undef HAVE_STRUCT_UTMP_UT_ADDR */
-
-/* Define if struct utmp has field ut_host. */
-/* #undef HAVE_STRUCT_UTMP_UT_HOST */
-
-/* Define if struct utmp has field ut_id. */
-/* #undef HAVE_STRUCT_UTMP_UT_ID */
-
-/* Define if struct utmp has field ut_pid. */
-/* #undef HAVE_STRUCT_UTMP_UT_PID */
-
-/* Define if struct utmp has field ut_type. */
-/* #undef HAVE_STRUCT_UTMP_UT_TYPE */
-
-/* Define if struct utmp has field ut_user. */
-/* #undef HAVE_STRUCT_UTMP_UT_USER */
-
 /* define if struct winsize is declared in sys/termios.h */
 #define HAVE_STRUCT_WINSIZE 1
 
@@ -1005,6 +999,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <syslog.h> header file. */
 #define HAVE_SYSLOG_H 1
 
+/* Define to 1 if you have the <sys/auxv.h> header file. */
+/* #undef HAVE_SYS_AUXV_H */
+
 /* Define to 1 if you have the <sys/bitypes.h> header file. */
 /* #undef HAVE_SYS_BITYPES_H */
 
@@ -1017,6 +1014,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <sys/category.h> header file. */
 /* #undef HAVE_SYS_CATEGORY_H */
 
+/* Define to 1 if you have the <sys/errno.h> header file. */
+#define HAVE_SYS_ERRNO_H 1
+
 /* Define to 1 if you have the <sys/file.h> header file. */
 #define HAVE_SYS_FILE_H 1
 
@@ -1114,7 +1114,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_SYS_WAIT_H 1
 
 /* Define to 1 if you have the `tdelete' function. */
-/* #undef HAVE_TDELETE */
+#define HAVE_TDELETE 1
 
 /* Define to 1 if you have the <termcap.h> header file. */
 #define HAVE_TERMCAP_H 1
@@ -1129,7 +1129,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_TERM_H 1
 
 /* Define to 1 if you have the `tfind' function. */
-/* #undef HAVE_TFIND */
+#define HAVE_TFIND 1
 
 /* Define to 1 if you have the `tgetent' function. */
 #define HAVE_TGETENT 1
@@ -1147,7 +1147,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* #undef HAVE_TMPDIR_H */
 
 /* Define if you have the function `tsearch'. */
-/* #undef HAVE_TSEARCH 1 */
+#define HAVE_TSEARCH 1
 
 /* Define to 1 if you have the `ttyname' function. */
 #define HAVE_TTYNAME 1
@@ -1156,7 +1156,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define HAVE_TTYSLOT 1
 
 /* Define to 1 if you have the `twalk' function. */
-/* #undef HAVE_TWALK */
+#define HAVE_TWALK 1
 
 /* Define to 1 if you have the <udb.h> header file. */
 /* #undef HAVE_UDB_H */
@@ -1203,12 +1203,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to 1 if you have the <util.h> header file. */
 #define HAVE_UTIL_H 1
 
-/* Define to 1 if you have the <utmpx.h> header file. */
-#define HAVE_UTMPX_H 1
-
-/* Define to 1 if you have the <utmp.h> header file. */
-#define HAVE_UTMP_H 1
-
 /* Define to 1 if the system has the type `u_int16_t'. */
 #define HAVE_U_INT16_T 1
 
@@ -1254,6 +1248,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the function `vwarnx'. */
 #define HAVE_VWARNX 1
 
+/* Define to 1 if you have the `waitpid' function. */
+#define HAVE_WAITPID 1
+
 /* Define if you have the function `warn'. */
 #define HAVE_WARN 1
 
@@ -1275,15 +1272,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* define if struct winsize has ws_ypixel */
 #define HAVE_WS_YPIXEL 1
 
-/* Define to 1 if you have the `XauFileName' function. */
-#define HAVE_XAUFILENAME 1
-
-/* Define to 1 if you have the `XauReadAuth' function. */
-#define HAVE_XAUREADAUTH 1
-
-/* Define to 1 if you have the `XauWriteAuth' function. */
-#define HAVE_XAUWRITEAUTH 1
-
 /* Define to 1 if you have the `yp_get_default_domain' function. */
 #define HAVE_YP_GET_DEFAULT_DOMAIN 1
 
@@ -1302,22 +1290,19 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you have the `__progname' variable. */
 #define HAVE___PROGNAME 1
 
-/*
- * Not all NetBSD platforms have __sync_add_and_fetch, but NetBSD provides
- * the standard <sys/atomic.h> API everywhere.
- */
-#define USE_ATOMIC_INCDEC	1
 /* have __sync_add_and_fetch */
-/*
- * #define HAVE___SYNC_ADD_AND_FETCH 1
- */
+#define HAVE___SYNC_ADD_AND_FETCH 1
+
+/* Define to one of cc, pkcs11, ossl, w32crypto, or hcrypto to set a default
+   hcrypto provider */
+/* #undef HCRYPTO_DEF_PROVIDER */
+
+/* Set to 1 to allow fallback to hcrypto for unavailable algorithms */
+#define HCRYPTO_FALLBACK 1
 
 /* Define if you want support for weak crypto */
 #define HEIM_WEAK_CRYPTO 1
 
-/* Define if you have the hesiod package. */
-/* #undef HESIOD */
-
 /* Enable Kerberos 5 support in applications. */
 #define KRB5 1
 
@@ -1328,7 +1313,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define LIBDIR "/usr/lib"
 
 /* Define if you have the libedit package. */
-#define LIBEDIT 1
+/* #undef LIBEDIT */
 
 /* path to libexec */
 #define LIBEXECDIR "/usr/libexec"
@@ -1436,9 +1421,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if you don't wan't support for AFS. */
 /* #undef NO_AFS */
 
-/* Define to 1 if your C compiler doesn't accept -c and -o together. */
-/* #undef NO_MINUS_C_MINUS_O */
-
 /* Define if you don't want to use mmap. */
 /* #undef NO_MMAP */
 
@@ -1462,13 +1444,13 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define PACKAGE "heimdal"
 
 /* Define to the address where bug reports for this package should be sent. */
-#define PACKAGE_BUGREPORT "heimdal-bugs@h5l.org"
+#define PACKAGE_BUGREPORT "https://github.com/heimdal/heimdal/issues"
 
 /* Define to the full name of this package. */
 #define PACKAGE_NAME "Heimdal"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "Heimdal 1.5.3"
+#define PACKAGE_STRING "Heimdal 7.1.0"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "heimdal"
@@ -1477,7 +1459,10 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.5.3"
+#define PACKAGE_VERSION "7.1.0"
+
+/* path to PKCS11 module */
+/* #undef PKCS11_MODULE_PATH */
 
 /* Define to enable PKINIT. */
 #define PKINIT 1
@@ -1486,7 +1471,10 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* #undef POSIX_GETLOGIN */
 
 /* Define if getpwnam_r has POSIX flavour. */
-/* #undef POSIX_GETPWNAM_R */
+#define POSIX_GETPWNAM_R 1
+
+/* Define if getpwuid_r has POSIX flavour. */
+#define POSIX_GETPWUID_R 1
 
 /* Define if you have the readline package. */
 /* #undef READLINE */
@@ -1513,9 +1501,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
    char *, size_t) */
 #define STRERROR_R_PROTO_COMPATIBLE 1
 
-/* Define if os support want to detach is daemonens. */
-#define SUPPORT_DETACH 1
-
 /* Enable use of inetd style startup. */
 #define SUPPORT_INETD 1
 
@@ -1532,7 +1517,7 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* #undef TM_IN_SYS_TIME */
 
 /* Version number of package */
-#define VERSION "1.5.3"
+#define VERSION "7.1.0"
 
 /* Define if signal handlers return void. */
 #define VOID_RETSIGTYPE 1
@@ -1540,9 +1525,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* define if target is big endian */
 /* #undef WORDS_BIGENDIAN */
 
-/* Define to 1 if the X Window System is missing or not being used. */
-/* #undef X_DISPLAY_MISSING */
-
 /* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
    `char[]'. */
 #define YYTEXT_POINTER 1
@@ -1550,6 +1532,11 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Required for functional/sane headers on AIX */
 /* #undef _ALL_SOURCE */
 
+/* Enable large inode numbers on Mac OS X 10.5.  */
+#ifndef _DARWIN_USE_64_BIT_INODE
+# define _DARWIN_USE_64_BIT_INODE 1
+#endif
+
 /* Number of bits in a file offset, on hosts where this is settable. */
 /* #undef _FILE_OFFSET_BITS */
 
@@ -1562,6 +1549,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define to get POSIX getpwnam_r in some systems. */
 /* #undef _POSIX_PTHREAD_SEMANTICS */
 
+/* Enable general extensions on Solaris. */
+/* #undef __EXTENSIONS__ */
+
 /* Define to empty if `const' does not conform to ANSI C. */
 /* #undef const */
 
diff --git a/crypto/external/bsd/heimdal/include/der-private.h b/crypto/external/bsd/heimdal/include/der-private.h
index 555f71bd0..14866dcce 100644
--- a/crypto/external/bsd/heimdal/include/der-private.h
+++ b/crypto/external/bsd/heimdal/include/der-private.h
@@ -4,6 +4,20 @@
 
 #include <stdarg.h>
 
+int
+_asn1_bmember_isset_bit (
+	const void */*data*/,
+	unsigned int /*bit*/,
+	size_t /*size*/);
+
+void
+_asn1_bmember_put_bit (
+	unsigned char */*p*/,
+	const void */*data*/,
+	unsigned int /*bit*/,
+	size_t /*size*/,
+	unsigned int */*bitset*/);
+
 int
 _asn1_copy (
 	const struct asn1_template */*t*/,
@@ -42,16 +56,37 @@ _asn1_encode (
 	const void */*data*/,
 	size_t */*size*/);
 
+int
+_asn1_encode_fuzzer (
+	const struct asn1_template */*t*/,
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const void */*data*/,
+	size_t */*size*/);
+
 void
 _asn1_free (
 	const struct asn1_template */*t*/,
 	void */*data*/);
 
+void
+_asn1_free_top (
+	const struct asn1_template */*t*/,
+	void */*data*/);
+
 size_t
 _asn1_length (
 	const struct asn1_template */*t*/,
 	const void */*data*/);
 
+size_t
+_asn1_length_fuzzer (
+	const struct asn1_template */*t*/,
+	const void */*data*/);
+
+size_t
+_asn1_sizeofType (const struct asn1_template */*t*/);
+
 struct tm *
 _der_gmtime (
 	time_t /*t*/,
@@ -70,9 +105,15 @@ _heim_fix_dce (
 size_t
 _heim_len_int (int /*val*/);
 
+size_t
+_heim_len_int64 (int64_t /*val*/);
+
 size_t
 _heim_len_unsigned (unsigned /*val*/);
 
+size_t
+_heim_len_unsigned64 (uint64_t /*val*/);
+
 int
 _heim_time2generalizedtime (
 	time_t /*t*/,
diff --git a/crypto/external/bsd/heimdal/include/der-protos.h b/crypto/external/bsd/heimdal/include/der-protos.h
index 3b3d81d17..9f7094117 100644
--- a/crypto/external/bsd/heimdal/include/der-protos.h
+++ b/crypto/external/bsd/heimdal/include/der-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __der_protos_h__
 #define __der_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -8,6 +9,18 @@
 extern "C" {
 #endif
 
+int
+asn1_fuzzer_done (void);
+
+int
+asn1_fuzzer_method (const char */*mode*/);
+
+void
+asn1_fuzzer_next (void);
+
+void
+asn1_fuzzer_reset (void);
+
 int
 copy_heim_any (
 	const heim_any */*from*/,
@@ -67,6 +80,11 @@ der_copy_integer (
 	const int */*from*/,
 	int */*to*/);
 
+int
+der_copy_integer64 (
+	const int64_t */*from*/,
+	int64_t */*to*/);
+
 int
 der_copy_octet_string (
 	const heim_octet_string */*from*/,
@@ -92,6 +110,11 @@ der_copy_unsigned (
 	const unsigned */*from*/,
 	unsigned */*to*/);
 
+int
+der_copy_unsigned64 (
+	const uint64_t */*from*/,
+	uint64_t */*to*/);
+
 int
 der_copy_utctime (
 	const time_t */*from*/,
@@ -128,6 +151,9 @@ der_free_ia5_string (heim_ia5_string */*str*/);
 void
 der_free_integer (int */*i*/);
 
+void
+der_free_integer64 (int64_t */*i*/);
+
 void
 der_free_octet_string (heim_octet_string */*k*/);
 
@@ -143,6 +169,9 @@ der_free_universal_string (heim_universal_string */*k*/);
 void
 der_free_unsigned (unsigned */*u*/);
 
+void
+der_free_unsigned64 (uint64_t */*u*/);
+
 void
 der_free_utctime (time_t */*t*/);
 
@@ -214,6 +243,13 @@ der_get_integer (
 	int */*ret*/,
 	size_t */*size*/);
 
+int
+der_get_integer64 (
+	const unsigned char */*p*/,
+	size_t /*len*/,
+	int64_t */*ret*/,
+	size_t */*size*/);
+
 int
 der_get_length (
 	const unsigned char */*p*/,
@@ -253,7 +289,7 @@ int
 der_get_tag (
 	const unsigned char */*p*/,
 	size_t /*len*/,
-	Der_class */*class*/,
+	Der_class */*cls*/,
 	Der_type */*type*/,
 	unsigned int */*tag*/,
 	size_t */*size*/);
@@ -284,6 +320,13 @@ der_get_unsigned (
 	unsigned */*ret*/,
 	size_t */*size*/);
 
+int
+der_get_unsigned64 (
+	const unsigned char */*p*/,
+	size_t /*len*/,
+	uint64_t */*ret*/,
+	size_t */*size*/);
+
 int
 der_get_utctime (
 	const unsigned char */*p*/,
@@ -367,6 +410,9 @@ der_length_ia5_string (const heim_ia5_string */*data*/);
 size_t
 der_length_integer (const int */*data*/);
 
+size_t
+der_length_integer64 (const int64_t */*data*/);
+
 size_t
 der_length_len (size_t /*len*/);
 
@@ -388,6 +434,9 @@ der_length_universal_string (const heim_universal_string */*data*/);
 size_t
 der_length_unsigned (const unsigned */*data*/);
 
+size_t
+der_length_unsigned64 (const uint64_t */*data*/);
+
 size_t
 der_length_utctime (const time_t */*t*/);
 
@@ -401,7 +450,7 @@ int
 der_match_tag (
 	const unsigned char */*p*/,
 	size_t /*len*/,
-	Der_class /*class*/,
+	Der_class /*cls*/,
 	Der_type /*type*/,
 	unsigned int /*tag*/,
 	size_t */*size*/);
@@ -410,7 +459,7 @@ int
 der_match_tag2 (
 	const unsigned char */*p*/,
 	size_t /*len*/,
-	Der_class /*class*/,
+	Der_class /*cls*/,
 	Der_type */*type*/,
 	unsigned int /*tag*/,
 	size_t */*size*/);
@@ -419,7 +468,7 @@ int
 der_match_tag_and_length (
 	const unsigned char */*p*/,
 	size_t /*len*/,
-	Der_class /*class*/,
+	Der_class /*cls*/,
 	Der_type */*type*/,
 	unsigned int /*tag*/,
 	size_t */*length_ret*/,
@@ -508,6 +557,13 @@ der_put_integer (
 	const int */*v*/,
 	size_t */*size*/);
 
+int
+der_put_integer64 (
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const int64_t */*v*/,
+	size_t */*size*/);
+
 int
 der_put_length (
 	unsigned char */*p*/,
@@ -569,6 +625,13 @@ der_put_unsigned (
 	const unsigned */*v*/,
 	size_t */*size*/);
 
+int
+der_put_unsigned64 (
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const uint64_t */*v*/,
+	size_t */*size*/);
+
 int
 der_put_utctime (
 	unsigned char */*p*/,
@@ -625,4 +688,5 @@ length_heim_any_set (const heim_any */*data*/);
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __der_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/gsskrb5-private.h b/crypto/external/bsd/heimdal/include/gsskrb5-private.h
index 2a669d867..e05d4a6b6 100644
--- a/crypto/external/bsd/heimdal/include/gsskrb5-private.h
+++ b/crypto/external/bsd/heimdal/include/gsskrb5-private.h
@@ -178,6 +178,17 @@ _gssapi_unwrap_cfx_iov (
 	gss_iov_buffer_desc */*iov*/,
 	int /*iov_count*/);
 
+OM_uint32
+_gssapi_unwrap_iov_arcfour (
+	OM_uint32 */*minor_status*/,
+	gsskrb5_ctx /*ctx*/,
+	krb5_context /*context*/,
+	int */*pconf_state*/,
+	gss_qop_t */*pqop_state*/,
+	gss_iov_buffer_desc */*iov*/,
+	int /*iov_count*/,
+	krb5_keyblock */*key*/);
+
 OM_uint32
 _gssapi_verify_mech_header (
 	u_char **/*str*/,
@@ -242,6 +253,28 @@ _gssapi_wrap_cfx_iov (
 	gss_iov_buffer_desc */*iov*/,
 	int /*iov_count*/);
 
+OM_uint32
+_gssapi_wrap_iov_arcfour (
+	OM_uint32 */*minor_status*/,
+	gsskrb5_ctx /*ctx*/,
+	krb5_context /*context*/,
+	int /*conf_req_flag*/,
+	int */*conf_state*/,
+	gss_iov_buffer_desc */*iov*/,
+	int /*iov_count*/,
+	krb5_keyblock */*key*/);
+
+OM_uint32
+_gssapi_wrap_iov_length_arcfour (
+	OM_uint32 */*minor_status*/,
+	gsskrb5_ctx /*ctx*/,
+	krb5_context /*context*/,
+	int /*conf_req_flag*/,
+	gss_qop_t /*qop_req*/,
+	int */*conf_state*/,
+	gss_iov_buffer_desc */*iov*/,
+	int /*iov_count*/);
+
 OM_uint32
 _gssapi_wrap_iov_length_cfx (
 	OM_uint32 */*minor_status*/,
@@ -278,7 +311,7 @@ OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_accept_sec_context (
 	OM_uint32 * /*minor_status*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_cred_id_t /*acceptor_cred_handle*/,
+	gss_const_cred_id_t /*acceptor_cred_handle*/,
 	const gss_buffer_t /*input_token_buffer*/,
 	const gss_channel_bindings_t /*input_chan_bindings*/,
 	gss_name_t * /*src_name*/,
@@ -291,7 +324,7 @@ _gsskrb5_accept_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_acquire_cred (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*desired_name*/,
+	gss_const_name_t /*desired_name*/,
 	OM_uint32 /*time_req*/,
 	const gss_OID_set /*desired_mechs*/,
 	gss_cred_usage_t /*cred_usage*/,
@@ -302,7 +335,7 @@ _gsskrb5_acquire_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_acquire_cred_ext (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*desired_name*/,
+	gss_const_name_t /*desired_name*/,
 	gss_const_OID /*credential_type*/,
 	const void */*credential_data*/,
 	OM_uint32 /*time_req*/,
@@ -313,8 +346,8 @@ _gsskrb5_acquire_cred_ext (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_add_cred (
 	 OM_uint32 */*minor_status*/,
-	const gss_cred_id_t /*input_cred_handle*/,
-	const gss_name_t /*desired_name*/,
+	gss_const_cred_id_t /*input_cred_handle*/,
+	gss_const_name_t /*desired_name*/,
 	const gss_OID /*desired_mech*/,
 	gss_cred_usage_t /*cred_usage*/,
 	OM_uint32 /*initiator_time_req*/,
@@ -327,7 +360,7 @@ _gsskrb5_add_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_authorize_localname (
 	OM_uint32 */*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_const_buffer_t /*user_name*/,
 	gss_const_OID /*user_name_type*/);
 
@@ -335,15 +368,13 @@ OM_uint32
 _gsskrb5_canon_name (
 	OM_uint32 */*minor_status*/,
 	krb5_context /*context*/,
-	int /*use_dns*/,
-	krb5_const_principal /*sourcename*/,
-	gss_name_t /*targetname*/,
+	gss_const_name_t /*targetname*/,
 	krb5_principal */*out*/);
 
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_canonicalize_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * output_name );
 
@@ -353,14 +384,14 @@ _gsskrb5_clear_status (void);
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_compare_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*name1*/,
-	const gss_name_t /*name2*/,
+	gss_const_name_t /*name1*/,
+	gss_const_name_t /*name2*/,
 	int * name_equal );
 
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_context_time (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	OM_uint32 * time_rec );
 
 OM_uint32
@@ -406,7 +437,7 @@ _gsskrb5_delete_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_display_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t /*output_name_buffer*/,
 	gss_OID * output_name_type );
 
@@ -422,7 +453,7 @@ _gsskrb5_display_status (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_duplicate_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*src_name*/,
+	gss_const_name_t /*src_name*/,
 	gss_name_t * dest_name );
 
 void
@@ -459,13 +490,13 @@ _gsskrb5_export_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_export_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t exported_name );
 
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_export_sec_context (
-	 OM_uint32 * /*minor_status*/,
-	gss_ctx_id_t * /*context_handle*/,
+	 OM_uint32 */*minor_status*/,
+	gss_ctx_id_t */*context_handle*/,
 	gss_buffer_t interprocess_token );
 
 ssize_t
@@ -477,7 +508,7 @@ _gsskrb5_get_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_get_mic (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*message_buffer*/,
 	gss_buffer_t message_token );
@@ -518,9 +549,9 @@ _gsskrb5_init (krb5_context */*context*/);
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_init_sec_context (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_name_t /*target_name*/,
+	gss_const_name_t /*target_name*/,
 	const gss_OID /*mech_type*/,
 	OM_uint32 /*req_flags*/,
 	OM_uint32 /*time_req*/,
@@ -534,7 +565,7 @@ _gsskrb5_init_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_context (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_name_t * /*src_name*/,
 	gss_name_t * /*targ_name*/,
 	OM_uint32 * /*lifetime_rec*/,
@@ -546,7 +577,7 @@ _gsskrb5_inquire_context (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_cred (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	gss_name_t * /*output_name*/,
 	OM_uint32 * /*lifetime*/,
 	gss_cred_usage_t * /*cred_usage*/,
@@ -555,7 +586,7 @@ _gsskrb5_inquire_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_cred_by_mech (
 	 OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * /*name*/,
 	OM_uint32 * /*initiator_lifetime*/,
@@ -565,14 +596,14 @@ _gsskrb5_inquire_cred_by_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_cred_by_oid (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	const gss_OID /*desired_object*/,
 	gss_buffer_set_t */*data_set*/);
 
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_mechs_for_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_OID_set * mech_types );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -584,7 +615,7 @@ _gsskrb5_inquire_names_for_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_inquire_sec_context_by_oid (
 	OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_OID /*desired_object*/,
 	gss_buffer_set_t */*data_set*/);
 
@@ -606,9 +637,16 @@ OM_uint32
 _gsskrb5_lifetime_left (
 	OM_uint32 */*minor_status*/,
 	krb5_context /*context*/,
-	OM_uint32 /*lifetime*/,
+	OM_uint32 /*endtime*/,
 	OM_uint32 */*lifetime_rec*/);
 
+OM_uint32 GSSAPI_CALLCONV
+_gsskrb5_localname (
+	OM_uint32 */*minor_status*/,
+	gss_const_name_t /*pname*/,
+	const gss_OID /*mech_type*/,
+	gss_buffer_t /*localname*/);
+
 void *
 _gsskrb5_make_header (
 	void */*ptr*/,
@@ -616,17 +654,10 @@ _gsskrb5_make_header (
 	const void */*type*/,
 	const gss_OID /*mech*/);
 
-OM_uint32 GSSAPI_CALLCONV
-_gsskrb5_pname_to_uid (
-	OM_uint32 */*minor_status*/,
-	const gss_name_t /*pname*/,
-	const gss_OID /*mech_type*/,
-	uid_t */*uidp*/);
-
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_process_context_token (
 	 OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t token_buffer );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -692,7 +723,7 @@ _gsskrb5_store_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_unwrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*input_message_buffer*/,
 	gss_buffer_t /*output_message_buffer*/,
 	int * /*conf_state*/,
@@ -716,7 +747,7 @@ _gsskrb5_verify_header (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_verify_mic (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*message_buffer*/,
 	const gss_buffer_t /*token_buffer*/,
 	gss_qop_t * qop_state );
@@ -734,7 +765,7 @@ _gsskrb5_verify_mic_internal (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_wrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*input_message_buffer*/,
@@ -744,7 +775,7 @@ _gsskrb5_wrap (
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_wrap_size_limit (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	OM_uint32 /*req_output_size*/,
diff --git a/crypto/external/bsd/heimdal/include/hdb-private.h b/crypto/external/bsd/heimdal/include/hdb-private.h
index 8a7486944..826819976 100644
--- a/crypto/external/bsd/heimdal/include/hdb-private.h
+++ b/crypto/external/bsd/heimdal/include/hdb-private.h
@@ -15,7 +15,7 @@ _hdb_fetch_kvno (
 
 hdb_master_key
 _hdb_find_master_key (
-	uint32_t */*mkvno*/,
+	unsigned int */*mkvno*/,
 	hdb_master_key /*mkey*/);
 
 krb5_error_code
@@ -24,6 +24,19 @@ _hdb_keytab2hdb_entry (
 	const krb5_keytab_entry */*ktentry*/,
 	hdb_entry_ex */*entry*/);
 
+krb5_error_code
+_hdb_mdb_value2entry (
+	krb5_context /*context*/,
+	krb5_data */*data*/,
+	krb5_kvno /*target_kvno*/,
+	hdb_entry */*entry*/);
+
+int
+_hdb_mit_dump2mitdb_entry (
+	krb5_context /*context*/,
+	char */*line*/,
+	krb5_storage */*sp*/);
+
 int
 _hdb_mkey_decrypt (
 	krb5_context /*context*/,
@@ -49,8 +62,15 @@ krb5_error_code
 _hdb_remove (
 	krb5_context /*context*/,
 	HDB */*db*/,
+	unsigned /*flags*/,
 	krb5_const_principal /*principal*/);
 
+krb5_error_code
+_hdb_set_master_key_usage (
+	krb5_context /*context*/,
+	HDB */*db*/,
+	unsigned int /*key_usage*/);
+
 krb5_error_code
 _hdb_store (
 	krb5_context /*context*/,
diff --git a/crypto/external/bsd/heimdal/include/hdb-protos.h b/crypto/external/bsd/heimdal/include/hdb-protos.h
index 44a1bddc7..fe6755587 100644
--- a/crypto/external/bsd/heimdal/include/hdb-protos.h
+++ b/crypto/external/bsd/heimdal/include/hdb-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __hdb_protos_h__
 #define __hdb_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -8,12 +9,64 @@
 extern "C" {
 #endif
 
+krb5_error_code
+entry2mit_string_int (
+	krb5_context /*context*/,
+	krb5_storage */*sp*/,
+	hdb_entry */*ent*/);
+
+/**
+ * This function adds an HDB entry's current keyset to the entry's key
+ * history.  The current keyset is left alone; the caller is responsible
+ * for freeing it.
+ *
+ * @param context   Context
+ * @param entry	    HDB entry
+ */
+
+krb5_error_code
+hdb_add_current_keys_to_history (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/);
+
+/**
+ * This function adds a key to an HDB entry's key history.
+ *
+ * @param context   Context
+ * @param entry	    HDB entry
+ * @param kvno	    Key version number of the key to add to the history
+ * @param key	    The Key to add
+ */
+
+krb5_error_code
+hdb_add_history_key (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/,
+	krb5_kvno /*kvno*/,
+	Key */*key*/);
+
 krb5_error_code
 hdb_add_master_key (
 	krb5_context /*context*/,
 	krb5_keyblock */*key*/,
 	hdb_master_key */*inout*/);
 
+/**
+ * This function changes an hdb_entry's kvno, swapping the current key
+ * set with a historical keyset.  If no historical keys are found then
+ * an error is returned (the caller can still set entry->kvno directly).
+ *
+ * @param context	krb5_context
+ * @param new_kvno	New kvno for the entry
+ * @param entry		hdb_entry to modify
+ */
+
+krb5_error_code
+hdb_change_kvno (
+	krb5_context /*context*/,
+	krb5_kvno /*new_kvno*/,
+	hdb_entry */*entry*/);
+
 krb5_error_code
 hdb_check_db_format (
 	krb5_context /*context*/,
@@ -30,6 +83,14 @@ hdb_clear_master_key (
 	krb5_context /*context*/,
 	HDB */*db*/);
 
+/**
+ * Create a handle for a Kerberos database
+ *
+ * Create a handle for a Kerberos database backend specified by a
+ * filename.  Doesn't create a file if its doesn't exists, you have to
+ * use O_CREAT to tell the backend to create the file.
+ */
+
 krb5_error_code
 hdb_create (
 	krb5_context /*context*/,
@@ -37,11 +98,25 @@ hdb_create (
 	const char */*filename*/);
 
 krb5_error_code
-hdb_db_create (
+hdb_db1_create (
 	krb5_context /*context*/,
 	HDB **/*db*/,
 	const char */*filename*/);
 
+krb5_error_code
+hdb_db3_create (
+	krb5_context /*context*/,
+	HDB **/*db*/,
+	const char */*filename*/);
+
+/**
+ * Return the directory where the hdb database resides.
+ *
+ * @param context Kerberos 5 context.
+ *
+ * @return string pointing to directory.
+ */
+
 const char *
 hdb_db_dir (krb5_context /*context*/);
 
@@ -85,6 +160,14 @@ hdb_dbinfo_get_realm (
 	krb5_context /*context*/,
 	struct hdb_dbinfo */*dbp*/);
 
+/**
+ * Return the default hdb database resides.
+ *
+ * @param context Kerberos 5 context.
+ *
+ * @return string pointing to directory.
+ */
+
 const char *
 hdb_default_db (krb5_context /*context*/);
 
@@ -92,6 +175,7 @@ krb5_error_code
 hdb_enctype2key (
 	krb5_context /*context*/,
 	hdb_entry */*e*/,
+	const Keys */*keyset*/,
 	krb5_enctype /*enctype*/,
 	Key **/*key*/);
 
@@ -118,6 +202,16 @@ hdb_entry_check_mandatory (
 	krb5_context /*context*/,
 	const hdb_entry */*ent*/);
 
+krb5_error_code
+hdb_entry_clear_kvno_diff_clnt (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/);
+
+krb5_error_code
+hdb_entry_clear_kvno_diff_svc (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/);
+
 int
 hdb_entry_clear_password (
 	krb5_context /*context*/,
@@ -133,6 +227,12 @@ hdb_entry_get_aliases (
 	const hdb_entry */*entry*/,
 	const HDB_Ext_Aliases **/*a*/);
 
+unsigned int
+hdb_entry_get_kvno_diff_clnt (const hdb_entry */*entry*/);
+
+unsigned int
+hdb_entry_get_kvno_diff_svc (const hdb_entry */*entry*/);
+
 int
 hdb_entry_get_password (
 	krb5_context /*context*/,
@@ -160,6 +260,18 @@ hdb_entry_get_pw_change_time (
 	const hdb_entry */*entry*/,
 	time_t */*t*/);
 
+krb5_error_code
+hdb_entry_set_kvno_diff_clnt (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/,
+	unsigned int /*diff*/);
+
+krb5_error_code
+hdb_entry_set_kvno_diff_svc (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/,
+	unsigned int /*diff*/);
+
 int
 hdb_entry_set_password (
 	krb5_context /*context*/,
@@ -214,6 +326,8 @@ krb5_error_code
 hdb_generate_key_set (
 	krb5_context /*context*/,
 	krb5_principal /*principal*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	int /*n_ks_tuple*/,
 	Key **/*ret_key_set*/,
 	size_t */*nkeyset*/,
 	int /*no_salt*/);
@@ -223,6 +337,8 @@ hdb_generate_key_set_password (
 	krb5_context /*context*/,
 	krb5_principal /*principal*/,
 	const char */*password*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	int /*n_ks_tuple*/,
 	Key **/*keys*/,
 	size_t */*num_keys*/);
 
@@ -248,6 +364,12 @@ hdb_keytab_create (
 	HDB ** /*db*/,
 	const char */*arg*/);
 
+const Keys *
+hdb_kvno2keys (
+	krb5_context /*context*/,
+	const hdb_entry */*e*/,
+	krb5_kvno /*kvno*/);
+
 krb5_error_code
 hdb_ldap_create (
 	krb5_context /*context*/,
@@ -276,6 +398,12 @@ hdb_mdb_create (
 	HDB **/*db*/,
 	const char */*filename*/);
 
+krb5_error_code
+hdb_mitdb_create (
+	krb5_context /*context*/,
+	HDB **/*db*/,
+	const char */*filename*/);
+
 krb5_error_code
 hdb_ndbm_create (
 	krb5_context /*context*/,
@@ -286,6 +414,7 @@ krb5_error_code
 hdb_next_enctype2key (
 	krb5_context /*context*/,
 	const hdb_entry */*e*/,
+	const Keys */*keyset*/,
 	krb5_enctype /*enctype*/,
 	Key **/*key*/);
 
@@ -310,6 +439,19 @@ hdb_process_master_key (
 	krb5_enctype /*etype*/,
 	hdb_master_key */*mkey*/);
 
+/**
+ * This function prunes an HDB entry's keys that are too old to have been used
+ * to mint still valid tickets (based on the entry's maximum ticket lifetime).
+ * 
+ * @param context   Context
+ * @param entry	    HDB entry
+ */
+
+krb5_error_code
+hdb_prune_keys (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/);
+
 krb5_error_code
 hdb_read_master_key (
 	krb5_context /*context*/,
@@ -346,6 +488,13 @@ hdb_seal_keys_mkey (
 	hdb_entry */*ent*/,
 	hdb_master_key /*mkey*/);
 
+krb5_error_code
+hdb_set_last_modified_by (
+	krb5_context /*context*/,
+	hdb_entry */*entry*/,
+	krb5_principal /*modby*/,
+	time_t /*modtime*/);
+
 krb5_error_code
 hdb_set_master_key (
 	krb5_context /*context*/,
@@ -358,11 +507,21 @@ hdb_set_master_keyfile (
 	HDB */*db*/,
 	const char */*keyfile*/);
 
+/**
+ * Create SQLITE object, and creates the on disk database if its doesn't exists.
+ *
+ * @param context A Kerberos 5 context.
+ * @param db a returned database handle.
+ * @param filename filename
+ *
+ * @return        0 on success, an error code if not
+ */
+
 krb5_error_code
 hdb_sqlite_create (
 	krb5_context /*context*/,
 	HDB **/*db*/,
-	const char */*argument*/);
+	const char */*filename*/);
 
 krb5_error_code
 hdb_unlock (int /*fd*/);
@@ -385,6 +544,14 @@ hdb_unseal_keys (
 	HDB */*db*/,
 	hdb_entry */*ent*/);
 
+krb5_error_code
+hdb_unseal_keys_kvno (
+	krb5_context /*context*/,
+	HDB */*db*/,
+	krb5_kvno /*kvno*/,
+	unsigned /*flags*/,
+	hdb_entry */*ent*/);
+
 krb5_error_code
 hdb_unseal_keys_mkey (
 	krb5_context /*context*/,
@@ -413,4 +580,5 @@ hdb_write_master_key (
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __hdb_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/heimntlm-protos.h b/crypto/external/bsd/heimdal/include/heimntlm-protos.h
index 5f56536ff..b44dbc312 100644
--- a/crypto/external/bsd/heimdal/include/heimntlm-protos.h
+++ b/crypto/external/bsd/heimdal/include/heimntlm-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __heimntlm_protos_h__
 #define __heimntlm_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -8,6 +9,20 @@
 extern "C" {
 #endif
 
+/**
+ * Generates an NTLMv1 session random with assosited session master key.
+ *
+ * @param key the ntlm v1 key
+ * @param len length of key
+ * @param session generated session nonce, should be freed with heim_ntlm_free_buf().
+ * @param master calculated session master key, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_build_ntlm1_master (
 	void */*key*/,
@@ -15,6 +30,21 @@ heim_ntlm_build_ntlm1_master (
 	struct ntlm_buf */*session*/,
 	struct ntlm_buf */*master*/);
 
+/**
+ * Generates an NTLMv2 session random with associated session master key.
+ *
+ * @param key the NTLMv2 key
+ * @param len length of key
+ * @param blob the NTLMv2 "blob"
+ * @param session generated session nonce, should be freed with heim_ntlm_free_buf().
+ * @param master calculated session master key, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_build_ntlm2_master (
 	void */*key*/,
@@ -23,6 +53,23 @@ heim_ntlm_build_ntlm2_master (
 	struct ntlm_buf */*session*/,
 	struct ntlm_buf */*master*/);
 
+/**
+ * Calculate LMv2 response
+ *
+ * @param key the ntlm key
+ * @param len length of key
+ * @param username name of the user, as sent in the message, assumed to be in UTF8.
+ * @param target the name of the target, assumed to be in UTF8.
+ * @param serverchallenge challenge as sent by the server in the type2 message.
+ * @param ntlmv2 calculated session key
+ * @param answer ntlm response answer, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_calculate_lm2 (
 	const void */*key*/,
@@ -33,6 +80,20 @@ heim_ntlm_calculate_lm2 (
 	unsigned char ntlmv2[16],
 	struct ntlm_buf */*answer*/);
 
+/**
+ * Calculate NTLMv1 response hash
+ *
+ * @param key the ntlm v1 key
+ * @param len length of key
+ * @param challenge sent by the server
+ * @param answer calculated answer, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_calculate_ntlm1 (
 	void */*key*/,
@@ -40,6 +101,24 @@ heim_ntlm_calculate_ntlm1 (
 	unsigned char challenge[8],
 	struct ntlm_buf */*answer*/);
 
+/**
+ * Calculate NTLMv2 response
+ *
+ * @param key the ntlm key
+ * @param len length of key
+ * @param username name of the user, as sent in the message, assumed to be in UTF8.
+ * @param target the name of the target, assumed to be in UTF8.
+ * @param serverchallenge challenge as sent by the server in the type2 message.
+ * @param infotarget infotarget as sent by the server in the type2 message.
+ * @param ntlmv2 calculated session key
+ * @param answer ntlm response answer, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_calculate_ntlm2 (
 	const void */*key*/,
@@ -51,6 +130,10 @@ heim_ntlm_calculate_ntlm2 (
 	unsigned char ntlmv2[16],
 	struct ntlm_buf */*answer*/);
 
+/**
+     * Third check with empty domain.
+ */
+
 int
 heim_ntlm_calculate_ntlm2_sess (
 	const unsigned char clnt_nonce[8],
@@ -65,6 +148,19 @@ heim_ntlm_calculate_ntlm2_sess_hash (
 	const unsigned char svr_chal[8],
 	unsigned char verifier[8]);
 
+/**
+ * Decodes an NTLM targetinfo message
+ *
+ * @param data input data buffer with the encode NTLM targetinfo message
+ * @param ucs2 if the strings should be encoded with ucs2 (selected by flag in message).
+ * @param ti the decoded target info, should be freed with heim_ntlm_free_targetinfo().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_decode_targetinfo (
 	const struct ntlm_buf */*data*/,
@@ -95,42 +191,150 @@ heim_ntlm_derive_ntlm2_sess (
 	const unsigned char svr_chal[8],
 	unsigned char derivedkey[16]);
 
+/**
+ * Encodes a ntlm_targetinfo message.
+ *
+ * @param ti the ntlm_targetinfo message to encode.
+ * @param ucs2 ignored
+ * @param data is the return buffer with the encoded message, should be
+ * freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_encode_targetinfo (
 	const struct ntlm_targetinfo */*ti*/,
 	int /*ucs2*/,
 	struct ntlm_buf */*data*/);
 
+/**
+ * Encodes an ntlm_type1 message.
+ *
+ * @param type1 the ntlm_type1 message to encode.
+ * @param data is the return buffer with the encoded message, should be
+ * freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_encode_type1 (
 	const struct ntlm_type1 */*type1*/,
 	struct ntlm_buf */*data*/);
 
+/**
+ * Encodes an ntlm_type2 message.
+ *
+ * @param type2 the ntlm_type2 message to encode.
+ * @param data is the return buffer with the encoded message, should be
+ * freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_encode_type2 (
 	const struct ntlm_type2 */*type2*/,
 	struct ntlm_buf */*data*/);
 
+/**
+ * Encodes an ntlm_type3 message.
+ *
+ * @param type3 the ntlm_type3 message to encode.
+ * @param data is the return buffer with the encoded message, should be
+ * @param[out] mic_offset offset of message integrity code
+ * freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_encode_type3 (
 	const struct ntlm_type3 */*type3*/,
-	struct ntlm_buf */*data*/);
+	struct ntlm_buf */*data*/,
+	size_t */*mic_offset*/);
+
+/**
+ * heim_ntlm_free_buf frees the ntlm buffer
+ *
+ * @param p buffer to be freed
+ *
+ * @ingroup ntlm_core
+ */
 
 void
 heim_ntlm_free_buf (struct ntlm_buf */*p*/);
 
+/**
+ * Frees the ntlm_targetinfo message
+ *
+ * @param ti targetinfo to be freed
+ *
+ * @ingroup ntlm_core
+ */
+
 void
 heim_ntlm_free_targetinfo (struct ntlm_targetinfo */*ti*/);
 
+/**
+ * Frees the ntlm_type1 message
+ *
+ * @param data message to be freed
+ *
+ * @ingroup ntlm_core
+ */
+
 void
 heim_ntlm_free_type1 (struct ntlm_type1 */*data*/);
 
+/**
+ * Frees the ntlm_type2 message
+ *
+ * @param data message to be freed
+ *
+ * @ingroup ntlm_core
+ */
+
 void
 heim_ntlm_free_type2 (struct ntlm_type2 */*data*/);
 
+/**
+ * Frees the ntlm_type3 message
+ *
+ * @param data message to be freed
+ *
+ * @ingroup ntlm_core
+ */
+
 void
 heim_ntlm_free_type3 (struct ntlm_type3 */*data*/);
 
