The first big step towards a complete upgrade to kth-krb4-0.9.7

110 files changed, 8674 insertions, 6717 deletions

diff --git a/kerberosIV/Makefile b/kerberosIV/Makefile
index 730a24d1f5b..2868f4cc819 100644
--- a/kerberosIV/Makefile
+++ b/kerberosIV/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.10 1997/06/29 14:54:18 provos Exp $
+#	$OpenBSD: Makefile,v 1.11 1997/11/28 12:48:37 art Exp $
 #	from @(#)Makefile	5.1 (Berkeley) 6/25/90
 
 SUBDIR=
@@ -9,10 +9,12 @@ SUBDIR+=include
 
 SUBDIR+=acl krb kadm kafs kdb
 
-SUBDIR+=ext_srvtab kadmin kadmind kdb_destroy kdb_edit kdb_init kdb_util \
-	kdestroy kerberos kinit klist kpasswdd kprop kpropd ksrvtgt ksrvutil \
+SUBDIR+=ext_srvtab kadmin kdb_destroy kdb_edit kdb_init kdb_util \
+	kdestroy kerberos kinit klist kprop kpropd ksrvtgt ksrvutil \
 	kstash make_keypair register registerd
 
+#removed: kpasswdd kadmind 
+
 SUBDIR+=man
 
 build:
diff --git a/kerberosIV/include/kafs_locl.h b/kerberosIV/include/kafs_locl.h
new file mode 100644
index 00000000000..0971f359469
--- /dev/null
+++ b/kerberosIV/include/kafs_locl.h
@@ -0,0 +1,90 @@
+/* $KTH: kafs_locl.h,v 1.7 1997/10/14 22:57:11 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef __KAFS_LOCL_H__
+#define __KAFS_LOCL_H__
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+#include <setjmp.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/filio.h>
+
+#include <sys/syscall.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+#include <netdb.h>
+
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+#include <kerberosIV/krb.h>
+#include <kerberosIV/kafs.h>
+
+#include "afssysdefs.h"
+
+struct kafs_data;
+typedef int (*afslog_uid_func_t)(struct kafs_data*, const char*, uid_t);
+
+typedef int (*get_cred_func_t)(struct kafs_data*, const char*, const char*, 
+				    const char*, CREDENTIALS*);
+
+typedef char* (*get_realm_func_t)(struct kafs_data*, const char*);
+
+typedef struct kafs_data {
+    afslog_uid_func_t afslog_uid;
+    get_cred_func_t get_cred;
+    get_realm_func_t get_realm;
+    void *data;
+} kafs_data;
+
+int _kafs_afslog_all_local_cells(kafs_data*, uid_t);
+
+int _kafs_get_cred(kafs_data*, const char*, const char*, const char *, 
+		  CREDENTIALS*);
+
+#endif /* __KAFS_LOCL_H__ */
diff --git a/kerberosIV/include/kerberosIV/kafs.h b/kerberosIV/include/kerberosIV/kafs.h
index d085e8f98ad..d67d0f3b1ea 100644
--- a/kerberosIV/include/kerberosIV/kafs.h
+++ b/kerberosIV/include/kerberosIV/kafs.h
@@ -1,21 +1,63 @@
-/*	$Id: kafs.h,v 1.1 1995/12/14 06:52:34 tholo Exp $	*/
+/* $KTH: kafs.h,v 1.24 1997/10/14 23:00:16 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
 
 #ifndef __KAFS_H
 #define __KAFS_H
 
+/* XXX must include krb5.h or krb.h */
+
+/* sys/ioctl.h must be included manually before kafs.h */
+
+/*
+ */
 #define AFSCALL_PIOCTL 20
 #define AFSCALL_SETPAG 21
 
 #ifndef _VICEIOCTL
-#if defined(__STDC__) || defined(sgi)
 #define _VICEIOCTL(id)  ((unsigned int ) _IOW('V', id, struct ViceIoctl))
-#else
-#define _VICEIOCTL(id)  ((unsigned int ) _IOW(V, id, struct ViceIoctl))
-#endif
 #endif /* _VICEIOCTL */
 
-#define VIOCSETTOK _VICEIOCTL(3)
-#define VIOCUNLOG  _VICEIOCTL(9)
+#define VIOCSETTOK		_VICEIOCTL(3)
+#define VIOCGETTOK		_VICEIOCTL(8)
+#define VIOCUNLOG		_VICEIOCTL(9)
+#define VIOC_FILE_CELL_NAME	_VICEIOCTL(30)
 
 struct ViceIoctl {
   caddr_t in, out;
@@ -36,12 +78,44 @@ struct ClearToken {
 
 int k_hasafs __P((void));
 
-int k_afsklog __P((char *realm));
+int krb_afslog __P((const char *cell, const char *realm));
+int krb_afslog_uid __P((const char *cell, const char *realm, uid_t uid));
+/* compat */
+#define k_afsklog krb_afslog
+#define k_afsklog_uid krb_afslog_uid
+
 int k_pioctl __P((char *a_path,
 		  int o_opcode,
 		  struct ViceIoctl *a_paramsP,
 		  int a_followSymlinks));
 int k_unlog __P((void));
 int k_setpag __P((void));
+int k_afs_cell_of_file __P((const char *path, char *cell, int len));
+
+/* XXX */
+#ifdef KFAILURE
+#define KRB_H_INCLUDED
+#endif
+
+#ifdef KRB5_RECVAUTH_IGNORE_VERSION
+#define KRB5_H_INCLUDED
+#endif
+
+#ifdef KRB_H_INCLUDED
+int kafs_settoken __P((const char*, uid_t, CREDENTIALS*));
+#endif
+
+#ifdef KRB5_H_INCLUDED
+krb5_error_code krb5_afslog_uid __P((krb5_context, krb5_ccache,
+				     const char*, krb5_const_realm, uid_t));
+krb5_error_code krb5_afslog __P((krb5_context, krb5_ccache, 
+				 const char*, krb5_const_realm));
+#endif
+
+
+#define _PATH_VICE		"/usr/vice/etc/"
+#define _PATH_THISCELL 		_PATH_VICE "ThisCell"
+#define _PATH_CELLSERVDB 	_PATH_VICE "CellServDB"
+#define _PATH_THESECELLS	_PATH_VICE "TheseCells"
 
 #endif /* __KAFS_H */
diff --git a/kerberosIV/include/kerberosIV/krb.h b/kerberosIV/include/kerberosIV/krb.h
index 9397884e53d..20ac571badf 100644
--- a/kerberosIV/include/kerberosIV/krb.h
+++ b/kerberosIV/include/kerberosIV/krb.h
@@ -1,6 +1,7 @@
-/*	$Id: krb.h,v 1.4 1997/06/29 10:48:36 provos Exp $	*/
+/*	$Id: krb.h,v 1.5 1997/11/28 12:48:41 art Exp $	*/
+/*      $KTH: krb.h,v 1.85 1997/10/24 10:18:16 assar Exp $      */
 
-/*-
+/*
  * Copyright 1987, 1988 by the Student Information Processing Board
  *	of the Massachusetts Institute of Technology
  *
@@ -21,13 +22,14 @@
  * Include file for the Kerberos library. 
  */
 
-/* Only one time, please */
-#ifndef	KRB_DEFS
-#define KRB_DEFS
-
 #include <sys/cdefs.h>
 #include <sys/types.h>
 
+#ifndef __KRB_H__
+#define __KRB_H__
+
+__BEGIN_DECLS
+
 /* Include site.h file to define paths */
 #include <kerberosIV/site.h>
 
@@ -35,16 +37,19 @@
 #include <des.h>
 
 /* Global library variables. */
+extern int krb_ignore_ip_address; /* To turn off IP address comparison */
+extern int krb_no_long_lifetimes; /* To disable AFS compatible lifetimes */
 extern int krbONE;
 #define         HOST_BYTE_ORDER (* (char *) &krbONE)
-extern int private_msg_ver; /* in rd_priv.c */
-extern int req_act_vno; /* this is defined in the kerberos server code */
-
 
 /* Text describing error codes */
 #define		MAX_KRB_ERRORS	256
 extern const char *krb_err_txt[MAX_KRB_ERRORS];
 
+/* Use this function rather than indexing in krb_err_txt */
+const char *krb_get_err_text __P((int code));
+
+
 /* General definitions */
 #define		KSUCCESS	0
 #define		KFAILURE	255
@@ -54,33 +59,68 @@ extern const char *krb_err_txt[MAX_KRB_ERRORS];
  *
  * KRBLOG is the log file for the kerberos master server. KRB_CONF is
  * the configuration file where different host machines running master
- * and slave servers can be found.
+ * and slave servers can be found. KRB_MASTER is the name of the
+ * machine with the master database.  The admin_server runs on this
+ * machine, and all changes to the db (as opposed to read-only
+ * requests, which can go to slaves) must go to it. KRB_HOST is the
+ * default machine * when looking for a kerberos slave server.  Other
+ * possibilities are * in the KRB_CONF file. KRB_REALM is the name of
+ * the realm. 
  */
 
+/* /etc/kerberosIV is only for backwards compatibility, don't use it! */
+#ifndef KRB_CONF
+#define KRB_CONF	"/etc/krb.conf"
+#endif
+#ifndef KRB_RLM_TRANS
+#define KRB_RLM_TRANS   "/etc/krb.realms"
+#endif
+#ifndef KRB_CNF_FILES
+#define KRB_CNF_FILES	{ KRB_CONF,   "/etc/kerberosIV/krb.conf", 0}
+#endif
+#ifndef KRB_RLM_FILES
+#define KRB_RLM_FILES	{ KRB_RLM_TRANS, "/etc/kerberosIV/krb.realms", 0}
+#endif
+#ifndef KRB_EQUIV
+#define KRB_EQUIV	"/etc/krb.equiv"
+#endif
+#define KRB_MASTER	"kerberos"
+#ifndef KRB_REALM
+#define KRB_REALM	(krb_get_default_realm())
+#endif
+
 /* The maximum sizes for aname, realm, sname, and instance +1 */
 #define 	ANAME_SZ	40
 #define		REALM_SZ	40
 #define		SNAME_SZ	40
 #define		INST_SZ		40
-/* include space for '.' and '@' */
-#define		MAX_K_NAME_SZ	(ANAME_SZ + INST_SZ + REALM_SZ + 2)
+/* Leave space for quoting */
+#define		MAX_K_NAME_SZ	(2*ANAME_SZ + 2*INST_SZ + 2*REALM_SZ - 3)
 #define		KKEY_SZ		100
 #define		VERSION_SZ	1
 #define		MSG_TYPE_SZ	1
 #define		DATE_SZ		26	/* RTI date output */
 
-#define		MAX_HSTNM	100
+#define MAX_HSTNM 100 /* for compatibility */
+
+typedef struct krb_principal{
+    char name[ANAME_SZ];
+    char instance[INST_SZ];
+    char realm[REALM_SZ];
+}krb_principal;
 
 #ifndef DEFAULT_TKT_LIFE	/* allow compile-time override */
 /* default lifetime for krb_mk_req & co., 10 hrs */
 #define	DEFAULT_TKT_LIFE 120
 #endif
 
+#define		KRB_TICKET_GRANTING_TICKET	"krbtgt"
+
 /* Definition of text structure used to pass text around */
 #define		MAX_KTXT_LEN	1250
 
 struct ktext {
-    int     length;		/* Length of the text */
+    unsigned int length;		/* Length of the text */
     unsigned char dat[MAX_KTXT_LEN];	/* The data itself */
     u_int32_t mbz;		/* zero to catch runaway strings */
 };
@@ -101,6 +141,10 @@ typedef struct ktext KTEXT_ST;
 /* Parameters for rd_ap_req */
 /* Maximum alloable clock skew in seconds */
 #define 	CLOCK_SKEW	5*60
+/* Filename for readservkey */
+#ifndef		KEYFILE
+#define		KEYFILE		"/etc/srvtab"
+#endif
 
 /* Structure definition for rd_ap_req */
 
@@ -149,6 +193,16 @@ struct msg_dat {
 
 typedef struct msg_dat MSG_DAT;
 
+struct krb_host {
+    char *realm;
+    char *host;
+    enum krb_host_proto { PROTO_UDP, PROTO_TCP, PROTO_HTTP } proto;
+    int port;
+    int admin;
+};
+
+struct krb_host *krb_get_host __P((int, char*, int));
+
 
 /* Location of ticket file for save_cred and get_cred */
 #define TKT_FILE        tkt_string()
@@ -226,6 +280,7 @@ typedef struct msg_dat MSG_DAT;
 /* Values returned by get_adtkt */
 #define         AD_OK           0	/* Ticket Obtained */
 #define         AD_NOTGT       71	/* Don't have tgt */
+#define         AD_INTR_RLM_NOTGT 72	/* Can't get inter-realm tgt */
 
 /* Error codes returned by ticket file utilities */
 #define		NO_TKT_FIL	76	/* No ticket file found */
@@ -257,7 +312,7 @@ typedef struct msg_dat MSG_DAT;
  swab(((char *) x) +10,((char *)  _krb_swap_tmp) +4 ,2); \
  swab(((char *) x) +12,((char *)  _krb_swap_tmp) +2 ,2); \
  swab(((char *) x) +14,((char *)  _krb_swap_tmp) +0 ,2); \
- bcopy((char *)_krb_swap_tmp,(char *)x,16);\
+ memcpy(x, _krb_swap_tmp, 16);\
                             }
 
 #define     swap_u_12(x) {\
@@ -268,7 +323,7 @@ typedef struct msg_dat MSG_DAT;
  swab(((char *) x) +6, ((char *)  _krb_swap_tmp) +4 ,2); \
  swab(((char *) x) +8, ((char *)  _krb_swap_tmp) +2 ,2); \
  swab(((char *) x) +10,((char *)  _krb_swap_tmp) +0 ,2); \
- bcopy((char *)_krb_swap_tmp,(char *)x,12);\
+ memcpy(x, _krb_swap_tmp, 12);\
                             }
 
 #define     swap_C_Block(x) {\
@@ -277,7 +332,7 @@ typedef struct msg_dat MSG_DAT;
  swab(((char *) x) +2,((char *)  _krb_swap_tmp) +4 ,2); \
  swab(((char *) x) +4,((char *)  _krb_swap_tmp) +2 ,2); \
  swab(((char *) x) +6,((char *)  _krb_swap_tmp)    ,2); \
- bcopy((char *)_krb_swap_tmp,(char *)x,8);\
+ memcpy(x, _krb_swap_tmp, 8);\
                             }
 #define     swap_u_quad(x) {\
  u_int32_t   _krb_swap_tmp[4];\
@@ -285,7 +340,7 @@ typedef struct msg_dat MSG_DAT;
  swab(((char *) &x) +2,((char *)  _krb_swap_tmp) +4 ,2); \
  swab(((char *) &x) +4,((char *)  _krb_swap_tmp) +2 ,2); \
  swab(((char *) &x) +6,((char *)  _krb_swap_tmp)    ,2); \
- bcopy((char *)_krb_swap_tmp,(char *)&x,8);\
+ memcpy(x, _krb_swap_tmp, 8);\
                             }
 
 #define     swap_u_long(x) {\
@@ -320,17 +375,29 @@ typedef struct msg_dat MSG_DAT;
 				     * a hostname
 				     */
 
+#define KOPT_IGNORE_PROTOCOL 0x0008
+
 #define	KRB_SENDAUTH_VLEN 8	    /* length for version strings */
 
-#ifdef ATHENA_COMPAT
-#define	KOPT_DO_OLDSTYLE 0x00000008 /* use the old-style protocol */
-#endif /* ATHENA_COMPAT */
 
-struct tm;
+/* File locking */
+#define   K_LOCK_SH   1		/* Shared lock */
+#define   K_LOCK_EX   2		/* Exclusive lock */
+#define   K_LOCK_NB   4		/* Don't block when locking */
+#define   K_LOCK_UN   8		/* Unlock */
+int k_flock __P((int fd, int operation));
 struct tm *k_localtime __P((u_int32_t *));
+int k_getsockinst __P((int fd, char *inst, size_t));
+int k_getportbyname __P((const char *service, const char *proto, int default_port));
+
+extern char *krb4_version;
+
+struct in_addr;
+
+int k_get_all_addrs __P((struct in_addr **l));
 
-/* --- Random prototypes */
-#include <sys/types.h> /* to get u_char */
+/* Host address comparison */
+int krb_equiv __P((u_int32_t, u_int32_t));
 
 /* Password conversion */
 void mit_string_to_key __P((char *str, char *cell, des_cblock *key));
@@ -346,20 +413,25 @@ int krb_atime_to_life __P((char *atime));
 int tf_get_cred __P((CREDENTIALS *));
 int tf_get_pinst __P((char *));
 int tf_get_pname __P((char *));
+int tf_put_pinst __P((char *));
+int tf_put_pname __P((char *));
 int tf_init __P((char *, int));
+int tf_create __P((char *));
 int tf_save_cred __P((char *, char *, char *, unsigned char *, int , int , KTEXT ticket, u_int32_t));
 void tf_close __P((void));
+int tf_setup __P((CREDENTIALS *cred, char *pname, char *pinst));
 
 /* Private communication */
 struct sockaddr_in;
-int32_t krb_mk_priv __P((u_char *, u_char *, u_int32_t , struct des_ks_struct *, des_cblock *, struct sockaddr_in *, struct sockaddr_in *));
-int32_t krb_rd_priv __P((u_char *, u_int32_t, struct des_ks_struct *, des_cblock *, struct sockaddr_in *, struct sockaddr_in *, MSG_DAT *));
+
+int32_t krb_mk_priv __P((void *, void *, u_int32_t, struct des_ks_struct *, des_cblock *, struct sockaddr_in *, struct sockaddr_in *));
+int32_t krb_rd_priv __P((void *, u_int32_t, struct des_ks_struct *, des_cblock *, struct sockaddr_in *, struct sockaddr_in *, MSG_DAT *));
 
 /* Misc */
 KTEXT create_auth_reply __P((char *, char *, char *, int32_t, int, u_int32_t, int, KTEXT));
 
-char *krb_get_phost __P((char *));
-char *krb_realmofhost __P((char *));
+char *krb_get_phost __P((const char *));
+char *krb_realmofhost __P((const char *));
 char *tkt_string __P((void));
 
 int create_ciph __P((KTEXT, unsigned char *, char *, char *, char *, u_int32_t, int, KTEXT, u_int32_t, des_cblock *));
@@ -368,56 +440,103 @@ int dest_tkt __P((void));
 int get_ad_tkt __P((char *, char *, char *, int));
 int get_pw_tkt __P((char *, char *, char *, char *));
 int get_request __P((KTEXT, int, char **, char **));
-int get_request __P((KTEXT, int, char **, char **));
 int in_tkt __P((char *, char *));
+int k_gethostname __P((char *, int ));
 int k_isinst __P((char *));
 int k_isname __P((char *));
 int k_isrealm __P((char *));
 int kname_parse __P((char *, char *, char *, char *));
-int krb_create_ticket __P((KTEXT, unsigned char, char *, char *, char *, int32_t, char *, int16_t, int32_t, char *, char *, des_cblock *));
-int krb_get_admhst __P((char *, char *, int));
+int krb_parse_name __P((const char*, krb_principal*));
+char *krb_unparse_name  __P((krb_principal*));
+char *krb_unparse_name_r  __P((krb_principal*, char*));
+char *krb_unparse_name_long  __P((char*, char*, char*));
+char *krb_unparse_name_long_r __P((char *name, char *instance, char *realm, char *fullname));
+int krb_create_ticket __P((KTEXT, unsigned char, char *, char *, char *, int32_t, void *, int16_t, int32_t, char *, char *, des_cblock *));
 int krb_get_admhst __P((char *, char *, int));
 int krb_get_cred __P((char *, char *, char *, CREDENTIALS *));
-int krb_get_in_tkt __P((char *, char *, char *, char *, char *, int , int (*key_proc) (/* ??? */), int (*decrypt_proc) (/* ??? */), char *));
-int krb_get_krbhst __P((char *, char *, int));
-int krb_get_krbhst __P((char *, char *, int));
+
+typedef int (*key_proc_t) __P((char*, char*, char*, void*, des_cblock*));
+
+typedef int (*decrypt_proc_t) __P((char*, char*, char*, void*, 
+			      key_proc_t, KTEXT*));
+
+int krb_mk_as_req __P((char*, char*, char*, char*, char*, int, KTEXT));
+int krb_decode_as_rep __P((char*, char*, char*, char*, char*, 
+			   key_proc_t, decrypt_proc_t, void*, 
+			   KTEXT, CREDENTIALS*));
+int krb_get_in_tkt __P((char*, char*, char*, char*, char*, int, key_proc_t, 
+			decrypt_proc_t, void*));
+
+int srvtab_to_key	__P((char *, char *, char *, void *, des_cblock *));
+int passwd_to_key	__P((char *, char *, char *, void *, des_cblock *));
+int passwd_to_afskey	__P((char *, char *, char *, void *, des_cblock *));
+
 int krb_get_krbhst __P((char *, char *, int));
 int krb_get_lrealm __P((char *, int));
+char *krb_get_default_realm __P((void));
 int krb_get_pw_in_tkt __P((char *, char *, char *, char *, char *, int, char *));
 int krb_get_svc_in_tkt __P((char *, char *, char *, char *, char *, int, char *));
 int krb_get_tf_fullname __P((char *, char *, char *, char *));
 int krb_get_tf_realm __P((char *, char *));
 int krb_kntoln __P((AUTH_DAT *, char *));
 int krb_mk_req __P((KTEXT , char *, char *, char *, int32_t));
-int krb_net_read __P((int , char *, int));
-int krb_net_write __P((int , char *, int));
+int krb_net_read __P((int , void *, size_t));
+int krb_net_write __P((int , const void *, size_t));
 int krb_rd_err __P((u_char *, u_int32_t, int32_t *, MSG_DAT *));
 int krb_rd_req __P((KTEXT , char *, char *, int32_t, AUTH_DAT *, char *));
 int krb_recvauth __P((int32_t, int, KTEXT, char *, char *, struct sockaddr_in *, struct sockaddr_in *, AUTH_DAT *, char *, struct des_ks_struct *, char *));
 int krb_sendauth __P((int32_t, int, KTEXT, char *, char *, char *, u_int32_t, MSG_DAT *, CREDENTIALS *, struct des_ks_struct *, struct sockaddr_in *, struct sockaddr_in *, char *));
-int krb_set_key __P((char *, int));
+int krb_mk_auth __P((int32_t, KTEXT, char *, char *, char *, u_int32_t, char *, KTEXT));
+int krb_check_auth __P((KTEXT, u_int32_t, MSG_DAT *, des_cblock *, struct des_ks_struct *, struct sockaddr_in *, struct sockaddr_in *));
+int krb_set_key __P((void *, int));
 int krb_set_lifetime __P((int));
+int krb_kuserok __P((char *, char *, char *, char *));
 int kuserok __P((AUTH_DAT *, char *));
 int read_service_key __P((char *, char *, char *, int , char *, char *));
 int save_credentials __P((char *, char *, char *, unsigned char *, int , int , KTEXT , int32_t));
 int send_to_kdc __P((KTEXT , KTEXT , char *));
 
 int32_t krb_mk_err __P((u_char *, int32_t, char *));
-int32_t krb_mk_safe __P((u_char *, u_char *, u_int32_t, des_cblock *, struct sockaddr_in *, struct sockaddr_in *));
-int32_t krb_rd_safe __P((u_char *, u_int32_t, des_cblock *, struct sockaddr_in *, struct sockaddr_in *, MSG_DAT *));
+int32_t krb_mk_safe __P((void *, void *, u_int32_t, des_cblock *, struct sockaddr_in *, struct sockaddr_in *));
+int32_t krb_rd_safe __P((void *, u_int32_t, des_cblock *, struct sockaddr_in *, struct sockaddr_in *, MSG_DAT *));
 
 void ad_print __P((AUTH_DAT *));
 void cr_err_reply __P((KTEXT, char *, char *, char *, u_int32_t, u_int32_t, char *));
 void extract_ticket __P((KTEXT, int, char *, int *, int *, char *, KTEXT));
-void krb_set_tkt_string __P((char *));
+void krb_set_tkt_string __P((const char *));
 
-void kset_logfile __P((char *));
-void set_logfile __P((char *));
-
-void log ();
-char *klog ();
+int krb_get_default_principal __P((char *, char *, char *));
+int krb_realm_parse __P((char *, int));
+int krb_verify_user __P((char*, char*, char*, char*, int, char *));
 
 int getst __P((int, char *, int));
+const char *month_sname __P((int));
+const char *krb_stime __P((time_t *));
+struct tm;
+int krb_check_tm __P((struct tm));
+
+int krb_get_int __P((void *from, u_int32_t *to, int size, int lsb));
+int krb_put_int __P((u_int32_t from, void *to, int size));
+int krb_get_address __P((void *from, u_int32_t *to));
+int krb_put_address __P((u_int32_t addr, void *to));
+int krb_put_string __P((char *from, void *to));
+int krb_get_string __P((void *from, char *to));
+int krb_get_nir __P((void *from, char *name, char *instance, char *realm));
+int krb_put_nir __P((char *name, char *instance, char *realm, void *to));
+
+/* XXX - this should really be somewhere else (from libroken)*/
+char *strtok_r __P((char *s1, const char *s2, char **lasts));
+int base64_encode __P((const void *data, int size, char **str));
+int base64_decode __P((const char *str, void *data));
+
+#if !defined(__GNUC__) && !defined(__attribute__)
+#define __attribute__(x)
+#endif
+
+int asprintf (char **ret, const char *format, ...)
+     __attribute__ ((format (printf, 2, 3)));
+
 
+__END_DECLS
 
-#endif /* KRB_DEFS */
+#endif /* __KRB_H__ */
diff --git a/kerberosIV/include/klog.h b/kerberosIV/include/klog.h
index 7053d77278e..331ed34bfef 100644
--- a/kerberosIV/include/klog.h
+++ b/kerberosIV/include/klog.h
@@ -1,6 +1,6 @@
-/*	$Id: klog.h,v 1.1 1995/12/14 06:52:34 tholo Exp $	*/
+/* $KTH: klog.h,v 1.5 1997/05/11 11:05:28 assar Exp $ */
 
-/*-
+/*
  * Copyright 1988 by the Massachusetts Institute of Technology.
  *
  * For copying and distribution information, please see the file
@@ -13,6 +13,12 @@
 #ifndef KLOG_DEFS
 #define KLOG_DEFS
 
+#ifndef KRBLOG
+#define KRBLOG 		"/var/log/kerberos.log"  /* master server  */
+#endif
+#ifndef KRBSLAVELOG
+#define KRBSLAVELOG	"/var/log/kerberos_slave.log"  /* slave server  */
+#endif
 #define	NLOGTYPE	100	/* Maximum number of log msg types  */
 
 #define L_NET_ERR	  1	/* Error in network code	    */
@@ -32,6 +38,10 @@
 #define L_APPL_REQ	 15	/* Application requests (using tgt) */
 #define L_KRB_PWARN      16	/* Protocol warning messages	    */
 
-char   *klog();
+char * klog __P((int type, const char *format, ...))
+#ifdef __GNUC__
+__attribute__ ((format (printf, 2, 3)))
+#endif
+;
 
 #endif /* KLOG_DEFS */
diff --git a/kerberosIV/include/krb_log.h b/kerberosIV/include/krb_log.h
new file mode 100644
index 00000000000..53e846d70f1
--- /dev/null
+++ b/kerberosIV/include/krb_log.h
@@ -0,0 +1,83 @@
+/* $KTH krb_log.h,v 1.2 1997/09/26 17:40:33 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <kerberosIV/krb.h>
+
+#ifndef __KRB_LOG_H__
+#define __KRB_LOG_H__
+
+#if !defined(__GNUC__) && !defined(__attribute__)
+#define __attribute__(X)
+#endif
+
+__BEGIN_DECLS
+
+/* logging.c */
+
+typedef int (*krb_log_func_t) __P((FILE *, const char *, va_list));
+
+typedef krb_log_func_t krb_warnfn_t;
+
+struct krb_log_facility;
+
+int krb_vlogger __P((struct krb_log_facility*, const char *, va_list)) 
+	__attribute__ ((format (printf, 2, 0)));
+int krb_logger __P((struct krb_log_facility*, const char *, ...))
+	__attribute__ ((format (printf, 2, 3)));
+int krb_openlog __P((struct krb_log_facility*, char*, FILE*, krb_log_func_t));
+
+void krb_set_warnfn  __P((krb_warnfn_t));
+krb_warnfn_t krb_get_warnfn  __P((void));
+void krb_warning  __P((const char*, ...))
+	__attribute__ ((format (printf, 1, 2)));
+
+void kset_logfile __P((char*));
+void krb_log __P((const char*, ...))
+	__attribute__ ((format (printf, 1, 2)));
+char *klog __P((int, const char*, ...))
+	__attribute__ ((format (printf, 2, 3)));
+
+__END_DECLS
+
+#endif /* __KRB_LOG_H__ */
+
+
+
+
diff --git a/kerberosIV/include/kuser_locl.h b/kerberosIV/include/kuser_locl.h
index 15f24c285de..c15ee92591b 100644
--- a/kerberosIV/include/kuser_locl.h
+++ b/kerberosIV/include/kuser_locl.h
@@ -1,6 +1,47 @@
-/*	$Id: kuser_locl.h,v 1.1 1995/12/14 06:52:33 tholo Exp $	*/
+/*	$Id: kuser_locl.h,v 1.2 1997/11/28 12:48:39 art Exp $	*/
+/*      $KTH: kuser_locl.h,v 1.10 1997/05/20 18:40:43 bg Exp $          */
 
-#include "kerberosIV/site.h"
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+
+#include <kerberosIV/site.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -12,8 +53,17 @@
 #include <fcntl.h>
 #include <time.h>
 #include <sys/file.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
 
 #include <pwd.h>
 
+#include <err.h>
+
 #include <kerberosIV/krb.h>
+#include <kerberosIV/krb_db.h>
+#include <kerberosIV/kadm.h>
 #include <prot.h>
+
+
+
diff --git a/kerberosIV/include/prot.h b/kerberosIV/include/prot.h
index 4a0a29ae101..629ea104e2f 100644
--- a/kerberosIV/include/prot.h
+++ b/kerberosIV/include/prot.h
@@ -1,6 +1,6 @@
-/*	$Id: prot.h,v 1.1 1995/12/14 06:52:33 tholo Exp $	*/
+/* $KTH: prot.h,v 1.7 1997/03/23 03:52:27 joda Exp $ */
 
-/*-
+/*
  * Copyright 1985, 1986, 1987, 1988 by the Massachusetts Institute
  * of Technology.
  *
@@ -13,12 +13,12 @@
 #ifndef PROT_DEFS
 #define PROT_DEFS
 
+#define		KRB_SERVICE		"kerberos-iv"
 #define		KRB_PORT		750	/* PC's don't have
 						 * /etc/services */
 #define		KRB_PROT_VERSION 	4
 #define 	MAX_PKT_LEN		1000
 #define		MAX_TXT_LEN		1000
-#define		TICKET_GRANTING_TICKET	"krbtgt"
 
 /* Macro's to obtain various fields from a packet */
 
@@ -57,8 +57,12 @@
 
 /* Routines to create and read packets may be found in prot.c */
 
-KTEXT create_auth_reply();
-KTEXT create_death_packet();
+KTEXT create_auth_reply(char *pname, char *pinst, char *prealm, 
+			int32_t time_ws, int n, u_int32_t x_date, 
+			int kvno, KTEXT cipher);
+#ifdef DEBUG
+KTEXT krb_create_death_packet(char *a_name);
+#endif
 
 /* Message types , always leave lsb for byte order */
 
@@ -70,6 +74,8 @@ KTEXT create_death_packet();
 #define		AUTH_MSG_PRIVATE			 6<<1
 #define		AUTH_MSG_SAFE				 7<<1
 #define		AUTH_MSG_APPL_ERR			 8<<1
+#define		AUTH_MSG_KDC_FORWARD			 9<<1
+#define		AUTH_MSG_KDC_RENEW			10<<1
 #define 	AUTH_MSG_DIE				63<<1
 
 /* values for kerb error codes */
@@ -85,5 +91,15 @@ KTEXT create_death_packet();
 #define		KERB_ERR_PRINCIPAL_UNKNOWN		 8
 #define		KERB_ERR_PRINCIPAL_NOT_UNIQUE		 9
 #define		KERB_ERR_NULL_KEY			10
+#define		KERB_ERR_TIMEOUT			11
+
+/* sendauth - recvauth */
+
+/*
+ * If the protocol changes, you will need to change the version string
+ * be sure to support old versions of krb_sendauth!
+ */
+
+#define	KRB_SENDAUTH_VERS "AUTHV0.1" /* MUST be KRB_SENDAUTH_VLEN chars */
 
 #endif /* PROT_DEFS */
diff --git a/kerberosIV/kafs/Makefile b/kerberosIV/kafs/Makefile
index bfe28c1326e..10122fcfe1c 100644
--- a/kerberosIV/kafs/Makefile
+++ b/kerberosIV/kafs/Makefile
@@ -1,6 +1,7 @@
-#	$Id: Makefile,v 1.1 1995/12/14 06:52:46 tholo Exp $
+#	$Id: Makefile,v 1.2 1997/11/28 12:48:42 art Exp $
 
 LIB=	kafs
-SRCS=	afssys.c
+CFLAGS+=-I${.CURDIR} -DNO_AFS
+SRCS=	afskrb.c afssys.c common.c
 
 .include <bsd.lib.mk>
diff --git a/kerberosIV/kafs/afskrb.c b/kerberosIV/kafs/afskrb.c
new file mode 100644
index 00000000000..d6809e541ed
--- /dev/null
+++ b/kerberosIV/kafs/afskrb.c
@@ -0,0 +1,112 @@
+/* $KTH: afskrb.c,v 1.8 1997/10/14 23:00:39 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kafs_locl.h"
+
+struct krb_kafs_data {
+    const char *realm;
+};
+
+static int
+get_cred(kafs_data *data, const char *name, const char *inst, 
+	 const char *realm, CREDENTIALS *c)
+{
+    KTEXT_ST tkt;
+    int ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, c);
+    
+    if (ret) {
+	ret = krb_mk_req(&tkt, (char*)name, (char*)inst, (char*)realm, 0);
+	if (ret == KSUCCESS)
+	    ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, c);
+    }
+    return ret;
+}
+
+static int
+afslog_uid_int(kafs_data *data, const char *cell, uid_t uid)
+{
+    int ret;
+    CREDENTIALS c;
+    struct krb_kafs_data *d = data->data;
+    char realm[REALM_SZ], *lrealm;
+    
+    if (cell == 0 || cell[0] == 0)
+	return _kafs_afslog_all_local_cells (data, uid);
+
+    ret = krb_get_lrealm(realm , 0);
+    if(ret == KSUCCESS && (d->realm == NULL || strcmp(d->realm, realm)))
+	lrealm = realm;
+    else
+	lrealm = NULL;
+
+    ret = _kafs_get_cred(data, cell, d->realm, lrealm, &c);
+    
+    if(ret == 0)
+	ret = kafs_settoken(cell, uid, &c);
+    return ret;
+}
+
+static char *
+get_realm(kafs_data *data, const char *host)
+{
+    char *r = krb_realmofhost(host);
+    if(r)
+	return strdup(r);
+    return NULL;
+}
+
+int
+krb_afslog_uid(const char *cell, const char *realm, uid_t uid)
+{
+    kafs_data kd;
+    struct krb_kafs_data d;
+    kd.afslog_uid = afslog_uid_int;
+    kd.get_cred = get_cred;
+    kd.get_realm = get_realm;
+    kd.data = &d;
+    d.realm = realm;
+    return afslog_uid_int(&kd, cell, uid);
+}
+
+int
+krb_afslog(const char *cell, const char *realm)
+{
+    return krb_afslog_uid (cell, realm, getuid());
+}
diff --git a/kerberosIV/kafs/afssys.c b/kerberosIV/kafs/afssys.c
index 2c831e41abf..eb849791abc 100644
--- a/kerberosIV/kafs/afssys.c
+++ b/kerberosIV/kafs/afssys.c
@@ -1,302 +1,220 @@
-/*	$Id: afssys.c,v 1.2 1996/09/16 03:18:08 tholo Exp $	*/
-
-#include <sys/types.h>
-#include <sys/ioctl.h>
-#include <signal.h>
-#include <setjmp.h>
-#include <errno.h>
-#include <string.h>
-#include <unistd.h>
-
-#include <kerberosIV/krb.h>
-#include <kerberosIV/kafs.h>
-
-#include "afssysdefs.h"
-
-#define AUTH_SUPERUSER "afs"
+/* $KTH: afssys.c,v 1.53 1997/05/04 02:30:41 assar Exp $ */
 
 /*
- * Here only ASCII characters are relevant.
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-#define IsAsciiUpper(c) ('A' <= (c) && (c) <= 'Z')
-
-#define ToAsciiLower(c) ((c) - 'A' + 'a')
-
-static void
-folddown(a, b)
-     char *a, *b;
-{
-  for (; *b; a++, b++)
-    if (IsAsciiUpper(*b))
-      *a = ToAsciiLower(*b);
-    else
-      *a = *b;
-  *a = '\0';
-}
-
-#if !defined(linux)		/* won't work there -- no SIGSYS, no syscall */
-
-int
-k_afsklog(realm)
-	char *realm;
-{
-  int k_errno;
-  CREDENTIALS c;
-  KTEXT_ST ticket;
-  char username[256];
-  char krealm[REALM_SZ];
-
-  if (!k_hasafs())
-    return KSUCCESS;
-
-  if (realm == 0 || realm[0] == 0)
-    {
-      k_errno = krb_get_lrealm(krealm, 0);
-      if (k_errno != KSUCCESS)
-	return k_errno;
-      realm = krealm;
-    }
-
-  k_errno = krb_get_cred(AUTH_SUPERUSER, "", realm, &c);
-  if (k_errno != KSUCCESS)
-    {
-      k_errno = krb_mk_req(&ticket, AUTH_SUPERUSER, "", realm, 0);
-      if (k_errno == KSUCCESS)
-	k_errno = krb_get_cred(AUTH_SUPERUSER, "", realm, &c);
-    }
-
-  if (k_errno == KSUCCESS)
-    {
-      char cell[256];
-      struct ViceIoctl parms;
-      struct ClearToken ct;
-      int32_t sizeof_x;
-      char buf[2048], *t;
-
-      folddown(cell, realm);
-
-      /*
-       * Build a struct ClearToken
-       */
-      ct.AuthHandle = c.kvno;
-      bcopy((char *)c.session, ct.HandShakeKey, sizeof(c.session));
-      ct.ViceId = getuid();	/* is this always valid? */
-      ct.BeginTimestamp = 1 + c.issue_date;
-      ct.EndTimestamp = krb_life_to_time(c.issue_date, c.lifetime);
-
-      t = buf;
-      /*
-       * length of secret token followed by secret token
-       */
-      sizeof_x = c.ticket_st.length;
-      bcopy((char *)&sizeof_x, t, sizeof(sizeof_x));
-      t += sizeof(sizeof_x);
-      bcopy((char *)c.ticket_st.dat, t, sizeof_x);
-      t += sizeof_x;
-      /*
-       * length of clear token followed by clear token
-       */
-      sizeof_x = sizeof(ct);
-      bcopy((char *)&sizeof_x, t, sizeof(sizeof_x));
-      t += sizeof(sizeof_x);
-      bcopy((char *)&ct, t, sizeof_x);
-      t += sizeof_x;
-
-      /*
-       * do *not* mark as primary cell
-       */
-      sizeof_x = 0;
-      bcopy((char *)&sizeof_x, t, sizeof(sizeof_x));
-      t += sizeof(sizeof_x);
-      /*
-       * follow with cell name
-       */
-      sizeof_x = strlen(cell) + 1;
-      bcopy(cell, t, sizeof_x);
-      t += sizeof_x;
-
-      /*
-       * Build argument block
-       */
-      parms.in = buf;
-      parms.in_size = t - buf;
-      parms.out = 0;
-      parms.out_size = 0;
-      (void) k_pioctl(0, VIOCSETTOK, &parms, 0);
-    }
-  return k_errno;
-}
+#include "kafs_locl.h"
 
 #define NO_ENTRY_POINT		0
 #define SINGLE_ENTRY_POINT	1
 #define MULTIPLE_ENTRY_POINT	2
 #define SINGLE_ENTRY_POINT2	3
-#define AIX_ENTRY_POINTS	4
-#define UNKNOWN_ENTRY_POINT	5
+#define SINGLE_ENTRY_POINT3	4
+#define AIX_ENTRY_POINTS	5
+#define UNKNOWN_ENTRY_POINT	6
 static int afs_entry_point = UNKNOWN_ENTRY_POINT;
+static int afs_syscalls[2];
+
 
 int
-k_pioctl(a_path, o_opcode, a_paramsP, a_followSymlinks)
-	char *a_path;
-	int o_opcode;
-	struct ViceIoctl *a_paramsP;
-	int a_followSymlinks;
+k_pioctl(char *a_path,
+	 int o_opcode,
+	 struct ViceIoctl *a_paramsP,
+	 int a_followSymlinks)
 {
-#ifdef AFS_SYSCALL
-  if (afs_entry_point == SINGLE_ENTRY_POINT)
-    return syscall(AFS_SYSCALL, AFSCALL_PIOCTL,
-		   a_path, o_opcode, a_paramsP, a_followSymlinks);
+#ifndef NO_AFS
+    switch(afs_entry_point){
+#if defined(AFS_SYSCALL) || defined(AFS_SYSCALL2) || defined(AFS_SYSCALL3)
+    case SINGLE_ENTRY_POINT:
+    case SINGLE_ENTRY_POINT2:
+    case SINGLE_ENTRY_POINT3:
+	return syscall(afs_syscalls[0], AFSCALL_PIOCTL,
+		       a_path, o_opcode, a_paramsP, a_followSymlinks);
 #endif
-
-#ifdef AFS_PIOCTL
-    if (afs_entry_point == MULTIPLE_ENTRY_POINT)
-      return syscall(AFS_PIOCTL,
-		     a_path, o_opcode, a_paramsP, a_followSymlinks);
+#if defined(AFS_PIOCTL)
+    case MULTIPLE_ENTRY_POINT:
+	return syscall(afs_syscalls[0],
+		       a_path, o_opcode, a_paramsP, a_followSymlinks);
 #endif
-
-#ifdef AFS_SYSCALL2
-  if (afs_entry_point == SINGLE_ENTRY_POINT2)
-    return syscall(AFS_SYSCALL2, AFSCALL_PIOCTL,
-		   a_path, o_opcode, a_paramsP, a_followSymlinks);
-#endif
-
-#ifdef _AIX
-  if (afs_entry_point == AIX_ENTRY_POINTS)
-    return lpioctl(a_path, o_opcode, a_paramsP, a_followSymlinks);
-#endif
-
-  errno = ENOSYS;
-  kill(getpid(), SIGSYS);	/* You loose! */
-  return -1;
+    }
+    
+    errno = ENOSYS;
+    kill(getpid(), SIGSYS);	/* You loose! */
+#endif /* NO_AFS */
+    return -1;
 }
 
 int
-k_unlog()
+k_afs_cell_of_file(const char *path, char *cell, int len)
 {
-  struct ViceIoctl parms;
-  bzero((char *)&parms, sizeof(parms));
-  return k_pioctl(0, VIOCUNLOG, &parms, 0);
+    struct ViceIoctl parms;
+    parms.in = NULL;
+    parms.in_size = 0;
+    parms.out = cell;
+    parms.out_size = len;
+    return k_pioctl((char*)path, VIOC_FILE_CELL_NAME, &parms, 1);
 }
 
 int
-k_setpag()
+k_unlog(void)
 {
-#ifdef AFS_SYSCALL
-  if (afs_entry_point == SINGLE_ENTRY_POINT)
-    return syscall(AFS_SYSCALL, AFSCALL_SETPAG);
-#endif
-
-#ifdef AFS_SETPAG
-  if (afs_entry_point == MULTIPLE_ENTRY_POINT)
-    return syscall(AFS_SETPAG);
-#endif
+    struct ViceIoctl parms;
+    memset(&parms, 0, sizeof(parms));
+    return k_pioctl(0, VIOCUNLOG, &parms, 0);
+}
 