+/**
+ * Given a key and encrypted session, unwrap the session key
+ *
+ * @param baseKey the sessionBaseKey
+ * @param encryptedSession encrypted session, type3.session field.
+ * @param session generated session nonce, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_keyex_unwrap (
 	struct ntlm_buf */*baseKey*/,
@@ -143,19 +347,60 @@ heim_ntlm_keyex_wrap (
 	struct ntlm_buf */*session*/,
 	struct ntlm_buf */*encryptedSession*/);
 
+/**
+ * Calculate the NTLM key, the password is assumed to be in UTF8.
+ *
+ * @param password password to calcute the key for.
+ * @param key calcuted key, should be freed with heim_ntlm_free_buf().
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_nt_key (
 	const char */*password*/,
 	struct ntlm_buf */*key*/);
 
+/**
+ * Generates an NTLMv2 session key.
+ *
+ * @param key the ntlm key
+ * @param len length of key
+ * @param username name of the user, as sent in the message, assumed to be in UTF8.
+ * @param target the name of the target, assumed to be in UTF8.
+ * @param upper_case_target upper case the target, should not be used only for legacy systems
+ * @param ntlmv2 the ntlmv2 session key
+ *
+ * @return 0 on success, or an error code on failure.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_ntlmv2_key (
 	const void */*key*/,
 	size_t /*len*/,
 	const char */*username*/,
 	const char */*target*/,
+	int /*upper_case_target*/,
 	unsigned char ntlmv2[16]);
 
+time_t
+heim_ntlm_ts2unixtime (uint64_t /*t*/);
+
+uint64_t
+heim_ntlm_unix2ts_time (time_t /*unix_time*/);
+
+/**
+ @defgroup ntlm_core Heimdal NTLM library *
+ * The NTLM core functions implement the string2key generation
+ * function, message encode and decode function, and the hash function
+ * functions.
+ */
+
 size_t
 heim_ntlm_unparse_flags (
 	uint32_t /*flags*/,
@@ -175,6 +420,25 @@ heim_ntlm_v2_base_session (
 	struct ntlm_buf */*ntlmResponse*/,
 	struct ntlm_buf */*session*/);
 
+/**
+ * Verify NTLMv2 response.
+ *
+ * @param key the ntlm key
+ * @param len length of key
+ * @param username name of the user, as sent in the message, assumed to be in UTF8.
+ * @param target the name of the target, assumed to be in UTF8.
+ * @param now the time now (0 if the library should pick it up itself)
+ * @param serverchallenge challenge as sent by the server in the type2 message.
+ * @param answer ntlm response answer, should be freed with heim_ntlm_free_buf().
+ * @param infotarget infotarget as sent by the server in the type2 message.
+ * @param ntlmv2 calculated session key
+ *
+ * @return In case of success 0 is return, an errors, a errno in what
+ * went wrong.
+ *
+ * @ingroup ntlm_core
+ */
+
 int
 heim_ntlm_verify_ntlm2 (
 	const void */*key*/,
@@ -191,4 +455,5 @@ heim_ntlm_verify_ntlm2 (
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __heimntlm_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/hx509-private.h b/crypto/external/bsd/heimdal/include/hx509-private.h
index 60891f27f..72d3bbdfa 100644
--- a/crypto/external/bsd/heimdal/include/hx509-private.h
+++ b/crypto/external/bsd/heimdal/include/hx509-private.h
@@ -30,7 +30,7 @@ void
 _hx509_abort (
 	const char */*fmt*/,
 	...)
-     __attribute__ ((noreturn, format (printf, 1, 2)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 1, 2)));
 
 int
 _hx509_calculate_path (
@@ -193,6 +193,9 @@ _hx509_find_extension_subject_key_id (
 	const Certificate */*issuer*/,
 	SubjectKeyIdentifier */*si*/);
 
+const struct signature_alg *
+_hx509_find_sig_alg (const heim_oid */*oid*/);
+
 int
 _hx509_generate_private_key (
 	hx509_context /*context*/,
@@ -333,6 +336,9 @@ _hx509_pi_printf (
 	const char */*fmt*/,
 	...);
 
+void
+_hx509_private_eckey_free (void */*eckey*/);
+
 int
 _hx509_private_key_export (
 	hx509_context /*context*/,
@@ -440,10 +446,16 @@ _hx509_set_cert_attribute (
 	const heim_octet_string */*attr*/);
 
 int
-_hx509_signature_best_before (
+_hx509_set_digest_alg (
+	DigestAlgorithmIdentifier */*id*/,
+	const heim_oid */*oid*/,
+	const void */*param*/,
+	size_t /*length*/);
+
+int
+_hx509_signature_is_weak (
 	hx509_context /*context*/,
-	const AlgorithmIdentifier */*alg*/,
-	time_t /*t*/);
+	const AlgorithmIdentifier */*alg*/);
 
 void
 _hx509_unmap_file_os (heim_octet_string */*os*/);
diff --git a/crypto/external/bsd/heimdal/include/hx509-protos.h b/crypto/external/bsd/heimdal/include/hx509-protos.h
index d03c7767e..8de7a67ab 100644
--- a/crypto/external/bsd/heimdal/include/hx509-protos.h
+++ b/crypto/external/bsd/heimdal/include/hx509-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __hx509_protos_h__
 #define __hx509_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -21,12 +22,47 @@ extern "C" {
 #endif
 #endif
 #endif
+/**
+ * Print a bitstring using a hx509_vprint_func function. To print to
+ * stdout use hx509_print_stdout().
+ *
+ * @param b bit string to print.
+ * @param func hx509_vprint_func to print with.
+ * @param ctx context variable to hx509_vprint_func function.
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_bitstring_print (
 	const heim_bit_string */*b*/,
 	hx509_vprint_func /*func*/,
 	void */*ctx*/);
 
+/**
+ * Sign a to-be-signed certificate object with a issuer certificate.
+ *
+ * The caller needs to at least have called the following functions on the
+ * to-be-signed certificate object:
+ * - hx509_ca_tbs_init()
+ * - hx509_ca_tbs_set_subject()
+ * - hx509_ca_tbs_set_spki()
+ *
+ * When done the to-be-signed certificate object should be freed with
+ * hx509_ca_tbs_free().
+ *
+ * When creating self-signed certificate use hx509_ca_sign_self() instead.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param signer the CA certificate object to sign with (need private key).
+ * @param certificate return cerificate, free with hx509_cert_free().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_sign (
 	hx509_context /*context*/,
@@ -34,6 +70,19 @@ hx509_ca_sign (
 	hx509_cert /*signer*/,
 	hx509_cert */*certificate*/);
 
+/**
+ * Work just like hx509_ca_sign() but signs it-self.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param signer private key to sign with.
+ * @param certificate return cerificate, free with hx509_cert_free().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_sign_self (
 	hx509_context /*context*/,
@@ -41,6 +90,20 @@ hx509_ca_sign_self (
 	hx509_private_key /*signer*/,
 	hx509_cert */*certificate*/);
 
+/**
+ * Add CRL distribution point URI to the to-be-signed certificate
+ * object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param uri uri to the CRL.
+ * @param issuername name of the issuer.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_crl_dp_uri (
 	hx509_context /*context*/,
@@ -48,30 +111,99 @@ hx509_ca_tbs_add_crl_dp_uri (
 	const char */*uri*/,
 	hx509_name /*issuername*/);
 
+/**
+ * An an extended key usage to the to-be-signed certificate object.
+ * Duplicates will detected and not added.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param oid extended key usage to add.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_eku (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const heim_oid */*oid*/);
 
+/**
+ * Add a Subject Alternative Name hostname to to-be-signed certificate
+ * object. A domain match starts with ., an exact match does not.
+ *
+ * Example of a an domain match: .domain.se matches the hostname
+ * host.domain.se.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param dnsname a hostame.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_hostname (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const char */*dnsname*/);
 
+/**
+ * Add a Jabber/XMPP jid Subject Alternative Name to the to-be-signed
+ * certificate object. The jid is an UTF8 string.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param jid string of an a jabber id in UTF8.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_jid (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const char */*jid*/);
 
+/**
+ * Add Microsoft UPN Subject Alternative Name to the to-be-signed
+ * certificate object. The principal string is a UTF8 string.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param principal Microsoft UPN string.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_ms_upn (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const char */*principal*/);
 
+/**
+ * Add Subject Alternative Name otherName to the to-be-signed
+ * certificate object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param oid the oid of the OtherName.
+ * @param os data in the other name.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_otherName (
 	hx509_context /*context*/,
@@ -79,79 +211,273 @@ hx509_ca_tbs_add_san_otherName (
 	const heim_oid */*oid*/,
 	const heim_octet_string */*os*/);
 
+/**
+ * Add Kerberos Subject Alternative Name to the to-be-signed
+ * certificate object. The principal string is a UTF8 string.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param principal Kerberos principal to add to the certificate.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_pkinit (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const char */*principal*/);
 
+/**
+ * Add a Subject Alternative Name rfc822 (email address) to
+ * to-be-signed certificate object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param rfc822Name a string to a email address.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_add_san_rfc822name (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const char */*rfc822Name*/);
 
+/**
+ * Free an To Be Signed object.
+ *
+ * @param tbs object to free.
+ *
+ * @ingroup hx509_ca
+ */
+
 void
 hx509_ca_tbs_free (hx509_ca_tbs */*tbs*/);
 
+/**
+ * Allocate an to-be-signed certificate object that will be converted
+ * into an certificate.
+ *
+ * @param context A hx509 context.
+ * @param tbs returned to-be-signed certicate object, free with
+ * hx509_ca_tbs_free().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_init (
 	hx509_context /*context*/,
 	hx509_ca_tbs */*tbs*/);
 
+/**
+ * Make the to-be-signed certificate object a CA certificate. If the
+ * pathLenConstraint is negative path length constraint is used.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param pathLenConstraint path length constraint, negative, no
+ * constraint.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_ca (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	int /*pathLenConstraint*/);
 
+/**
+ * Make the to-be-signed certificate object a windows domain controller certificate.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_domaincontroller (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/);
 
+/**
+ * Set the absolute time when the certificate is valid to.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param t time when the certificate will expire
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_notAfter (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	time_t /*t*/);
 
+/**
+ * Set the relative time when the certificiate is going to expire.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param delta seconds to the certificate is going to expire.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_notAfter_lifetime (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	time_t /*delta*/);
 
+/**
+ * Set the absolute time when the certificate is valid from. If not
+ * set the current time will be used.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param t time the certificated will start to be valid
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_notBefore (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	time_t /*t*/);
 
+/**
+ * Make the to-be-signed certificate object a proxy certificate. If the
+ * pathLenConstraint is negative path length constraint is used.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param pathLenConstraint path length constraint, negative, no
+ * constraint.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_proxy (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	int /*pathLenConstraint*/);
 
+/**
+ * Set the serial number to use for to-be-signed certificate object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param serialNumber serial number to use for the to-be-signed
+ * certificate object.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_serialnumber (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const heim_integer */*serialNumber*/);
 
+/**
+ * Set signature algorithm on the to be signed certificate
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param sigalg signature algorithm to use
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
+int
+hx509_ca_tbs_set_signature_algorithm (
+	hx509_context /*context*/,
+	hx509_ca_tbs /*tbs*/,
+	const AlgorithmIdentifier */*sigalg*/);
+
+/**
+ * Set the subject public key info (SPKI) in the to-be-signed certificate
+ * object. SPKI is the public key and key related parameters in the
+ * certificate.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param spki subject public key info to use for the to-be-signed certificate object.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_spki (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	const SubjectPublicKeyInfo */*spki*/);
 
+/**
+ * Set the subject name of a to-be-signed certificate object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param subject the name to set a subject.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_subject (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	hx509_name /*subject*/);
 
+/**
+ * Initialize the to-be-signed certificate object from a template certifiate.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param flags bit field selecting what to copy from the template
+ * certifiate.
+ * @param cert template certificate.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_template (
 	hx509_context /*context*/,
@@ -159,6 +485,24 @@ hx509_ca_tbs_set_template (
 	int /*flags*/,
 	hx509_cert /*cert*/);
 
+/**
+ * Set the issuerUniqueID and subjectUniqueID
+ *
+ * These are only supposed to be used considered with version 2
+ * certificates, replaced by the two extensions SubjectKeyIdentifier
+ * and IssuerKeyIdentifier. This function is to allow application
+ * using legacy protocol to issue them.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param issuerUniqueID to be set
+ * @param subjectUniqueID to be set
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_set_unique (
 	hx509_context /*context*/,
@@ -166,21 +510,71 @@ hx509_ca_tbs_set_unique (
 	const heim_bit_string */*subjectUniqueID*/,
 	const heim_bit_string */*issuerUniqueID*/);
 
+/**
+ * Expand the the subject name in the to-be-signed certificate object
+ * using hx509_name_expand().
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param env environment variable to expand variables in the subject
+ * name, see hx509_env_init().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
 int
 hx509_ca_tbs_subject_expand (
 	hx509_context /*context*/,
 	hx509_ca_tbs /*tbs*/,
 	hx509_env /*env*/);
 
+/**
+ * Make of template units, use to build flags argument to
+ * hx509_ca_tbs_set_template() with parse_units().
+ *
+ * @return an units structure.
+ *
+ * @ingroup hx509_ca
+ */
+
 const struct units *
 hx509_ca_tbs_template_units (void);
 
+/**
+ * Encodes the hx509 certificate as a DER encode binary.
+ *
+ * @param context A hx509 context.
+ * @param c the certificate to encode.
+ * @param os the encode certificate, set to NULL, 0 on case of
+ * error. Free the os->data with hx509_xfree().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_binary (
 	hx509_context /*context*/,
 	hx509_cert /*c*/,
 	heim_octet_string */*os*/);
 
+/**
+ * Check the extended key usage on the hx509 certificate.
+ *
+ * @param context A hx509 context.
+ * @param cert A hx509 context.
+ * @param eku the EKU to check for
+ * @param allow_any_eku if the any EKU is set, allow that to be a
+ * substitute.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_check_eku (
 	hx509_context /*context*/,
@@ -188,11 +582,40 @@ hx509_cert_check_eku (
 	const heim_oid */*eku*/,
 	int /*allow_any_eku*/);
 
+/**
+ * Compare to hx509 certificate object, useful for sorting.
+ *
+ * @param p a hx509 certificate object.
+ * @param q a hx509 certificate object.
+ *
+ * @return 0 the objects are the same, returns > 0 is p is "larger"
+ * then q, < 0 if p is "smaller" then q.
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_cmp (
 	hx509_cert /*p*/,
 	hx509_cert /*q*/);
 
+/**
+ * Return a list of subjectAltNames specified by oid in the
+ * certificate. On error the
+ *
+ * The returned list of octet string should be freed with
+ * hx509_free_octet_string_list().
+ *
+ * @param context A hx509 context.
+ * @param cert a hx509 certificate object.
+ * @param oid an oid to for SubjectAltName.
+ * @param list list of matching SubjectAltName.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_find_subjectAltName_otherName (
 	hx509_context /*context*/,
@@ -200,62 +623,223 @@ hx509_cert_find_subjectAltName_otherName (
 	const heim_oid */*oid*/,
 	hx509_octet_string_list */*list*/);
 
+/**
+ * Free reference to the hx509 certificate object, if the refcounter
+ * reaches 0, the object if freed. Its allowed to pass in NULL.
+ *
+ * @param cert the cert to free.
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_cert_free (hx509_cert /*cert*/);
 
+/**
+ * Get the SubjectPublicKeyInfo structure from the hx509 certificate.
+ *
+ * @param context a hx509 context.
+ * @param p a hx509 certificate object.
+ * @param spki SubjectPublicKeyInfo, should be freed with
+ * free_SubjectPublicKeyInfo().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_SPKI (
 	hx509_context /*context*/,
 	hx509_cert /*p*/,
 	SubjectPublicKeyInfo */*spki*/);
 
+/**
+ * Get the AlgorithmIdentifier from the hx509 certificate.
+ *
+ * @param context a hx509 context.
+ * @param p a hx509 certificate object.
+ * @param alg AlgorithmIdentifier, should be freed with
+ *            free_AlgorithmIdentifier(). The algorithmidentifier is
+ *            typicly rsaEncryption, or id-ecPublicKey, or some other
+ *            public key mechanism.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_SPKI_AlgorithmIdentifier (
 	hx509_context /*context*/,
 	hx509_cert /*p*/,
 	AlgorithmIdentifier */*alg*/);
 
+/**
+ * Get an external attribute for the certificate, examples are
+ * friendly name and id.
+ *
+ * @param cert hx509 certificate object to search
+ * @param oid an oid to search for.
+ *
+ * @return an hx509_cert_attribute, only valid as long as the
+ * certificate is referenced.
+ *
+ * @ingroup hx509_cert
+ */
+
 hx509_cert_attribute
 hx509_cert_get_attribute (
 	hx509_cert /*cert*/,
 	const heim_oid */*oid*/);
 
+/**
+ * Return the name of the base subject of the hx509 certificate. If
+ * the certiicate is a verified proxy certificate, the this function
+ * return the base certificate (root of the proxy chain). If the proxy
+ * certificate is not verified with the base certificate
+ * HX509_PROXY_CERTIFICATE_NOT_CANONICALIZED is returned.
+ *
+ * @param context a hx509 context.
+ * @param c a hx509 certificate object.
+ * @param name a pointer to a hx509 name, should be freed by
+ * hx509_name_free(). See also hx509_cert_get_subject().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_base_subject (
 	hx509_context /*context*/,
 	hx509_cert /*c*/,
 	hx509_name */*name*/);
 
+/**
+ * Get friendly name of the certificate.
+ *
+ * @param cert cert to get the friendly name from.
+ *
+ * @return an friendly name or NULL if there is. The friendly name is
+ * only valid as long as the certificate is referenced.
+ *
+ * @ingroup hx509_cert
+ */
+
 const char *
 hx509_cert_get_friendly_name (hx509_cert /*cert*/);
 
+/**
+ * Return the name of the issuer of the hx509 certificate.
+ *
+ * @param p a hx509 certificate object.
+ * @param name a pointer to a hx509 name, should be freed by
+ * hx509_name_free().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_issuer (
 	hx509_cert /*p*/,
 	hx509_name */*name*/);
 
+/**
+ * Get a copy of the Issuer Unique ID
+ *
+ * @param context a hx509_context
+ * @param p a hx509 certificate
+ * @param issuer the issuer id returned, free with der_free_bit_string()
+ *
+ * @return An hx509 error code, see hx509_get_error_string(). The
+ * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
+ * doesn't have a issuerUniqueID
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_issuer_unique_id (
 	hx509_context /*context*/,
 	hx509_cert /*p*/,
 	heim_bit_string */*issuer*/);
 
+/**
+ * Get notAfter time of the certificate.
+ *
+ * @param p a hx509 certificate object.
+ *
+ * @return return not after time.
+ *
+ * @ingroup hx509_cert
+ */
+
 time_t
 hx509_cert_get_notAfter (hx509_cert /*p*/);
 
+/**
+ * Get notBefore time of the certificate.
+ *
+ * @param p a hx509 certificate object.
+ *
+ * @return return not before time
+ *
+ * @ingroup hx509_cert
+ */
+
 time_t
 hx509_cert_get_notBefore (hx509_cert /*p*/);
 
+/**
+ * Get serial number of the certificate.
+ *
+ * @param p a hx509 certificate object.
+ * @param i serial number, should be freed ith der_free_heim_integer().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_serialnumber (
 	hx509_cert /*p*/,
 	heim_integer */*i*/);
 
+/**
+ * Return the name of the subject of the hx509 certificate.
+ *
+ * @param p a hx509 certificate object.
+ * @param name a pointer to a hx509 name, should be freed by
+ * hx509_name_free(). See also hx509_cert_get_base_subject().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_subject (
 	hx509_cert /*p*/,
 	hx509_name */*name*/);
 
+/**
+ * Get a copy of the Subect Unique ID
+ *
+ * @param context a hx509_context
+ * @param p a hx509 certificate
+ * @param subject the subject id returned, free with der_free_bit_string()
+ *
+ * @return An hx509 error code, see hx509_get_error_string(). The
+ * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
+ * doesn't have a subjectUniqueID
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_get_subject_unique_id (
 	hx509_context /*context*/,
@@ -265,18 +849,63 @@ hx509_cert_get_subject_unique_id (
 int
 hx509_cert_have_private_key (hx509_cert /*p*/);
 
-int
+/**
+ * Allocate and init an hx509 certificate object from the decoded
+ * certificate `c´.
+ *
+ * @param context A hx509 context.
+ * @param c
+ * @param error
+ *
+ * @return Returns an hx509 certificate
+ *
+ * @ingroup hx509_cert
+ */
+
+hx509_cert
 hx509_cert_init (
 	hx509_context /*context*/,
 	const Certificate */*c*/,
-	hx509_cert */*cert*/);
+	heim_error_t */*error*/);
 
-int
+/**
+ * Just like hx509_cert_init(), but instead of a decode certificate
+ * takes an pointer and length to a memory region that contains a
+ * DER/BER encoded certificate.
+ *
+ * If the memory region doesn't contain just the certificate and
+ * nothing more the function will fail with
+ * HX509_EXTRA_DATA_AFTER_STRUCTURE.
+ *
+ * @param context A hx509 context.
+ * @param ptr pointer to memory region containing encoded certificate.
+ * @param len length of memory region.
+ * @param error possibly returns an error
+ *
+ * @return An hx509 certificate
+ *
+ * @ingroup hx509_cert
+ */
+
+hx509_cert
 hx509_cert_init_data (
 	hx509_context /*context*/,
 	const void */*ptr*/,
 	size_t /*len*/,
-	hx509_cert */*cert*/);
+	heim_error_t */*error*/);
+
+/**
+ * Print certificate usage for a certificate to a string.
+ *
+ * @param context A hx509 context.
+ * @param c a certificate print the keyusage for.
+ * @param s the return string with the keysage printed in to, free
+ * with hx509_xfree().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
 
 int
 hx509_cert_keyusage_print (
@@ -292,20 +921,72 @@ hx509_cert_public_encrypt (
 	heim_oid */*encryption_oid*/,
 	heim_octet_string */*ciphertext*/);
 
+/**
+ * Add a reference to a hx509 certificate object.
+ *
+ * @param cert a pointer to an hx509 certificate object.
+ *
+ * @return the same object as is passed in.
+ *
+ * @ingroup hx509_cert
+ */
+
 hx509_cert
 hx509_cert_ref (hx509_cert /*cert*/);
 
+/**
+ * Set the friendly name on the certificate.
+ *
+ * @param cert The certificate to set the friendly name on
+ * @param name Friendly name.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_cert_set_friendly_name (
 	hx509_cert /*cert*/,
 	const char */*name*/);
 
+/**
+ * Add a certificate to the certificiate store.
+ *
+ * The receiving keyset certs will either increase reference counter
+ * of the cert or make a deep copy, either way, the caller needs to
+ * free the cert itself.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to add the certificate to.
+ * @param cert certificate to add.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_add (
 	hx509_context /*context*/,
 	hx509_certs /*certs*/,
 	hx509_cert /*cert*/);
 
+/**
+ * Same a hx509_certs_merge() but use a lock and name to describe the
+ * from source.
+ *
+ * @param context a hx509 context.
+ * @param to the store to merge into.
+ * @param lock a lock that unlocks the certificates store, use NULL to
+ * select no password/certifictes/prompt lock (see @ref page_lock).
+ * @param name name of the source store
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_append (
 	hx509_context /*context*/,
@@ -313,12 +994,38 @@ hx509_certs_append (
 	hx509_lock /*lock*/,
 	const char */*name*/);
 
+/**
+ * End the iteration over certificates.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over.
+ * @param cursor cursor that will keep track of progress, freed.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_end_seq (
 	hx509_context /*context*/,
 	hx509_certs /*certs*/,
 	hx509_cursor /*cursor*/);
 
+/**
+ * Filter certificate matching the query.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to search.
+ * @param q query allocated with @ref hx509_query functions.
+ * @param result the filtered certificate store, caller must free with
+ *        hx509_certs_free().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_filter (
 	hx509_context /*context*/,
@@ -326,6 +1033,20 @@ hx509_certs_filter (
 	const hx509_query */*q*/,
 	hx509_certs */*result*/);
 
+/**
+ * Find a certificate matching the query.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to search.
+ * @param q query allocated with @ref hx509_query functions.
+ * @param r return certificate (or NULL on error), should be freed
+ * with hx509_cert_free().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_find (
 	hx509_context /*context*/,
@@ -333,9 +1054,32 @@ hx509_certs_find (
 	const hx509_query */*q*/,
 	hx509_cert */*r*/);
 
+/**
+ * Free a certificate store.
+ *
+ * @param certs certificate store to free.
+ *
+ * @ingroup hx509_keyset
+ */
+
 void
 hx509_certs_free (hx509_certs */*certs*/);
 
+/**
+ * Print some info about the certificate store.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to print information about.
+ * @param func function that will get each line of the information, if
+ * NULL is used the data is printed on a FILE descriptor that should
+ * be passed in ctx, if ctx also is NULL, stdout is used.
+ * @param ctx parameter to func.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_info (
 	hx509_context /*context*/,
@@ -343,6 +1087,24 @@ hx509_certs_info (
 	int (*/*func*/)(void *, const char *),
 	void */*ctx*/);
 
+/**
+ * Open or creates a new hx509 certificate store.
+ *
+ * @param context A hx509 context
+ * @param name name of the store, format is TYPE:type-specific-string,
+ * if NULL is used the MEMORY store is used.
+ * @param flags list of flags:
+ * - HX509_CERTS_CREATE create a new keystore of the specific TYPE.
+ * - HX509_CERTS_UNPROTECT_ALL fails if any private key failed to be extracted.
+ * @param lock a lock that unlocks the certificates store, use NULL to
+ * select no password/certifictes/prompt lock (see @ref page_lock).
+ * @param certs return pointer, free with hx509_certs_free().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_init (
 	hx509_context /*context*/,
@@ -351,6 +1113,21 @@ hx509_certs_init (
 	hx509_lock /*lock*/,
 	hx509_certs */*certs*/);
 
+/**
+ * Iterate over all certificates in a keystore and call a block
+ * for each of them.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over.
+ * @param func block to call for each certificate. The function
+ * should return non-zero to abort the iteration, that value is passed
+ * back to the caller of hx509_certs_iter().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 #ifdef __BLOCKS__
 int
 hx509_certs_iter (
@@ -359,6 +1136,22 @@ hx509_certs_iter (
 	int (^func)(hx509_cert));
 #endif /* __BLOCKS__ */
 
+/**
+ * Iterate over all certificates in a keystore and call a function
+ * for each of them.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over.
+ * @param func function to call for each certificate. The function
+ * should return non-zero to abort the iteration, that value is passed
+ * back to the caller of hx509_certs_iter_f().
+ * @param ctx context variable that will passed to the function.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_iter_f (
 	hx509_context /*context*/,
@@ -366,12 +1159,40 @@ hx509_certs_iter_f (
 	int (*/*func*/)(hx509_context, void *, hx509_cert),
 	void */*ctx*/);
 
+/**
+ * Merge a certificate store into another. The from store is keep
+ * intact.
+ *
+ * @param context a hx509 context.
+ * @param to the store to merge into.
+ * @param from the store to copy the object from.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_merge (
 	hx509_context /*context*/,
 	hx509_certs /*to*/,
 	hx509_certs /*from*/);
 
+/**
+ * Get next ceritificate from the certificate keystore pointed out by
+ * cursor.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over.
+ * @param cursor cursor that keeps track of progress.
+ * @param cert return certificate next in store, NULL if the store
+ * contains no more certificates. Free with hx509_cert_free().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_next_cert (
 	hx509_context /*context*/,
@@ -382,12 +1203,42 @@ hx509_certs_next_cert (
 hx509_certs
 hx509_certs_ref (hx509_certs /*certs*/);
 
+/**
+ * Start the integration
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over
+ * @param cursor cursor that will keep track of progress, free with
+ * hx509_certs_end_seq().
+ *
+ * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION is
+ * returned if the certificate store doesn't support the iteration
+ * operation.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_start_seq (
 	hx509_context /*context*/,
 	hx509_certs /*certs*/,
 	hx509_cursor */*cursor*/);
 
+/**
+ * Write the certificate store to stable storage.
+ *
+ * @param context A hx509 context.
+ * @param certs a certificate store to store.
+ * @param flags currently unused, use 0.
+ * @param lock a lock that unlocks the certificates store, use NULL to
+ * select no password/certifictes/prompt lock (see @ref page_lock).
+ *
+ * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION if
+ * the certificate store doesn't support the store operation.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_certs_store (
 	hx509_context /*context*/,
@@ -395,12 +1246,33 @@ hx509_certs_store (
 	int /*flags*/,
 	hx509_lock /*lock*/);
 
+/**
+ * Function to use to hx509_certs_iter_f() as a function argument, the
+ * ctx variable to hx509_certs_iter_f() should be a FILE file descriptor.
+ *
+ * @param context a hx509 context.
+ * @param ctx used by hx509_certs_iter_f().
+ * @param c a certificate
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_ci_print_names (
 	hx509_context /*context*/,
 	void */*ctx*/,
 	hx509_cert /*c*/);
 
+/**
+ * Resets the error strings the hx509 context.
+ *
+ * @param context A hx509 context.
+ *
+ * @ingroup hx509_error
+ */
+
 void
 hx509_clear_error_string (hx509_context /*context*/);
 
@@ -418,6 +1290,31 @@ hx509_cms_create_signed (
 	hx509_certs /*pool*/,
 	heim_octet_string */*signed_data*/);
 
+/**
+ * Decode SignedData and verify that the signature is correct.
+ *
+ * @param context A hx509 context.
+ * @param flags
+ * @param eContentType the type of the data.
+ * @param data data to sign
+ * @param length length of the data that data point to.
+ * @param digest_alg digest algorithm to use, use NULL to get the
+ * default or the peer determined algorithm.
+ * @param cert certificate to use for sign the data.
+ * @param peer info about the peer the message to send the message to,
+ * like what digest algorithm to use.
+ * @param anchors trust anchors that the client will use, used to
+ * polulate the certificates included in the message
+ * @param pool certificates to use in try to build the path to the
+ * trust anchors.
+ * @param signed_data the output of the function, free with
+ * der_free_octet_string().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_create_signed_1 (
 	hx509_context /*context*/,
@@ -432,6 +1329,11 @@ hx509_cms_create_signed_1 (
 	hx509_certs /*pool*/,
 	heim_octet_string */*signed_data*/);
 
+/**
+     * Use HX509_CMS_SIGNATURE_NO_SIGNER to create no sigInfo (no
+     * signatures).
+ */
+
 int
 hx509_cms_decrypt_encrypted (
 	hx509_context /*context*/,
@@ -441,6 +1343,34 @@ hx509_cms_decrypt_encrypted (
 	heim_oid */*contentType*/,
 	heim_octet_string */*content*/);
 
+/**
+ * Encrypt end encode EnvelopedData.
+ *
+ * Encrypt and encode EnvelopedData. The data is encrypted with a
+ * random key and the the random key is encrypted with the
+ * certificates private key. This limits what private key type can be
+ * used to RSA.
+ *
+ * @param context A hx509 context.
+ * @param flags flags to control the behavior.
+ *    - HX509_CMS_EV_NO_KU_CHECK - Dont check KU on certificate
+ *    - HX509_CMS_EV_ALLOW_WEAK - Allow weak crytpo
+ *    - HX509_CMS_EV_ID_NAME - prefer issuer name and serial number
+ * @param cert Certificate to encrypt the EnvelopedData encryption key
+ * with.
+ * @param data pointer the data to encrypt.
+ * @param length length of the data that data point to.
+ * @param encryption_type Encryption cipher to use for the bulk data,
+ * use NULL to get default.
+ * @param contentType type of the data that is encrypted
+ * @param content the output of the function,
+ * free with der_free_octet_string().
+ *
+ * @return an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_envelope_1 (
 	hx509_context /*context*/,
@@ -452,6 +1382,30 @@ hx509_cms_envelope_1 (
 	const heim_oid */*contentType*/,
 	heim_octet_string */*content*/);
 
+/**
+ * Decode and unencrypt EnvelopedData.
+ *
+ * Extract data and parameteres from from the EnvelopedData. Also
+ * supports using detached EnvelopedData.
+ *
+ * @param context A hx509 context.
+ * @param certs Certificate that can decrypt the EnvelopedData
+ * encryption key.
+ * @param flags HX509_CMS_UE flags to control the behavior.
+ * @param data pointer the structure the contains the DER/BER encoded
+ * EnvelopedData stucture.
+ * @param length length of the data that data point to.
+ * @param encryptedContent in case of detached signature, this
+ * contains the actual encrypted data, othersize its should be NULL.
+ * @param time_now set the current time, if zero the library uses now as the date.
+ * @param contentType output type oid, should be freed with der_free_oid().
+ * @param content the data, free with der_free_octet_string().
+ *
+ * @return an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_unenvelope (
 	hx509_context /*context*/,
@@ -464,6 +1418,20 @@ hx509_cms_unenvelope (
 	heim_oid */*contentType*/,
 	heim_octet_string */*content*/);
 
+/**
+ * Decode an ContentInfo and unwrap data and oid it.
+ *
+ * @param in the encoded buffer.
+ * @param oid type of the content.
+ * @param out data to be wrapped.
+ * @param have_data since the data is optional, this flags show dthe
+ * diffrence between no data and the zero length data.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_unwrap_ContentInfo (
 	const heim_octet_string */*in*/,
@@ -471,6 +1439,30 @@ hx509_cms_unwrap_ContentInfo (
 	heim_octet_string */*out*/,
 	int */*have_data*/);
 
+/**
+ * Decode SignedData and verify that the signature is correct.
+ *
+ * @param context A hx509 context.
+ * @param ctx a hx509 verify context.
+ * @param flags to control the behaivor of the function.
+ *    - HX509_CMS_VS_NO_KU_CHECK - Don't check KeyUsage
+ *    - HX509_CMS_VS_ALLOW_DATA_OID_MISMATCH - allow oid mismatch
+ *    - HX509_CMS_VS_ALLOW_ZERO_SIGNER - no signer, see below.
+ * @param data pointer to CMS SignedData encoded data.
+ * @param length length of the data that data point to.
+ * @param signedContent external data used for signature.
+ * @param pool certificate pool to build certificates paths.
+ * @param contentType free with der_free_oid().
+ * @param content the output of the function, free with
+ * der_free_octet_string().
+ * @param signer_certs list of the cerficates used to sign this
+ * request, free with hx509_certs_free().
+ *
+ * @return an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_verify_signed (
 	hx509_context /*context*/,
@@ -484,45 +1476,152 @@ hx509_cms_verify_signed (
 	heim_octet_string */*content*/,
 	hx509_certs */*signer_certs*/);
 
+/**
+ * Wrap data and oid in a ContentInfo and encode it.
+ *
+ * @param oid type of the content.
+ * @param buf data to be wrapped. If a NULL pointer is passed in, the
+ * optional content field in the ContentInfo is not going be filled
+ * in.
+ * @param res the encoded buffer, the result should be freed with
+ * der_free_octet_string().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_cms
+ */
+
 int
 hx509_cms_wrap_ContentInfo (
 	const heim_oid */*oid*/,
 	const heim_octet_string */*buf*/,
 	heim_octet_string */*res*/);
 
+/**
+ * Free the context allocated by hx509_context_init().
+ *
+ * @param context context to be freed.
+ *
+ * @ingroup hx509
+ */
+
 void
 hx509_context_free (hx509_context */*context*/);
 
+/**
+ * Creates a hx509 context that most functions in the library
+ * uses. The context is only allowed to be used by one thread at each
+ * moment. Free the context with hx509_context_free().
+ *
+ * @param context Returns a pointer to new hx509 context.
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509
+ */
+
 int
 hx509_context_init (hx509_context */*context*/);
 
+/**
+ * Selects if the hx509_revoke_verify() function is going to require
+ * the existans of a revokation method (OCSP, CRL) or not. Note that
+ * hx509_verify_path(), hx509_cms_verify_signed(), and other function
+ * call hx509_revoke_verify().
+ *
+ * @param context hx509 context to change the flag for.
+ * @param flag zero, revokation method required, non zero missing
+ * revokation method ok
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_context_set_missing_revoke (
 	hx509_context /*context*/,
 	int /*flag*/);
 
+/**
+ * Add revoked certificate to an CRL context.
+ *
+ * @param context a hx509 context.
+ * @param crl the CRL to add the revoked certificate to.
+ * @param certs keyset of certificate to revoke.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_crl_add_revoked_certs (
 	hx509_context /*context*/,
 	hx509_crl /*crl*/,
 	hx509_certs /*certs*/);
 
+/**
+ * Create a CRL context. Use hx509_crl_free() to free the CRL context.
+ *
+ * @param context a hx509 context.
+ * @param crl return pointer to a newly allocated CRL context.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_crl_alloc (
 	hx509_context /*context*/,
 	hx509_crl */*crl*/);
 
+/**
+ * Free a CRL context.
+ *
+ * @param context a hx509 context.
+ * @param crl a CRL context to free.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_crl_free (
 	hx509_context /*context*/,
 	hx509_crl */*crl*/);
 
+/**
+ * Set the lifetime of a CRL context.
+ *
+ * @param context a hx509 context.
+ * @param crl a CRL context
+ * @param delta delta time the certificate is valid, library adds the
+ * current time to this.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_crl_lifetime (
 	hx509_context /*context*/,
 	hx509_crl /*crl*/,
 	int /*delta*/);
 
+/**
+ * Sign a CRL and return an encode certificate.
+ *
+ * @param context a hx509 context.
+ * @param signer certificate to sign the CRL with
+ * @param crl the CRL to sign
+ * @param os return the signed and encoded CRL, free with
+ * free_heim_octet_string()
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_crl_sign (
 	hx509_context /*context*/,
@@ -635,6 +1734,19 @@ hx509_crypto_set_random_key (
 	hx509_crypto /*crypto*/,
 	heim_octet_string */*key*/);
 
+/**
+ * Add a new key/value pair to the hx509_env.
+ *
+ * @param context A hx509 context.
+ * @param env environment to add the environment variable too.
+ * @param key key to add
+ * @param value value to add
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_env
+ */
+
 int
 hx509_env_add (
 	hx509_context /*context*/,
@@ -642,6 +1754,19 @@ hx509_env_add (
 	const char */*key*/,
 	const char */*value*/);
 
+/**
+ * Add a new key/binding pair to the hx509_env.
+ *
+ * @param context A hx509 context.
+ * @param env environment to add the environment variable too.
+ * @param key key to add
+ * @param list binding list to add
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_env
+ */
+
 int
 hx509_env_add_binding (
 	hx509_context /*context*/,
@@ -649,21 +1774,66 @@ hx509_env_add_binding (
 	const char */*key*/,
 	hx509_env /*list*/);
 
+/**
+ * Search the hx509_env for a key.
+ *
+ * @param context A hx509 context.
+ * @param env environment to add the environment variable too.
+ * @param key key to search for.
+ *
+ * @return the value if the key is found, NULL otherwise.
+ *
+ * @ingroup hx509_env
+ */
+
 const char *
 hx509_env_find (
 	hx509_context /*context*/,
 	hx509_env /*env*/,
 	const char */*key*/);
 
+/**
+ * Search the hx509_env for a binding.
+ *
+ * @param context A hx509 context.
+ * @param env environment to add the environment variable too.
+ * @param key key to search for.
+ *
+ * @return the binding if the key is found, NULL if not found.
+ *
+ * @ingroup hx509_env
+ */
+
 hx509_env
 hx509_env_find_binding (
 	hx509_context /*context*/,
 	hx509_env /*env*/,
 	const char */*key*/);
 
+/**
+ * Free an hx509_env environment context.
+ *
+ * @param env the environment to free.
+ *
+ * @ingroup hx509_env
+ */
+
 void
 hx509_env_free (hx509_env */*env*/);
 
+/**
+ * Search the hx509_env for a length based key.
+ *
+ * @param context A hx509 context.
+ * @param env environment to add the environment variable too.
+ * @param key key to search for.
+ * @param len length of key.
+ *
+ * @return the value if the key is found, NULL otherwise.
+ *
+ * @ingroup hx509_env
+ */
+
 const char *
 hx509_env_lfind (
 	hx509_context /*context*/,
@@ -671,6 +1841,18 @@ hx509_env_lfind (
 	const char */*key*/,
 	size_t /*len*/);
 
+/**
+ * Print error message and fatally exit from error code
+ *
+ * @param context A hx509 context.
+ * @param exit_code exit() code from process.
+ * @param error_code Error code for the reason to exit.
+ * @param fmt format string with the exit message.
+ * @param ... argument to format string.
+ *
+ * @ingroup hx509_error
+ */
+
 void
 hx509_err (
 	hx509_context /*context*/,
@@ -682,22 +1864,73 @@ hx509_err (
 hx509_private_key_ops *
 hx509_find_private_alg (const heim_oid */*oid*/);
 
+/**
+ * Free error string returned by hx509_get_error_string().
+ *
+ * @param str error string to free.
+ *
+ * @ingroup hx509_error
+ */
+
 void
 hx509_free_error_string (char */*str*/);
 
+/**
+ * Free a list of octet strings returned by another hx509 library
+ * function.
+ *
+ * @param list list to be freed.
+ *
+ * @ingroup hx509_misc
+ */
+
 void
 hx509_free_octet_string_list (hx509_octet_string_list */*list*/);
 
+/**
+ * Unparse the hx509 name in name into a string.
+ *
+ * @param name the name to print
+ * @param str an allocated string returns the name in string form
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_general_name_unparse (
 	GeneralName */*name*/,
 	char **/*str*/);
 
+/**
+ * Get an error string from context associated with error_code.
+ *
+ * @param context A hx509 context.
+ * @param error_code Get error message for this error code.
+ *
+ * @return error string, free with hx509_free_error_string().
+ *
+ * @ingroup hx509_error
+ */
+
 char *
 hx509_get_error_string (
 	hx509_context /*context*/,
 	int /*error_code*/);
 
+/**
+ * Get one random certificate from the certificate store.
+ *
+ * @param context a hx509 context.
+ * @param certs a certificate store to get the certificate from.
+ * @param c return certificate, should be freed with hx509_cert_free().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
 int
 hx509_get_one_cert (
 	hx509_context /*context*/,
@@ -729,6 +1962,12 @@ hx509_lock_command_string (
 void
 hx509_lock_free (hx509_lock /*lock*/);
 