-#ifdef AFS_SYSCALL2
-  if (afs_entry_point == SINGLE_ENTRY_POINT2)
-    return syscall(AFS_SYSCALL2, AFSCALL_SETPAG);
+int
+k_setpag(void)
+{
+#ifndef NO_AFS
+    switch(afs_entry_point){
+#if defined(AFS_SYSCALL) || defined(AFS_SYSCALL2) || defined(AFS_SYSCALL3)
+    case SINGLE_ENTRY_POINT:
+    case SINGLE_ENTRY_POINT2:
+    case SINGLE_ENTRY_POINT3:
+	return syscall(afs_syscalls[0], AFSCALL_SETPAG);
 #endif
-
-#ifdef _AIX
-  if (afs_entry_point == AIX_ENTRY_POINTS)
-    return lsetpag();
+#if defined(AFS_PIOCTL)
+    case MULTIPLE_ENTRY_POINT:
+	return syscall(afs_syscalls[1]);
 #endif
-
-  errno = ENOSYS;
-  kill(getpid(), SIGSYS);	/* You loose! */
-  return -1;
+    }
+    
+    errno = ENOSYS;
+    kill(getpid(), SIGSYS);	/* You loose! */
+#endif /* NO_AFS */
+    return -1;
 }
-#endif /* defined(linux) */
+
 static jmp_buf catch_SIGSYS;
 
-static void
-SIGSYS_handler()
+void
+SIGSYS_handler(int sig)
 {
-  errno = 0;
-  longjmp(catch_SIGSYS, 1);
+    errno = 0;
+    longjmp(catch_SIGSYS, 1);
 }
 
 int
-k_hasafs()
+k_hasafs(void)
 {
-  int saved_errno;
-  void (*saved_func)();
-  struct ViceIoctl parms;
+    int saved_errno;
+    void (*saved_func)();
+    struct ViceIoctl parms;
   
-#if defined(linux)
-  return 0;
-#else
-  /*
-   * Already checked presence of AFS syscalls?
-   */
-  if (afs_entry_point != UNKNOWN_ENTRY_POINT)
-    return afs_entry_point != NO_ENTRY_POINT;
-
-  /*
-   * Probe kernel for AFS specific syscalls,
-   * they (currently) come in two flavors.
-   * If the syscall is absent we recive a SIGSYS.
-   */
-  afs_entry_point = NO_ENTRY_POINT;
-  bzero(&parms, sizeof(parms));
+    /*
+     * Already checked presence of AFS syscalls?
+     */
+    if (afs_entry_point != UNKNOWN_ENTRY_POINT)
+	return afs_entry_point != NO_ENTRY_POINT;
+
+    /*
+     * Probe kernel for AFS specific syscalls,
+     * they (currently) come in two flavors.
+     * If the syscall is absent we recive a SIGSYS.
+     */
+    afs_entry_point = NO_ENTRY_POINT;
+    memset(&parms, 0, sizeof(parms));
   
-  saved_errno = errno;
-  saved_func = signal(SIGSYS, SIGSYS_handler);
+    saved_errno = errno;
+#ifndef NO_AFS
+    saved_func = signal(SIGSYS, SIGSYS_handler);
 
 #ifdef AFS_SYSCALL
-  if (setjmp(catch_SIGSYS) == 0)
-    {
-      syscall(AFS_SYSCALL, AFSCALL_PIOCTL,
-	      0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-      if (errno == EINVAL)
+    if (setjmp(catch_SIGSYS) == 0)
 	{
-	  afs_entry_point = SINGLE_ENTRY_POINT;
-	  goto done;
+	    syscall(AFS_SYSCALL, AFSCALL_PIOCTL,
+		    0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	    if (errno == EINVAL)
+		{
+		    afs_entry_point = SINGLE_ENTRY_POINT;
+		    afs_syscalls[0] = AFS_SYSCALL;
+		    goto done;
+		}
 	}
-    }
 #endif /* AFS_SYSCALL */
 
 #ifdef AFS_PIOCTL
-  if (setjmp(catch_SIGSYS) == 0)
-    {
-      syscall(AFS_PIOCTL,
-	      0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-      if (errno == EINVAL)
+    if (setjmp(catch_SIGSYS) == 0)
 	{
-	  afs_entry_point = MULTIPLE_ENTRY_POINT;
-	  goto done;
+	    syscall(AFS_PIOCTL,
+		    0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	    if (errno == EINVAL)
+		{
+		    afs_entry_point = MULTIPLE_ENTRY_POINT;
+		    afs_syscalls[0] = AFS_PIOCTL;
+		    afs_syscalls[1] = AFS_SETPAG;
+		    goto done;
+		}
 	}
-    }
 #endif /* AFS_PIOCTL */
 
 #ifdef AFS_SYSCALL2
-  if (setjmp(catch_SIGSYS) == 0)
-    {
-      syscall(AFS_SYSCALL2, AFSCALL_PIOCTL,
-	      0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-      if (errno == EINVAL)
+    if (setjmp(catch_SIGSYS) == 0)
 	{
-	  afs_entry_point = SINGLE_ENTRY_POINT2;
-	  goto done;
+	    syscall(AFS_SYSCALL2, AFSCALL_PIOCTL,
+		    0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	    if (errno == EINVAL)
+		{
+		    afs_entry_point = SINGLE_ENTRY_POINT2;
+		    afs_syscalls[0] = AFS_SYSCALL2;
+		    goto done;
+		}
 	}
-    }
 #endif /* AFS_SYSCALL */
 
-#ifdef _AIX
-  if (setjmp(catch_SIGSYS) == 0)
-    {
-      lpioctl(0, 0, 0, 0);
-      if (errno == EINVAL)
+#ifdef AFS_SYSCALL3
+    if (setjmp(catch_SIGSYS) == 0)
 	{
-	  afs_entry_point = AIX_ENTRY_POINTS;
-	  goto done;
+	    syscall(AFS_SYSCALL3, AFSCALL_PIOCTL,
+		    0, VIOCSETTOK, &parms, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	    if (errno == EINVAL)
+		{
+		    afs_entry_point = SINGLE_ENTRY_POINT3;
+		    afs_syscalls[0] = AFS_SYSCALL3;
+		    goto done;
+		}
 	}
-    }
-#endif
+#endif /* AFS_SYSCALL */
 
- done:
-  (void) signal(SIGSYS, saved_func);
-  errno = saved_errno;
-  return afs_entry_point != NO_ENTRY_POINT;
-#endif /* linux */
+done:
+    signal(SIGSYS, saved_func);
+#endif /* NO_AFS */
+    errno = saved_errno;
+    return afs_entry_point != NO_ENTRY_POINT;
 }
diff --git a/kerberosIV/kafs/afssysdefs.h b/kerberosIV/kafs/afssysdefs.h
index 2920141794e..7aa113d6f78 100644
--- a/kerberosIV/kafs/afssysdefs.h
+++ b/kerberosIV/kafs/afssysdefs.h
@@ -1,29 +1,71 @@
-/*	$Id: afssysdefs.h,v 1.1 1995/12/14 06:52:46 tholo Exp $	*/
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* $Id: afssysdefs.h,v 1.2 1997/11/28 12:48:43 art Exp $ */
 
 /*
  * This section is for machines using single entry point AFS syscalls!
- * or
+ * and/or
  * This section is for machines using multiple entry point AFS syscalls!
+ *
+ * SunOS 4 is an example of single entry point and sgi of multiple
+ * entry point syscalls.
  */
 
-#if defined(sun) && !defined(__svr4__)
+#if SunOS == 4
 #define AFS_SYSCALL	31
 #endif
 
-#if defined(sun) && defined(__svr4__)
+#if SunOS == 5
 #define AFS_SYSCALL	105
 #endif
 
-#if defined(hpux)
+#if defined(__hpux)
 #define AFS_SYSCALL	50
 #define AFS_SYSCALL2	49
+#define AFS_SYSCALL3	48
 #endif
 
 #if defined(_AIX)
 /* _AIX is too weird */
 #endif
 
-#if defined(sgi)
+#if defined(__sgi)
 #define AFS_PIOCTL      (64+1000)
 #define AFS_SETPAG      (65+1000)
 #endif
@@ -32,3 +74,15 @@
 #define AFS_SYSCALL	232
 #define AFS_SYSCALL2	258
 #endif
+
+#if defined(__ultrix)
+#define AFS_SYSCALL	31
+#endif
+
+#if defined(__NetBSD__)
+#define AFS_SYSCALL 210
+#endif
+
+#ifdef SYS_afs_syscall
+#define AFS_SYSCALL3	SYS_afs_syscall
+#endif
diff --git a/kerberosIV/kafs/common.c b/kerberosIV/kafs/common.c
new file mode 100644
index 00000000000..c7f2061a4aa
--- /dev/null
+++ b/kerberosIV/kafs/common.c
@@ -0,0 +1,340 @@
+/* $KTH: common.c,v 1.3 1997/11/03 20:35:24 bg Exp $ */
+
+/*
+ * Copyright (c) 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. All advertising materials mentioning features or use of this software 
+ *    must display the following acknowledgement: 
+ *      This product includes software developed by Kungliga Tekniska 
+ *      Högskolan and its contributors. 
+ *
+ * 4. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "kafs_locl.h"
+
+#define AUTH_SUPERUSER "afs"
+
+/*
+ * Here only ASCII characters are relevant.
+ */
+
+#define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
+
+#define ToAsciiUpper(c) ((c) - 'a' + 'A')
+
+static void
+foldup(char *a, const char *b)
+{
+  for (; *b; a++, b++)
+    if (IsAsciiLower(*b))
+      *a = ToAsciiUpper(*b);
+    else
+      *a = *b;
+  *a = '\0';
+}
+
+int
+kafs_settoken(const char *cell, uid_t uid, CREDENTIALS *c)
+{
+    struct ViceIoctl parms;
+    struct ClearToken ct;
+    int32_t sizeof_x;
+    char buf[2048], *t;
+    int ret;
+    
+    /*
+     * Build a struct ClearToken
+     */
+    ct.AuthHandle = c->kvno;
+    memcpy (ct.HandShakeKey, c->session, sizeof(c->session));
+    ct.ViceId = uid;	/* is this always valid? */
+    ct.BeginTimestamp = 1 + c->issue_date;
+    ct.EndTimestamp = krb_life_to_time(c->issue_date, c->lifetime);
+
+#define ODD(x) ((x) & 1)
+    /* If we don't know the numerical ID lifetime should be even? */
+    if (uid == 0 && ODD(ct.EndTimestamp - ct.BeginTimestamp))
+	ct.BeginTimestamp--;
+
+    t = buf;
+    /*
+     * length of secret token followed by secret token
+     */
+    sizeof_x = c->ticket_st.length;
+    memcpy(t, &sizeof_x, sizeof(sizeof_x));
+    t += sizeof(sizeof_x);
+    memcpy(t, c->ticket_st.dat, sizeof_x);
+    t += sizeof_x;
+    /*
+     * length of clear token followed by clear token
+     */
+    sizeof_x = sizeof(ct);
+    memcpy(t, &sizeof_x, sizeof(sizeof_x));
+    t += sizeof(sizeof_x);
+    memcpy(t, &ct, sizeof_x);
+    t += sizeof_x;
+
+    /*
+     * do *not* mark as primary cell
+     */
+    sizeof_x = 0;
+    memcpy(t, &sizeof_x, sizeof(sizeof_x));
+    t += sizeof(sizeof_x);
+    /*
+     * follow with cell name
+     */
+    sizeof_x = strlen(cell) + 1;
+    memcpy(t, cell, sizeof_x);
+    t += sizeof_x;
+
+    /*
+     * Build argument block
+     */
+    parms.in = buf;
+    parms.in_size = t - buf;
+    parms.out = 0;
+    parms.out_size = 0;
+    ret = k_pioctl(0, VIOCSETTOK, &parms, 0);
+    return ret;
+}
+
+#if 0
+/* Try to get a db-server for an AFS cell from a AFSDB record */
+
+static int
+dns_find_cell(const char *cell, char *dbserver)
+{
+    struct dns_reply *r;
+    int ok = -1;
+    r = dns_lookup(cell, "afsdb");
+    if(r){
+	struct resource_record *rr = r->head;
+	while(rr){
+	    if(rr->type == T_AFSDB && rr->u.afsdb->preference == 1){
+		strncpy(dbserver, rr->u.afsdb->domain, MAXHOSTNAMELEN);
+		dbserver[MaxHostNameLen - 1] = 0;
+		ok = 0;
+		break;
+	    }
+	    rr = rr->next;
+	}
+	dns_free_data(r);
+    }
+    return ok;
+}
+#endif
+
+
+/*
+ * Try to find the cells we should try to klog to in "file".
+ */
+static void
+find_cells(char *file, char ***cells, int *index)
+{
+    FILE *f;
+    char cell[64];
+    int i;
+    f = fopen(file, "r");
+    if (f == NULL)
+	return;
+    while (fgets(cell, sizeof(cell), f)) {
+	char *nl = strchr(cell, '\n');
+	if (nl) *nl = 0;
+	for(i = 0; i < *index; i++)
+	    if(strcmp((*cells)[i], cell) == 0)
+		break;
+	if(i == *index){
+	    *cells = realloc(*cells, (*index + 1) * sizeof(**cells));
+	    (*cells)[(*index)++] = strdup(cell);
+	}
+    }
+    fclose(f);
+}
+
+/*
+ * Get tokens for all cells[]
+ */
+static int
+afslog_cells(kafs_data *data, char **cells, int max, uid_t uid)
+{
+    int ret = 0;
+    int i;
+    for(i = 0; i < max; i++)
+	ret = (*data->afslog_uid)(data, cells[i], uid);
+    return ret;
+}
+
+int
+_kafs_afslog_all_local_cells(kafs_data *data, uid_t uid)
+{
+    int ret;
+    char **cells = NULL;
+    int index = 0;
+
+    char *p;
+    
+    if ((p = getenv("HOME"))) {
+	char home[MAXPATHLEN];
+	snprintf(home, sizeof(home), "%s/.TheseCells", p);
+	find_cells(home, &cells, &index);
+    }
+    find_cells(_PATH_THESECELLS, &cells, &index);
+    find_cells(_PATH_THISCELL, &cells, &index);
+    
+    ret = afslog_cells(data, cells, index, uid);
+    while(index > 0)
+	free(cells[--index]);
+    free(cells);
+    return ret;
+}
+
+
+/* Find the realm associated with cell. Do this by opening
+   /usr/vice/etc/CellServDB and getting the realm-of-host for the
+   first VL-server for the cell.
+
+   This does not work when the VL-server is living in one realm, but
+   the cell it is serving is living in another realm.
+
+   Return 0 on success, -1 otherwise.
+   */
+
+static int
+realm_of_cell(kafs_data *data, const char *cell, char **realm)
+{
+    FILE *F;
+    char buf[1024];
+    char *p;
+    int ret = -1;
+
+    if ((F = fopen(_PATH_CELLSERVDB, "r")))
+      {
+	while (fgets(buf, sizeof(buf), F))
+	  {
+	    if (buf[0] != '>')
+	      continue;		/* Not a cell name line, try next line */
+	    if (strncmp(buf + 1, cell, strlen(cell)) == 0)
+	      {
+		/*
+		 * We found the cell name we're looking for.
+		 * Read next line on the form ip-address '#' hostname
+		 */
+		if (fgets(buf, sizeof(buf), F) == NULL)
+		  break;	/* Read failed, give up */
+		p = strchr(buf, '#');
+		if (p == NULL)
+		  break;	/* No '#', give up */
+		p++;
+		if (buf[strlen(buf) - 1] == '\n')
+		  buf[strlen(buf) - 1] = 0;
+		*realm = (*data->get_realm)(data, p);
+		if (*realm && **realm != 0)
+		  ret = 0;
+		break;		/* Won't try any more */
+	      }
+	  }
+	fclose(F);
+      }
+#if 0
+    if (realm == NULL) {
+	if (dns_find_cell(cell, buf) == 0)
+	    realm = krb_realmofhost(buf);
+    }
+#endif
+    return ret;
+}
+
+int
+_kafs_get_cred(kafs_data *data,
+	      const char *cell, 
+	      const char *krealm, 
+	      const char *lrealm,
+	      CREDENTIALS *c)
+{
+    int ret = -1;
+    char *vl_realm;
+    char CELL[64];
+
+    /* We're about to find the the realm that holds the key for afs in
+     * the specified cell. The problem is that null-instance
+     * afs-principals are common and that hitting the wrong realm might
+     * yield the wrong afs key. The following assumptions were made.
+     *
+     * Any realm passed to us is preferred.
+     *
+     * If there is a realm with the same name as the cell, it is most
+     * likely the correct realm to talk to.
+     *
+     * In most (maybe even all) cases the database servers of the cell
+     * will live in the realm we are looking for.
+     *
+     * Try the local realm, but if the previous cases fail, this is
+     * really a long shot.
+     *
+     */
+  
+    /* comments on the ordering of these tests */
+
+    /* If the user passes a realm, she probably knows something we don't
+     * know and we should try afs@krealm (otherwise we're talking with a
+     * blondino and she might as well have it.)
+     */
+  
+    if (krealm) {
+	ret = (*data->get_cred)(data, AUTH_SUPERUSER, cell, krealm, c);
+	if (ret == 0) return 0;
+	ret = (*data->get_cred)(data, AUTH_SUPERUSER, "", krealm, c);
+    }
+    if (ret == 0) return 0;
+
+    foldup(CELL, cell);
+
+    ret = (*data->get_cred)(data, AUTH_SUPERUSER, cell, CELL, c);
+    if (ret == 0) return 0;
+
+    ret = (*data->get_cred)(data, AUTH_SUPERUSER, "", CELL, c);
+    if (ret == 0) return 0;
+    
+    /* this might work in some cases */
+    if (realm_of_cell(data, cell, &vl_realm) == 0) {
+	ret = (*data->get_cred)(data, AUTH_SUPERUSER, cell, vl_realm, c);
+	if (ret)
+	    ret = (*data->get_cred)(data, AUTH_SUPERUSER, "", vl_realm, c);
+	free(vl_realm);
+	if (ret == 0) return 0;
+    }
+    
+    if (lrealm)
+	ret = (*data->get_cred)(data, AUTH_SUPERUSER, cell, lrealm, c);
+    return ret;
+}
+
+
diff --git a/kerberosIV/kafs/shlib_version b/kerberosIV/kafs/shlib_version
index d9961ea9fef..3066b9771e7 100644
--- a/kerberosIV/kafs/shlib_version
+++ b/kerberosIV/kafs/shlib_version
@@ -1,2 +1,2 @@
-major=4
+major=5
 minor=0
diff --git a/kerberosIV/kdb/kdb_locl.h b/kerberosIV/kdb/kdb_locl.h
index 0ea18e9e41b..2aa6670ab75 100644
--- a/kerberosIV/kdb/kdb_locl.h
+++ b/kerberosIV/kdb/kdb_locl.h
@@ -1,4 +1,43 @@
-/*	$Id: kdb_locl.h,v 1.1 1995/12/14 06:52:37 tholo Exp $	*/
+/*	$Id: kdb_locl.h,v 1.2 1997/11/28 12:48:45 art Exp $	*/
+/*      $KTH: kdb_locl.h,v 1.9 1997/05/02 14:29:08 assar Exp $          */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
 
 #ifndef __kdb_locl_h
 #define __kdb_locl_h
diff --git a/kerberosIV/kerberos/Makefile b/kerberosIV/kerberos/Makefile
index 455fe5ad922..8b16fd72bcc 100644
--- a/kerberosIV/kerberos/Makefile
+++ b/kerberosIV/kerberos/Makefile
@@ -1,9 +1,11 @@
 #	from @(#)Makefile	8.1 (Berkeley) 6/1/93
-#	$Id: Makefile,v 1.1 1995/12/14 06:52:52 tholo Exp $
+#	$Id: Makefile,v 1.2 1997/11/28 12:48:46 art Exp $
 
 PROG=	kerberos
 DPADD=	${LIBKDB} ${LIBKRB} ${LIBDES}
 LDADD=	-lkdb -lkrb -ldes
 MAN=	kerberos.8
 
+CFLAGS+=-I${.CURDIR}
+
 .include <bsd.prog.mk>
diff --git a/kerberosIV/kerberos/kerberos.c b/kerberosIV/kerberos/kerberos.c
index 9d0dbe42550..7f66aa55e65 100644
--- a/kerberosIV/kerberos/kerberos.c
+++ b/kerberosIV/kerberos/kerberos.c
@@ -1,103 +1,73 @@
-/*	$Id: kerberos.c,v 1.5 1997/06/29 10:32:14 provos Exp $	*/
+/* $KTH: kerberos.c,v 1.70 1997/09/26 18:06:38 joda Exp $ */
 
-/*-
- * Copyright 1987, 1988 by the Student Information Processing Board
- *	of the Massachusetts Institute of Technology
+
+/*
+ * Copyright 1985, 1986, 1987, 1988 by the Massachusetts Institute
+ * of Technology.
  *
- * Permission to use, copy, modify, and distribute this software
- * and its documentation for any purpose and without fee is
- * hereby granted, provided that the above copyright notice
- * appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation,
- * and that the names of M.I.T. and the M.I.T. S.I.P.B. not be
- * used in advertising or publicity pertaining to distribution
- * of the software without specific, written prior permission.
- * M.I.T. and the M.I.T. S.I.P.B. make no representations about
- * the suitability of this software for any purpose.  It is
- * provided "as is" without express or implied warranty.
+ * For copying and distribution information, please see the file
+ * <mit-copyright.h>.
  */
 
-#include "kerberosIV/site.h"
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
 
 #include <sys/types.h>
-
 #include <sys/time.h>
 #include <time.h>
-
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/ioctl.h>
-
+#include <sys/select.h>
 #include <errno.h>
 #include <unistd.h>
-
+#include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include <sys/socket.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/filio.h>
 
 #include <netdb.h>
+#include <stdarg.h>
+#include <err.h>
 
 #include <des.h>
 #include <kerberosIV/krb.h>
 #include <kerberosIV/krb_db.h>
-
 #include <prot.h>
-#include <klog.h>
-#include <kdc.h>
+#include "klog.h"
 
-static struct sockaddr_in sina = {AF_INET};
-int     f;
-
-/* XXX several files in libkdb know about this */
-char *progname;
+#include "version.h"
+#include "krb_log.h"
+#include "kdc.h"
 
 static des_key_schedule master_key_schedule;
 static des_cblock master_key;
 
 static struct timeval kerb_time;
-static Principal a_name_data;	/* for requesting user */
-static Principal s_name_data;	/* for services requested */
-static des_cblock session_key;
 static u_char master_key_version;
 static char k_instance[INST_SZ];
 static char *lt;
 static int more;
 
 static int mflag;		/* Are we invoked manually? */
-static int lflag;		/* Have we set an alterate log file? */
-static char *log_file;		/* name of alt. log file */
+static char *log_file = KRBLOG;	/* name of alt. log file */
 static int nflag;		/* don't check max age */
 static int rflag;		/* alternate realm specified */
 
 /* fields within the received request packet */
-static u_char req_msg_type;
-static u_char req_version;
 static char *req_name_ptr;
 static char *req_inst_ptr;
 static char *req_realm_ptr;
-static u_long req_time_ws;
-
-int req_act_vno = KRB_PROT_VERSION; /* Temporary for version skew */
+static u_int32_t req_time_ws;
 
 static char local_realm[REALM_SZ];
 
-/* statistics */
-static int q_bytes;		/* current bytes remaining in queue */
-static int q_n;		/* how many consecutive non-zero
-				 * q_bytes   */
-static int max_q_bytes;
-static int max_q_n;
-static int n_auth_req;
-static int n_appl_req;
-static int n_packets;
-
+/* options */
 static int max_age = -1;
 static int pause_int = -1;
+static char progname[]="kerberos";
 
 /*
  * Print usage message and exit.
@@ -105,31 +75,31 @@ static int pause_int = -1;
 static void
 usage(void)
 {
-    fprintf(stderr, "Usage: %s [-s] [-m] [-n] [-p pause_seconds]%s%s\n", progname, 
-	    " [-a max_age] [-l log_file] [-r realm]"
-	    ," [database_pathname]"
-	    );
+    fprintf(stderr, "Usage: %s [-s] [-m] [-n] [-p pause_seconds]"
+	    " [-a max_age] [-l log_file] [-i address_to_listen_on]"
+	    " [-r realm] [database_pathname]\n",
+	    progname);
     exit(1);
 }
 
 /*
- * kerb_er_reply creates an error reply packet and sends it to the
+ * kerb_err_reply creates an error reply packet and sends it to the
  * client. 
  */
 
 static void
-kerb_err_reply(struct sockaddr_in *client, KTEXT pkt, long int err, char *string)
+kerb_err_reply(int f, struct sockaddr_in *client, int err, char *string)
 {
     static KTEXT_ST e_pkt_st;
     KTEXT   e_pkt = &e_pkt_st;
     static char e_msg[128];
 
-    bzero(e_msg, sizeof e_msg);
     strcpy(e_msg, "\nKerberos error -- ");
     strcat(e_msg, string);
     cr_err_reply(e_pkt, req_name_ptr, req_inst_ptr, req_realm_ptr,
 		 req_time_ws, err, e_msg);
-    sendto(f, e_pkt->dat, e_pkt->length, 0, (struct sockaddr*)client, S_AD_SZ);
+    sendto(f, (char*)e_pkt->dat, e_pkt->length, 0, (struct sockaddr *)client,
+	   sizeof(*client));
 }
 
 static void
@@ -141,9 +111,9 @@ hang(void)
 	    pause();
     } else {
 	char buf[256];
-	(void) snprintf(buf, sizeof(buf),
-	    "Kerberos will wait %d seconds before dying so as not to loop init",
-	    pause_int);
+	snprintf(buf, sizeof(buf),
+		 "Kerberos will wait %d seconds before dying so as not to loop init",
+		 pause_int);
 	klog(L_KRB_PERR, buf);
 	sleep(pause_int);
 	klog(L_KRB_PERR, "Do svedania....\n");
@@ -151,29 +121,6 @@ hang(void)
     }
 }
 
-/*
- * Given a pointer to a long containing the number of seconds
- * since the beginning of time (midnight 1 Jan 1970 GMT), return
- * a string containing the local time in the form:
- *
- * "25-Jan-88 10:17:56"
- */
-
-static char *
-strtime(time_t *t)
-{
-    static char st_data[40];
-    static char *st = st_data;
-    struct tm *tm;
-    char *month_sname(int n);
-
-    tm = localtime(t);
-    (void) snprintf(st, sizeof(st_data), "%2d-%s-%02d %02d:%02d:%02d",
-		    tm->tm_mday, month_sname(tm->tm_mon + 1), tm->tm_year,
-                    tm->tm_hour, tm->tm_min, tm->tm_sec);
-    return st;
-}
-
 static int
 check_princ(char *p_name, char *instance, unsigned int lifetime, Principal *p)
 {
@@ -181,9 +128,6 @@ check_princ(char *p_name, char *instance, unsigned int lifetime, Principal *p)
     static int more;
 
     n = kerb_get_principal(p_name, instance, p, 1, &more);
-    klog(L_ALL_REQ,
-	 "Principal: \"%s\", Instance: \"%s\" Lifetime = %d n = %d",
-	 p_name, instance, lifetime, n, 0);
     
     if (n < 0) {
 	lt = klog(L_KRB_PERR, "Database unavailable!");
@@ -197,43 +141,47 @@ check_princ(char *p_name, char *instance, unsigned int lifetime, Principal *p)
      */
     if (n == 0) {
 	/* service unknown, log error, skip to next request */
-	lt = klog(L_ERR_UNK, "UNKNOWN \"%s\" \"%s\"", p_name,
-	    instance, 0);
+	lt = klog(L_ERR_UNK, "UNKNOWN %s.%s", p_name, instance);
 	return KERB_ERR_PRINCIPAL_UNKNOWN;
     }
     if (more) {
 	/* not unique, log error */
-	lt = klog(L_ERR_NUN, "Principal NOT UNIQUE \"%s\" \"%s\"",
-		  p_name, instance, 0);
+	lt = klog(L_ERR_NUN, "Principal not unique %s.%s", p_name, instance);
 	return KERB_ERR_PRINCIPAL_NOT_UNIQUE;
     }
     /* If the user's key is null, we want to return an error */
     if ((p->key_low == 0) && (p->key_high == 0)) {
 	/* User has a null key */
-	lt = klog(L_ERR_NKY, "Null key \"%s\" \"%s\"", p_name,
-	    instance, 0);
+	lt = klog(L_ERR_NKY, "Null key %s.%s", p_name, instance);
 	return KERB_ERR_NULL_KEY;
     }
     if (master_key_version != p->kdc_key_ver) {
 	/* log error reply */
 	lt = klog(L_ERR_MKV,
-	    "Key vers incorrect, KRB = %d, \"%s\" \"%s\" = %d",
-	    master_key_version, p->name, p->instance, p->kdc_key_ver,
-	    0);
+		  "Incorrect master key version for %s.%s: %d (should be %d)",
+		  p->name, p->instance, p->kdc_key_ver, master_key_version);
 	return KERB_ERR_NAME_MAST_KEY_VER;
     }
     /* make sure the service hasn't expired */
-    if ((u_long) p->exp_date < (u_long) kerb_time.tv_sec) {
+    if ((u_int32_t) p->exp_date < (u_int32_t) kerb_time.tv_sec) {
 	/* service did expire, log it */
+	time_t t = p->exp_date;
 	lt = klog(L_ERR_SEXP,
-	    "EXPIRED \"%s\" \"%s\"  %s", p->name, p->instance,
-	     strtime((time_t*)&(p->exp_date)), 0);
+		  "Principal %s.%s expired at %s", p->name, p->instance,
+		  krb_stime(&t));
 	return KERB_ERR_NAME_EXP;
     }
     /* ok is zero */
     return 0;
 }
 
+static void
+unseal(des_cblock *key)
+{
+    kdb_encrypt_key(key, key, &master_key, master_key_schedule, DES_DECRYPT);
+}
+
+
 /* Set the key for krb_rd_req so we can check tgt */
 static int
 set_tgtkey(char *r)
@@ -248,315 +196,236 @@ set_tgtkey(char *r)
     if (!strcmp(lastrealm, r))
 	return (KSUCCESS);
 
-    log("Getting key for %s", r);
+    klog(L_ALL_REQ, "Getting key for %s", r);
 
-    n = kerb_get_principal("krbtgt", r, p, 1, &more);
+    n = kerb_get_principal(KRB_TICKET_GRANTING_TICKET, r, p, 1, &more);
     if (n == 0)
 	return (KFAILURE);
 
     /* unseal tgt key from master key */
-    bcopy(&p->key_low, key, 4);
-    bcopy(&p->key_high, ((long *) key) + 1, 4);
-    kdb_encrypt_key(&key, &key, &master_key,
-		    master_key_schedule, DES_DECRYPT);
+    copy_to_key(&p->key_low, &p->key_high, key);
+    unseal(&key);
     krb_set_key(key, 0);
     strcpy(lastrealm, r);
     return (KSUCCESS);
 }
 
-static void
-kerberos(struct sockaddr_in *client, KTEXT pkt)
-{
-    static KTEXT_ST rpkt_st;
-    KTEXT   rpkt = &rpkt_st;
-    static KTEXT_ST ciph_st;
-    KTEXT   ciph = &ciph_st;
-    static KTEXT_ST tk_st;
-    KTEXT   tk = &tk_st;
-    static KTEXT_ST auth_st;
-    KTEXT   auth = &auth_st;
-    AUTH_DAT ad_st;
-    AUTH_DAT *ad = &ad_st;
-
-
-    static struct in_addr client_host;
-    static int msg_byte_order;
-    static int swap_bytes;
-    static u_char k_flags;
-    u_long  lifetime;
-    int     i;
-    des_cblock key;
-    des_key_schedule key_s;
-    char   *ptr;
-
-
-
-    ciph->length = 0;
 
-    client_host = client->sin_addr;
-
-    /* eval macros and correct the byte order and alignment as needed */
-    req_version = pkt_version(pkt);	/* 1 byte, version */
-    req_msg_type = pkt_msg_type(pkt);	/* 1 byte, Kerberos msg type */
-
-    req_act_vno = req_version;
-
-    /* check packet version */
-    if (req_version != KRB_PROT_VERSION) {
-	lt = klog(L_KRB_PERR,
-	"KRB prot version mismatch: KRB =%d request = %d",
-		  KRB_PROT_VERSION, req_version, 0);
-	/* send an error reply */
-	kerb_err_reply(client, pkt, KERB_ERR_PKT_VER, lt);
-	return;
-    }
-    msg_byte_order = req_msg_type & 1;
-
-    swap_bytes = 0;
-    if (msg_byte_order != HOST_BYTE_ORDER) {
-	swap_bytes++;
+static int
+kerberos(unsigned char *buf, int len,
+	 char *proto, struct sockaddr_in *client,
+	 struct sockaddr_in *server,
+	 KTEXT rpkt)
+{
+    int pvno;
+    int msg_type;
+    int lsb;
+    int life;
+    int flags = 0;
+    char name[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
+    char service[SNAME_SZ], sinst[INST_SZ];
+    u_int32_t req_time;
+    static KTEXT_ST ticket, cipher, adat;
+    KTEXT tk = &ticket, ciph = &cipher, auth = &adat;
+    AUTH_DAT ad;
+    des_cblock session, key;
+    int err;
+    Principal a_name, s_name;
+    
+    char *msg;
+    
+    
+    unsigned char *p = buf;
+    if(len < 2){
+	strcpy((char*)rpkt->dat, "Packet too short");
+	return KFAILURE;
     }
-    klog(L_KRB_PINFO,
-	"Prot version: %d, Byte order: %d, Message type: %d",
-	 req_version, msg_byte_order, req_msg_type);
 
-    switch (req_msg_type & ~1) {
+    gettimeofday(&kerb_time, NULL);
 
+    pvno = *p++;
+    if(pvno != KRB_PROT_VERSION){
+	msg = klog(L_KRB_PERR, "KRB protocol version mismatch (%d)", pvno);
+	strcpy((char*)rpkt->dat, msg);
+	return KERB_ERR_PKT_VER;
+    }
+    msg_type = *p++;
+    lsb = msg_type & 1;
+    msg_type &= ~1;
+    switch(msg_type){
     case AUTH_MSG_KDC_REQUEST:
+	/* XXX range check */
+	p += krb_get_nir(p, name, inst, realm);
+	p += krb_get_int(p, &req_time, 4, lsb);
+	life = *p++;
+	p += krb_get_nir(p, service, sinst, NULL);
+	klog(L_INI_REQ,
+	     "AS REQ %s.%s@%s for %s.%s from %s (%s/%u)", 
+	     name, inst, realm, service, sinst,
+	     inet_ntoa(client->sin_addr),
+	     proto, ntohs(server->sin_port));
+	if((err = check_princ(name, inst, 0, &a_name))){
+	    strcpy((char*)rpkt->dat, krb_get_err_text(err));
+	    return err;
+	}
+	tk->length = 0;
+	if((err = check_princ(service, sinst, 0, &s_name))){
+	    strcpy((char*)rpkt->dat, krb_get_err_text(err));
+	    return err;
+	}
+	life = min(life, s_name.max_life);
+	life = min(life, a_name.max_life);
+    
+	des_new_random_key(&session);
+	copy_to_key(&s_name.key_low, &s_name.key_high, key);
+	unseal(&key);
+	krb_create_ticket(tk, flags, a_name.name, a_name.instance, 
+			  local_realm, client->sin_addr.s_addr,
+			  session, 
+			  life, kerb_time.tv_sec, 
+			  s_name.name, s_name.instance, &key);
+	copy_to_key(&a_name.key_low, &a_name.key_high, key);
+	unseal(&key);
+	create_ciph(ciph, session, s_name.name, s_name.instance,
+		    local_realm, life, s_name.key_version, tk, 
+		    kerb_time.tv_sec, &key);
+	memset(&session, 0, sizeof(session));
+	memset(&key, 0, sizeof(key));
 	{
-	    u_long  req_life;	/* Requested liftime */
-	    char   *service;	/* Service name */
-	    char   *instance;	/* Service instance */
-
-	    n_auth_req++;
-	    tk->length = 0;
-	    k_flags = 0;	/* various kerberos flags */
-
-
-	    /* set up and correct for byte order and alignment */
-	    req_name_ptr = (char *) pkt_a_name(pkt);
-	    req_inst_ptr = (char *) pkt_a_inst(pkt);
-	    req_realm_ptr = (char *) pkt_a_realm(pkt);
-	    bcopy(pkt_time_ws(pkt), &req_time_ws, sizeof(req_time_ws));
-	    /* time has to be diddled */
-	    if (swap_bytes) {
-		swap_u_long(req_time_ws);
-	    }
-	    ptr = (char *) pkt_time_ws(pkt) + 4;
-
-	    req_life = (unsigned char) (*ptr++);
-
-	    service = ptr;
-	    instance = ptr + strlen(service) + 1;
-
-	    rpkt = &rpkt_st;
-	    klog(L_INI_REQ,
-	    "Initial ticket request Host: %s User: \"%s\" \"%s\"",
-	       inet_ntoa(client_host), req_name_ptr, req_inst_ptr, 0);
-
-	    if ((i = check_princ(req_name_ptr, req_inst_ptr, 0,
-		&a_name_data))) {
-		kerb_err_reply(client, pkt, i, lt);
-		return;
-	    }
-	    tk->length = 0;	/* init */
-	    if (strcmp(service, "krbtgt"))
-		klog(L_NTGT_INTK,
-		    "INITIAL request from %s.%s for %s.%s",
-		     req_name_ptr, req_inst_ptr, service, instance, 0);
-	    /* this does all the checking */
-	    if ((i = check_princ(service, instance, 0,
-		&s_name_data))) {
-		kerb_err_reply(client, pkt, i, lt);
-		return;
-	    }
-	    /* Bound requested lifetime with service and user */
-	    lifetime = min(req_life, ((u_long) s_name_data.max_life));
-	    lifetime = min(lifetime, ((u_long) a_name_data.max_life));
-
-#ifdef NOENCRYPTION
-	    bzero(session_key, sizeof(des_cblock));
-#else
-	    des_new_random_key(&session_key);
-#endif
-	    /* unseal server's key from master key */
-	    bcopy(&s_name_data.key_low, key, 4);
-	    bcopy(&s_name_data.key_high, ((long *) key) + 1, 4);
-	    kdb_encrypt_key(&key, &key, &master_key,
-			    master_key_schedule, DES_DECRYPT);
-	    /* construct and seal the ticket */
-	    krb_create_ticket(tk, k_flags, a_name_data.name,
-		a_name_data.instance, local_realm,
-		 client_host.s_addr, session_key, lifetime, kerb_time.tv_sec,
-			 s_name_data.name, s_name_data.instance, &key);
-	    bzero(key, sizeof(key));
-	    bzero(key_s, sizeof(key_s));
-
-	    /*
-	     * get the user's key, unseal it from the server's key, and
-	     * use it to seal the cipher 
-	     */
-
-	    /* a_name_data.key_low a_name_data.key_high */
-	    bcopy(&a_name_data.key_low, key, 4);
-	    bcopy(&a_name_data.key_high, ((long *) key) + 1, 4);
-
-	    /* unseal the a_name key from the master key */
-	    kdb_encrypt_key(&key, &key, &master_key, 
-			    master_key_schedule, DES_DECRYPT);
-
-	    create_ciph(ciph, session_key, s_name_data.name,
-			s_name_data.instance, local_realm, lifetime,
-		  s_name_data.key_version, tk, kerb_time.tv_sec, &key);
-
-	    /* clear session key */
-	    bzero(session_key, sizeof(session_key));
-
-	    bzero(key, sizeof(key));
-
-
-
-	    /* always send a reply packet */
-	    rpkt = create_auth_reply(req_name_ptr, req_inst_ptr,
-		req_realm_ptr, req_time_ws, 0, a_name_data.exp_date,
-		a_name_data.key_version, ciph);
-	    sendto(f, rpkt->dat, rpkt->length, 0, (struct sockaddr*)client, S_AD_SZ);
-	    bzero(&a_name_data, sizeof(a_name_data));
-	    bzero(&s_name_data, sizeof(s_name_data));
-	    break;
+	    KTEXT r;
+	    r = create_auth_reply(name, inst, realm, req_time, 0, 
+				  a_name.exp_date, a_name.key_version, ciph);
+	    memcpy(rpkt, r, sizeof(*rpkt));
 	}
+	return 0;
     case AUTH_MSG_APPL_REQUEST:
-	{
-	    u_long  time_ws;	/* Workstation time */
-	    u_long  req_life;	/* Requested liftime */
-	    char   *service;	/* Service name */
-	    char   *instance;	/* Service instance */
-	    int     kerno;	/* Kerberos error number */
-	    char    tktrlm[REALM_SZ];
-
-	    n_appl_req++;
-	    tk->length = 0;
-	    k_flags = 0;	/* various kerberos flags */
-
-	    auth->length = 4 + strlen((char*)pkt->dat + 3);
-	    auth->length += (int) *(pkt->dat + auth->length) +
-		(int) *(pkt->dat + auth->length + 1) + 2;
-
-	    bcopy(pkt->dat, auth->dat, auth->length);
-
-	    strncpy(tktrlm, (char*)(auth->dat + 3), REALM_SZ);
-	    if (set_tgtkey(tktrlm)) {
-		lt = klog(L_ERR_UNK,
-		    "FAILED realm %s unknown. Host: %s ",
-			  tktrlm, inet_ntoa(client_host));
-		kerb_err_reply(client, pkt, kerno, lt);
-		return;
-	    }
-	    kerno = krb_rd_req(auth, "ktbtgt", tktrlm, client_host.s_addr,
-		ad, 0);
-
-	    if (kerno) {
-		klog(L_ERR_UNK, "FAILED krb_rd_req from %s: %s",
-		     inet_ntoa(client_host), krb_err_txt[kerno]);
-		kerb_err_reply(client, pkt, kerno, "krb_rd_req failed");
-		return;
-	    }
-	    ptr = (char *) pkt->dat + auth->length;
-
-	    bcopy(ptr, &time_ws, 4);
-	    ptr += 4;
-
-	    req_life = (unsigned char) (*ptr++);
-
-	    service = ptr;
-	    instance = ptr + strlen(service) + 1;
+	strcpy(realm, (char*)buf + 3);
+	if((err = set_tgtkey(realm))){
+	    msg = klog(L_ERR_UNK,
+		       "Unknown realm %s from %s (%s/%u)", 
+		       realm, inet_ntoa(client->sin_addr),
+		       proto, ntohs(server->sin_port));
+	    strcpy((char*)rpkt->dat, msg);
+	    return err;
+	}
+	p = buf + strlen(realm) + 4;
+	p = p + p[0] + p[1] + 2;
+	auth->length = p - buf;
+	memcpy(auth->dat, buf, auth->length);
+	err = krb_rd_req(auth, KRB_TICKET_GRANTING_TICKET,
+			 realm, client->sin_addr.s_addr, &ad, 0);
+	if(err){
+	    msg = klog(L_ERR_UNK,
+		       "krb_rd_req from %s (%s/%u): %s", 
+		       inet_ntoa(client->sin_addr),
+		       proto,
+		       ntohs(server->sin_port),
+		       krb_get_err_text(err));
+	    strcpy((char*)rpkt->dat, msg);
+	    return err;
+	}
+	p += krb_get_int(p, &req_time, 4, lsb);
+	life = *p++;
+	p += krb_get_nir(p, service, sinst, NULL);
+	klog(L_APPL_REQ,
+	     "APPL REQ %s.%s@%s for %s.%s from %s (%s/%u)",
+	     ad.pname, ad.pinst, ad.prealm,
+	     service, sinst,
+	     inet_ntoa(client->sin_addr),
+	     proto,
+	     ntohs(server->sin_port));
+
+	if(strcmp(ad.prealm, realm)){
+	    msg = klog(L_ERR_UNK, "Can't hop realms: %s -> %s", 
+		       realm, ad.prealm);
+	    strcpy((char*)rpkt->dat, msg);
+	    return KERB_ERR_PRINCIPAL_UNKNOWN;
+	}
 
-	    klog(L_APPL_REQ, "APPL Request %s.%s@%s on %s for %s.%s",
-	     ad->pname, ad->pinst, ad->prealm, inet_ntoa(client_host),
-		 service, instance, 0);
+	if(!strcmp(service, "changepw")){
+	    strcpy((char*)rpkt->dat, 
+		   "Can't authorize password changed based on TGT");
+	    return KERB_ERR_PRINCIPAL_UNKNOWN;
+	}
 
-	    if (strcmp(ad->prealm, tktrlm)) {
-		kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN,
-		     "Can't hop realms");
-		return;
-	    }
-	    if (!strcmp(service, "changepw")) {
-		kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN,
-		     "Can't authorize password changed based on TGT");
-		return;
-	    }
-	    kerno = check_princ(service, instance, req_life,
-		&s_name_data);
-	    if (kerno) {
-		kerb_err_reply(client, pkt, kerno, lt);
-		return;
-	    }
-	    /* Bound requested lifetime with service and user */
-	    lifetime = min(req_life,
-	      krb_time_to_life(kerb_time.tv_sec,krb_life_to_time(ad->time_sec,ad->life)));
-	    lifetime = min(lifetime, ((u_long) s_name_data.max_life));
-
-	    /* unseal server's key from master key */
-	    bcopy(&s_name_data.key_low, key, 4);
-	    bcopy(&s_name_data.key_high, ((long *) key) + 1, 4);
-	    kdb_encrypt_key(&key, &key, &master_key,
-			    master_key_schedule, DES_DECRYPT);
-	    /* construct and seal the ticket */
-
-#ifdef NOENCRYPTION
-	    bzero(session_key, sizeof(des_cblock));
-#else
-	    des_new_random_key(&session_key);
-#endif
-
-	    krb_create_ticket(tk, k_flags, ad->pname, ad->pinst,
-			      ad->prealm, client_host.s_addr,
-			      session_key, lifetime, kerb_time.tv_sec,
-			      s_name_data.name, s_name_data.instance,
-			      &key);
-	    bzero(key, sizeof(key));
-	    bzero(key_s, sizeof(key_s));
-
-	    create_ciph(ciph, session_key, service, instance,
-			local_realm,
-			lifetime, s_name_data.key_version, tk,
-			kerb_time.tv_sec, &ad->session);
-
-	    /* clear session key */
-	    bzero(session_key, sizeof(session_key));
-
-	    bzero(ad->session, sizeof(ad->session));
-
-	    rpkt = create_auth_reply(ad->pname, ad->pinst,
-				     ad->prealm, time_ws,
-				     0, 0, 0, ciph);
-	    sendto(f, rpkt->dat, rpkt->length, 0, (struct sockaddr*)client, S_AD_SZ);
-	    bzero(&s_name_data, sizeof(s_name_data));
-	    break;
+	err = check_princ(service, sinst, life, &s_name);
+	if(err){
+	    strcpy((char*)rpkt->dat, krb_get_err_text(err));
+	    return err;
 	}
+	life = min(life, 
+		   krb_time_to_life(kerb_time.tv_sec, 
+				    krb_life_to_time(ad.time_sec, 
+						     ad.life)));
+	life = min(life, s_name.max_life);
+	copy_to_key(&s_name.key_low, &s_name.key_high, key);
+	unseal(&key);
+	des_new_random_key(&session);
+	krb_create_ticket(tk, flags, ad.pname, ad.pinst, ad.prealm,
+			  client->sin_addr.s_addr, &session,
+			  life, kerb_time.tv_sec,
+			  s_name.name, s_name.instance,
+			  &key);
+	
+	memset(&key, 0, sizeof(key));
 
+	create_ciph(ciph, session, service, sinst, local_realm,
+		    life, s_name.key_version, tk,
+		    kerb_time.tv_sec, &ad.session);
 
-#ifdef notdef_DIE
-    case AUTH_MSG_DIE:
+	memset(&session, 0, sizeof(session));
+	memset(ad.session, 0, sizeof(ad.session));
 	{
-	    lt = klog(L_DEATH_REQ,
-	        "Host: %s User: \"%s\" \"%s\" Kerberos killed",
-	        inet_ntoa(client_host), req_name_ptr, req_inst_ptr, 0);
-	    exit(0);
+	    KTEXT r;
+	    r =create_auth_reply(ad.pname, ad.pinst, ad.prealm, 
+				 req_time, 0, 0, 0, ciph);
+	    memcpy(rpkt, r, sizeof(*rpkt));
 	}
-#endif /* notdef_DIE */
-
+	memset(&s_name, 0, sizeof(s_name));
+	return 0;
+	
+    case AUTH_MSG_ERR_REPLY:
+	return -1;
     default:
-	{
-	    lt = klog(L_KRB_PERR,
-		"Unknown message type: %d from %s port %u",
-		req_msg_type, inet_ntoa(client_host),
-		ntohs(client->sin_port));
-	    break;
-	}
+	msg = klog(L_KRB_PERR,
+		   "Unknown message type: %d from %s (%s/%u)", 
+		   msg_type,
+		   inet_ntoa(client->sin_addr),
+		   proto,
+		   ntohs(server->sin_port));
+	strcpy((char*)rpkt->dat, msg);
+	return KFAILURE;
+    }
+}
+
+
+static void
+kerberos_wrap(int s, KTEXT data, char *proto, struct sockaddr_in *client, 
+	      struct sockaddr_in *server)
+{
+    KTEXT_ST pkt;
+    int http_flag = strcmp(proto, "http") == 0;
+    int err = kerberos(data->dat, data->length, proto, client, server, &pkt);
+    if(err == -1)
+	return;
+    if(http_flag){
+	const char *msg = 
+	    "HTTP/1.1 200 OK\r\n"
+	    "Server: KTH-KRB/" VERSION "\r\n"
+	    "Content-type: application/octet-stream\r\n"
+	    "Content-transfer-encoding: binary\r\n\r\n";
+	sendto(s, msg, strlen(msg), 0, (struct sockaddr *)client,
+	       sizeof(*client));
+    }
+    if(err){
+	kerb_err_reply(s, client, err, (char*)pkt.dat);
+	return;
     }
+    sendto(s, pkt.dat, pkt.length, 0, (struct sockaddr *)client,
+	   sizeof(*client));
 }
 
+
 /*
  * setup_disc 
  *
@@ -570,16 +439,16 @@ setup_disc(void)
     int     s;
 
     for (s = 0; s < 3; s++) {
-	(void) close(s);
+	close(s);
     }
 
-    (void) open("/dev/null", 0);
-    (void) dup2(0, 1);
-    (void) dup2(0, 2);
+    open("/dev/null", 0);
+    dup2(0, 1);
+    dup2(0, 2);
 
     setsid();
 
-    (void) chdir("/tmp");
+    chdir("/tmp");
     return;
 }
 
@@ -589,7 +458,8 @@ setup_disc(void)
  * Exit if it is; we don't want to tell lies.
  */
 
-static void check_db_age(void)
+static void
+check_db_age(void)
 {
     long age;
     
@@ -609,25 +479,159 @@ static void check_db_age(void)
     }
 }
 
+struct descr{
+    int s;
+    KTEXT_ST buf;
+    int type;
+    int timeout;
+    struct sockaddr_in addr;
+};
+
+static void
+mksocket(struct descr *d, struct in_addr addr, int type, 
+	 const char *service, int port)
+{
+    int     on = 1;
+    int sock;
+
+    memset(d, 0, sizeof(struct descr));
+    if ((sock = socket(AF_INET, type, 0)) < 0)
+	err (1, "socket");
+    if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
+		   sizeof(on)) < 0)
+	warn ("setsockopt (SO_REUSEADDR)");
+    memset(&d->addr, 0, sizeof(d->addr));
+    d->addr.sin_family = AF_INET;
+    d->addr.sin_port   = port;
+    d->addr.sin_addr   = addr;
+    if (bind(sock, (struct sockaddr *)&d->addr, sizeof(d->addr)) < 0)
+	err (1, "bind '%s/%s' (%d)",
+	     service, (type == SOCK_DGRAM) ? "udp" : "tcp",
+	     ntohs(d->addr.sin_port));
+    
+    if(type == SOCK_STREAM)
+	listen(sock, SOMAXCONN);
+    d->s = sock;
+    d->type = type;
+}
+
+
+static void loop(struct descr *fds, int maxfd);
+
+struct port_spec {
+    int port;
+    int type;
+};
+
+static int
+add_port(struct port_spec **ports, int *num_ports, int port, int type)
+{
+    struct port_spec *tmp;
+    tmp = realloc(*ports, (*num_ports + 1) * sizeof(*tmp));
+    if(tmp == NULL)
+	return ENOMEM;
+    *ports = tmp;
+    tmp[*num_ports].port = port;
+    tmp[*num_ports].type = type;
+    (*num_ports)++;
+    return 0;
+}
+
+void make_sockets(char *port_spec, struct in_addr *i_addr, 
+		  struct descr **fds, int *nfds)
+{
+    int tp;
+    struct in_addr *a;
+    char *p, *q, *pos = NULL;
+    struct servent *sp;
+    struct port_spec *ports = NULL;
+    int num_ports = 0;
+    int i, j;
+    
+
+    for(p = strtok_r(port_spec, " \t", &pos); 
+	p; 
+	p = strtok_r(NULL, " \t", &pos)){
+	if(strcmp(p, "+") == 0){
+	    add_port(&ports, &num_ports, 88, SOCK_DGRAM);
+	    add_port(&ports, &num_ports, 88, SOCK_STREAM);
+	    add_port(&ports, &num_ports, 750, SOCK_DGRAM);
+	    add_port(&ports, &num_ports, 750, SOCK_STREAM);
+	}else{
+	    q = strchr(p, '/');
+	    if(q){
+		*q = 0;
+		q++;
+	    }
+	    sp = getservbyname(p, q);
+	    if(sp)
+		tp = ntohs(sp->s_port);
+	    else if(sscanf(p, "%d", &tp) != 1) {
+		warnx("Unknown port: %s%s%s", p, q ? "/" : "", q ? q : "");
+		continue;
+	    }
+	    if(q){
+		if(strcasecmp(q, "tcp") == 0)
+		    add_port(&ports, &num_ports, tp, SOCK_STREAM);
+		else if(strcasecmp(q, "udp") == 0)
+		    add_port(&ports, &num_ports, tp, SOCK_DGRAM);
+		else
+		    warnx("Unknown protocol type: %s", q);
+	    }else{
+		add_port(&ports, &num_ports, tp, SOCK_DGRAM);
+		add_port(&ports, &num_ports, tp, SOCK_STREAM);
+	    }
+	}
+    }
+
+    if(num_ports == 0)
+	errx(1, "No valid ports specified!");
+    
+    if (i_addr) {
+	*nfds = 1;
+	a = malloc(sizeof(*a) * *nfds);
+	memcpy(a, i_addr, sizeof(struct in_addr));
+    } else
+	*nfds = k_get_all_addrs (&a);
+    if (*nfds < 0) {
+	struct in_addr any;
+
+	any.s_addr = INADDR_ANY;
+
+	warnx ("Could not get local addresses, binding to INADDR_ANY");
+	*nfds = 1;
+	a = malloc(sizeof(*a) * *nfds);
+	memcpy(a, &any, sizeof(struct in_addr));
+    }
+    *fds = malloc(*nfds * num_ports * sizeof(**fds));
+    for (i = 0; i < *nfds; i++) {
+	for(j = 0; j < num_ports; j++) {
+	    mksocket(*fds + num_ports * i + j, a[i], 
+		     ports[j].type, "", htons(ports[j].port));
+	}
+    }
+    *nfds *= num_ports;
+    free(ports);
+    free (a);
+}
+
+
 int
 main(int argc, char **argv)
 {
-    struct sockaddr_in from;
-    register int n;
-    int     on = 1;
     int     child;
-    struct servent *sp;
-    int     fromlen;
-    static KTEXT_ST pkt_st;
-    KTEXT   pkt = &pkt_st;
-    int     kerror;
     int c;
-    extern char *optarg;
-    extern int optind;
+    struct descr *fds;
+    int nfds;
+    int n;
+    int     kerror;
+    int i_flag = 0;
+    struct in_addr i_addr;
+    char *port_spec = "+";
 
-    progname = argv[0];
+    umask(077);		/* Create protected files */
 
-    while ((c = getopt(argc, argv, "snmp:a:l:r:")) != -1) {
+    while ((c = getopt(argc, argv, "snmp:P:a:l:r:i:")) != EOF) {
 	switch(c) {
 	case 's':
 	    /*
@@ -637,10 +641,6 @@ main(int argc, char **argv)
 		max_age = ONE_DAY;	/* 24 hours */
 	    if (pause_int == -1)
 		pause_int = FIVE_MINUTES; /* 5 minutes */
-	    if (lflag == 0) {
-		log_file = KRBSLAVELOG;
-		lflag++;
-	    }
 	    break;
 	case 'n':
 	    max_age = -1;	/* don't check max age. */
@@ -659,6 +659,9 @@ main(int argc, char **argv)
 		usage();
 	    }
 	    break;
+	case 'P':
+	    port_spec = optarg;
+	    break;
 	case 'a':
 	    /* Set max age. */
 	    if (!isdigit(optarg[0])) 
@@ -671,7 +674,6 @@ main(int argc, char **argv)
 	    break;
 	case 'l':
 	    /* Set alternate log file */
-	    lflag++;
 	    log_file = optarg;
 	    break;
 	case 'r':
@@ -679,12 +681,20 @@ main(int argc, char **argv)
 	    rflag++;
 	    strcpy(local_realm, optarg);
 	    break;
+	case 'i':
+	    /* Only listen on this address */
+	    if(inet_aton (optarg, &i_addr) == 0) {
+		fprintf (stderr, "Bad address: %s\n", optarg);
+		exit (1);
+	    }
+	    ++i_flag;
+	    break;
 	default:
 	    usage();
 	    break;
 	}
     }
-
+    
     if (optind == (argc-1)) {
 	if (kerb_db_set_name(argv[optind]) != 0) {
 	    fprintf(stderr, "Could not set alternate database name\n");
@@ -707,40 +717,22 @@ main(int argc, char **argv)
     if (mflag)
 	printf("\tMaster key will be entered manually\n");
     
-    printf("\tLog file is %s\n", lflag ? log_file : KRBLOG);
+    printf("\tLog file is %s\n", log_file);
 
-    if (lflag)
-	kset_logfile(log_file);
+    kset_logfile(log_file);
     
     /* find our hostname, and use it as the instance */
-    if (gethostname(k_instance, INST_SZ)) {
-	fprintf(stderr, "%s: gethostname error\n", progname);
-	exit(1);
-    }
-
-    if ((sp = getservbyname("kerberos", "udp")) == 0) {
-	fprintf(stderr, "%s: udp/kerberos unknown service\n", progname);
-	exit(1);
-    }
-    sina.sin_port = sp->s_port;
+    if (k_gethostname(k_instance, INST_SZ))
+	err (1, "gethostname");
 
-    if ((f = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
-	fprintf(stderr, "%s: Can't open socket\n", progname);
-	exit(1);
-    }
-    if (setsockopt(f, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0)
-	fprintf(stderr, "%s: setsockopt (SO_REUSEADDR)\n", progname);
+    make_sockets(port_spec, i_flag ? &i_addr : NULL, &fds, &nfds);
 
-    if (bind(f, (struct sockaddr*)&sina, sizeof(sina)) < 0) {
-	fprintf(stderr, "%s: Can't bind socket\n", progname);
-	exit(1);
-    }
     /* do all the database and cache inits */
     if ((n = kerb_init())) {
 	if (mflag) {
 	    printf("Kerberos db and cache init ");
 	    printf("failed = %d ...exiting\n", n);
-	    exit(-1);
+	    exit (1);
 	} else {
 	    klog(L_KRB_PERR,
 	    "Kerberos db and cache init failed = %d ...exiting", n);
@@ -753,15 +745,15 @@ main(int argc, char **argv)
     
     /* setup master key */
     if (kdb_get_master_key (mflag, &master_key, master_key_schedule) != 0) {
-      klog (L_KRB_PERR, "kerberos: couldn't get master key.\n");
-      exit (-1);
+      klog (L_KRB_PERR, "kerberos: couldn't get master key.");
+      exit (1);
     }
     kerror = kdb_verify_master_key (&master_key, master_key_schedule, stdout);
     if (kerror < 0) {
       klog (L_KRB_PERR, "Can't verify master key.");
-      bzero (master_key, sizeof (master_key));
-      bzero (master_key_schedule, sizeof (master_key_schedule));
-      exit (-1);
+      memset(master_key, 0, sizeof (master_key));
+      memset (master_key_schedule, 0, sizeof (master_key_schedule));
+      exit (1);
     }
 
     master_key_version = (u_char) kerror;
@@ -790,28 +782,170 @@ main(int argc, char **argv)
 	}
 	setup_disc();
     }
+    
+    klog(L_ALL_REQ, "Starting Kerberos for %s (kvno %d)", 
+	 local_realm, master_key_version);
+    
     /* receive loop */
+    loop(fds, nfds);
+    exit(1);
+}
+
+
+void
+read_socket(struct descr *n)
+{
+    int b;
+    struct sockaddr_in from;
+    int fromlen = sizeof(from);
+    b = recvfrom(n->s, n->buf.dat + n->buf.length, 
+		 MAX_PKT_LEN - n->buf.length, 0, 
+		 (struct sockaddr *)&from, &fromlen);
+    if(b < 0){
+	if(n->type == SOCK_STREAM){
+	    close(n->s);
+	    n->s = -1;
+	}
+	n->buf.length = 0;
+	return;
+    }
+    n->buf.length += b;
+    if(n->type == SOCK_STREAM){
+	char *proto = "tcp";
+	if(n->buf.length > 4 && 
+	   strncmp(n->buf.dat, "GET ", 4) == 0 &&
+	   strncmp(n->buf.dat + n->buf.length - 4, 
+		   "\r\n\r\n", 4) == 0){
+	    char *p;
+	    n->buf.dat[n->buf.length - 1] = 0;
+	    strtok(n->buf.dat, " \t\r\n");
+	    p = strtok(NULL, " \t\r\n");
+	    if(p == NULL)
+		p = "";
+	    if(*p == '/') p++;
+	    p = strdup(p);
+	    n->buf.length = base64_decode(p, n->buf.dat);
+	    free(p);
+	    if(n->buf.length <= 0){
+		const char *msg = 
+		    "HTTP/1.1 404 Not found\r\n"
+		    "Server: KTH-KRB/" VERSION "\r\n"
+		    "Content-type: text/html\r\n"
+		    "Content-transfer-encoding: 8bit\r\n\r\n"
+		    "<TITLE>404 Not found</TITLE>\r\n"
+		    "<H1>404 Not found</H1>\r\n"
+		    "That page does not exist. Information about "
+		    "<A HREF=\"http://www.pdc.kth.se/kth-krb\">KTH-KRB</A> "
+		    "is available elsewhere.\r\n";
+		write(n->s, msg, strlen(msg));
+		close(n->s);
+		n->s = -1;
+		n->buf.length = 0;
+		return;
+	    }
+	    proto = "http";
+	    b = 0;
+	}
+	else if(n->buf.length >= 4 && n->buf.dat[0] == 0){
+	    /* if this is a new type of packet (with
+	       the length attached to the head of the
+	       packet), and there is no more data to
+	       be read, fake an old packet, so the
+	       code below will work */
+	    u_int32_t len;
+	    krb_get_int(n->buf.dat, &len, 4, 0);
+	    if(n->buf.length == len + 4){
+		memmove(n->buf.dat, n->buf.dat + 4, len);
+		b = 0;
+	    }
+	}
+	if(b == 0){
+	    /* handle request if there are 
+	       no more bytes to read */
+	    fromlen = sizeof(from);
+	    getpeername(n->s,(struct sockaddr*)&from, &fromlen);
+	    kerberos_wrap(n->s, &n->buf, proto, &from,
+			  &n->addr);
+	    n->buf.length = 0;
+	    close(n->s);
+	    n->s = -1;
+	}
+    }else{
+	/* udp packets are atomic */
+	kerberos_wrap(n->s, &n->buf, "udp", &from,
+		      &n->addr);
+	n->buf.length = 0;
+    }
+}
+
+static void
+loop(struct descr *fds, int nfds)
+{
     for (;;) {
-	fromlen = S_AD_SZ;
-	n = recvfrom(f, pkt->dat, MAX_PKT_LEN, 0, (struct sockaddr*)&from, &fromlen);
-	if (n > 0) {
-	    pkt->length = n;
-	    pkt->mbz = 0; /* force zeros to catch runaway strings */
-	    /* see what is left in the input queue */
-	    ioctl(f, FIONREAD, &q_bytes);
-	    gettimeofday(&kerb_time, NULL);
-	    q_n++;
-	    max_q_n = max(max_q_n, q_n);
-	    n_packets++;
-	    klog(L_NET_INFO,
-	 "q_byt %d, q_n %d, rd_byt %d, mx_q_b %d, mx_q_n %d, n_pkt %d",
-		 q_bytes, q_n, n, max_q_bytes, max_q_n, n_packets, 0);
-	    max_q_bytes = max(max_q_bytes, q_bytes);
-	    if (!q_bytes)
-		q_n = 0;	/* reset consecutive packets */
-	    kerberos(&from, pkt);
-	} else
-	    klog(L_NET_ERR,
-	    "%s: bad recvfrom n = %d errno = %d", progname, n, errno, 0);
+	int ret;
+        fd_set readfds;
+	struct timeval tv;
+	int maxfd = 0;
+	struct descr *n, *minfree;
+	int accepted; /* accept at most one socket per `round' */
+	
+	FD_ZERO(&readfds);
+	gettimeofday(&tv, NULL);
+	maxfd = 0;
+	minfree = NULL;
+	/* Remove expired TCP sockets, and add all other 
+	   to the set we are selecting on */
+	for(n = fds; n < fds + nfds; n++){
+	    if(n->s >= 0 && n->timeout && tv.tv_sec > n->timeout){
+		kerb_err_reply(n->s, NULL, KERB_ERR_TIMEOUT, "Timeout");
+		close(n->s);
+		n->s = -1;
+	    }
+	    if(n->s < 0){
+		if(minfree == NULL) minfree = n;
+		continue;
+	    }
+	    FD_SET(n->s, &readfds);
+	    maxfd = max(maxfd, n->s);
+	}
+	/* add more space for sockets */
+	if(minfree == NULL){
+	    int i = nfds;
+	    struct descr *new;
+	    nfds *=2;
+	    new = realloc(fds, sizeof(struct descr) * nfds);
+	    if(new){
+		fds = new;
+		minfree = fds + i;
+		for(; i < nfds; i++) fds[i].s = -1;
+	    }
+	}
+	ret = select(maxfd + 1, &readfds, 0, 0, 0);
+	accepted = 0;
+	for (n = fds; n < fds + nfds; n++){
+	    if(n->s < 0) continue;
+	    if (FD_ISSET(n->s, &readfds)){
+		if(n->type == SOCK_STREAM && n->timeout == 0){
+		    /* add accepted socket to list of sockets we are
+                       selecting on */
+		    int s;
+		    if(accepted) continue;
+		    accepted = 1;
+		    s = accept(n->s, NULL, 0);
+		    if(minfree == NULL){
+			kerb_err_reply(s, NULL, KFAILURE, "Out of memory");
+			close(s);
+		    }else{
+			minfree->s = s;
+			minfree->type = SOCK_STREAM;
+			gettimeofday(&tv, NULL);
+			minfree->timeout = tv.tv_sec + 4; /* XXX */
+			minfree->buf.length = 0;
+			memcpy(&minfree->addr, &n->addr, sizeof(minfree->addr));
+		    }
+		}else
+		    read_socket(n);
+	    }
+	}
     }
 }
diff --git a/kerberosIV/kinit/kinit.c b/kerberosIV/kinit/kinit.c
index bd7ca653887..d3aa92b8661 100644
--- a/kerberosIV/kinit/kinit.c
+++ b/kerberosIV/kinit/kinit.c
@@ -1,4 +1,7 @@
-/*	$Id: kinit.c,v 1.1 1995/12/14 06:52:51 tholo Exp $	*/
+/*	$Id: kinit.c,v 1.2 1997/11/28 12:48:47 art Exp $	*/
+/*      $KTH: kinit.c,v 1.15 1997/03/30 18:58:46 assar Exp $    */
+
+
 
 /*-
  * Copyright 1987, 1988 by the Student Information Processing Board
@@ -28,55 +31,50 @@
  *   -r[realm]
  *   -v[erbose]
  *   -l[ifetime]
+ *   -p
  */
 
 #include <kuser_locl.h>
 #include <sys/param.h>
 
 #define	LIFE	DEFAULT_TKT_LIFE /* lifetime of ticket in 5-minute units */
+#define CHPASSLIFE 2
 
-char   *progname;
+char progname[] = "kinit";
 
 static void
-get_input(s, size, stream)
-char *s;
-int size;
-FILE *stream;
+get_input(char *s, int size, FILE *stream)
 {
-	char *p;
+    char *p;
 
-	if (fgets(s, size, stream) == NULL)
-	  exit(1);
-	if ( (p = strchr(s, '\n')) != NULL)
-		*p = '\0';
+    if (fgets(s, size, stream) == NULL)
+	exit(1);
+    if ( (p = strchr(s, '\n')) != NULL)
+	*p = '\0';
 }
 
-
 static void
-usage()
+usage(void)
 {
-    fprintf(stderr, "Usage: %s [-irvl] [name]\n", progname);
+    fprintf(stderr, "Usage: %s [-irvlp] [name]\n", progname);
     exit(1);
 }
 
 int
-main(argc, argv)
-    int argc;
-    char   *argv[];
+main(int argc, char **argv)
 {
     char    aname[ANAME_SZ];
     char    inst[INST_SZ];
     char    realm[REALM_SZ];
     char    buf[MAXHOSTNAMELEN];
+    char    name[MAX_K_NAME_SZ];
     char   *username = NULL;
-    int     iflag, rflag, vflag, lflag, lifetime, k_errno;
-    register char *cp;
-    register i;
+    int     iflag, rflag, vflag, lflag, pflag, lifetime, k_errno;
+    int	    i;
 
     *inst = *realm = '\0';
-    iflag = rflag = vflag = lflag = 0;
+    iflag = rflag = vflag = lflag = pflag = 0;
     lifetime = LIFE;
-    progname = (cp = strrchr(*argv, '/')) ? cp + 1 : *argv;
 
     while (--argc) {
 	if ((*++argv)[0] != '-') {
@@ -99,22 +97,22 @@ main(argc, argv)
 	    case 'l':
 		++lflag;
 		continue;
+	    case 'p':
+		++pflag;	/* chpass-tickets */
+		lifetime = CHPASSLIFE;
+		break;
 	    default:
 		usage();
-		exit(1);
 	    }
     }
     if (username &&
-	(k_errno = kname_parse(aname, inst, realm, username))
-	!= KSUCCESS) {
-	fprintf(stderr, "%s: %s\n", progname, krb_err_txt[k_errno]);
+	(k_errno = kname_parse(aname, inst, realm, username)) != KSUCCESS) {
+	warnx("%s", krb_get_err_text(k_errno));
 	iflag = rflag = 1;
 	username = NULL;
     }
-    if (gethostname(buf, MAXHOSTNAMELEN)) {
-	fprintf(stderr, "%s: gethostname failed\n", progname);
-	exit(1);
-    }
+    if (k_gethostname(buf, MAXHOSTNAMELEN)) 
+	errx(1, "k_gethostname failed");
     printf("%s (%s)\n", ORGANIZATION, buf);
     if (username) {
 	printf("Kerberos Initialization for \"%s", aname);
@@ -126,33 +124,24 @@ main(argc, argv)
     } else {
 	printf("Kerberos Initialization\n");
 	printf("Kerberos name: ");
-	get_input(aname, sizeof(aname), stdin);
-	if (!*aname)
-	    exit(0);
-	if (!k_isname(aname)) {
-	    fprintf(stderr, "%s: bad Kerberos name format\n",
-		    progname);
-	    exit(1);
-	}
+	get_input(name, sizeof(name), stdin);
+	if (!*name)
+	    return 0;
+	if ((k_errno = kname_parse(aname, inst, realm, name)) != KSUCCESS )
+	    errx(1, "%s", krb_get_err_text(k_errno));
     }
     /* optional instance */
     if (iflag) {
 	printf("Kerberos instance: ");
 	get_input(inst, sizeof(inst), stdin);
-	if (!k_isinst(inst)) {
-	    fprintf(stderr, "%s: bad Kerberos instance format\n",
-		    progname);
-	    exit(1);
-	}
+	if (!k_isinst(inst))
+	    errx(1, "bad Kerberos instance format");
     }
     if (rflag) {
 	printf("Kerberos realm: ");
 	get_input(realm, sizeof(realm), stdin);
-	if (!k_isrealm(realm)) {
-	    fprintf(stderr, "%s: bad Kerberos realm format\n",
-		    progname);
-	    exit(1);
-	}
+	if (!k_isrealm(realm))
+	    errx(1, "bad Kerberos realm format");
     }
     if (lflag) {
 	 printf("Kerberos ticket lifetime (minutes): ");
@@ -161,24 +150,23 @@ main(argc, argv)
 	 if (lifetime < 5)
 	      lifetime = 1;
 	 else
-	      lifetime /= krb_time_to_life(0, lifetime*60);
+	      lifetime = krb_time_to_life(0, lifetime*60);
 	 /* This should be changed if the maximum ticket lifetime */
 	 /* changes */
 	 if (lifetime > 255)
 	      lifetime = 255;
     }
-    if (!*realm && krb_get_lrealm(realm, 1)) {
-	fprintf(stderr, "%s: krb_get_lrealm failed\n", progname);
-	exit(1);
-    }
-    k_errno = krb_get_pw_in_tkt(aname, inst, realm, "krbtgt", realm,
+    if (!*realm && krb_get_lrealm(realm, 1))
+	errx(1, "krb_get_lrealm failed");
+    k_errno = krb_get_pw_in_tkt(aname, inst, realm,
+				pflag ? PWSERV_NAME : 
+				KRB_TICKET_GRANTING_TICKET,
+				pflag ? KADM_SINST  : realm,
 				lifetime, 0);
     if (vflag) {
 	printf("Kerberos realm %s:\n", realm);
-	printf("%s\n", krb_err_txt[k_errno]);
-    } else if (k_errno) {
-	fprintf(stderr, "%s: %s\n", progname, krb_err_txt[k_errno]);
-	exit(1);
-    }
+	printf("%s\n", krb_get_err_text(k_errno));
+    } else if (k_errno)
+	errx(1, "%s", krb_get_err_text(k_errno));
     exit(0);
 }
diff --git a/kerberosIV/klist/Makefile b/kerberosIV/klist/Makefile
index 9f9c2acbe57..c0e03f4818f 100644
--- a/kerberosIV/klist/Makefile
+++ b/kerberosIV/klist/Makefile
@@ -1,9 +1,9 @@
 #	from @(#)Makefile	8.1 (Berkeley) 6/1/93
-#	$Id: Makefile,v 1.1 1995/12/14 06:52:50 tholo Exp $
+#	$Id: Makefile,v 1.2 1997/11/28 12:48:48 art Exp $
 
 PROG=	klist
 DPADD=	${LIBKRB} ${LIBDES}
-LDADD=	-lkrb -ldes
+LDADD=	-lkrb -ldes -lkafs
 BINDIR=	/usr/bin
 
 .include <bsd.prog.mk>
diff --git a/kerberosIV/klist/klist.c b/kerberosIV/klist/klist.c
index 90ccd7c91c2..e16b353b37c 100644
--- a/kerberosIV/klist/klist.c
+++ b/kerberosIV/klist/klist.c
@@ -1,51 +1,41 @@
-/*	$Id: klist.c,v 1.1 1995/12/14 06:52:50 tholo Exp $	*/
-
-/*-
- * Copyright 1987, 1988 by the Student Information Processing Board
- *	of the Massachusetts Institute of Technology
- *
- * Permission to use, copy, modify, and distribute this software
- * and its documentation for any purpose and without fee is
- * hereby granted, provided that the above copyright notice
- * appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation,
- * and that the names of M.I.T. and the M.I.T. S.I.P.B. not be
- * used in advertising or publicity pertaining to distribution
- * of the software without specific, written prior permission.
- * M.I.T. and the M.I.T. S.I.P.B. make no representations about
- * the suitability of this software for any purpose.  It is
- * provided "as is" without express or implied warranty.
- */
+/* $KTH: klist.c,v 1.28 1997/05/26 17:33:50 bg Exp $ */
 
 /*
+ * Copyright 1987, 1988 by the Massachusetts Institute of Technology. 
+ *
+ * For copying and distribution information, please see the file
+ * <mit-copyright.h>. 
+ *
  * Lists your current Kerberos tickets.
  * Written by Bill Sommerfeld, MIT Project Athena.
  */
 
-#include <kuser_locl.h>
+#include "kuser_locl.h"
+
+#include <sys/ioctl.h>
+#include <sys/ioccom.h>
+#include <kerberosIV/kafs.h>
 
-char   *whoami;			/* What was I invoked as?? */
+static int option_verbose = 0;
+
+static char progname[]="klist";
 
 static char *
-short_date(dp)
-    time_t *dp;
+short_date(int32_t dp)
 {
-    register char *cp;
+    char *cp;
+    time_t t = (time_t)dp;
 
-    if (*dp == (time_t)(-1L)) return "***  Never  *** ";
-    cp = ctime(dp) + 4;
+    if (t == (time_t)(-1L)) return "***  Never  *** ";
+    cp = ctime(&t) + 4;
     cp[15] = '\0';
     return (cp);
 }
 
 static void
-display_tktfile(file, tgt_test, long_form)
-char *file;
-int tgt_test, long_form;
+display_tktfile(char *file, int tgt_test, int long_form)
 {
-    char    pname[ANAME_SZ];
-    char    pinst[INST_SZ];
-    char    prealm[REALM_SZ];
+    krb_principal pr;
     char    buf1[20], buf2[20];
     int     k_errno;
     CREDENTIALS c;
@@ -70,11 +60,11 @@ int tgt_test, long_form;
     /* Open ticket file */
     if ((k_errno = tf_init(file, R_TKT_FIL))) {
 	if (!tgt_test)
-		fprintf(stderr, "%s: %s\n", whoami, krb_err_txt[k_errno]);
+	    warnx("%s", krb_get_err_text(k_errno));
 	exit(1);
     }
     /* Close ticket file */
-    (void) tf_close();
+    tf_close();
 
     /* 
      * We must find the realm of the ticket file here before calling
@@ -82,25 +72,25 @@ int tgt_test, long_form;
      * really stored in the principal section of the file, the
      * routine we use must itself call tf_init and tf_close.
      */
-    if ((k_errno = krb_get_tf_realm(file, prealm)) != KSUCCESS) {
+    if ((k_errno = krb_get_tf_realm(file, pr.realm)) != KSUCCESS) {
 	if (!tgt_test)
-	    fprintf(stderr, "%s: can't find realm of ticket file: %s\n",
-		    whoami, krb_err_txt[k_errno]);
+	    warnx("can't find realm of ticket file: %s", 
+		  krb_get_err_text(k_errno));
 	exit(1);
     }
 
     /* Open ticket file */
     if ((k_errno = tf_init(file, R_TKT_FIL))) {
 	if (!tgt_test)
-		fprintf(stderr, "%s: %s\n", whoami, krb_err_txt[k_errno]);
+	    warnx("%s", krb_get_err_text(k_errno));
 	exit(1);
     }
     /* Get principal name and instance */
-    if ((k_errno = tf_get_pname(pname)) ||
-	(k_errno = tf_get_pinst(pinst))) {
-	    if (!tgt_test)
-		    fprintf(stderr, "%s: %s\n", whoami, krb_err_txt[k_errno]);
-	    exit(1);
+    if ((k_errno = tf_get_pname(pr.name)) ||
+	(k_errno = tf_get_pinst(pr.instance))) {
+	if (!tgt_test)
+	    warnx("%s", krb_get_err_text(k_errno));
+	exit(1);
     }
 
     /* 
@@ -111,19 +101,18 @@ int tgt_test, long_form;
      */
        
     if (!tgt_test && long_form)
-	printf("Principal:\t%s%s%s%s%s\n\n", pname,
-	       (pinst[0] ? "." : ""), pinst,
-	       (prealm[0] ? "@" : ""), prealm);
+	printf("Principal:\t%s\n\n", krb_unparse_name(&pr));
     while ((k_errno = tf_get_cred(&c)) == KSUCCESS) {
 	if (!tgt_test && long_form && header) {
-	    printf("%-15s  %-15s  %s\n",
-		   "  Issued", "  Expires", "  Principal");
+	    printf("%-15s  %-15s  %s%s\n",
+		   "  Issued", "  Expires", "  Principal", 
+		   option_verbose ? " (kvno)" : "");
 	    header = 0;
 	}
 	if (tgt_test) {
 	    c.issue_date = krb_life_to_time(c.issue_date, c.lifetime);
-	    if (!strcmp(c.service, TICKET_GRANTING_TICKET) &&
-		!strcmp(c.instance, prealm)) {
+	    if (!strcmp(c.service, KRB_TICKET_GRANTING_TICKET) &&
+		!strcmp(c.instance, pr.realm)) {
 		if (time(0) < c.issue_date)
 		    exit(0);		/* tgt hasn't expired */
 		else
@@ -132,17 +121,18 @@ int tgt_test, long_form;
 	    continue;			/* not a tgt */
 	}
 	if (long_form) {
-	    (void) strcpy(buf1, short_date(&c.issue_date));
+	    strcpy(buf1, short_date(c.issue_date));
 	    c.issue_date = krb_life_to_time(c.issue_date, c.lifetime);
 	    if (time(0) < (unsigned long) c.issue_date)
-	        (void) strcpy(buf2, short_date(&c.issue_date));
+	        strcpy(buf2, short_date(c.issue_date));
 	    else
-	        (void) strcpy(buf2, ">>> Expired <<< ");
+	        strcpy(buf2, ">>> Expired <<<");
 	    printf("%s  %s  ", buf1, buf2);
 	}
-	printf("%s%s%s%s%s\n",
-	       c.service, (c.instance[0] ? "." : ""), c.instance,
-	       (c.realm[0] ? "@" : ""), c.realm);
+	printf("%s", krb_unparse_name_long(c.service, c.instance, c.realm));
+	if(long_form && option_verbose)
+	  printf(" (%d)", c.kvno);
+	printf("\n");
     }
     if (tgt_test)
 	exit(1);			/* no tgt found */
@@ -165,12 +155,9 @@ int tgt_test, long_form;
  */
 
 static int
-ok_getst(fd, s, n)
-    int fd;
-    register char *s;
-    int n;
+ok_getst(int fd, char *s, int n)
 {
-    register count = n;
+    int count = n;
     int err;
     while ((err = read(fd, s, 1)) > 0 && --count)
         if (*s++ == '\0')
@@ -182,8 +169,40 @@ ok_getst(fd, s, n)
 }
 
 static void
-display_srvtab(file)
-char *file;
+display_tokens()
+{
+    u_int32_t i;
+    unsigned char t[128];
+    struct ViceIoctl parms;
+    struct ClearToken ct;
+    int size_secret_tok, size_public_tok;
+
+    parms.in = (void *)&i;
+    parms.in_size = sizeof(i);
+    parms.out = (void *)t;
+    parms.out_size = sizeof(t);
+
+    for (i = 0; k_pioctl(NULL, VIOCGETTOK, &parms, 0) == 0; i++) {
+        char *cell;
+	memcpy(&size_secret_tok, t, 4);
+	memcpy(&size_public_tok, t + 4 + size_secret_tok, 4);
+	memcpy(&ct, t + 4 + size_secret_tok + 4, size_public_tok);
+	cell = t + 4 + size_secret_tok + 4 + size_public_tok + 4;
+
+	printf("%-15s  ", short_date(ct.BeginTimestamp));
+	printf("%-15s  ", short_date(ct.EndTimestamp));
+	if ((ct.EndTimestamp - ct.BeginTimestamp) & 1)
+	  printf("User's (AFS ID %d) tokens for %s", ct.ViceId, cell);
+	else
+	  printf("Tokens for %s", cell);
+	if (option_verbose)
+	    printf(" (%d)", ct.AuthHandle);
+	putchar('\n');
+    }
+}
+
+static void
+display_srvtab(char *file)
 {
     int stab;
     char serv[SNAME_SZ];
@@ -207,44 +226,44 @@ char *file;
     while (((count = ok_getst(stab, serv, SNAME_SZ)) > 0)
 	   && ((count = ok_getst(stab, inst, INST_SZ)) > 0)
 	   && ((count = ok_getst(stab, rlm, REALM_SZ)) > 0)) {
-	if (((count = read(stab,(char *) &vno,1)) != 1) ||
-	     ((count = read(stab,(char *) key,8)) != 8)) {
+	if (((count = read(stab,  &vno,1)) != 1) ||
+	     ((count = read(stab, key,8)) != 8)) {
 	    if (count < 0)
-		perror("reading from key file");
+		err(1, "reading from key file");
 	    else
-		fprintf(stderr, "key file truncated\n");
-	    exit(1);
+		errx(1, "key file truncated");
 	}
 	printf("%-15s %-15s %-15s %d\n",serv,inst,rlm,vno);
     }
     if (count < 0)
-	perror(file);
-    (void) close(stab);
+	warn(file);
+    close(stab);
 }
 
 static void
-usage()
+usage(void)
 {
     fprintf(stderr,
-        "Usage: %s [ -s | -t ] [ -file filename ] [ -srvtab ]\n", whoami);
+	    "Usage: %s [ -v | -s | -t ] [ -f filename ] [-tokens] [-srvtab ]\n",
+	    progname);
     exit(1);
 }
 