+/**
+ * @page page_lock Locking and unlocking certificates and encrypted data.
+ *
+ * See the library functions here: @ref hx509_lock
+ */
+
 int
 hx509_lock_init (
 	hx509_context /*context*/,
@@ -756,31 +1995,98 @@ hx509_lock_set_prompter (
 	hx509_prompter_fct /*prompt*/,
 	void */*data*/);
 
+/**
+ * Convert a hx509_name object to DER encoded name.
+ *
+ * @param name name to concert
+ * @param os data to a DER encoded name, free the resulting octet
+ * string with hx509_xfree(os->data).
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_binary (
 	const hx509_name /*name*/,
 	heim_octet_string */*os*/);
 
+/**
+ * Compare to hx509 name object, useful for sorting.
+ *
+ * @param n1 a hx509 name object.
+ * @param n2 a hx509 name object.
+ *
+ * @return 0 the objects are the same, returns > 0 is n2 is "larger"
+ * then n2, < 0 if n1 is "smaller" then n2.
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_cmp (
 	hx509_name /*n1*/,
 	hx509_name /*n2*/);
 
+/**
+ * Copy a hx509 name object.
+ *
+ * @param context A hx509 cotext.
+ * @param from the name to copy from
+ * @param to the name to copy to
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_copy (
 	hx509_context /*context*/,
 	const hx509_name /*from*/,
 	hx509_name */*to*/);
 
+/**
+ * Expands variables in the name using env. Variables are on the form
+ * ${name}. Useful when dealing with certificate templates.
+ *
+ * @param context A hx509 cotext.
+ * @param name the name to expand.
+ * @param env environment variable to expand.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_expand (
 	hx509_context /*context*/,
 	hx509_name /*name*/,
 	hx509_env /*env*/);
 
+/**
+ * Free a hx509 name object, upond return *name will be NULL.
+ *
+ * @param name a hx509 name object to be freed.
+ *
+ * @ingroup hx509_name
+ */
+
 void
 hx509_name_free (hx509_name */*name*/);
 
+/**
+ * Unparse the hx509 name in name into a string.
+ *
+ * @param name the name to check if its empty/null.
+ *
+ * @return non zero if the name is empty/null.
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_is_null_p (const hx509_name /*name*/);
 
@@ -789,16 +2095,56 @@ hx509_name_normalize (
 	hx509_context /*context*/,
 	hx509_name /*name*/);
 
+/**
+ * Convert a hx509_name into a Name.
+ *
+ * @param from the name to copy from
+ * @param to the name to copy to
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_to_Name (
 	const hx509_name /*from*/,
 	Name */*to*/);
 
+/**
+ * Convert the hx509 name object into a printable string.
+ * The resulting string should be freed with free().
+ *
+ * @param name name to print
+ * @param str the string to return
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_name_to_string (
 	const hx509_name /*name*/,
 	char **/*str*/);
 
+/**
+ * Create an OCSP request for a set of certificates.
+ *
+ * @param context a hx509 context
+ * @param reqcerts list of certificates to request ocsp data for
+ * @param pool certificate pool to use when signing
+ * @param signer certificate to use to sign the request
+ * @param digest the signing algorithm in the request, if NULL use the
+ * default signature algorithm,
+ * @param request the encoded request, free with free_heim_octet_string().
+ * @param nonce nonce in the request, free with free_heim_octet_string().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_ocsp_request (
 	hx509_context /*context*/,
@@ -809,6 +2155,25 @@ hx509_ocsp_request (
 	heim_octet_string */*request*/,
 	heim_octet_string */*nonce*/);
 
+/**
+ * Verify that the certificate is part of the OCSP reply and it's not
+ * expired. Doesn't verify signature the OCSP reply or it's done by a
+ * authorized sender, that is assumed to be already done.
+ *
+ * @param context a hx509 context
+ * @param now the time right now, if 0, use the current time.
+ * @param cert the certificate to verify
+ * @param flags flags control the behavior
+ * @param data pointer to the encode ocsp reply
+ * @param length the length of the encode ocsp reply
+ * @param expiration return the time the OCSP will expire and need to
+ * be rechecked.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_ocsp_verify (
 	hx509_context /*context*/,
@@ -819,17 +2184,51 @@ hx509_ocsp_verify (
 	size_t /*length*/,
 	time_t */*expiration*/);
 
+/**
+ * Print a oid using a hx509_vprint_func function. To print to stdout
+ * use hx509_print_stdout().
+ *
+ * @param oid oid to print
+ * @param func hx509_vprint_func to print with.
+ * @param ctx context variable to hx509_vprint_func function.
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_oid_print (
 	const heim_oid */*oid*/,
 	hx509_vprint_func /*func*/,
 	void */*ctx*/);
 
+/**
+ * Print a oid to a string.
+ *
+ * @param oid oid to print
+ * @param str allocated string, free with hx509_xfree().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
+
 int
 hx509_oid_sprint (
 	const heim_oid */*oid*/,
 	char **/*str*/);
 
+/**
+ * Parse a string into a hx509 name object.
+ *
+ * @param context A hx509 context.
+ * @param str a string to parse.
+ * @param name the resulting object, NULL in case of error.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_parse_name (
 	hx509_context /*context*/,
@@ -845,25 +2244,80 @@ hx509_parse_private_key (
 	hx509_key_format_t /*format*/,
 	hx509_private_key */*private_key*/);
 
+/**
+ * Add an additional algorithm that the peer supports.
+ *
+ * @param context A hx509 context.
+ * @param peer the peer to set the new algorithms for
+ * @param val an AlgorithmsIdentier to add
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_peer
+ */
+
 int
 hx509_peer_info_add_cms_alg (
 	hx509_context /*context*/,
 	hx509_peer_info /*peer*/,
 	const AlgorithmIdentifier */*val*/);
 
+/**
+ * Allocate a new peer info structure an init it to default values.
+ *
+ * @param context A hx509 context.
+ * @param peer return an allocated peer, free with hx509_peer_info_free().
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_peer
+ */
+
 int
 hx509_peer_info_alloc (
 	hx509_context /*context*/,
 	hx509_peer_info */*peer*/);
 
+/**
+ * Free a peer info structure.
+ *
+ * @param peer peer info to be freed.
+ *
+ * @ingroup hx509_peer
+ */
+
 void
 hx509_peer_info_free (hx509_peer_info /*peer*/);
 
+/**
+ * Set the certificate that remote peer is using.
+ *
+ * @param peer peer info to update
+ * @param cert cerificate of the remote peer.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_peer
+ */
+
 int
 hx509_peer_info_set_cert (
 	hx509_peer_info /*peer*/,
 	hx509_cert /*cert*/);
 
+/**
+ * Set the algorithms that the peer supports.
+ *
+ * @param context A hx509 context.
+ * @param peer the peer to set the new algorithms for
+ * @param val array of supported AlgorithmsIdentiers
+ * @param len length of array val.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_peer
+ */
+
 int
 hx509_peer_info_set_cms_algs (
 	hx509_context /*context*/,
@@ -901,12 +2355,38 @@ hx509_pem_write (
 	const void */*data*/,
 	size_t /*size*/);
 
+/**
+ * Print a simple representation of a certificate
+ *
+ * @param context A hx509 context, can be NULL
+ * @param cert certificate to print
+ * @param out the stdio output stream, if NULL, stdout is used
+ *
+ * @return An hx509 error code
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_print_cert (
 	hx509_context /*context*/,
 	hx509_cert /*cert*/,
 	FILE */*out*/);
 
+/**
+ * Helper function to print on stdout for:
+ * - hx509_oid_print(),
+ * - hx509_bitstring_print(),
+ * - hx509_validate_ctx_set_print().
+ *
+ * @param ctx the context to the print function. If the ctx is NULL,
+ * stdout is used.
+ * @param fmt the printing format.
+ * @param va the argumet list.
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_print_stdout (
 	void */*ctx*/,
@@ -944,22 +2424,68 @@ hx509_private_key_private_decrypt (
 int
 hx509_prompt_hidden (hx509_prompt_type /*type*/);
 
+/**
+ * Allocate an query controller. Free using hx509_query_free().
+ *
+ * @param context A hx509 context.
+ * @param q return pointer to a hx509_query.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_query_alloc (
 	hx509_context /*context*/,
 	hx509_query **/*q*/);
 
+/**
+ * Free the query controller.
+ *
+ * @param context A hx509 context.
+ * @param q a pointer to the query controller.
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_query_free (
 	hx509_context /*context*/,
 	hx509_query */*q*/);
 
+/**
+ * Set the query controller to match using a specific match function.
+ *
+ * @param q a hx509 query controller.
+ * @param func function to use for matching, if the argument is NULL,
+ * the match function is removed.
+ * @param ctx context passed to the function.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_query_match_cmp_func (
 	hx509_query */*q*/,
 	int (*/*func*/)(hx509_context, hx509_cert, void *),
 	void */*ctx*/);
 
+/**
+ * Set the query controller to require an one specific EKU (extended
+ * key usage). Any previous EKU matching is overwitten. If NULL is
+ * passed in as the eku, the EKU requirement is reset.
+ *
+ * @param q a hx509 query controller.
+ * @param eku an EKU to match on.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_query_match_eku (
 	hx509_query */*q*/,
@@ -971,27 +2497,81 @@ hx509_query_match_expr (
 	hx509_query */*q*/,
 	const char */*expr*/);
 
+/**
+ * Set the query controller to match on a friendly name
+ *
+ * @param q a hx509 query controller.
+ * @param name a friendly name to match on
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_query_match_friendly_name (
 	hx509_query */*q*/,
 	const char */*name*/);
 
+/**
+ * Set the issuer and serial number of match in the query
+ * controller. The function make copies of the isser and serial number.
+ *
+ * @param q a hx509 query controller
+ * @param issuer issuer to search for
+ * @param serialNumber the serialNumber of the issuer.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_query_match_issuer_serial (
 	hx509_query */*q*/,
 	const Name */*issuer*/,
 	const heim_integer */*serialNumber*/);
 
+/**
+ * Set match options for the hx509 query controller.
+ *
+ * @param q query controller.
+ * @param option options to control the query controller.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_query_match_option (
 	hx509_query */*q*/,
 	hx509_query_option /*option*/);
 
+/**
+ * Set a statistic file for the query statistics.
+ *
+ * @param context A hx509 context.
+ * @param fn statistics file name
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_query_statistic_file (
 	hx509_context /*context*/,
 	const char */*fn*/);
 
+/**
+ * Unparse the statistics file and print the result on a FILE descriptor.
+ *
+ * @param context A hx509 context.
+ * @param printtype tyep to print
+ * @param out the FILE to write the data on.
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_query_unparse_stats (
 	hx509_context /*context*/,
@@ -1030,32 +2610,110 @@ hx509_request_set_name (
 	hx509_request /*req*/,
 	hx509_name /*name*/);
 
+/**
+ * Add a CRL file to the revokation context.
+ *
+ * @param context hx509 context
+ * @param ctx hx509 revokation context
+ * @param path path to file that is going to be added to the context.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_revoke_add_crl (
 	hx509_context /*context*/,
 	hx509_revoke_ctx /*ctx*/,
 	const char */*path*/);
 
+/**
+ * Add a OCSP file to the revokation context.
+ *
+ * @param context hx509 context
+ * @param ctx hx509 revokation context
+ * @param path path to file that is going to be added to the context.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_revoke_add_ocsp (
 	hx509_context /*context*/,
 	hx509_revoke_ctx /*ctx*/,
 	const char */*path*/);
 
+/**
+ * Free a hx509 revokation context.
+ *
+ * @param ctx context to be freed
+ *
+ * @ingroup hx509_revoke
+ */
+
 void
 hx509_revoke_free (hx509_revoke_ctx */*ctx*/);
 
+/**
+ * Allocate a revokation context. Free with hx509_revoke_free().
+ *
+ * @param context A hx509 context.
+ * @param ctx returns a newly allocated revokation context.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_revoke_init (
 	hx509_context /*context*/,
 	hx509_revoke_ctx */*ctx*/);
 
+/**
+ * Print the OCSP reply stored in a file.
+ *
+ * @param context a hx509 context
+ * @param path path to a file with a OCSP reply
+ * @param out the out FILE descriptor to print the reply on
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_revoke_ocsp_print (
 	hx509_context /*context*/,
 	const char */*path*/,
 	FILE */*out*/);
 
+int
+hx509_revoke_print (
+	hx509_context /*context*/,
+	hx509_revoke_ctx /*ctx*/,
+	FILE */*out*/);
+
+/**
+ * Check that a certificate is not expired according to a revokation
+ * context. Also need the parent certificte to the check OCSP
+ * parent identifier.
+ *
+ * @param context hx509 context
+ * @param ctx hx509 revokation context
+ * @param certs
+ * @param now
+ * @param cert
+ * @param parent_cert
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_revoke
+ */
+
 int
 hx509_revoke_verify (
 	hx509_context /*context*/,
@@ -1065,6 +2723,20 @@ hx509_revoke_verify (
 	hx509_cert /*cert*/,
 	hx509_cert /*parent_cert*/);
 
+/**
+ * See hx509_set_error_stringv().
+ *
+ * @param context A hx509 context.
+ * @param flags
+ * - HX509_ERROR_APPEND appends the error string to the old messages
+     (code is updated).
+ * @param code error code related to error message
+ * @param fmt error message format
+ * @param ... arguments to error message format
+ *
+ * @ingroup hx509_error
+ */
+
 void
 hx509_set_error_string (
 	hx509_context /*context*/,
@@ -1073,6 +2745,20 @@ hx509_set_error_string (
 	const char */*fmt*/,
 	...);
 
+/**
+ * Add an error message to the hx509 context.
+ *
+ * @param context A hx509 context.
+ * @param flags
+ * - HX509_ERROR_APPEND appends the error string to the old messages
+     (code is updated).
+ * @param code error code related to error message
+ * @param fmt error message format
+ * @param ap arguments to error message format
+ *
+ * @ingroup hx509_error
+ */
+
 void
 hx509_set_error_stringv (
 	hx509_context /*context*/,
@@ -1084,9 +2770,6 @@ hx509_set_error_stringv (
 const AlgorithmIdentifier *
 hx509_signature_ecPublicKey (void);
 
-const AlgorithmIdentifier *
-hx509_signature_ecdsa_with_sha1 (void);
-
 const AlgorithmIdentifier *
 hx509_signature_ecdsa_with_sha256 (void);
 
@@ -1126,42 +2809,135 @@ hx509_signature_sha384 (void);
 const AlgorithmIdentifier *
 hx509_signature_sha512 (void);
 
+/**
+ * Convert a DER encoded name info a string.
+ *
+ * @param data data to a DER/BER encoded name
+ * @param length length of data
+ * @param str the resulting string, is NULL on failure.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_name
+ */
+
 int
 hx509_unparse_der_name (
 	const void */*data*/,
 	size_t /*length*/,
 	char **/*str*/);
 
+/**
+ * Validate/Print the status of the certificate.
+ *
+ * @param context A hx509 context.
+ * @param ctx A hx509 validation context.
+ * @param cert the cerificate to validate/print.
+
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
+
 int
 hx509_validate_cert (
 	hx509_context /*context*/,
 	hx509_validate_ctx /*ctx*/,
 	hx509_cert /*cert*/);
 
+/**
+ * Add flags to control the behaivor of the hx509_validate_cert()
+ * function.
+ *
+ * @param ctx A hx509 validation context.
+ * @param flags flags to add to the validation context.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_validate_ctx_add_flags (
 	hx509_validate_ctx /*ctx*/,
 	int /*flags*/);
 
+/**
+ * Free an hx509 validate context.
+ *
+ * @param ctx the hx509 validate context to free.
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_validate_ctx_free (hx509_validate_ctx /*ctx*/);
 
+/**
+ * Allocate a hx509 validation/printing context.
+ *
+ * @param context A hx509 context.
+ * @param ctx a new allocated hx509 validation context, free with
+ * hx509_validate_ctx_free().
+
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
+
 int
 hx509_validate_ctx_init (
 	hx509_context /*context*/,
 	hx509_validate_ctx */*ctx*/);
 
+/**
+ * Set the printing functions for the validation context.
+ *
+ * @param ctx a hx509 valication context.
+ * @param func the printing function to usea.
+ * @param c the context variable to the printing function.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_print
+ */
+
 void
 hx509_validate_ctx_set_print (
 	hx509_validate_ctx /*ctx*/,
 	hx509_vprint_func /*func*/,
 	void */*c*/);
 
+/**
+ * Set the trust anchors in the verification context, makes an
+ * reference to the keyset, so the consumer can free the keyset
+ * independent of the destruction of the verification context (ctx).
+ * If there already is a keyset attached, it's released.
+ *
+ * @param ctx a verification context
+ * @param set a keyset containing the trust anchors.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_attach_anchors (
 	hx509_verify_ctx /*ctx*/,
 	hx509_certs /*set*/);
 
+/**
+ * Attach an revocation context to the verfication context, , makes an
+ * reference to the revoke context, so the consumer can free the
+ * revoke context independent of the destruction of the verification
+ * context. If there is no revoke context, the verification process is
+ * NOT going to check any verification status.
+ *
+ * @param ctx a verification context.
+ * @param revoke_ctx a revoke context.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_attach_revoke (
 	hx509_verify_ctx /*ctx*/,
@@ -1172,14 +2948,56 @@ hx509_verify_ctx_f_allow_best_before_signature_algs (
 	hx509_context /*ctx*/,
 	int /*boolean*/);
 
+/**
+ * Allow using the operating system builtin trust anchors if no other
+ * trust anchors are configured.
+ *
+ * @param ctx a verification context
+ * @param boolean if non zero, useing the operating systems builtin
+ * trust anchors.
+ *
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 void
 hx509_verify_ctx_f_allow_default_trustanchors (
 	hx509_verify_ctx /*ctx*/,
 	int /*boolean*/);
 
+/**
+ * Free an hx509 verification context.
+ *
+ * @param ctx the context to be freed.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_destroy_ctx (hx509_verify_ctx /*ctx*/);
 
+/**
+ * Verify that the certificate is allowed to be used for the hostname
+ * and address.
+ *
+ * @param context A hx509 context.
+ * @param cert the certificate to match with
+ * @param flags Flags to modify the behavior:
+ * - HX509_VHN_F_ALLOW_NO_MATCH no match is ok
+ * @param type type of hostname:
+ * - HX509_HN_HOSTNAME for plain hostname.
+ * - HX509_HN_DNSSRV for DNS SRV names.
+ * @param hostname the hostname to check
+ * @param sa address of the host
+ * @param sa_size length of address
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_cert
+ */
+
 int
 hx509_verify_hostname (
 	hx509_context /*context*/,
@@ -1190,11 +3008,38 @@ hx509_verify_hostname (
 	const struct sockaddr */*sa*/,
 	int /*sa_size*/);
 
+/**
+ * Allocate an verification context that is used fo control the
+ * verification process.
+ *
+ * @param context A hx509 context.
+ * @param ctx returns a pointer to a hx509_verify_ctx object.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_verify_init_ctx (
 	hx509_context /*context*/,
 	hx509_verify_ctx */*ctx*/);
 
+/**
+ * Build and verify the path for the certificate to the trust anchor
+ * specified in the verify context. The path is constructed from the
+ * certificate, the pool and the trust anchors.
+ *
+ * @param context A hx509 context.
+ * @param ctx A hx509 verification context.
+ * @param cert the certificate to build the path from.
+ * @param pool A keyset of certificates to build the chain from.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_verify
+ */
+
 int
 hx509_verify_path (
 	hx509_context /*context*/,
@@ -1202,26 +3047,83 @@ hx509_verify_path (
 	hx509_cert /*cert*/,
 	hx509_certs /*pool*/);
 
+/**
+ * Set the maximum depth of the certificate chain that the path
+ * builder is going to try.
+ *
+ * @param ctx a verification context
+ * @param max_depth maxium depth of the certificate chain, include
+ * trust anchor.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_set_max_depth (
 	hx509_verify_ctx /*ctx*/,
 	unsigned int /*max_depth*/);
 
+/**
+ * Allow or deny the use of proxy certificates
+ *
+ * @param ctx a verification context
+ * @param boolean if non zero, allow proxy certificates.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_set_proxy_certificate (
 	hx509_verify_ctx /*ctx*/,
 	int /*boolean*/);
 
+/**
+ * Select strict RFC3280 verification of certificiates. This means
+ * checking key usage on CA certificates, this will make version 1
+ * certificiates unuseable.
+ *
+ * @param ctx a verification context
+ * @param boolean if non zero, use strict verification.
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_set_strict_rfc3280_verification (
 	hx509_verify_ctx /*ctx*/,
 	int /*boolean*/);
 
+/**
+ * Set the clock time the the verification process is going to
+ * use. Used to check certificate in the past and future time. If not
+ * set the current time will be used.
+ *
+ * @param ctx a verification context.
+ * @param t the time the verifiation is using.
+ *
+ *
+ * @ingroup hx509_verify
+ */
+
 void
 hx509_verify_set_time (
 	hx509_verify_ctx /*ctx*/,
 	time_t /*t*/);
 
+/**
+ * Verify a signature made using the private key of an certificate.
+ *
+ * @param context A hx509 context.
+ * @param signer the certificate that made the signature.
+ * @param alg algorthm that was used to sign the data.
+ * @param data the data that was signed.
+ * @param sig the sigature to verify.
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_crypto
+ */
+
 int
 hx509_verify_signature (
 	hx509_context /*context*/,
@@ -1230,6 +3132,14 @@ hx509_verify_signature (
 	const heim_octet_string */*data*/,
 	const heim_octet_string */*sig*/);
 
+/**
+ * Free a data element allocated in the library.
+ *
+ * @param ptr data to be freed.
+ *
+ * @ingroup hx509_misc
+ */
+
 void
 hx509_xfree (void */*ptr*/);
 
@@ -1240,4 +3150,5 @@ yywrap (void);
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __hx509_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/kadm5-private.h b/crypto/external/bsd/heimdal/include/kadm5-private.h
index ab8d694dd..3f102fd89 100644
--- a/crypto/external/bsd/heimdal/include/kadm5-private.h
+++ b/crypto/external/bsd/heimdal/include/kadm5-private.h
@@ -52,11 +52,10 @@ kadm5_ret_t
 _kadm5_error_code (kadm5_ret_t /*code*/);
 
 int
-_kadm5_exists_keys (
+_kadm5_exists_keys_hist (
 	Key */*keys1*/,
 	int /*len1*/,
-	Key */*keys2*/,
-	int /*len2*/);
+	HDB_Ext_KeySet */*hist_keys*/);
 
 void
 _kadm5_free_keys (
@@ -94,6 +93,8 @@ kadm5_ret_t
 _kadm5_set_keys (
 	kadm5_server_context */*context*/,
 	hdb_entry */*ent*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	const char */*password*/);
 
 kadm5_ret_t
@@ -114,6 +115,8 @@ kadm5_ret_t
 _kadm5_set_keys_randomly (
 	kadm5_server_context */*context*/,
 	hdb_entry */*ent*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	krb5_keyblock **/*new_keys*/,
 	int */*n_keys*/);
 
@@ -147,12 +150,16 @@ kadm5_ret_t
 kadm5_c_chpass_principal (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	int /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	const char */*password*/);
 
 kadm5_ret_t
 kadm5_c_chpass_principal_with_key (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	int /*keepold*/,
 	int /*n_key_data*/,
 	krb5_key_data */*key_data*/);
 
@@ -161,6 +168,8 @@ kadm5_c_create_principal (
 	void */*server_handle*/,
 	kadm5_principal_ent_t /*princ*/,
 	uint32_t /*mask*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	const char */*password*/);
 
 kadm5_ret_t
@@ -266,6 +275,9 @@ kadm5_ret_t
 kadm5_c_randkey_principal (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	krb5_keyblock **/*new_keys*/,
 	int */*n_keys*/);
 
@@ -278,7 +290,7 @@ kadm5_c_rename_principal (
 kadm5_ret_t
 kadm5_log_create (
 	kadm5_server_context */*context*/,
-	hdb_entry */*ent*/);
+	hdb_entry */*entry*/);
 
 kadm5_ret_t
 kadm5_log_delete (
@@ -286,56 +298,83 @@ kadm5_log_delete (
 	krb5_principal /*princ*/);
 
 kadm5_ret_t
-kadm5_log_end (kadm5_server_context */*context*/);
+kadm5_log_end (kadm5_server_context */*server_context*/);
 
 kadm5_ret_t
 kadm5_log_foreach (
 	kadm5_server_context */*context*/,
-	void (*/*func*/)(kadm5_server_context *server_context, uint32_t ver, time_t timestamp, enum kadm_ops op, uint32_t len, krb5_storage *, void *),
+	enum kadm_iter_opts /*iter_opts*/,
+	off_t */*off_lastp*/,
+	kadm5_ret_t (*/*func*/)(kadm5_server_context *server_context, uint32_t ver, time_t timestamp, enum kadm_ops op, uint32_t len, krb5_storage *sp, void *ctx),
 	void */*ctx*/);
 
 kadm5_ret_t
 kadm5_log_get_version (
-	kadm5_server_context */*context*/,
+	kadm5_server_context */*server_context*/,
 	uint32_t */*ver*/);
 
 kadm5_ret_t
 kadm5_log_get_version_fd (
+	kadm5_server_context */*server_context*/,
 	int /*fd*/,
-	uint32_t */*ver*/);
+	int /*which*/,
+	uint32_t */*ver*/,
+	uint32_t */*tstamp*/);
 
 krb5_storage *
-kadm5_log_goto_end (int /*fd*/);
+kadm5_log_goto_end (
+	kadm5_server_context */*server_context*/,
+	int /*fd*/);
 
 kadm5_ret_t
-kadm5_log_init (kadm5_server_context */*context*/);
+kadm5_log_init (kadm5_server_context */*server_context*/);
+
+kadm5_ret_t
+kadm5_log_init_nb (kadm5_server_context */*server_context*/);
+
+kadm5_ret_t
+kadm5_log_init_nolock (kadm5_server_context */*server_context*/);
+
+kadm5_ret_t
+kadm5_log_init_sharedlock (
+	kadm5_server_context */*server_context*/,
+	int /*lock_flags*/);
 
 kadm5_ret_t
 kadm5_log_modify (
 	kadm5_server_context */*context*/,
-	hdb_entry */*ent*/,
+	hdb_entry */*entry*/,
 	uint32_t /*mask*/);
 
 kadm5_ret_t
-kadm5_log_nop (kadm5_server_context */*context*/);
+kadm5_log_nop (
+	kadm5_server_context */*context*/,
+	enum kadm_nop_type /*nop_type*/);
 
 kadm5_ret_t
 kadm5_log_previous (
 	krb5_context /*context*/,
 	krb5_storage */*sp*/,
-	uint32_t */*ver*/,
-	time_t */*timestamp*/,
-	enum kadm_ops */*op*/,
-	uint32_t */*len*/);
+	uint32_t */*verp*/,
+	time_t */*tstampp*/,
+	enum kadm_ops */*opp*/,
+	uint32_t */*lenp*/);
 
 kadm5_ret_t
-kadm5_log_reinit (kadm5_server_context */*context*/);
+kadm5_log_recover (
+	kadm5_server_context */*context*/,
+	enum kadm_recover_mode /*mode*/);
+
+kadm5_ret_t
+kadm5_log_reinit (
+	kadm5_server_context */*server_context*/,
+	uint32_t /*vno*/);
 
 kadm5_ret_t
 kadm5_log_rename (
 	kadm5_server_context */*context*/,
 	krb5_principal /*source*/,
-	hdb_entry */*ent*/);
+	hdb_entry */*entry*/);
 
 kadm5_ret_t
 kadm5_log_replay (
@@ -350,6 +389,9 @@ kadm5_log_set_version (
 	kadm5_server_context */*context*/,
 	uint32_t /*vno*/);
 
+void
+kadm5_log_signal_master (kadm5_server_context */*context*/);
+
 const char *
 kadm5_log_signal_socket (krb5_context /*context*/);
 
@@ -360,24 +402,32 @@ kadm5_log_signal_socket_info (
 	struct addrinfo **/*ret_addrs*/);
 
 kadm5_ret_t
-kadm5_log_truncate (kadm5_server_context */*server_context*/);
+kadm5_log_truncate (
+	kadm5_server_context */*context*/,
+	size_t /*keep*/,
+	size_t /*maxbytes*/);
 
 kadm5_ret_t
 kadm5_s_chpass_principal (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	int /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	const char */*password*/);
 
 kadm5_ret_t
 kadm5_s_chpass_principal_cond (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	int /*keepold*/,
 	const char */*password*/);
 
 kadm5_ret_t
 kadm5_s_chpass_principal_with_key (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	int /*keepold*/,
 	int /*n_key_data*/,
 	krb5_key_data */*key_data*/);
 
@@ -386,6 +436,8 @@ kadm5_s_create_principal (
 	void */*server_handle*/,
 	kadm5_principal_ent_t /*princ*/,
 	uint32_t /*mask*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	const char */*password*/);
 
 kadm5_ret_t
@@ -497,6 +549,9 @@ kadm5_ret_t
 kadm5_s_randkey_principal (
 	void */*server_handle*/,
 	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
 	krb5_keyblock **/*new_keys*/,
 	int */*n_keys*/);
 
@@ -506,4 +561,14 @@ kadm5_s_rename_principal (
 	krb5_principal /*source*/,
 	krb5_principal /*target*/);
 
+kadm5_ret_t
+kadm5_s_setkey_principal_3 (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	krb5_keyblock */*keyblocks*/,
+	int /*n_keys*/);
+
 #endif /* __kadm5_private_h__ */
diff --git a/crypto/external/bsd/heimdal/include/kadm5-protos.h b/crypto/external/bsd/heimdal/include/kadm5-protos.h
index eebae95d8..8c5f29c8c 100644
--- a/crypto/external/bsd/heimdal/include/kadm5-protos.h
+++ b/crypto/external/bsd/heimdal/include/kadm5-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __kadm5_protos_h__
 #define __kadm5_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -34,6 +35,11 @@ kadm5_add_passwd_quality_verifier (
 	krb5_context /*context*/,
 	const char */*check_library*/);
 
+int
+kadm5_all_keys_are_bogus (
+	size_t /*n_keys*/,
+	krb5_key_data */*keys*/);
+
 const char *
 kadm5_check_password_quality (
 	krb5_context /*context*/,
@@ -46,6 +52,15 @@ kadm5_chpass_principal (
 	krb5_principal /*princ*/,
 	const char */*password*/);
 
+kadm5_ret_t
+kadm5_chpass_principal_3 (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	const char */*password*/);
+
 kadm5_ret_t
 kadm5_chpass_principal_with_key (
 	void */*server_handle*/,
@@ -53,6 +68,20 @@ kadm5_chpass_principal_with_key (
 	int /*n_key_data*/,
 	krb5_key_data */*key_data*/);
 
+kadm5_ret_t
+kadm5_chpass_principal_with_key_3 (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	int /*keepold*/,
+	int /*n_key_data*/,
+	krb5_key_data */*key_data*/);
+
+kadm5_ret_t
+kadm5_create_policy (
+	void */*server_handle*/,
+	kadm5_policy_ent_t /*policy*/,
+	long /*mask*/);
+
 kadm5_ret_t
 kadm5_create_principal (
 	void */*server_handle*/,
@@ -60,6 +89,46 @@ kadm5_create_principal (
 	uint32_t /*mask*/,
 	const char */*password*/);
 
+kadm5_ret_t
+kadm5_create_principal_3 (
+	void */*server_handle*/,
+	kadm5_principal_ent_t /*princ*/,
+	uint32_t /*mask*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	char */*password*/);
+
+/**
+ * Extract decrypted keys from kadm5_principal_ent_t object.  Mostly a
+ * no-op for Heimdal because we fetch the entry with decrypted keys.
+ * Sadly this is not fully a no-op, as we have to allocate a copy.
+ *
+ * @server_handle is the kadm5 handle
+ * @entry is the HDB entry for the principal in question
+ * @ktype is the enctype to get a key for, or -1 to get the first one
+ * @stype is the salttype to get a key for, or -1 to get the first match
+ * @kvno is the kvno to search for, or -1 to get the first match (highest kvno)
+ * @keyblock is where the key will be placed
+ * @keysalt, if not NULL, is where the salt will be placed
+ * @kvnop, if not NULL, is where the selected kvno will be placed
+ */
+
+kadm5_ret_t
+kadm5_decrypt_key (
+	void */*server_handle*/,
+	kadm5_principal_ent_t /*entry*/,
+	int32_t /*ktype*/,
+	int32_t /*stype*/,
+	int32_t /*kvno*/,
+	krb5_keyblock */*keyblock*/,
+	krb5_keysalt */*keysalt*/,
+	int */*kvnop*/);
+
+kadm5_ret_t
+kadm5_delete_policy (
+	void */*server_handle*/,
+	char */*name*/);
+
 kadm5_ret_t
 kadm5_delete_principal (
 	void */*server_handle*/,
@@ -83,11 +152,27 @@ kadm5_free_name_list (
 	char **/*names*/,
 	int */*count*/);
 
+kadm5_ret_t
+kadm5_free_policy_ent (kadm5_policy_ent_t /*ent*/);
+
 void
 kadm5_free_principal_ent (
 	void */*server_handle*/,
 	kadm5_principal_ent_t /*princ*/);
 
+kadm5_ret_t
+kadm5_get_policies (
+	void */*server_handle*/,
+	char */*exp*/,
+	char ***/*pols*/,
+	int */*count*/);
+
+kadm5_ret_t
+kadm5_get_policy (
+	void */*server_handle*/,
+	char */*policy*/,
+	kadm5_policy_ent_t /*ent*/);
+
 kadm5_ret_t
 kadm5_get_principal (
 	void */*server_handle*/,
@@ -170,6 +255,15 @@ kadm5_init_with_skey_ctx (
 	unsigned long /*api_version*/,
 	void **/*server_handle*/);
 
+kadm5_ret_t
+kadm5_lock (void */*server_handle*/);
+
+kadm5_ret_t
+kadm5_modify_policy (
+	void */*server_handle*/,
+	kadm5_policy_ent_t /*policy*/,
+	uint32_t /*mask*/);
+
 kadm5_ret_t
 kadm5_modify_principal (
 	void */*server_handle*/,
@@ -183,6 +277,16 @@ kadm5_randkey_principal (
 	krb5_keyblock **/*new_keys*/,
 	int */*n_keys*/);
 
+kadm5_ret_t
+kadm5_randkey_principal_3 (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	krb5_keyblock **/*new_keys*/,
+	int */*n_keys*/);
+
 kadm5_ret_t
 kadm5_rename_principal (
 	void */*server_handle*/,
@@ -210,12 +314,50 @@ kadm5_ret_tl_data (
 	krb5_storage */*sp*/,
 	krb5_tl_data */*tl*/);
 
+/**
+ * This function is allows the caller to set new keys for a principal.
+ * This is a trivial wrapper around kadm5_setkey_principal_3().
+ */
+
+kadm5_ret_t
+kadm5_setkey_principal (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	krb5_keyblock */*new_keys*/,
+	int /*n_keys*/);
+
+/**
+ * This function is allows the caller to set new keys for a principal.
+ * This is a simple wrapper around kadm5_get_principal() and
+ * kadm5_modify_principal().
+ */
+
+kadm5_ret_t
+kadm5_setkey_principal_3 (
+	void */*server_handle*/,
+	krb5_principal /*princ*/,
+	krb5_boolean /*keepold*/,
+	int /*n_ks_tuple*/,
+	krb5_key_salt_tuple */*ks_tuple*/,
+	krb5_keyblock */*keyblocks*/,
+	int /*n_keys*/);
+
 void
 kadm5_setup_passwd_quality_check (
 	krb5_context /*context*/,
 	const char */*check_library*/,
 	const char */*check_function*/);
 
+int
+kadm5_some_keys_are_bogus (
+	size_t /*n_keys*/,
+	krb5_key_data */*keys*/);
+
+kadm5_ret_t
+kadm5_store_fake_key_data (
+	krb5_storage */*sp*/,
+	krb5_key_data */*key*/);
+
 kadm5_ret_t
 kadm5_store_key_data (
 	krb5_storage */*sp*/,
@@ -232,13 +374,22 @@ kadm5_store_principal_ent_mask (
 	kadm5_principal_ent_t /*princ*/,
 	uint32_t /*mask*/);
 
+kadm5_ret_t
+kadm5_store_principal_ent_nokeys (
+	krb5_storage */*sp*/,
+	kadm5_principal_ent_t /*princ*/);
+
 kadm5_ret_t
 kadm5_store_tl_data (
 	krb5_storage */*sp*/,
 	krb5_tl_data */*tl*/);
 
+kadm5_ret_t
+kadm5_unlock (void */*server_handle*/);
+
 #ifdef __cplusplus
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __kadm5_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/kcm-protos.h b/crypto/external/bsd/heimdal/include/kcm-protos.h
index 1f985c601..1cdde61da 100644
--- a/crypto/external/bsd/heimdal/include/kcm-protos.h
+++ b/crypto/external/bsd/heimdal/include/kcm-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __kcm_protos_h__
 #define __kcm_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -303,4 +304,5 @@ kcm_zero_ccache_data_internal (
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __kcm_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/kdc-private.h b/crypto/external/bsd/heimdal/include/kdc-private.h
index aef929b26..c64940492 100644
--- a/crypto/external/bsd/heimdal/include/kdc-private.h
+++ b/crypto/external/bsd/heimdal/include/kdc-private.h
@@ -24,10 +24,7 @@ _kdc_add_inital_verified_cas (
 
 krb5_error_code
 _kdc_as_rep (
-	krb5_context /*context*/,
-	krb5_kdc_configuration */*config*/,
-	KDC_REQ */*req*/,
-	const krb5_data */*req_buffer*/,
+	kdc_request_t /*r*/,
 	krb5_data */*reply*/,
 	const char */*from*/,
 	struct sockaddr */*from_addr*/,
@@ -42,7 +39,7 @@ _kdc_check_access (
 	hdb_entry_ex */*server_ex*/,
 	const char */*server_name*/,
 	KDC_REQ */*req*/,
-	krb5_data */*e_data*/);
+	METHOD_DATA */*method_data*/);
 
 krb5_boolean
 _kdc_check_addresses (
@@ -83,8 +80,10 @@ krb5_error_code
 _kdc_encode_reply (
 	krb5_context /*context*/,
 	krb5_kdc_configuration */*config*/,
+	krb5_crypto /*armor_crypto*/,
+	uint32_t /*nonce*/,
 	KDC_REP */*rep*/,
-	const EncTicketPart */*et*/,
+	EncTicketPart */*et*/,
 	EncKDCRepPart */*ek*/,
 	krb5_enctype /*etype*/,
 	int /*skvno*/,
@@ -95,6 +94,35 @@ _kdc_encode_reply (
 	const char **/*e_text*/,
 	krb5_data */*reply*/);
 
+krb5_error_code
+_kdc_fast_mk_error (
+	krb5_context /*context*/,
+	kdc_request_t /*r*/,
+	METHOD_DATA */*error_method*/,
+	krb5_crypto /*armor_crypto*/,
+	const KDC_REQ_BODY */*req_body*/,
+	krb5_error_code /*outer_error*/,
+	const char */*e_text*/,
+	krb5_principal /*error_server*/,
+	const PrincipalName */*error_client_name*/,
+	const Realm */*error_client_realm*/,
+	time_t */*csec*/,
+	int */*cusec*/,
+	krb5_data */*error_msg*/);
+
+krb5_error_code
+_kdc_fast_mk_response (
+	krb5_context /*context*/,
+	krb5_crypto /*armor_crypto*/,
+	METHOD_DATA */*pa_data*/,
+	krb5_keyblock */*strengthen_key*/,
+	KrbFastFinished */*finished*/,
+	krb5uint32 /*nonce*/,
+	krb5_data */*data*/);
+
+krb5_error_code
+_kdc_fast_unwrap_request (kdc_request_t /*r*/);
+
 krb5_error_code
 _kdc_find_etype (
 	krb5_context /*context*/,
@@ -120,6 +148,21 @@ _kdc_free_ent (
 	krb5_context /*context*/,
 	hdb_entry_ex */*ent*/);
 
+krb5_error_code
+_kdc_generate_ecdh_keyblock (
+	krb5_context /*context*/,
+	void */*ec_key_pk*/,
+	void **/*ec_key_key*/,
+	unsigned char **/*dh_gen_key*/,
+	size_t */*dh_gen_keylen*/);
+
+krb5_error_code
+_kdc_get_ecdh_param (
+	krb5_context /*context*/,
+	krb5_kdc_configuration */*config*/,
+	SubjectPublicKeyInfo */*dh_key_info*/,
+	void **/*out*/);
+
 krb5_error_code
 _kdc_get_preferred_key (
 	krb5_context /*context*/,
@@ -129,6 +172,9 @@ _kdc_get_preferred_key (
 	krb5_enctype */*enctype*/,
 	Key **/*key*/);
 
+krb5_boolean
+_kdc_is_anon_request (const KDC_REQ_BODY */*b*/);
+
 krb5_boolean
 _kdc_is_anonymous (
 	krb5_context /*context*/,
@@ -178,6 +224,12 @@ _kdc_pk_check_client (
 	pk_client_params */*cp*/,
 	char **/*subject_name*/);
 
+void
+_kdc_pk_free_client_ec_param (
+	krb5_context /*context*/,
+	void */*ec_key_pk*/,
+	void */*ec_key_key*/);
+
 void
 _kdc_pk_free_client_param (
 	krb5_context /*context*/,
@@ -192,7 +244,7 @@ _kdc_pk_mk_pa_reply (
 	krb5_enctype /*sessionetype*/,
 	const KDC_REQ */*req*/,
 	const krb5_data */*req_buffer*/,
-	krb5_keyblock **/*reply_key*/,
+	krb5_keyblock */*reply_key*/,
 	krb5_keyblock */*sessionkey*/,
 	METHOD_DATA */*md*/);
 
@@ -205,6 +257,13 @@ _kdc_pk_rd_padata (
 	hdb_entry_ex */*client*/,
 	pk_client_params **/*ret_params*/);
 