 /* ARGSUSED */
 int
-main(argc, argv)
-    int     argc;
-    char  **argv;
+main(int argc, char **argv)
 {
     int     long_form = 1;
     int     tgt_test = 0;
     int     do_srvtab = 0;
+    int     do_tokens = 0;
     char   *tkt_file = NULL;
-    char   *cp;
-
-    whoami = (cp = strrchr(*argv, '/')) ? cp + 1 : *argv;
 
     while (*(++argv)) {
+	if (!strcmp(*argv, "-v")) {
+	    option_verbose = 1;
+	    continue;
+	}
 	if (!strcmp(*argv, "-s")) {
 	    long_form = 0;
 	    continue;
@@ -254,10 +273,15 @@ main(argc, argv)
 	    long_form = 0;
 	    continue;
 	}
+	if (strcmp(*argv, "-tokens") == 0
+	    || strcmp(*argv, "-T") == 0) {
+	    do_tokens = k_hasafs();
+	    continue;
+	}
 	if (!strcmp(*argv, "-l")) {	/* now default */
 	    continue;
 	}
-	if (!strcmp(*argv, "-file")) {
+	if (!strncmp(*argv, "-f", 2)) {
 	    if (*(++argv)) {
 		tkt_file = *argv;
 		continue;
@@ -278,5 +302,7 @@ main(argc, argv)
 	display_srvtab(tkt_file);
     else
 	display_tktfile(tkt_file, tgt_test, long_form);
+    if (long_form && do_tokens)
+	display_tokens();
     exit(0);
 }
diff --git a/kerberosIV/krb/Makefile b/kerberosIV/krb/Makefile
index d7bf05e3e05..295aa22d559 100644
--- a/kerberosIV/krb/Makefile
+++ b/kerberosIV/krb/Makefile
@@ -1,19 +1,83 @@
 #	@(#)Makefile	8.1 (Berkeley) 6/1/93
 
 LIB=	krb
-CFLAGS+=-I${.CURDIR}
-SRCS=	cr_err_reply.c create_auth_reply.c create_ciph.c \
-	create_death_packet.c create_ticket.c debug_decl.c decomp_ticket.c \
-	dest_tkt.c extract_ticket.c fgetst.c get_ad_tkt.c get_admhst.c \
-	get_cred.c get_in_tkt.c get_krbhst.c get_krbrlm.c get_phost.c \
-	get_pw_tkt.c get_request.c get_svc_in_tkt.c get_tf_fullname.c \
-	get_tf_realm.c getrealm.c getst.c in_tkt.c k_localtime.c klog.c \
-	kname_parse.c kntoln.c kparse.c krb_err.c krb_err_txt.c \
-	krb_get_in_tkt.c kuserok.c lifetime.c log.c mk_err.c mk_priv.c \
-	mk_req.c mk_safe.c month_sname.c netread.c netwrite.c one.c \
-	pkt_cipher.c pkt_clen.c rd_err.c rd_priv.c rd_req.c rd_safe.c \
-	read_service_key.c recvauth.c save_credentials.c send_to_kdc.c \
-	sendauth.c str2key.c tf_util.c tkt_string.c
+CFLAGS+=-I${.CURDIR} -DPARANOIA
+SRCS=	cr_err_reply.c \
+          create_auth_reply.c \
+          create_ciph.c \
+          create_death_packet.c \
+          create_ticket.c \
+          dest_tkt.c \
+          get_in_tkt.c \
+          get_svc_in_tkt.c \
+          getrealm.c \
+          k_localtime.c \
+          krb_err_txt.c \
+          krb_get_in_tkt.c \
+          kuserok.c \
+          parse_name.c \
+          kntoln.c \
+          mk_auth.c \
+          krb_check_auth.c \
+          mk_err.c \
+          mk_safe.c \
+          rd_err.c \
+          rd_safe.c \
+          recvauth.c \
+          mk_priv.c \
+          rd_req.c \
+          decomp_ticket.c \
+          lifetime.c \
+          month_sname.c \
+          stime.c \
+          read_service_key.c \
+          getst.c \
+          sendauth.c \
+          netread.c \
+          netwrite.c \
+          rd_priv.c \
+          krb_equiv.c \
+          str2key.c \
+          get_ad_tkt.c \
+          mk_req.c \
+          get_cred.c \
+          get_tf_realm.c \
+          get_tf_fullname.c \
+          one.c \
+          save_credentials.c \
+          send_to_kdc.c \
+          get_host.c \
+          get_krbrlm.c \
+          k_gethostname.c \
+          tf_util.c \
+          debug_decl.c \
+          k_flock.c \
+          tkt_string.c \
+          getaddrs.c \
+          k_getsockinst.c \
+          k_getport.c \
+          lsb_addr_comp.c \
+          name2name.c \
+          get_default_principal.c \
+          realm_parse.c \
+          verify_user.c \
+          rw.c \
+          kdc_reply.c \
+          encrypt_ktext.c \
+          check_time.c \
+          krb_err.c \
+          et_list.c \
+          resolve.c \
+          unparse_name.c \
+          logging.c \
+          k_concat.c \
+	  strtok_r.c \
+	  asprintf.c \
+	  base64.c 
+
+# XXX base64.c, strtok_r.c and asprintf.c should really be somewhere else. 
+# (or replaced) (they are from libroken)
+
 MAN=	kerberos.3 krb_realmofhost.3 krb_sendauth.3 krb_set_tkt_string.3 \
 	kuserok.3 tf_util.3
 MLINKS+=kerberos.3 krb_mk_req.3 kerberos.3 krb_rd_req.3 kerberos.3 krb_kntoln.3 \
diff --git a/kerberosIV/krb/asprintf.c b/kerberosIV/krb/asprintf.c
new file mode 100644
index 00000000000..7a08bd181cb
--- /dev/null
+++ b/kerberosIV/krb/asprintf.c
@@ -0,0 +1,556 @@
+/* $KTH: snprintf.c,v 1.15 1997/08/17 08:51:55 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+
+enum format_flags {
+    minus_flag     =  1,
+    plus_flag      =  2,
+    space_flag     =  4,
+    alternate_flag =  8,
+    zero_flag      = 16
+};
+
+/*
+ * Common state
+ */
+
+struct state {
+  char *str;
+  char *s;
+  char *theend;
+  size_t sz;
+  size_t max_sz;
+  int (*append_char)(struct state *, char);
+  int (*reserve)(struct state *, size_t);
+  /* XXX - methods */
+};
+
+static int
+sn_reserve (struct state *state, size_t n)
+{
+  return state->s + n > state->theend;
+}
+
+static int
+sn_append_char (struct state *state, char c)
+{
+  if (sn_reserve (state, 1)) {
+    *state->s++ = '\0';
+    return 1;
+  } else {
+    *state->s++ = c;
+    return 0;
+  }
+}
+
+static int
+as_reserve (struct state *state, size_t n)
+{
+  while (state->s + n > state->theend) {
+    int off = state->s - state->str;
+    char *tmp;
+
+    if (state->max_sz && state->sz >= state->max_sz)
+      return 1;
+
+    if (state->max_sz)
+      state->sz = min(state->max_sz, state->sz*2);
+    else
+      state->sz *= 2;
+    tmp = realloc (state->str, state->sz);
+    if (tmp == NULL)
+      return 1;
+    state->str = tmp;
+    state->s = state->str + off;
+    state->theend = state->str + state->sz - 1;
+  }
+  return 0;
+}
+
+static int
+as_append_char (struct state *state, char c)
+{
+  if(as_reserve (state, 1))
+    return 1;
+  else {
+    *state->s++ = c;
+    return 0;
+  }
+}
+
+static int
+append_number(struct state *state,
+	      unsigned long num, unsigned base, char *rep,
+	      int width, int prec, int flags, int minusp)
+{
+  int len = 0;
+  int i;
+
+  /* given precision, ignore zero flag */
+  if(prec != -1)
+    flags &= ~zero_flag;
+  else
+    prec = 1;
+  /* zero value with zero precision -> "" */
+  if(prec == 0 && num == 0)
+    return 0;
+  do{
+    if((*state->append_char)(state, rep[num % base]))
+      return 1;
+    len++;
+    num /= base;
+  }while(num);
+  prec -= len;
+  /* pad with prec zeros */
+  while(prec-- > 0){
+    if((*state->append_char)(state, '0'))
+      return 1;
+    len++;
+  }
+  /* add length of alternate prefix (added later) to len */
+  if(flags & alternate_flag && (base == 16 || base == 8))
+    len += base / 8;
+  /* pad with zeros */
+  if(flags & zero_flag){
+    width -= len;
+    if(minusp || (flags & space_flag) || (flags & plus_flag))
+      width--;
+    while(width-- > 0){
+      if((*state->append_char)(state, '0'))
+	return 1;
+      len++;
+    }
+  }
+  /* add alternate prefix */
+  if(flags & alternate_flag && (base == 16 || base == 8)){
+    if(base == 16)
+      if((*state->append_char)(state, rep[10] + 23)) /* XXX */
+	return 1;
+    if((*state->append_char)(state, '0'))
+      return 1;
+  }
+  /* add sign */
+  if(minusp){
+    if((*state->append_char)(state, '-'))
+      return 1;
+    len++;
+  } else if(flags & plus_flag) {
+    if((*state->append_char)(state, '+'))
+      return 1;
+    len++;
+  } else if(flags & space_flag) {
+    if((*state->append_char)(state, ' '))
+      return 1;
+    len++;
+  }
+  if(flags & minus_flag)
+    /* swap before padding with spaces */
+    for(i = 0; i < len / 2; i++){
+      char c = state->s[-i-1];
+      state->s[-i-1] = state->s[-len+i];
+      state->s[-len+i] = c;
+    }
+  width -= len;
+  while(width-- > 0){
+    if((*state->append_char)(state,  ' '))
+      return 1;
+    len++;
+  }
+  if(!(flags & minus_flag))
+    /* swap after padding with spaces */
+    for(i = 0; i < len / 2; i++){
+      char c = state->s[-i-1];
+      state->s[-i-1] = state->s[-len+i];
+      state->s[-len+i] = c;
+    }
+    
+  return 0;
+}
+
+static int
+append_string (struct state *state,
+	       char *arg,
+	       int width,
+	       int prec,
+	       int flags)
+{
+  if(prec != -1)
+    width -= prec;
+  else
+    width -= strlen(arg);
+  if(!(flags & minus_flag))
+    while(width-- > 0)
+      if((*state->append_char) (state, ' '))
+	return 1;
+  if (prec != -1) {
+    while (*arg && prec--)
+      if ((*state->append_char) (state, *arg++))
+	return 1;
+  } else {
+    while (*arg)
+      if ((*state->append_char) (state, *arg++))
+	return 1;
+  }
+  if(flags & minus_flag)
+    while(width-- > 0)
+      if((*state->append_char) (state, ' '))
+	return 1;
+  return 0;
+}
+
+static int
+append_char(struct state *state,
+	    char arg,
+	    int width,
+	    int flags)
+{
+  while(!(flags & minus_flag) && --width > 0)
+    if((*state->append_char) (state, ' '))
+      return 1;
+    
+  if((*state->append_char) (state, arg))
+    return 1;
+  while((flags & minus_flag) && --width > 0)
+    if((*state->append_char) (state, ' '))
+      return 1;
+    
+  return 0;
+}
+
+/*
+ * This can't be made into a function...
+ */
+
+#define PARSE_INT_FORMAT(res, arg, unsig) \
+if (long_flag) \
+     res = va_arg(arg, unsig long); \
+else if (short_flag) \
+     res = va_arg(arg, unsig short); \
+else \
+     res = va_arg(arg, unsig int)
+
+/*
+ * zyxprintf - return 0 or -1
+ */
+
+static int
+xyzprintf (struct state *state, const char *format, va_list ap)
+{
+  char c;
+
+  while((c = *format++)) {
+    if (c == '%') {
+      int flags      = 0;
+      int width      = 0;
+      int prec       = -1;
+      int long_flag  = 0;
+      int short_flag = 0;
+
+      /* flags */
+      while((c = *format++)){
+	if(c == '-')
+	  flags |= minus_flag;
+	else if(c == '+')
+	  flags |= plus_flag;
+	else if(c == ' ')
+	  flags |= space_flag;
+	else if(c == '#')
+	  flags |= alternate_flag;
+	else if(c == '0')
+	  flags |= zero_flag;
+	else
+	  break;
+      }
+      
+      if((flags & space_flag) && (flags & plus_flag))
+	flags ^= space_flag;
+
+      if((flags & minus_flag) && (flags & zero_flag))
+	flags ^= zero_flag;
+
+      /* width */
+      if (isdigit(c))
+	do {
+	  width = width * 10 + c - '0';
+	  c = *format++;
+	} while(isdigit(c));
+      else if(c == '*') {
+	width = va_arg(ap, int);
+	c = *format++;
+      }
+
+      /* precision */
+      if (c == '.') {
+	prec = 0;
+	c = *format++;
+	if (isdigit(c))
+	  do {
+	    prec = prec * 10 + c - '0';
+	    c = *format++;
+	  } while(isdigit(c));
+	else if (c == '*') {
+	  prec = va_arg(ap, int);
+	  c = *format++;
+	}
+      }
+
+      /* size */
+
+      if (c == 'h') {
+	short_flag = 1;
+	c = *format++;
+      } else if (c == 'l') {
+	long_flag = 1;
+	c = *format++;
+      }
+
+      switch (c) {
+      case 'c' :
+	if(append_char(state, va_arg(ap, int), width, flags))
+	  return -1;
+	break;
+      case 's' :
+	if (append_string(state,
+			  va_arg(ap, char*),
+			  width,
+			  prec, 
+			  flags))
+	  return -1;
+	break;
+      case 'd' :
+      case 'i' : {
+	long arg;
+	unsigned long num;
+	int minusp = 0;
+
+	PARSE_INT_FORMAT(arg, ap, signed);
+
+	if (arg < 0) {
+	  minusp = 1;
+	  num = -arg;
+	} else
+	  num = arg;
+
+	if (append_number (state, num, 10, "0123456789",
+			   width, prec, flags, minusp))
+	  return -1;
+	break;
+      }
+      case 'u' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 10, "0123456789",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'o' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 010, "01234567",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'x' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 0x10, "0123456789abcdef",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'X' :{
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'p' : {
+	unsigned long arg = (unsigned long)va_arg(ap, void*);
+
+	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'n' : {
+	int *arg = va_arg(ap, int*);
+	*arg = state->s - state->str;
+	break;
+      }
+      case '%' :
+	if ((*state->append_char)(state, c))
+	  return -1;
+	break;
+      default :
+	if (   (*state->append_char)(state, '%')
+	    || (*state->append_char)(state, c))
+	  return -1;
+	break;
+      }
+    } else
+      if ((*state->append_char) (state, c))
+	return -1;
+  }
+  return 0;
+}
+
+int
+asprintf (char **ret, const char *format, ...)
+{
+  va_list args;
+  int val;
+
+  va_start(args, format);
+  val = vasprintf (ret, format, args);
+
+#ifdef PARANOIA
+  {
+    int ret2;
+    char *tmp;
+    tmp = malloc (val + 1);
+    if (tmp == NULL)
+      abort ();
+
+    ret2 = vsprintf (tmp, format, args);
+    if (val != ret2 || strcmp(*ret, tmp))
+      abort ();
+    free (tmp);
+  }
+#endif
+
+  va_end(args);
+  return val;
+}
+
+int
+asnprintf (char **ret, size_t max_sz, const char *format, ...)
+{
+  va_list args;
+  int val;
+
+  va_start(args, format);
+  val = vasnprintf (ret, max_sz, format, args);
+
+#ifdef PARANOIA
+  {
+    int ret2;
+    char *tmp;
+    tmp = malloc (val + 1);
+    if (tmp == NULL)
+      abort ();
+
+    ret2 = vsprintf (tmp, format, args);
+    if (val != ret2 || strcmp(*ret, tmp))
+      abort ();
+    free (tmp);
+  }
+#endif
+
+  va_end(args);
+  return val;
+}
+
+int
+vasprintf (char **ret, const char *format, va_list args)
+{
+  return vasnprintf (ret, 0, format, args);
+}
+
+
+int
+vasnprintf (char **ret, size_t max_sz, const char *format, va_list args)
+{
+  int st;
+  size_t len;
+  struct state state;
+
+  state.max_sz = max_sz;
+  if (max_sz)
+    state.sz   = min(1, max_sz);
+  else
+    state.sz   = 1;
+  state.str    = malloc(state.sz);
+  if (state.str == NULL) {
+    *ret = NULL;
+    return -1;
+  }
+  state.s = state.str;
+  state.theend = state.s + state.sz - 1;
+  state.append_char = as_append_char;
+  state.reserve     = as_reserve;
+
+  st = xyzprintf (&state, format, args);
+  if (st) {
+    free (state.str);
+    *ret = NULL;
+    return -1;
+  } else {
+    char *tmp;
+
+    *state.s = '\0';
+    len = state.s - state.str;
+    tmp = realloc (state.str, len+1);
+    if (state.str == NULL) {
+      free (state.str);
+      *ret = NULL;
+      return -1;
+    }
+    *ret = tmp;
+    return len;
+  }
+}
diff --git a/kerberosIV/krb/base64.c b/kerberosIV/krb/base64.c
new file mode 100644
index 00000000000..4c67412fc64
--- /dev/null
+++ b/kerberosIV/krb/base64.c
@@ -0,0 +1,146 @@
+/* $KTH: base64.c,v 1.1 1997/08/27 22:41:56 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+
+static char base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static int pos(char c)
+{
+  char *p;
+  for(p = base64; *p; p++)
+    if(*p == c)
+      return p - base64;
+  return -1;
+}
+
+int base64_encode(const void *data, int size, char **str)
+{
+  char *s, *p;
+  int i;
+  int c;
+  unsigned char *q;
+
+  p = s = (char*)malloc(size*4/3+4);
+  q = (unsigned char*)data;
+  i=0;
+  for(i = 0; i < size;){
+    c=q[i++];
+    c*=256;
+    if(i < size)
+      c+=q[i];
+    i++;
+    c*=256;
+    if(i < size)
+      c+=q[i];
+    i++;
+    p[0]=base64[(c&0x00fc0000) >> 18];
+    p[1]=base64[(c&0x0003f000) >> 12];
+    p[2]=base64[(c&0x00000fc0) >> 6];
+    p[3]=base64[(c&0x0000003f) >> 0];
+    if(i > size)
+      p[3]='=';
+    if(i > size+1)
+      p[2]='=';
+    p+=4;
+  }
+  *p=0;
+  *str = s;
+  return strlen(s);
+}
+
+int base64_decode(const char *str, void *data)
+{
+  const char *p;
+  unsigned char *q;
+  int c;
+  int x;
+  int done = 0;
+  q=(unsigned char*)data;
+  for(p=str; *p && !done; p+=4){
+    x = pos(p[0]);
+    if(x >= 0)
+      c = x;
+    else{
+      done = 3;
+      break;
+    }
+    c*=64;
+    
+    x = pos(p[1]);
+    if(x >= 0)
+      c += x;
+    else
+      return -1;
+    c*=64;
+    
+    if(p[2] == '=')
+      done++;
+    else{
+      x = pos(p[2]);
+      if(x >= 0)
+	c += x;
+      else
+	return -1;
+    }
+    c*=64;
+    
+    if(p[3] == '=')
+      done++;
+    else{
+      if(done)
+	return -1;
+      x = pos(p[3]);
+      if(x >= 0)
+	c += x;
+      else
+	return -1;
+    }
+    if(done < 3)
+      *q++=(c&0x00ff0000)>>16;
+      
+    if(done < 2)
+      *q++=(c&0x0000ff00)>>8;
+    if(done < 1)
+      *q++=(c&0x000000ff)>>0;
+  }
+  return q - (unsigned char*)data;
+}
diff --git a/kerberosIV/krb/check_time.c b/kerberosIV/krb/check_time.c
new file mode 100644
index 00000000000..fb00538256d
--- /dev/null
+++ b/kerberosIV/krb/check_time.c
@@ -0,0 +1,56 @@
+/* $KTH: check_time.c,v 1.4 1997/04/01 08:18:18 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan 
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+int
+krb_check_tm (struct tm tm)
+{
+     return  tm.tm_mon < 0
+	  || tm.tm_mon > 11
+	  || tm.tm_hour < 0
+	  || tm.tm_hour > 23
+	  || tm.tm_min < 0
+	  || tm.tm_min > 59
+	  || tm.tm_sec < 0
+	  || tm.tm_sec > 59
+	  || tm.tm_year < 1901
+	  || tm.tm_year > 2038;
+}
diff --git a/kerberosIV/krb/cr_err_reply.c b/kerberosIV/krb/cr_err_reply.c
index 8feaa6544e2..e2890e9be0d 100644
--- a/kerberosIV/krb/cr_err_reply.c
+++ b/kerberosIV/krb/cr_err_reply.c
@@ -1,42 +1,46 @@
+/* $KTH: cr_err_reply.c,v 1.9 1997/04/01 08:18:19 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/cr_err_reply.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
 /*
- * req_act_vno used to be defined as an extern ("defined in server").
- * However, that does noone anything good, so we define our own so
- * that the shared libraries do not turn up with an undefined variable!
- */
-static int my_req_act_vno = KRB_PROT_VERSION;
-
-/*
  * This routine is used by the Kerberos authentication server to
  * create an error reply packet to send back to its client.
  *
@@ -71,47 +75,25 @@ static int my_req_act_vno = KRB_PROT_VERSION;
  */
 
 void
-cr_err_reply(pkt, pname, pinst, prealm, time_ws, e, e_string)
-	KTEXT pkt;
-	char *pname;		/* Principal's name */
-	char *pinst;		/* Principal's instance */
-	char *prealm;		/* Principal's authentication domain */
-	u_int32_t time_ws;	/* Workstation time */
-	u_int32_t e;		/* Error code */
-	char *e_string;		/* Text of error */
+cr_err_reply(KTEXT pkt, char *pname, char *pinst, char *prealm, 
+	     u_int32_t time_ws, u_int32_t e, char *e_string)
 {
-    u_char *v = (u_char *) pkt->dat; /* Prot vers number */
-    u_char *t = (u_char *)(pkt->dat+1); /* Prot message type */
+    unsigned char *p = pkt->dat;
+    
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_ERR_REPLY, p, 1);
+
+    if (pname == NULL) pname = "";
+    if (pinst == NULL) pinst = "";
+    if (prealm == NULL) prealm = "";
 
-    /* Create fixed part of packet */
-    *v = (unsigned char) my_req_act_vno; /* KRB_PROT_VERSION; */
-    *t = (unsigned char) AUTH_MSG_ERR_REPLY;
-    *t |= HOST_BYTE_ORDER;
+    p += krb_put_nir(pname, pinst, prealm, p);
+    
+    p += krb_put_int(time_ws, p, 4);
 
-    if (pname == 0)
-        pname = "";
-    if (pinst == 0)
-        pinst = "";
-    if (prealm == 0)
-        prealm = "";
+    p += krb_put_int(e, p, 4);
 
-    /* Add the basic info */
-    (void) strcpy((char *) (pkt->dat+2),pname);
-    pkt->length = 3 + strlen(pname);
-    (void) strcpy((char *)(pkt->dat+pkt->length),pinst);
-    pkt->length += 1 + strlen(pinst);
-    (void) strcpy((char *)(pkt->dat+pkt->length),prealm);
-    pkt->length += 1 + strlen(prealm);
-    /* ws timestamp */
-    bcopy((char *) &time_ws,(char *)(pkt->dat+pkt->length),4);
-    pkt->length += 4;
-    /* err code */
-    bcopy((char *) &e,(char *)(pkt->dat+pkt->length),4);
-    pkt->length += 4;
-    /* err text */
-    (void) strcpy((char *)(pkt->dat+pkt->length),e_string);
-    pkt->length += 1 + strlen(e_string);
+    p += krb_put_string(e_string, p);
 
-    /* And return */
-    return;
+    pkt->length = p - pkt->dat;
 }
diff --git a/kerberosIV/krb/create_auth_reply.c b/kerberosIV/krb/create_auth_reply.c
index 80169848cfe..0c2fc35cb8d 100644
--- a/kerberosIV/krb/create_auth_reply.c
+++ b/kerberosIV/krb/create_auth_reply.c
@@ -1,32 +1,43 @@
+/* $KTH: create_auth_reply.c,v 1.11 1997/04/01 08:18:20 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/create_auth_reply.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
 /*
@@ -74,55 +85,47 @@ or implied warranty.
  */
 
 KTEXT
-create_auth_reply(pname, pinst, prealm, time_ws, n, x_date, kvno, cipher)
-	char *pname;		/* Principal's name */
-	char *pinst;		/* Principal's instance */
-	char *prealm;		/* Principal's authentication domain */
-	int32_t time_ws;	/* Workstation time */
-	int n;			/* Number of tickets */
-	u_int32_t x_date;	/* Principal's expiration date */
-	int kvno;		/* Principal's key version number */
-	KTEXT cipher;		/* Cipher text with tickets and
-				 * session keys */
+create_auth_reply(char *pname,	/* Principal's name */
+		  char *pinst,	/* Principal's instance */
+		  char *prealm,	/* Principal's authentication domain */
+		  int32_t time_ws, /* Workstation time */
+		  int n,	/* Number of tickets */
+		  u_int32_t x_date, /* Principal's expiration date */
+		  int kvno,	/* Principal's key version number */
+		  KTEXT cipher)	/* Cipher text with tickets and session keys */
 {
     static  KTEXT_ST pkt_st;
     KTEXT pkt = &pkt_st;
-    unsigned char *v =  pkt->dat; /* Prot vers number */
-    unsigned char *t = (pkt->dat+1); /* Prot message type */
-    short w_l;			/* Cipher length */
+    
+    unsigned char *p = pkt->dat;
+
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_KDC_REPLY, p, 1);
+
+    if(n != 0){
+	/* barf on old code */
+	krb_warning("create_auth_reply: don't give me no krb3 crap!"
+		    " (n == %d)\n", n);
+	return NULL;
+    }
 
-    /* Create fixed part of packet */
-    *v = (unsigned char) KRB_PROT_VERSION;
-    *t = (unsigned char) AUTH_MSG_KDC_REPLY;
-    *t |= HOST_BYTE_ORDER;
 
-    if (n != 0)
-	*v = 3;
+    p += krb_put_nir(pname, pinst, prealm, p);
 
-    /* Add the basic info */
-    (void) strcpy((char *) (pkt->dat+2), pname);
-    pkt->length = 3 + strlen(pname);
-    (void) strcpy((char *) (pkt->dat+pkt->length),pinst);
-    pkt->length += 1 + strlen(pinst);
-    (void) strcpy((char *) (pkt->dat+pkt->length),prealm);
-    pkt->length += 1 + strlen(prealm);
-    /* Workstation timestamp */
-    bcopy((char *) &time_ws, (char *) (pkt->dat+pkt->length), 4);
-    pkt->length += 4;
-    *(pkt->dat+(pkt->length)++) = (unsigned char) n;
-    /* Expiration date */
-    bcopy((char *) &x_date, (char *) (pkt->dat+pkt->length),4);
-    pkt->length += 4;
+    p += krb_put_int(time_ws, p, 4);
+    
+    p += krb_put_int(n, p, 1);
+    
+    p += krb_put_int(x_date, p, 4);
+    
+    p += krb_put_int(kvno, p, 1);
+    
+    p += krb_put_int(cipher->length, p, 2);
+    
+    memcpy(p, cipher->dat, cipher->length);
+    p += cipher->length;
 
-    /* Now send the ciphertext and info to help decode it */
-    *(pkt->dat+(pkt->length)++) = (unsigned char) kvno;
-    w_l = (short) cipher->length;
-    bcopy((char *) &w_l,(char *) (pkt->dat+pkt->length),2);
-    pkt->length += 2;
-    bcopy((char *) (cipher->dat), (char *) (pkt->dat+pkt->length),
-	  cipher->length);
-    pkt->length += cipher->length;
+    pkt->length = p - pkt->dat;
 
-    /* And return the packet */
     return pkt;
 }
diff --git a/kerberosIV/krb/create_ciph.c b/kerberosIV/krb/create_ciph.c
index 4bf44f953d9..ab5a41f8232 100644
--- a/kerberosIV/krb/create_ciph.c
+++ b/kerberosIV/krb/create_ciph.c
@@ -1,31 +1,43 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/create_ciph.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
 
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
+/* $KTH: create_ciph.c,v 1.9 1997/04/01 08:18:20 joda Exp $ */
 
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
 
 #include "krb_locl.h"
 
@@ -67,56 +79,40 @@ or implied warranty.
  */
 
 int
-create_ciph(c, session, service, instance, realm,
-	    life, kvno, tkt, kdc_time, key)
-	KTEXT c;		/* Text block to hold ciphertext */
-	unsigned char *session;	/* Session key to send to user */
-	char *service;		/* Service name on ticket */
-	char *instance;		/* Instance name on ticket */
-	char *realm;		/* Realm of this KDC */
-	u_int32_t life;		/* Lifetime of the ticket */
-	int kvno;		/* Key version number for service */
-	KTEXT tkt;		/* The ticket for the service */
-	u_int32_t kdc_time;	/* KDC time */
-	des_cblock *key;	/* Key to encrypt ciphertext with */
-{
-    char            *ptr;
-    des_key_schedule    key_s;
+create_ciph(KTEXT c,		/* Text block to hold ciphertext */
+	    unsigned char *session, /* Session key to send to user */
+	    char *service,	/* Service name on ticket */
+	    char *instance,	/* Instance name on ticket */
+	    char *realm,	/* Realm of this KDC */
+	    u_int32_t life,	/* Lifetime of the ticket */
+	    int kvno,		/* Key version number for service */
+	    KTEXT tkt,		/* The ticket for the service */
+	    u_int32_t kdc_time,	/* KDC time */
+	    des_cblock *key)	/* Key to encrypt ciphertext with */
 
-    ptr = (char *) c->dat;
-
-    bcopy((char *) session, ptr, 8);
-    ptr += 8;
-
-    (void) strcpy(ptr,service);
-    ptr += strlen(service) + 1;
-
-    (void) strcpy(ptr,instance);
-    ptr += strlen(instance) + 1;
-
-    (void) strcpy(ptr,realm);
-    ptr += strlen(realm) + 1;
+{
+    unsigned char *p = c->dat;
 
-    *(ptr++) = (unsigned char) life;
-    *(ptr++) = (unsigned char) kvno;
-    *(ptr++) = (unsigned char) tkt->length;
+    memset(c, 0, sizeof(KTEXT_ST));
 
-    bcopy((char *)(tkt->dat),ptr,tkt->length);
-    ptr += tkt->length;
+    memcpy(p, session, 8);
+    p += 8;
+    
+    p += krb_put_nir(service, instance, realm, p);
+    
+    p += krb_put_int(life, p, 1);
+    p += krb_put_int(kvno, p, 1);
 
-    bcopy((char *) &kdc_time,ptr,4);
-    ptr += 4;
+    p += krb_put_int(tkt->length, p, 1);
 
-    /* guarantee null padded encrypted data to multiple of 8 bytes */
-    bzero(ptr, 7);
+    memcpy(p, tkt->dat, tkt->length);
+    p += tkt->length;
 
-    c->length = (((ptr - (char *) c->dat) + 7) / 8) * 8;
+    p += krb_put_int(kdc_time, p, 4);
 
-#ifndef NOENCRYPTION
-    des_key_sched(key,key_s);
-    des_pcbc_encrypt((des_cblock *)c->dat,(des_cblock *)c->dat,(long) c->length,key_s,
-	key, DES_ENCRYPT);
-#endif /* NOENCRYPTION */
+    /* multiple of eight bytes */
+    c->length = (p - c->dat + 7) & ~7;
 
-    return(KSUCCESS);
+    encrypt_ktext(c, key, DES_ENCRYPT);
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/create_death_packet.c b/kerberosIV/krb/create_death_packet.c
index f7333097513..c6fd5ecc60c 100644
--- a/kerberosIV/krb/create_death_packet.c
+++ b/kerberosIV/krb/create_death_packet.c
@@ -1,32 +1,43 @@
+/* $KTH: create_death_packet.c,v 1.8 1997/04/01 08:18:21 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/create_death_packet.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
 /*
@@ -57,19 +68,18 @@ or implied warranty.
 
 #ifdef DEBUG
 KTEXT
-krb_create_death_packet(a_name)
-    char *a_name;
+krb_create_death_packet(char *a_name)
 {
     static KTEXT_ST pkt_st;
     KTEXT pkt = &pkt_st;
 
-    unsigned char *v =  pkt->dat;
-    unsigned char *t =  (pkt->dat+1);
-    *v = (unsigned char) KRB_PROT_VERSION;
-    *t = (unsigned char) AUTH_MSG_DIE;
-    *t |= HOST_BYTE_ORDER;
-    (void) strcpy((char *) (pkt->dat+2),a_name);
-    pkt->length = 3 + strlen(a_name);
+    unsigned char *p = pkt->dat;
+    
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_DIE, p, 1);
+    
+    p += krb_put_string(a_name, p);
+    pkt->length = p - pkt->dat;
     return pkt;
 }
 #endif /* DEBUG */
diff --git a/kerberosIV/krb/create_ticket.c b/kerberosIV/krb/create_ticket.c
index 944007c9e7a..7f355b52589 100644
--- a/kerberosIV/krb/create_ticket.c
+++ b/kerberosIV/krb/create_ticket.c
@@ -1,32 +1,43 @@
+/* $KTH: create_ticket.c,v 1.12 1997/04/01 08:18:21 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/create_ticket.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
 /*
@@ -38,7 +49,6 @@ or implied warranty.
  * eight bytes and is in tkt->length.
  *
  * If the ticket is too long, the ticket will contain nulls.
- * The return value of the routine is undefined.
  *
  * The corresponding routine to extract information from a ticket it
  * decomp_ticket.  When changes are made to this routine, the
@@ -79,63 +89,46 @@ or implied warranty.
  */
 
 int
-krb_create_ticket(tkt, flags, pname, pinstance, prealm, paddress,
-		  session, life, time_sec, sname, sinstance, key)
-	KTEXT tkt;		/* Gets filled in by the ticket */
-	unsigned char flags;	/* Various Kerberos flags */
-	char *pname;		/* Principal's name */
-	char *pinstance;	/* Principal's instance */
-	char *prealm;		/* Principal's authentication domain */
-	int32_t paddress;	/* Net address of requesting entity */
-	char *session;		/* Session key inserted in ticket */
-	int16_t life;		/* Lifetime of the ticket */
-	int32_t time_sec;	/* Issue time and date */
-	char *sname;		/* Service Name */
-	char *sinstance;	/* Instance Name */
-	des_cblock *key;	/* Service's secret key */
+krb_create_ticket(KTEXT tkt,	/* Gets filled in by the ticket */
+		  unsigned char flags, /* Various Kerberos flags */
+		  char *pname,	/* Principal's name */
+		  char *pinstance, /* Principal's instance */
+		  char *prealm, /* Principal's authentication domain */
+		  int32_t paddress, /* Net address of requesting entity */
+		  void *session, /* Session key inserted in ticket */
+		  int16_t life,	/* Lifetime of the ticket */
+		  int32_t time_sec, /* Issue time and date */
+		  char *sname,	/* Service Name */
+		  char *sinstance, /* Instance Name */
+		  des_cblock *key) /* Service's secret key */
 {
-    des_key_schedule key_s;
-    register char *data;        /* running index into ticket */
+    unsigned char *p = tkt->dat;
+
+    memset(tkt, 0, sizeof(KTEXT_ST));
+
+    p += krb_put_int(flags, p, 1);
+    p += krb_put_nir(pname, pinstance, prealm, p);
+    
+    p += krb_put_address(paddress, p);
+    
+    memcpy(p, session, 8);
+    p += 8;
 
-    tkt->length = 0;            /* Clear previous data  */
-    flags |= HOST_BYTE_ORDER;   /* ticket byte order   */
-    bcopy((char *) &flags,(char *) (tkt->dat),sizeof(flags));
-    data = ((char *)tkt->dat) + sizeof(flags);
-    (void) strcpy(data, pname);
-    data += 1 + strlen(pname);
-    (void) strcpy(data, pinstance);
-    data += 1 + strlen(pinstance);
-    (void) strcpy(data, prealm);
-    data += 1 + strlen(prealm);
-    bcopy((char *) &paddress, data, 4);
-    data += 4;
+    p += krb_put_int(life, p, 1);
+    p += krb_put_int(time_sec, p, 4);
 
-    bcopy((char *) session, data, 8);
-    data += 8;
-    *(data++) = (char) life;
-    /* issue time */
-    bcopy((char *) &time_sec, data, 4);
-    data += 4;
-    (void) strcpy(data, sname);
-    data += 1 + strlen(sname);
-    (void) strcpy(data, sinstance);
-    data += 1 + strlen(sinstance);
+    p += krb_put_nir(sname, sinstance, NULL, p);
 
-    /* guarantee null padded ticket to multiple of 8 bytes */
-    bzero(data, 7);
-    tkt->length = ((data - ((char *)tkt->dat) + 7)/8)*8;
+    /* multiple of eight bytes */
+    tkt->length = (p - tkt->dat + 7) & ~7;
 
     /* Check length of ticket */
     if (tkt->length > (sizeof(KTEXT_ST) - 7)) {
-        bzero(tkt->dat, tkt->length);
+        memset(tkt->dat, 0, tkt->length);
         tkt->length = 0;
         return KFAILURE /* XXX */;
     }
 
-#ifndef NOENCRYPTION
-    des_key_sched(key,key_s);
-    des_pcbc_encrypt((des_cblock *)tkt->dat,(des_cblock *)tkt->dat,(long)tkt->length,
-	key_s,key, DES_ENCRYPT);
-#endif
-    return 0;
+    encrypt_ktext(tkt, key, DES_ENCRYPT);
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/debug_decl.c b/kerberosIV/krb/debug_decl.c
index 5489acd99cb..b96afa63baf 100644
--- a/kerberosIV/krb/debug_decl.c
+++ b/kerberosIV/krb/debug_decl.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/debug_decl.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: debug_decl.c,v 1.7 1997/10/28 15:44:00 bg Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -27,7 +21,10 @@ or implied warranty.
 
   */
 
+#include "krb_locl.h"
+
 /* Declare global debugging variables. */
 
 int krb_ap_req_debug = 0;
 int krb_debug = 0;
+int krb_dns_debug = 0;
diff --git a/kerberosIV/krb/decomp_ticket.c b/kerberosIV/krb/decomp_ticket.c
index a0de714ccbe..d1c3b7a8e18 100644
--- a/kerberosIV/krb/decomp_ticket.c
+++ b/kerberosIV/krb/decomp_ticket.c
@@ -1,32 +1,43 @@
+/* $KTH: decomp_ticket.c,v 1.16 1997/04/01 08:18:22 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/decomp_ticket.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
 /*
@@ -34,15 +45,6 @@ or implied warranty.
  * should be filled in based on the information in the ticket.  It
  * fills in values for its arguments.
  *
- * Note: if the client realm field in the ticket is the null string,
- * then the "prealm" variable is filled in with the local realm.
- *
- * If the ticket byte order is different than the host's byte order
- * (as indicated by the byte order bit of the "flags" field), then
- * the KDC timestamp "time_sec" is byte-swapped.  The other fields
- * potentially affected by byte order, "paddress" and "session" are
- * not byte-swapped.
- *
  * The routine returns KFAILURE if any of the "pname", "pinstance",
  * or "prealm" fields is too big, otherwise it returns KSUCCESS.
  *
@@ -54,80 +56,64 @@ or implied warranty.
  */
 
 int
-decomp_ticket(tkt, flags, pname, pinstance, prealm, paddress, session,
-	      life, time_sec, sname, sinstance, key, key_s)
-	KTEXT tkt;		/* The ticket to be decoded */
-	unsigned char *flags;	/* Kerberos ticket flags */
-	char *pname;		/* Authentication name */
-	char *pinstance;	/* Principal's instance */
-	char *prealm;		/* Principal's authentication domain */
-	u_int32_t *paddress;	/* Net address of entity
-                                 * requesting ticket */
-	unsigned char *session;	/* Session key inserted in ticket */
-	int *life;		/* Lifetime of the ticket */
-	u_int32_t *time_sec;	/* Issue time and date */
-	char *sname;		/* Service name */
-	char *sinstance;	/* Service instance */
-	des_cblock *key;	/* Service's secret key
-                                 * (to decrypt the ticket) */
-	struct des_ks_struct *key_s; /* The precomputed key schedule */
+decomp_ticket(KTEXT tkt,	/* The ticket to be decoded */
+	      unsigned char *flags, /* Kerberos ticket flags */
+	      char *pname,	/* Authentication name */
+	      char *pinstance,	/* Principal's instance */
+	      char *prealm,	/* Principal's authentication domain */
+	      u_int32_t *paddress,/* Net address of entity requesting ticket */
+	      unsigned char *session, /* Session key inserted in ticket */
+	      int *life,	/* Lifetime of the ticket */
+	      u_int32_t *time_sec, /* Issue time and date */
+	      char *sname,	/* Service name */
+	      char *sinstance,	/* Service instance */
+	      des_cblock *key,	/* Service's secret key (to decrypt the ticket) */
+	      des_key_schedule schedule) /* The precomputed key schedule */
+
 {
-    static int tkt_swap_bytes;
-    unsigned char *uptr;
-    char *ptr = (char *)tkt->dat;
-
-#ifndef NOENCRYPTION
-    des_pcbc_encrypt((des_cblock *)tkt->dat,(des_cblock *)tkt->dat,(long)tkt->length,
-	key_s,key, DES_DECRYPT);
-#endif /* ! NOENCRYPTION */
-
-    *flags = *ptr;              /* get flags byte */
-    ptr += sizeof(*flags);
-    tkt_swap_bytes = 0;
-    if (HOST_BYTE_ORDER != ((*flags >> K_FLAG_ORDER)& 1))
-        tkt_swap_bytes++;
-
-    if (strlen(ptr) > ANAME_SZ)
-        return(KFAILURE);
-    (void) strcpy(pname,ptr);   /* pname */
-    ptr += strlen(pname) + 1;
-
-    if (strlen(ptr) > INST_SZ)
-        return(KFAILURE);
-    (void) strcpy(pinstance,ptr); /* instance */
-    ptr += strlen(pinstance) + 1;
-
-    if (strlen(ptr) > REALM_SZ)
-        return(KFAILURE);
-    (void) strcpy(prealm,ptr);  /* realm */
-    ptr += strlen(prealm) + 1;
-    /* temporary hack until realms are dealt with properly */
-    if (*prealm == 0 && krb_get_lrealm(prealm, 1) != KSUCCESS)
-	return(KFAILURE);
-
-    bcopy(ptr,(char *)paddress,4); /* net address */
-    ptr += 4;
-
-    bcopy(ptr,(char *)session,8); /* session key */
-    ptr+= 8;
-#ifdef notdef /* DONT SWAP SESSION KEY spm 10/22/86 */
-    if (tkt_swap_bytes)
-        swap_C_Block(session);
-#endif
-
-    /* get lifetime, being certain we don't get negative lifetimes */
-    uptr = (unsigned char *) ptr++;
-    *life = (int) *uptr;
-
-    bcopy(ptr,(char *) time_sec,4); /* issue time */
-    ptr += 4;
-    if (tkt_swap_bytes)
-        swap_u_long(*time_sec);
-
-    (void) strcpy(sname,ptr);   /* service name */
-    ptr += 1 + strlen(sname);
-
-    (void) strcpy(sinstance,ptr); /* instance */
-    ptr += 1 + strlen(sinstance);
-    return(KSUCCESS);
+    unsigned char *p = tkt->dat;
+    
+    int little_endian;
+
+    des_pcbc_encrypt((des_cblock *)tkt->dat, (des_cblock *)tkt->dat,
+		     tkt->length, schedule, key, DES_DECRYPT);
+
+    tkt->mbz = 0;
+
+    *flags = *p++;
+
+    little_endian = (*flags >> K_FLAG_ORDER) & 1;
+
+    if(strlen((char*)p) > ANAME_SZ)
+	return KFAILURE;
+    p += krb_get_string(p, pname);
+
+    if(strlen((char*)p) > INST_SZ)
+	return KFAILURE;
+    p += krb_get_string(p, pinstance);
+
+    if(strlen((char*)p) > REALM_SZ)
+	return KFAILURE;
+    p += krb_get_string(p, prealm);
+
+    if(tkt->length - (p - tkt->dat) < 8 + 1 + 4)
+	return KFAILURE;
+    p += krb_get_address(p, paddress);
+
+    memcpy(session, p, 8);
+    p += 8;
+
+    *life = *p++;
+    
+    p += krb_get_int(p, time_sec, 4, little_endian);
+
+    if(strlen((char*)p) > SNAME_SZ)
+	return KFAILURE;
+    p += krb_get_string(p, sname);
+
+    if(strlen((char*)p) > INST_SZ)
+	return KFAILURE;
+    p += krb_get_string(p, sinstance);
+
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/dest_tkt.c b/kerberosIV/krb/dest_tkt.c
index 2386a5afdc9..18f2f9a84a4 100644
--- a/kerberosIV/krb/dest_tkt.c
+++ b/kerberosIV/krb/dest_tkt.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/dest_tkt.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: dest_tkt.c,v 1.11 1997/05/19 03:03:40 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,13 +23,6 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/file.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#ifdef TKT_SHMEM
-#include <sys/param.h>
-#endif
-
 /*
  * dest_tkt() is used to destroy the ticket store upon logout.
  * If the ticket file does not exist, dest_tkt() returns RET_TKFIL.
@@ -46,18 +33,15 @@ or implied warranty.
  */
 
 int
-dest_tkt()
+dest_tkt(void)
 {
     char *file = TKT_FILE;
     int i,fd;
     struct stat statb;
     char buf[BUFSIZ];
-#ifdef TKT_SHMEM
-    char shmidname[MaxPathLen];
-#endif /* TKT_SHMEM */
 
     errno = 0;
-    if (lstat(file,&statb) < 0)
+    if (lstat(file, &statb) < 0)      
 	goto out;
 
     if (!(statb.st_mode & S_IFREG)
@@ -70,31 +54,23 @@ dest_tkt()
     if ((fd = open(file, O_RDWR, 0)) < 0)
 	goto out;
 
-    bzero(buf, BUFSIZ);
+    memset(buf, 0, BUFSIZ);
 
-    for (i = 0; i < statb.st_size; i += BUFSIZ)
-	if (write(fd, buf, BUFSIZ) != BUFSIZ) {
-	    (void) fsync(fd);
-	    (void) close(fd);
+    for (i = 0; i < statb.st_size; i += sizeof(buf))
+	if (write(fd, buf, sizeof(buf)) != sizeof(buf)) {
+	    fsync(fd);
+	    close(fd);
 	    goto out;
 	}
+	
 
-    (void) fsync(fd);
-    (void) close(fd);
-
-    (void) unlink(file);
+    fsync(fd);
+    close(fd);
+    
+    unlink(file);
 
 out:
     if (errno == ENOENT) return RET_TKFIL;
     else if (errno != 0) return KFAILURE;
-#ifdef TKT_SHMEM
-    /* 
-     * handle the shared memory case 
-     */
-    (void) strcpy(shmidname, file);
-    (void) strcat(shmidname, ".shm");
-    if ((i = krb_shm_dest(shmidname)) != KSUCCESS)
-	return(i);
-#endif /* TKT_SHMEM */
     return(KSUCCESS);
 }
diff --git a/kerberosIV/krb/encrypt_ktext.c b/kerberosIV/krb/encrypt_ktext.c
new file mode 100644
index 00000000000..89b78ec455f
--- /dev/null
+++ b/kerberosIV/krb/encrypt_ktext.c
@@ -0,0 +1,51 @@
+/* $KTH: encrypt_ktext.c,v 1.4 1997/04/01 08:18:26 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+void
+encrypt_ktext(KTEXT cip, des_cblock *key, int encrypt)
+{
+    des_key_schedule schedule;
+    des_set_key(key, schedule);
+    des_pcbc_encrypt((des_cblock*)cip->dat, (des_cblock*)cip->dat, 
+		     cip->length, schedule, key, encrypt);
+    memset(schedule, 0, sizeof(des_key_schedule));
+}
diff --git a/kerberosIV/krb/et_list.c b/kerberosIV/krb/et_list.c
new file mode 100644
index 00000000000..380c1b5d48a
--- /dev/null
+++ b/kerberosIV/krb/et_list.c
@@ -0,0 +1,54 @@
+/* $KTH: et_list.c,v 1.12 1997/05/13 09:45:01 bg Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+struct et_list {
+    struct et_list *next;
+    const struct error_table *table;
+};
+
+#if defined(__GNUC__)
+
+struct et_list * _et_list __attribute__ ((weak)) = 0;
+
+#else /* !__GNUC__ */
+
+struct et_list * _et_list = 0;
+
+#endif /* !__GNUC__ */
diff --git a/kerberosIV/krb/extract_ticket.c b/kerberosIV/krb/extract_ticket.c
deleted file mode 100644
index 7a32e712edf..00000000000
--- a/kerberosIV/krb/extract_ticket.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/extract_ticket.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-/*
- * This routine is obsolete.
- *
- * This routine accepts the ciphertext returned by kerberos and
- * extracts the nth ticket.  It also fills in the variables passed as
- * session, liftime and kvno.
- */
-
-void
-extract_ticket(cipher, n, session, lifetime, kvno, realm, ticket)
-	KTEXT cipher;		/* The ciphertext */
-	int n;			/* Which ticket */
-	char *session;		/* The session key for this tkt */
-	int *lifetime;		/* The life of this ticket */
-	int *kvno;		/* The kvno for the service */
-	char *realm;		/* Realm in which tkt issued */
-	KTEXT ticket;		/* The ticket itself */
-{
-    char *ptr;
-    int i;
-
-    /* Start after the ticket lengths */
-    ptr = (char *) cipher->dat;
-    ptr = ptr + 1 + (int) *(cipher->dat);
-
-    /* Step through earlier tickets */
-    for (i = 1; i < n; i++)
-	ptr = ptr + 11 + strlen(ptr+10) + (int) *(cipher->dat+i);
-    bcopy(ptr, (char *) session, 8); /* Save the session key */
-    ptr += 8;
-    *lifetime = (unsigned char) *(ptr++); /* Save the life of the ticket */
-    *kvno = *(ptr++);		/* Save the kvno */
-    (void) strcpy(realm,ptr);	/* instance */
-    ptr += strlen(realm) + 1;
-
-    /* Save the ticket if its length is non zero */
-    ticket->length = *(cipher->dat+n);
-    if (ticket->length)
-	bcopy(ptr, (char *) (ticket->dat), ticket->length);
-}
diff --git a/kerberosIV/krb/get_ad_tkt.c b/kerberosIV/krb/get_ad_tkt.c
index 7250b443fd1..98c9349daf2 100644
--- a/kerberosIV/krb/get_ad_tkt.c
+++ b/kerberosIV/krb/get_ad_tkt.c
@@ -1,76 +1,44 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_ad_tkt.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-static int swap_bytes;
+/* $KTH: get_ad_tkt.c,v 1.16 1997/05/30 17:43:34 bg Exp $ */
 
 /*
- * Given a pointer to an AUTH_MSG_KDC_REPLY packet, return the length of
- * its ciphertext portion.  The external variable "swap_bytes" is assumed
- * to have been set to indicate whether or not the packet is in local
- * byte order.  pkt_clen() takes this into account when reading the
- * ciphertext length out of the packet.
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-static int
-pkt_clen(pkt)
-	KTEXT pkt;
-{
-    static unsigned short temp,temp2;
-    int clen = 0;
-
-    /* Start of ticket list */
-    unsigned char *ptr = pkt_a_realm(pkt) + 10
-	+ strlen((char *)pkt_a_realm(pkt));
-
-    /* Finally the length */
-    bcopy((char *)(++ptr),(char *)&temp,2); /* alignment */
-    if (swap_bytes) {
-        /* assume a short is 2 bytes?? */
-        swab((char *)&temp,(char *)&temp2,2);
-        temp = temp2;
-    }
-
-    clen = (int) temp;
-
-    if (krb_debug)
-	printf("Clen is %d\n",clen);
-    return(clen);
-}
-
-/* use the bsd time.h struct defs for PC too! */
-#include <sys/time.h>
-#include <sys/types.h>
-
-static struct timeval tt_local = { 0, 0 };
-static unsigned long rep_err_code;
+#include "krb_locl.h"
 
 /*
  * get_ad_tkt obtains a new service ticket from Kerberos, using
@@ -106,45 +74,33 @@ static unsigned long rep_err_code;
  */
 
 int
-get_ad_tkt(service, sinstance, realm, lifetime)
-	char *service;
-	char *sinstance;
-	char *realm;
-	int lifetime;
+get_ad_tkt(char *service, char *sinstance, char *realm, int lifetime)
 {
     static KTEXT_ST pkt_st;
     KTEXT pkt = & pkt_st;	/* Packet to KDC */
     static KTEXT_ST rpkt_st;
     KTEXT rpkt = &rpkt_st;	/* Returned packet */
-    static KTEXT_ST cip_st;
-    KTEXT cip = &cip_st;	/* Returned Ciphertext */
-    static KTEXT_ST tkt_st;
-    KTEXT tkt = &tkt_st;	/* Current ticket */
-    des_cblock ses;                /* Session key for tkt */
+
     CREDENTIALS cr;
-    int kvno;			/* Kvno for session key */
     char lrealm[REALM_SZ];
-    des_cblock key;		/* Key for decrypting cipher */
-    des_key_schedule key_s;
-    long time_ws = 0;
-
-    char s_name[SNAME_SZ];
-    char s_instance[INST_SZ];
-    int msg_byte_order;
+    u_int32_t time_ws = 0;
     int kerror;
-    char rlm[REALM_SZ];
-    char *ptr;
+    unsigned char *p;
 
-    unsigned long kdc_time;   /* KDC time */
+    /*
+     * First check if we have a "real" TGT for the corresponding
+     * realm, if we don't, use ordinary inter-realm authentication.
+     */
 
-    if ((kerror = krb_get_tf_realm(TKT_FILE, lrealm)) != KSUCCESS)
+    kerror = krb_get_cred(KRB_TICKET_GRANTING_TICKET, realm, realm, &cr);
+    if (kerror == KSUCCESS)
+      strncpy(lrealm, realm, REALM_SZ);
+    else
+      kerror = krb_get_tf_realm(TKT_FILE, lrealm);
+    
+    if (kerror != KSUCCESS)
 	return(kerror);
 
-    /* Create skeleton of packet to be sent */
-    (void) gettimeofday(&tt_local,(struct timezone *) 0);
-
-    pkt->length = 0;
-
     /*
      * Look for the session key (and other stuff we don't need)
      * in the ticket file for krbtgt.realm@lrealm where "realm" 
@@ -153,7 +109,8 @@ get_ad_tkt(service, sinstance, realm, lifetime)
      * have this, we will try to get it.
      */
     
-    if ((kerror = krb_get_cred("krbtgt",realm,lrealm,&cr)) != KSUCCESS) {
+    if ((kerror = krb_get_cred(KRB_TICKET_GRANTING_TICKET,
+			       realm, lrealm, &cr)) != KSUCCESS) {
 	/*
 	 * If realm == lrealm, we have no hope, so let's not even try.
 	 */
@@ -161,9 +118,14 @@ get_ad_tkt(service, sinstance, realm, lifetime)
 	    return(AD_NOTGT);
 	else{
 	    if ((kerror = 
-		 get_ad_tkt("krbtgt",realm,lrealm,lifetime)) != KSUCCESS)
-		return(kerror);
-	    if ((kerror = krb_get_cred("krbtgt",realm,lrealm,&cr)) != KSUCCESS)
+		 get_ad_tkt(KRB_TICKET_GRANTING_TICKET,
+			    realm, lrealm, lifetime)) != KSUCCESS)
+		if (kerror == KDC_PR_UNKNOWN)
+		  return(AD_INTR_RLM_NOTGT);
+		else
+		  return(kerror);
+	    if ((kerror = krb_get_cred(KRB_TICKET_GRANTING_TICKET,
+				       realm, lrealm, &cr)) != KSUCCESS)
 		return(kerror);
 	}
     }
@@ -174,105 +136,55 @@ get_ad_tkt(service, sinstance, realm, lifetime)
      * into "pkt".  Then tack other stuff on the end.
      */
     
-    kerror = krb_mk_req(pkt,"krbtgt",realm,lrealm,0L);
+    kerror = krb_mk_req(pkt,
+			KRB_TICKET_GRANTING_TICKET,
+			realm,lrealm,0L);
 
     if (kerror)
 	return(AD_NOTGT);
 
-    /* timestamp */
-    bcopy((char *) &time_ws,(char *) (pkt->dat+pkt->length),4);
-    pkt->length += 4;
-    *(pkt->dat+(pkt->length)++) = (char) lifetime;
-    (void) strcpy((char *) (pkt->dat+pkt->length),service);
-    pkt->length += 1 + strlen(service);
-    (void) strcpy((char *)(pkt->dat+pkt->length),sinstance);
-    pkt->length += 1 + strlen(sinstance);
+    p = pkt->dat + pkt->length;
 
+    p += krb_put_int(time_ws, p, 4);
+    p += krb_put_int(lifetime, p, 1);
+    p += krb_put_nir(service, sinstance, NULL, p);
+    
+    pkt->length = p - pkt->dat;
     rpkt->length = 0;
-
+    
     /* Send the request to the local ticket-granting server */
     if ((kerror = send_to_kdc(pkt, rpkt, realm))) return(kerror);
 
     /* check packet version of the returned packet */
-    if (pkt_version(rpkt) != KRB_PROT_VERSION )
-        return(INTK_PROT);
-
-    /* Check byte order */
-    msg_byte_order = pkt_msg_type(rpkt) & 1;
-    swap_bytes = 0;
-    if (msg_byte_order != HOST_BYTE_ORDER)
-	swap_bytes++;
-
-    switch (pkt_msg_type(rpkt) & ~1) {
-    case AUTH_MSG_KDC_REPLY:
-	break;
-    case AUTH_MSG_ERR_REPLY:
-	bcopy(pkt_err_code(rpkt), (char *) &rep_err_code, 4);
-	if (swap_bytes)
-	    swap_u_long(rep_err_code);
-	return(rep_err_code);
-
-    default:
-	return(INTK_PROT);
-    }
-
-    /* Extract the ciphertext */
-    cip->length = pkt_clen(rpkt);       /* let clen do the swap */
-
-    bcopy((char *) pkt_cipher(rpkt),(char *) (cip->dat),cip->length);
 
-#ifndef NOENCRYPTION
-    /* Attempt to decrypt it */
-
-    des_key_sched(&cr.session,key_s);
-    if (krb_debug)  printf("About to do decryption ...");
-    des_pcbc_encrypt((des_cblock *)cip->dat,(des_cblock *)cip->dat,
-                 (long) cip->length,key_s,&cr.session,0);
-#endif /* !NOENCRYPTION */
-    /* Get rid of all traces of key */
-    bzero((char *) cr.session, sizeof(key));
-    bzero((char *) key_s, sizeof(key_s));
-
-    ptr = (char *) cip->dat;
-
-    bcopy(ptr,(char *)ses,8);
-    ptr += 8;
-
-    (void) strcpy(s_name,ptr);
-    ptr += strlen(s_name) + 1;
-
-    (void) strcpy(s_instance,ptr);
-    ptr += strlen(s_instance) + 1;
-
-    (void) strcpy(rlm,ptr);
-    ptr += strlen(rlm) + 1;
-
-    lifetime = (unsigned char) ptr[0];
-    kvno = (unsigned long) ptr[1];
-    tkt->length = (int) ptr[2];
-    ptr += 3;
-    bcopy(ptr,(char *)(tkt->dat),tkt->length);
-    ptr += tkt->length;
-
-    if (strcmp(s_name, service) || strcmp(s_instance, sinstance) ||
-        strcmp(rlm, realm))	/* not what we asked for */
-	return(INTK_ERR);	/* we need a better code here XXX */
-
-    /* check KDC time stamp */
-    bcopy(ptr,(char *)&kdc_time,4); /* Time (coarse) */
-    if (swap_bytes) swap_u_long(kdc_time);
-
-    ptr += 4;
+    {
+	KTEXT_ST cip;
+	CREDENTIALS cred;
+	struct timeval tv;
+
+	kerror = kdc_reply_cipher(rpkt, &cip);
+	if(kerror != KSUCCESS)
+	    return kerror;
+	
+	encrypt_ktext(&cip, &cr.session, DES_DECRYPT);
+
+	kerror = kdc_reply_cred(&cip, &cred);
+	if(kerror != KSUCCESS)
+	    return kerror;
+
+	if (strcmp(cred.service, service) || strcmp(cred.instance, sinstance) ||
+	    strcmp(cred.realm, realm))	/* not what we asked for */
+	    return INTK_ERR;	/* we need a better code here XXX */
+	
+	gettimeofday(&tv, NULL);
+	if (abs((int)(tv.tv_sec - cred.issue_date)) > CLOCK_SKEW) {
+	    return RD_AP_TIME; /* XXX should probably be better code */
+	}
+	
 
-    (void) gettimeofday(&tt_local,(struct timezone *) 0);
-    if (abs((int)(tt_local.tv_sec - kdc_time)) > CLOCK_SKEW) {
-        return(RD_AP_TIME);		/* XXX should probably be better
-					   code */
+	kerror = save_credentials(cred.service, cred.instance, cred.realm, 
+				  cred.session, cred.lifetime, cred.kvno, 
+				  &cred.ticket_st, tv.tv_sec);
+	return kerror;
     }
-
-    if ((kerror = save_credentials(s_name,s_instance,rlm,ses,lifetime,
-				  kvno,tkt,tt_local.tv_sec)))
-	return(kerror);
-
-    return(AD_OK);
 }
diff --git a/kerberosIV/krb/get_admhst.c b/kerberosIV/krb/get_admhst.c
deleted file mode 100644
index 59d11450829..00000000000
--- a/kerberosIV/krb/get_admhst.c
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_admhst.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-/*
- * Given a Kerberos realm, find a host on which the Kerberos database
- * administration server can be found.
- *
- * krb_get_admhst takes a pointer to be filled in, a pointer to the name
- * of the realm for which a server is desired, and an integer n, and
- * returns (in h) the nth administrative host entry from the configuration
- * file (KRB_CONF, defined in "krb.h") associated with the specified realm.
- *
- * On error, get_admhst returns KFAILURE. If all goes well, the routine
- * returns KSUCCESS.
- *
- * For the format of the KRB_CONF file, see comments describing the routine
- * krb_get_krbhst().
- *
- * This is a temporary hack to allow us to find the nearest system running
- * a Kerberos admin server.  In the long run, this functionality will be
- * provided by a nameserver.
- */
-
-int
-krb_get_admhst(h, r, n)
-	char *h;
-	char *r;
-	int n;
-{
-    FILE *cnffile;
-    char tr[REALM_SZ];
-    char linebuf[BUFSIZ];
-    char scratch[64];
-    register int i;
-
-    if ((cnffile = fopen(KRB_CONF,"r")) == NULL) {
-        char tbuf[128];
-        char *tdir = NULL;
-        if (issetugid() == 0)
-	   tdir = (char *) getenv("KRBCONFDIR");
-        strncpy(tbuf, tdir ? tdir : "/etc", sizeof(tbuf)-1);
-        tbuf[sizeof(tbuf)-1] = 0;
-        strncat(tbuf, "/krb.conf", sizeof(tbuf)-strlen(tbuf));
-        if ((cnffile = fopen(tbuf,"r")) == NULL)
-            return(KFAILURE);
-    }
-    if (fgets(linebuf, BUFSIZ, cnffile) == NULL) {
-	/* error reading */
-	(void) fclose(cnffile);
-	return(KFAILURE);
-    }
-    if (!strchr(linebuf, '\n')) {
-	/* didn't all fit into buffer, punt */
-	(void) fclose(cnffile);
-	return(KFAILURE);
-    }
-    for (i = 0; i < n; ) {
-	/* run through the file, looking for admin host */
-	if (fgets(linebuf, BUFSIZ, cnffile) == NULL) {
-            (void) fclose(cnffile);
-            return(KFAILURE);
-        }
-	/* need to scan for a token after 'admin' to make sure that
-	   admin matched correctly */
-	if (sscanf(linebuf, "%s %s admin %s", tr, h, scratch) != 3)
-	    continue;
-        if (!strcmp(tr,r))
-            i++;
-    }
-    (void) fclose(cnffile);
-    return(KSUCCESS);
-}
diff --git a/kerberosIV/krb/get_cred.c b/kerberosIV/krb/get_cred.c
index 2882de597ad..03d38bf4fce 100644
--- a/kerberosIV/krb/get_cred.c
+++ b/kerberosIV/krb/get_cred.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_cred.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_cred.c,v 1.6 1997/05/30 17:38:29 bg Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -39,13 +33,16 @@ or implied warranty.
  */
 
 int
-krb_get_cred(service, instance, realm, c)
-	char *service;		/* Service name */
-	char *instance;		/* Instance */
-	char *realm;		/* Auth domain */
-	CREDENTIALS *c;		/* Credentials struct */
+krb_get_cred(char *service,	/* Service name */
+	     char *instance,	/* Instance */
+	     char *realm,	/* Auth domain */
+	     CREDENTIALS *c)	/* Credentials struct */
 {
     int tf_status;              /* return value of tf function calls */
+    CREDENTIALS cr;
+
+    if (c == 0)
+        c = &cr;
 
     /* Open ticket file and lock it for shared reading */
     if ((tf_status = tf_init(TKT_FILE, R_TKT_FIL)) != KSUCCESS)
@@ -60,13 +57,12 @@ krb_get_cred(service, instance, realm, c)
     /* Search for requested service credentials and copy into c */
        
     while ((tf_status = tf_get_cred(c)) == KSUCCESS) {
-        /* Is this the right ticket? */
 	if ((strcmp(c->service,service) == 0) &&
            (strcmp(c->instance,instance) == 0) &&
            (strcmp(c->realm,realm) == 0))
 		   break;
     }
-    (void) tf_close();
+    tf_close();
 
     if (tf_status == EOF)
 	return (GC_NOTKT);
diff --git a/kerberosIV/krb/get_default_principal.c b/kerberosIV/krb/get_default_principal.c
new file mode 100644
index 00000000000..01054df3167
--- /dev/null
+++ b/kerberosIV/krb/get_default_principal.c
@@ -0,0 +1,89 @@
+/* $KTH: get_default_principal.c,v 1.10 1997/04/01 08:18:28 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+int
+krb_get_default_principal(char *name, char *instance, char *realm)
+{
+  char *file;
+  int ret;
+
+  char *p;
+
+  if ((file = getenv("KRBTKFILE")) == NULL)
+      file = TKT_FILE;  
+  
+  ret = krb_get_tf_fullname(file, name, instance, realm);
+  if(ret == KSUCCESS)
+      return 0;
+
+  p = getenv("KRB4PRINCIPAL");
+  if(p && kname_parse(name, instance, realm, p) == KSUCCESS)
+      return 1;
+      
+  {
+    struct passwd *pw;
+    pw = getpwuid(getuid());
+    if(pw == NULL){
+      return -1;
+    }
+
+    strcpy(name, pw->pw_name);
+    strcpy(instance, "");
+    krb_get_lrealm(realm, 1);
+
+    if(strcmp(name, "root") == 0){
+      p = NULL;
+      p = getlogin();
+      if(p == NULL)
+	p = getenv("USER");
+      if(p == NULL)
+	p = getenv("LOGNAME");
+      if(p){
+	strncpy (name, p, ANAME_SZ);
+	name[ANAME_SZ - 1] = '\0';
+	strcpy(instance, "root");
+      }
+    }
+    return 1;
+  }
+  return -1;
+}
diff --git a/kerberosIV/krb/get_host.c b/kerberosIV/krb/get_host.c
new file mode 100644
index 00000000000..8e62ceedf3e
--- /dev/null
+++ b/kerberosIV/krb/get_host.c
@@ -0,0 +1,309 @@
+/* $KTH: get_host.c,v 1.31 1997/09/26 17:42:37 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+static struct host_list {
+    struct krb_host *this;
+    struct host_list *next;
+} *hosts;
+
+static int krb_port = 0;
+
+static void
+free_hosts(struct host_list *h)
+{
+    struct host_list *t;
+    while(h){
+	if(h->this->realm)
+	    free(h->this->realm);
+	if(h->this->host)
+	    free(h->this->host);
+	t = h;
+	h = h->next;
+	free(t);
+    }
+}
+
+static int
+parse_address(char *address, enum krb_host_proto *proto, char **host, int *port)
+{
+    char *p, *q;
+    int default_port = krb_port;
+    *proto = PROTO_UDP;
+    if(strncmp(address, "http://", 7) == 0){
+	p = address + 7;
+	*proto = PROTO_HTTP;
+	default_port = 80;
+    }else{
+	p = strchr(address, '/');
+	if(p){
+	    char prot[32];
+	    struct protoent *pp;
+	    strncpy(prot, address, p - address);
+	    prot[p - address] = 0;
+	    if((pp = getprotobyname(prot))){
+		switch(pp->p_proto){
+		case IPPROTO_UDP:
+		    *proto = PROTO_UDP;
+		    break;
+		case IPPROTO_TCP:
+		    *proto = PROTO_TCP;
+		    break;
+		default:	
+		krb_warning("Unknown protocol `%s', Using default `udp'.\n", 
+			    prot);
+		}
+	    } else
+		krb_warning("Bad protocol name `%s', Using default `udp'.\n", 
+			    prot);
+	    p++;
+	}else
+	    p = address;
+    }
+    q = strchr(p, ':');
+    if(q){
+	*host = (char*)malloc(q - p + 1);
+	strncpy(*host, p, q - p);
+	(*host)[q - p] = 0;
+	q++;
+	{
+	    struct servent *sp = getservbyname(q, NULL);
+	    if(sp)
+		*port = ntohs(sp->s_port);
+	    else
+		if(sscanf(q, "%d", port) != 1){
+		    krb_warning("Bad port specification `%s', using port %d.", 
+				q, krb_port);
+		    *port = krb_port;
+		}
+	}
+    }else{
+	*host = strdup(p);
+	*port = default_port;
+    }
+    return 0;
+}
+
+static int
+add_host(char *realm, char *address, int admin, int validate)
+{
+    struct krb_host *host;
+    struct host_list *p, **last = &hosts;
+    host = (struct krb_host*)malloc(sizeof(struct krb_host));
+    parse_address(address, &host->proto, &host->host, &host->port);
+    if(validate && gethostbyname(host->host) == NULL){
+	free(host->host);
+	free(host);
+	return 1;
+    }
+    host->admin = admin;
+    for(p = hosts; p; p = p->next){
+	if(strcmp(realm, p->this->realm) == 0 &&
+	   strcmp(host->host, p->this->host) == 0 && 
+	   host->proto == p->this->proto &&
+	   host->port == p->this->port){
+	    free(host->host);
+	    free(host);
+	    return 1;
+	}
+	last = &p->next;
+    }
+    host->realm = strdup(realm);
+    p = (struct host_list*)malloc(sizeof(struct host_list));
+    p->this = host;
+    p->next = NULL;
+    *last = p;
+    return 0;
+}
+
+
+
+static int
+read_file(const char *filename, const char *r)
+{
+    char line[1024];
+    char realm[1024];
+    char address[1024];
+    char scratch[1024];
+    int n;
+    int nhosts = 0;
+    
+    FILE *f = fopen(filename, "r");
+    if(f == NULL)
+	return -1;
+    while(fgets(line, sizeof(line), f)){
+	n = sscanf(line, "%s %s admin %s", realm, address, scratch);
+	if(n == 2 || n == 3){
+	    if(strcmp(realm, r))
+		continue;
+	    if(add_host(realm, address, n == 3, 0) == 0)
+		nhosts++;
+	}
+    }
+    fclose(f);
+    return nhosts;
+}
+
+static int
+init_hosts(char *realm)
+{
+    static const char *files[] = KRB_CNF_FILES;
+    int i;
+    char *dir = getenv("KRBCONFDIR");
+
+    krb_port = ntohs(k_getportbyname (KRB_SERVICE, NULL, htons(KRB_PORT)));
+    if(dir){
+	char file[MAXPATHLEN];
+	if(k_concat(file, sizeof(file), dir, "/krb.conf", NULL) == 0)
+	    read_file(file, realm);
+    }
+    for(i = 0; files[i]; i++)
+	read_file(files[i], realm);
+    return 0;
+}
+
+static void
+srv_find_realm(char *realm, char *proto, char *service)
+{
+    char *domain;
+    struct dns_reply *r;
+    struct resource_record *rr;
+    
+    k_mconcat(&domain, 1024, service, ".", proto, ".", realm, ".", NULL);
+    
+    if(domain == NULL)
+	return;
+    
+    r = dns_lookup(domain, "srv");
+    if(r == NULL)
+	r = dns_lookup(domain, "txt");
+    if(r == NULL){
+	free(domain);
+	return;
+    }
+    for(rr = r->head; rr; rr = rr->next){
+	if(rr->type == T_SRV){
+	    char buf[1024];
+
+	    if (snprintf (buf,
+			  sizeof(buf),
+			  "%s/%s:%u",
+			  proto,
+			  rr->u.srv->target,
+			  rr->u.srv->port) < sizeof(buf))
+		add_host(realm, buf, 0, 0);
+	}else if(rr->type == T_TXT)
+	    add_host(realm, rr->u.txt, 0, 0);
+    }
+    dns_free_data(r);
+    free(domain);
+}
+
+struct krb_host*
+krb_get_host(int nth, char *realm, int admin)
+{
+    struct host_list *p;
+    static char orealm[REALM_SZ];
+    if(orealm[0] == 0 || strcmp(realm, orealm)){
+	/* quick optimization */
+	if(realm && realm[0]){
+	    strncpy(orealm, realm, sizeof(orealm) - 1);
+	    orealm[sizeof(orealm) - 1] = 0;
+	}else{
+	    int ret = krb_get_lrealm(orealm, 1);
+	    if(ret != KSUCCESS)
+		return NULL;
+	}
+	
+	if(hosts){
+	    free_hosts(hosts);
+	    hosts = NULL;
+	}
+	
+	init_hosts(orealm);
+    
+	srv_find_realm(orealm, "udp", KRB_SERVICE);
+	srv_find_realm(orealm, "tcp", KRB_SERVICE);
+	
+	{
+	    /* XXX this assumes no one has more than 99999 kerberos
+	       servers */
+	    char host[REALM_SZ + sizeof("kerberos-XXXXX..")];
+	    int i = 0;
+	    sprintf(host, "kerberos.%s.", orealm);
+	    add_host(orealm, host, 1, 1);
+	    do{
+		i++;
+		sprintf(host, "kerberos-%d.%s.", i, orealm);
+	    }while(i < 100000 && add_host(orealm, host, 0, 1) == 0);
+	}
+    }
+    
+    for(p = hosts; p; p = p->next){
+	if(strcmp(orealm, p->this->realm) == 0 &&
+	   (!admin || p->this->admin))
+	    if(nth == 1)
+		return p->this;
+	    else
+		nth--;
+    }
+    return NULL;
+}
+
+int
+krb_get_krbhst(char *host, char *realm, int nth)
+{
+    struct krb_host *p = krb_get_host(nth, realm, 0);
+    if(p == NULL)
+	return KFAILURE;
+    strcpy(host, p->host);
+    return KSUCCESS;
+}
+
+int
+krb_get_admhst(char *host, char *realm, int nth)
+{
+    struct krb_host *p = krb_get_host(nth, realm, 1);
+    if(p == NULL)
+	return KFAILURE;
+    strcpy(host, p->host);
+    return KSUCCESS;
+}
diff --git a/kerberosIV/krb/get_in_tkt.c b/kerberosIV/krb/get_in_tkt.c
index f894640af3e..393f25b8ab5 100644
--- a/kerberosIV/krb/get_in_tkt.c
+++ b/kerberosIV/krb/get_in_tkt.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_in_tkt.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_in_tkt.c,v 1.19 1997/10/03 21:51:42 joda Exp $ */ 
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -30,67 +24,49 @@ or implied warranty.
 #include "krb_locl.h"
 
 /*
- * This file contains two routines: passwd_to_key() converts
- * a password into a DES key (prompting for the password if
- * not supplied), and krb_get_pw_in_tkt() gets an initial ticket for
- * a user.
+ * This file contains three routines: passwd_to_key() and
+ * passwd_to_afskey() converts a password into a DES key, using the
+ * normal strinttokey and the AFS one, respectively, and
+ * krb_get_pw_in_tkt() gets an initial ticket for a user.  
  */
 
 /*
- * passwd_to_key(): given a password, return a DES key.
- * There are extra arguments here which (used to be?)
- * used by srvtab_to_key().
- *
- * If the "passwd" argument is not null, generate a DES
- * key from it, using string_to_key().
- *
- * If the "passwd" argument is null, call des_read_password()
- * to prompt for a password and then convert it into a DES key.
- *
- * In either case, the resulting key is put in the "key" argument,
- * and 0 is returned.
+ * passwd_to_key() and passwd_to_afskey: given a password, return a DES key.
  */
 
-/*ARGSUSED */
-static int
-passwd_to_key(user, instance, realm, passwd, key)
-	char *user;
-	char *instance;
-	char *realm;
-	char *passwd;
-	des_cblock *key;
+int
+passwd_to_key(char *user, char *instance, char *realm, void *passwd,
+	      des_cblock *key)
 {
-#ifdef NOENCRYPTION
-    if (!passwd)
-	placebo_read_password(key, "Kerberos Password: ", 0);
-#else
-    if (passwd)
-	des_string_to_key(passwd,key);
-    else
-	des_read_password(key,"Kerberos Password: ",0);
+#ifndef NOENCRYPTION
+    des_string_to_key((char *)passwd, key);
 #endif
-    return (0);
+    return 0;
 }
 
-/*ARGSUSED */
-static int
-afs_passwd_to_key(user, instance, realm, passwd, key)
-	char *user;
-	char *instance;
-	char *realm;
-	char *passwd;
-	des_cblock *key;
+int
+passwd_to_5key(char *user, char *instance, char *realm, void *passwd, 
+	       des_cblock *key)
 {
-#ifdef NOENCRYPTION
-    if (!passwd)
-        placebo_read_password(key, "Kerberos Password: ", 0);
-#else /* Do encyryption */
-    if (passwd)
-        afs_string_to_key(passwd, realm, key);
-    else {
-        des_read_password(key, "Kerberos Password: ", 0);
-    }
-#endif /* NOENCRYPTION */
+    char *p;
+    size_t len;
+    len = k_mconcat (&p, 512, passwd, realm, user, instance, NULL);
+    if(len == 0)
+	return  -1;
+    des_string_to_key(p, key);
+    memset(p, 0, len);
+    free(p);
+    return 0;
+}
+
+
+int
+passwd_to_afskey(char *user, char *instance, char *realm, void *passwd,
+		  des_cblock *key)
+{
+#ifndef NOENCRYPTION
+    afs_string_to_key((char *)passwd, realm, key);
+#endif
     return (0);
 }
 
@@ -112,208 +88,50 @@ afs_passwd_to_key(user, instance, realm, passwd, key)
  */
 
 int
-krb_get_pw_in_tkt(user, instance, realm, service, sinstance, life, password)
-	char *user;
-	char *instance;
-	char *realm;
-	char *service;
-	char *sinstance;
-	int life;
-	char *password;
+krb_get_pw_in_tkt(char *user, char *instance, char *realm, char *service,
+		  char *sinstance, int life, char *password)
 {
     char pword[100];		/* storage for the password */
     int code;
 
     /* Only request password once! */
     if (!password) {
-        if (des_read_pw_string(pword, sizeof(pword)-1, "Kerberos Password: ", 0))
-            pword[0] = '\0'; /* something wrong */
+        if (des_read_pw_string(pword, sizeof(pword)-1, "Password: ", 0)){
+	    memset(pword, 0, sizeof(pword));
+	    return INTK_BADPW;
+	}
         password = pword;
     }
 
-    code = krb_get_in_tkt(user,instance,realm,service,sinstance,life,
-                          passwd_to_key, NULL, password);
-    if (code != INTK_BADPW)
-      goto done;
-
-    code = krb_get_in_tkt(user,instance,realm,service,sinstance,life,
-                          afs_passwd_to_key, NULL, password);
-    if (code != INTK_BADPW)
-      goto done;
+    {
+	KTEXT_ST as_rep;
+	CREDENTIALS cred;
+	int ret = 0;
+	key_proc_t key_procs[] = { passwd_to_key, passwd_to_afskey, 
+				   passwd_to_5key, NULL };
+	key_proc_t *kp;
+	
+	code = krb_mk_as_req(user, instance, realm,
+			     service, sinstance, life, &as_rep);
+	if(code)
+	    return code;
+	for(kp = key_procs; *kp; kp++){
+	    KTEXT_ST tmp;
+	    memcpy(&tmp, &as_rep, sizeof(as_rep));
+	    code = krb_decode_as_rep(user, instance, realm, service, sinstance, 
+				     *kp, NULL, password, &tmp, &cred);
+	    if(code == 0)
+		break;
+	    if(code != INTK_BADPW)
+		ret = code; /* this is probably a better code than
+			       what code gets after this loop */
+	}
+	if(code)
+	    return ret ? ret : code;
 