+krb5_error_code
+_kdc_serialize_ecdh_key (
+	krb5_context /*context*/,
+	void */*key*/,
+	unsigned char **/*out*/,
+	size_t */*out_len*/);
+
 krb5_error_code
 _kdc_tgs_rep (
 	krb5_context /*context*/,
diff --git a/crypto/external/bsd/heimdal/include/kdc-protos.h b/crypto/external/bsd/heimdal/include/kdc-protos.h
index a46993b67..3eeb15297 100644
--- a/crypto/external/bsd/heimdal/include/kdc-protos.h
+++ b/crypto/external/bsd/heimdal/include/kdc-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __kdc_protos_h__
 #define __kdc_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -114,4 +115,5 @@ krb5_kdc_windc_init (krb5_context /*context*/);
 }
 #endif
 
+#endif /* DOXY */
 #endif /* __kdc_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/krb5-private.h b/crypto/external/bsd/heimdal/include/krb5-private.h
index 180b504b0..b511590cc 100644
--- a/crypto/external/bsd/heimdal/include/krb5-private.h
+++ b/crypto/external/bsd/heimdal/include/krb5-private.h
@@ -27,10 +27,10 @@
 #endif /* KRB5_DEPRECATED_FUNCTION */
 
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _heim_krb5_ipc_client_clear_target (void);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _heim_krb5_ipc_client_set_target_uid (uid_t /*uid*/);
 
 void
@@ -49,6 +49,15 @@ _krb5_HMAC_MD5_checksum (
 	unsigned /*usage*/,
 	Checksum */*result*/);
 
+krb5_error_code
+_krb5_SP800_108_HMAC_KDF (
+	krb5_context /*context*/,
+	const krb5_data */*kdf_K1*/,
+	const krb5_data */*kdf_label*/,
+	const krb5_data */*kdf_context*/,
+	const EVP_MD */*md*/,
+	krb5_data */*kdf_K0*/);
+
 krb5_error_code
 _krb5_SP_HMAC_SHA1_checksum (
 	krb5_context /*context*/,
@@ -58,6 +67,12 @@ _krb5_SP_HMAC_SHA1_checksum (
 	unsigned /*usage*/,
 	Checksum */*result*/);
 
+krb5_error_code
+_krb5_aes_sha2_md_for_enctype (
+	krb5_context /*context*/,
+	krb5_enctype /*enctype*/,
+	const EVP_MD **/*md*/);
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_build_authenticator (
 	krb5_context /*context*/,
@@ -69,6 +84,12 @@ _krb5_build_authenticator (
 	krb5_key_usage /*usage*/);
 
 krb5_error_code
+_krb5_build_authpack_subjectPK_EC (
+	krb5_context /*context*/,
+	krb5_pk_init_ctx /*ctx*/,
+	AuthPack */*a*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_cc_allocate (
 	krb5_context /*context*/,
 	const krb5_cc_ops */*ops*/,
@@ -87,7 +108,7 @@ _krb5_config_get (
 	int /*type*/,
 	...);
 
-krb5_config_section *
+KRB5_LIB_FUNCTION krb5_config_section * KRB5_LIB_CALL
 _krb5_config_get_entry (
 	krb5_config_section **/*parent*/,
 	const char */*name*/,
@@ -101,7 +122,7 @@ _krb5_config_get_next (
 	int /*type*/,
 	...);
 
-const void *
+KRB5_LIB_FUNCTION const void * KRB5_LIB_CALL
 _krb5_config_vget (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
@@ -121,10 +142,10 @@ _krb5_copy_send_to_kdc_func (
 	krb5_context /*context*/,
 	krb5_context /*to*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_crc_init_table (void);
 
-uint32_t
+KRB5_LIB_FUNCTION uint32_t KRB5_LIB_CALL
 _krb5_crc_update (
 	const char */*p*/,
 	size_t /*len*/,
@@ -136,12 +157,12 @@ _krb5_debug (
 	int /*level*/,
 	const char */*fmt*/,
 	...)
-     __attribute__((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_debug_backtrace (krb5_context /*context*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_derive_key (
 	krb5_context /*context*/,
 	struct _krb5_encryption_type */*et*/,
@@ -149,7 +170,7 @@ _krb5_derive_key (
 	const void */*constant*/,
 	size_t /*len*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_des_checksum (
 	krb5_context /*context*/,
 	const EVP_MD */*evp_md*/,
@@ -158,7 +179,7 @@ _krb5_des_checksum (
 	size_t /*len*/,
 	Checksum */*cksum*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_des_verify (
 	krb5_context /*context*/,
 	const EVP_MD */*evp_md*/,
@@ -167,7 +188,7 @@ _krb5_des_verify (
 	size_t /*len*/,
 	Checksum */*C*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_dh_group_ok (
 	krb5_context /*context*/,
 	unsigned long /*bits*/,
@@ -177,13 +198,18 @@ _krb5_dh_group_ok (
 	struct krb5_dh_moduli **/*moduli*/,
 	char **/*name*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_einval (
 	krb5_context /*context*/,
 	const char */*func*/,
 	unsigned long /*argn*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+_krb5_enctype_requires_random_salt (
+	krb5_context /*context*/,
+	krb5_enctype /*enctype*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_erase_file (
 	krb5_context /*context*/,
 	const char */*filename*/);
@@ -219,7 +245,7 @@ _krb5_evp_schedule (
 	struct _krb5_key_type */*kt*/,
 	struct _krb5_key_data */*kd*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_expand_default_cc_name (
 	krb5_context /*context*/,
 	const char */*str*/,
@@ -229,9 +255,18 @@ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_expand_path_tokens (
 	krb5_context /*context*/,
 	const char */*path_in*/,
+	int /*filepath*/,
 	char **/*ppath_out*/);
 
-int
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_expand_path_tokensv (
+	krb5_context /*context*/,
+	const char */*path_in*/,
+	int /*filepath*/,
+	char **/*ppath_out*/,
+	...);
+
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_extract_ticket (
 	krb5_context /*context*/,
 	krb5_kdc_rep */*rep*/,
@@ -242,28 +277,75 @@ _krb5_extract_ticket (
 	krb5_addresses */*addrs*/,
 	unsigned /*nonce*/,
 	unsigned /*flags*/,
+	krb5_data */*request*/,
 	krb5_decrypt_proc /*decrypt_proc*/,
 	krb5_const_pointer /*decryptarg*/);
 
-struct _krb5_checksum_type *
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_fast_armor_key (
+	krb5_context /*context*/,
+	krb5_keyblock */*subkey*/,
+	krb5_keyblock */*sessionkey*/,
+	krb5_keyblock */*armorkey*/,
+	krb5_crypto */*armor_crypto*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_fast_cf2 (
+	krb5_context /*context*/,
+	krb5_keyblock */*key1*/,
+	const char */*pepper1*/,
+	krb5_keyblock */*key2*/,
+	const char */*pepper2*/,
+	krb5_keyblock */*armorkey*/,
+	krb5_crypto */*armor_crypto*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_find_capath (
+	krb5_context /*context*/,
+	const char */*client_realm*/,
+	const char */*local_realm*/,
+	const char */*server_realm*/,
+	krb5_boolean /*use_hierarchical*/,
+	char ***/*rpath*/,
+	size_t */*npath*/);
+
+KRB5_LIB_FUNCTION struct _krb5_checksum_type * KRB5_LIB_CALL
 _krb5_find_checksum (krb5_cksumtype /*type*/);
 
-struct _krb5_encryption_type *
+KRB5_LIB_FUNCTION struct _krb5_encryption_type * KRB5_LIB_CALL
 _krb5_find_enctype (krb5_enctype /*type*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_free_capath (
+	krb5_context /*context*/,
+	char **/*capath*/);
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_key_data (
 	krb5_context /*context*/,
 	struct _krb5_key_data */*key*/,
 	struct _krb5_encryption_type */*et*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_krbhst_info (krb5_krbhst_info */*hi*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_free_moduli (struct krb5_dh_moduli **/*moduli*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION void
+_krb5_free_name_canon_rules (
+	krb5_context /*context*/,
+	krb5_name_canon_rule /*rules*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+_krb5_get_ad (
+	krb5_context /*context*/,
+	const AuthorizationData */*ad*/,
+	krb5_keyblock */*sessionkey*/,
+	int /*type*/,
+	krb5_data */*data*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_cred_kdc_any (
 	krb5_context /*context*/,
 	krb5_kdc_flags /*flags*/,
@@ -274,13 +356,13 @@ _krb5_get_cred_kdc_any (
 	krb5_creds **/*out_creds*/,
 	krb5_creds ***/*ret_tgts*/);
 
-char *
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
 _krb5_get_default_cc_name_from_registry (krb5_context /*context*/);
 
-char *
+KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
 _krb5_get_default_config_config_files_from_registry (void);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_default_principal_local (
 	krb5_context /*context*/,
 	krb5_principal */*princ*/);
@@ -301,19 +383,30 @@ _krb5_get_int (
 	unsigned long */*value*/,
 	size_t /*size*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
+_krb5_get_int64 (
+	void */*buffer*/,
+	uint64_t */*value*/,
+	size_t /*size*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_get_krbtgt (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_realm /*realm*/,
 	krb5_creds **/*cred*/);
 
-krb5_boolean KRB5_LIB_FUNCTION
+KRB5_LIB_FUNCTION krb5_error_code
+_krb5_get_name_canon_rules (
+	krb5_context /*context*/,
+	krb5_name_canon_rule */*rules*/);
+
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 _krb5_have_debug (
 	krb5_context /*context*/,
 	int /*level*/);
 
-krb5_boolean
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 _krb5_homedir_access (krb5_context /*context*/);
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -324,7 +417,7 @@ _krb5_init_etype (
 	krb5_enctype **/*val*/,
 	const krb5_enctype */*etypes*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_internal_hmac (
 	krb5_context /*context*/,
 	struct _krb5_checksum_type */*cm*/,
@@ -357,7 +450,7 @@ _krb5_kcm_noop (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
-krb5_error_code KRB5_CALLCONV
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_kdc_retry (
 	krb5_context /*context*/,
 	krb5_sendto_ctx /*ctx*/,
@@ -365,16 +458,16 @@ _krb5_kdc_retry (
 	const krb5_data */*reply*/,
 	int */*action*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_krbhost_info_move (
 	krb5_context /*context*/,
 	krb5_krbhst_info */*from*/,
 	krb5_krbhst_info **/*to*/);
 
-const char *
+KRB5_LIB_FUNCTION const char * KRB5_LIB_CALL
 _krb5_krbhst_get_realm (krb5_krbhst_handle /*handle*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_kt_principal_not_found (
 	krb5_context /*context*/,
 	krb5_error_code /*ret*/,
@@ -383,16 +476,34 @@ _krb5_kt_principal_not_found (
 	krb5_enctype /*enctype*/,
 	int /*kvno*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+_krb5_kuserok (
+	krb5_context /*context*/,
+	krb5_principal /*principal*/,
+	const char */*luser*/,
+	krb5_boolean /*an2ln_ok*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_load_ccache_plugins (krb5_context /*context*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_load_db_plugins (krb5_context /*context*/);
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_load_plugins (
 	krb5_context /*context*/,
 	const char */*name*/,
 	const char **/*paths*/);
 
 krb5_error_code
+_krb5_make_fast_ap_fxarmor (
+	krb5_context /*context*/,
+	krb5_ccache /*armor_ccache*/,
+	krb5_data */*armor_value*/,
+	krb5_keyblock */*armor_key*/,
+	krb5_crypto */*armor_crypto*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_mk_req_internal (
 	krb5_context /*context*/,
 	krb5_auth_context */*auth_context*/,
@@ -410,7 +521,7 @@ _krb5_n_fold (
 	void */*key*/,
 	size_t /*size*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pac_sign (
 	krb5_context /*context*/,
 	krb5_pac /*p*/,
@@ -420,13 +531,13 @@ _krb5_pac_sign (
 	const krb5_keyblock */*priv_key*/,
 	krb5_data */*data*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_parse_moduli (
 	krb5_context /*context*/,
 	const char */*file*/,
 	struct krb5_dh_moduli ***/*moduli*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_parse_moduli_line (
 	krb5_context /*context*/,
 	const char */*file*/,
@@ -437,7 +548,10 @@ _krb5_parse_moduli_line (
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_pk_cert_free (struct krb5_pk_cert */*cert*/);
 
-krb5_error_code
+void
+_krb5_pk_eckey_free (void */*eckey*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pk_kdf (
 	krb5_context /*context*/,
 	const struct AlgorithmIdentifier */*ai*/,
@@ -480,7 +594,7 @@ _krb5_pk_mk_padata (
 	unsigned /*nonce*/,
 	METHOD_DATA */*md*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_pk_octetstring2key (
 	krb5_context /*context*/,
 	krb5_enctype /*type*/,
@@ -503,22 +617,25 @@ _krb5_pk_rd_pa_reply (
 	krb5_keyblock **/*key*/);
 
 krb5_error_code
+_krb5_pk_rd_pa_reply_ecdh_compute_key (
+	krb5_context /*context*/,
+	krb5_pk_init_ctx /*ctx*/,
+	const unsigned char */*in*/,
+	size_t /*in_sz*/,
+	unsigned char **/*out*/,
+	int */*out_sz*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_plugin_find (
 	krb5_context /*context*/,
 	enum krb5_plugin_type /*type*/,
 	const char */*name*/,
 	struct krb5_plugin **/*list*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_plugin_free (struct krb5_plugin */*list*/);
 
-struct krb5_plugin *
-_krb5_plugin_get_next (struct krb5_plugin */*p*/);
-
-void *
-_krb5_plugin_get_symbol (struct krb5_plugin */*p*/);
-
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_plugin_run_f (
 	krb5_context /*context*/,
 	const char */*module*/,
@@ -526,7 +643,7 @@ _krb5_plugin_run_f (
 	int /*min_version*/,
 	int /*flags*/,
 	void */*userctx*/,
-	krb5_error_code (*/*func*/)(krb5_context, const void *, void *, void *));
+	krb5_error_code (KRB5_LIB_CALL *func)(krb5_context, const void *, void *, void *));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_principal2principalname (
@@ -549,7 +666,7 @@ _krb5_principalname2krb5_principal (
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
 _krb5_put_int (
 	void */*buffer*/,
-	unsigned long /*value*/,
+	uint64_t /*value*/,
 	size_t /*size*/);
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
@@ -558,41 +675,46 @@ _krb5_s4u2self_to_checksumdata (
 	const PA_S4U2Self */*self*/,
 	krb5_data */*data*/);
 
-int
-_krb5_send_and_recv_tcp (
-	krb5_socket_t /*fd*/,
-	time_t /*tmout*/,
-	const krb5_data */*req*/,
-	krb5_data */*rep*/);
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_sendto_ctx_set_krb5hst (
+	krb5_context /*context*/,
+	krb5_sendto_ctx /*ctx*/,
+	krb5_krbhst_handle /*handle*/);
 
-int
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_sendto_ctx_set_prexmit (
+	krb5_sendto_ctx /*ctx*/,
+	krb5_sendto_prexmit /*prexmit*/,
+	void */*data*/);
+
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_set_default_cc_name_to_registry (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
-void
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 _krb5_unload_plugins (
 	krb5_context /*context*/,
 	const char */*name*/);
 
-krb5_error_code
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 _krb5_usage2arcfour (
 	krb5_context /*context*/,
 	unsigned */*usage*/);
 
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_xlock (
 	krb5_context /*context*/,
 	int /*fd*/,
 	krb5_boolean /*exclusive*/,
 	const char */*filename*/);
 
-void
-_krb5_xor (
-	DES_cblock */*key*/,
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+_krb5_xor8 (
+	unsigned char */*a*/,
 	const unsigned char */*b*/);
 
-int
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 _krb5_xunlock (
 	krb5_context /*context*/,
 	int /*fd*/);
diff --git a/crypto/external/bsd/heimdal/include/krb5-protos.h b/crypto/external/bsd/heimdal/include/krb5-protos.h
index f2f5f9ebb..a312e070f 100644
--- a/crypto/external/bsd/heimdal/include/krb5-protos.h
+++ b/crypto/external/bsd/heimdal/include/krb5-protos.h
@@ -1,6 +1,7 @@
 /* This is a generated file */
 #ifndef __krb5_protos_h__
 #define __krb5_protos_h__
+#ifndef DOXY
 
 #include <stdarg.h>
 
@@ -44,6 +45,22 @@ extern "C" {
 #endif
 #endif
 #endif
+/**
+ * Convert the v5 credentials in in_cred to v4-dito in v4creds.  This
+ * is done by sending them to the 524 function in the KDC.  If
+ * `in_cred' doesn't contain a DES session key, then a new one is
+ * gotten from the KDC and stored in the cred cache `ccache'.
+ *
+ * @param context Kerberos 5 context.
+ * @param in_cred the credential to convert
+ * @param v4creds the converted credential
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5_v4compat
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb524_convert_creds_kdc (
 	krb5_context /*context*/,
@@ -51,6 +68,21 @@ krb524_convert_creds_kdc (
 	struct credentials */*v4creds*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Convert the v5 credentials in in_cred to v4-dito in v4creds,
+ * check the credential cache ccache before checking with the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param ccache credential cache used to check for des-ticket.
+ * @param in_cred the credential to convert
+ * @param v4creds the converted credential
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5_v4compat
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb524_convert_creds_kdc_ccache (
 	krb5_context /*context*/,
@@ -59,20 +91,58 @@ krb524_convert_creds_kdc_ccache (
 	struct credentials */*v4creds*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Log a warning to the log, default stderr, include the error from
+ * the last failure and then abort.
+ *
+ * @param context A Kerberos 5 context
+ * @param code error code of the last error
+ * @param fmt message to print
+ * @param ... arguments for format string
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_abort (
 	krb5_context /*context*/,
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((noreturn, format (printf, 3, 4)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 4)));
+
+/**
+ * Log a warning to the log, default stderr, and then abort.
+ *
+ * @param context A Kerberos 5 context
+ * @param fmt printf format string of message to print
+ * @param ... arguments for format string
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_abortx (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((noreturn, format (printf, 2, 3)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 3)));
+
+/**
+ * krb5_acl_match_file matches ACL format against each line in a file
+ * using krb5_acl_match_string(). Lines starting with # are treated
+ * like comments and ignored.
+ *
+ * @param context Kerberos 5 context.
+ * @param file file with acl listed in the file.
+ * @param format format to match.
+ * @param ... parameter to format string.
+ *
+ * @return Return an error code or 0.
+ *
+ * @sa krb5_acl_match_string
+ * @ingroup krb5_support
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_acl_match_file (
@@ -81,6 +151,52 @@ krb5_acl_match_file (
 	const char */*format*/,
 	...);
 
+/**
+ * krb5_acl_match_string matches ACL format against a string.
+ *
+ * The ACL format has three format specifiers: s, f, and r.  Each
+ * specifier will retrieve one argument from the variable arguments
+ * for either matching or storing data.  The input string is split up
+ * using " " (space) and "\t" (tab) as a delimiter; multiple and "\t"
+ * in a row are considered to be the same.
+ *
+ * List of format specifiers:
+ * - s Matches a string using strcmp(3) (case sensitive).
+ * - f Matches the string with fnmatch(3). Theflags
+ *     argument (the last argument) passed to the fnmatch function is 0.
+ * - r Returns a copy of the string in the char ** passed in; the copy
+ *     must be freed with free(3). There is no need to free(3) the
+ *     string on error: the function will clean up and set the pointer
+ *     to NULL.
+ *
+ * @param context Kerberos 5 context
+ * @param string string to match with
+ * @param format format to match
+ * @param ... parameter to format string
+ *
+ * @return Return an error code or 0.
+ *
+ *
+ * @code
+ * char *s;
+ *
+ * ret = krb5_acl_match_string(context, "foo", "s", "foo");
+ * if (ret)
+ *     krb5_errx(context, 1, "acl didn't match");
+ * ret = krb5_acl_match_string(context, "foo foo baz/kaka",
+ *     "ss", "foo", &s, "foo/\\*");
+ * if (ret) {
+ *     // no need to free(s) on error
+ *     assert(s == NULL);
+ *     krb5_errx(context, 1, "acl didn't match");
+ * }
+ * free(s);
+ * @endcode
+ *
+ * @sa krb5_acl_match_file
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_acl_match_string (
 	krb5_context /*context*/,
@@ -88,16 +204,56 @@ krb5_acl_match_string (
 	const char */*format*/,
 	...);
 
+/**
+ * Add a specified list of error messages to the et list in context.
+ * Call func (probably a comerr-generated function) with a pointer to
+ * the current et_list.
+ *
+ * @param context A kerberos context.
+ * @param func The generated com_err et function.
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_add_et_list (
 	krb5_context /*context*/,
 	void (*/*func*/)(struct et_list **));
 
+/**
+ * Add extra address to the address list that the library will add to
+ * the client's address list when communicating with the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses addreses to add
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_add_extra_addresses (
 	krb5_context /*context*/,
 	krb5_addresses */*addresses*/);
 
+/**
+ * Add extra addresses to ignore when fetching addresses from the
+ * underlaying operating system.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses addreses to ignore
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_add_ignore_addresses (
 	krb5_context /*context*/,
@@ -119,6 +275,27 @@ krb5_addlog_func (
 	krb5_log_close_func_t /*close_func*/,
 	void */*data*/);
 
+/**
+ * krb5_addr2sockaddr sets the "struct sockaddr sockaddr" from addr
+ * and port. The argument sa_size should initially contain the size of
+ * the sa and after the call, it will contain the actual length of the
+ * address. In case of the sa is too small to fit the whole address,
+ * the up to *sa_size will be stored, and then *sa_size will be set to
+ * the required length.
+ *
+ * @param context a Keberos context
+ * @param addr the address to copy the from
+ * @param sa the struct sockaddr that will be filled in
+ * @param sa_size pointer to length of sa, and after the call, it will
+ * contain the actual length of the address.
+ * @param port set port in sa.
+ *
+ * @return Return an error code or 0. Will return
+ * KRB5_PROG_ATYPE_NOSUPP in case address type is not supported.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_addr2sockaddr (
 	krb5_context /*context*/,
@@ -127,18 +304,61 @@ krb5_addr2sockaddr (
 	krb5_socklen_t */*sa_size*/,
 	int /*port*/);
 
+/**
+ * krb5_address_compare compares the addresses  addr1 and addr2.
+ * Returns TRUE if the two addresses are the same.
+ *
+ * @param context a Keberos context
+ * @param addr1 address to compare
+ * @param addr2 address to compare
+ *
+ * @return Return an TRUE is the address are the same FALSE if not
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_address_compare (
 	krb5_context /*context*/,
 	const krb5_address */*addr1*/,
 	const krb5_address */*addr2*/);
 
+/**
+ * krb5_address_order compares the addresses addr1 and addr2 so that
+ * it can be used for sorting addresses. If the addresses are the same
+ * address krb5_address_order will return 0. Behavies like memcmp(2).
+ *
+ * @param context a Keberos context
+ * @param addr1 krb5_address to compare
+ * @param addr2 krb5_address to compare
+ *
+ * @return < 0 if address addr1 in "less" then addr2. 0 if addr1 and
+ * addr2 is the same address, > 0 if addr2 is "less" then addr1.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_address_order (
 	krb5_context /*context*/,
 	const krb5_address */*addr1*/,
 	const krb5_address */*addr2*/);
 
+/**
+ * Calculate the boundary addresses of `inaddr'/`prefixlen' and store
+ * them in `low' and `high'.
+ *
+ * @param context a Keberos context
+ * @param inaddr address in prefixlen that the bondery searched
+ * @param prefixlen width of boundery
+ * @param low lowest address
+ * @param high highest address
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_address_prefixlen_boundary (
 	krb5_context /*context*/,
@@ -147,17 +367,57 @@ krb5_address_prefixlen_boundary (
 	krb5_address */*low*/,
 	krb5_address */*high*/);
 
+/**
+ * krb5_address_search checks if the address addr is a member of the
+ * address set list addrlist .
+ *
+ * @param context a Keberos context.
+ * @param addr address to search for.
+ * @param addrlist list of addresses to look in for addr.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_address_search (
 	krb5_context /*context*/,
 	const krb5_address */*addr*/,
 	const krb5_addresses */*addrlist*/);
 
+/**
+ * Enable or disable all weak encryption types
+ *
+ * @param context Kerberos 5 context
+ * @param enable true to enable, false to disable
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_allow_weak_crypto (
 	krb5_context /*context*/,
 	krb5_boolean /*enable*/);
 
+/**
+ * Map a principal name to a local username.
+ *
+ * Returns 0 on success, KRB5_NO_LOCALNAME if no mapping was found, or
+ * some Kerberos or system error.
+ *
+ * Inputs:
+ *
+ * @param context    A krb5_context
+ * @param aname      A principal name
+ * @param lnsize     The size of the buffer into which the username will be written
+ * @param lname      The buffer into which the username will be written
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_aname_to_localname (
 	krb5_context /*context*/,
@@ -165,6 +425,23 @@ krb5_aname_to_localname (
 	size_t /*lnsize*/,
 	char */*lname*/);
 
+/**
+ * krb5_anyaddr fills in a "struct sockaddr sa" that can be used to
+ * bind(2) to.  The argument sa_size should initially contain the size
+ * of the sa, and after the call, it will contain the actual length
+ * of the address.
+ *
+ * @param context a Keberos context
+ * @param af address family
+ * @param sa sockaddr
+ * @param sa_size lenght of sa.
+ * @param port for to fill into sa.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_anyaddr (
 	krb5_context /*context*/,
@@ -200,12 +477,32 @@ krb5_appdefault_time (
 	time_t /*def_val*/,
 	time_t */*ret_val*/);
 
+/**
+ * krb5_append_addresses adds the set of addresses in source to
+ * dest. While copying the addresses, duplicates are also sorted out.
+ *
+ * @param context a Keberos context
+ * @param dest destination of copy operation
+ * @param source adresses that are going to be added to dest
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_append_addresses (
 	krb5_context /*context*/,
 	krb5_addresses */*dest*/,
 	const krb5_addresses */*source*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_auth_con_add_AuthorizationData (
+	krb5_context /*context*/,
+	krb5_auth_context /*auth_context*/,
+	int /*type*/,
+	krb5_data */*data*/);
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_addflags (
 	krb5_context /*context*/,
@@ -213,11 +510,28 @@ krb5_auth_con_addflags (
 	int32_t /*addflags*/,
 	int32_t */*flags*/);
 
+/**
+ * Deallocate an authentication context previously initialized with
+ * krb5_auth_con_init().
+ *
+ * @param context      A kerberos context.
+ * @param auth_context The authentication context to be deallocated.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_free (
 	krb5_context /*context*/,
 	krb5_auth_context /*auth_context*/);
 
+/**
+ * Update the authentication context \a auth_context with the local
+ * and remote addresses from socket \a fd, according to \a flags.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_genaddrs (
 	krb5_context /*context*/,
@@ -310,6 +624,17 @@ krb5_auth_con_getsendsubkey (
 	krb5_auth_context /*auth_context*/,
 	krb5_keyblock **/*keyblock*/);
 
+/**
+ * Allocate and initialize an autentication context.
+ *
+ * @param context      A kerberos context.
+ * @param auth_context The authentication context to be initialized.
+ *
+ * Use krb5_auth_con_free() to release the memory when done using the context.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_con_init (
 	krb5_context /*context*/,
@@ -407,6 +732,12 @@ krb5_auth_con_setuserkey (
 	krb5_auth_context /*auth_context*/,
 	krb5_keyblock */*keyblock*/);
 
+/**
+ * Deprecated: use krb5_auth_con_getremoteseqnumber()
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_auth_getremoteseqnumber (
 	krb5_context /*context*/,
@@ -423,6 +754,20 @@ krb5_build_ap_req (
 	krb5_data /*authenticator*/,
 	krb5_data */*retdata*/);
 
+/**
+ * Build a principal using vararg style building
+ *
+ * @param context A Kerberos context.
+ * @param principal returned principal
+ * @param rlen length of realm
+ * @param realm realm name
+ * @param ... a list of components ended with NULL.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_build_principal (
 	krb5_context /*context*/,
@@ -492,6 +837,12 @@ krb5_c_encrypt_length (
 	size_t /*inputlen*/,
 	size_t */*length*/);
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_c_enctype_compare (
 	krb5_context /*context*/,
@@ -575,49 +926,140 @@ krb5_c_verify_checksum (
 	const krb5_checksum */*cksum*/,
 	krb5_boolean */*valid*/);
 
+/**
+ * Destroy the cursor `cursor'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_cache_end_seq_get (
 	krb5_context /*context*/,
 	krb5_cc_cache_cursor /*cursor*/);
 
+/**
+ * Start iterating over all caches of specified type. See also
+ * krb5_cccol_cursor_new().
+
+ * @param context A Kerberos 5 context
+ * @param type optional type to iterate over, if NULL, the default cache is used.
+ * @param cursor cursor should be freed with krb5_cc_cache_end_seq_get().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_cache_get_first (
 	krb5_context /*context*/,
 	const char */*type*/,
 	krb5_cc_cache_cursor */*cursor*/);
 
+/**
+ * Search for a matching credential cache that have the
+ * `principal' as the default principal. On success, `id' needs to be
+ * freed with krb5_cc_close() or krb5_cc_destroy().
+ *
+ * @param context A Kerberos 5 context
+ * @param client The principal to search for
+ * @param id the returned credential cache
+ *
+ * @return On failure, error code is returned and `id' is set to NULL.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_cache_match (
 	krb5_context /*context*/,
 	krb5_principal /*client*/,
 	krb5_ccache */*id*/);
 
+/**
+ * Retrieve the next cache pointed to by (`cursor') in `id'
+ * and advance `cursor'.
+ *
+ * @param context A Kerberos 5 context
+ * @param cursor the iterator cursor, returned by krb5_cc_cache_get_first()
+ * @param id next ccache
+ *
+ * @return Return 0 or an error code. Returns KRB5_CC_END when the end
+ *         of caches is reached, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_cache_next (
 	krb5_context /*context*/,
 	krb5_cc_cache_cursor /*cursor*/,
 	krb5_ccache */*id*/);
 
+/**
+ * Clear `mcreds' so it can be used with krb5_cc_retrieve_cred
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_cc_clear_mcred (krb5_creds */*mcred*/);
 
+/**
+ * Stop using the ccache `id' and free the related resources.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_close (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * Just like krb5_cc_copy_match_f(), but copy everything.
+ *
+ * @ingroup @krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_copy_cache (
 	krb5_context /*context*/,
 	const krb5_ccache /*from*/,
 	krb5_ccache /*to*/);
 
+/**
+ * MIT compat glue
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_copy_creds (
 	krb5_context /*context*/,
 	const krb5_ccache /*from*/,
 	krb5_ccache /*to*/);
 
+/**
+ * Copy the contents of `from' to `to' if the given match function
+ * return true.
+ *
+ * @param context A Kerberos 5 context.
+ * @param from the cache to copy data from.
+ * @param to the cache to copy data to.
+ * @param match a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
+ * @param matchctx context passed to match function.
+ * @param matched set to true if there was a credential that matched, may be NULL.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_copy_match_f (
 	krb5_context /*context*/,
@@ -627,25 +1069,66 @@ krb5_cc_copy_match_f (
 	void */*matchctx*/,
 	unsigned int */*matched*/);
 
+/**
+ * Open the default ccache in `id'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_default (
 	krb5_context /*context*/,
 	krb5_ccache */*id*/);
 
+/**
+ * Return a pointer to a context static string containing the default
+ * ccache name.
+ *
+ * @return String to the default credential cache name.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_cc_default_name (krb5_context /*context*/);
 
+/**
+ * Remove the ccache `id'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_destroy (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * Destroy the cursor `cursor'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_end_seq_get (
 	krb5_context /*context*/,
 	const krb5_ccache /*id*/,
 	krb5_cc_cursor */*cursor*/);
 
+/**
+ * Generate a new ccache of type `ops' in `id'.
+ *
+ * Deprecated: use krb5_cc_new_unique() instead.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_gen_new (
 	krb5_context /*context*/,
@@ -653,6 +1136,19 @@ krb5_cc_gen_new (
 	krb5_ccache */*id*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Get some configuration for the credential cache in the cache.
+ *
+ * @param context a Keberos context
+ * @param id the credential cache to store the data for
+ * @param principal configuration for a specific principal, if
+ * NULL, global for the whole cache.
+ * @param name name under which the configuraion is stored.
+ * @param data data to fetched, free with krb5_data_free()
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_config (
 	krb5_context /*context*/,
@@ -661,85 +1157,230 @@ krb5_cc_get_config (
 	const char */*name*/,
 	krb5_data */*data*/);
 
+/**
+ * Get the flags of `id', store them in `flags'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_flags (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_flags */*flags*/);
 
+/**
+ * Return a friendly name on credential cache. Free the result with krb5_xfree().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_friendly_name (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	char **/*name*/);
 
+/**
+ * Return the complete resolvable name the cache
+
+ * @param context a Keberos context
+ * @param id return pointer to a found credential cache
+ * @param str the returned name of a credential cache, free with krb5_xfree()
+ *
+ * @return Returns 0 or an error (and then *str is set to NULL).
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_full_name (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	char **/*str*/);
 
+/**
+ * Get the time offset betwen the client and the KDC
+ *
+ * If the backend doesn't support KDC offset, use the context global setting.
+ *
+ * @param context A Kerberos 5 context.
+ * @param id a credential cache
+ * @param offset the offset in seconds
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_kdc_offset (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_deltat */*offset*/);
 
+/**
+ * Get the lifetime of the initial ticket in the cache
+ *
+ * Get the lifetime of the initial ticket in the cache, if the initial
+ * ticket was not found, the error code KRB5_CC_END is returned.
+ *
+ * @param context A Kerberos 5 context.
+ * @param id a credential cache
+ * @param t the relative lifetime of the initial ticket
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_lifetime (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	time_t */*t*/);
 
+/**
+ * Return the name of the ccache `id'
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_cc_get_name (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * Return krb5_cc_ops of a the ccache `id'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
 krb5_cc_get_ops (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * Get the cc ops that is registered in `context' to handle the
+ * prefix. prefix can be a complete credential cache name or a
+ * prefix, the function will only use part up to the first colon (:)
+ * if there is one. If prefix the argument is NULL, the default ccache
+ * implemtation is returned.
+ *
+ * @return Returns NULL if ops not found.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION const krb5_cc_ops * KRB5_LIB_CALL
 krb5_cc_get_prefix_ops (
 	krb5_context /*context*/,
 	const char */*prefix*/);
 
+/**
+ * Return the principal of `id' in `principal'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_principal (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_principal */*principal*/);
 
+/**
+ * Return the type of the ccache `id'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_cc_get_type (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * Return the version of `id'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_get_version (
 	krb5_context /*context*/,
 	const krb5_ccache /*id*/);
 
+/**
+ * Create a new ccache in `id' for `primary_principal'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_initialize (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_principal /*primary_principal*/);
 
+/**
+ * Return the last time the credential cache was modified.
+ *
+ * @param context A Kerberos 5 context
+ * @param id The credential cache to probe
+ * @param mtime the last modification time, set to 0 on error.
+
+ * @return Return 0 or and error. See krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_last_change_time (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_timestamp */*mtime*/);
 
+/**
+ * Move the content from one credential cache to another. The
+ * operation is an atomic switch.
+ *
+ * @param context a Keberos context
+ * @param from the credential cache to move the content from
+ * @param to the credential cache to move the content to
+
+ * @return On sucess, from is freed. On failure, error code is
+ * returned and from and to are both still allocated, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_move (
 	krb5_context /*context*/,
 	krb5_ccache /*from*/,
 	krb5_ccache /*to*/);
 
+/**
+ * Generates a new unique ccache of `type` in `id'. If `type' is NULL,
+ * the library chooses the default credential cache type. The supplied
+ * `hint' (that can be NULL) is a string that the credential cache
+ * type can use to base the name of the credential on, this is to make
+ * it easier for the user to differentiate the credentials.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_new_unique (
 	krb5_context /*context*/,
@@ -747,6 +1388,15 @@ krb5_cc_new_unique (
 	const char */*hint*/,
 	krb5_ccache */*id*/);
 
+/**
+ * Retrieve the next cred pointed to by (`id', `cursor') in `creds'
+ * and advance `cursor'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_next_cred (
 	krb5_context /*context*/,
@@ -754,12 +1404,32 @@ krb5_cc_next_cred (
 	krb5_cc_cursor */*cursor*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Add a new ccache type with operations `ops', overwriting any
+ * existing one if `override'.
+ *
+ * @param context a Keberos context
+ * @param ops type of plugin symbol
+ * @param override flag to select if the registration is to overide
+ * an existing ops with the same name.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_register (
 	krb5_context /*context*/,
 	const krb5_cc_ops */*ops*/,
 	krb5_boolean /*override*/);
 
+/**
+ * Remove the credential identified by `cred', `which' from `id'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_remove_cred (
 	krb5_context /*context*/,
@@ -767,12 +1437,43 @@ krb5_cc_remove_cred (
 	krb5_flags /*which*/,
 	krb5_creds */*cred*/);
 
+/**
+ * Find and allocate a ccache in `id' from the specification in `residual'.
+ * If the ccache name doesn't contain any colon, interpret it as a file name.
+ *
+ * @param context a Keberos context.
+ * @param name string name of a credential cache.
+ * @param id return pointer to a found credential cache.
+ *
+ * @return Return 0 or an error code. In case of an error, id is set
+ * to NULL, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_resolve (
 	krb5_context /*context*/,
 	const char */*name*/,
 	krb5_ccache */*id*/);
 
+/**
+ * Retrieve the credential identified by `mcreds' (and `whichfields')
+ * from `id' in `creds'. 'creds' must be free by the caller using
+ * krb5_free_cred_contents.
+ *
+ * @param context A Kerberos 5 context
+ * @param id a Kerberos 5 credential cache
+ * @param whichfields what fields to use for matching credentials, same
+ *        flags as whichfields in krb5_compare_creds()
+ * @param mcreds template credential to use for comparing
+ * @param creds returned credential, free with krb5_free_cred_contents()
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_retrieve_cred (
 	krb5_context /*context*/,
@@ -781,6 +1482,20 @@ krb5_cc_retrieve_cred (
 	const krb5_creds */*mcreds*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Store some configuration for the credential cache in the cache.
+ * Existing configuration under the same name is over-written.
+ *
+ * @param context a Keberos context
+ * @param id the credential cache to store the data for
+ * @param principal configuration for a specific principal, if
+ * NULL, global for the whole cache.
+ * @param name name under which the configuraion is stored.
+ * @param data data to store, if NULL, configure is removed.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_set_config (
 	krb5_context /*context*/,
@@ -789,73 +1504,209 @@ krb5_cc_set_config (
 	const char */*name*/,
 	krb5_data */*data*/);
 
+/**
+ * Set the default cc name for `context' to `name'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_set_default_name (
 	krb5_context /*context*/,
 	const char */*name*/);
 
+/**
+ * Set the flags of `id' to `flags'.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_set_flags (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_flags /*flags*/);
 
+/**
+ * Set the friendly name on credential cache.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_set_friendly_name (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	const char */*name*/);
 
+/**
+ * Set the time offset betwen the client and the KDC
+ *
+ * If the backend doesn't support KDC offset, use the context global setting.
+ *
+ * @param context A Kerberos 5 context.
+ * @param id a credential cache
+ * @param offset the offset in seconds
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_set_kdc_offset (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_deltat /*offset*/);
 
+/**
+ * Start iterating over `id', `cursor' is initialized to the
+ * beginning.  Caller must free the cursor with krb5_cc_end_seq_get().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_start_seq_get (
 	krb5_context /*context*/,
 	const krb5_ccache /*id*/,
 	krb5_cc_cursor */*cursor*/);
 
+/**
+ * Store `creds' in the ccache `id'.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_store_cred (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Return true if the default credential cache support switch
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_cc_support_switch (
 	krb5_context /*context*/,
 	const char */*type*/);
 
+/**
+ * Switch the default default credential cache for a specific
+ * credcache type (and name for some implementations).
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cc_switch (
 	krb5_context /*context*/,
 	krb5_ccache /*id*/);
 
+/**
+ * End an iteration and free all resources, can be done before end is reached.
+ *
+ * @param context A Kerberos 5 context
+ * @param cursor the iteration cursor to be freed.
+ *
+ * @return Return 0 or and error, KRB5_CC_END is returned at the end
+ *        of iteration. See krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cccol_cursor_free (
 	krb5_context /*context*/,
 	krb5_cccol_cursor */*cursor*/);
 
+/**
+ * Get a new cache interation cursor that will interate over all
+ * credentials caches independent of type.
+ *
+ * @param context a Keberos context
+ * @param cursor passed into krb5_cccol_cursor_next() and free with krb5_cccol_cursor_free().
+ *
+ * @return Returns 0 or and error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cccol_cursor_new (
 	krb5_context /*context*/,
 	krb5_cccol_cursor */*cursor*/);
 
+/**
+ * Get next credential cache from the iteration.
+ *
+ * @param context A Kerberos 5 context
+ * @param cursor the iteration cursor
+ * @param cache the returned cursor, pointer is set to NULL on failure
+ *        and a cache on success. The returned cache needs to be freed
+ *        with krb5_cc_close() or destroyed with krb5_cc_destroy().
+ *        MIT Kerberos behavies slightly diffrent and sets cache to NULL
+ *        when all caches are iterated over and return 0.
+ *
+ * @return Return 0 or and error, KRB5_CC_END is returned at the end
+ *        of iteration. See krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cccol_cursor_next (
 	krb5_context /*context*/,
 	krb5_cccol_cursor /*cursor*/,
 	krb5_ccache */*cache*/);
 
+/**
+ * Return the last modfication time for a cache collection. The query
+ * can be limited to a specific cache type. If the function return 0
+ * and mtime is 0, there was no credentials in the caches.
+ *
+ * @param context A Kerberos 5 context
+ * @param type The credential cache to probe, if NULL, all type are traversed.
+ * @param mtime the last modification time, set to 0 on error.
+
+ * @return Return 0 or and error. See krb5_get_error_message().
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cccol_last_change_time (
 	krb5_context /*context*/,
 	const char */*type*/,
 	krb5_timestamp */*mtime*/);
 
+/**
+ * Deprecated: krb5_change_password() is deprecated, use krb5_set_password().
+ *
+ * @param context a Keberos context
+ * @param creds
+ * @param newpw
+ * @param result_code
+ * @param result_code_string
+ * @param result_string
+ *
+ * @return On sucess password is changed.
+
+ * @ingroup @krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_change_password (
 	krb5_context /*context*/,
@@ -908,6 +1759,18 @@ krb5_checksumsize (
 	krb5_cksumtype /*type*/,
 	size_t */*size*/);
 