-  done:
+	code = tf_setup(&cred, user, instance);
+    }
     if (password == pword)
-        bzero(pword, sizeof(pword));
+        memset(pword, 0, sizeof(pword));
     return(code);
 }
-
-#ifdef NOENCRYPTION
-/*
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_in_tkt.c,v $
- * $Author: millert $
- *
- * Copyright 1985, 1986, 1987, 1988 by the Massachusetts Institute
- * of Technology.
- *
- * For copying and distribution information, please see the file
- * <mit-copyright.h>.
- *
- * This routine prints the supplied string to standard
- * output as a prompt, and reads a password string without
- * echoing.
- */
-
-#ifndef	lint
-static char rcsid_read_password_c[] =
-"Bones$Header: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_in_tkt.c,v 1.4 1997/08/18 03:11:21 millert Exp $";
-#endif /* lint */
-
-#include <des.h>
-#include "conf.h"
-
-#include <stdio.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <signal.h>
-#include <setjmp.h>
-
-static jmp_buf env;
-
-static void sig_restore();
-static push_signals(), pop_signals();
-int placebo_read_pw_string();
-
-/*** Routines ****************************************************** */
-int
-placebo_read_password(k,prompt,verify)
-    des_cblock *k;
-    char *prompt;
-    int	verify;
-{
-    int ok;
-    char key_string[BUFSIZ];
-
-    if (setjmp(env)) {
-	ok = -1;
-	goto lose;
-    }
-
-    ok = placebo_read_pw_string(key_string, BUFSIZ, prompt, verify);
-    if (ok == 0)
-	bzero(k, sizeof(C_Block));
-
-lose:
-    bzero(key_string, sizeof (key_string));
-    return ok;
-}
-
-/*
- * This version just returns the string, doesn't map to key.
- *
- * Returns 0 on success, non-zero on failure.
- */
-
-int
-placebo_read_pw_string(s,max,prompt,verify)
-    char *s;
-    int	max;
-    char *prompt;
-    int	verify;
-{
-    int ok = 0;
-    char *ptr;
-    
-    jmp_buf old_env;
-    struct sgttyb tty_state;
-    char key_string[BUFSIZ];
-
-    if (max > BUFSIZ) {
-	return -1;
-    }
-
-    bcopy(old_env, env, sizeof(env));
-    if (setjmp(env))
-	goto lose;
-
-    /* save terminal state*/
-    if (ioctl(0,TIOCGETP,&tty_state) == -1) 
-	return -1;
-
-    push_signals();
-    /* Turn off echo */
-    tty_state.sg_flags &= ~ECHO;
-    if (ioctl(0,TIOCSETP,&tty_state) == -1)
-	return -1;
-    while (!ok) {
-	printf(prompt);
-	fflush(stdout);
-	if (!fgets(s, max, stdin)) {
-	    clearerr(stdin);
-	    continue;
-	}
-	if ((ptr = strchr(s, '\n')))
-	    *ptr = '\0';
-	if (verify) {
-	    printf("\nVerifying, please re-enter %s",prompt);
-	    fflush(stdout);
-	    if (!fgets(key_string, sizeof(key_string), stdin)) {
-		clearerr(stdin);
-		continue;
-	    }
-            if ((ptr = strchr(key_string, '\n')))
-	    *ptr = '\0';
-	    if (strcmp(s,key_string)) {
-		printf("\n\07\07Mismatch - try again\n");
-		fflush(stdout);
-		continue;
-	    }
-	}
-	ok = 1;
-    }
-
-lose:
-    if (!ok)
-	bzero(s, max);
-    printf("\n");
-    /* turn echo back on */
-    tty_state.sg_flags |= ECHO;
-    if (ioctl(0,TIOCSETP,&tty_state))
-	ok = 0;
-    pop_signals();
-    bcopy(env, old_env, sizeof(env));
-    if (verify)
-	bzero(key_string, sizeof (key_string));
-    s[max-1] = 0;		/* force termination */
-    return !ok;			/* return nonzero if not okay */
-}
-
-/*
- * this can be static since we should never have more than
- * one set saved....
- */
-static RETSIGTYPE (*old_sigfunc[NSIG])();
-
-static
-push_signals()
-{
-    register i;
-    for (i = 0; i < NSIG; i++)
-	old_sigfunc[i] = signal(i,sig_restore);
-}
-
-static
-pop_signals()
-{
-    register i;
-    for (i = 0; i < NSIG; i++)
-	signal(i,old_sigfunc[i]);
-}
-
-static void
-sig_restore(sig,code,scp)
-    int sig,code;
-    struct sigcontext *scp;
-{
-    longjmp(env,1);
-}
-#endif /* NOENCRYPTION */
diff --git a/kerberosIV/krb/get_krbhst.c b/kerberosIV/krb/get_krbhst.c
deleted file mode 100644
index 0dd0eb96ba1..00000000000
--- a/kerberosIV/krb/get_krbhst.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_krbhst.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-/*
- * Given a Kerberos realm, find a host on which the Kerberos authenti-
- * cation server can be found.
- *
- * krb_get_krbhst takes a pointer to be filled in, a pointer to the name
- * of the realm for which a server is desired, and an integer, n, and
- * returns (in h) the nth entry from the configuration file (KRB_CONF,
- * defined in "krb.h") associated with the specified realm.
- *
- * On end-of-file, krb_get_krbhst returns KFAILURE. If all goes well,
- * the routine returns KSUCCESS.
- *
- * The KRB_CONF file contains the name of the local realm in the first
- * line (not used by this routine), followed by lines indicating realm/host
- * entries.  The words "admin server" following the hostname indicate that 
- * the host provides an administrative database server.
- *
- * For example:
- *
- *	ATHENA.MIT.EDU
- *	ATHENA.MIT.EDU kerberos-1.mit.edu admin server
- *	ATHENA.MIT.EDU kerberos-2.mit.edu
- *	LCS.MIT.EDU kerberos.lcs.mit.edu admin server
- *
- * This is a temporary hack to allow us to find the nearest system running
- * kerberos.  In the long run, this functionality will be provided by a
- * nameserver.
- */
-
-int
-krb_get_krbhst(h, r, n)
-	char *h;
-	char *r;
-	int n;
-{
-    FILE *cnffile;
-    char tr[REALM_SZ];
-    char linebuf[BUFSIZ];
-    register int i;
-
-    if ((cnffile = fopen(KRB_CONF,"r")) == NULL) {
-        char tbuf[128];
-        char *tdir = NULL;
-	if (issetugid() == 0)
-	   tdir = (char *) getenv("KRBCONFDIR");
-        strncpy(tbuf, tdir ? tdir : "/etc", sizeof(tbuf)-1);
-        tbuf[sizeof(tbuf)-1] = 0;
-        strncat(tbuf, "/krb.conf", sizeof(tbuf)-strlen(tbuf));
-        if ((cnffile = fopen(tbuf,"r")) == NULL)
-            return(KFAILURE);
-    }
-    if (fscanf(cnffile,"%s",tr) == EOF)
-        return(KFAILURE);
-    /* run through the file, looking for the nth server for this realm */
-    for (i = 1; i <= n;) {
-	if (fgets(linebuf, BUFSIZ, cnffile) == NULL) {
-            (void) fclose(cnffile);
-            return(KFAILURE);
-        }
-	if (sscanf(linebuf, "%s %s", tr, h) != 2)
-	    continue;
-        if (!strcmp(tr,r))
-            i++;
-    }
-    (void) fclose(cnffile);
-    return(KSUCCESS);
-}
diff --git a/kerberosIV/krb/get_krbrlm.c b/kerberosIV/krb/get_krbrlm.c
index ff9f0ebc532..24dfd680b4b 100644
--- a/kerberosIV/krb/get_krbrlm.c
+++ b/kerberosIV/krb/get_krbrlm.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_krbrlm.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_krbrlm.c,v 1.16 1997/05/02 01:26:22 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -33,7 +27,9 @@ or implied warranty.
  * krb_get_lrealm takes a pointer to a string, and a number, n.  It fills
  * in the string, r, with the name of the nth realm specified on the
  * first line of the kerberos config file (KRB_CONF, defined in "krb.h").
- * It returns 0 (KSUCCESS) on success, and KFAILURE on failure.
+ * It returns 0 (KSUCCESS) on success, and KFAILURE on failure.  If the
+ * config file does not exist, and if n=1, a successful return will occur
+ * with r = KRB_REALM (also defined in "krb.h").
  *
  * NOTE: for archaic & compatibility reasons, this routine will only return
  * valid results when n = 1.
@@ -42,32 +38,79 @@ or implied warranty.
  * krb_get_krbhst().
  */
 
+static int
+krb_get_lrealm_f(char *r, int n, const char *fname)
+{
+    FILE *f;
+    int ret = KFAILURE;
+    f = fopen(fname, "r");
+    if(f){
+	char buf[REALM_SZ];
+	if(fgets(buf, sizeof(buf), f)){
+	    char *p = buf + strspn(buf, " \t");
+	    p[strcspn(p, " \t\r\n")] = 0;
+	    p[REALM_SZ - 1] = 0;
+	    strcpy(r, p);
+	    ret = KSUCCESS;
+	}
+	fclose(f);
+    }
+    return ret;
+}
+
 int
-krb_get_lrealm(r, n)
-	char *r;
-	int n;
+krb_get_lrealm(char *r, int n)
 {
-    FILE *cnffile;
+  static const char *const files[] = KRB_CNF_FILES;
+  int i;
+  
+  const char *dir = getenv("KRBCONFDIR");
 
-    if (n > 1)
-	return(KFAILURE);  /* Temporary restriction */
+  if (n > 1)
+    return(KFAILURE);		/* Temporary restriction */
 
-    if ((cnffile = fopen(KRB_CONF, "r")) == NULL) {
-        char tbuf[128];
-        char *tdir = NULL;
-	if (issetugid() == 0) 
-	   tdir = (char *) getenv("KRBCONFDIR");
-        strncpy(tbuf, tdir ? tdir : "/etc", sizeof(tbuf)-1);
-        tbuf[sizeof(tbuf)-1] = 0;
-        strncat(tbuf, "/krb.conf", sizeof(tbuf)-strlen(tbuf));
-        if ((cnffile = fopen(tbuf,"r")) == NULL)
-            return(KFAILURE);
-    }
+  /* First try user specified file */
+  if (dir != 0) {
+    char fname[MAXPATHLEN];
+    if(k_concat(fname, sizeof(fname), dir, "/krb.conf", NULL) == 0)
+	if (krb_get_lrealm_f(r, n, fname) == KSUCCESS)
+	    return KSUCCESS;
+  }
+
+  for (i = 0; files[i] != 0; i++)
+    if (krb_get_lrealm_f(r, n, files[i]) == KSUCCESS)
+      return KSUCCESS;
+
+  /* If nothing else works try LOCALDOMAIN, if it exists */
+  if (n == 1)
+    {
+      char *t, hostname[MAXHOSTNAMELEN];
+      k_gethostname(hostname, sizeof(hostname));
+      t = krb_realmofhost(hostname);
+      if (t) {
+	strcpy (r, t);
+	return KSUCCESS;
+      }
+      t = strchr(hostname, '.');
+      if (t == 0)
+	return KFAILURE;	/* No domain part, you loose */
 
-    if (fscanf(cnffile,"%s",r) != 1) {
-        (void) fclose(cnffile);
-        return(KFAILURE);
+      t++;			/* Skip leading dot and upcase the rest */
+      for (; *t; t++, r++)
+	*r = toupper(*t);
+      *r = 0;
+      return(KSUCCESS);
     }
-    (void) fclose(cnffile);
-    return(*r == '#' ? KFAILURE : KSUCCESS);
+  else
+    return(KFAILURE);
+}
+
+/* For SunOS5 compat. */
+char *
+krb_get_default_realm(void)
+{
+  static char local_realm[REALM_SZ]; /* local kerberos realm */
+  if (krb_get_lrealm(local_realm, 1) != KSUCCESS)
+    strcpy(local_realm, "NO.DEFAULT.REALM");
+  return local_realm;
 }
diff --git a/kerberosIV/krb/get_phost.c b/kerberosIV/krb/get_phost.c
deleted file mode 100644
index 8c6c6caef9a..00000000000
--- a/kerberosIV/krb/get_phost.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_phost.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-#define USE_FULL_HOST_NAME      0
-
-#include <ctype.h>
-#include <netdb.h>
-
-/*
- * This routine takes an alias for a host name and returns the first
- * field, lower case, of its domain name.  For example, if "menel" is
- * an alias for host officially named "menelaus" (in /etc/hosts), for
- * the host whose official name is "MENELAUS.MIT.EDU", the name "menelaus"
- * is returned.
- *
- * This is done for historical Athena reasons: the Kerberos name of
- * rcmd servers (rlogin, rsh, rcp) is of the form "rcmd.host@realm"
- * where "host"is the lowercase for of the host name ("menelaus").
- * This should go away: the instance should be the domain name
- * (MENELAUS.MIT.EDU).  But for now we need this routine...
- *
- * A pointer to the name is returned, if found, otherwise a pointer
- * to the original "alias" argument is returned.
- */
-
-char *
-krb_get_phost(alias)
-	char *alias;
-{
-    struct hostent *h;
-    char *phost = alias;
-    if ((h=gethostbyname(alias)) != (struct hostent *)NULL ) {
-#if     USE_FULL_HOST_NAME
-        char *p;
-#else /* USE_FULL_HOST_NAME */
-        char *p = strchr( h->h_name, '.' ); 
-        if (p) 
-            *p = 0; 
-#endif /* USE_FULL_HOST_NAME */
-        p = phost = h->h_name;
-        do {
-            if (isupper(*p)) *p=tolower(*p);
-        } while (*p++);
-    }
-    return(phost);
-}
diff --git a/kerberosIV/krb/get_pw_tkt.c b/kerberosIV/krb/get_pw_tkt.c
deleted file mode 100644
index d2dbf5ee2e1..00000000000
--- a/kerberosIV/krb/get_pw_tkt.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_pw_tkt.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-#include <sys/param.h>
-
-/*
- * Get a ticket for the password-changing server ("changepw.KRB_MASTER").
- *
- * Given the name, instance, realm, and current password of the
- * principal for which the user wants a password-changing-ticket,
- * return either:
- *
- *	GT_PW_BADPW if current password was wrong,
- *	GT_PW_NULL  if principal had a NULL password,
- *	or the result of the krb_get_pw_in_tkt() call.
- *
- * First, try to get a ticket for "user.instance@realm" to use the
- * "changepw.KRB_MASTER" server (KRB_MASTER is defined in "krb.h").
- * The requested lifetime for the ticket is "1", and the current
- * password is the "cpw" argument given.
- *
- * If the password was bad, give up.
- *
- * If the principal had a NULL password in the Kerberos database
- * (indicating that the principal is known to Kerberos, but hasn't
- * got a password yet), try instead to get a ticket for the principal
- * "default.changepw@realm" to use the "changepw.KRB_MASTER" server.
- * Use the password "changepwkrb" instead of "cpw".  Return GT_PW_NULL
- * if all goes well, otherwise the error.
- *
- * If this routine succeeds, a ticket and session key for either the
- * principal "user.instance@realm" or "default.changepw@realm" to use
- * the password-changing server will be in the user's ticket file.
- */
-
-int
-get_pw_tkt(user, instance, realm, cpw)
-	char *user;
-	char *instance;
-	char *realm;
-	char *cpw;
-{
-    char *dot, admin[MAXHOSTNAMELEN];
-    int kerror;
-
-    if ((kerror = krb_get_admhst(admin, realm, 1)) != KSUCCESS)
-        return(GT_PW_BADPW);
-    if ((dot = strchr(admin, '.')) != NULL)
-	*dot = '\0';
-
-    kerror = krb_get_pw_in_tkt(user, instance, realm, "changepw",
-			       admin, 1, cpw);
-
-    if (kerror == INTK_BADPW)
-	return(GT_PW_BADPW);
-
-    if (kerror == KDC_NULL_KEY) {
-	kerror = krb_get_pw_in_tkt("default","changepw",realm,"changepw",
-				   admin,1,"changepwkrb");
-	if (kerror)
-	    return(kerror);
-	return(GT_PW_NULL);
-    }
-
-    return(kerror);
-}
diff --git a/kerberosIV/krb/get_request.c b/kerberosIV/krb/get_request.c
deleted file mode 100644
index ba0e0daaa67..00000000000
--- a/kerberosIV/krb/get_request.c
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_request.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-/*
- * This procedure is obsolete.  It is used in the kerberos_slave
- * code for Version 3 tickets.
- *
- * This procedure sets s_name, and instance to point to
- * the corresponding fields from tne nth request in the packet.
- * it returns the lifetime requested.  Garbage will be returned
- * if there are less than n requests in the packet.
- */
-
-int
-get_request(pkt, n, s_name, instance)
-	KTEXT pkt;		/* The packet itself */
-	int n;			/* Which request do we want */
-	char **s_name;		/* Service name to be filled in */
-	char **instance;	/* Instance name to be filled in */
-{
-    /* Go to the beginning of the request list */
-    char *ptr = (char *) pkt_a_realm(pkt) + 6 +
-	strlen((char *)pkt_a_realm(pkt));
-
-    /* Read requests until we hit the right one */
-    while (n-- > 1) {
-        ptr++;
-        ptr += 1 + strlen(ptr);
-        ptr += 1 + strlen(ptr);
-    }
-
-    /* Set the arguments to point to the right place */
-    *s_name = 1 + ptr;
-    *instance = 2 + ptr + strlen(*s_name);
-
-    /* Return the requested lifetime */
-    return((int) *ptr);
-}
diff --git a/kerberosIV/krb/get_svc_in_tkt.c b/kerberosIV/krb/get_svc_in_tkt.c
index 57f1942cbb9..13171952f42 100644
--- a/kerberosIV/krb/get_svc_in_tkt.c
+++ b/kerberosIV/krb/get_svc_in_tkt.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_svc_in_tkt.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_svc_in_tkt.c,v 1.8 1997/03/23 03:53:09 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -52,18 +46,14 @@ or implied warranty.
  * The service key is placed in "key".
  */
 
-static int 
-srvtab_to_key(user, instance, realm, srvtab, key)
-	char *user;
-	char *instance;
-	char *realm;
-	char *srvtab;
-	unsigned char *key;
+int 
+srvtab_to_key(char *user, char *instance, char *realm, void *srvtab,
+	      des_cblock *key)
 {
     if (!srvtab)
         srvtab = KEYFILE;
 
-    return(read_service_key(user, instance, realm, 0, srvtab,
+    return(read_service_key(user, instance, realm, 0, (char *)srvtab,
                             (char *)key));
 }
 
@@ -78,14 +68,8 @@ srvtab_to_key(user, instance, realm, srvtab, key)
  */
 
 int
-krb_get_svc_in_tkt(user, instance, realm, service, sinstance, life, srvtab)
-	char *user;
-	char *instance;
-	char *realm;
-	char *service;
-	char *sinstance;
-	int life;
-	char *srvtab;
+krb_get_svc_in_tkt(char *user, char *instance, char *realm, char *service,
+		   char *sinstance, int life, char *srvtab)
 {
     return(krb_get_in_tkt(user, instance, realm, service, sinstance,
                           life, srvtab_to_key, NULL, srvtab));
diff --git a/kerberosIV/krb/get_tf_fullname.c b/kerberosIV/krb/get_tf_fullname.c
index 40ec5986eb7..893f49506c8 100644
--- a/kerberosIV/krb/get_tf_fullname.c
+++ b/kerberosIV/krb/get_tf_fullname.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_tf_fullname.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_tf_fullname.c,v 1.6 1997/03/23 03:53:10 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -38,17 +32,13 @@ or implied warranty.
  * krb_get_tf_fullname() takes four arguments: the name of the 
  * ticket file, and variables for name, instance, and realm to be
  * returned in.  Since the realm of a ticket file is not really fully 
- * supported, the realm used will be that of the first ticket in the
- * file as this is the one that was obtained with a password by
+ * supported, the realm used will be that of the the first ticket in 
+ * the file as this is the one that was obtained with a password by
  * krb_get_in_tkt().
  */
 
 int
-krb_get_tf_fullname(ticket_file, name, instance, realm)
-	char *ticket_file;
-	char *name;
-	char *instance;
-	char *realm;
+krb_get_tf_fullname(char *ticket_file, char *name, char *instance, char *realm)
 {
     int tf_status;
     CREDENTIALS c;
@@ -74,7 +64,7 @@ krb_get_tf_fullname(ticket_file, name, instance, realm)
 	else
 	    return(tf_status);
     }    
-    (void) tf_close();
+    tf_close();
     
     return(tf_status);
 }
diff --git a/kerberosIV/krb/get_tf_realm.c b/kerberosIV/krb/get_tf_realm.c
index 04b19894ac2..fb02f775085 100644
--- a/kerberosIV/krb/get_tf_realm.c
+++ b/kerberosIV/krb/get_tf_realm.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/get_tf_realm.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: get_tf_realm.c,v 1.5 1997/03/23 03:53:10 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -41,9 +35,7 @@ or implied warranty.
  */
 
 int
-krb_get_tf_realm(ticket_file, realm)
-	char *ticket_file;
-	char *realm;
+krb_get_tf_realm(char *ticket_file, char *realm)
 {
     return(krb_get_tf_fullname(ticket_file, 0, 0, realm));
 }
diff --git a/kerberosIV/krb/getaddrs.c b/kerberosIV/krb/getaddrs.c
new file mode 100644
index 00000000000..9a45422b090
--- /dev/null
+++ b/kerberosIV/krb/getaddrs.c
@@ -0,0 +1,105 @@
+/* $KTH: getaddrs.c,v 1.20 1997/11/09 06:13:32 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+#include <sys/ioctl.h>
+#include <net/if.h>
+#include <sys/sockio.h>
+
+/*
+ * Return number and list of all local adresses.
+ */
+
+int
+k_get_all_addrs (struct in_addr **l)
+{
+     int fd;
+     char buf[BUFSIZ];
+     struct ifreq ifreq;
+     struct ifconf ifconf;
+     int num, j;
+     char *p;
+
+     fd = socket(AF_INET, SOCK_DGRAM, 0);
+     if (fd < 0)
+	  return -1;
+
+     ifconf.ifc_len = sizeof(buf);
+     ifconf.ifc_buf = buf;
+     if(ioctl(fd, SIOCGIFCONF, &ifconf) < 0)
+	  return -1;
+     num = ifconf.ifc_len / sizeof(struct ifreq);
+     *l = malloc(num * sizeof(struct in_addr));
+     if(*l == NULL) {
+	  close (fd);
+	  return -1;
+     }
+
+     j = 0;
+     ifreq.ifr_name[0] = '\0';
+     for (p = ifconf.ifc_buf; p < ifconf.ifc_buf + ifconf.ifc_len;) {
+          struct ifreq *ifr = (struct ifreq *)p;
+	  size_t sz = sizeof(*ifr);
+	  sz = max(sz, sizeof(ifr->ifr_name) + ifr->ifr_addr.sa_len);
+
+	  if(strncmp(ifreq.ifr_name, ifr->ifr_name, sizeof(ifr->ifr_name))) {
+	       if(ioctl(fd, SIOCGIFFLAGS, ifr) < 0) {
+		    close (fd);
+		    free (*l);
+		    return -1;
+	       }
+	       if (ifr->ifr_flags & IFF_UP) {
+		    if(ioctl(fd, SIOCGIFADDR, ifr) < 0) {
+			 close (fd);
+			 free (*l);
+			 return -1;
+		    }
+		    (*l)[j++] = ((struct sockaddr_in *)&ifr->ifr_addr)->sin_addr;
+	       }
+	       ifreq = *ifr;
+	  }
+	  p = p + sz;
+     }
+     if (j != num)
+	  *l = realloc (*l, j * sizeof(struct in_addr));
+     close (fd);
+     return j;
+}
diff --git a/kerberosIV/krb/getrealm.c b/kerberosIV/krb/getrealm.c
index 7d303287d60..91878e8817a 100644
--- a/kerberosIV/krb/getrealm.c
+++ b/kerberosIV/krb/getrealm.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/getrealm.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: getrealm.c,v 1.26 1997/10/08 22:51:13 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -28,15 +22,9 @@ or implied warranty.
   */
 
 #include "krb_locl.h"
-#include <netdb.h>
 
 #define MATCH_SUBDOMAINS        0
 
-/* for Ultrix and friends ... */
-#ifndef MAXHOSTNAMELEN
-#define MAXHOSTNAMELEN 64
-#endif
-
 /*
  * krb_realmofhost.
  * Given a fully-qualified domain-style primary host name,
@@ -55,78 +43,152 @@ or implied warranty.
  * host names should be in the usual form (e.g. FOO.BAR.BAZ)
  */
 
-static char ret_realm[REALM_SZ+1];
+/* To automagically find the correct realm of a host (without
+ * krb.realms) add a text record for your domain with the name of your
+ * realm, like this:
+ *
+ * krb4-realm	IN	TXT	FOO.SE
+ *
+ * The search is recursive, so you can also add entries for specific
+ * hosts. To find the realm of host a.b.c, it first tries
+ * krb4-realm.a.b.c, then krb4-realm.b.c and so on.
+ */
 
-char *
-krb_realmofhost(host)
-	char *host;
+static int
+dns_find_realm(char *hostname, char *realm)
 {
-	char *domain;
-	FILE *trans_file;
-	char trans_host[MAXHOSTNAMELEN+1];
-	char trans_realm[REALM_SZ+1];
-	struct hostent *hp;
-	int retval;
-
-	if ((hp = gethostbyname(host)) != NULL)
-		host = hp->h_name;
-
-	domain = strchr(host, '.');
-
-	/* prepare default */
-	if (domain) {
-		ret_realm[0] = '\0';
-	} else {
-		krb_get_lrealm(ret_realm, 1);
+    char domain[MAXHOSTNAMELEN + sizeof("krb4-realm..")];
+    char *p;
+    int level = 0;
+    struct dns_reply *r;
+    
+    p = hostname;
+
+    while(1){
+	snprintf(domain, sizeof(domain), "krb4-realm.%s.", p);
+	p = strchr(p, '.');
+	if(p == NULL)
+	    break;
+	p++;
+	r = dns_lookup(domain, "TXT");
+	if(r){
+	    struct resource_record *rr = r->head;
+	    while(rr){
+		if(rr->type == T_TXT){
+		    strncpy(realm, rr->u.txt, REALM_SZ);
+		    realm[REALM_SZ - 1] = 0;
+		    dns_free_data(r);
+		    return level;
+		}
+		rr = rr->next;
+	    }
+	    dns_free_data(r);
 	}
+	level++;
+    }
+    return -1;
+}
+
+
+static FILE *
+open_krb_realms(void)
+{
+  static const char *const files[] = KRB_RLM_FILES;
+  FILE *res;
+  int i;
+  
+  const char *dir = getenv("KRBCONFDIR");
 
-	if ((trans_file = fopen(KRB_RLM_TRANS, "r")) == (FILE *) 0) {
-	        char tbuf[128];
-		char *tdir = NULL;
-		if (issetugid() == 0) 
-			tdir = (char *) getenv("KRBCONFDIR");
-		strncpy(tbuf, tdir ? tdir : "/etc", sizeof(tbuf)-1);
-		tbuf[sizeof(tbuf)-1] = '\0';
-		strncat(tbuf, "/krb.realms", sizeof(tbuf) - strlen(tbuf));
-		if ((trans_file = fopen(tbuf,"r")) == NULL)
-                        return(ret_realm[0] ? ret_realm : NULL); /* krb_errno = KRB_NO_TRANS */
+  /* First try user specified file */
+  if (dir != 0) {
+    char fname[MAXPATHLEN];
+
+    if(k_concat(fname, sizeof(fname), dir, "/krb.realms", NULL) == 0)
+	if ((res = fopen(fname, "r")) != NULL)
+	    return res;
+  }
+
+  for (i = 0; files[i] != 0; i++)
+    if ((res = fopen(files[i], "r")) != NULL)
+      return res;
+
+  return NULL;
+}
+
+static int
+file_find_realm(const char *phost, const char *domain, char *ret_realm)
+{
+    FILE *trans_file;
+    char buf[1024];
+    char trans_host[MAXHOSTNAMELEN];
+    char trans_realm[REALM_SZ];
+    int ret = -1;
+    
+    if ((trans_file = open_krb_realms()) == NULL)
+	return -1;
+
+    while (fgets(buf, sizeof(buf), trans_file)) {
+	char *save = NULL;
+	char *tok = strtok_r(buf, " \t\r\n", &save);
+	if(tok == NULL)
+	    continue;
+	strncpy(trans_host, tok, MAXHOSTNAMELEN);
+	trans_host[MAXHOSTNAMELEN - 1] = 0;
+	tok = strtok_r(NULL, " \t\r\n", &save);
+	if(tok == NULL)
+	    continue;
+	strcpy(trans_realm, tok);
+	trans_realm[REALM_SZ - 1] = 0;
+	if (!strcasecmp(trans_host, phost)) {
+	    /* exact match of hostname, so return the realm */
+	    strcpy(ret_realm, trans_realm);
+	    ret = 0;
+	    break;
 	}
-	while (1) {
-		if ((retval = fscanf(trans_file, "%s %s",
-				     trans_host, trans_realm)) != 2) {
-			if (retval == EOF) {
-				fclose(trans_file);
-				return(ret_realm[0] ? ret_realm : NULL);
-			}
-			continue;	/* ignore broken lines */
-		}
-		trans_host[MAXHOSTNAMELEN] = '\0';
-		trans_realm[REALM_SZ] = '\0';
-		if (!strcasecmp(trans_host, host)) {
-			/* exact match of hostname, so return the realm */
-			(void) strcpy(ret_realm, trans_realm);
-			fclose(trans_file);
-			return(ret_realm[0] ? ret_realm : NULL);
-		}
-		if ((trans_host[0] == '.') && domain) { 
-#if     MATCH_SUBDOMAINS
-                        char *cp;
-                        for (cp = domain; cp != NULL; cp = strchr(cp+1, '.')) {
-                                /* this is a domain match */
-                                if (!strcasecmp(trans_host, cp)) {
-                                        /* domain match, save for later */
-                                        (void) strcpy(ret_realm, trans_realm);
-                                        continue;
-                                }
-                        }
-#else /* MATCH_SUBDOMAINS */
-			/* this is a domain match */ 
-			if (!strcasecmp(trans_host, domain)) { 
-				/* domain match, save for later */ 
-				(void) strcpy(ret_realm, trans_realm); 
-				continue; 
-			} 
-#endif /* MATCH_SUBDOMAINS */
+	if ((trans_host[0] == '.') && domain) { 
+	    const char *cp = domain;
+	    do {
+		if(strcasecmp(trans_host, domain) == 0){
+		    /* domain match, save for later */ 
+		    strcpy(ret_realm, trans_realm);
+		    ret = 0;
+		    break;
 		}
+		cp = strchr(cp + 1, '.');
+	    } while(MATCH_SUBDOMAINS && cp);
 	}
+    }
+    fclose(trans_file);
+    return ret;
+}
+
+char *
+krb_realmofhost(const char *host)
+{
+    static char ret_realm[REALM_SZ];
+    char *domain;
+    char phost[MAXHOSTNAMELEN];
+	
+    krb_name_to_name(host, phost, sizeof(phost));
+	
+    domain = strchr(phost, '.');
+
+    if(file_find_realm(phost, domain, ret_realm) == 0)
+	return ret_realm;
+
+    if(dns_find_realm(phost, ret_realm) >= 0)
+	return ret_realm;
+  
+    if (domain) {
+	char *cp;
+	  
+	strncpy(ret_realm, &domain[1], REALM_SZ);
+	ret_realm[REALM_SZ - 1] = 0;
+	/* Upper-case realm */
+	for (cp = ret_realm; *cp; cp++)
+	    *cp = toupper(*cp);
+    } else {
+	krb_get_lrealm(ret_realm, 1);
+    }
+    return ret_realm;
 }
diff --git a/kerberosIV/krb/getst.c b/kerberosIV/krb/getst.c
index a7b73af0947..a7c5a031b19 100644
--- a/kerberosIV/krb/getst.c
+++ b/kerberosIV/krb/getst.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/getst.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: getst.c,v 1.6 1997/03/23 03:53:11 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -40,12 +34,9 @@ or implied warranty.
  */
 
 int
-getst(fd, s, n)
-	int fd;
-	register char *s;
-	int n;
+getst(int fd, char *s, int n)
 {
-    register count = n;
+    int count = n;
     while (read(fd, s, 1) > 0 && --count)
         if (*s++ == '\0')
             return (n - count);
diff --git a/kerberosIV/krb/in_tkt.c b/kerberosIV/krb/in_tkt.c
deleted file mode 100644
index 9eb958d6b90..00000000000
--- a/kerberosIV/krb/in_tkt.c
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/in_tkt.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-#include <sys/file.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#ifdef TKT_SHMEM
-#include <sys/param.h>
-#endif
-
-/*
- * in_tkt() is used to initialize the ticket store.  It creates the
- * file to contain the tickets and writes the given user's name "pname"
- * and instance "pinst" in the file.  in_tkt() returns KSUCCESS on
- * success, or KFAILURE if something goes wrong.
- */
-
-int
-in_tkt(pname, pinst)
-	char *pname;
-	char *pinst;
-{
-    int tktfile;
-    uid_t me, metoo;
-    struct stat buf;
-    int count;
-    char *file = TKT_FILE;
-    int fd;
-    register int i;
-    char charbuf[BUFSIZ];
-#ifdef TKT_SHMEM
-    char shmidname[MaxPathLen];
-#endif /* TKT_SHMEM */
-
-    me = getuid ();
-    metoo = geteuid();
-    if (lstat(file,&buf) == 0) {
-	if (buf.st_uid != me || !(buf.st_mode & S_IFREG) ||
-	    buf.st_mode & 077 || buf.st_nlink != 1) {
-	    if (krb_debug)
-		fprintf(stderr,"Error initializing %s",file);
-	    return(KFAILURE);
-	}
-	/* file already exists, and permissions appear ok, so nuke it */
-	if ((fd = open(file, O_RDWR, 0)) < 0)
-	    goto out; /* can't zero it, but we can still try truncating it */
-
-	bzero(charbuf, sizeof(charbuf));
-
-	for (i = 0; i < buf.st_size; i += sizeof(charbuf))
-	    if (write(fd, charbuf, sizeof(charbuf)) != sizeof(charbuf))
-	      break;
-	
-	(void) fsync(fd);
-	(void) close(fd);
-	(void) unlink (file);
-    }
- out:
-    /* arrange so the file is owned by the ruid
-       (swap real & effective uid if necessary).
-       This isn't a security problem, since the ticket file, if it already
-       exists, has the right uid (== ruid) and mode. */
-    if (me != metoo) {
-	if (seteuid(me) < 0) {
-	    /* can't switch??? barf! */
-	    if (krb_debug)
-		perror("in_tkt: seteuid");
-	    return(KFAILURE);
-	} else
-	    if (krb_debug)
-		printf("swapped UID's %d and %d\n",(int)metoo,(int)me);
-    }
-    if ((tktfile = open (file,O_CREAT|O_EXCL|O_WRONLY,0600)) < 0) {
-	if (krb_debug)
-	    fprintf(stderr,"Error initializing %s",TKT_FILE);
-        return(KFAILURE);
-    }
-    if (me != metoo) {
-	if (seteuid(metoo) < 0) {
-	    /* can't switch??? barf! */
-	    if (krb_debug)
-		perror("in_tkt: seteuid2");
-	    return(KFAILURE);
-	} else
-	    if (krb_debug)
-		printf("swapped UID's %d and %d\n",(int)me,(int)metoo);
-    }
-    if (lstat(file,&buf) < 0) {
-	if (krb_debug)
-	    fprintf(stderr,"Error initializing %s",TKT_FILE);
-        return(KFAILURE);
-    }
-
-    if (buf.st_uid != me || !(buf.st_mode & S_IFREG) ||
-        buf.st_mode & 077) {
-	if (krb_debug)
-	    fprintf(stderr,"Error initializing %s",TKT_FILE);
-        return(KFAILURE);
-    }
-
-    count = strlen(pname)+1;
-    if (write(tktfile,pname,count) != count) {
-        (void) close(tktfile);
-        return(KFAILURE);
-    }
-    count = strlen(pinst)+1;
-    if (write(tktfile,pinst,count) != count) {
-        (void) close(tktfile);
-        return(KFAILURE);
-    }
-    (void) close(tktfile);
-#ifdef TKT_SHMEM
-    (void) strcpy(shmidname, file);
-    (void) strcat(shmidname, ".shm");
-    return(krb_shm_create(shmidname));
-#else /* !TKT_SHMEM */
-    return(KSUCCESS);
-#endif /* TKT_SHMEM */
-}
diff --git a/kerberosIV/krb/k_concat.c b/kerberosIV/krb/k_concat.c
new file mode 100644
index 00000000000..354c8ddcb49
--- /dev/null
+++ b/kerberosIV/krb/k_concat.c
@@ -0,0 +1,116 @@
+/* $KTH: k_concat.c,v 1.5 1997/05/02 08:56:39 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+int
+k_concat (char *s, size_t len, ...)
+{
+    int ret;
+    va_list args;
+
+    va_start(args, len);
+    ret = k_vconcat (s, len, args);
+    va_end(args);
+    return ret;
+}
+
+int
+k_vconcat (char *s, size_t len, va_list args)
+{
+    const char *a;
+
+    while ((a = va_arg(args, const char*))) {
+	size_t n = strlen (a);
+
+	if (n >= len)
+	    return -1;
+	strncpy (s, a, n);
+	s += n;
+	len -= n;
+    }
+    *s = '\0';
+    return 0;
+}
+
+size_t
+k_vmconcat (char **s, size_t max_len, va_list args)
+{
+    const char *a;
+    char *p, *q;
+    size_t len = 0;
+    *s = NULL;
+    p = malloc(1);
+    if(p == NULL)
+	return 0;
+    *p = 0;
+    len = 1;
+    while ((a = va_arg(args, const char*))) {
+	size_t n = strlen (a);
+	
+	if(max_len && len + n > max_len){
+	    free(p);
+	    return 0;
+	}
+	q = realloc(p, len + n);
+	if(q == NULL){
+	    free(p);
+	    return 0;
+	}
+	p = q;
+	len += n;
+	strcat(p, a);
+    }
+    *s = p;
+    return len;
+}
+
+size_t
+k_mconcat (char **s, size_t max_len, ...)
+{
+    int ret;
+    va_list args;
+
+    va_start(args, max_len);
+    ret = k_vmconcat (s, max_len, args);
+    va_end(args);
+    return ret;
+}
+
diff --git a/kerberosIV/krb/k_flock.c b/kerberosIV/krb/k_flock.c
new file mode 100644
index 00000000000..6891dbc3845
--- /dev/null
+++ b/kerberosIV/krb/k_flock.c
@@ -0,0 +1,59 @@
+/* $KTH: k_flock.c,v 1.8 1997/04/01 08:18:30 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+#define K_OP_MASK (K_LOCK_SH | K_LOCK_EX | K_LOCK_UN)
+
+int
+k_flock(int fd, int operation)
+{
+  int op = 0;
+  if (operation & K_LOCK_SH)
+    op |= LOCK_SH;
+  if (operation & K_LOCK_EX)
+    op |= LOCK_EX;
+  if (operation & K_LOCK_UN)
+    op |= LOCK_UN;
+  if (operation & K_LOCK_NB)
+    op |= LOCK_NB;
+
+  return flock(fd, op);
+}
diff --git a/kerberosIV/krb/pkt_cipher.c b/kerberosIV/krb/k_gethostname.c
index 2beb0f6a53f..78e64acdd22 100644
--- a/kerberosIV/krb/pkt_cipher.c
+++ b/kerberosIV/krb/k_gethostname.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/pkt_cipher.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: k_gethostname.c,v 1.10 1997/03/23 03:53:12 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,22 +23,18 @@ or implied warranty.
 
 #include "krb_locl.h"
 
+#include <sys/utsname.h>
+
 /*
- * This routine takes a reply packet from the Kerberos ticket-granting
- * service and returns a pointer to the beginning of the ciphertext in it.
- *
- * See "prot.h" for packet format.
+ * Return the local host's name in "name", up to "namelen" characters.
+ * "name" will be null-terminated if "namelen" is big enough.
+ * The return code is 0 on success, -1 on failure.  (The calling
+ * interface is identical to gethostname(2).)
  */
 
-char *
-pkt_cipher(packet)
-	KTEXT packet;
+int
+k_gethostname(char *name, int namelen)
 {
-    unsigned char *ptr = pkt_a_realm(packet) + 6
-	+ strlen((char *)pkt_a_realm(packet));
-    /* Skip a few more fields */
-    ptr += 3 + 4;		/* add 4 for exp_date */
+    return gethostname(name, namelen);
 
-    /* And return the pointer */
-    return((char*)ptr);
 }
diff --git a/kerberosIV/krb/k_getport.c b/kerberosIV/krb/k_getport.c
new file mode 100644
index 00000000000..be4c2f534f1
--- /dev/null
+++ b/kerberosIV/krb/k_getport.c
@@ -0,0 +1,57 @@
+/* $KTH: k_getport.c,v 1.10 1997/04/01 08:18:30 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+int
+k_getportbyname (const char *service, const char *proto, int default_port)
+{
+    struct servent *sp;
+    
+    sp = getservbyname(service, proto);
+    if(sp != NULL)
+	return sp->s_port;
+    
+    krb_warning ("%s/%s unknown service, using default port %d\n", 
+		 service, proto ? proto : "*", ntohs(default_port));
+    return default_port;
+}
+
+
diff --git a/kerberosIV/krb/k_getsockinst.c b/kerberosIV/krb/k_getsockinst.c
new file mode 100644
index 00000000000..89468812dec
--- /dev/null
+++ b/kerberosIV/krb/k_getsockinst.c
@@ -0,0 +1,73 @@
+/* $KTH: k_getsockinst.c,v 1.10 1997/05/02 14:29:17 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+/*
+ * Return in inst the name of the local interface bound to socket
+ * fd. On Failure return the 'wildcard' instance "*".
+ */
+
+int
+k_getsockinst(int fd, char *inst, size_t inst_size)
+{
+  struct sockaddr_in addr;
+  int len = sizeof(addr);
+  struct hostent *hnam;
+
+  if (getsockname(fd, (struct sockaddr *)&addr, &len) < 0)
+    goto fail;
+
+  hnam = gethostbyaddr((char *)&addr.sin_addr,
+		       sizeof(addr.sin_addr),
+		       addr.sin_family);
+  if (hnam == 0)
+    goto fail;
+
+  strncpy (inst, hnam->h_name, inst_size);
+  inst[inst_size - 1] = '\0';
+  k_ricercar(inst); /* Canonicalize name */
+  return 0;			/* Success */
+
+ fail:
+  inst[0] = '*';
+  inst[1] = 0;
+  return -1;
+}
diff --git a/kerberosIV/krb/k_localtime.c b/kerberosIV/krb/k_localtime.c
index db54f81f681..09fb165c158 100644
--- a/kerberosIV/krb/k_localtime.c
+++ b/kerberosIV/krb/k_localtime.c
@@ -1,33 +1,46 @@
-/*
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/k_localtime.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: k_localtime.c,v 1.7 1997/04/01 08:18:31 joda Exp $ */
 
 /*
- * Copyright 1987, 1988 by the Student Information Processing Board
- *	of the Massachusetts Institute of Technology
- *
- * Permission to use, copy, modify, and distribute this software
- * and its documentation for any purpose and without fee is
- * hereby granted, provided that the above copyright notice
- * appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation,
- * and that the names of M.I.T. and the M.I.T. S.I.P.B. not be
- * used in advertising or publicity pertaining to distribution
- * of the software without specific, written prior permission.
- * M.I.T. and the M.I.T. S.I.P.B. make no representations about
- * the suitability of this software for any purpose.  It is
- * provided "as is" without express or implied warranty.
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-#include <kerberosIV/krb.h>
-
-#include <time.h>
+#include "krb_locl.h"
 