+/**
+ * Return the coresponding encryption type for a checksum type.
+ *
+ * @param context Kerberos context
+ * @param ctype The checksum type to get the result enctype for
+ * @param etype The returned encryption, when the matching etype is
+ * not found, etype is set to ETYPE_NULL.
+ *
+ * @return Return an error code for an failure or 0 on success.
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_cksumtype_to_enctype (
 	krb5_context /*context*/,
@@ -919,9 +1782,27 @@ krb5_cksumtype_valid (
 	krb5_context /*context*/,
 	krb5_cksumtype /*ctype*/);
 
+/**
+ * Clears the error message from the Kerberos 5 context.
+ *
+ * @param context The Kerberos 5 context to clear
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_clear_error_message (krb5_context /*context*/);
 
+/**
+ * Clear the error message returned by krb5_get_error_string().
+ *
+ * Deprecated: use krb5_clear_error_message()
+ *
+ * @param context Kerberos context
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_clear_error_string (krb5_context /*context*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
@@ -931,6 +1812,32 @@ krb5_closelog (
 	krb5_context /*context*/,
 	krb5_log_facility */*fac*/);
 
+/**
+ * Return TRUE if `mcreds' and `creds' are equal (`whichfields'
+ * determines what equal means).
+ *
+ *
+ * The following flags, set in whichfields affects the comparison:
+ * - KRB5_TC_MATCH_SRV_NAMEONLY Consider all realms equal when comparing the service principal.
+ * - KRB5_TC_MATCH_KEYTYPE Compare enctypes.
+ * - KRB5_TC_MATCH_FLAGS_EXACT Make sure that the ticket flags are identical.
+ * - KRB5_TC_MATCH_FLAGS Make sure that all ticket flags set in mcreds are also present in creds .
+ * - KRB5_TC_MATCH_TIMES_EXACT Compares the ticket times exactly.
+ * - KRB5_TC_MATCH_TIMES Compares only the expiration times of the creds.
+ * - KRB5_TC_MATCH_AUTHDATA Compares the authdata fields.
+ * - KRB5_TC_MATCH_2ND_TKT Compares the second tickets (used by user-to-user authentication).
+ * - KRB5_TC_MATCH_IS_SKEY Compares the existance of the second ticket.
+ *
+ * @param context Kerberos 5 context.
+ * @param whichfields which fields to compare.
+ * @param mcreds cred to compare with.
+ * @param creds cred to compare with.
+ *
+ * @return return TRUE if mcred and creds are equal, FALSE if not.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_compare_creds (
 	krb5_context /*context*/,
@@ -938,20 +1845,74 @@ krb5_compare_creds (
 	const krb5_creds * /*mcreds*/,
 	const krb5_creds * /*creds*/);
 
+/**
+ * Free configuration file section, the result of
+ * krb5_config_parse_file() and krb5_config_parse_file_multi().
+ *
+ * @param context A Kerberos 5 context
+ * @param s the configuration section to free
+ *
+ * @return returns 0 on successes, otherwise an error code, see
+ *          krb5_get_error_message()
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_config_file_free (
 	krb5_context /*context*/,
 	krb5_config_section */*s*/);
 
+/**
+ * Free the resulting strings from krb5_config-get_strings() and
+ * krb5_config_vget_strings().
+ *
+ * @param strings strings to free
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_config_free_strings (char **/*strings*/);
 
+/**
+ * Like krb5_config_get_bool() but with a va_list list of
+ * configuration selection.
+ *
+ * Configuration value to a boolean value, where yes/true and any
+ * non-zero number means TRUE and other value is FALSE.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_config_get_bool (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	...);
 
+/**
+ * krb5_config_get_bool_default() will convert the configuration
+ * option value to a boolean value, where yes/true and any non-zero
+ * number means TRUE and other value is FALSE.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_config_get_bool_default (
 	krb5_context /*context*/,
@@ -972,18 +1933,60 @@ krb5_config_get_int_default (
 	int /*def_value*/,
 	...);
 
+/**
+ * Get a list of configuration binding list for more processing
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return NULL if configuration list is not found, a list otherwise
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const krb5_config_binding * KRB5_LIB_CALL
 krb5_config_get_list (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	...);
 
+/**
+ * Returns a "const char *" to a string in the configuration database.
+ * The string may not be valid after a reload of the configuration
+ * database so a caller should make a local copy if it needs to keep
+ * the string.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return NULL if configuration string not found, a string otherwise
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_config_get_string (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	...);
 
+/**
+ * Like krb5_config_get_string(), but instead of returning NULL,
+ * instead return a default value.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return a configuration string
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_config_get_string_default (
 	krb5_context /*context*/,
@@ -991,18 +1994,57 @@ krb5_config_get_string_default (
 	const char */*def_value*/,
 	...);
 
+/**
+ * Get a list of configuration strings, free the result with
+ * krb5_config_free_strings().
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION char** KRB5_LIB_CALL
 krb5_config_get_strings (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	...);
 
+/**
+ * Get the time from the configuration file using a relative time, for example: 1h30s
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return parsed the time or -1 on error
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_config_get_time (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	...);
 
+/**
+ * Get the time from the configuration file using a relative time, for example: 1h30s
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param ... a list of names, terminated with NULL.
+ *
+ * @return parsed the time (or def_value on parse error)
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_config_get_time_default (
 	krb5_context /*context*/,
@@ -1010,18 +2052,43 @@ krb5_config_get_time_default (
 	int /*def_value*/,
 	...);
 
+/**
+     * If the fname starts with "~/" parse configuration file in the
+     * current users home directory. The behavior can be disabled and
+     * enabled by calling krb5_set_home_dir_access().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_config_parse_file (
 	krb5_context /*context*/,
 	const char */*fname*/,
 	krb5_config_section **/*res*/);
 
+/**
+ * Parse a configuration file and add the result into res. This
+ * interface can be used to parse several configuration files into one
+ * resulting krb5_config_section by calling it repeatably.
+ *
+ * @param context a Kerberos 5 context.
+ * @param fname a file name to a Kerberos configuration file
+ * @param res the returned result, must be free with krb5_free_config_files().
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_config_parse_file_multi (
 	krb5_context /*context*/,
 	const char */*fname*/,
 	krb5_config_section **/*res*/);
 
+/**
+ * Deprecated: configuration files are not strings
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_config_parse_string_multi (
 	krb5_context /*context*/,
@@ -1029,12 +2096,44 @@ krb5_config_parse_string_multi (
 	krb5_config_section **/*res*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * krb5_config_get_bool() will convert the configuration
+ * option value to a boolean value, where yes/true and any non-zero
+ * number means TRUE and other value is FALSE.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param args a va_list of arguments
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_config_vget_bool (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	va_list /*args*/);
 
+/**
+ * Like krb5_config_get_bool_default() but with a va_list list of
+ * configuration selection.
+ *
+ * Configuration value to a boolean value, where yes/true and any
+ * non-zero number means TRUE and other value is FALSE.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param args a va_list of arguments
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_config_vget_bool_default (
 	krb5_context /*context*/,
@@ -1055,18 +2154,57 @@ krb5_config_vget_int_default (
 	int /*def_value*/,
 	va_list /*args*/);
 
+/**
+ * Get a list of configuration binding list for more processing
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param args a va_list of arguments
+ *
+ * @return NULL if configuration list is not found, a list otherwise
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const krb5_config_binding * KRB5_LIB_CALL
 krb5_config_vget_list (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	va_list /*args*/);
 
+/**
+ * Like krb5_config_get_string(), but uses a va_list instead of ...
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param args a va_list of arguments
+ *
+ * @return NULL if configuration string not found, a string otherwise
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_config_vget_string (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	va_list /*args*/);
 
+/**
+ * Like krb5_config_vget_string(), but instead of returning NULL,
+ * instead return a default value.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param args a va_list of arguments
+ *
+ * @return a configuration string
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_config_vget_string_default (
 	krb5_context /*context*/,
@@ -1074,18 +2212,60 @@ krb5_config_vget_string_default (
 	const char */*def_value*/,
 	va_list /*args*/);
 
+/**
+ * Get a list of configuration strings, free the result with
+ * krb5_config_free_strings().
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param args a va_list of arguments
+ *
+ * @return TRUE or FALSE
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION char ** KRB5_LIB_CALL
 krb5_config_vget_strings (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	va_list /*args*/);
 
+/**
+ * Get the time from the configuration file using a relative time, for example: 1h30s
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param args a va_list of arguments
+ *
+ * @return parsed the time or -1 on error
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_config_vget_time (
 	krb5_context /*context*/,
 	const krb5_config_section */*c*/,
 	va_list /*args*/);
 
+/**
+ * Get the time from the configuration file using a relative time.
+ *
+ * Like krb5_config_get_time_default() but with a va_list list of
+ * configuration selection.
+ *
+ * @param context A Kerberos 5 context.
+ * @param c a configuration section, or NULL to use the section from context
+ * @param def_value the default value to return if no configuration
+ *        found in the database.
+ * @param args a va_list of arguments
+ *
+ * @return parsed the time (or def_value on parse error)
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_config_vget_time_default (
 	krb5_context /*context*/,
@@ -1093,12 +2273,38 @@ krb5_config_vget_time_default (
 	int /*def_value*/,
 	va_list /*args*/);
 
+/**
+ * krb5_copy_address copies the content of address
+ * inaddr to outaddr.
+ *
+ * @param context a Keberos context
+ * @param inaddr pointer to source address
+ * @param outaddr pointer to destination address
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_address (
 	krb5_context /*context*/,
 	const krb5_address */*inaddr*/,
 	krb5_address */*outaddr*/);
 
+/**
+ * krb5_copy_addresses copies the content of addresses
+ * inaddr to outaddr.
+ *
+ * @param context a Keberos context
+ * @param inaddr pointer to source addresses
+ * @param outaddr pointer to destination addresses
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_addresses (
 	krb5_context /*context*/,
@@ -1111,53 +2317,169 @@ krb5_copy_checksum (
 	const krb5_checksum */*old*/,
 	krb5_checksum **/*new*/);
 
+/**
+ * Make a copy for the Kerberos 5 context, the new krb5_context shoud
+ * be freed with krb5_free_context().
+ *
+ * @param context the Kerberos context to copy
+ * @param out the copy of the Kerberos, set to NULL error.
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_context (
 	krb5_context /*context*/,
 	krb5_context */*out*/);
 
+/**
+ * Copy krb5_creds.
+ *
+ * @param context Kerberos 5 context.
+ * @param incred source credential
+ * @param outcred destination credential, free with krb5_free_creds().
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_creds (
 	krb5_context /*context*/,
 	const krb5_creds */*incred*/,
 	krb5_creds **/*outcred*/);
 
+/**
+ * Copy content of krb5_creds.
+ *
+ * @param context Kerberos 5 context.
+ * @param incred source credential
+ * @param c destination credential, free with krb5_free_cred_contents().
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_creds_contents (
 	krb5_context /*context*/,
 	const krb5_creds */*incred*/,
 	krb5_creds */*c*/);
 
+/**
+ * Copy the data into a newly allocated krb5_data.
+ *
+ * @param context Kerberos 5 context.
+ * @param indata the krb5_data data to copy
+ * @param outdata new krb5_date to copy too. Free with krb5_free_data().
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_data (
 	krb5_context /*context*/,
 	const krb5_data */*indata*/,
 	krb5_data **/*outdata*/);
 
+/**
+ * Copy the list of realms from `from' to `to'.
+ *
+ * @param context Kerberos 5 context.
+ * @param from list of realms to copy from.
+ * @param to list of realms to copy to, free list of krb5_free_host_realm().
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_host_realm (
 	krb5_context /*context*/,
 	const krb5_realm */*from*/,
 	krb5_realm **/*to*/);
 
+/**
+ * Copy a keyblock, free the output keyblock with
+ * krb5_free_keyblock().
+ *
+ * @param context a Kerberos 5 context
+ * @param inblock the key to copy
+ * @param to the output key.
+ *
+ * @return 0 on success or a Kerberos 5 error code
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_keyblock (
 	krb5_context /*context*/,
 	const krb5_keyblock */*inblock*/,
 	krb5_keyblock **/*to*/);
 
+/**
+ * Copy a keyblock, free the output keyblock with
+ * krb5_free_keyblock_contents().
+ *
+ * @param context a Kerberos 5 context
+ * @param inblock the key to copy
+ * @param to the output key.
+ *
+ * @return 0 on success or a Kerberos 5 error code
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_keyblock_contents (
 	krb5_context /*context*/,
 	const krb5_keyblock */*inblock*/,
 	krb5_keyblock */*to*/);
 
+/**
+ * Copy a principal
+ *
+ * @param context A Kerberos context.
+ * @param inprinc principal to copy
+ * @param outprinc copied principal, free with krb5_free_principal()
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_principal (
 	krb5_context /*context*/,
 	krb5_const_principal /*inprinc*/,
 	krb5_principal */*outprinc*/);
 
+/**
+ * Copy ticket and content
+ *
+ * @param context a Kerberos 5 context
+ * @param from ticket to copy
+ * @param to new copy of ticket, free with krb5_free_ticket()
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_copy_ticket (
 	krb5_context /*context*/,
@@ -1174,6 +2496,20 @@ krb5_create_checksum (
 	size_t /*len*/,
 	Checksum */*result*/);
 
+/**
+ * Create a Kerberos message checksum.
+ *
+ * @param context Kerberos context
+ * @param crypto Kerberos crypto context
+ * @param usage Key usage for this buffer
+ * @param data array of buffers to process
+ * @param num_data length of array
+ * @param type output data
+ *
+ * @return Return an error code or 0.
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_create_checksum_iov (
 	krb5_context /*context*/,
@@ -1183,14 +2519,52 @@ krb5_create_checksum_iov (
 	unsigned int /*num_data*/,
 	krb5_cksumtype */*type*/);
 
+/**
+ * Returns the ticket flags for the credentials in creds.
+ * See also krb5_ticket_get_flags().
+ *
+ * @param creds credential to get ticket flags from
+ *
+ * @return ticket flags
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL
 krb5_creds_get_ticket_flags (krb5_creds */*creds*/);
 
+/**
+ * Free a crypto context created by krb5_crypto_init().
+ *
+ * @param context Kerberos context
+ * @param crypto crypto context to free
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_destroy (
 	krb5_context /*context*/,
 	krb5_crypto /*crypto*/);
 
+/**
+ * The FX-CF2 key derivation function, used in FAST and preauth framework.
+ *
+ * @param context Kerberos 5 context
+ * @param crypto1 first key to combine
+ * @param crypto2 second key to combine
+ * @param pepper1 factor to combine with first key to garante uniqueness
+ * @param pepper2 factor to combine with second key to garante uniqueness
+ * @param enctype the encryption type of the resulting key
+ * @param res allocated key, free with krb5_free_keyblock_contents()
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_fx_cf2 (
 	krb5_context /*context*/,
@@ -1207,30 +2581,96 @@ krb5_crypto_get_checksum_type (
 	krb5_crypto /*crypto*/,
 	krb5_cksumtype */*type*/);
 
+/**
+ * Return the blocksize used algorithm referenced by the crypto context
+ *
+ * @param context Kerberos context
+ * @param crypto crypto context to query
+ * @param blocksize the resulting blocksize
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_getblocksize (
 	krb5_context /*context*/,
 	krb5_crypto /*crypto*/,
 	size_t */*blocksize*/);
 
+/**
+ * Return the confounder size used by the crypto context
+ *
+ * @param context Kerberos context
+ * @param crypto crypto context to query
+ * @param confoundersize the returned confounder size
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_getconfoundersize (
 	krb5_context /*context*/,
 	krb5_crypto /*crypto*/,
 	size_t */*confoundersize*/);
 
+/**
+ * Return the encryption type used by the crypto context
+ *
+ * @param context Kerberos context
+ * @param crypto crypto context to query
+ * @param enctype the resulting encryption type
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_getenctype (
 	krb5_context /*context*/,
 	krb5_crypto /*crypto*/,
 	krb5_enctype */*enctype*/);
 
+/**
+ * Return the padding size used by the crypto context
+ *
+ * @param context Kerberos context
+ * @param crypto crypto context to query
+ * @param padsize the return padding size
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_getpadsize (
 	krb5_context /*context*/,
 	krb5_crypto /*crypto*/,
 	size_t */*padsize*/);
 
+/**
+ * Create a crypto context used for all encryption and signature
+ * operation. The encryption type to use is taken from the key, but
+ * can be overridden with the enctype parameter.  This can be useful
+ * for encryptions types which is compatiable (DES for example).
+ *
+ * To free the crypto context, use krb5_crypto_destroy().
+ *
+ * @param context Kerberos context
+ * @param key the key block information with all key data
+ * @param etype the encryption type
+ * @param crypto the resulting crypto context
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_crypto_init (
 	krb5_context /*context*/,
@@ -1270,35 +2710,113 @@ krb5_crypto_prf_length (
 	krb5_enctype /*type*/,
 	size_t */*length*/);
 
+/**
+ * Allocate data of and krb5_data.
+ *
+ * @param p krb5_data to allocate.
+ * @param len size to allocate.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_data_alloc (
 	krb5_data */*p*/,
 	int /*len*/);
 
+/**
+ * Compare to data.
+ *
+ * @param data1 krb5_data to compare
+ * @param data2 krb5_data to compare
+ *
+ * @return return the same way as memcmp(), useful when sorting.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_data_cmp (
 	const krb5_data */*data1*/,
 	const krb5_data */*data2*/);
 
+/**
+ * Copy the data of len into the krb5_data.
+ *
+ * @param p krb5_data to copy into.
+ * @param data data to copy..
+ * @param len new size.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_data_copy (
 	krb5_data */*p*/,
 	const void */*data*/,
 	size_t /*len*/);
 
+/**
+ * Compare to data not exposing timing information from the checksum data
+ *
+ * @param data1 krb5_data to compare
+ * @param data2 krb5_data to compare
+ *
+ * @return returns zero for same data, otherwise non zero.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_data_ct_cmp (
 	const krb5_data */*data1*/,
 	const krb5_data */*data2*/);
 
+/**
+ * Free the content of krb5_data structure, its ok to free a zeroed
+ * structure (with memset() or krb5_data_zero()). When done, the
+ * structure will be zeroed. The same function is called
+ * krb5_free_data_contents() in MIT Kerberos.
+ *
+ * @param p krb5_data to free.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_data_free (krb5_data */*p*/);
 
+/**
+ * Grow (or shrink) the content of krb5_data to a new size.
+ *
+ * @param p krb5_data to free.
+ * @param len new size.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_data_realloc (
 	krb5_data */*p*/,
 	int /*len*/);
 
+/**
+ * Reset the (potentially uninitalized) krb5_data structure.
+ *
+ * @param p krb5_data to reset.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_data_zero (krb5_data */*p*/);
 
@@ -1397,6 +2915,27 @@ krb5_decrypt_EncryptedData (
 	const EncryptedData */*e*/,
 	krb5_data */*result*/);
 
+/**
+ * Inline decrypt a Kerberos message.
+ *
+ * @param context Kerberos context
+ * @param crypto Kerberos crypto context
+ * @param usage Key usage for this buffer
+ * @param data array of buffers to process
+ * @param num_data length of array
+ * @param ivec initial cbc/cts vector
+ *
+ * @return Return an error code or 0.
+ * @ingroup krb5_crypto
+ *
+ * 1. KRB5_CRYPTO_TYPE_HEADER
+ * 2. one KRB5_CRYPTO_TYPE_DATA and array [0,...] of KRB5_CRYPTO_TYPE_SIGN_ONLY in
+ *  any order, however the receiver have to aware of the
+ *  order. KRB5_CRYPTO_TYPE_SIGN_ONLY is commonly used unencrypoted
+ *  protocol headers and trailers. The output data will be of same
+ *  size as the input data or shorter.
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_decrypt_iov_ivec (
 	krb5_context /*context*/,
@@ -1487,6 +3026,19 @@ krb5_digest_init_request (
 	krb5_realm /*realm*/,
 	krb5_ccache /*ccache*/);
 
+/**
+ * Get the supported/allowed mechanism for this principal.
+ *
+ * @param context A Keberos context.
+ * @param realm The realm of the KDC.
+ * @param ccache The credential cache to use when talking to the KDC.
+ * @param flags The supported mechanism.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_digest
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_digest_probe (
 	krb5_context /*context*/,
@@ -1624,6 +3176,17 @@ krb5_domain_x500_encode (
 	unsigned int /*num_realms*/,
 	krb5_data */*encoding*/);
 
+/**
+ * Convert the getaddrinfo() error code to a Kerberos et error code.
+ *
+ * @param eai_errno contains the error code from getaddrinfo().
+ * @param system_error should have the value of errno after the failed getaddrinfo().
+ *
+ * @return Kerberos error code representing the EAI errors.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_eai_to_heim_errno (
 	int /*eai_errno*/,
@@ -1720,6 +3283,30 @@ krb5_encrypt_EncryptedData (
 	int /*kvno*/,
 	EncryptedData */*result*/);
 
+/**
+ * Inline encrypt a kerberos message
+ *
+ * @param context Kerberos context
+ * @param crypto Kerberos crypto context
+ * @param usage Key usage for this buffer
+ * @param data array of buffers to process
+ * @param num_data length of array
+ * @param ivec initial cbc/cts vector
+ *
+ * @return Return an error code or 0.
+ * @ingroup krb5_crypto
+ *
+ * Kerberos encrypted data look like this:
+ *
+ * 1. KRB5_CRYPTO_TYPE_HEADER
+ * 2. array [1,...] KRB5_CRYPTO_TYPE_DATA and array [0,...]
+ *    KRB5_CRYPTO_TYPE_SIGN_ONLY in any order, however the receiver
+ *    have to aware of the order. KRB5_CRYPTO_TYPE_SIGN_ONLY is
+ *    commonly used headers and trailers.
+ * 3. KRB5_CRYPTO_TYPE_PADDING, at least on padsize long if padsize > 1
+ * 4. KRB5_CRYPTO_TYPE_TRAILER
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_encrypt_iov_ivec (
 	krb5_context /*context*/,
@@ -1739,11 +3326,33 @@ krb5_encrypt_ivec (
 	krb5_data */*result*/,
 	void */*ivec*/);
 
+/**
+ * Disable encryption type
+ *
+ * @param context Kerberos 5 context
+ * @param enctype encryption type to disable
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_enctype_disable (
 	krb5_context /*context*/,
 	krb5_enctype /*enctype*/);
 
+/**
+ * Enable encryption type
+ *
+ * @param context Kerberos 5 context
+ * @param enctype encryption type to enable
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_enctype_enable (
 	krb5_context /*context*/,
@@ -1773,11 +3382,27 @@ krb5_enctype_to_string (
 	krb5_enctype /*etype*/,
 	char **/*string*/);
 
+/**
+ * Check if a enctype is valid, return 0 if it is.
+ *
+ * @param context Kerberos context
+ * @param etype enctype to check if its valid or not
+ *
+ * @return Return an error code for an failure or 0 on success (enctype valid).
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_enctype_valid (
 	krb5_context /*context*/,
 	krb5_enctype /*etype*/);
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_enctypes_compatible_keys (
 	krb5_context /*context*/,
@@ -1788,6 +3413,18 @@ krb5_enctypes_compatible_keys (
 krb5_error_code
 krb5_enomem (krb5_context /*context*/);
 
+/**
+ * Log a warning to the log, default stderr, include bthe error from
+ * the last failure and then exit.
+ *
+ * @param context A Kerberos 5 context
+ * @param eval the exit code to exit with
+ * @param code error code of the last error
+ * @param fmt message to print
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_err (
 	krb5_context /*context*/,
@@ -1795,7 +3432,7 @@ krb5_err (
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((noreturn, format (printf, 4, 5)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 4, 5)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_error_from_rd_error (
@@ -1803,13 +3440,38 @@ krb5_error_from_rd_error (
 	const krb5_error */*error*/,
 	const krb5_creds */*creds*/);
 
+/**
+ * Log a warning to the log, default stderr, and then exit.
+ *
+ * @param context A Kerberos 5 context
+ * @param eval the exit code to exit with
+ * @param fmt message to print
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_errx (
 	krb5_context /*context*/,
 	int /*eval*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((noreturn, format (printf, 3, 4)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 4)));
+
+/**
+ * krb5_expand_hostname() tries to make orig_hostname into a more
+ * canonical one in the newly allocated space returned in
+ * new_hostname.
+
+ * @param context a Keberos context
+ * @param orig_hostname hostname to canonicalise.
+ * @param new_hostname output hostname, caller must free hostname with
+ *        krb5_xfree().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_support
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_expand_hostname (
@@ -1817,6 +3479,24 @@ krb5_expand_hostname (
 	const char */*orig_hostname*/,
 	char **/*new_hostname*/);
 
+/**
+ * krb5_expand_hostname_realms() expands orig_hostname to a name we
+ * believe to be a hostname in newly allocated space in new_hostname
+ * and return the realms new_hostname is believed to belong to in
+ * realms.
+ *
+ * @param context a Keberos context
+ * @param orig_hostname hostname to canonicalise.
+ * @param new_hostname output hostname, caller must free hostname with
+ *        krb5_xfree().
+ * @param realms output possible realms, is an array that is terminated
+ *        with NULL. Caller must free with krb5_free_host_realm().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_expand_hostname_realms (
 	krb5_context /*context*/,
@@ -1839,11 +3519,35 @@ krb5_format_time (
 	size_t /*len*/,
 	krb5_boolean /*include_time*/);
 
+/**
+ * krb5_free_address frees the data stored in the address that is
+ * alloced with any of the krb5_address functions.
+ *
+ * @param context a Keberos context
+ * @param address addresss to be freed.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_address (
 	krb5_context /*context*/,
 	krb5_address */*address*/);
 
+/**
+ * krb5_free_addresses frees the data stored in the address that is
+ * alloced with any of the krb5_address functions.
+ *
+ * @param context a Keberos context
+ * @param addresses addressses to be freed.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_addresses (
 	krb5_context /*context*/,
@@ -1869,33 +3573,103 @@ krb5_free_checksum_contents (
 	krb5_context /*context*/,
 	krb5_checksum */*cksum*/);
 
+/**
+ * Free a list of configuration files.
+ *
+ * @param filenames list, terminated with a NULL pointer, to be
+ * freed. NULL is an valid argument.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_config_files (char **/*filenames*/);
 
+/**
+ * Frees the krb5_context allocated by krb5_init_context().
+ *
+ * @param context context to be freed.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_context (krb5_context /*context*/);
 
+/**
+ * Free content of krb5_creds.
+ *
+ * @param context Kerberos 5 context.
+ * @param c krb5_creds to free.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_cred_contents (
 	krb5_context /*context*/,
 	krb5_creds */*c*/);
 
+/**
+ * Free krb5_creds.
+ *
+ * @param context Kerberos 5 context.
+ * @param c krb5_creds to free.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_creds (
 	krb5_context /*context*/,
 	krb5_creds */*c*/);
 
+/**
+ * Deprecated: use krb5_free_cred_contents()
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_creds_contents (
 	krb5_context /*context*/,
 	krb5_creds */*c*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Free krb5_data (and its content).
+ *
+ * @param context Kerberos 5 context.
+ * @param p krb5_data to free.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_data (
 	krb5_context /*context*/,
 	krb5_data */*p*/);
 
+/**
+ * Same as krb5_data_free(). MIT compat.
+ *
+ * Deprecated: use krb5_data_free().
+ *
+ * @param context Kerberos 5 context.
+ * @param data krb5_data to free.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_data_contents (
 	krb5_context /*context*/,
@@ -1917,32 +3691,89 @@ krb5_free_error_contents (
 	krb5_context /*context*/,
 	krb5_error */*error*/);
 
+/**
+ * Free the error message returned by krb5_get_error_message().
+ *
+ * @param context Kerberos context
+ * @param msg error message to free, returned byg
+ *        krb5_get_error_message().
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_error_message (
 	krb5_context /*context*/,
 	const char */*msg*/);
 
+/**
+ * Free the error message returned by krb5_get_error_string().
+ *
+ * Deprecated: use krb5_free_error_message()
+ *
+ * @param context Kerberos context
+ * @param str error message to free
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_error_string (
 	krb5_context /*context*/,
 	char */*str*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Free all memory allocated by `realmlist'
+ *
+ * @param context A Kerberos 5 context.
+ * @param realmlist realmlist to free, NULL is ok
+ *
+ * @return a Kerberos error code, always 0.
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_host_realm (
 	krb5_context /*context*/,
 	krb5_realm */*realmlist*/);
 
+/**
+ * Variable containing the FILE based credential cache implemention.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_kdc_rep (
 	krb5_context /*context*/,
 	krb5_kdc_rep */*rep*/);
 
+/**
+ * Free a keyblock, also zero out the content of the keyblock, uses
+ * krb5_free_keyblock_contents() to free the content.
+ *
+ * @param context a Kerberos 5 context
+ * @param keyblock keyblock to free, NULL is valid argument
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_keyblock (
 	krb5_context /*context*/,
 	krb5_keyblock */*keyblock*/);
 
+/**
+ * Free a keyblock's content, also zero out the content of the keyblock.
+ *
+ * @param context a Kerberos 5 context
+ * @param keyblock keyblock content to free, NULL is valid argument
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_keyblock_contents (
 	krb5_context /*context*/,
@@ -1953,6 +3784,28 @@ krb5_free_krbhst (
 	krb5_context /*context*/,
 	char **/*hostlist*/);
 
+/**
+ * Free a name canonicalization rule iterator.
+ */
+
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_free_name_canon_iterator (
+	krb5_context /*context*/,
+	krb5_name_canon_iterator /*iter*/);
+
+/**
+ * Frees a Kerberos principal allocated by the library with
+ * krb5_parse_name(), krb5_make_principal() or any other related
+ * principal functions.
+ *
+ * @param context A Kerberos context.
+ * @param p a principal to free.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_principal (
 	krb5_context /*context*/,
@@ -1963,17 +3816,54 @@ krb5_free_salt (
 	krb5_context /*context*/,
 	krb5_salt /*salt*/);
 
+/**
+ * Free ticket and content
+ *
+ * @param context a Kerberos 5 context
+ * @param ticket ticket to free
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_free_ticket (
 	krb5_context /*context*/,
 	krb5_ticket */*ticket*/);
 
+/**
+ * Deprecated: use krb5_xfree().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_free_unparsed_name (
 	krb5_context /*context*/,
 	char */*str*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Forward credentials for client to host hostname , making them
+ * forwardable if forwardable, and returning the blob of data to sent
+ * in out_data.  If hostname == NULL, pick it from server.
+ *
+ * @param context A kerberos 5 context.
+ * @param auth_context the auth context with the key to encrypt the out_data.
+ * @param hostname the host to forward the tickets too.
+ * @param client the client to delegate from.
+ * @param server the server to delegate the credential too.
+ * @param ccache credential cache to use.
+ * @param forwardable make the forwarded ticket forwabledable.
+ * @param out_data the resulting credential.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_fwd_tgt_creds (
 	krb5_context /*context*/,
@@ -1985,6 +3875,46 @@ krb5_fwd_tgt_creds (
 	int /*forwardable*/,
 	krb5_data */*out_data*/);
 
+/**
+ * Fill buffer buf with len bytes of PRNG randomness that is ok to use
+ * for key generation, padding and public diclosing the randomness w/o
+ * disclosing the randomness source.
+ *
+ * This function can fail, and callers must check the return value.
+ *
+ * @param buf a buffer to fill with randomness
+ * @param len length of memory that buf points to.
+ *
+ * @return return 0 on success or HEIM_ERR_RANDOM_OFFLINE if the
+ * funcation failed to initialize the randomness source.
+ *
+ * @ingroup krb5_crypto
+ */
+
+HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_generate_random (
+	void */*buf*/,
+	size_t /*len*/);
+
+/**
+ * Fill buffer buf with len bytes of PRNG randomness that is ok to use
+ * for key generation, padding and public diclosing the randomness w/o
+ * disclosing the randomness source.
+ *
+ * This function can NOT fail, instead it will abort() and program will crash.
+ *
+ * If this function is called after a successful krb5_init_context(),
+ * the chance of it failing is low due to that krb5_init_context()
+ * pulls out some random, and quite commonly the randomness sources
+ * will not fail once it have started to produce good output,
+ * /dev/urandom behavies that way.
+ *
+ * @param buf a buffer to fill with randomness
+ * @param len length of memory that buf points to.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_generate_random_block (
 	void */*buf*/,
@@ -2002,6 +3932,12 @@ krb5_generate_seq_number (
 	const krb5_keyblock */*key*/,
 	uint32_t */*seqno*/);
 
+/**
+ * Deprecated: use krb5_generate_subkey_extended()
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_generate_subkey (
 	krb5_context /*context*/,
@@ -2009,6 +3945,19 @@ krb5_generate_subkey (
 	krb5_keyblock **/*subkey*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Generate subkey, from keyblock
+ *
+ * @param context kerberos context
+ * @param key session key
+ * @param etype encryption type of subkey, if ETYPE_NULL, use key's enctype
+ * @param subkey returned new, free with krb5_free_keyblock().
+ *
+ * @return 0 on success or a Kerberos 5 error code
+ *
+* @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_generate_subkey_extended (
 	krb5_context /*context*/,
@@ -2026,6 +3975,12 @@ krb5_get_all_server_addrs (
 	krb5_context /*context*/,
 	krb5_addresses */*res*/);
 
+/**
+ * Deprecated: use krb5_get_credentials_with_flags().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_cred_from_kdc (
 	krb5_context /*context*/,
@@ -2035,6 +3990,12 @@ krb5_get_cred_from_kdc (
 	krb5_creds ***/*ret_tgts*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_get_credentials_with_flags().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_cred_from_kdc_opt (
 	krb5_context /*context*/,
@@ -2110,9 +4071,35 @@ krb5_get_creds_opt_set_ticket (
 	krb5_get_creds_opt /*opt*/,
 	const Ticket */*ticket*/);
 
+/**
+ * Get the global configuration list.
+ *
+ * @param pfilenames return array of filenames, should be freed with krb5_free_config_files().
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_default_config_files (char ***/*pfilenames*/);
 
+/**
+ * Get the default encryption types that will be use in communcation
+ * with the KDC, clients and servers.
+ *
+ * @param context Kerberos 5 context.
+ * @param pdu_type request type (AS, TGS or none)
+ * @param etypes Encryption types, array terminated with
+ * ETYPE_NULL(0), caller should free array with krb5_xfree():
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_default_in_tkt_etypes (
 	krb5_context /*context*/,
@@ -2134,33 +4121,135 @@ krb5_get_default_realms (
 	krb5_context /*context*/,
 	krb5_realm **/*realms*/);
 
+/**
+ * Get if the library uses DNS to canonicalize hostnames.
+ *
+ * @param context Kerberos 5 context.
+ *
+ * @return return non zero if the library uses DNS to canonicalize hostnames.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_get_dns_canonicalize_hostname (krb5_context /*context*/);
 
+/**
+ * Return the error string for the error code. The caller must not
+ * free the string.
+ *
+ * This function is deprecated since its not threadsafe.
+ *
+ * @param context Kerberos 5 context.
+ * @param code Kerberos error code.
+ *
+ * @return the error message matching code
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_get_err_text (
 	krb5_context /*context*/,
 	krb5_error_code /*code*/)
-     KRB5_DEPRECATED_FUNCTION("Use X instead");
+     KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead");
+
+/**
+ * Return the error message for `code' in context. On memory
+ * allocation error the function returns NULL.
+ *
+ * @param context Kerberos 5 context
+ * @param code Error code related to the error
+ *
+ * @return an error string, needs to be freed with
+ * krb5_free_error_message(). The functions return NULL on error.
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION const char * KRB5_LIB_CALL
 krb5_get_error_message (
 	krb5_context /*context*/,
 	krb5_error_code /*code*/);
 
+/**
+ * Return the error message in context. On error or no error string,
+ * the function returns NULL.
+ *
+ * @param context Kerberos 5 context
+ *
+ * @return an error string, needs to be freed with
+ * krb5_free_error_message(). The functions return NULL on error.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION char * KRB5_LIB_CALL
-krb5_get_error_string (krb5_context /*context*/);
+krb5_get_error_string (krb5_context /*context*/)
+     KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead");
+
+/**
+ * Get extra address to the address list that the library will add to
+ * the client's address list when communicating with the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses addreses to set
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_extra_addresses (
 	krb5_context /*context*/,
 	krb5_addresses */*addresses*/);
 
+/**
+ * Get version of fcache that the library should use.
+ *
+ * @param context Kerberos 5 context.
+ * @param version version number.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_fcache_version (
 	krb5_context /*context*/,
 	int */*version*/);
 
+/**
+ * Gets tickets forwarded to hostname. If the tickets that are
+ * forwarded are address-less, the forwarded tickets will also be
+ * address-less.
+ *
+ * If the ticket have any address, hostname will be used for figure
+ * out the address to forward the ticket too. This since this might
+ * use DNS, its insecure and also doesn't represent configured all
+ * addresses of the host. For example, the host might have two
+ * adresses, one IPv4 and one IPv6 address where the later is not
+ * published in DNS. This IPv6 address might be used communications
+ * and thus the resulting ticket useless.
+ *
+ * @param context A kerberos 5 context.
+ * @param auth_context the auth context with the key to encrypt the out_data.
+ * @param ccache credential cache to use
+ * @param flags the flags to control the resulting ticket flags
+ * @param hostname the host to forward the tickets too.
+ * @param in_creds the in client and server ticket names.  The client
+ * and server components forwarded to the remote host.
+ * @param out_data the resulting credential.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_forwarded_creds (
 	krb5_context /*context*/,
@@ -2177,6 +4266,19 @@ krb5_get_host_realm (
 	const char */*targethost*/,
 	krb5_realm **/*realms*/);
 
+/**
+ * Get extra addresses to ignore when fetching addresses from the
+ * underlaying operating system.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses list addreses ignored
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_ignore_addresses (
 	krb5_context /*context*/,
@@ -2214,6 +4316,12 @@ krb5_get_in_tkt (
 	krb5_kdc_rep */*ret_as_reply*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_get_init_creds() and friends.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_in_tkt_with_keytab (
 	krb5_context /*context*/,
@@ -2227,6 +4335,12 @@ krb5_get_in_tkt_with_keytab (
 	krb5_kdc_rep */*ret_as_reply*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_get_init_creds() and friends.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_in_tkt_with_password (
 	krb5_context /*context*/,
@@ -2240,6 +4354,12 @@ krb5_get_in_tkt_with_password (
 	krb5_kdc_rep */*ret_as_reply*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_get_init_creds() and friends.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_in_tkt_with_skey (
 	krb5_context /*context*/,
@@ -2253,6 +4373,12 @@ krb5_get_in_tkt_with_skey (
 	krb5_kdc_rep */*ret_as_reply*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Get new credentials using keyblock.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_init_creds_keyblock (
 	krb5_context /*context*/,
@@ -2263,6 +4389,12 @@ krb5_get_init_creds_keyblock (
 	const char */*in_tkt_service*/,
 	krb5_get_init_creds_opt */*options*/);
 
+/**
+ * Get new credentials using keytab.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_init_creds_keytab (
 	krb5_context /*context*/,
@@ -2273,16 +4405,36 @@ krb5_get_init_creds_keytab (
 	const char */*in_tkt_service*/,
 	krb5_get_init_creds_opt */*options*/);
 
+/**
+ * Allocate a new krb5_get_init_creds_opt structure, free with
+ * krb5_get_init_creds_opt_free().
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_init_creds_opt_alloc (
 	krb5_context /*context*/,
 	krb5_get_init_creds_opt **/*opt*/);
 
+/**
+ * Free krb5_get_init_creds_opt structure.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_get_init_creds_opt_free (
 	krb5_context /*context*/,
 	krb5_get_init_creds_opt */*opt*/);
 
+/**
+ * Deprecated: use the new krb5_init_creds_init() and
+ * krb5_init_creds_get_error().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_init_creds_opt_get_error (
 	krb5_context /*context*/,
@@ -2290,6 +4442,16 @@ krb5_get_init_creds_opt_get_error (
 	KRB_ERROR **/*error*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_get_init_creds_opt_alloc().
+ *
+ * The reason krb5_get_init_creds_opt_init() is deprecated is that
+ * krb5_get_init_creds_opt is a static structure and for ABI reason it
+ * can't grow, ie can't add new functionality.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_get_init_creds_opt_init (krb5_get_init_creds_opt */*opt*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
@@ -2316,6 +4478,11 @@ krb5_get_init_creds_opt_set_canonicalize (
 	krb5_get_init_creds_opt */*opt*/,
 	krb5_boolean /*req*/);
 
+KRB5_LIB_FUNCTION void KRB5_LIB_CALL
+krb5_get_init_creds_opt_set_change_password_prompt (
+	krb5_get_init_creds_opt */*opt*/,
+	int /*change_password_prompt*/);
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_get_init_creds_opt_set_default_flags (
 	krb5_context /*context*/,
@@ -2406,6 +4573,12 @@ krb5_get_init_creds_opt_set_win2k (
 	krb5_get_init_creds_opt */*opt*/,
 	krb5_boolean /*req*/);
 
+/**
+ * Get new credentials using password.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_init_creds_password (
 	krb5_context /*context*/,
@@ -2428,6 +4601,18 @@ krb5_get_kdc_cred (
 	krb5_creds */*in_creds*/,
 	krb5_creds **out_creds );
 
+/**
+ * Get current offset in time to the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param sec seconds part of offset.
+ * @param usec micro seconds part of offset.
+ *
+ * @return returns zero
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_kdc_sec_offset (
 	krb5_context /*context*/,
@@ -2458,9 +4643,29 @@ krb5_get_krbhst (
 	const krb5_realm */*realm*/,
 	char ***/*hostlist*/);
 
+/**
+ * Get max time skew allowed.
+ *
+ * @param context Kerberos 5 context.
+ *
+ * @return timeskew in seconds.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL
 krb5_get_max_time_skew (krb5_context /*context*/);
 
+/**
+     * krb5_init_context() will get one random byte to make sure our
+     * random is alive.  Assumption is that once the non blocking
+     * source allows us to pull bytes, its all seeded and allows us to
+     * pull more bytes.
+     *
+     * Most Kerberos users calls krb5_init_context(), so this is
+     * useful point where we can do the checking.
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_permitted_enctypes (
 	krb5_context /*context*/,
@@ -2486,9 +4691,33 @@ krb5_get_server_rcache (
 	const krb5_data */*piece*/,
 	krb5_rcache */*id*/);
 
+/**
+ * Make the kerberos library default to the admin KDC.
+ *
+ * @param context Kerberos 5 context.
+ *
+ * @return boolean flag to telling the context will use admin KDC as the default KDC.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_get_use_admin_kdc (krb5_context /*context*/);
 
+/**
+ * Validate the newly fetch credential, see also krb5_verify_init_creds().
+ *
+ * @param context a Kerberos 5 context
+ * @param creds the credentials to verify
+ * @param client the client name to match up
+ * @param ccache the credential cache to use
+ * @param service a service name to use, used with
+ *        krb5_sname_to_principal() to build a hostname to use to
+ *        verify.
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_get_validated_creds (
 	krb5_context /*context*/,
@@ -2497,6 +4726,14 @@ krb5_get_validated_creds (
 	krb5_ccache /*ccache*/,
 	char */*service*/);
 
+/**
+ * Get the default logging facility.
+ *
+ * @param context A Kerberos 5 context
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_log_facility * KRB5_LIB_CALL
 krb5_get_warn_dest (krb5_context /*context*/);
 
@@ -2513,6 +4750,20 @@ krb5_getportbyname (
 	const char */*proto*/,
 	int /*default_port*/);
 
+/**
+ * krb5_h_addr2addr works like krb5_h_addr2sockaddr with the exception
+ * that it operates on a krb5_address instead of a struct sockaddr.
+ *
+ * @param context a Keberos context
+ * @param af address family
+ * @param haddr host address from struct hostent.
+ * @param addr returned krb5_address.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_h_addr2addr (
 	krb5_context /*context*/,
@@ -2520,6 +4771,25 @@ krb5_h_addr2addr (
 	const char */*haddr*/,
 	krb5_address */*addr*/);
 
+/**
+ * krb5_h_addr2sockaddr initializes a "struct sockaddr sa" from af and
+ * the "struct hostent" (see gethostbyname(3) ) h_addr_list
+ * component. The argument sa_size should initially contain the size
+ * of the sa, and after the call, it will contain the actual length of
+ * the address.
+ *
+ * @param context a Keberos context
+ * @param af addresses
+ * @param addr address
+ * @param sa returned struct sockaddr
+ * @param sa_size size of sa
+ * @param port port to set in sa.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_h_addr2sockaddr (
 	krb5_context /*context*/,
@@ -2529,11 +4799,23 @@ krb5_h_addr2sockaddr (
 	krb5_socklen_t */*sa_size*/,
 	int /*port*/);
 
+/**
+ * Convert the gethostname() error code (h_error) to a Kerberos et
+ * error code.
+ *
+ * @param eai_errno contains the error code from gethostname().
+ *
+ * @return Kerberos error code representing the gethostname errors.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_h_errno_to_heim_errno (int /*eai_errno*/);
 
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
-krb5_have_error_string (krb5_context /*context*/);
+krb5_have_error_string (krb5_context /*context*/)
+     KRB5_DEPRECATED_FUNCTION("Use krb5_get_error_message instead");
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_hmac (
@@ -2545,31 +4827,102 @@ krb5_hmac (
 	krb5_keyblock */*key*/,
 	Checksum */*result*/);
 
+/**
+ * Initializes the context structure and reads the configuration file
+ * /etc/krb5.conf. The structure should be freed by calling
+ * krb5_free_context() when it is no longer being used.
+ *
+ * @param context pointer to returned context
+ *
+ * @return Returns 0 to indicate success.  Otherwise an errno code is
+ * returned.  Failure means either that something bad happened during
+ * initialization (typically ENOMEM) or that Kerberos should not be
+ * used ENXIO. If the function returns HEIM_ERR_RANDOM_OFFLINE, the
+ * random source is not available and later Kerberos calls might fail.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_context (krb5_context */*context*/);
 
+/**
+ * Free the krb5_init_creds_context allocated by krb5_init_creds_init().
+ *
+ * @param context A Kerberos 5 context.
+ * @param ctx The krb5_init_creds_context to free.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_init_creds_free (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/);
 
+/**
+ * Get new credentials as setup by the krb5_init_creds_context.
+ *
+ * @param context A Kerberos 5 context.
+ * @param ctx The krb5_init_creds_context to process.
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_get (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/);
 
+/**
+ * Extract the newly acquired credentials from krb5_init_creds_context
+ * context.
+ *
+ * @param context A Kerberos 5 context.
+ * @param ctx
+ * @param cred credentials, free with krb5_free_cred_contents().
+ *
+ * @return 0 for sucess or An Kerberos error code, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_get_creds (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	krb5_creds */*cred*/);
 
+/**
+ * Get the last error from the transaction.
+ *
+ * @return Returns 0 or an error code
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_get_error (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	KRB_ERROR */*error*/);
 
+/**
+ * Start a new context to get a new initial credential.
+ *
+ * @param context A Kerberos 5 context.
+ * @param client The Kerberos principal to get the credential for, if
+ *     NULL is given, the default principal is used as determined by
+ *     krb5_get_default_principal().
+ * @param prompter
+ * @param prompter_data
+ * @param start_time the time the ticket should start to be valid or 0 for now.
+ * @param options a options structure, can be NULL for default options.
+ * @param rctx A new allocated free with krb5_init_creds_free().
+ *
+ * @return 0 for success or an Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_init (
 	krb5_context /*context*/,
@@ -2580,30 +4933,99 @@ krb5_init_creds_init (
 	krb5_get_init_creds_opt */*options*/,
 	krb5_init_creds_context */*rctx*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_init_creds_set_fast_ap_armor_service (
+	krb5_context /*context*/,
+	krb5_init_creds_context /*ctx*/,
+	krb5_const_principal /*armor_service*/);
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_init_creds_set_fast_ccache (
+	krb5_context /*context*/,
+	krb5_init_creds_context /*ctx*/,
+	krb5_ccache /*fast_ccache*/);
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_set_keyblock (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	krb5_keyblock */*keyblock*/);
 
+/**
+ * Set the keytab to use for authentication.
+ *
+ * @param context a Kerberos 5 context.
+ * @param ctx ctx krb5_init_creds_context context.
+ * @param keytab the keytab to read the key from.
+ *
+ * @return 0 for success, or an Kerberos 5 error code, see krb5_get_error_message().
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_set_keytab (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	krb5_keytab /*keytab*/);
 
+/**
+ * Sets the password that will use for the request.
+ *
+ * @param context a Kerberos 5 context.
+ * @param ctx ctx krb5_init_creds_context context.
+ * @param password the password to use.
+ *
+ * @return 0 for success, or an Kerberos 5 error code, see krb5_get_error_message().
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_set_password (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	const char */*password*/);
 
+/**
+ * Sets the service that the is requested. This call is only neede for
+ * special initial tickets, by default the a krbtgt is fetched in the default realm.
+ *
+ * @param context a Kerberos 5 context.
+ * @param ctx a krb5_init_creds_context context.
+ * @param service the service given as a string, for example
+ *        "kadmind/admin". If NULL, the default krbtgt in the clients
+ *        realm is set.
+ *
+ * @return 0 for success, or an Kerberos 5 error code, see krb5_get_error_message().
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_set_service (
 	krb5_context /*context*/,
 	krb5_init_creds_context /*ctx*/,
 	const char */*service*/);
 
+/**
+ * The core loop if krb5_get_init_creds() function family. Create the
+ * packets and have the caller send them off to the KDC.
+ *
+ * If the caller want all work been done for them, use
+ * krb5_init_creds_get() instead.
+ *
+ * @param context a Kerberos 5 context.
+ * @param ctx ctx krb5_init_creds_context context.
+ * @param in input data from KDC, first round it should be reset by krb5_data_zer().
+ * @param out reply to KDC.
+ * @param hostinfo KDC address info, first round it can be NULL.
+ * @param flags status of the round, if
+ *        KRB5_INIT_CREDS_STEP_FLAG_CONTINUE is set, continue one more round.
+ *
+ * @return 0 for success, or an Kerberos 5 error code, see
+ *     krb5_get_error_message().
+ *
+ * @ingroup krb5_credential
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_init_creds_step (
 	krb5_context /*context*/,
@@ -2613,20 +5035,115 @@ krb5_init_creds_step (
 	krb5_krbhst_info */*hostinfo*/,
 	unsigned int */*flags*/);
 
+/**
+ *
+ * @ingroup krb5_credential
+ */
+
+krb5_error_code
+krb5_init_creds_store (
+	krb5_context /*context*/,
+	krb5_init_creds_context /*ctx*/,
+	krb5_ccache /*id*/);
+
+/**
+ * Init the built-in ets in the Kerberos library.
+ *
+ * @param context kerberos context to add the ets too
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_init_ets (krb5_context /*context*/);
 
+/**
+ @struct krb5plugin_kuserok_ftable_desc *
+ * @brief Description of the krb5_kuserok(3) plugin facility.
+ *
+ * The krb5_kuserok(3) function is pluggable.  The plugin is named
+ * KRB5_PLUGIN_KUSEROK ("krb5_plugin_kuserok"), with a single minor
+ * version, KRB5_PLUGIN_KUSEROK_VERSION_0 (0).
+ *
+ * The plugin for krb5_kuserok(3) consists of a data symbol referencing
+ * a structure of type krb5plugin_kuserok_ftable, with four fields:
+ *
+ * @param init          Plugin initialization function (see krb5-plugin(7))
+ *
+ * @param minor_version The plugin minor version number (0)
+ *
+ * @param fini          Plugin finalization function
+ *
+ * @param kuserok       Plugin kuserok function
+ *
+ * The kuserok field is the plugin entry point that performs the
+ * traditional kuserok operation however the plugin desires.  It is
+ * invoked in no particular order relative to other kuserok plugins, but
+ * it has a 'rule' argument that indicates which plugin is intended to
+ * act on the rule.  The plugin kuserok function must return
+ * KRB5_PLUGIN_NO_HANDLE if the rule is not applicable to it.
+ *
+ * The plugin kuserok function has the following arguments, in this
+ * order:
+ *
+ * -# plug_ctx, the context value output by the plugin's init function
+ * -# context, a krb5_context
+ * -# rule, the kuserok rule being evaluated (from krb5.conf(5))
+ * -# flags
+ * -# k5login_dir, configured location of k5login per-user files if any
+ * -# luser, name of the local user account to which principal is attempting to access.
+ * -# principal, the krb5_principal trying to access the luser account
+ * -# result, a krb5_boolean pointer where the plugin will output its result
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_initlog (
 	krb5_context /*context*/,
 	const char */*program*/,
 	krb5_log_facility **/*fac*/);
 
+/**
+ * Return TRUE (non zero) if the principal is a configuration
+ * principal (generated part of krb5_cc_set_config()). Returns FALSE
+ * (zero) if not a configuration principal.
+ *
+ * @param context a Keberos context
+ * @param principal principal to check if it a configuration principal
+ *
+ * @ingroup krb5_ccache
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_is_config_principal (
 	krb5_context /*context*/,
 	krb5_const_principal /*principal*/);
 
+/**
+ * Returns is the encryption is strong or weak
+ *
+ * @param context Kerberos 5 context
+ * @param enctype encryption type to probe
+ *
+ * @return Returns true if encryption type is weak or is not supported.
+ *
+ * @ingroup krb5_crypto
+ */
+
+KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+krb5_is_enctype_weak (
+	krb5_context /*context*/,
+	krb5_enctype /*enctype*/);
+
+/**
+ * Runtime check if the Kerberos library was complied with thread support.
+ *
+ * @return TRUE if the library was compiled with thread support, FALSE if not.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_is_thread_safe (void);
 
@@ -2643,12 +5160,40 @@ krb5_kcm_storage_request (
 	uint16_t /*opcode*/,
 	krb5_storage **/*storage_p*/);
 
+/**
+ * Returns the list of Kerberos encryption types sorted in order of
+ * most preferred to least preferred encryption type.  Note that some
+ * encryption types might be disabled, so you need to check with
+ * krb5_enctype_valid() before using the encryption type.
+ *
+ * @return list of enctypes, terminated with ETYPE_NULL. Its a static
+ * array completed into the Kerberos library so the content doesn't
+ * need to be freed.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION const krb5_enctype * KRB5_LIB_CALL
 krb5_kerberos_enctypes (krb5_context /*context*/);
 
+/**
+ * Get encryption type of a keyblock.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_enctype KRB5_LIB_CALL
 krb5_keyblock_get_enctype (const krb5_keyblock */*block*/);
 
+/**
+ * Fill in `key' with key data of type `enctype' from `data' of length
+ * `size'. Key should be freed using krb5_free_keyblock_contents().
+ *
+ * @return 0 on success or a Kerberos 5 error code
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_keyblock_init (
 	krb5_context /*context*/,
@@ -2665,9 +5210,23 @@ krb5_keyblock_key_proc (
 	krb5_const_pointer /*keyseed*/,
 	krb5_keyblock **/*key*/);
 
+/**
+ * Zero out a keyblock
+ *
+ * @param keyblock keyblock to zero out
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_keyblock_zero (krb5_keyblock */*keyblock*/);
 
+/**
+ * Deprecated: use krb5_get_init_creds() and friends.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_CALLCONV
 krb5_keytab_key_proc (
 	krb5_context /*context*/,
@@ -2677,6 +5236,12 @@ krb5_keytab_key_proc (
 	krb5_keyblock **/*key*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_keytype_to_enctypes (
 	krb5_context /*context*/,
@@ -2685,6 +5250,12 @@ krb5_keytype_to_enctypes (
 	krb5_enctype **/*val*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_keytype_to_enctypes_default (
 	krb5_context /*context*/,
@@ -2693,6 +5264,13 @@ krb5_keytype_to_enctypes_default (
 	krb5_enctype **/*val*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes in
+ * most cases, use krb5_enctype_to_string().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_keytype_to_string (
 	krb5_context /*context*/,
@@ -2712,6 +5290,16 @@ krb5_krbhst_free (
 	krb5_context /*context*/,
 	krb5_krbhst_handle /*handle*/);
 
+/**
+ * Return an `struct addrinfo *' for a KDC host.
+ *
+ * Returns an the struct addrinfo in in that corresponds to the
+ * information in `host'.  free:ing is handled by krb5_krbhst_free, so
+ * the returned ai must not be released.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_krbhst_get_addrinfo (
 	krb5_context /*context*/,
@@ -2751,17 +5339,63 @@ krb5_krbhst_reset (
 	krb5_context /*context*/,
 	krb5_krbhst_handle /*handle*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_krbhst_set_hostname (
+	krb5_context /*context*/,
+	krb5_krbhst_handle /*handle*/,
+	const char */*hostname*/);
+
+/**
+ * Add the entry in `entry' to the keytab `id'.
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param entry the entry to add
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_add_entry (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/,
 	krb5_keytab_entry */*entry*/);
 
+/**
+ * Finish using the keytab in `id'.  All resources will be released,
+ * even on errors.
+ *
+ * @param context a Keberos context.
+ * @param id keytab to close.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_close (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/);
 
+/**
+ * Compare `entry' against `principal, vno, enctype'.
+ * Any of `principal, vno, enctype' might be 0 which acts as a wildcard.
+ * Return TRUE if they compare the same, FALSE otherwise.
+ *
+ * @param context a Keberos context.
+ * @param entry an entry to match with.
+ * @param principal principal to match, NULL matches all principals.
+ * @param vno key version to match, 0 matches all key version numbers.
+ * @param enctype encryption type to match, 0 matches all encryption types.
+ *
+ * @return Return TRUE or match, FALSE if not matched.
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_kt_compare (
 	krb5_context /*context*/,
@@ -2770,45 +5404,143 @@ krb5_kt_compare (
 	krb5_kvno /*vno*/,
 	krb5_enctype /*enctype*/);
 
+/**
+ * Copy the contents of `in' into `out'.
+ *
+ * @param context a Keberos context.
+ * @param in the keytab entry to copy.
+ * @param out the copy of the keytab entry, free with krb5_kt_free_entry().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_copy_entry_contents (
 	krb5_context /*context*/,
 	const krb5_keytab_entry */*in*/,
 	krb5_keytab_entry */*out*/);
 
+/**
+ * Set `id' to the default keytab.
+ *
+ * @param context a Keberos context.
+ * @param id the new default keytab.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default (
 	krb5_context /*context*/,
 	krb5_keytab */*id*/);
 
+/**
+ * Copy the name of the default modify keytab into `name'.
+ *
+ * @param context a Keberos context.
+ * @param name buffer where the name will be written
+ * @param namesize length of name
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default_modify_name (
 	krb5_context /*context*/,
 	char */*name*/,
 	size_t /*namesize*/);
 
+/**
+ * copy the name of the default keytab into `name'.
+ *
+ * @param context a Keberos context.
+ * @param name buffer where the name will be written
+ * @param namesize length of name
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_default_name (
 	krb5_context /*context*/,
 	char */*name*/,
 	size_t /*namesize*/);
 
+/**
+ * Destroy (remove) the keytab in `id'.  All resources will be released,
+ * even on errors, does the equvalment of krb5_kt_close() on the resources.
+ *
+ * @param context a Keberos context.
+ * @param id keytab to destroy.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_destroy (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/);
 
+/**
+ * Release all resources associated with `cursor'.
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param cursor the cursor to free.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_end_seq_get (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/,
 	krb5_kt_cursor */*cursor*/);
 
+/**
+ * Free the contents of `entry'.
+ *
+ * @param context a Keberos context.
+ * @param entry the entry to free
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_free_entry (
 	krb5_context /*context*/,
 	krb5_keytab_entry */*entry*/);
 
+/**
+ * Retrieve the keytab entry for `principal, kvno, enctype' into `entry'
+ * from the keytab `id'. Matching is done like krb5_kt_compare().
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param principal principal to match, NULL matches all principals.
+ * @param kvno key version to match, 0 matches all key version numbers.
+ * @param enctype encryption type to match, 0 matches all encryption types.
+ * @param entry the returned entry, free with krb5_kt_free_entry().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_get_entry (
 	krb5_context /*context*/,
@@ -2818,12 +5550,39 @@ krb5_kt_get_entry (
 	krb5_enctype /*enctype*/,
 	krb5_keytab_entry */*entry*/);
 
+/**
+ * Retrieve the full name of the keytab `keytab' and store the name in
+ * `str'.
+ *
+ * @param context a Keberos context.
+ * @param keytab keytab to get name for.
+ * @param str the name of the keytab name, usee krb5_xfree() to free
+ *        the string.  On error, *str is set to NULL.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_get_full_name (
 	krb5_context /*context*/,
 	krb5_keytab /*keytab*/,
 	char **/*str*/);
 
+/**
+ * Retrieve the name of the keytab `keytab' into `name', `namesize'
+ *
+ * @param context a Keberos context.
+ * @param keytab the keytab to get the name for.
+ * @param name name buffer.
+ * @param namesize size of name buffer.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_get_name (
 	krb5_context /*context*/,
@@ -2831,6 +5590,20 @@ krb5_kt_get_name (
 	char */*name*/,
 	size_t /*namesize*/);
 
+/**
+ * Return the type of the `keytab' in the string `prefix of length
+ * `prefixsize'.
+ *
+ * @param context a Keberos context.
+ * @param keytab the keytab to get the prefix for
+ * @param prefix prefix buffer
+ * @param prefixsize length of prefix buffer
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_get_type (
 	krb5_context /*context*/,
@@ -2838,11 +5611,36 @@ krb5_kt_get_type (
 	char */*prefix*/,
 	size_t /*prefixsize*/);
 
-KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
+/**
+ * Return true if the keytab exists and have entries
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_have_content (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/);
 
+/**
+ * Get the next entry from keytab, advance the cursor.  On last entry
+ * the function will return KRB5_KT_END.
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param entry the returned entry, free with krb5_kt_free_entry().
+ * @param cursor the cursor of the iteration.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_next_entry (
 	krb5_context /*context*/,
@@ -2850,6 +5648,22 @@ krb5_kt_next_entry (
 	krb5_keytab_entry */*entry*/,
 	krb5_kt_cursor */*cursor*/);
 
+/**
+ * Read the key identified by `(principal, vno, enctype)' from the
+ * keytab in `keyprocarg' (the default if == NULL) into `*key'.
+ *
+ * @param context a Keberos context.
+ * @param keyprocarg
+ * @param principal
+ * @param vno
+ * @param enctype
+ * @param key
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_read_service_key (
 	krb5_context /*context*/,
@@ -2859,29 +5673,113 @@ krb5_kt_read_service_key (
 	krb5_enctype /*enctype*/,
 	krb5_keyblock **/*key*/);
 
+/**
+ * Register a new keytab backend.
+ *
+ * @param context a Keberos context.
+ * @param ops a backend to register.
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_register (
 	krb5_context /*context*/,
 	const krb5_kt_ops */*ops*/);
 
+/**
+ * Remove an entry from the keytab, matching is done using
+ * krb5_kt_compare().
+
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param entry the entry to remove
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_remove_entry (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/,
 	krb5_keytab_entry */*entry*/);
 
+/**
+ * Resolve the keytab name (of the form `type:residual') in `name'
+ * into a keytab in `id'.
+ *
+ * @param context a Keberos context.
+ * @param name name to resolve
+ * @param id resulting keytab, free with krb5_kt_close().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_resolve (
 	krb5_context /*context*/,
 	const char */*name*/,
 	krb5_keytab */*id*/);
 
+/**
+ * Set `cursor' to point at the beginning of `id'.
+ *
+ * @param context a Keberos context.
+ * @param id a keytab.
+ * @param cursor a newly allocated cursor, free with krb5_kt_end_seq_get().
+ *
+ * @return Return an error code or 0, see krb5_get_error_message().
+ *
+ * @ingroup krb5_keytab
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_kt_start_seq_get (
 	krb5_context /*context*/,
 	krb5_keytab /*id*/,
 	krb5_kt_cursor */*cursor*/);
 
+/**
+ * This function takes the name of a local user and checks if
+ * principal is allowed to log in as that user.
+ *
+ * The user may have a ~/.k5login file listing principals that are
+ * allowed to login as that user. If that file does not exist, all
+ * principals with a only one component that is identical to the
+ * username, and a realm considered local, are allowed access.
+ *
+ * The .k5login file must contain one principal per line, be owned by
+ * user and not be writable by group or other (but must be readable by
+ * anyone).
+ *
+ * Note that if the file exists, no implicit access rights are given
+ * to user@@LOCALREALM.
+ *
+ * Optionally, a set of files may be put in ~/.k5login.d (a
+ * directory), in which case they will all be checked in the same
+ * manner as .k5login.  The files may be called anything, but files
+ * starting with a hash (#) , or ending with a tilde (~) are
+ * ignored. Subdirectories are not traversed. Note that this directory
+ * may not be checked by other Kerberos implementations.
+ *
+ * If no configuration file exists, match user against local domains,
+ * ie luser@@LOCAL-REALMS-IN-CONFIGURATION-FILES.
+ *
+ * @param context Kerberos 5 context.
+ * @param principal principal to check if allowed to login
+ * @param luser local user id
+ *
+ * @return returns TRUE if access should be granted, FALSE otherwise.
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_kuserok (
 	krb5_context /*context*/,
@@ -2895,7 +5793,7 @@ krb5_log (
 	int /*level*/,
 	const char */*fmt*/,
 	...)
-     __attribute__((format (printf, 4, 5)));
+     __attribute__ ((__format__ (__printf__, 4, 5)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_log_msg (
@@ -2905,7 +5803,20 @@ krb5_log_msg (
 	char **/*reply*/,
 	const char */*fmt*/,
 	...)
-     __attribute__((format (printf, 5, 6)));
+     __attribute__ ((__format__ (__printf__, 5, 6)));
+
+/**
+ * Create an address of type KRB5_ADDRESS_ADDRPORT from (addr, port)
+ *
+ * @param context a Keberos context
+ * @param res built address from addr/port
+ * @param addr address to use
+ * @param port port to use
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_make_addrport (
@@ -2914,6 +5825,19 @@ krb5_make_addrport (
 	const krb5_address */*addr*/,
 	int16_t /*port*/);
 
+/**
+ * Build a principal using vararg style building
+ *
+ * @param context A Kerberos context.
+ * @param principal returned principal
+ * @param realm realm name
+ * @param ... a list of components ended with NULL.
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_make_principal (
 	krb5_context /*context*/,
@@ -2921,6 +5845,15 @@ krb5_make_principal (
 	krb5_const_realm /*realm*/,
 	...);
 
+/**
+ * krb5_max_sockaddr_size returns the max size of the .Li struct
+ * sockaddr that the Kerberos library will return.
+ *
+ * @return Return an size_t of the maximum struct sockaddr.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION size_t KRB5_LIB_CALL
 krb5_max_sockaddr_size (void);
 
@@ -2936,6 +5869,19 @@ krb5_mk_error (
 	int */*client_usec*/,
 	krb5_data */*reply*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_mk_error_ext (
+	krb5_context /*context*/,
+	krb5_error_code /*error_code*/,
+	const char */*e_text*/,
+	const krb5_data */*e_data*/,
+	const krb5_principal /*server*/,
+	const PrincipalName */*client_name*/,
+	const Realm */*client_realm*/,
+	time_t */*client_time*/,
+	int */*client_usec*/,
+	krb5_data */*reply*/);
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_mk_priv (
 	krb5_context /*context*/,
@@ -2988,6 +5934,49 @@ krb5_mk_safe (
 	krb5_data */*outbuf*/,
 	krb5_replay_data */*outdata*/);
 
+/**
+ * Iteratively apply name canon rules, outputing a principal and rule
+ * options each time.  Iteration completes when the @iter is NULL on
+ * return or when an error is returned.  Callers must free the iterator
+ * if they abandon it mid-way.
+ *
+ * @param context   Kerberos context
+ * @param iter	    name canon rule iterator (input/output)
+ * @param try_princ output principal name
+ * @param rule_opts output rule options
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_name_canon_iterate (
+	krb5_context /*context*/,
+	krb5_name_canon_iterator */*iter*/,
+	krb5_const_principal */*try_princ*/,
+	krb5_name_canon_rule_options */*rule_opts*/);
+
+/**
+ * Initialize name canonicalization iterator.
+ *
+ * @param context   Kerberos context
+ * @param in_princ  principal name to be canonicalized OR
+ * @param iter	    output iterator object
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_name_canon_iterator_start (
+	krb5_context /*context*/,
+	krb5_const_principal /*in_princ*/,
+	krb5_name_canon_iterator */*iter*/);
+
+/**
+ * Read \a len bytes from socket \a p_fd into buffer \a buf.
+ * Block until \a len bytes are read or until an error.
+ *
+ * @return If successful, the number of bytes read: \a len.
+ *         On end-of-file, 0.
+ *         On error, less than 0 (if single-threaded, the error can be found
+ *         in the errno global variable).
+ */
+
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
 krb5_net_read (
 	krb5_context /*context*/,
@@ -3021,10 +6010,10 @@ krb5_ntlm_free (
 	krb5_ntlm /*ntlm*/);
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
-krb5_ntlm_init_get_challange (
+krb5_ntlm_init_get_challenge (
 	krb5_context /*context*/,
 	krb5_ntlm /*ntlm*/,
-	krb5_data */*challange*/);
+	krb5_data */*challenge*/);
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ntlm_init_get_flags (
@@ -3141,6 +6130,20 @@ krb5_pac_free (
 	krb5_context /*context*/,
 	krb5_pac /*pac*/);
 
+/**
+ * Get the PAC buffer of specific type from the pac.
+ *
+ * @param context Kerberos 5 context.
+ * @param p the pac structure returned by krb5_pac_parse().
+ * @param type type of buffer to get
+ * @param data return data, free with krb5_data_free().
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5_pac
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_pac_get_buffer (
 	krb5_context /*context*/,
@@ -3167,6 +6170,22 @@ krb5_pac_parse (
 	size_t /*len*/,
 	krb5_pac */*pac*/);
 
+/**
+ * Verify the PAC.
+ *
+ * @param context Kerberos 5 context.
+ * @param pac the pac structure returned by krb5_pac_parse().
+ * @param authtime The time of the ticket the PAC belongs to.
+ * @param principal the principal to verify.
+ * @param server The service key, most always be given.
+ * @param privsvr The KDC key, may be given.
+
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5_pac
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_pac_verify (
 	krb5_context /*context*/,
@@ -3184,18 +6203,56 @@ krb5_padata_add (
 	void */*buf*/,
 	size_t /*len*/);
 
+/**
+ * krb5_parse_address returns the resolved hostname in string to the
+ * krb5_addresses addresses .
+ *
+ * @param context a Keberos context
+ * @param string
+ * @param addresses
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_parse_address (
 	krb5_context /*context*/,
 	const char */*string*/,
 	krb5_addresses */*addresses*/);
 
+/**
+ * Parse a name into a krb5_principal structure
+ *
+ * @param context Kerberos 5 context
+ * @param name name to parse into a Kerberos principal
+ * @param principal returned principal, free with krb5_free_principal().
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_parse_name (
 	krb5_context /*context*/,
 	const char */*name*/,
 	krb5_principal */*principal*/);
 
+/**
+ * Parse a name into a krb5_principal structure, flags controls the behavior.
+ *
+ * @param context Kerberos 5 context
+ * @param name name to parse into a Kerberos principal
+ * @param flags flags to control the behavior
+ * @param principal returned principal, free with krb5_free_principal().
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_parse_name_flags (
 	krb5_context /*context*/,
@@ -3203,6 +6260,12 @@ krb5_parse_name_flags (
 	int /*flags*/,
 	krb5_principal */*principal*/);
 
+/**
+ * Parse nametype string and return a nametype integer
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_parse_nametype (
 	krb5_context /*context*/,
@@ -3214,6 +6277,12 @@ krb5_passwd_result_to_string (
 	krb5_context /*context*/,
 	int /*result*/);
 
+/**
+ * Deprecated: use krb5_get_init_creds() and friends.
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_CALLCONV
 krb5_password_key_proc (
 	krb5_context /*context*/,
@@ -3231,6 +6300,18 @@ krb5_pk_enterprise_cert (
 	krb5_principal */*principal*/,
 	struct hx509_certs_data **/*res*/);
 
+/**
+ * Register a plugin symbol name of specific type.
+ * @param context a Keberos context
+ * @param type type of plugin symbol
+ * @param name name of plugin symbol
+ * @param symbol a pointer to the named symbol
+ * @return In case of error a non zero error com_err error is returned
+ * and the Kerberos error string is set.
+ *
+ * @ingroup krb5_support
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_plugin_register (
 	krb5_context /*context*/,
@@ -3244,18 +6325,50 @@ krb5_prepend_config_files (
 	char **/*pq*/,
 	char ***/*ret_pp*/);
 
+/**
+ * Prepend the filename to the global configuration list.
+ *
+ * @param filelist a filename to add to the default list of filename
+ * @param pfilenames return array of filenames, should be freed with krb5_free_config_files().
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_prepend_config_files_default (
 	const char */*filelist*/,
 	char ***/*pfilenames*/);
 
+/**
+ * Prepend the context full error string for a specific error code.
+ * The error that is stored should be internationalized.
+ *
+ * The if context is NULL, no error string is stored.
+ *
+ * @param context Kerberos 5 context
+ * @param ret The error code
+ * @param fmt Error string for the error code
+ * @param ... printf(3) style parameters.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_prepend_error_message (
 	krb5_context /*context*/,
 	krb5_error_code /*ret*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
+
+/**
+ * Deprecated: use krb5_principal_get_realm()
+ *
+ * @ingroup krb5_deprecated
+ */
 
 KRB5_LIB_FUNCTION krb5_realm * KRB5_LIB_CALL
 krb5_princ_realm (
@@ -3263,6 +6376,12 @@ krb5_princ_realm (
 	krb5_principal /*principal*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Deprecated: use krb5_principal_set_realm()
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_princ_set_realm (
 	krb5_context /*context*/,
@@ -3270,12 +6389,39 @@ krb5_princ_set_realm (
 	krb5_realm */*realm*/)
      KRB5_DEPRECATED_FUNCTION("Use X instead");
 
+/**
+ * Compares the two principals, including realm of the principals and returns
+ * TRUE if they are the same and FALSE if not.
+ *
+ * @param context Kerberos 5 context
+ * @param princ1 first principal to compare
+ * @param princ2 second principal to compare
+ *
+ * @ingroup krb5_principal
+ * @see krb5_principal_compare_any_realm()
+ * @see krb5_realm_compare()
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_principal_compare (
 	krb5_context /*context*/,
 	krb5_const_principal /*princ1*/,
 	krb5_const_principal /*princ2*/);
 
+/**
+ * Return TRUE iff princ1 == princ2 (without considering the realm)
+ *
+ * @param context Kerberos 5 context
+ * @param princ1 first principal to compare
+ * @param princ2 second principal to compare
+ *
+ * @return non zero if equal, 0 if not
+ *
+ * @ingroup krb5_principal
+ * @see krb5_principal_compare()
+ * @see krb5_realm_compare()
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_principal_compare_any_realm (
 	krb5_context /*context*/,
@@ -3288,44 +6434,192 @@ krb5_principal_get_comp_string (
 	krb5_const_principal /*principal*/,
 	unsigned int /*component*/);
 
+/**
+ * Get number of component is principal.
+ *
+ * @param context Kerberos 5 context
+ * @param principal principal to query
+ *
+ * @return number of components in string
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION unsigned int KRB5_LIB_CALL
 krb5_principal_get_num_comp (
 	krb5_context /*context*/,
 	krb5_const_principal /*principal*/);
 
+/**
+ * Get the realm of the principal
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to get the realm for
+ *
+ * @return realm of the principal, don't free or use after krb5_principal is freed
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
 krb5_principal_get_realm (
 	krb5_context /*context*/,
 	krb5_const_principal /*principal*/);
 
+/**
+ * Get the type of the principal
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to get the type for
+ *
+ * @return the type of principal
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_principal_get_type (
 	krb5_context /*context*/,
 	krb5_const_principal /*principal*/);
 
+/**
+ * Returns true iff name is an WELLKNOWN:ORG.H5L.HOSTBASED-SERVICE
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_gss_hostbased_service (
+	krb5_context /*context*/,
+	krb5_const_principal /*principal*/);
+
+/**
+ * Check if the cname part of the principal is a krbtgt principal
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_principal_is_krbtgt (
 	krb5_context /*context*/,
 	krb5_const_principal /*p*/);
 
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_lkdc (
+	krb5_context /*context*/,
+	krb5_const_principal /*principal*/);
+
+/**
+ * Returns true if name is Kerberos NULL name
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_null (
+	krb5_context /*context*/,
+	krb5_const_principal /*principal*/);
+
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_pku2u (
+	krb5_context /*context*/,
+	krb5_const_principal /*principal*/);
+
+/**
+ * Check if the cname part of the principal is a initial or renewed krbtgt principal
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_principal_is_root_krbtgt (
+	krb5_context /*context*/,
+	krb5_const_principal /*p*/);
+
+/**
+ * return TRUE iff princ matches pattern
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_principal_match (
 	krb5_context /*context*/,
 	krb5_const_principal /*princ*/,
 	krb5_const_principal /*pattern*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_principal_set_comp_string (
+	krb5_context /*context*/,
+	krb5_principal /*principal*/,
+	unsigned int /*k*/,
+	const char */*component*/);
+
+/**
+ * Set a new realm for a principal, and as a side-effect free the
+ * previous realm.
+ *
+ * @param context A Kerberos context.
+ * @param principal principal set the realm for
+ * @param realm the new realm to set
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_principal_set_realm (
 	krb5_context /*context*/,
 	krb5_principal /*principal*/,
 	krb5_const_realm /*realm*/);
 
+/**
+ * Set the type of the principal
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to set the type for
+ * @param type the new type
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_principal_set_type (
 	krb5_context /*context*/,
 	krb5_principal /*principal*/,
 	int /*type*/);
 
+/**
+ * krb5_print_address prints the address in addr to the string string
+ * that have the length len. If ret_len is not NULL, it will be filled
+ * with the length of the string if size were unlimited (not including
+ * the final NUL) .
+ *
+ * @param addr address to be printed
+ * @param str pointer string to print the address into
+ * @param len length that will fit into area pointed to by "str".
+ * @param ret_len return length the str.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_print_address (
 	const krb5_address */*addr*/,
@@ -3333,6 +6627,12 @@ krb5_print_address (
 	size_t /*len*/,
 	size_t */*ret_len*/);
 
+krb5_error_code
+krb5_process_last_request (
+	krb5_context /*context*/,
+	krb5_get_init_creds_opt */*options*/,
+	krb5_init_creds_context /*ctx*/);
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_program_setup (
 	krb5_context */*context*/,
@@ -3351,6 +6651,23 @@ krb5_prompter_posix (
 	int /*num_prompts*/,
 	krb5_prompt prompts[]);
 
+/**
+ * Converts the random bytestring to a protocol key according to
+ * Kerberos crypto frame work. It may be assumed that all the bits of
+ * the input string are equally random, even though the entropy
+ * present in the random source may be limited.
+ *
+ * @param context Kerberos 5 context
+ * @param type the enctype resulting key will be of
+ * @param data input random data to convert to a key
+ * @param size size of input random data, at least krb5_enctype_keysize() long
+ * @param key key, output key, free with krb5_free_keyblock_contents()
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_random_to_key (
 	krb5_context /*context*/,
@@ -3472,6 +6789,23 @@ krb5_rd_rep (
 	const krb5_data */*inbuf*/,
 	krb5_ap_rep_enc_part **/*repl*/);
 
+/**
+ * Process an AP_REQ message.
+ *
+ * @param context        Kerberos 5 context.
+ * @param auth_context   authentication context of the peer.
+ * @param inbuf          the AP_REQ message, obtained for example with krb5_read_message().
+ * @param server         server principal.
+ * @param keytab         server keytab.
+ * @param ap_req_options set to the AP_REQ options. See the AP_OPTS_* defines.
+ * @param ticket         on success, set to the authenticated client credentials.
+ *                       Must be deallocated with krb5_free_ticket(). If not
+ *                       interested, pass a NULL value.
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req (
 	krb5_context /*context*/,
@@ -3482,6 +6816,30 @@ krb5_rd_req (
 	krb5_flags */*ap_req_options*/,
 	krb5_ticket **/*ticket*/);
 
+/**
+ * The core server function that verify application authentication
+ * requests from clients.
+ *
+ * @param context Keberos 5 context.
+ * @param auth_context the authentication context, can be NULL, then
+ *        default values for the authentication context will used.
+ * @param inbuf the (AP-REQ) authentication buffer
+ *
+ * @param server the server to authenticate to. If NULL the function
+ *        will try to find any available credential in the keytab
+ *        that will verify the reply. The function will prefer the
+ *        server specified in the AP-REQ, but if
+ *        there is no mach, it will try all keytab entries for a
+ *        match. This has serious performance issues for large keytabs.
+ *
+ * @param inctx control the behavior of the function, if NULL, the
+ *        default behavior is used.
+ * @param outctx the return outctx, free with krb5_rd_req_out_ctx_free().
+ * @return Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_ctx (
 	krb5_context /*context*/,
@@ -3491,6 +6849,19 @@ krb5_rd_req_ctx (
 	krb5_rd_req_in_ctx /*inctx*/,
 	krb5_rd_req_out_ctx */*outctx*/);
 
+/**
+ * Allocate a krb5_rd_req_in_ctx as an input parameter to
+ * krb5_rd_req_ctx(). The caller should free the context with
+ * krb5_rd_req_in_ctx_free() when done with the context.
+ *
+ * @param context Keberos 5 context.
+ * @param ctx in ctx to krb5_rd_req_ctx().
+ *
+ * @return Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_in_ctx_alloc (
 	krb5_context /*context*/,
@@ -3507,18 +6878,53 @@ krb5_rd_req_in_set_keyblock (
 	krb5_rd_req_in_ctx /*in*/,
 	krb5_keyblock */*keyblock*/);
 
+/**
+ * Set the keytab that krb5_rd_req_ctx() will use.
+ *
+ * @param context Keberos 5 context.
+ * @param in in ctx to krb5_rd_req_ctx().
+ * @param keytab keytab that krb5_rd_req_ctx() will use, only copy the
+ *        pointer, so the caller must free they keytab after
+ *        krb5_rd_req_in_ctx_free() is called.
+ *
+ * @return Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_in_set_keytab (
 	krb5_context /*context*/,
 	krb5_rd_req_in_ctx /*in*/,
 	krb5_keytab /*keytab*/);
 
+/**
+ * Set if krb5_rq_red() is going to check the Windows PAC or not
+ *
+ * @param context Keberos 5 context.
+ * @param in krb5_rd_req_in_ctx to check the option on.
+ * @param flag flag to select if to check the pac (TRUE) or not (FALSE).
+ *
+ * @return Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_in_set_pac_check (
 	krb5_context /*context*/,
 	krb5_rd_req_in_ctx /*in*/,
 	krb5_boolean /*flag*/);
 
+/**
+ * Free the krb5_rd_req_out_ctx.
+ *
+ * @param context Keberos 5 context.
+ * @param ctx krb5_rd_req_out_ctx context to free.
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_rd_req_out_ctx_free (
 	krb5_context /*context*/,
@@ -3536,6 +6942,18 @@ krb5_rd_req_out_get_keyblock (
 	krb5_rd_req_out_ctx /*out*/,
 	krb5_keyblock **/*keyblock*/);
 
+/**
+ * Get the principal that was used in the request from the
+ * client. Might not match whats in the ticket if krb5_rd_req_ctx()
+ * searched in the keytab for a matching key.
+ *
+ * @param context a Kerberos 5 context.
+ * @param out a krb5_rd_req_out_ctx from krb5_rd_req_ctx().
+ * @param principal return principal, free with krb5_free_principal().
+ *
+ * @ingroup krb5_auth
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_rd_req_out_get_server (
 	krb5_context /*context*/,
@@ -3586,12 +7004,52 @@ krb5_read_safe_message (
 	krb5_pointer /*p_fd*/,
 	krb5_data */*data*/);
 