-struct tm *
-k_localtime(tp)
-	u_int32_t *tp;
+struct tm *k_localtime(u_int32_t *tp)
 {
   time_t t;
   t = *tp;
diff --git a/kerberosIV/krb/kdc_reply.c b/kerberosIV/krb/kdc_reply.c
new file mode 100644
index 00000000000..3561955847f
--- /dev/null
+++ b/kerberosIV/krb/kdc_reply.c
@@ -0,0 +1,131 @@
+/* $KTH: kdc_reply.c,v 1.9 1997/04/15 21:52:14 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+static int little_endian; /* XXX ugly */
+
+int
+kdc_reply_cred(KTEXT cip, CREDENTIALS *cred)
+{
+    unsigned char *p = cip->dat;
+    
+    memcpy(cred->session, p, 8);
+    p += 8;
+    
+    if(p + strlen((char*)p) > cip->dat + cip->length)
+	return INTK_BADPW;
+    p += krb_get_string(p, cred->service);
+    
+    if(p + strlen((char*)p) > cip->dat + cip->length)
+	return INTK_BADPW;
+    p += krb_get_string(p, cred->instance);
+    
+    if(p + strlen((char*)p) > cip->dat + cip->length)
+	return INTK_BADPW;
+    p += krb_get_string(p, cred->realm);
+    
+    if(p + 3 > cip->dat + cip->length)
+	return INTK_BADPW;
+    cred->lifetime = *p++;
+    cred->kvno = *p++;
+    cred->ticket_st.length = *p++;
+    
+    if(p + cred->ticket_st.length + 4 > cip->dat + cip->length)
+	return INTK_BADPW;
+    memcpy(cred->ticket_st.dat, p, cred->ticket_st.length);
+    p += cred->ticket_st.length;
+    
+    p += krb_get_int(p, (u_int32_t *)&cred->issue_date, 4, little_endian);
+    
+    return KSUCCESS;
+}
+
+int
+kdc_reply_cipher(KTEXT reply, KTEXT cip)
+{
+    unsigned char *p;
+    unsigned char pvno;
+    unsigned char type;
+
+    char aname[ANAME_SZ];
+    char inst[INST_SZ];
+    char realm[REALM_SZ];
+    
+    u_int32_t kdc_time;
+    u_int32_t exp_date;
+    u_int32_t clen;
+
+    p = reply->dat;
+
+    pvno = *p++;
+
+    if (pvno != KRB_PROT_VERSION )
+        return INTK_PROT;
+    
+    type = *p++;
+    little_endian = type & 1;
+    
+    type &= ~1;
+
+    if(type == AUTH_MSG_ERR_REPLY){
+	u_int32_t code;
+	p += strlen((char*)p) + 1; /* name */
+	p += strlen((char*)p) + 1; /* instance */
+	p += strlen((char*)p) + 1; /* realm */
+	p += 4; /* time */
+	p += krb_get_int(p, &code, 4, little_endian);
+	return code;
+    }
+    if(type != AUTH_MSG_KDC_REPLY)
+	return INTK_PROT;
+
+    p += krb_get_nir(p, aname, inst, realm);
+    p += krb_get_int(p, &kdc_time, 4, little_endian);
+    p++; /* number of tickets */
+    p += krb_get_int(p, &exp_date, 4, little_endian);
+    p++; /* master key version number */
+    p += krb_get_int(p, &clen, 2, little_endian);
+    cip->length = clen;
+    memcpy(cip->dat, p, clen);
+    p += clen;
+    
+    return KSUCCESS;
+}
diff --git a/kerberosIV/krb/klog.c b/kerberosIV/krb/klog.c
deleted file mode 100644
index 5e2768f279d..00000000000
--- a/kerberosIV/krb/klog.c
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/klog.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-#include <sys/time.h>
-
-#include <klog.h>
-
-static char *log_name = KRBLOG;
-static int is_open;
-static char logtxt[1000];
-
-/*
- * This file contains two logging routines: kset_logfile()
- * to determine the file to which log entries should be written;
- * and klog() to write log entries to the file.
- */
-
-/*
- * klog() is used to add entries to the logfile (see kset_logfile()
- * below).  Note that it is probably not portable since it makes
- * assumptions about what the compiler will do when it is called
- * with less than the correct number of arguments which is the
- * way it is usually called.
- *
- * The log entry consists of a timestamp and the given arguments
- * printed according to the given "format" string.
- *
- * The log file is opened and closed for each log entry.
- *
- * If the given log type "type" is unknown, or if the log file
- * cannot be opened, no entry is made to the log file.
- *
- * The return value is always a pointer to the formatted log
- * text string "logtxt".
- */
-
-char *
-klog(type, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a0)
-     int type;
-     char *format;
-     int a1, a2, a3, a4, a5, a6, a7, a8, a9, a0;
-{
-    FILE *logfile;
-    time_t now;
-    char *month_sname(int n);
-    struct tm *tm;
-    static int logtype_array[NLOGTYPE] = {0,0};
-    static int array_initialized;
-
-    if (!(array_initialized++)) {
-        logtype_array[L_NET_ERR] = 1;
-        logtype_array[L_KRB_PERR] = 1;
-        logtype_array[L_KRB_PWARN] = 1;
-        logtype_array[L_APPL_REQ] = 1;
-        logtype_array[L_INI_REQ] = 1;
-        logtype_array[L_DEATH_REQ] = 1;
-        logtype_array[L_NTGT_INTK] = 1;
-        logtype_array[L_ERR_SEXP] = 1;
-        logtype_array[L_ERR_MKV] = 1;
-        logtype_array[L_ERR_NKY] = 1;
-        logtype_array[L_ERR_NUN] = 1;
-        logtype_array[L_ERR_UNK] = 1;
-    }
-
-    (void) snprintf(logtxt,sizeof(logtxt),format,a1,a2,a3,a4,a5,a6,a7,a8,a9,a0);
-
-    if (!logtype_array[type])
-	return(logtxt);
-
-    if ((logfile = fopen(log_name,"a")) == NULL)
-        return(logtxt);
-
-    (void) time(&now);
-    tm = localtime(&now);
-
-    fprintf(logfile,"%2d-%s-%02d %02d:%02d:%02d ",tm->tm_mday,
-            month_sname(tm->tm_mon + 1),tm->tm_year,
-            tm->tm_hour, tm->tm_min, tm->tm_sec);
-    fprintf(logfile,"%s\n",logtxt);
-    (void) fclose(logfile);
-    return(logtxt);
-}
-
-/*
- * kset_logfile() changes the name of the file to which
- * messages are logged.  If kset_logfile() is not called,
- * the logfile defaults to KRBLOG, defined in "krb.h".
- */
-
-void
-kset_logfile(filename)
-	char *filename;
-{
-    log_name = filename;
-    is_open = 0;
-}
diff --git a/kerberosIV/krb/kname_parse.c b/kerberosIV/krb/kname_parse.c
deleted file mode 100644
index 3acdcce0a24..00000000000
--- a/kerberosIV/krb/kname_parse.c
+++ /dev/null
@@ -1,262 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/kname_parse.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-#define INSTANCE_DOTS_OK        0
-
-/* max size of full name */
-#define FULL_SZ (ANAME_SZ + INST_SZ + REALM_SZ)
-
-#define NAME    0		/* which field are we in? */
-#define INST    1
-#define REALM   2
-
-/*
- * This file contains four routines for handling Kerberos names.
- *
- * kname_parse() breaks a Kerberos name into its name, instance,
- * and realm components.
- *
- * k_isname(), k_isinst(), and k_isrealm() check a given string to see if
- * it's a syntactically legitimate respective part of a Kerberos name,
- * returning 1 if it is, 0 if it isn't.
- *
- * Definition of "syntactically legitimate" names is according to
- * the Project Athena Technical Plan Section E.2.1, page 7 "Specifying
- * names", version dated 21 Dec 1987.
- */
-
-/*
- * kname_parse() takes a Kerberos name "fullname" of the form:
- *
- *		username[.instance][@realm]
- *
- * and returns the three components ("name", "instance", and "realm"
- * in the example above) in the given arguments "np", "ip", and "rp".
- *
- * If successful, it returns KSUCCESS.  If there was an error,
- * KNAME_FMT is returned.
- */
-
-int
-kname_parse(np, ip, rp, fullname)
-	char *np;
-	char *ip;
-	char *rp;
-	char *fullname;
-{
-    static char buf[FULL_SZ];
-    char *rnext, *wnext;	/* next char to read, write */
-    register char c;
-    int backslash;
-    int field;
-
-    backslash = 0;
-    rnext = buf;
-    wnext = np;
-    field = NAME;
-
-    if (strlen(fullname) > FULL_SZ)
-        return KNAME_FMT;
-    (void) strcpy(buf, fullname);
-
-    while ((c = *rnext++)) {
-        if (backslash) {
-            *wnext++ = c;
-            backslash = 0;
-            continue;
-        }
-        switch (c) {
-        case '\\':
-            backslash++;
-            break;
-        case '.':
-            switch (field) {
-            case NAME:
-                if (wnext == np)
-                    return KNAME_FMT;
-                *wnext = '\0';
-                field = INST;
-                wnext = ip;
-                break;
-            case INST:
-#if     INSTANCE_DOTS_OK
-                *wnext++ = c;
-                break;
-#else /* INSTANCE_DOTS_OK */
-                return KNAME_FMT; 
-#endif /* INSTANCE_DOTS_OK */
-                /* break; */
-            case REALM:
-                *wnext++ = c;
-                break;
-            default:
-                fprintf(stderr, "unknown field value\n");
-                exit(1);
-            }
-            break;
-        case '@':
-            switch (field) {
-            case NAME:
-                if (wnext == np)
-                    return KNAME_FMT;
-                *ip = '\0';
-                /* fall through */
-            case INST:
-                *wnext = '\0';
-                field = REALM;
-                wnext = rp;
-                break;
-            case REALM:
-                return KNAME_FMT;
-            default:
-                fprintf(stderr, "unknown field value\n");
-                exit(1);
-            }
-            break;
-        default:
-            *wnext++ = c;
-        }
-    }
-    *wnext = '\0';
-    if ((strlen(np) > ANAME_SZ - 1) ||
-        (strlen(ip) > INST_SZ  - 1) ||
-        (strlen(rp) > REALM_SZ - 1))
-        return KNAME_FMT;
-    return KSUCCESS;
-}
-
-/*
- * k_isname() returns 1 if the given name is a syntactically legitimate
- * Kerberos name; returns 0 if it's not.
- */
-
-int
-k_isname(s)
-	char *s;
-{
-    register char c;
-    int backslash = 0;
-
-    if (!*s)
-        return 0;
-    if (strlen(s) > ANAME_SZ - 1)
-        return 0;
-    while ((c = *s++)) {
-        if (backslash) {
-            backslash = 0;
-            continue;
-        }
-        switch(c) {
-        case '\\':
-            backslash = 1;
-            break;
-        case '.':
-            return 0;
-            /* break; */
-        case '@':
-            return 0;
-            /* break; */
-        }
-    }
-    return 1;
-}
-
-
-/*
- * k_isinst() returns 1 if the given name is a syntactically legitimate
- * Kerberos instance; returns 0 if it's not.
- */
-
-int
-k_isinst(s)
-	char *s;
-{
-    register char c;
-    int backslash = 0;
-
-    if (strlen(s) > INST_SZ - 1)
-        return 0;
-    while ((c = *s++)) {
-        if (backslash) {
-            backslash = 0;
-            continue;
-        }
-        switch(c) {
-        case '\\':
-            backslash = 1;
-            break;
-        case '.':
-#if     INSTANCE_DOTS_OK
-            break;
-#else /* INSTANCE_DOTS_OK */
-            return 0; 
-#endif /* INSTANCE_DOTS_OK */
-            /* break; */
-        case '@':
-            return 0;
-            /* break; */
-        }
-    }
-    return 1;
-}
-
-/*
- * k_isrealm() returns 1 if the given name is a syntactically legitimate
- * Kerberos realm; returns 0 if it's not.
- */
-
-int
-k_isrealm(s)
-	char *s;
-{
-    register char c;
-    int backslash = 0;
-
-    if (!*s)
-        return 0;
-    if (strlen(s) > REALM_SZ - 1)
-        return 0;
-    while ((c = *s++)) {
-        if (backslash) {
-            backslash = 0;
-            continue;
-        }
-        switch(c) {
-        case '\\':
-            backslash = 1;
-            break;
-        case '@':
-            return 0;
-            /* break; */
-        }
-    }
-    return 1;
-}
diff --git a/kerberosIV/krb/kntoln.c b/kerberosIV/krb/kntoln.c
index 3f4239e2703..8d63ac7f1d9 100644
--- a/kerberosIV/krb/kntoln.c
+++ b/kerberosIV/krb/kntoln.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/kntoln.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: kntoln.c,v 1.7 1997/03/23 03:53:12 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -56,19 +50,131 @@ or implied warranty.
 #include "krb_locl.h"
 
 int
-krb_kntoln(ad, lname)
-	AUTH_DAT *ad;
-	char *lname;
+krb_kntoln(AUTH_DAT *ad, char *lname)
 {
     static char lrealm[REALM_SZ] = "";
 
     if (!(*lrealm) && (krb_get_lrealm(lrealm,1) == KFAILURE))
         return(KFAILURE);
 
-    if (strcmp(ad->pinst,""))
+    if (strcmp(ad->pinst, ""))
         return(KFAILURE);
-    if (strcmp(ad->prealm,lrealm))
+    if (strcmp(ad->prealm, lrealm))
         return(KFAILURE);
-    (void) strcpy(lname,ad->pname);
+    strcpy(lname, ad->pname);
     return(KSUCCESS);
 }
+
+#if 0
+/* Posted to usenet by "Derrick J. Brashear" <shadow+@andrew.cmu.edu> */
+
+#include <krb.h>
+#include <ndbm.h>
+#include <stdio.h>
+#include <sys/file.h>
+#include <strings.h>
+#include <sys/syslog.h>
+#include <sys/errno.h>
+
+extern int errno;
+/*
+ * antoln converts an authentication name into a local name by looking up
+ * the authentication name in the /etc/aname dbm database.
+ * 
+ * If the /etc/aname file can not be opened it will set the 
+ * local name to the principal name.  Thus, in this case it performs as 
+ * the identity function.
+ * 
+ * The name instance and realm are passed to antoln through
+ * the AUTH_DAT structure (ad).
+ */
+
+static char     lrealm[REALM_SZ] = "";
+
+an_to_ln(ad,lname)
+AUTH_DAT        *ad;
+char            *lname;
+{
+        static DBM *aname = NULL;
+        char keyname[ANAME_SZ+INST_SZ+REALM_SZ+2];
+
+        if(!(*lrealm) && (krb_get_lrealm(lrealm,1) == KFAILURE))
+                return(KFAILURE);
+
+        if((strcmp(ad->pinst,"") && strcmp(ad->pinst,"root")) ||
+strcmp(ad->prealm,lrealm)) {
+                datum val;
+                datum key;
+                /*
+                 * Non-local name (or) non-null and non-root instance.
+                 * Look up in dbm file.
+                 */
+                if (!aname) {
+                        if ((aname = dbm_open("/etc/aname", O_RDONLY, 0))
+                            == NULL) return (KFAILURE);
+                }
+                /* Construct dbm lookup key. */
+                an_to_a(ad, keyname);
+                key.dptr = keyname;
+                key.dsize = strlen(keyname)+1;
+                flock(dbm_dirfno(aname), LOCK_SH);
+                val = dbm_fetch(aname, key);
+                flock(dbm_dirfno(aname), LOCK_UN);
+                if (!val.dptr) {
+                  dbm_close(aname);
+                  return(KFAILURE);
+                }
+                /* Got it! */
+                strcpy(lname,val.dptr);
+                return(KSUCCESS);
+        } else strcpy(lname,ad->pname);
+        return(KSUCCESS);
+}
+
+an_to_a(ad, str)
+        AUTH_DAT *ad;
+        char *str;
+{
+        strcpy(str, ad->pname);
+        if(*ad->pinst) {
+                strcat(str, ".");
+                strcat(str, ad->pinst);
+        }
+        strcat(str, "@");
+        strcat(str, ad->prealm);
+}
+
+/*
+ * Parse a string of the form "user[.instance][@realm]" 
+ * into a struct AUTH_DAT.
+ */
+
+a_to_an(str, ad)
+        AUTH_DAT *ad;
+        char *str;
+{
+        char *buf = (char *)malloc(strlen(str)+1);
+        char *rlm, *inst, *princ;
+
+        if(!(*lrealm) && (krb_get_lrealm(lrealm,1) == KFAILURE)) {
+                free(buf);
+                return(KFAILURE);
+        }
+        /* destructive string hacking is more fun.. */
+        strcpy(buf, str);
+
+        if (rlm = index(buf, '@')) {
+                *rlm++ = '\0';
+        }
+        if (inst = index(buf, '.')) {
+                *inst++ = '\0';
+        }
+        strcpy(ad->pname, buf);
+        if(inst) strcpy(ad->pinst, inst);
+        else *ad->pinst = '\0';
+        if (rlm) strcpy(ad->prealm, rlm);
+        else strcpy(ad->prealm, lrealm);
+        free(buf);
+        return(KSUCCESS);
+}
+#endif
diff --git a/kerberosIV/krb/kparse.c b/kerberosIV/krb/kparse.c
deleted file mode 100644
index 1f029177c1e..00000000000
--- a/kerberosIV/krb/kparse.c
+++ /dev/null
@@ -1,796 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/kparse.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-/*
- * Purpose:
- * This module was developed to parse the "~/.klogin" files for
- * Kerberos-authenticated rlogin/rcp/rsh services.  However, it is
- * general purpose and can be used to parse any such parameter file.
- *
- * The parameter file should consist of one or more entries, with each
- * entry on a separate line and consisting of zero or more
- * "keyword=value" combinations.  The keyword is case insensitive, but
- * the value is not.  Any string may be enclosed in quotes, and
- * c-style "\" literals are supported.  A comma may be used to
- * separate the k/v combinations, and multiple commas are ignored.
- * Whitespace (blank or tab) may be used freely and is ignored.
- *
- * Full error processing is available.  When PS_BAD_KEYWORD or
- * PS_SYNTAX is returned from fGetParameterSet(), the string ErrorMsg
- * contains a meaningful error message.
- *
- * Keywords and their default values are programmed by an external
- * table.
- *
- * Routines:
- * fGetParameterSet()      parse one line of the parameter file
- * fGetKeywordValue()      parse one "keyword=value" combo
- * fGetToken()             parse one token
- *
- * " <- emacs fix
- */
-
-#include "krb_locl.h"
-
-#include <kerberosIV/kparse.h>
-
-#ifndef FALSE
-#define FALSE 0
-#define TRUE 1
-#endif
-
-#define MAXKEY          80
-#define MAXVALUE        80
-
-int LineNbr=1;		/* current line nbr in parameter file */
-char ErrorMsg[80];	/* meaningful only when KV_SYNTAX, PS_SYNTAX,
-                         * or PS_BAD_KEYWORD is returned by
-                         * fGetKeywordValue or fGetParameterSet */
-
-int
-fGetParameterSet(fp, parm, parmcount)
-	FILE *fp;
-	parmtable *parm;
-	int parmcount;
-{
-    int rc,i;
-    char keyword[MAXKEY];
-    char value[MAXVALUE];
-
-    while (TRUE) {
-        rc=fGetKeywordValue(fp,keyword,MAXKEY,value,MAXVALUE);
-
-        switch (rc) {
-
-        case KV_EOF:
-            return(PS_EOF);
-
-        case KV_EOL:
-            return(PS_OKAY);
-
-        case KV_SYNTAX:
-            return(PS_SYNTAX);
-
-        case KV_OKAY:
-            /*
-             * got a reasonable keyword/value pair.  Search the
-             * parameter table to see if we recognize the keyword; if
-             * not, return an error.  If we DO recognize it, make sure
-             * it has not already been given.  If not already given,
-             * save the value.
-             */
-            for (i=0; i<parmcount; i++) {
-                if (strcmp(strutol(keyword),parm[i].keyword)==0) {
-                    if (parm[i].value) {
-                        snprintf(ErrorMsg, sizeof(ErrorMsg),
-				 "duplicate keyword \"%s\" found", keyword);
-                        return(PS_BAD_KEYWORD);
-                    }
-                    parm[i].value = strsave( value );
-                    break;
-                }
-            }
-            if (i >= parmcount) {
-                snprintf(ErrorMsg, sizeof(ErrorMsg),
-			 "unrecognized keyword \"%s\" found", keyword);
-                return(PS_BAD_KEYWORD);
-            }
-            break;
-
-        default:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		    "panic: bad return (%d) from fGetToken()",rc);
-            break;
-        }
-    }
-}
-
-/*
- * Routine: ParmCompare
- *
- * Purpose:
- * ParmCompare checks a specified value for a particular keyword.
- * fails if keyword not found or keyword found but the value was
- * different. Like strcmp, ParmCompare returns 0 for a match found, -1
- * otherwise
- */
-int
-ParmCompare(parm, parmcount, keyword, value)
-	parmtable *parm;
-	int parmcount;
-	char *keyword;
-	char *value;
-{
-    int i;
-
-    for (i=0; i<parmcount; i++) {
-        if (strcmp(parm[i].keyword,keyword)==0) {
-            if (parm[i].value) {
-                return(strcmp(parm[i].value,value));
-            } else {
-                return(strcmp(parm[i].defvalue,value));
-            }
-        }
-    }
-    return(-1);
-}
-
-void
-FreeParameterSet(parm, parmcount)
-	parmtable *parm;
-	int parmcount;
-{
-    int i;
-
-    for (i=0; i<parmcount; i++) {
-        if (parm[i].value) {
-            free(parm[i].value);
-            parm[i].value = (char *)NULL;
-        }
-    }
-}
-
-int
-fGetKeywordValue(fp, keyword, klen, value, vlen)
-	FILE *fp;
-	char *keyword;
-	int klen;
-	char *value;
-	int vlen;
-{
-    int rc;
-    int gotit;
-
-    *keyword = *value = '\0';   /* preset strings to NULL */
-
-    /*
-     * Looking for a keyword.
-     *          return an exception for EOF or BAD_QSTRING
-     *          ignore leading WHITEspace
-     *          ignore any number of leading commas
-     *          newline means we have all the parms for this
-     *          	statement; give an indication that there is
-     *          	nothing more on this line.
-     *          stop looking if we find QSTRING, STRING, or NUMBER
-     *          return syntax error for any other PUNKtuation
-     */
-    gotit = FALSE;
-    do {
-        rc = fGetToken(fp,keyword,klen);
-
-        switch (rc) {
-
-        case GTOK_WHITE:
-            break;
-
-        case GTOK_EOF:
-            return(KV_EOF);
-
-        case GTOK_BAD_QSTRING:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "unterminated string \"%s found",keyword);
-            return(KV_SYNTAX);
-
-        case GTOK_PUNK:
-            if (strcmp("\n",keyword)==0) {
-                return(KV_EOL);
-            } else if (strcmp(",",keyword)!=0) {
-                snprintf(ErrorMsg, sizeof(ErrorMsg),
-			 "expecting rvalue, found \'%s\'", keyword);
-            }
-            break;
-
-        case GTOK_STRING:
-        case GTOK_QSTRING:
-        case GTOK_NUMBER:
-            gotit = TRUE;
-            break;
-
-        default:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "panic: bad return (%d) from fGetToken()", rc);
-            return(KV_SYNTAX);
-        }
-
-    } while (!gotit);
-
-    /*
-     * now we expect an equal sign.
-     *          skip any whitespace
-     *          stop looking if we find an equal sign
-     *          anything else causes a syntax error
-     */
-    gotit = FALSE;
-    do {
-        rc = fGetToken(fp,value,vlen);
-
-        switch (rc) {
-
-        case GTOK_WHITE:
-            break;
-
-        case GTOK_BAD_QSTRING:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "expecting \'=\', found unterminated string \"%s",
-                     value);
-            return(KV_SYNTAX);
-
-        case GTOK_PUNK:
-            if (strcmp("=",value)==0) {
-                gotit = TRUE;
-            } else {
-                if (strcmp("\n",value)==0) {
-                    snprintf(ErrorMsg, sizeof(ErrorMsg),
-			     "expecting \"=\", found newline");
-                    fUngetChar('\n',fp);
-                } else {
-                    snprintf(ErrorMsg, sizeof(ErrorMsg),
-			     "expecting rvalue, found \'%s\'",keyword);
-                }
-                return(KV_SYNTAX);
-            }
-            break;
-
-        case GTOK_STRING:
-        case GTOK_QSTRING:
-        case GTOK_NUMBER:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "expecting \'=\', found \"%s\"", value);
-            return(KV_SYNTAX);
-
-        case GTOK_EOF:
-            snprintf(ErrorMsg, sizeof(ErrorMsg), "expecting \'=\', found EOF");
-            return(KV_SYNTAX);
-
-        default:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "panic: bad return (%d) from fGetToken()",rc);
-            return(KV_SYNTAX);
-        }
-
-    } while ( !gotit );
-
-    /*
-     * got the keyword and equal sign, now get a value.
-     *          ignore any whitespace
-     *          any punctuation is a syntax error
-     */
-    gotit = FALSE;
-    do {
-        rc = fGetToken(fp,value,vlen);
-
-        switch (rc) {
-
-        case GTOK_WHITE:
-            break;
-
-        case GTOK_EOF:
-            snprintf(ErrorMsg, sizeof(ErrorMsg), "expecting rvalue, found EOF");
-            return(KV_SYNTAX);
-
-        case GTOK_BAD_QSTRING:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "unterminated quoted string \"%s", value);
-            return(KV_SYNTAX);
-
-        case GTOK_PUNK:
-            if (strcmp("\n",value)==0) {
-                snprintf(ErrorMsg, sizeof(ErrorMsg),
-			 "expecting rvalue, found newline");
-                fUngetChar('\n',fp);
-            } else {
-                snprintf(ErrorMsg, sizeof(ErrorMsg),
-			 "expecting rvalue, found \'%s\'",value);
-            }
-            return(KV_SYNTAX);
-            break;
-
-        case GTOK_STRING:
-        case GTOK_QSTRING:
-        case GTOK_NUMBER:
-            gotit = TRUE;
-            return(KV_OKAY);
-
-        default:
-            snprintf(ErrorMsg, sizeof(ErrorMsg),
-		     "panic: bad return (%d) from fGetToken()",rc);
-            return(KV_SYNTAX);
-        }
-
-    } while ( !gotit );
-    /*NOTREACHED*/
-    return(KV_SYNTAX);
-}
-
-/*
- * Routine Name: fGetToken
- *
- * Function: read the next token from the specified file.
- * A token is defined as a group of characters
- * terminated by a white space char (SPACE, CR,
- * LF, FF, TAB). The token returned is stripped of
- * both leading and trailing white space, and is
- * terminated by a NULL terminator.  An alternate
- * definition of a token is a string enclosed in
- * single or double quotes.
- *
- * Explicit Parameters:
- * fp              pointer to the input FILE
- * dest    pointer to destination buffer
- * maxlen  length of the destination buffer. The buffer
- * length INCLUDES the NULL terminator.
- *
- * Implicit Parameters: stderr  where the "token too long" message goes
- *
- * External Procedures: fgetc
- *
- * Side Effects:                None
- *
- * Return Value:                A token classification value, as
- *				defined in kparse.h. Note that the
- *				classification for end of file is
- *				always zero.
- */
-int
-fGetToken(fp, dest, maxlen)
-	FILE *fp;
-	char *dest;
-	int maxlen;
-{
-    int ch='\0';
-    int len=0;
-    char *p = dest;
-    int digits;
-
-    ch=fGetChar(fp);
-
-    /*
-     * check for a quoted string.  If found, take all characters
-     * that fit until a closing quote is found.  Note that this
-     * algorithm will not behave well for a string which is too long.
-     */
-    if (ISQUOTE(ch)) {
-        int done = FALSE;
-        do {
-            ch = fGetChar(fp);
-            done = ((maxlen<++len)||ISLINEFEED(ch)||(ch==EOF)
-		    ||ISQUOTE(ch));
-            if (ch=='\\')
-                ch = fGetLiteral(fp);
-            if (!done)
-                *p++ = ch;
-            else if ((ch!=EOF) && !ISQUOTE(ch))
-                fUngetChar(ch,fp);
-        } while (!done);
-        *p = '\0';
-        if (ISLINEFEED(ch)) return(GTOK_BAD_QSTRING);
-        return(GTOK_QSTRING);
-    }
-
-    /*
-     * Not a quoted string.  If its a token character (rules are
-     * defined via the ISTOKENCHAR macro, in kparse.h) take it and all
-     * token chars following it until we run out of space.
-     */
-    digits=TRUE;
-    if (ISTOKENCHAR(ch)) {
-        while ( (ISTOKENCHAR(ch)) && len<maxlen-1 ) {
-            if (!isdigit(ch)) digits=FALSE;
-            *p++ = ch;
-            len++;
-            ch = fGetChar(fp);
-        };
-        *p = '\0';
-
-        if (ch!=EOF) {
-            fUngetChar(ch,fp);
-        }
-        if (digits) {
-            return(GTOK_NUMBER);
-        } else {
-            return(GTOK_STRING);
-        }
-    }
-
-    /*
-     * Neither a quoted string nor a token character.  Return a string
-     * with just that one character in it.
-     */
-    if (ch==EOF) {
-        return(GTOK_EOF);
-    }
-    if (!ISWHITESPACE(ch)) {
-        *p++ = ch;
-        *p='\0';
-    } else {
-        *p++ = ' ';		/* white space is always the
-				 * blank character */
-        *p='\0';
-        /*
-         * The character is a white space. Flush all additional white
-         * space.
-         */
-        while (ISWHITESPACE(ch) && ((ch=fGetChar(fp)) != EOF))
-            ;
-        if (ch!=EOF) {
-            fUngetChar(ch,fp);
-        }
-        return(GTOK_WHITE);
-    }
-    return(GTOK_PUNK);
-}
-
-/*
- * fGetLiteral is called after we find a '\' in the input stream.  A
- * string of numbers following the backslash are converted to the
- * appropriate value; hex (0xn), octal (0n), and decimal (otherwise)
- * are all supported.  If the char after the \ is not a number, we
- * special case certain values (\n, \f, \r, \b) or return a literal
- * otherwise (useful for \", for example).
- *
- * " <- emacs fix
- */
-
-int
-fGetLiteral(fp)
-	FILE *fp;
-{
-    int ch;
-    int n=0;
-    int base;
-
-    ch = fGetChar(fp);
-
-    if (!isdigit(ch)) {
-        switch (ch) {
-        case 'n':       return('\n');
-        case 'f':       return('\f');
-        case 'r':       return('\r');
-        case 'b':       return('\b');
-        default:        return(ch);
-        }
-    }
-
-    /*
-     * got a number.  might be decimal (no prefix), octal (prefix 0),
-     * or hexadecimal (prefix 0x).  Set the base appropriately.
-     */
-    if (ch!='0') {
-        base=10;                /* its a decimal number */
-    } else {
-        /*
-         * found a zero, its either hex or octal
-         */
-        ch = fGetChar(fp);
-        if ((ch!='x') && (ch!='X')) {
-            base=010;
-        } else {
-            ch = fGetChar(fp);
-            base=0x10;
-        }
-    }
-
-    switch (base) {
-
-    case 010:                   /* octal */
-        while (ISOCTAL(ch)) {
-            n = (n*base) + ch - '0';
-            ch = fGetChar(fp);
-        }
-        break;
-
-    case 10:                    /* decimal */
-        while (isdigit(ch)) {
-            n = (n*base) + ch - '0';
-            ch = fGetChar(fp);
-        }
-        break;
-    case 0x10:                  /* hexadecimal */
-        while (isxdigit(ch)) {
-            if (isdigit(ch)) {
-                n = (n*base) + ch - '0';
-            } else {
-                n = (n*base) + toupper(ch) - 'A' + 0xA ;
-            }
-            ch = fGetChar(fp);
-        }
-        break;
-    default:
-        fprintf(stderr,"fGetLiteral() died real bad. Fix gettoken.c.");
-        exit(1);
-        break;
-    }
-    fUngetChar(ch,fp);
-    return(n);
-}
-
-/*
- * exactly the same as ungetc(3) except that the line number of the
- * input file is maintained.
- */
-int
-fUngetChar(ch, fp)
-	int ch;
-	FILE *fp;
-{
-    if (ch=='\n') LineNbr--;
-    return(ungetc(ch,fp));
-}
-
-/*
- * exactly the same as fgetc(3) except that the line number of the
- * input file is maintained.
- */
-int
-fGetChar(fp)
-	FILE *fp;
-{
-    int ch = fgetc(fp);
-    if (ch=='\n') LineNbr++;
-    return(ch);
-}
-
-
-/*
- * Routine Name: strsave
- *
- * Function: return a pointer to a saved copy of the
- * input string. the copy will be allocated
- * as large as necessary.
- *
- * Explicit Parameters: pointer to string to save
- *
- * Implicit Parameters: None
- *
- * External Procedures: malloc,strcpy,strlen
- *
- * Side Effects: None
- *
- * Return Value: pointer to copied string
- *
- */
-char *
-strsave(p)
-	char *p;
-{
-    return(strcpy(malloc(strlen(p)+1),p));
-}
-
-
-/*
- * strutol changes all characters in a string to lower case, in place.
- * the pointer to the beginning of the string is returned.
- */
-
-char *
-strutol(start)
-	char *start;
-{
-    char *q;
-    for (q=start; *q; q++)
-        if (isupper(*q))
-	    *q=tolower(*q);
-    return(start);
-}
-
-#ifdef GTOK_TEST	     /* mainline test routine for fGetToken() */
-
-#define MAXTOKEN 100
-
-char *pgm = "gettoken";
-
-main(argc,argv)
-    int argc;
-    char **argv;
-{
-    char *p;
-    int type;
-    FILE *fp;
-
-    if (--argc) {
-        fp = fopen(*++argv,"ra");
-        if (fp == (FILE *)NULL) {
-            fprintf(stderr,"can\'t open \"%s\"\n",*argv);
-        }
-    } else
-        fp = stdin;
-
-    p = malloc(MAXTOKEN);
-    while (type = fGetToken(fp,p,MAXTOKEN)) {
-        switch(type) {
-        case GTOK_BAD_QSTRING:
-	    printf("BAD QSTRING!\t");
-	    break;
-        case GTOK_EOF:
-	    printf("EOF!\t");
-	    break;
-        case GTOK_QSTRING:
-	    printf("QSTRING\t");
-	    break;
-        case GTOK_STRING:
-	    printf("STRING\t");
-	    break;
-        case GTOK_NUMBER:
-	    printf("NUMBER\t");
-	    break;
-        case GTOK_PUNK:
-	    printf("PUNK\t");
-	    break;
-        case GTOK_WHITE:
-	    printf("WHITE\t");
-	    break;
-        default:
-	    printf("HUH?\t");
-	    break;
-        }
-        if (*p=='\n')
-            printf("\\n\n");
-	else
-            printf("%s\n",p);
-    }
-    exit(0);
-}
-#endif
-
-#ifdef KVTEST
-
-main(argc,argv)
-    int argc;
-    char **argv;
-{
-    int rc,ch;
-    FILE *fp;
-    char key[MAXKEY],valu[MAXVALUE];
-    char *filename;
-
-    if (argc != 2) {
-        fprintf(stderr,"usage: test <filename>\n");
-        exit(1);
-    }
-
-    if (!(fp=fopen(*++argv,"r"))) {
-        fprintf(stderr,"can\'t open input file \"%s\"\n",filename);
-        exit(1);
-    }
-    filename = *argv;
-
-    while ((rc=fGetKeywordValue(fp,key,MAXKEY,valu,MAXVALUE))!=KV_EOF){
-
-        switch (rc) {
-
-        case KV_EOL:
-            printf("%s, line %d: nada mas.\n",filename,LineNbr-1);
-            break;
-
-        case KV_SYNTAX:
-            printf("%s, line %d: syntax error: %s\n",
-                   filename,LineNbr,ErrorMsg);
-            while ( ((ch=fGetChar(fp))!=EOF) && (ch!='\n') );
-            break;
-
-        case KV_OKAY:
-            printf("%s, line %d: okay, %s=\"%s\"\n",
-                   filename,LineNbr,key,valu);
-            break;
-
-        default:
-            printf("panic: bad return (%d) from fGetKeywordValue\n",rc);
-            break;
-        }
-    }
-    printf("EOF");
-    fclose(fp);
-    exit(0);
-}
-#endif
-
-#ifdef PSTEST
-
-parmtable kparm[] = {
-    /*  keyword, default, found value */
-    { "user",       "",    (char *)NULL },
-    { "realm",   "Athena", (char *)NULL },
-    { "instance",   "",    (char *)NULL }
-};
-
-main(argc,argv)
-    int argc;
-    char **argv;
-{
-    int rc,i,ch;
-    FILE *fp;
-    char *filename;
-
-    if (argc != 2) {
-        fprintf(stderr,"usage: test <filename>\n");
-        exit(1);
-    }
-
-    if (!(fp=fopen(*++argv,"r"))) {
-        fprintf(stderr,"can\'t open input file \"%s\"\n",filename);
-        exit(1);
-    }
-    filename = *argv;
-
-    while ((rc=fGetParameterSet(fp,kparm,PARMCOUNT(kparm))) != PS_EOF) {
-
-        switch (rc) {
-
-        case PS_BAD_KEYWORD:
-            printf("%s, line %d: %s\n",filename,LineNbr,ErrorMsg);
-            while ( ((ch=fGetChar(fp))!=EOF) && (ch!='\n') );
-            break;
-
-        case PS_SYNTAX:
-            printf("%s, line %d: syntax error: %s\n",
-                   filename,LineNbr,ErrorMsg);
-            while ( ((ch=fGetChar(fp))!=EOF) && (ch!='\n') );
-            break;
-
-        case PS_OKAY:
-            printf("%s, line %d: valid parameter set found:\n",
-                   filename,LineNbr-1);
-            for (i=0; i<PARMCOUNT(kparm); i++) {
-                printf("\t%s = \"%s\"\n",kparm[i].keyword,
-                       (kparm[i].value ? kparm[i].value
-			: kparm[i].defvalue));
-            }
-            break;
-
-        default:
-            printf("panic: bad return (%d) from fGetParameterSet\n",rc);
-            break;
-        }
-        FreeParameterSet(kparm,PARMCOUNT(kparm));
-    }
-    printf("EOF");
-    fclose(fp);
-    exit(0);
-}
-#endif
diff --git a/kerberosIV/krb/krb_check_auth.c b/kerberosIV/krb/krb_check_auth.c
new file mode 100644
index 00000000000..ddb52d6a9f0
--- /dev/null
+++ b/kerberosIV/krb/krb_check_auth.c
@@ -0,0 +1,76 @@
+/* $KTH: krb_check_auth.c,v 1.4 1997/04/01 08:18:33 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+/*
+ *
+ * Receive an mutual-authenticator for a server in `packet', with
+ * `checksum', `session', and `schedule' having the appropriate values
+ * and return the data in `msg_data'.
+ *
+ * Return KSUCCESS if the received checksum is correct.
+ *
+ */
+
+int
+krb_check_auth(KTEXT packet,
+	       u_int32_t checksum,
+	       MSG_DAT *msg_data,
+	       des_cblock *session,
+	       struct des_ks_struct *schedule,
+	       struct sockaddr_in *laddr,
+	       struct sockaddr_in *faddr)
+{
+  int ret;
+  u_int32_t checksum2;
+
+  ret = krb_rd_priv (packet->dat, packet->length, schedule, session, faddr,
+		     laddr, msg_data);
+  if (ret != RD_AP_OK)
+    return ret;
+  if (msg_data->app_length != 4)
+    return KFAILURE;
+  krb_get_int (msg_data->app_data, &checksum2, 4, 0);
+  if (checksum2 == checksum + 1)
+    return KSUCCESS;
+  else
+    return KFAILURE;
+}
diff --git a/kerberosIV/krb/krb_equiv.c b/kerberosIV/krb/krb_equiv.c
new file mode 100644
index 00000000000..8dcc7184853
--- /dev/null
+++ b/kerberosIV/krb/krb_equiv.c
@@ -0,0 +1,144 @@
+/* $KTH: krb_equiv.c,v 1.13 1997/04/01 08:18:33 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * int krb_equiv(u_int32_t ipaddr_a, u_int32_t ipaddr_b);
+ *
+ * Given two IP adresses return true if they match
+ * or are considered to belong to the same host.
+ *
+ * For example if /etc/krb.equiv looks like
+ *
+ *    130.237.223.3   192.16.126.3    # alv alv1
+ *    130.237.223.4   192.16.126.4    # byse byse1
+ *    130.237.228.152 192.16.126.9    # topsy topsy1
+ *
+ * krb_equiv(alv, alv1) would return true but
+ * krb_equiv(alv, byse1) would not.
+ *
+ * A comment starts with an '#' and ends with '\n'.
+ *
+ */
+#include "krb_locl.h"
+
+int krb_ignore_ip_address = 0;
+
+int
+krb_equiv(u_int32_t a, u_int32_t b)
+{
+  FILE *fil;
+  char line[256];
+  int hit_a, hit_b;
+  int iscomment;
+  
+  if (a == b)			/* trivial match, also the common case */
+    return 1;
+  
+  if (krb_ignore_ip_address)
+    return 1;			/* if we have decided not to compare */
+
+  a = ntohl(a);
+  b = ntohl(b);
+
+  fil = fopen(KRB_EQUIV, "r");
+  if (fil == NULL)		/* open failed */
+    return 0;
+  
+  hit_a = hit_b = 0;
+  iscomment = 0;
+  while (fgets(line, sizeof(line)-1, fil) != NULL) /* for each line */
+    {
+      char *t = line;
+      int len = strlen(t);
+      
+      /* for each item on this line */
+      while (*t != 0)		/* more addresses on this line? */
+	if (*t == '\n') {
+	  iscomment = hit_a = hit_b = 0;
+	  break;
+	} else if (iscomment)
+	  t = line + len - 1;
+	else if (*t == '#') {		/* rest is comment */
+	  iscomment = 1;
+	  ++t;
+	} else if (*t == '\\' ) /* continuation */
+	  break;
+	else if (isspace(*t))	/* skip space */
+	  t++;
+	else if (isdigit(*t))	/* an address? */
+	  {
+	    u_int32_t tmp;
+	    u_int32_t tmpa, tmpb, tmpc, tmpd;
+	    
+	    sscanf(t, "%d.%d.%d.%d", &tmpa, &tmpb, &tmpc, &tmpd);
+	    tmp = (tmpa << 24) | (tmpb << 16) | (tmpc << 8) | tmpd;
+
+	    while (*t == '.' || isdigit(*t)) /* done with this address */
+	      t++;
+
+	    if (tmp != -1) {	/* an address (and not broadcast) */
+	      u_int32_t mask = (u_int32_t)~0;
+
+	      if (*t == '/') {
+		++t;
+		mask <<= 32 - atoi(t);
+
+		while(isdigit(*t))
+		  ++t;
+	      }
+
+	      if ((tmp & mask) == (a & mask))
+		hit_a = 1;
+	      if ((tmp & mask) == (b & mask))
+		hit_b = 1;
+	      if (hit_a && hit_b) {
+		fclose(fil);
+		return 1;
+	      }
+	    }
+	  }
+	else
+	  ++t;		/* garbage on this line, skip it */
+
+    }
+
+  fclose(fil);
+  return 0;
+}
diff --git a/kerberosIV/krb/krb_err.et b/kerberosIV/krb/krb_err.et
index 6c7d37df89e..172e61f12ba 100644
--- a/kerberosIV/krb/krb_err.et
+++ b/kerberosIV/krb/krb_err.et
@@ -3,9 +3,7 @@
 #	For copying and distribution information, see the file
 #	"mit-copyright.h".
 # 
-#	$Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/krb_err.et,v $
-#	$Author: tholo $
-#	$Header: /cvs/OpenBSD/src/kerberosIV/krb/Attic/krb_err.et,v 1.1 1995/12/14 06:52:37 tholo Exp $
+#	$KTH: krb_err.et,v 1.4 1996/10/27 13:30:28 bg Exp $
 #
 	error_table	krb
 
@@ -226,7 +224,7 @@
 			"Don't have Kerberos ticket-granting ticket"
 
 	ec		KRBET_KRB_RES72,
-			"Reserved 72"
+			"Can't get Kerberos inter-realm ticket-granting ticket"
 
 	ec		KRBET_KRB_RES73,
 			"Reserved 73"
diff --git a/kerberosIV/krb/krb_err_txt.c b/kerberosIV/krb/krb_err_txt.c
index 8423d20e81a..18eb61bba8c 100644
--- a/kerberosIV/krb/krb_err_txt.c
+++ b/kerberosIV/krb/krb_err_txt.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/krb_err_txt.c,v $
- *
- * $Locker:  $
- */
+/*     $KTH: krb_err_txt.c,v 1.12 1997/04/02 05:37:10 joda Exp $    */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,6 +23,7 @@ or implied warranty.
 