+/**
+ * return TRUE iff realm(princ1) == realm(princ2)
+ *
+ * @param context Kerberos 5 context
+ * @param princ1 first principal to compare
+ * @param princ2 second principal to compare
+ *
+ * @ingroup krb5_principal
+ * @see krb5_principal_compare_any_realm()
+ * @see krb5_principal_compare()
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_realm_compare (
 	krb5_context /*context*/,
 	krb5_const_principal /*princ1*/,
 	krb5_const_principal /*princ2*/);
 
+/**
+ * Returns true if name is Kerberos an LKDC realm
+ *
+ * @ingroup krb5_principal
+ */
+
+krb5_boolean KRB5_LIB_FUNCTION
+krb5_realm_is_lkdc (const char */*realm*/);
+
+/**
+ * Perform the server side of the sendauth protocol.
+ *
+ * @param context       Kerberos 5 context.
+ * @param auth_context  authentication context of the peer.
+ * @param p_fd          socket associated to the connection.
+ * @param appl_version  server-specific string.
+ * @param server        server principal.
+ * @param flags         if KRB5_RECVAUTH_IGNORE_VERSION is set, skip the sendauth version
+ *                      part of the protocol.
+ * @param keytab        server keytab.
+ * @param ticket        on success, set to the authenticated client credentials.
+ *                      Must be deallocated with krb5_free_ticket(). If not
+ *                      interested, pass a NULL value.
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_recvauth (
 	krb5_context /*context*/,
@@ -3603,6 +7061,12 @@ krb5_recvauth (
 	krb5_keytab /*keytab*/,
 	krb5_ticket **/*ticket*/);
 
+/**
+ * Perform the server side of the sendauth protocol like krb5_recvauth(), but support
+ * a user-specified callback, \a match_appl_version, to perform the match of the application
+ * version \a match_data.
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_recvauth_match_version (
 	krb5_context /*context*/,
@@ -3615,61 +7079,212 @@ krb5_recvauth_match_version (
 	krb5_keytab /*keytab*/,
 	krb5_ticket **/*ticket*/);
 
+/**
+ * Read a address block from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param adr the address block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_address (
 	krb5_storage */*sp*/,
 	krb5_address */*adr*/);
 
+/**
+ * Read a addresses block from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param adr the addresses block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_addrs (
 	krb5_storage */*sp*/,
 	krb5_addresses */*adr*/);
 
+/**
+ * Read a auth data from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param auth the auth data block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_authdata (
 	krb5_storage */*sp*/,
 	krb5_authdata */*auth*/);
 
+/**
+ * Read a credentials block from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param creds the credentials block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_creds (
 	krb5_storage */*sp*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Read a tagged credentials block from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param creds the credentials block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_creds_tag (
 	krb5_storage */*sp*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Parse a data from the storage.
+ *
+ * @param sp the storage buffer to read from
+ * @param data the parsed data
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_data (
 	krb5_storage */*sp*/,
 	krb5_data */*data*/);
 
+/**
+ * Read a int16 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_int16 (
 	krb5_storage */*sp*/,
 	int16_t */*value*/);
 
+/**
+ * Read a int32 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_int32 (
 	krb5_storage */*sp*/,
 	int32_t */*value*/);
 
+/**
+ * Read a int64 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_ret_int64 (
+	krb5_storage */*sp*/,
+	int64_t */*value*/);
+
+/**
+ * Read a int8 from storage
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_int8 (
 	krb5_storage */*sp*/,
 	int8_t */*value*/);
 
+/**
+ * Read a keyblock from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param p the keyblock read from storage, free using krb5_free_keyblock()
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_keyblock (
 	krb5_storage */*sp*/,
 	krb5_keyblock */*p*/);
 
+/**
+ * Parse principal from the storage.
+ *
+ * @param sp the storage buffer to read from
+ * @param princ the parsed principal
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_principal (
 	krb5_storage */*sp*/,
 	krb5_principal */*princ*/);
 
+/**
+ * Parse a string from the storage.
+ *
+ * @param sp the storage buffer to read from
+ * @param string the parsed string
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_string (
 	krb5_storage */*sp*/,
@@ -3680,26 +7295,100 @@ krb5_ret_stringnl (
 	krb5_storage */*sp*/,
 	char **/*string*/);
 
+/**
+ * Parse zero terminated string from the storage.
+ *
+ * @param sp the storage buffer to read from
+ * @param string the parsed string
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_stringz (
 	krb5_storage */*sp*/,
 	char **/*string*/);
 
+/**
+ * Read a times block from the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param times the times block read from storage
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_times (
 	krb5_storage */*sp*/,
 	krb5_times */*times*/);
 
+/**
+ * Read a int16 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_uint16 (
 	krb5_storage */*sp*/,
 	uint16_t */*value*/);
 
+/**
+ * Read a uint32 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_uint32 (
 	krb5_storage */*sp*/,
 	uint32_t */*value*/);
 
+/**
+ * Read a uint64 from storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_ret_uint64 (
+	krb5_storage */*sp*/,
+	uint64_t */*value*/);
+
+/**
+ * Read a uint8 from storage
+ *
+ * @param sp the storage to write too
+ * @param value the value read from the buffer
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ret_uint8 (
 	krb5_storage */*sp*/,
@@ -3712,6 +7401,30 @@ krb5_salttype_to_string (
 	krb5_salttype /*stype*/,
 	char **/*string*/);
 
+/**
+ * Perform the client side of the sendauth protocol.
+ *
+ * @param context        Kerberos 5 context.
+ * @param auth_context   Authentication context of the peer.
+ * @param p_fd           Socket associated to the connection.
+ * @param appl_version   Server-specific string.
+ * @param client         Client principal. If NULL, use the credentials in \a ccache.
+ * @param server         Server principal.
+ * @param ap_req_options Options for the AP_REQ message. See the AP_OPTS_* defines in krb5.h.
+ * @param in_data        FIXME
+ * @param in_creds       FIXME
+ * @param ccache         Credentials cache. If NULL, use the default credentials cache.
+ * @param ret_error      If not NULL, will be set to the error reported by server, if any.
+ *                       Must be deallocated with krb5_free_error_contents().
+ * @param rep_result     If not NULL, will be set to the EncApRepPart of the AP_REP message.
+ *                       Must be deallocated with krb5_free_ap_rep_enc_part().
+ * @param out_creds      FIXME If not NULL, will be set to FIXME. Must be deallocated with
+ *                       krb5_free_creds().
+ *
+ * @return 0 to indicate success. Otherwise a Kerberos error code is
+ *         returned, see krb5_get_error_message().
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sendauth (
 	krb5_context /*context*/,
@@ -3740,7 +7453,7 @@ krb5_sendto_context (
 	krb5_context /*context*/,
 	krb5_sendto_ctx /*ctx*/,
 	const krb5_data */*send_data*/,
-	const krb5_realm /*realm*/,
+	krb5_const_realm /*realm*/,
 	krb5_data */*receive*/);
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
@@ -3748,6 +7461,23 @@ krb5_sendto_ctx_add_flags (
 	krb5_sendto_ctx /*ctx*/,
 	int /*flags*/);
 
+/**
+ * @section send_to_kdc Locating and sending packets to the KDC
+ *
+ * The send to kdc code is responsible to request the list of KDC from
+ * the locate-kdc subsystem and then send requests to each of them.
+ *
+ * - Each second a new hostname is tried.
+ * - If the hostname have several addresses, the first will be tried
+ *   directly then in turn the other will be tried every 3 seconds
+ *   (host_timeout).
+ * - UDP requests are tried 3 times, and it tried with a individual timeout of kdc_timeout / 3.
+ * - TCP and HTTP requests are tried 1 time.
+ *
+ *  Total wait time shorter then (number of addresses * 3) + kdc_timeout seconds.
+ *
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sendto_ctx_alloc (
 	krb5_context /*context*/,
@@ -3787,11 +7517,50 @@ krb5_sendto_kdc_flags (
 	krb5_data */*receive*/,
 	int /*flags*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_sendto_set_hostname (
+	krb5_context /*context*/,
+	krb5_sendto_ctx /*ctx*/,
+	const char */*hostname*/);
+
+/**
+ * Reinit the context from a new set of filenames.
+ *
+ * @param context context to add configuration too.
+ * @param filenames array of filenames, end of list is indicated with a NULL filename.
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_config_files (
 	krb5_context /*context*/,
 	char **/*filenames*/);
 
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_set_debug_dest (
+	krb5_context /*context*/,
+	const char */*program*/,
+	const char */*log_spec*/);
+
+/**
+ * Set the default encryption types that will be use in communcation
+ * with the KDC, clients and servers.
+ *
+ * @param context Kerberos 5 context.
+ * @param etypes Encryption types, array terminated with ETYPE_NULL (0).
+ * A value of NULL resets the encryption types to the defaults set in the
+ * configuration file.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_default_in_tkt_etypes (
 	krb5_context /*context*/,
@@ -3802,57 +7571,186 @@ krb5_set_default_realm (
 	krb5_context /*context*/,
 	const char */*realm*/);
 
+/**
+ * Set if the library should use DNS to canonicalize hostnames.
+ *
+ * @param context Kerberos 5 context.
+ * @param flag if its dns canonicalizion is used or not.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_set_dns_canonicalize_hostname (
 	krb5_context /*context*/,
 	krb5_boolean /*flag*/);
 
+/**
+ * Set the context full error string for a specific error code.
+ * The error that is stored should be internationalized.
+ *
+ * The if context is NULL, no error string is stored.
+ *
+ * @param context Kerberos 5 context
+ * @param ret The error code
+ * @param fmt Error string for the error code
+ * @param ... printf(3) style parameters.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_set_error_message (
 	krb5_context /*context*/,
 	krb5_error_code /*ret*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
+
+/**
+ * Set the error message returned by krb5_get_error_string().
+ *
+ * Deprecated: use krb5_get_error_message()
+ *
+ * @param context Kerberos context
+ * @param fmt error message to free
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_deprecated
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_error_string (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	...)
-     __attribute__((format (printf, 2, 3))) KRB5_DEPRECATED_FUNCTION("Use X instead");
+     __attribute__ ((__format__ (__printf__, 2, 3))) KRB5_DEPRECATED_FUNCTION("Use X instead");
+
+/**
+ * Set extra address to the address list that the library will add to
+ * the client's address list when communicating with the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses addreses to set
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_extra_addresses (
 	krb5_context /*context*/,
 	const krb5_addresses */*addresses*/);
 
+/**
+ * Set version of fcache that the library should use.
+ *
+ * @param context Kerberos 5 context.
+ * @param version version number.
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_fcache_version (
 	krb5_context /*context*/,
 	int /*version*/);
 
+/**
+ * Enable and disable home directory access on either the global state
+ * or the krb5_context state. By calling krb5_set_home_dir_access()
+ * with context set to NULL, the global state is configured otherwise
+ * the state for the krb5_context is modified.
+ *
+ * For home directory access to be allowed, both the global state and
+ * the krb5_context state have to be allowed.
+ *
+ * @param context a Kerberos 5 context or NULL
+ * @param allow allow if TRUE home directory
+ * @return the old value
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_set_home_dir_access (
 	krb5_context /*context*/,
 	krb5_boolean /*allow*/);
 
+/**
+ * Set extra addresses to ignore when fetching addresses from the
+ * underlaying operating system.
+ *
+ * @param context Kerberos 5 context.
+ * @param addresses addreses to ignore
+ *
+ * @return Returns 0 to indicate success. Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_ignore_addresses (
 	krb5_context /*context*/,
 	const krb5_addresses */*addresses*/);
 
+/**
+ * Set current offset in time to the KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param sec seconds part of offset.
+ * @param usec micro seconds part of offset.
+ *
+ * @return returns zero
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_kdc_sec_offset (
 	krb5_context /*context*/,
 	int32_t /*sec*/,
 	int32_t /*usec*/);
 
+/**
+ * Set max time skew allowed.
+ *
+ * @param context Kerberos 5 context.
+ * @param t timeskew in seconds.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_set_max_time_skew (
 	krb5_context /*context*/,
 	time_t /*t*/);
 
+/**
+ * Change password using creds.
+ *
+ * @param context a Keberos context
+ * @param creds The initial kadmin/passwd for the principal or an admin principal
+ * @param newpw The new password to set
+ * @param targprinc if unset, the default principal is used.
+ * @param result_code Result code, KRB5_KPASSWD_SUCCESS is when password is changed.
+ * @param result_code_string binary message from the server, contains
+ * at least the result_code.
+ * @param result_string A message from the kpasswd service or the
+ * library in human printable form. The string is NUL terminated.
+ *
+ * @return On sucess and *result_code is KRB5_KPASSWD_SUCCESS, the password is changed.
+
+ * @ingroup @krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_password (
 	krb5_context /*context*/,
@@ -3873,6 +7771,20 @@ krb5_set_password_using_ccache (
 	krb5_data */*result_code_string*/,
 	krb5_data */*result_string*/);
 
+/**
+ * Set the absolute time that the caller knows the kdc has so the
+ * kerberos library can calculate the relative diffrence beteen the
+ * KDC time and local system time.
+ *
+ * @param context Keberos 5 context.
+ * @param sec The applications new of "now" in seconds
+ * @param usec The applications new of "now" in micro seconds
+
+ * @return Kerberos 5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_real_time (
 	krb5_context /*context*/,
@@ -3885,16 +7797,57 @@ krb5_set_send_to_kdc_func (
 	krb5_send_to_kdc_func /*func*/,
 	void */*data*/);
 
+/**
+ * Make the kerberos library default to the admin KDC.
+ *
+ * @param context Kerberos 5 context.
+ * @param flag boolean flag to select if the use the admin KDC or not.
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_set_use_admin_kdc (
 	krb5_context /*context*/,
 	krb5_boolean /*flag*/);
 
+/**
+ * Set the default logging facility.
+ *
+ * @param context A Kerberos 5 context
+ * @param fac Facility to use for logging.
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_set_warn_dest (
 	krb5_context /*context*/,
 	krb5_log_facility */*fac*/);
 
+/**
+ * Create a principal for the given service running on the given
+ * hostname. If KRB5_NT_SRV_HST is used, the hostname is canonicalized
+ * according the configured name canonicalization rules, with
+ * canonicalization delayed in some cases.  One rule involves DNS, which
+ * is insecure unless DNSSEC is used, but we don't use DNSSEC-capable
+ * resolver APIs here, so that if DNSSEC is used we wouldn't know it.
+ *
+ * Canonicalization is immediate (not delayed) only when there is only
+ * one canonicalization rule and that rule indicates that we should do a
+ * host lookup by name (i.e., DNS).
+ *
+ * @param context A Kerberos context.
+ * @param hostname hostname to use
+ * @param sname Service name to use
+ * @param type name type of principal, use KRB5_NT_SRV_HST or KRB5_NT_UNKNOWN.
+ * @param ret_princ return principal, free with krb5_free_principal().
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sname_to_principal (
 	krb5_context /*context*/,
@@ -3911,12 +7864,39 @@ krb5_sock_to_principal (
 	int32_t /*type*/,
 	krb5_principal */*ret_princ*/);
 
+/**
+ * krb5_sockaddr2address stores a address a "struct sockaddr" sa in
+ * the krb5_address addr.
+ *
+ * @param context a Keberos context
+ * @param sa a struct sockaddr to extract the address from
+ * @param addr an Kerberos 5 address to store the address in.
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sockaddr2address (
 	krb5_context /*context*/,
 	const struct sockaddr */*sa*/,
 	krb5_address */*addr*/);
 
+/**
+ * krb5_sockaddr2port extracts a port (if possible) from a "struct
+ * sockaddr.
+ *
+ * @param context a Keberos context
+ * @param sa a struct sockaddr to extract the port from
+ * @param port a pointer to an int16_t store the port in.
+ *
+ * @return Return an error code or 0. Will return
+ * KRB5_PROG_ATYPE_NOSUPP in case address type is not supported.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_sockaddr2port (
 	krb5_context /*context*/,
@@ -3926,6 +7906,18 @@ krb5_sockaddr2port (
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_sockaddr_is_loopback (const struct sockaddr */*sa*/);
 
+/**
+ * krb5_sockaddr_uninteresting returns TRUE for all .Fa sa that the
+ * kerberos library thinks are uninteresting.  One example are link
+ * local addresses.
+ *
+ * @param sa pointer to struct sockaddr that might be interesting.
+ *
+ * @return Return a non zero for uninteresting addresses.
+ *
+ * @ingroup krb5_address
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_sockaddr_uninteresting (const struct sockaddr */*sa*/);
 
@@ -3935,147 +7927,546 @@ krb5_std_usage (
 	struct getargs */*args*/,
 	int /*num_args*/);
 
+/**
+ * Clear the flags on a storage buffer
+ *
+ * @param sp the storage buffer to clear the flags on
+ * @param flags the flags to clear
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_storage_clear_flags (
 	krb5_storage */*sp*/,
 	krb5_flags /*flags*/);
 
+/**
+ * Create a elastic (allocating) memory storage backend. Memory is
+ * allocated on demand. Free returned krb5_storage with
+ * krb5_storage_free().
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_fd()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_socket()
+ */
+
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
 krb5_storage_emem (void);
 
+/**
+ * Free a krb5 storage.
+ *
+ * @param sp the storage to free.
+ *
+ * @return An Kerberos 5 error code.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_storage_free (krb5_storage */*sp*/);
 
+/**
+ * Create a fixed size memory storage block
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_mem()
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_fd()
+ */
+
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
 krb5_storage_from_data (krb5_data */*data*/);
 
+/**
+ *
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_emem()
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_socket()
+ */
+
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
-krb5_storage_from_fd (krb5_socket_t /*fd_in*/);
+krb5_storage_from_fd (int /*fd_in*/);
+
+/**
+ * Create a fixed size memory storage block
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_fd()
+ * @sa krb5_storage_from_socket()
+ */
 
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
 krb5_storage_from_mem (
 	void */*buf*/,
 	size_t /*len*/);
 
+/**
+ * Create a fixed size memory storage block that is read only
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_mem()
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_fd()
+ */
+
 KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
 krb5_storage_from_readonly_mem (
 	const void */*buf*/,
 	size_t /*len*/);
 
+/**
+ *
+ *
+ * @return A krb5_storage on success, or NULL on out of memory error.
+ *
+ * @ingroup krb5_storage
+ *
+ * @sa krb5_storage_emem()
+ * @sa krb5_storage_from_mem()
+ * @sa krb5_storage_from_readonly_mem()
+ * @sa krb5_storage_from_data()
+ * @sa krb5_storage_from_fd()
+ */
+
+KRB5_LIB_FUNCTION krb5_storage * KRB5_LIB_CALL
+krb5_storage_from_socket (krb5_socket_t /*sock_in*/);
+
+/**
+ * Sync the storage buffer to its backing store.  If there is no
+ * backing store this function will return success.
+ *
+ * @param sp the storage buffer to sync
+ *
+ * @return A Kerberos 5 error code
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION int KRB5_LIB_CALL
+krb5_storage_fsync (krb5_storage */*sp*/);
+
+/**
+ * Return the current byteorder for the buffer. See krb5_storage_set_byteorder() for the list or byte order contants.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_flags KRB5_LIB_CALL
 krb5_storage_get_byteorder (krb5_storage */*sp*/);
 
+/**
+ * Get the return code that will be used when end of storage is reached.
+ *
+ * @param sp the storage
+ *
+ * @return storage error code
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_storage_get_eof_code (krb5_storage */*sp*/);
 
+/**
+ * Return true or false depending on if the storage flags is set or
+ * not. NB testing for the flag 0 always return true.
+ *
+ * @param sp the storage buffer to check flags on
+ * @param flags The flags to test for
+ *
+ * @return true if all the flags are set, false if not.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
 krb5_storage_is_flags (
 	krb5_storage */*sp*/,
 	krb5_flags /*flags*/);
 
+/**
+ * Read to the storage buffer.
+ *
+ * @param sp the storage buffer to read from
+ * @param buf the buffer to store the data in
+ * @param len the length to read
+ *
+ * @return The length of data read (can be shorter then len), or negative on error.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
 krb5_storage_read (
 	krb5_storage */*sp*/,
 	void */*buf*/,
 	size_t /*len*/);
 
+/**
+ * Seek to a new offset.
+ *
+ * @param sp the storage buffer to seek in.
+ * @param offset the offset to seek
+ * @param whence relateive searching, SEEK_CUR from the current
+ * position, SEEK_END from the end, SEEK_SET absolute from the start.
+ *
+ * @return The new current offset
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION off_t KRB5_LIB_CALL
 krb5_storage_seek (
 	krb5_storage */*sp*/,
 	off_t /*offset*/,
 	int /*whence*/);
 
+/**
+ * Set the new byte order of the storage buffer.
+ *
+ * @param sp the storage buffer to set the byte order for.
+ * @param byteorder the new byte order.
+ *
+ * The byte order are: KRB5_STORAGE_BYTEORDER_BE,
+ * KRB5_STORAGE_BYTEORDER_LE and KRB5_STORAGE_BYTEORDER_HOST.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_storage_set_byteorder (
 	krb5_storage */*sp*/,
 	krb5_flags /*byteorder*/);
 
+/**
+ * Set the return code that will be used when end of storage is reached.
+ *
+ * @param sp the storage
+ * @param code the error code to return on end of storage
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_storage_set_eof_code (
 	krb5_storage */*sp*/,
 	int /*code*/);
 
+/**
+ * Add the flags on a storage buffer by or-ing in the flags to the buffer.
+ *
+ * @param sp the storage buffer to set the flags on
+ * @param flags the flags to set
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_storage_set_flags (
 	krb5_storage */*sp*/,
 	krb5_flags /*flags*/);
 
+/**
+ * Set the max alloc value
+ *
+ * @param sp the storage buffer set the max allow for
+ * @param size maximum size to allocate, use 0 to remove limit
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_storage_set_max_alloc (
 	krb5_storage */*sp*/,
 	size_t /*size*/);
 
+/**
+ * Copy the contnent of storage
+ *
+ * @param sp the storage to copy to a data
+ * @param data the copied data, free with krb5_data_free()
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_storage_to_data (
 	krb5_storage */*sp*/,
 	krb5_data */*data*/);
 
+/**
+ * Truncate the storage buffer in sp to offset.
+ *
+ * @param sp the storage buffer to truncate.
+ * @param offset the offset to truncate too.
+ *
+ * @return An Kerberos 5 error code.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
 krb5_storage_truncate (
 	krb5_storage */*sp*/,
 	off_t /*offset*/);
 
+/**
+ * Write to the storage buffer.
+ *
+ * @param sp the storage buffer to write to
+ * @param buf the buffer to write to the storage buffer
+ * @param len the length to write
+ *
+ * @return The length of data written (can be shorter then len), or negative on error.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL
 krb5_storage_write (
 	krb5_storage */*sp*/,
 	const void */*buf*/,
 	size_t /*len*/);
 
+/**
+ * Write a address block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param p the address block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_address (
 	krb5_storage */*sp*/,
 	krb5_address /*p*/);
 
+/**
+ * Write a addresses block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param p the addresses block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_addrs (
 	krb5_storage */*sp*/,
 	krb5_addresses /*p*/);
 
+/**
+ * Write a auth data block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param auth the auth data block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_authdata (
 	krb5_storage */*sp*/,
 	krb5_authdata /*auth*/);
 
+/**
+ * Write a credentials block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param creds the creds block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_creds (
 	krb5_storage */*sp*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Write a tagged credentials block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param creds the creds block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_creds_tag (
 	krb5_storage */*sp*/,
 	krb5_creds */*creds*/);
 
+/**
+ * Store a data to the storage. The data is stored with an int32 as
+ * lenght plus the data (not padded).
+ *
+ * @param sp the storage buffer to write to
+ * @param data the buffer to store.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_data (
 	krb5_storage */*sp*/,
 	krb5_data /*data*/);
 
+/**
+ * Store a int16 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_int16 (
 	krb5_storage */*sp*/,
 	int16_t /*value*/);
 
+/**
+ * Store a int32 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_int32 (
 	krb5_storage */*sp*/,
 	int32_t /*value*/);
 
+/**
+ * Store a int64 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_store_int64 (
+	krb5_storage */*sp*/,
+	int64_t /*value*/);
+
+/**
+ * Store a int8 to storage.
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_int8 (
 	krb5_storage */*sp*/,
 	int8_t /*value*/);
 
+/**
+ * Store a keyblock to the storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param p the keyblock to write
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_keyblock (
 	krb5_storage */*sp*/,
 	krb5_keyblock /*p*/);
 
+/**
+ * Write a principal block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param p the principal block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_principal (
 	krb5_storage */*sp*/,
 	krb5_const_principal /*p*/);
 
+/**
+ * Store a string to the buffer. The data is formated as an len:uint32
+ * plus the string itself (not padded).
+ *
+ * @param sp the storage buffer to write to
+ * @param s the string to store.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_string (
 	krb5_storage */*sp*/,
@@ -4086,26 +8477,101 @@ krb5_store_stringnl (
 	krb5_storage */*sp*/,
 	const char */*s*/);
 
+/**
+ * Store a zero terminated string to the buffer. The data is stored
+ * one character at a time until a NUL is stored.
+ *
+ * @param sp the storage buffer to write to
+ * @param s the string to store.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_stringz (
 	krb5_storage */*sp*/,
 	const char */*s*/);
 
+/**
+ * Write a times block to storage.
+ *
+ * @param sp the storage buffer to write to
+ * @param times the times block to write.
+ *
+ * @return 0 on success, a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_times (
 	krb5_storage */*sp*/,
 	krb5_times /*times*/);
 
+/**
+ * Store a uint16 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_uint16 (
 	krb5_storage */*sp*/,
 	uint16_t /*value*/);
 
+/**
+ * Store a uint32 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_uint32 (
 	krb5_storage */*sp*/,
 	uint32_t /*value*/);
 
+/**
+ * Store a uint64 to storage, byte order is controlled by the settings
+ * on the storage, see krb5_storage_set_byteorder().
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
+krb5_store_uint64 (
+	krb5_storage */*sp*/,
+	uint64_t /*value*/);
+
+/**
+ * Store a uint8 to storage.
+ *
+ * @param sp the storage to write too
+ * @param value the value to store
+ *
+ * @return 0 for success, or a Kerberos 5 error code on failure.
+ *
+ * @ingroup krb5_storage
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_store_uint8 (
 	krb5_storage */*sp*/,
@@ -4180,6 +8646,13 @@ krb5_string_to_key_salt_opaque (
 	krb5_data /*opaque*/,
 	krb5_keyblock */*key*/);
 
+/**
+ * Deprecated: keytypes doesn't exists, they are really enctypes in
+ * most cases, use krb5_string_to_enctype().
+ *
+ * @ingroup krb5_deprecated
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_string_to_keytype (
 	krb5_context /*context*/,
@@ -4194,6 +8667,19 @@ krb5_string_to_salttype (
 	const char */*string*/,
 	krb5_salttype */*salttype*/);
 
+/**
+ * Extract the authorization data type of type from the ticket. Store
+ * the field in data. This function is to use for kerberos
+ * applications.
+ *
+ * @param context a Kerberos 5 context
+ * @param ticket Kerberos ticket
+ * @param type type to fetch
+ * @param data returned data, free with krb5_data_free()
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ticket_get_authorization_data_type (
 	krb5_context /*context*/,
@@ -4201,39 +8687,117 @@ krb5_ticket_get_authorization_data_type (
 	int /*type*/,
 	krb5_data */*data*/);
 
+/**
+ * Return client principal in ticket
+ *
+ * @param context a Kerberos 5 context
+ * @param ticket ticket to copy
+ * @param client client principal, free with krb5_free_principal()
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ticket_get_client (
 	krb5_context /*context*/,
 	const krb5_ticket */*ticket*/,
 	krb5_principal */*client*/);
 
+/**
+ * Return end time of ticket
+ *
+ * @param context a Kerberos 5 context
+ * @param ticket ticket to copy
+ *
+ * @return end time of ticket
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL
 krb5_ticket_get_endtime (
 	krb5_context /*context*/,
 	const krb5_ticket */*ticket*/);
 
+/**
+ * Get the flags from the Kerberos ticket
+ *
+ * @param context Kerberos context
+ * @param ticket Kerberos ticket
+ *
+ * @return ticket flags
+ *
+ * @ingroup krb5_ticket
+ */
+
 KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL
 krb5_ticket_get_flags (
 	krb5_context /*context*/,
 	const krb5_ticket */*ticket*/);
 
+/**
+ * Return server principal in ticket
+ *
+ * @param context a Kerberos 5 context
+ * @param ticket ticket to copy
+ * @param server server principal, free with krb5_free_principal()
+ *
+ * @return Returns 0 to indicate success.  Otherwise an kerberos et
+ * error code is returned, see krb5_get_error_message().
+ *
+ * @ingroup krb5
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_ticket_get_server (
 	krb5_context /*context*/,
 	const krb5_ticket */*ticket*/,
 	krb5_principal */*server*/);
 
+/**
+     * If the caller passes in a negative usec, its assumed to be
+     * unknown and the function will use the current time usec.
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_timeofday (
 	krb5_context /*context*/,
 	krb5_timestamp */*timeret*/);
 
+/**
+ * Unparse the Kerberos name into a string
+ *
+ * @param context Kerberos 5 context
+ * @param principal principal to query
+ * @param name resulting string, free with krb5_xfree()
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name (
 	krb5_context /*context*/,
 	krb5_const_principal /*principal*/,
 	char **/*name*/);
 
+/**
+ * Unparse the principal name to a fixed buffer
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to unparse
+ * @param name buffer to write name to
+ * @param len length of buffer
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name_fixed (
 	krb5_context /*context*/,
@@ -4241,6 +8805,20 @@ krb5_unparse_name_fixed (
 	char */*name*/,
 	size_t /*len*/);
 
+/**
+ * Unparse the principal name with unparse flags to a fixed buffer.
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to unparse
+ * @param flags unparse flags
+ * @param name buffer to write name to
+ * @param len length of buffer
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name_fixed_flags (
 	krb5_context /*context*/,
@@ -4249,6 +8827,20 @@ krb5_unparse_name_fixed_flags (
 	char */*name*/,
 	size_t /*len*/);
 
+/**
+ * Unparse the principal name to a fixed buffer. The realm is skipped
+ * if its a default realm.
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to unparse
+ * @param name buffer to write name to
+ * @param len length of buffer
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name_fixed_short (
 	krb5_context /*context*/,
@@ -4256,6 +8848,19 @@ krb5_unparse_name_fixed_short (
 	char */*name*/,
 	size_t /*len*/);
 
+/**
+ * Unparse the Kerberos name into a string
+ *
+ * @param context Kerberos 5 context
+ * @param principal principal to query
+ * @param flags flag to determine the behavior
+ * @param name resulting string, free with krb5_xfree()
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name_flags (
 	krb5_context /*context*/,
@@ -4263,6 +8868,19 @@ krb5_unparse_name_flags (
 	int /*flags*/,
 	char **/*name*/);
 
+/**
+ * Unparse the principal name to a allocated buffer. The realm is
+ * skipped if its a default realm.
+ *
+ * @param context A Kerberos context.
+ * @param principal principal to unparse
+ * @param name returned buffer, free with krb5_xfree()
+ *
+ * @return An krb5 error code, see krb5_get_error_message().
+ *
+ * @ingroup krb5_principal
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_unparse_name_short (
 	krb5_context /*context*/,
@@ -4275,20 +8893,32 @@ krb5_us_timeofday (
 	krb5_timestamp */*sec*/,
 	int32_t */*usec*/);
 
+/**
+ * Log a warning to the log, default stderr, include bthe error from
+ * the last failure and then abort.
+ *
+ * @param context A Kerberos 5 context
+ * @param code error code of the last error
+ * @param fmt message to print
+ * @param ap arguments
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vabort (
 	krb5_context /*context*/,
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((noreturn, format (printf, 3, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 0)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vabortx (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((noreturn, format (printf, 2, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 2, 0)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verify_ap_req (
@@ -4329,6 +8959,20 @@ krb5_verify_checksum (
 	size_t /*len*/,
 	Checksum */*cksum*/);
 
+/**
+ * Verify a Kerberos message checksum.
+ *
+ * @param context Kerberos context
+ * @param crypto Kerberos crypto context
+ * @param usage Key usage for this buffer
+ * @param data array of buffers to process
+ * @param num_data length of array
+ * @param type return checksum type if not NULL
+ *
+ * @return Return an error code or 0.
+ * @ingroup krb5_crypto
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verify_checksum_iov (
 	krb5_context /*context*/,
@@ -4416,6 +9060,19 @@ krb5_verify_user_opt (
 	const char */*password*/,
 	krb5_verify_opt */*opt*/);
 
+/**
+ * Log a warning to the log, default stderr, include bthe error from
+ * the last failure and then exit.
+ *
+ * @param context A Kerberos 5 context
+ * @param eval the exit code to exit with
+ * @param code error code of the last error
+ * @param fmt message to print
+ * @param ap arguments
+ *
+ * @ingroup krb5_error
+ */
+
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verr (
 	krb5_context /*context*/,
@@ -4423,7 +9080,18 @@ krb5_verr (
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((noreturn, format (printf, 4, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 4, 0)));
+
+/**
+ * Log a warning to the log, default stderr, and then exit.
+ *
+ * @param context A Kerberos 5 context
+ * @param eval the exit code to exit with
+ * @param fmt message to print
+ * @param ap arguments
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_verrx (
@@ -4431,7 +9099,7 @@ krb5_verrx (
 	int /*eval*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((noreturn, format (printf, 3, 0)));
+     __attribute__ ((__noreturn__, __format__ (__printf__, 3, 0)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vlog (
@@ -4440,7 +9108,7 @@ krb5_vlog (
 	int /*level*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__((format (printf, 4, 0)));
+     __attribute__ ((__format__ (__printf__, 4, 0)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vlog_msg (
@@ -4450,7 +9118,20 @@ krb5_vlog_msg (
 	int /*level*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__((format (printf, 5, 0)));
+     __attribute__ ((__format__ (__printf__, 5, 0)));
+
+/**
+ * Prepend the contexts's full error string for a specific error code.
+ *
+ * The if context is NULL, no error string is stored.
+ *
+ * @param context Kerberos 5 context
+ * @param ret The error code
+ * @param fmt Error string for the error code
+ * @param args printf(3) style parameters.
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_vprepend_error_message (
@@ -4458,7 +9139,20 @@ krb5_vprepend_error_message (
 	krb5_error_code /*ret*/,
 	const char */*fmt*/,
 	va_list /*args*/)
-     __attribute__ ((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
+
+/**
+ * Set the context full error string for a specific error code.
+ *
+ * The if context is NULL, no error string is stored.
+ *
+ * @param context Kerberos 5 context
+ * @param ret The error code
+ * @param fmt Error string for the error code
+ * @param args printf(3) style parameters.
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 krb5_vset_error_message (
@@ -4466,14 +9160,41 @@ krb5_vset_error_message (
 	krb5_error_code /*ret*/,
 	const char */*fmt*/,
 	va_list /*args*/)
-     __attribute__ ((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
+
+/**
+ * Set the error message returned by krb5_get_error_string(),
+ * deprecated, use krb5_set_error_message().
+ *
+ * Deprecated: use krb5_vset_error_message()
+ *
+ * @param context Kerberos context
+ * @param fmt error message to free
+ * @param args variable argument list vector
+ *
+ * @return Return an error code or 0.
+ *
+ * @ingroup krb5_deprecated
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vset_error_string (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	va_list /*args*/)
-     __attribute__ ((format (printf, 2, 0))) KRB5_DEPRECATED_FUNCTION("Use X instead");
+     __attribute__ ((__format__ (__printf__, 2, 0))) KRB5_DEPRECATED_FUNCTION("Use X instead");
+
+/**
+ * Log a warning to the log, default stderr, include the error from
+ * the last failure.
+ *
+ * @param context A Kerberos 5 context.
+ * @param code error code of the last error
+ * @param fmt message to print
+ * @param ap arguments
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vwarn (
@@ -4481,14 +9202,35 @@ krb5_vwarn (
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
+
+/**
+ * Log a warning to the log, default stderr.
+ *
+ * @param context A Kerberos 5 context.
+ * @param fmt message to print
+ * @param ap arguments
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_vwarnx (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	va_list /*ap*/)
-     __attribute__ ((format (printf, 2, 0)));
+     __attribute__ ((__format__ (__printf__, 2, 0)));
+
+/**
+ * Log a warning to the log, default stderr, include the error from
+ * the last failure.
+ *
+ * @param context A Kerberos 5 context.
+ * @param code error code of the last error
+ * @param fmt message to print
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_warn (
@@ -4496,14 +9238,23 @@ krb5_warn (
 	krb5_error_code /*code*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
+
+/**
+ * Log a warning to the log, default stderr.
+ *
+ * @param context A Kerberos 5 context.
+ * @param fmt message to print
+ *
+ * @ingroup krb5_error
+ */
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_warnx (
 	krb5_context /*context*/,
 	const char */*fmt*/,
 	...)
-     __attribute__ ((format (printf, 2, 3)));
+     __attribute__ ((__format__ (__printf__, 2, 3)));
 
 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 krb5_write_message (
@@ -4534,4 +9285,5 @@ krb5_xfree (void */*ptr*/);
 
 #undef KRB5_DEPRECATED_FUNCTION
 
+#endif /* DOXY */
 #endif /* __krb5_protos_h__ */
diff --git a/crypto/external/bsd/heimdal/include/krb5-types.h b/crypto/external/bsd/heimdal/include/krb5-types.h
index 6384bd5e5..ac3a4c54e 100644
--- a/crypto/external/bsd/heimdal/include/krb5-types.h
+++ b/crypto/external/bsd/heimdal/include/krb5-types.h
@@ -1,6 +1,3 @@
-/* krb5-types.h -- this file was generated for x86_64-unknown-netbsd6.99.40 by
-                   $Id: krb5-types.h,v 1.6 2014/04/24 13:50:53 pettai Exp $ */
-
 #ifndef __krb5_types_h__
 #define __krb5_types_h__
 
@@ -15,34 +12,56 @@ typedef ssize_t krb5_ssize_t;
 
 typedef int krb5_socket_t;
 
+#if !defined(__has_extension)
+#define __has_extension(x) 0
+#endif
+
+#ifndef KRB5TYPES_REQUIRE_GNUC
+#define KRB5TYPES_REQUIRE_GNUC(m,n,p) \
+    (((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + __GNUC_PATCHLEVEL__) >= \
+     (((m) * 10000) + ((n) * 100) + (p)))
+#endif
+
 #ifndef HEIMDAL_DEPRECATED
-#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))
-#define HEIMDAL_DEPRECATED __attribute__((deprecated))
+#if __has_extension(deprecated) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
+#define HEIMDAL_DEPRECATED __attribute__ ((__deprecated__))
 #elif defined(_MSC_VER) && (_MSC_VER>1200)
 #define HEIMDAL_DEPRECATED __declspec(deprecated)
 #else
 #define HEIMDAL_DEPRECATED
 #endif
 #endif
+
 #ifndef HEIMDAL_PRINTF_ATTRIBUTE
-#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))
-#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__((format x))
+#if __has_extension(format) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
+#define HEIMDAL_PRINTF_ATTRIBUTE(x) __attribute__ ((__format__ x))
 #else
 #define HEIMDAL_PRINTF_ATTRIBUTE(x)
 #endif
 #endif
+
 #ifndef HEIMDAL_NORETURN_ATTRIBUTE
-#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))
-#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__((noreturn))
+#if __has_extension(noreturn) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
+#define HEIMDAL_NORETURN_ATTRIBUTE __attribute__ ((__noreturn__))
 #else
 #define HEIMDAL_NORETURN_ATTRIBUTE
 #endif
 #endif
+
 #ifndef HEIMDAL_UNUSED_ATTRIBUTE
-#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))
-#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__((unused))
+#if __has_extension(unused) || KRB5TYPES_REQUIRE_GNUC(3,1,0)
+#define HEIMDAL_UNUSED_ATTRIBUTE __attribute__ ((__unused__))
 #else
 #define HEIMDAL_UNUSED_ATTRIBUTE
 #endif
 #endif
+
+#ifndef HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+#if __has_extension(warn_unused_result) || KRB5TYPES_REQUIRE_GNUC(3,3,0)
+#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE __attribute__ ((__warn_unused_result__))
+#else
+#define HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE
+#endif
+#endif
+
 #endif /* __krb5_types_h__ */
diff --git a/crypto/external/bsd/heimdal/include/ntlm-private.h b/crypto/external/bsd/heimdal/include/ntlm-private.h
index 0c62b3533..b78f0b87b 100644
--- a/crypto/external/bsd/heimdal/include/ntlm-private.h
+++ b/crypto/external/bsd/heimdal/include/ntlm-private.h
@@ -11,7 +11,7 @@ OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_accept_sec_context (
 	OM_uint32 * /*minor_status*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_cred_id_t /*acceptor_cred_handle*/,
+	gss_const_cred_id_t /*acceptor_cred_handle*/,
 	const gss_buffer_t /*input_token_buffer*/,
 	const gss_channel_bindings_t /*input_chan_bindings*/,
 	gss_name_t * /*src_name*/,
@@ -23,20 +23,20 @@ _gss_ntlm_accept_sec_context (
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_acquire_cred (
-	OM_uint32 * /*min_stat*/,
-	const gss_name_t /*desired_name*/,
+	OM_uint32 */*min_stat*/,
+	gss_const_name_t /*desired_name*/,
 	OM_uint32 /*time_req*/,
 	const gss_OID_set /*desired_mechs*/,
 	gss_cred_usage_t /*cred_usage*/,
-	gss_cred_id_t * /*output_cred_handle*/,
-	gss_OID_set * /*actual_mechs*/,
-	OM_uint32 * time_rec );
+	gss_cred_id_t */*output_cred_handle*/,
+	gss_OID_set */*actual_mechs*/,
+	OM_uint32 */*time_rec*/);
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_add_cred (
 	 OM_uint32 */*minor_status*/,
-	const gss_cred_id_t /*input_cred_handle*/,
-	const gss_name_t /*desired_name*/,
+	gss_const_cred_id_t /*input_cred_handle*/,
+	gss_const_name_t /*desired_name*/,
 	const gss_OID /*desired_mech*/,
 	gss_cred_usage_t /*cred_usage*/,
 	OM_uint32 /*initiator_time_req*/,
@@ -54,21 +54,21 @@ _gss_ntlm_allocate_ctx (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_canonicalize_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * output_name );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_compare_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*name1*/,
-	const gss_name_t /*name2*/,
+	gss_const_name_t /*name1*/,
+	gss_const_name_t /*name2*/,
 	int * name_equal );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_context_time (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	OM_uint32 * time_rec );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -85,7 +85,7 @@ _gss_ntlm_destroy_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_display_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t /*output_name_buffer*/,
 	gss_OID * output_name_type );
 
@@ -101,13 +101,13 @@ _gss_ntlm_display_status (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_duplicate_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*src_name*/,
+	gss_const_name_t /*src_name*/,
 	gss_name_t * dest_name );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_export_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t exported_name );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -119,7 +119,7 @@ _gss_ntlm_export_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_get_mic (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*message_buffer*/,
 	gss_buffer_t message_token );
@@ -150,9 +150,9 @@ _gss_ntlm_indicate_mechs (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_init_sec_context (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*initiator_cred_handle*/,
+	gss_const_cred_id_t /*initiator_cred_handle*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_name_t /*target_name*/,
+	gss_const_name_t /*target_name*/,
 	const gss_OID /*mech_type*/,
 	OM_uint32 /*req_flags*/,
 	OM_uint32 /*time_req*/,
@@ -166,7 +166,7 @@ _gss_ntlm_init_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_context (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_name_t * /*src_name*/,
 	gss_name_t * /*targ_name*/,
 	OM_uint32 * /*lifetime_rec*/,
@@ -178,7 +178,7 @@ _gss_ntlm_inquire_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_cred (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	gss_name_t * /*name*/,
 	OM_uint32 * /*lifetime*/,
 	gss_cred_usage_t * /*cred_usage*/,
@@ -187,7 +187,7 @@ _gss_ntlm_inquire_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_cred_by_mech (
 	 OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * /*name*/,
 	OM_uint32 * /*initiator_lifetime*/,
@@ -197,7 +197,7 @@ _gss_ntlm_inquire_cred_by_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_mechs_for_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_OID_set * mech_types );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -209,7 +209,7 @@ _gss_ntlm_inquire_names_for_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_inquire_sec_context_by_oid (
 	OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_OID /*desired_object*/,
 	gss_buffer_set_t */*data_set*/);
 
@@ -222,7 +222,7 @@ _gss_ntlm_iter_creds_f (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_process_context_token (
 	 OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t token_buffer );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -246,7 +246,7 @@ _gss_ntlm_set_key (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_unwrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*input_message_buffer*/,
 	gss_buffer_t /*output_message_buffer*/,
 	int * /*conf_state*/,
@@ -255,7 +255,7 @@ _gss_ntlm_unwrap (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_verify_mic (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*message_buffer*/,
 	const gss_buffer_t /*token_buffer*/,
 	gss_qop_t * qop_state );
@@ -263,7 +263,7 @@ _gss_ntlm_verify_mic (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_wrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*input_message_buffer*/,
@@ -273,7 +273,7 @@ _gss_ntlm_wrap (
 OM_uint32 GSSAPI_CALLCONV
 _gss_ntlm_wrap_size_limit (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	OM_uint32 /*req_output_size*/,
diff --git a/crypto/external/bsd/heimdal/include/roken.h b/crypto/external/bsd/heimdal/include/roken.h
index dd2d3a277..fcf9fd7a6 100644
--- a/crypto/external/bsd/heimdal/include/roken.h
+++ b/crypto/external/bsd/heimdal/include/roken.h
@@ -9,22 +9,22 @@
  * Copyright (c) 1995-2005 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
- * 
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 
+ *
  * 3. Neither the name of the Institute nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -38,11 +38,13 @@
  * SUCH DAMAGE.
  */
 
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
 #include <stdint.h>
 #include <string.h>
+#include <limits.h>
 #include <signal.h>
 
 
@@ -70,6 +72,7 @@ typedef int rk_socket_t;
 #include <sys/param.h>
 #include <inttypes.h>
 #include <sys/types.h>
+#include <sys/errno.h>
 #include <unistd.h>
 #include <sys/socket.h>
 #include <sys/uio.h>
@@ -95,6 +98,7 @@ typedef int rk_socket_t;
 
 
 
+
 #include <krb5/roken-common.h>
 
 ROKEN_CPP_START
@@ -115,12 +119,12 @@ ROKEN_CPP_START
 #define asnprintf rk_asnprintf
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
     rk_asnprintf (char **, size_t, const char *, ...)
-     __attribute__ ((format (printf, 3, 4)));
+     __attribute__ ((__format__ (__printf__, 3, 4)));
 
 #define vasnprintf rk_vasnprintf
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
     vasnprintf (char **, size_t, const char *, va_list)
-     __attribute__((format (printf, 3, 0)));
+     __attribute__ ((__format__ (__printf__, 3, 0)));
 
 
 
@@ -154,6 +158,9 @@ ROKEN_LIB_FUNCTION char * ROKEN_LIB_CALL strupr(char *);
 ROKEN_LIB_FUNCTION struct passwd * ROKEN_LIB_CALL k_getpwnam (const char *);
 ROKEN_LIB_FUNCTION struct passwd * ROKEN_LIB_CALL k_getpwuid (uid_t);
 
+#define rk_getpwnam_r(_n, _pw, _b, _sz, _pwd) getpwnam_r(_n, _pw, _b, _sz, _pwd)
+#define rk_getpwuid_r(_u, _pw, _b, _sz, _pwd) getpwuid_r(_u, _pw, _b, _sz, _pwd)
+
 ROKEN_LIB_FUNCTION const char * ROKEN_LIB_CALL get_default_username (void);
 
 
@@ -166,6 +173,9 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL mkstemp(char *);
 
 #define rk_rename(__rk_rn_from,__rk_rn_to) rename(__rk_rn_from,__rk_rn_to)
 
+#define rk_mkdir(__rk_rn_name, __rk_rn_mode) mkdir(__rk_rn_name,__rk_rn_mode)
+
+
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL daemon(int, int);
 
 
@@ -175,6 +185,8 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL daemon(int, int);
 
 
 
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL rk_pidfile (const char*);
+
 
 
 
@@ -193,6 +205,9 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL roken_vconcat (char *, size_t, va_list);
 ROKEN_LIB_FUNCTION size_t ROKEN_LIB_CALL
     roken_vmconcat (char **, size_t, va_list);
 
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL roken_detach_prep(int, char **, char *);
+ROKEN_LIB_FUNCTION void ROKEN_LIB_CALL roken_detach_finish(const char *, int);
+
 ROKEN_LIB_FUNCTION ssize_t ROKEN_LIB_CALL
     net_write (rk_socket_t, const void *, size_t);
 
@@ -239,7 +254,7 @@ getnameinfo_verified(const struct sockaddr *, socklen_t,
 		     int);
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-roken_getaddrinfo_hostspec(const char *, int, struct addrinfo **); 
+roken_getaddrinfo_hostspec(const char *, int, struct addrinfo **);
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 roken_getaddrinfo_hostspec2(const char *, int, int, struct addrinfo **);
 
@@ -263,7 +278,7 @@ ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
 roken_gethostby_setup(const char*, const char*);
 ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL
 roken_gethostbyname(const char*);
-ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL 
+ROKEN_LIB_FUNCTION struct hostent* ROKEN_LIB_CALL
 roken_gethostbyaddr(const void*, size_t, int);
 
 #define roken_getservbyname(x,y) getservbyname(x,y)
@@ -293,13 +308,18 @@ mini_inetd (int, rk_socket_t *);
 
 
 
-#ifdef HAVE_NBTOOL_CONFIG_H
-#define rk_random() 0
-#else
-#define rk_random() arc4random()
-#endif
 
 
+#define memset_s rk_memset_s
+ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL memset_s(void *s, size_t smax,
+					int c, size_t n);
+
+# define rk_random() arc4random()
+
+
+
+/* Microsoft VC 2010 POSIX definitions */
+
 
 
 ROKEN_CPP_END
diff --git a/crypto/external/bsd/heimdal/include/spnego-private.h b/crypto/external/bsd/heimdal/include/spnego-private.h
index f50574d7e..7486b68fc 100644
--- a/crypto/external/bsd/heimdal/include/spnego-private.h
+++ b/crypto/external/bsd/heimdal/include/spnego-private.h
@@ -11,7 +11,7 @@ OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_accept_sec_context (
 	OM_uint32 * /*minor_status*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_cred_id_t /*acceptor_cred_handle*/,
+	gss_const_cred_id_t /*acceptor_cred_handle*/,
 	const gss_buffer_t /*input_token_buffer*/,
 	const gss_channel_bindings_t /*input_chan_bindings*/,
 	gss_name_t * /*src_name*/,
@@ -24,7 +24,7 @@ _gss_spnego_accept_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_acquire_cred (
 	OM_uint32 */*minor_status*/,
-	const gss_name_t /*desired_name*/,
+	gss_const_name_t /*desired_name*/,
 	OM_uint32 /*time_req*/,
 	const gss_OID_set /*desired_mechs*/,
 	gss_cred_usage_t /*cred_usage*/,
@@ -40,21 +40,21 @@ _gss_spnego_alloc_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_canonicalize_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * output_name );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_compare_name (
 	OM_uint32 */*minor_status*/,
-	const gss_name_t /*name1*/,
-	const gss_name_t /*name2*/,
+	gss_const_name_t /*name1*/,
+	gss_const_name_t /*name2*/,
 	int * name_equal );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_context_time (
 	OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	OM_uint32 *time_rec );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -66,14 +66,14 @@ _gss_spnego_delete_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_display_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t /*output_name_buffer*/,
 	gss_OID * output_name_type );
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_duplicate_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*src_name*/,
+	gss_const_name_t /*src_name*/,
 	gss_name_t * dest_name );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -85,7 +85,7 @@ _gss_spnego_export_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_export_name (
 	OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_buffer_t exported_name );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -97,7 +97,7 @@ _gss_spnego_export_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_get_mic (
 	OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*message_buffer*/,
 	gss_buffer_t message_token );
@@ -127,16 +127,16 @@ _gss_spnego_indicate_mechtypelist (
 	gss_name_t /*target_name*/,
 	OM_uint32 (*/*func*/)(gss_name_t, gss_OID),
 	int /*includeMSCompatOID*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	MechTypeList */*mechtypelist*/,
 	gss_OID */*preferred_mech*/);
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_init_sec_context (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*initiator_cred_handle*/,
+	gss_const_cred_id_t /*initiator_cred_handle*/,
 	gss_ctx_id_t * /*context_handle*/,
-	const gss_name_t /*target_name*/,
+	gss_const_name_t /*target_name*/,
 	const gss_OID /*mech_type*/,
 	OM_uint32 /*req_flags*/,
 	OM_uint32 /*time_req*/,
@@ -150,7 +150,7 @@ _gss_spnego_init_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_context (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	gss_name_t * /*src_name*/,
 	gss_name_t * /*targ_name*/,
 	OM_uint32 * /*lifetime_rec*/,
@@ -162,7 +162,7 @@ _gss_spnego_inquire_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_cred (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	gss_name_t * /*name*/,
 	OM_uint32 * /*lifetime*/,
 	gss_cred_usage_t * /*cred_usage*/,
@@ -171,7 +171,7 @@ _gss_spnego_inquire_cred (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_cred_by_mech (
 	 OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	const gss_OID /*mech_type*/,
 	gss_name_t * /*name*/,
 	OM_uint32 * /*initiator_lifetime*/,
@@ -181,14 +181,14 @@ _gss_spnego_inquire_cred_by_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_cred_by_oid (
 	OM_uint32 * /*minor_status*/,
-	const gss_cred_id_t /*cred_handle*/,
+	gss_const_cred_id_t /*cred_handle*/,
 	const gss_OID /*desired_object*/,
 	gss_buffer_set_t */*data_set*/);
 
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_mechs_for_name (
 	 OM_uint32 * /*minor_status*/,
-	const gss_name_t /*input_name*/,
+	gss_const_name_t /*input_name*/,
 	gss_OID_set * mech_types );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -200,7 +200,7 @@ _gss_spnego_inquire_names_for_mech (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_inquire_sec_context_by_oid (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_OID /*desired_object*/,
 	gss_buffer_set_t */*data_set*/);
 
@@ -213,7 +213,7 @@ _gss_spnego_internal_delete_sec_context (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_process_context_token (
 	OM_uint32 */*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t token_buffer );
 
 OM_uint32 GSSAPI_CALLCONV
@@ -258,7 +258,7 @@ _gss_spnego_set_sec_context_option (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_unwrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*input_message_buffer*/,
 	gss_buffer_t /*output_message_buffer*/,
 	int * /*conf_state*/,
@@ -276,7 +276,7 @@ _gss_spnego_unwrap_iov (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_verify_mic (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	const gss_buffer_t /*message_buffer*/,
 	const gss_buffer_t /*token_buffer*/,
 	gss_qop_t * qop_state );
@@ -284,7 +284,7 @@ _gss_spnego_verify_mic (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_wrap (
 	OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	const gss_buffer_t /*input_message_buffer*/,
@@ -314,7 +314,7 @@ _gss_spnego_wrap_iov_length (
 OM_uint32 GSSAPI_CALLCONV
 _gss_spnego_wrap_size_limit (
 	 OM_uint32 * /*minor_status*/,
-	const gss_ctx_id_t /*context_handle*/,
+	gss_const_ctx_id_t /*context_handle*/,
 	int /*conf_req_flag*/,
 	gss_qop_t /*qop_req*/,
 	OM_uint32 /*req_output_size*/,
diff --git a/crypto/external/bsd/heimdal/include/version.h b/crypto/external/bsd/heimdal/include/version.h
index 799363f83..74fc27753 100644
--- a/crypto/external/bsd/heimdal/include/version.h
+++ b/crypto/external/bsd/heimdal/include/version.h
@@ -1,5 +1,5 @@
 #ifndef VERSION_HIDDEN
 #define VERSION_HIDDEN
 #endif
-VERSION_HIDDEN const char *heimdal_long_version = "@(#)$Version: Heimdal 1.5.3 by pettai on stinky (x86_64-unknown-netbsd6.99.40) Tue Apr 22 09:10:01 UTC 2014 $";
-VERSION_HIDDEN const char *heimdal_version = "Heimdal 1.5.3";
+VERSION_HIDDEN const char *heimdal_long_version = "@(#)$Version: Heimdal 7.1.0 by christos on broadway.astron.com (x86_64-unknown-netbsd7.99) Fri Jan 27 14:36:06 EST 2017 $";
+VERSION_HIDDEN const char *heimdal_version = "Heimdal 7.1.0";
diff --git a/crypto/external/bsd/heimdal/lib/libasn1/Makefile b/crypto/external/bsd/heimdal/lib/libasn1/Makefile
index b273a3762..c58c2292b 100644
--- a/crypto/external/bsd/heimdal/lib/libasn1/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libasn1/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2013/09/11 23:04:09 joerg Exp $
+# $NetBSD: Makefile,v 1.5 2017/02/21 16:07:17 christos Exp $
 
 USE_FORT?= yes	# network protocol library
 
@@ -51,7 +51,9 @@ SRCS=			\
 	der_copy.c	\
 	der_cmp.c	\
 	der_format.c	\
+	fuzzer.c	\
 	extra.c		\
+	template.c	\
 	timegm.c
 
 .if ${USETOOLS} != "yes"
@@ -66,8 +68,18 @@ ${ASN1COMPILEOBJ}/asn1_compile: try_to_build_asn1_compile
 SUBDIR=	asn1_compile
 .endif
 
+
 .include <${HEIMBASE}/Makefile.rules.inc>
 .include <bsd.lib.mk>
 .if ${USETOOLS} != "yes"
 .include <bsd.subdir.mk>
 .endif
+
+.if ${MACHINE_ARCH} == "sparc64"
+# Or anything else that uses PROFILE_HOOK with gcc.
+# What happens is that we end up generating one of two different
+# function orders and since the profile code uses the function
+# number for label generation, we end up with one of two different
+# label orders. Disabling ASLR or optimization fixes it.
+COPTS.asn1_krb5_asn1.c+=-O0
+.endif
diff --git a/crypto/external/bsd/heimdal/lib/libasn1/shlib_version b/crypto/external/bsd/heimdal/lib/libasn1/shlib_version
index 2bfff6473..780b5c163 100644
--- a/crypto/external/bsd/heimdal/lib/libasn1/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libasn1/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:48 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:51 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=9
+major=10
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libcom_err/compile_et/Makefile b/crypto/external/bsd/heimdal/lib/libcom_err/compile_et/Makefile
index b077a089a..bf1e029b8 100644
--- a/crypto/external/bsd/heimdal/lib/libcom_err/compile_et/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libcom_err/compile_et/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2011/08/28 10:28:35 elric Exp $
+# $NetBSD: Makefile,v 1.4 2017/01/30 02:38:50 jakllsch Exp $
 
 NOMAN=		# defined
 
@@ -50,10 +50,11 @@ CLEANFILES+=	print_version.h make-print-version make-print-version.lo
 beforedepend:
 	[ -h krb5 ] || ln -sf . krb5
 	ln -sf ${HEIMBASE}/include/roken.h
+	ln -sf ${HEIMBASE}/include/krb5-types.h
 	ln -sf ${HEIMBASE}/dist/lib/roken/roken-common.h
 	ln -sf ${HEIMBASE}/dist/lib/roken/getarg.h
 
-CLEANFILES+=	krb5 roken.h roken-common.h getarg.h
+CLEANFILES+=	krb5 roken.h krb5-types.h roken-common.h getarg.h
 
 .ifndef HOSTPROG
 HOSTPROG=	${PROG}
diff --git a/crypto/external/bsd/heimdal/lib/libcom_err/shlib_version b/crypto/external/bsd/heimdal/lib/libcom_err/shlib_version
index 38d72eb4a..06f7ea6df 100644
--- a/crypto/external/bsd/heimdal/lib/libcom_err/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libcom_err/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:49 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:51 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=7
+major=8
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libgssapi/Makefile b/crypto/external/bsd/heimdal/lib/libgssapi/Makefile
index d303133c3..cc07839a6 100644
--- a/crypto/external/bsd/heimdal/lib/libgssapi/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libgssapi/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.4 2014/04/24 13:50:53 pettai Exp $
+# $NetBSD: Makefile,v 1.4.16.1 2018/07/16 13:32:27 sborrill Exp $
 
 USE_FORT?= yes        # network protocol library
 
@@ -17,6 +17,7 @@ LIBDPLIBS+=	krb5		${HEIMBASE}/lib/libkrb5		\
 		asn1		${HEIMBASE}/lib/libasn1		\
 		com_err		${HEIMBASE}/lib/libcom_err	\
 		roken		${HEIMBASE}/lib/libroken	\
+		heimbase	${HEIMBASE}/lib/libheimbase	\
 		heimntlm	${HEIMBASE}/lib/libheimntlm	\
 		crypto		${SSLBASE}/lib/libcrypto
 
diff --git a/crypto/external/bsd/heimdal/lib/libgssapi/shlib_version b/crypto/external/bsd/heimdal/lib/libgssapi/shlib_version
index f5b40f872..a44d83dca 100644
--- a/crypto/external/bsd/heimdal/lib/libgssapi/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libgssapi/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:50 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:51 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=10
+major=11
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libhdb/Makefile b/crypto/external/bsd/heimdal/lib/libhdb/Makefile
index 90b7f701d..655aa5187 100644
--- a/crypto/external/bsd/heimdal/lib/libhdb/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libhdb/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2013/09/11 23:04:09 joerg Exp $
+# $NetBSD: Makefile,v 1.4 2017/01/28 21:31:52 christos Exp $
 
 USE_FORT?= yes	# network protocol library
 
@@ -21,19 +21,22 @@ LIBDPLIBS+=	hx509		${HEIMBASE}/lib/libhx509	\
 		heimbase	${HEIMBASE}/lib/libheimbase
 
 HEIMSRCS= hdb_err.et hdb.asn1
+ASN1_OPTS.hdb.asn1+= --one-code-file --sequence=HDB-Ext-KeySet --sequence=Keys
 
 SRCS=			\
 	common.c	\
 	db.c		\
 	db3.c		\
+	dbinfo.c	\
 	ext.c		\
-	hdb-ldap.c	\
-	hdb.c		\
 	hdb-keytab.c	\
+	hdb-ldap.c	\
 	hdb-mitdb.c	\
+	hdb-sqlite.c	\
+	hdb.c		\
+	hdb_err.c	\
 	keys.c		\
 	keytab.c	\
-	dbinfo.c	\
 	mkey.c		\
 	ndbm.c		\
 	print.c
diff --git a/crypto/external/bsd/heimdal/lib/libhdb/shlib_version b/crypto/external/bsd/heimdal/lib/libhdb/shlib_version
index 8a41fb1b8..840c602d8 100644
--- a/crypto/external/bsd/heimdal/lib/libhdb/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libhdb/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:50 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=14
+major=15
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libheimbase/Makefile b/crypto/external/bsd/heimdal/lib/libheimbase/Makefile
index ae9c9b82f..3eb211717 100644
--- a/crypto/external/bsd/heimdal/lib/libheimbase/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libheimbase/Makefile
@@ -1,17 +1,22 @@
-# $NetBSD: Makefile,v 1.1 2011/04/13 19:16:51 elric Exp $
+# $NetBSD: Makefile,v 1.2 2017/01/28 21:31:52 christos Exp $
 
 USE_FORT?= yes	# network protocol library
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
 
-.PATH:		${HEIMDIST}/base
+.PATH:		${HEIMDIST}/lib/base
 
 LIB=		heimbase
 
 SRCS=			\
 	array.c		\
+	bsearch.c	\
+	db.c		\
+	data.c		\
 	dict.c		\
+	error.c		\
+	json.c		\
 	number.c	\
 	bool.c		\
 	heimbase.c	\
diff --git a/crypto/external/bsd/heimdal/lib/libheimbase/shlib_version b/crypto/external/bsd/heimdal/lib/libheimbase/shlib_version
index d064220c0..ab9d98e97 100644
--- a/crypto/external/bsd/heimdal/lib/libheimbase/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libheimbase/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:51 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=1
+major=2
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libheimntlm/Makefile b/crypto/external/bsd/heimdal/lib/libheimntlm/Makefile
index 2ac94848f..1727e7b47 100644
--- a/crypto/external/bsd/heimdal/lib/libheimntlm/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libheimntlm/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2013/09/11 23:04:09 joerg Exp $
+# $NetBSD: Makefile,v 1.2.18.1 2018/07/16 13:32:27 sborrill Exp $
 
 USE_FORT?= yes	# cryptographic software
 
@@ -15,7 +15,8 @@ LIBDPLIBS+=	asn1	${.CURDIR}/../libasn1 \
 		com_err	${.CURDIR}/../libcom_err \
 		crypto	${SSLBASE}/lib/libcrypto \
 		krb5	${.CURDIR}/../libkrb5 \
-		roken	${.CURDIR}/../libroken
+		roken	${.CURDIR}/../libroken \
+		wind	${.CURDIR}/../libwind
 
 HEIMSRCS= ntlm_err.et ntlm.c
 
diff --git a/crypto/external/bsd/heimdal/lib/libheimntlm/shlib_version b/crypto/external/bsd/heimdal/lib/libheimntlm/shlib_version
index 7b7fe48de..62ac42392 100644
--- a/crypto/external/bsd/heimdal/lib/libheimntlm/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libheimntlm/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:51 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=4
+major=5
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libhx509/Makefile b/crypto/external/bsd/heimdal/lib/libhx509/Makefile
index e9fd5e604..91ced8875 100644
--- a/crypto/external/bsd/heimdal/lib/libhx509/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libhx509/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.4 2011/07/31 09:58:19 plunky Exp $
+# $NetBSD: Makefile,v 1.5 2017/01/28 21:31:52 christos Exp $
 
 NOLINT=		# defined
 
@@ -31,6 +31,7 @@ SRCS=				\
 	cms.c			\
 	collector.c		\
 	crypto.c		\
+	crypto-ec.c		\
 	doxygen.c		\
 	env.c			\
 	error.c			\
diff --git a/crypto/external/bsd/heimdal/lib/libhx509/shlib_version b/crypto/external/bsd/heimdal/lib/libhx509/shlib_version
index f5b0e1e84..bde717412 100644
--- a/crypto/external/bsd/heimdal/lib/libhx509/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libhx509/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:52 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=5
+major=6
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libkadm5clnt/shlib_version b/crypto/external/bsd/heimdal/lib/libkadm5clnt/shlib_version
index eb6c4890d..3ee0b4372 100644
--- a/crypto/external/bsd/heimdal/lib/libkadm5clnt/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libkadm5clnt/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:52 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=13
+major=14
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libkadm5srv/Makefile b/crypto/external/bsd/heimdal/lib/libkadm5srv/Makefile
index fd7f960f2..96bc1898e 100644
--- a/crypto/external/bsd/heimdal/lib/libkadm5srv/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libkadm5srv/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2014/11/24 10:49:27 pettai Exp $
+# $NetBSD: Makefile,v 1.4.4.1 2018/07/16 13:32:27 sborrill Exp $
 
 USE_FORT?= yes	# network protocol library
 
@@ -10,11 +10,13 @@ NOLINT=		# defined
 .PATH:		${HEIMDIST}/lib/kadm5
 
 LIB=		kadm5srv
+CPPFLAGS+=	-I${HEIMDIST}/lib/krb5
 
 LIBDPLIBS+=	krb5	${.CURDIR}/../libkrb5 \
 		com_err	${.CURDIR}/../libcom_err \
 		hdb	${.CURDIR}/../libhdb \
-		roken	${.CURDIR}/../libroken
+		roken	${.CURDIR}/../libroken	\
+		heimbase	${.CURDIR}/../libheimbase
 
 HEIMSRCS= kadm5_err.et
 
@@ -43,6 +45,7 @@ SRCS =				\
 	randkey_s.c		\
 	rename_s.c		\
 	server_glue.c		\
+	setkey3_s.c		\
 	set_keys.c		\
 	set_modifier.c
 
diff --git a/crypto/external/bsd/heimdal/lib/libkadm5srv/shlib_version b/crypto/external/bsd/heimdal/lib/libkadm5srv/shlib_version
index 2e5417287..840c602d8 100644
--- a/crypto/external/bsd/heimdal/lib/libkadm5srv/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libkadm5srv/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:53 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=14
+major=15
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libkafs/Makefile b/crypto/external/bsd/heimdal/lib/libkafs/Makefile
index c27a783e0..9abaa9eb7 100644
--- a/crypto/external/bsd/heimdal/lib/libkafs/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libkafs/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2013/09/11 23:04:09 joerg Exp $
+# $NetBSD: Makefile,v 1.3 2017/01/28 21:31:52 christos Exp $
 
 USE_FORT?= yes	# network protocol library
 
@@ -15,7 +15,7 @@ LIBDPLIBS+=	krb5	${.CURDIR}/../libkrb5 \
 		asn1	${.CURDIR}/../libasn1 \
 		roken	${.CURDIR}/../libroken
 
-SRCS=		afssys.c afskrb5.c common.c
+SRCS=		afssys.c afskrb5.c common.c rxkad_kdf.c
 
 INCS=		kafs.h
 INCSDIR=	/usr/include/krb5
diff --git a/crypto/external/bsd/heimdal/lib/libkafs/shlib_version b/crypto/external/bsd/heimdal/lib/libkafs/shlib_version
index fde762904..e790f9d94 100644
--- a/crypto/external/bsd/heimdal/lib/libkafs/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libkafs/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:53 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=12
+major=13
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libkdc/Makefile b/crypto/external/bsd/heimdal/lib/libkdc/Makefile
index 3e255934d..9882c4421 100644
--- a/crypto/external/bsd/heimdal/lib/libkdc/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libkdc/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2013/09/11 23:04:09 joerg Exp $
+# $NetBSD: Makefile,v 1.3.4.1 2018/07/16 13:32:27 sborrill Exp $
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
@@ -15,15 +15,18 @@ LIBDPLIBS+=	krb5		${.CURDIR}/../libkrb5		\
 		hdb		${.CURDIR}/../libhdb		\
 		hx509		${.CURDIR}/../libhx509		\
 		asn1		${.CURDIR}/../libasn1		\
+		heimbase	${.CURDIR}/../libheimbase	\
 		heimntlm	${.CURDIR}/../libheimntlm	\
 		roken		${.CURDIR}/../libroken
 
 SRCS =	default_config.c	\
         set_dbinfo.c		\
         digest.c		\
+        fast.c			\
         kerberos5.c		\
         krb5tgs.c		\
         pkinit.c		\
+        pkinit-ec.c		\
         log.c			\
         misc.c			\
         kx509.c			\
diff --git a/crypto/external/bsd/heimdal/lib/libkdc/shlib_version b/crypto/external/bsd/heimdal/lib/libkdc/shlib_version
index e869d7196..14fa50834 100644
--- a/crypto/external/bsd/heimdal/lib/libkdc/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libkdc/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:53 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=2
+major=3
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libkrb5/Makefile b/crypto/external/bsd/heimdal/lib/libkrb5/Makefile
index c6e64a8cd..55ca69db5 100644
--- a/crypto/external/bsd/heimdal/lib/libkrb5/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libkrb5/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.8 2014/04/24 13:50:53 pettai Exp $
+# $NetBSD: Makefile,v 1.11 2017/01/29 15:42:58 christos Exp $
 
 USE_FORT?= yes	# network protocol library
 
@@ -9,20 +9,22 @@ CWARNFLAGS.clang=	-Wno-conversion -Wno-tautological-compare
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
 
-.PATH:		${HEIMDIST}/lib/krb5 ${HEIMDIST}/doc ${HEIMBASE}/include
+.PATH:		${HEIMDIST}/lib/krb5 ${HEIMDIST}/lib/vers ${HEIMDIST}/doc ${HEIMBASE}/include
 
 WARNS?=		0
 
 LIB=		krb5
 
-LIBDPLIBS+=	hx509		${HEIMBASE}/lib/libhx509	\
-		crypto		${SSLBASE}/lib/libcrypto	\
-		asn1		${HEIMBASE}/lib/libasn1		\
-		com_err		${HEIMBASE}/lib/libcom_err	\
-		roken		${HEIMBASE}/lib/libroken	\
-		wind		${HEIMBASE}/lib/libwind		\
-		heimbase	${HEIMBASE}/lib/libheimbase	\
-		crypt		${NETBSDSRCDIR}/lib/libcrypt
+LIBDPLIBS+=	\
+	hx509		${HEIMBASE}/lib/libhx509	\
+	crypto		${SSLBASE}/lib/libcrypto	\
+	asn1		${HEIMBASE}/lib/libasn1		\
+	com_err		${HEIMBASE}/lib/libcom_err	\
+	roken		${HEIMBASE}/lib/libroken	\
+	wind		${HEIMBASE}/lib/libwind		\
+	heimbase	${HEIMBASE}/lib/libheimbase	\
+	sqlite3		${NETBSDSRCDIR}/external/public-domain/sqlite/lib \
+	crypt		${NETBSDSRCDIR}/lib/libcrypt
 
 HEIMSRCS= krb_err.et krb5_err.et heim_err.et k524_err.et
 
@@ -47,7 +49,8 @@ SRCS=						\
 	copy_host_realm.c			\
 	crc.c					\
 	creds.c					\
-	crypto-aes.c				\
+	crypto-aes-sha1.c			\
+	crypto-aes-sha2.c			\
 	crypto-algs.c				\
 	crypto-arcfour.c			\
 	crypto-des-common.c			\
@@ -59,13 +62,17 @@ SRCS=						\
 	crypto-rand.c				\
 	crypto.c				\
 	data.c					\
+	db_plugin.c				\
+	dcache.c				\
 	deprecated.c				\
 	digest.c				\
 	doxygen.c				\
 	eai_to_heim_errno.c			\
+	enomem.c				\
 	error_string.c				\
 	expand_hostname.c			\
 	expand_path.c				\
+	fast.c					\
 	fcache.c				\
 	free.c					\
 	free_host_realm.c			\
@@ -107,8 +114,10 @@ SRCS=						\
 	padata.c				\
 	pcache.c				\
 	pkinit.c				\
+	pkinit-ec.c				\
 	plugin.c				\
 	principal.c				\
+	print_version.c				\
 	prog_setup.c				\
 	prompter_posix.c			\
 	rd_cred.c				\
@@ -120,7 +129,8 @@ SRCS=						\
 	read_message.c				\
 	recvauth.c				\
 	replay.c				\
-	salt-aes.c				\
+	salt-aes-sha1.c				\
+	salt-aes-sha2.c				\
 	salt-arcfour.c				\
 	salt-des.c				\
 	salt-des3.c				\
@@ -130,11 +140,13 @@ SRCS=						\
 	sendauth.c				\
 	set_default_realm.c			\
 	sock_principal.c			\
+	sp800-108-kdf.c				\
 	store-int.c				\
 	store.c					\
 	store_emem.c				\
 	store_fd.c				\
 	store_mem.c				\
+	store_sock.c				\
 	ticket.c				\
 	time.c					\
 	transited.c				\
@@ -530,9 +542,11 @@ INFOFLAGS=      -I. -I${HEIMDIST}/doc
 heimdal.texi: vars.texi
 
 vars.texi: vars.tin
-	< ${HEIMDIST}/doc/vars.tin > $@			\
-	sed -e 's,[@]dbdir[@],/var/heimdal,g'		\
-	    -e 's,[@]PACKAGE_VERSION[@],1.5.3,g'
+	@${TOOL_SED} -e 's,[@]dbdir[@],/var/heimdal,g'	\
+	    -e 's,[@]dbtype[@],db1,g'			\
+	    -e 's,[@]PACKAGE_VERSION[@],7.1.0,g'	\
+	    < ${.ALLSRC} > ${.TARGET}
+
 
 CLEANFILES+=	vars.texi
 
diff --git a/crypto/external/bsd/heimdal/lib/libkrb5/shlib_version b/crypto/external/bsd/heimdal/lib/libkrb5/shlib_version
index 582e9fc92..851143a3e 100644
--- a/crypto/external/bsd/heimdal/lib/libkrb5/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libkrb5/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:53 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=26
+major=27
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libroken/Makefile b/crypto/external/bsd/heimdal/lib/libroken/Makefile
index 1760a1d83..349d50342 100644
--- a/crypto/external/bsd/heimdal/lib/libroken/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libroken/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.1 2011/04/13 19:16:54 elric Exp $
+# $NetBSD: Makefile,v 1.2 2017/01/28 21:31:52 christos Exp $
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
@@ -18,6 +18,8 @@ SRCS=						\
 	cloexec.c				\
 	ct.c					\
 	dumpdata.c				\
+	detach.c				\
+	dumpdata.c				\
 	environment.c				\
 	ecalloc.c				\
 	emalloc.c				\
@@ -38,6 +40,7 @@ SRCS=						\
 	issuid.c				\
 	k_getpwnam.c				\
 	k_getpwuid.c				\
+	memset_s.c				\
 	mini_inetd.c				\
 	net_read.c				\
 	net_write.c				\
diff --git a/crypto/external/bsd/heimdal/lib/libroken/shlib_version b/crypto/external/bsd/heimdal/lib/libroken/shlib_version
index 0c843c89d..b230f9c68 100644
--- a/crypto/external/bsd/heimdal/lib/libroken/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libroken/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:55 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=19
+major=20
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libsl/shlib_version b/crypto/external/bsd/heimdal/lib/libsl/shlib_version
index 30ff1a10c..bde717412 100644
--- a/crypto/external/bsd/heimdal/lib/libsl/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libsl/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:55 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=5
+major=6
 minor=0
diff --git a/crypto/external/bsd/heimdal/lib/libsl/slc/Makefile b/crypto/external/bsd/heimdal/lib/libsl/slc/Makefile
index 5caef7727..9107949be 100644
--- a/crypto/external/bsd/heimdal/lib/libsl/slc/Makefile
+++ b/crypto/external/bsd/heimdal/lib/libsl/slc/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2011/04/15 21:02:47 elric Exp $
+# $NetBSD: Makefile,v 1.4 2017/01/30 02:38:50 jakllsch Exp $
 
 NOMAN=		# defined
 
@@ -37,11 +37,12 @@ print_version.h: make-print-version
 beforedepend:
 	[ -h krb5 ] || ln -sf . krb5
 	ln -sf ${HEIMBASE}/include/roken.h
+	ln -sf ${HEIMBASE}/include/krb5-types.h
 	ln -sf ${HEIMBASE}/dist/lib/roken/roken-common.h
 	ln -sf ${HEIMBASE}/dist/lib/roken/getarg.h
 
-CLEANFILES+=	krb5 roken.h roken-common.h getarg.h	\
-		print_version.h make-print-version	\
+CLEANFILES+=	krb5 roken.h krb5-types.h roken-common.h	\
+		getarg.h print_version.h make-print-version	\
 		make-print-version.lo
 
 # HOSTPROG will be set already if this is a src/tools build.
diff --git a/crypto/external/bsd/heimdal/lib/libwind/shlib_version b/crypto/external/bsd/heimdal/lib/libwind/shlib_version
index e68799539..01af622a0 100644
--- a/crypto/external/bsd/heimdal/lib/libwind/shlib_version
+++ b/crypto/external/bsd/heimdal/lib/libwind/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.1 2011/04/13 19:16:56 elric Exp $
+#	$NetBSD: shlib_version,v 1.2 2017/01/28 21:31:52 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
-major=0
+major=1
 minor=0
diff --git a/crypto/external/bsd/heimdal/libexec/Makefile.inc b/crypto/external/bsd/heimdal/libexec/Makefile.inc
index 9fd031347..fc8c2c39b 100644
--- a/crypto/external/bsd/heimdal/libexec/Makefile.inc
+++ b/crypto/external/bsd/heimdal/libexec/Makefile.inc
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.inc,v 1.3 2013/12/25 22:21:32 joerg Exp $
+# $NetBSD: Makefile.inc,v 1.5 2017/01/29 22:09:06 christos Exp $
 
 BINDIR=/usr/libexec
 
@@ -6,8 +6,10 @@ LDADD+= -lheimntlm -lkrb5 -lhx509 -lheimbase
 LDADD+= -lasn1 -lcom_err -lroken ${LIBVERS}
 LDADD+= -lwind
 LDADD+= -lcrypto -lcrypt
+LDADD+= -lsqlite3 -lutil
 
 DPADD+= ${LIBKRB5} ${LIBHX509}
 DPADD+= ${LIBASN1} ${LIBCOM_ERR} ${LIBROKEN} ${LIBVERS}
 DPADD+= ${LIBHEIMBASE} ${LIBHEIMNTLM} ${LIBWIND}
 DPADD+= ${LIBCRYPTO} ${LIBCRYPT}
+DPADD+= ${LIBSQLITE3} ${LIBUTIL}
diff --git a/crypto/external/bsd/heimdal/sbin/Makefile.inc b/crypto/external/bsd/heimdal/sbin/Makefile.inc
index b5e463fad..c37d4ee8d 100644
--- a/crypto/external/bsd/heimdal/sbin/Makefile.inc
+++ b/crypto/external/bsd/heimdal/sbin/Makefile.inc
@@ -1,11 +1,13 @@
-# $NetBSD: Makefile.inc,v 1.2 2011/05/25 19:21:18 he Exp $
+# $NetBSD: Makefile.inc,v 1.4 2017/01/29 22:09:06 christos Exp $
 
 BINDIR=/usr/sbin
 
 LDADD+= -lkrb5 -lhx509 -lasn1 -lwind
 LDADD+= -lcom_err -lroken -lheimbase ${LIBVERS}
 LDADD+= -lcrypto -lcrypt
+LDADD+= -lsqlite3 -lutil
 
 DPADD+= ${LIBKRB5} ${LIBHX509} ${LIBASN1} ${LIBWIND}
 DPADD+= ${LIBCOM_ERR} ${LIBROKEN} ${LIBHEIMBASE} ${LIBVERS}
 DPADD+= ${LIBCRYPTO} ${LIBCRYPT}
+DPADD+= ${LIBSQLITE3} ${LIBUTIL}
diff --git a/crypto/external/bsd/heimdal/sbin/kadmin/Makefile b/crypto/external/bsd/heimdal/sbin/kadmin/Makefile
index c8c0c58b1..4e6ba0bd0 100644
--- a/crypto/external/bsd/heimdal/sbin/kadmin/Makefile
+++ b/crypto/external/bsd/heimdal/sbin/kadmin/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2011/05/25 19:21:19 he Exp $
+# $NetBSD: Makefile,v 1.3 2017/01/28 21:31:53 christos Exp $
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
@@ -44,5 +44,10 @@ LDADD+= -lutil -ledit -lterminfo
 DPADD+=	${LIBKADM5SRV} ${LIBHDB} ${LIBKADM5CLNT} ${LIBSL}
 DPADD+= ${LIBUTIL} ${LIBEDIT} ${LIBTERMINFO}
 
+kadmin.8: kadmin.1
+	@${TOOL_SED} -e 's/KADMIN 1/KADMIN 8/' < ${.ALLSRC} > ${.TARGET}
+
+CLEANFILES+=kadmin.8
+
 .include <${HEIMBASE}/Makefile.rules.inc>
 .include <bsd.prog.mk>
diff --git a/crypto/external/bsd/heimdal/sbin/ktutil/Makefile b/crypto/external/bsd/heimdal/sbin/ktutil/Makefile
index dfaf80258..d77c0504f 100644
--- a/crypto/external/bsd/heimdal/sbin/ktutil/Makefile
+++ b/crypto/external/bsd/heimdal/sbin/ktutil/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.2 2011/05/25 19:21:19 he Exp $
+# $NetBSD: Makefile,v 1.3 2017/01/28 21:31:53 christos Exp $
 
 .include <bsd.own.mk>
 .include <${.CURDIR}/../../Makefile.inc>
@@ -29,5 +29,10 @@ SRCS=			\
 LDADD+= -lkadm5clnt -lsl -ledit -lterminfo -lutil
 DPADD+= ${LIBKADM5CLNT} ${LIBSL} ${LIBEDIT} ${LIBTERMINFO} ${LIBUTIL}
 
+ktutil.8: ktutil.1
+	@${TOOL_SED} -e 's/KTUTIL 1/KTUTIL 8/' < ${.ALLSRC} > ${.TARGET}
+
+CLEANFILES+=ktutil.8
+
 .include <${HEIMBASE}/Makefile.rules.inc>
 .include <bsd.prog.mk>