 #include "krb_locl.h"
 
+
 /*
  * This file contains an array of error text strings.
  * The associated error codes (which are defined in "krb.h")
@@ -47,7 +42,7 @@ const char *krb_err_txt[256] = {
   "Principal unknown (kerberos)",			/* 008 */
   "Principal not unique (kerberos)",			/* 009 */
   "Principal has null key (kerberos)",			/* 010 */
-  "Reserved error message 11 (kerberos)",		/* 011 */
+  "Timeout in request (kerberos)",			/* 011 */
   "Reserved error message 12 (kerberos)",		/* 012 */
   "Reserved error message 13 (kerberos)",		/* 013 */
   "Reserved error message 14 (kerberos)",		/* 014 */
@@ -99,16 +94,16 @@ const char *krb_err_txt[256] = {
   "Reserved error message 60 (send_to_kdc)",		/* 060 */
   "Warning: Not ALL tickets returned",			/* 061 */
   "Password incorrect",					/* 062 */
-  "Protocol error (get_intkt)",				/* 063 */
+  "Protocol error (get_in_tkt)",			/* 063 */
   "Reserved error message 64 (get_in_tkt)",		/* 064 */
   "Reserved error message 65 (get_in_tkt)",		/* 065 */
   "Reserved error message 66 (get_in_tkt)",		/* 066 */
   "Reserved error message 67 (get_in_tkt)",		/* 067 */
   "Reserved error message 68 (get_in_tkt)",		/* 068 */
   "Reserved error message 69 (get_in_tkt)",		/* 069 */
-  "Generic error (get_intkt)",				/* 070 */
+  "Generic error (get_in_tkt)(can't write ticket file)", /* 070 */
   "Don't have ticket granting ticket (get_ad_tkt)",	/* 071 */
-  "Reserved error message 72 (get_ad_tkt)",		/* 072 */
+  "Can't get inter-realm ticket granting ticket (get_ad_tkt)",	/* 072 */
   "Reserved error message 73 (get_ad_tkt)",		/* 073 */
   "Reserved error message 74 (get_ad_tkt)",		/* 074 */
   "Reserved error message 75 (get_ad_tkt)",		/* 075 */
@@ -293,3 +288,13 @@ const char *krb_err_txt[256] = {
   "(reserved)",
   "Generic kerberos error (kfailure)",			/* 255 */
 };
+
+static const char err_failure[] = "Illegal error code passed (krb_get_err_text)";
+
+const char *
+krb_get_err_text(int code)
+{
+  if(code < 0 || code >= MAX_KRB_ERRORS)
+    return err_failure;
+  return krb_err_txt[code];
+}
diff --git a/kerberosIV/krb/krb_get_in_tkt.c b/kerberosIV/krb/krb_get_in_tkt.c
index 1ce8c9926b7..4910e1fe052 100644
--- a/kerberosIV/krb/krb_get_in_tkt.c
+++ b/kerberosIV/krb/krb_get_in_tkt.c
@@ -1,64 +1,45 @@
+/* $KTH: krb_get_in_tkt.c,v 1.22 1997/08/23 15:49:11 joda Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/krb_get_in_tkt.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
-#include <sys/time.h>
-
-int     swap_bytes;
-
-static int
-pkt_clen(pkt)
-	KTEXT pkt;
-{
-    static unsigned short temp,temp2;
-    int clen = 0;
-
-    /* Start of ticket list */
-    unsigned char *ptr = pkt_a_realm(pkt) + 10
-	+ strlen((char *)pkt_a_realm(pkt));
-
-    /* Finally the length */
-    bcopy((char *)(++ptr),(char *)&temp,2); /* alignment */
-    if (swap_bytes) {
-        /* assume a short is 2 bytes?? */
-        swab((char *)&temp,(char *)&temp2,2);
-        temp = temp2;
-    }
-
-    clen = (int) temp;
-
-    if (krb_debug)
-	printf("Clen is %d\n",clen);
-    return(clen);
-}
-
 /*
  * decrypt_tkt(): Given user, instance, realm, passwd, key_proc
  * and the cipher text sent from the KDC, decrypt the cipher text
@@ -66,41 +47,20 @@ pkt_clen(pkt)
  */
 
 static int
-decrypt_tkt(user, instance, realm, arg, key_proc, cipp)
-  char *user;
-  char *instance;
-  char *realm;
-  char *arg;
-  int (*key_proc)();
-  KTEXT *cipp;
+decrypt_tkt(char *user, char *instance, char *realm,
+	    void *arg, key_proc_t key_proc, KTEXT *cip)
 {
-    KTEXT cip = *cipp;
     des_cblock key;		/* Key for decrypting cipher */
-    des_key_schedule key_s;
+    int ret;
 
-#ifndef NOENCRYPTION
-    /* Attempt to decrypt it */
-#endif
-    
-    /* generate a key */
-    
-    {
-	register int rc;
-	rc = (*key_proc)(user,instance,realm,arg,key);
-	if (rc)
-	    return(rc);
-    }
+    ret = key_proc(user, instance, realm, arg, &key);
+    if (ret != 0)
+	return ret;
     
-#ifndef NOENCRYPTION
-    des_key_sched(&key,key_s);
-    des_pcbc_encrypt((des_cblock *)cip->dat,(des_cblock *)cip->dat,
-		 (long) cip->length,key_s,&key,DES_DECRYPT);
-#endif /* !NOENCRYPTION */
-    /* Get rid of all traces of key */
-    bzero((char *)key,sizeof(key));
-    bzero((char *)key_s,sizeof(key_s));
+    encrypt_ktext(*cip, &key, DES_DECRYPT);
 
-    return(0);
+    memset(&key, 0, sizeof(key));
+    return 0;
 }
 
 /*
@@ -145,187 +105,92 @@ decrypt_tkt(user, instance, realm, arg, key_proc, cipp)
  */
 
 int
-krb_get_in_tkt(user, instance, realm, service, sinstance, life,
-	       key_proc, decrypt_proc, arg)
-    char *user;
-    char *instance;
-    char *realm;
-    char *service;
-    char *sinstance;
-    int life;
-    int (*key_proc)();
-    int (*decrypt_proc)();
-    char *arg;
+krb_mk_as_req(char *user, char *instance, char *realm, 
+	      char *service, char *sinstance, int life, KTEXT cip)
 {
     KTEXT_ST pkt_st;
     KTEXT pkt = &pkt_st;	/* Packet to KDC */
     KTEXT_ST rpkt_st;
-    KTEXT rpkt = &rpkt_st;	/* Returned packet */
-    KTEXT_ST cip_st;
-    KTEXT cip = &cip_st;	/* Returned Ciphertext */
-    KTEXT_ST tkt_st;
-    KTEXT tkt = &tkt_st;	/* Current ticket */
-    des_cblock ses;                /* Session key for tkt */
-    int kvno;			/* Kvno for session key */
-    unsigned char *v = pkt->dat; /* Prot vers no */
-    unsigned char *t = (pkt->dat+1); /* Prot msg type */
-
-    char s_name[SNAME_SZ];
-    char s_instance[INST_SZ];
-    char rlm[REALM_SZ];
-    int lifetime;
-    int msg_byte_order;
+    KTEXT rpkt = &rpkt_st;	/* Reply from KDC */
+    
     int kerror;
-    unsigned long exp_date;
-    char *ptr;
-
-    struct timeval t_local;
-
-    unsigned long rep_err_code;
-
-    unsigned long kdc_time;   /* KDC time */
+    struct timeval tv;
 
     /* BUILD REQUEST PACKET */
 
-    /* Set up the fixed part of the packet */
-    *v = (unsigned char) KRB_PROT_VERSION;
-    *t = (unsigned char) AUTH_MSG_KDC_REQUEST;
-    *t |= HOST_BYTE_ORDER;
+    unsigned char *p = pkt->dat;
+    
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_KDC_REQUEST, p, 1);
+
+    p += krb_put_nir(user, instance, realm, p);
 
-    /* Now for the variable info */
-    (void) strcpy((char *)(pkt->dat+2),user); /* aname */
-    pkt->length = 3 + strlen(user);
-    (void) strcpy((char *)(pkt->dat+pkt->length),
-		  instance);	/* instance */
-    pkt->length += 1 + strlen(instance);
-    (void) strcpy((char *)(pkt->dat+pkt->length),realm); /* realm */
-    pkt->length += 1 + strlen(realm);
+    gettimeofday(&tv, NULL);
+    p += krb_put_int(tv.tv_sec, p, 4);
+    p += krb_put_int(life, p, 1);
 
-    (void) gettimeofday(&t_local,(struct timezone *) 0);
-    /* timestamp */
-    bcopy((char *)&(t_local.tv_sec),(char *)(pkt->dat+pkt->length), 4);
-    pkt->length += 4;
+    p += krb_put_nir(service, sinstance, NULL, p);
 
-    *(pkt->dat+(pkt->length)++) = (char) life;
-    (void) strcpy((char *)(pkt->dat+pkt->length),service);
-    pkt->length += 1 + strlen(service);
-    (void) strcpy((char *)(pkt->dat+pkt->length),sinstance);
-    pkt->length += 1 + strlen(sinstance);
+    pkt->length = p - pkt->dat;
 
     rpkt->length = 0;
 
     /* SEND THE REQUEST AND RECEIVE THE RETURN PACKET */
 
-    if ((kerror = send_to_kdc(pkt, rpkt, realm))) return(kerror);
-
-    /* check packet version of the returned packet */
-    if (pkt_version(rpkt) != KRB_PROT_VERSION)
-        return(INTK_PROT);
-
-    /* Check byte order */
-    msg_byte_order = pkt_msg_type(rpkt) & 1;
-    swap_bytes = 0;
-    if (msg_byte_order != HOST_BYTE_ORDER) {
-        swap_bytes++;
-    }
-
-    switch (pkt_msg_type(rpkt) & ~1) {
-    case AUTH_MSG_KDC_REPLY:
-        break;
-    case AUTH_MSG_ERR_REPLY:
-        bcopy(pkt_err_code(rpkt),(char *) &rep_err_code,4);
-        if (swap_bytes) swap_u_long(rep_err_code);
-        return((int)rep_err_code);
-    default:
-        return(INTK_PROT);
-    }
-
-    /* EXTRACT INFORMATION FROM RETURN PACKET */
-
-    /* get the principal's expiration date */
-    bcopy(pkt_x_date(rpkt),(char *) &exp_date,sizeof(exp_date));
-    if (swap_bytes) swap_u_long(exp_date);
-
-    /* Extract the ciphertext */
-    cip->length = pkt_clen(rpkt);       /* let clen do the swap */
-
-    if ((cip->length < 0) || (cip->length > sizeof(cip->dat)))
-	return(INTK_ERR);		/* no appropriate error code
-					 currently defined for INTK_ */
-    /* copy information from return packet into "cip" */
-    bcopy((char *) pkt_cipher(rpkt),(char *)(cip->dat),cip->length);
+    kerror = send_to_kdc(pkt, rpkt, realm);
+    if(kerror) return kerror;
+    kerror = kdc_reply_cipher(rpkt, cip);
+    return kerror;
+}
 
-    /* Attempt to decrypt the reply. */
+int
+krb_decode_as_rep(char *user, char *instance, char *realm,
+		  char *service, char *sinstance, 
+		  key_proc_t key_proc, decrypt_proc_t decrypt_proc, void *arg,
+		  KTEXT as_rep, CREDENTIALS *cred)
+{
+    int kerror;
+    unsigned char *p;
+    time_t now;
+    
     if (decrypt_proc == NULL)
 	decrypt_proc = decrypt_tkt;
-    (*decrypt_proc)(user, instance, realm, arg, key_proc, &cip);
-
-    ptr = (char *) cip->dat;
-
-    /* extract session key */
-    bcopy(ptr,(char *)ses,8);
-    ptr += 8;
-
-    if ((strlen(ptr) + (ptr - (char *) cip->dat)) > cip->length)
-	return(INTK_BADPW);
-
-    /* extract server's name */
-    (void) strcpy(s_name,ptr);
-    ptr += strlen(s_name) + 1;
-
-    if ((strlen(ptr) + (ptr - (char *) cip->dat)) > cip->length)
-	return(INTK_BADPW);
-
-    /* extract server's instance */
-    (void) strcpy(s_instance,ptr);
-    ptr += strlen(s_instance) + 1;
-
-    if ((strlen(ptr) + (ptr - (char *) cip->dat)) > cip->length)
-	return(INTK_BADPW);
-
-    /* extract server's realm */
-    (void) strcpy(rlm,ptr);
-    ptr += strlen(rlm) + 1;
-
-    /* extract ticket lifetime, server key version, ticket length */
-    /* be sure to avoid sign extension on lifetime! */
-    lifetime = (unsigned char) ptr[0];
-    kvno = (unsigned char) ptr[1];
-    tkt->length = (unsigned char) ptr[2];
-    ptr += 3;
-    
-    if ((tkt->length < 0) ||
-	((tkt->length + (ptr - (char *) cip->dat)) > cip->length))
-	return(INTK_BADPW);
-
-    /* extract ticket itself */
-    bcopy(ptr,(char *)(tkt->dat),tkt->length);
-    ptr += tkt->length;
-
-    if (strcmp(s_name, service) || strcmp(s_instance, sinstance) ||
-        strcmp(rlm, realm))	/* not what we asked for */
-	return(INTK_ERR);	/* we need a better code here XXX */
-
-    /* check KDC time stamp */
-    bcopy(ptr,(char *)&kdc_time,4); /* Time (coarse) */
-    if (swap_bytes) swap_u_long(kdc_time);
-
-    ptr += 4;
-
-    (void) gettimeofday(&t_local,(struct timezone *) 0);
-    if (abs((int)(t_local.tv_sec - kdc_time)) > CLOCK_SKEW) {
-        return(RD_AP_TIME);		/* XXX should probably be better
-					   code */
+    (*decrypt_proc)(user, instance, realm, arg, key_proc, &as_rep);
+
+    kerror = kdc_reply_cred(as_rep, cred);
+    if(kerror != KSUCCESS)
+	return kerror;
+	
+    if (strcmp(cred->service, service) || 
+	strcmp(cred->instance, sinstance) ||
+	strcmp(cred->realm, realm))	/* not what we asked for */
+	return INTK_ERR;	/* we need a better code here XXX */
+
+    now = time(NULL);
+    if (abs((int)(now - cred->issue_date)) > CLOCK_SKEW) {
+	return RD_AP_TIME; /* XXX should probably be better code */
     }
 
-    /* initialize ticket cache */
-    if (in_tkt(user,instance) != KSUCCESS)
-	return(INTK_ERR);
-
-    /* stash ticket, session key, etc. for future use */
-    if ((kerror = save_credentials(s_name, s_instance, rlm, ses,
-				  lifetime, kvno, tkt, t_local.tv_sec)))
-	return(kerror);
+    return 0;
+}
 
-    return(INTK_OK);
+int
+krb_get_in_tkt(char *user, char *instance, char *realm, 
+	       char *service, char *sinstance, int life,
+	       key_proc_t key_proc, decrypt_proc_t decrypt_proc, void *arg)
+{
+    KTEXT_ST as_rep;
+    CREDENTIALS cred;
+    int ret;
+
+    ret = krb_mk_as_req(user, instance, realm, 
+			service, sinstance, life, &as_rep);
+    if(ret)
+	return ret;
+    ret = krb_decode_as_rep(user, instance, realm, service, sinstance, 
+			    key_proc, decrypt_proc, arg, &as_rep, &cred);
+    if(ret)
+	return ret;
+
+    return tf_setup(&cred, user, instance);
 }
diff --git a/kerberosIV/krb/krb_locl.h b/kerberosIV/krb/krb_locl.h
index 45f46bbf991..75b668a5170 100644
--- a/kerberosIV/krb/krb_locl.h
+++ b/kerberosIV/krb/krb_locl.h
@@ -1,40 +1,128 @@
-/* $Id: krb_locl.h,v 1.1 1995/12/14 06:52:38 tholo Exp $ */
+/* $KTH: krb_locl.h,v 1.44 1997/10/28 15:37:40 bg Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
 
 #ifndef __krb_locl_h
 #define __krb_locl_h
 
 #include <sys/cdefs.h>
-#include "kerberosIV/site.h"
+#include <kerberosIV/site.h>
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#include <assert.h>
+#include <stdarg.h>
+
+#include <errno.h>
 
+#include <pwd.h>
 #include <unistd.h>
 #include <sys/types.h>
+#include <sys/time.h>
 #include <time.h>
+#include <sys/time.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <sys/file.h>
+#include <sys/select.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
 #include <errno.h>
 
 #include <kerberosIV/krb.h>
 #include <prot.h>
 
+#include "resolve.h"
+#include "krb_log.h"
+
 /* --- */
 
 /* Globals! */
 extern int krb_debug;
 extern int krb_ap_req_debug;
+extern int krb_dns_debug;
+
+/* Temporary fixes for krb_{rd,mk}_safe */
+#define DES_QUAD_GUESS 0
+#define DES_QUAD_NEW 1
+#define DES_QUAD_OLD 2
+
+/* Set this to one of the constants above to specify default checksum
+   type to emit */
+#define DES_QUAD_DEFAULT DES_QUAD_GUESS
 
 /* Utils */
-char *pkt_cipher __P((KTEXT));
+int krb_name_to_name(const char *, char *, size_t);
+
+void encrypt_ktext(KTEXT cip, des_cblock *key, int encrypt);
+int kdc_reply_cred(KTEXT cip, CREDENTIALS *cred);
+int kdc_reply_cipher(KTEXT reply, KTEXT cip);
+
+void k_ricercar(char*);
+
+/* safe multiple strcat */
+int k_concat(char*, size_t, ...);
+int k_vconcat(char*, size_t, va_list);
+
+/* mallocing versions of the above */
+size_t k_vmconcat (char**, size_t, va_list); 
+size_t k_mconcat (char**, size_t, ...);
+
+/* used in rd_safe.c and mk_safe.c */
+
+void fixup_quad_cksum(void *start, size_t len, des_cblock *key, 
+		      void *new_checksum, void *old_checksum, int little);
+
+/* stuff from libroken*/
 
-int new_log __P((time_t, char *));
-char *klog ();
+#ifndef TRUE
+#define TRUE 1
+#endif
 
-char *month_sname __P((int));
-int fgetst __P((FILE *, char *, int));
+#ifndef FALSE
+#define FALSE 0
+#endif
 
 #endif /*  __krb_locl_h */
diff --git a/kerberosIV/krb/kuserok.c b/kerberosIV/krb/kuserok.c
index 7cc7e4af413..6908354e5fe 100644
--- a/kerberosIV/krb/kuserok.c
+++ b/kerberosIV/krb/kuserok.c
@@ -1,55 +1,68 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/kuserok.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: kuserok.c,v 1.21 1997/04/01 08:18:35 joda Exp $ */
 
 /*
- * kuserok: check if a kerberos principal has
- * access to a local account
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-#include <pwd.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/file.h>
-
 #define OK 0
 #define NOTOK 1
 #define MAX_USERNAME 10
 
-/*
- * Given a Kerberos principal "kdata", and a local username "luser",
- * determine whether user is authorized to login according to the
- * authorization file ("~luser/.klogin" by default).  Returns OK
- * if authorized, NOTOK if not authorized.
+/* 
+ * Given a Kerberos principal and a local username, determine whether
+ * user is authorized to login according to the authorization file
+ * ("~luser/.klogin" by default).  Returns OK if authorized, NOTOK if
+ * not authorized.
+ *
+ * IMPORTANT CHANGE: To eliminate the need of making a distinction
+ * between the 3 cases:
+ *
+ * 1. We can't verify that a .klogin file doesn't exist (no home dir).
+ * 2. It's there but we aren't allowed to read it.
+ * 3. We can read it and ~luser@LOCALREALM is (not) included.
+ *
+ * We instead make the assumption that luser@LOCALREALM is *always*
+ * included. Thus it is impossible to have an empty .klogin file and
+ * also to exclude luser@LOCALREALM from it. Root is treated differently
+ * since it's home should always be available.
  *
+ * OLD STRATEGY:
  * If there is no account for "luser" on the local machine, returns
  * NOTOK.  If there is no authorization file, and the given Kerberos
  * name "kdata" translates to the same name as "luser" (using
@@ -64,148 +77,80 @@ or implied warranty.
  *
  * one entry per line.
  *
- * The ATHENA_COMPAT code supports old-style Athena ~luser/.klogin
- * file entries.  See the file "kparse.c".
  */
 
-#ifdef ATHENA_COMPAT
-
-#include <kparse.h>
-
-/*
- * The parmtable defines the keywords we will recognize with their
- * default values, and keeps a pointer to the found value.  The found
- * value should be filled in with strsave(), since FreeParameterSet()
- * will release memory for all non-NULL found strings. 
- *
-*** NOTE WELL! *** 
- *
- * The table below is very nice, but we cannot hard-code a default for the
- * realm: we have to get the realm via krb_get_lrealm().  Even though the
- * default shows as "from krb_get_lrealm, below", it gets changed in
- * kuserok to whatever krb_get_lrealm() tells us.  That code assumes that
- * the realm will be the entry number in the table below, so if you
- * change the order of the entries below, you have to change the
- * #definition of REALM_SCRIPT to reflect it. 
- */
-#define REALM_SUBSCRIPT 1
-parmtable kparm[] = {
-
-/* keyword	default 			found value     */
-{"user",	"", 				(char *) NULL},
-{"realm",	"see krb_get_lrealm, below",	(char *) NULL},
-{"instance",	 "",				(char *) NULL},
-};
-#define KPARMS kparm,PARMCOUNT(kparm)
-#endif /* ATHENA_COMPAT */
-
 int
-kuserok(kdata, luser)
-	AUTH_DAT *kdata;
-	char *luser;
+krb_kuserok(char *name, char *instance, char *realm, char *luser)
 {
-    struct stat sbuf;
     struct passwd *pwd;
-    char pbuf[MAXPATHLEN];
-    int isok = NOTOK, rc;
-    FILE *fp;
-    char kuser[MAX_USERNAME];
-    char principal[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
-    char linebuf[BUFSIZ];
-    char *newline;
-    int gobble;
-#ifdef ATHENA_COMPAT
-    char local_realm[REALM_SZ];
-#endif /* ATHENA_COMPAT */
-
-    /* no account => no access */
-    if ((pwd = getpwnam(luser)) == NULL) {
-	return(NOTOK);
+    char lrealm[REALM_SZ];
+    FILE *f;
+    char line[1024];
+    char file[MAXPATHLEN];
+    struct stat st;
+
+    pwd = getpwnam(luser);
+    if(pwd == NULL)
+	return NOTOK;
+    if(krb_get_lrealm(lrealm, 1))
+	return NOTOK;
+    if(pwd->pw_uid != 0 &&
+       strcmp(name, luser) == 0 &&
+       strcmp(instance, "") == 0 &&
+       strcmp(realm, lrealm) == 0)
+	return OK;
+    strcpy(file, pwd->pw_dir);
+    strcat(file, "/.klogin");
+
+    f = fopen(file, "r");
+    if(f == NULL)
+	return NOTOK;
+    
+    /* this is not a working test in filesystems like AFS and DFS */
+    if(fstat(fileno(f), &st) < 0){
+	fclose(f);
+	return NOTOK;
     }
-    snprintf(pbuf, sizeof pbuf, "%s/.klogin", pwd->pw_dir);
-
-    if (access(pbuf, F_OK)) {	 /* not accessible */
-	/*
-	 * if he's trying to log in as himself, and there is no .klogin file,
-	 * let him.  To find out, call
-	 * krb_kntoln to convert the triple in kdata to a name which we can
-	 * string compare. 
-	 */
-	if (!krb_kntoln(kdata, kuser) && (strcmp(kuser, luser) == 0)) {
-	    return(OK);
-	}
-    }
-    /* open ~/.klogin */
-    if ((fp = fopen(pbuf, "r")) == NULL) {
-	return(NOTOK);
+    
+    if(st.st_uid != pwd->pw_uid){
+	fclose(f);
+	return NOTOK;
     }
-    /*
-     * security:  if the user does not own his own .klogin file,
-     * do not grant access
-     */
-    if (fstat(fileno(fp), &sbuf)) {
-	fclose(fp);
-	return(NOTOK);
+    
+    while(fgets(line, sizeof(line), f)){
+	char fname[ANAME_SZ], finst[INST_SZ], frealm[REALM_SZ];
+	if(line[strlen(line) - 1] != '\n')
+	    /* read till end of line */
+	    while(1){
+		int c = fgetc(f);
+		if(c == '\n' || c == EOF)
+		    break;
+	    }
+	else
+	    line[strlen(line) - 1] = 0;
+	
+	if(kname_parse(fname, finst, frealm, line))
+	    continue;
+	if(strcmp(name, fname))
+	    continue;
+	if(strcmp(instance, finst))
+	    continue;
+	if(frealm[0] == 0)
+	    strcpy(frealm, lrealm);
+	if(strcmp(realm, frealm))
+	    continue;
+	fclose(f);
+	return OK;
     }
-    if (sbuf.st_uid != pwd->pw_uid) {
-	fclose(fp);
-	return(NOTOK);
-    }
-
-#ifdef ATHENA_COMPAT
-    /* Accept old-style .klogin files */
-
-    /*
-     * change the default realm from the hard-coded value to the
-     * accepted realm that Kerberos specifies. 
-     */
-    rc = krb_get_lrealm(local_realm, 1);
-    if (rc == KSUCCESS)
-	kparm[REALM_SUBSCRIPT].defvalue = local_realm;
-    else
-	return (rc);
-
-    /* check each line */
-    while ((isok != OK) && (rc = fGetParameterSet(fp, KPARMS)) != PS_EOF) {
-	switch (rc) {
-	case PS_BAD_KEYWORD:
-	case PS_SYNTAX:
-	    while (((gobble = fGetChar(fp)) != EOF) && (gobble != '\n'));
-	    break;
-
-	case PS_OKAY:
-	    isok = (ParmCompare(KPARMS, "user", kdata->pname) ||
-		    ParmCompare(KPARMS, "instance", kdata->pinst) ||
-		    ParmCompare(KPARMS, "realm", kdata->prealm));
-	    break;
+    fclose(f);
+    return NOTOK;
+}
 
-	default:
-	    break;
-	}
-	FreeParameterSet(kparm, PARMCOUNT(kparm));
-    }
-    /* reset the stream for parsing new-style names, if necessary */
-    rewind(fp);
-#endif /* ATHENA_COMPAT */
+/* compatibility interface */
 
-    /* check each line */
-    while ((isok != OK) && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
-	/* null-terminate the input string */
-	linebuf[BUFSIZ-1] = '\0';
-	newline = NULL;
-	/* nuke the newline if it exists */
-	if ((newline = strchr(linebuf, '\n')))
-	    *newline = '\0';
-	rc = kname_parse(principal, inst, realm, linebuf);
-	if (rc == KSUCCESS) {
-	    isok = (strncmp(kdata->pname, principal, ANAME_SZ) ||
-		    strncmp(kdata->pinst, inst, INST_SZ) ||
-		    strncmp(kdata->prealm, realm, REALM_SZ));
-	}
-	/* clean up the rest of the line if necessary */
-	if (!newline)
-	    while (((gobble = getc(fp)) != EOF) && gobble != '\n');
-    }
-    fclose(fp);
-    return(isok);
+int
+kuserok(AUTH_DAT *auth, char *luser)
+{
+    return krb_kuserok(auth->pname, auth->pinst, auth->prealm, luser);
 }
+
diff --git a/kerberosIV/krb/lifetime.c b/kerberosIV/krb/lifetime.c
index 9b04bd0ba4d..1795bade304 100644
--- a/kerberosIV/krb/lifetime.c
+++ b/kerberosIV/krb/lifetime.c
@@ -1,25 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/lifetime.c,v $
- *
- * $Locker:  $
- */
-
-/***************************************************************************
- * PRE-HISTORY
- *
- * Revision 2.1.2.2  91/11/08  00:35:25  mja
- * 	Lower NEVERDATE to a positive value since time values are not
- * 	handled properly by most of the rest of the system when
- * 	negative;  add krb_life_to_atime() and krb_atime_to_life().
- * 	[91/11/07  22:52:50  mja]
- * 
- * Revision 2.1.2.1  91/07/09  22:50:42  mja
- * 	Created.
- * 	[91/01/30            jm36@ANDREW.CMU.EDU]
- * 
- ***************************************************************************/
+/* $KTH: lifetime.c,v 1.9 1997/05/02 14:29:18 assar Exp $ */
 
 /*
  * Ticket lifetime.  This defines the table used to lookup lifetime
@@ -36,6 +15,9 @@
 
 #include "krb_locl.h"
 
+/* If you want to disable this feature */
+int krb_no_long_lifetimes = 0;
+
 #define TKTLIFENUMFIXED 64
 #define TKTLIFEMINFIXED 0x80
 #define TKTLIFEMAXFIXED 0xBF
@@ -125,11 +107,12 @@ static const int tkt_lifetimes[TKTLIFENUMFIXED] = {
  * in seconds, which is added to start to produce the end time.
  */
 u_int32_t
-krb_life_to_time(start, life)
-	u_int32_t start;
-	int life;
+krb_life_to_time(u_int32_t start, int life_)
 {
-    life = (unsigned char) life;
+    unsigned char life = (unsigned char) life_;
+
+    if (krb_no_long_lifetimes) return start + life*5*60;
+
     if (life == TKTLIFENOEXPIRE) return NEVERDATE;
     if (life < TKTLIFEMINFIXED) return start + life*5*60;
     if (life > TKTLIFEMAXFIXED) return start + MAXTKTLIFETIME;
@@ -148,16 +131,14 @@ krb_life_to_time(start, life)
  * the table for the smallest entry *greater than or equal* to the
  * requested entry.
  */
-int
-krb_time_to_life(start, end)
-	u_int32_t start;
-	u_int32_t end;
+int krb_time_to_life(u_int32_t start, u_int32_t end)
 {
-    long lifetime;
     int i;
+    long lifetime = end - start;
+
+    if (krb_no_long_lifetimes) return (lifetime + 5*60 - 1)/(5*60);
 
     if (end >= NEVERDATE) return TKTLIFENOEXPIRE;
-    lifetime = end - start;
     if (lifetime > MAXTKTLIFETIME || lifetime <= 0) return 0;
     if (lifetime < tkt_lifetimes[0]) return (lifetime + 5*60 - 1)/(5*60);
     for (i=0; i<TKTLIFENUMFIXED; i++) {
@@ -169,14 +150,13 @@ krb_time_to_life(start, end)
 }
 
 char *
-krb_life_to_atime(life)
-	int life;
+krb_life_to_atime(int life)
 {
     static char atime[11+1+2+1+2+1+2+1];
     unsigned long when;
     int secs, mins, hours;
 
-    if (life == TKTLIFENOEXPIRE)
+    if (life == TKTLIFENOEXPIRE && !krb_no_long_lifetimes)
 	return("Forever");
     when = krb_life_to_time(0, life);
     secs = when%60;
@@ -185,17 +165,15 @@ krb_life_to_atime(life)
     when /= 60;
     hours = when%24;
     when /= 24;
-    snprintf(atime, sizeof(atime), "%d+%02d:%02d:%02d", (int)when, hours,
-	     mins, secs);
+    snprintf(atime, sizeof(atime), "%d+%02d:%02d:%02d", (int)when, hours, mins, secs);
     return(atime);
 }
 
 int
-krb_atime_to_life(atime)
-	char *atime;
+krb_atime_to_life(char *atime)
 {
     unsigned long when = 0;
-    register char *cp;
+    char *cp;
     int colon = 0, plus = 0;
     int n = 0;
 
diff --git a/kerberosIV/krb/log.c b/kerberosIV/krb/log.c
deleted file mode 100644
index 5cea8483276..00000000000
--- a/kerberosIV/krb/log.c
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/log.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#include "krb_locl.h"
-
-#include <sys/time.h>
-
-#include <klog.h>
-
-static char *log_name = KRBLOG;
-static is_open;
-
-/*
- * This file contains three logging routines: set_logfile()
- * to determine the file that log entries should be written to;
- * and log() and new_log() to write log entries to the file.
- */
-
-/*
- * log() is used to add entries to the logfile (see set_logfile()
- * below).  Note that it is probably not portable since it makes
- * assumptions about what the compiler will do when it is called
- * with less than the correct number of arguments which is the
- * way it is usually called.
- *
- * The log entry consists of a timestamp and the given arguments
- * printed according to the given "format".
- *
- * The log file is opened and closed for each log entry.
- *
- * The return value is undefined.
- */
-
-/*VARARGS1 */
-void
-log(format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a0)
-     char *format;
-     int a1, a2, a3, a4, a5, a6, a7, a8, a9, a0;
-{
-    FILE *logfile;
-    time_t now;
-    struct tm *tm;
-
-    if ((logfile = fopen(log_name,"a")) == NULL)
-        return;
-
-    (void) time(&now);
-    tm = localtime(&now);
-
-    fprintf(logfile,"%2d-%s-%02d %02d:%02d:%02d ",tm->tm_mday,
-            month_sname(tm->tm_mon + 1),tm->tm_year,
-            tm->tm_hour, tm->tm_min, tm->tm_sec);
-    fprintf(logfile,format,a1,a2,a3,a4,a5,a6,a7,a8,a9,a0);
-    fprintf(logfile,"\n");
-    (void) fclose(logfile);
-    return;
-}
-
-/*
- * set_logfile() changes the name of the file to which
- * messages are logged.  If set_logfile() is not called,
- * the logfile defaults to KRBLOG, defined in "krb.h".
- */
-
-void
-set_logfile(filename)
-	char *filename;
-{
-    log_name = filename;
-    is_open = 0;
-}
-
-/*
- * new_log() appends a log entry containing the give time "t" and the
- * string "string" to the logfile (see set_logfile() above).  The file
- * is opened once and left open.  The routine returns 1 on failure, 0
- * on success.
- */
-
-int
-new_log(t, string)
-	time_t t;
-	char *string;
-{
-    static FILE *logfile;
-
-    struct tm *tm;
-
-    if (!is_open) {
-        if ((logfile = fopen(log_name,"a")) == NULL) return(1);
-        is_open = 1;
-    }
-
-    if (t) {
-        tm = localtime(&t);
-
-        fprintf(logfile,"\n%2d-%s-%02d %02d:%02d:%02d  %s",tm->tm_mday,
-                month_sname(tm->tm_mon + 1),tm->tm_year,
-                tm->tm_hour, tm->tm_min, tm->tm_sec, string);
-    }
-    else {
-        fprintf(logfile,"\n%20s%s","",string);
-    }
-
-    (void) fflush(logfile);
-    return(0);
-}
diff --git a/kerberosIV/krb/logging.c b/kerberosIV/krb/logging.c
new file mode 100644
index 00000000000..46c7ba2c998
--- /dev/null
+++ b/kerberosIV/krb/logging.c
@@ -0,0 +1,240 @@
+/* $KTH: logging.c,v 1.14 1997/05/11 09:01:40 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+#include <klog.h>
+
+struct krb_log_facility {
+    char filename[MAXPATHLEN]; 
+    FILE *file; 
+    krb_log_func_t func;
+};
+
+int
+krb_vlogger(struct krb_log_facility *f, const char *format, va_list args)
+{
+    FILE *file = NULL;
+    int ret;
+
+    if (f->file != NULL)
+	file = f->file;
+    else if (f->filename && f->filename[0])
+	file = fopen(f->filename, "a");
+
+    ret = f->func(file, format, args);
+
+    if (file != f->file)
+	fclose(file);
+    return ret;
+}
+
+int
+krb_logger(struct krb_log_facility *f, const char *format, ...)
+{
+    va_list args;
+    int ret;
+    va_start(args, format);
+    ret = krb_vlogger(f, format, args);
+    va_end(args);
+    return ret;
+}
+
+/*
+ * If FILE * is given log to it, otherwise, log to filename. When
+ * given a file name the file is opened and closed for each log
+ * record.
+ */
+int
+krb_openlog(struct krb_log_facility *f,
+	    char *filename,
+	    FILE *file,
+	    krb_log_func_t func)
+{
+    strcpy(f->filename, filename);
+    f->file = file;
+    f->func = func;
+    return KSUCCESS;
+}
+
+/* ------------------------------------------------------------
+   Compatibility functions from warning.c
+   ------------------------------------------------------------ */
+
+static int
+log_tty(FILE *f, const char *format,  va_list args)
+{
+    if (f != NULL && isatty(fileno(f)))
+	vfprintf(f, format, args);
+    return KSUCCESS;
+}
+
+/* stderr */
+static struct krb_log_facility std_log = { "/dev/tty", NULL, log_tty };
+
+static void
+init_std_log ()
+{
+  static int done = 0;
+
+  if (!done) {
+    std_log.file = stderr;
+    done = 1;
+  }
+}
+
+/*
+ *
+ */
+void
+krb_set_warnfn (krb_warnfn_t newfunc)
+{
+    init_std_log ();
+    std_log.func =  newfunc;
+}
+
+/*
+ *
+ */
+krb_warnfn_t
+krb_get_warnfn (void)
+{
+    init_std_log ();
+    return std_log.func;
+}
+
+/*
+ * Log warnings to stderr if it's a tty.
+ */
+void
+krb_warning (const char *format, ...)
+{
+    va_list args;
+    
+    init_std_log ();
+    va_start(args, format);
+    krb_vlogger(&std_log, format, args);
+    va_end(args);
+}
+
+/* ------------------------------------------------------------
+   Compatibility functions from klog.c and log.c
+   ------------------------------------------------------------ */
+
+/*
+ * Used by kerberos and kadmind daemons and in libkrb (rd_req.c).
+ *
+ * By default they log to the kerberos server log-file (KRBLOG) to be
+ * backwards compatible.
+ */
+
+static int
+log_with_timestamp_and_nl(FILE *file, const char *format, va_list args)
+{
+    time_t now;
+    if(file == NULL)
+	return KFAILURE;
+    time(&now);
+    fputs(krb_stime(&now), file);
+    fputs(": ", file);
+    vfprintf(file, format, args);
+    fputs("\n", file);
+    fflush(file);
+    return KSUCCESS;
+}
+
+static struct krb_log_facility
+file_log = { KRBLOG, NULL, log_with_timestamp_and_nl };
+
+/*
+ * kset_logfile() changes the name of the file to which
+ * messages are logged.  If kset_logfile() is not called,
+ * the logfile defaults to KRBLOG, defined in "krb.h".
+ */
+
+void
+kset_logfile(char *filename)
+{
+    krb_openlog(&file_log, filename, NULL, log_with_timestamp_and_nl);
+}
+
+/*
+ * krb_log() and klog() is used to add entries to the logfile.
+ *
+ * The log entry consists of a timestamp and the given arguments
+ * printed according to the given "format" string.
+ *
+ * The log file is opened and closed for each log entry.
+ *
+ * If the given log type "type" is unknown, or if the log file
+ * cannot be opened, no entry is made to the log file.
+ *
+ * CHANGE: the type is always ignored
+ *
+ * The return value of klog() is always a pointer to the formatted log
+ * text string "logtxt".
+ */
+
+/* Used in kerberos.c only. */
+char *
+klog(int type, const char *format, ...)
+{
+    static char logtxt[1024];
+
+    va_list ap;
+
+    va_start(ap, format);
+    vsnprintf(logtxt, sizeof(logtxt), format, ap);
+    va_end(ap);
+    
+    krb_logger(&file_log, "%s", logtxt);
+    
+    return logtxt;
+}
+
+/* Used in kadmind and rd_req.c */
+void
+krb_log(const char *format, ...)
+{
+    va_list args;
+
+    va_start(args, format);
+    krb_vlogger(&file_log, format, args);
+    va_end(args);
+}
diff --git a/kerberosIV/krb/lsb_addr_comp.c b/kerberosIV/krb/lsb_addr_comp.c
new file mode 100644
index 00000000000..6e1c11fed0b
--- /dev/null
+++ b/kerberosIV/krb/lsb_addr_comp.c
@@ -0,0 +1,105 @@
+/* $KTH: lsb_addr_comp.c,v 1.9 1997/04/01 08:18:37 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+#include "lsb_addr_comp.h"
+
+int
+krb_lsb_antinet_ulong_cmp(u_int32_t x, u_int32_t y)
+{
+    int i;
+    u_int32_t a = 0, b = 0;
+    u_int8_t *p = (u_int8_t*) &x;
+    u_int8_t *q = (u_int8_t*) &y;
+
+    for(i = sizeof(u_int32_t) - 1; i >= 0; i--){
+	a = (a << 8) | p[i];
+	b = (b << 8) | q[i];
+    }
+    if(a > b)
+	return 1;
+    if(a < b)
+	return -1;
+    return 0;
+}
+
+int
+krb_lsb_antinet_ushort_cmp(u_int16_t x, u_int16_t y)
+{
+    int i;
+    u_int16_t a = 0, b = 0;
+    u_int8_t *p = (u_int8_t*) &x;
+    u_int8_t *q = (u_int8_t*) &y;
+
+    for(i = sizeof(u_int16_t) - 1; i >= 0; i--){
+	a = (a << 8) | p[i];
+	b = (b << 8) | q[i];
+    }
+    if(a > b)
+	return 1;
+    if(a < b)
+	return -1;
+    return 0;
+}
+
+u_int32_t
+lsb_time(time_t t, struct sockaddr_in *src, struct sockaddr_in *dst)
+{
+    /*
+     * direction bit is the sign bit of the timestamp.  Ok until
+     * 2038??
+     */
+    /* For compatibility with broken old code, compares are done in VAX 
+       byte order (LSBFIRST) */ 
+    if (krb_lsb_antinet_ulong_less(src->sin_addr.s_addr, /* src < recv */ 
+				   dst->sin_addr.s_addr) < 0) 
+        t = -t;
+    else if (krb_lsb_antinet_ulong_less(src->sin_addr.s_addr, 
+					dst->sin_addr.s_addr)==0) 
+        if (krb_lsb_antinet_ushort_less(src->sin_port, dst->sin_port) < 0)
+            t = -t;
+    /*
+     * all that for one tiny bit!  Heaven help those that talk to
+     * themselves.
+     */
+    t = t & 0xffffffff;
+    return t;
+}
diff --git a/kerberosIV/krb/lsb_addr_comp.h b/kerberosIV/krb/lsb_addr_comp.h
index 75a517de9cb..6fc76946816 100644
--- a/kerberosIV/krb/lsb_addr_comp.h
+++ b/kerberosIV/krb/lsb_addr_comp.h
@@ -1,25 +1,11 @@
-/*
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/lsb_addr_comp.h,v $
- */
+/* $KTH: lsb_addr_comp.h,v 1.6 1996/10/05 00:18:02 joda Exp $ */
 
 /*
- * Copyright 1987, 1988 by the Student Information Processing Board
- *	of the Massachusetts Institute of Technology
+ * Copyright 1988 by the Massachusetts Institute of Technology.
+ *
+ * For copying and distribution information, please see the file
+ * <mit-copyright.h>.
  *
- * Permission to use, copy, modify, and distribute this software
- * and its documentation for any purpose and without fee is
- * hereby granted, provided that the above copyright notice
- * appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation,
- * and that the names of M.I.T. and the M.I.T. S.I.P.B. not be
- * used in advertising or publicity pertaining to distribution
- * of the software without specific, written prior permission.
- * M.I.T. and the M.I.T. S.I.P.B. make no representations about
- * the suitability of this software for any purpose.  It is
- * provided "as is" without express or implied warranty.
- */
-
-/*
  * Comparison macros to emulate LSBFIRST comparison results of network
  * byte-order quantities
  */
@@ -27,28 +13,14 @@
 #ifndef LSB_ADDR_COMP_DEFS
 #define LSB_ADDR_COMP_DEFS
 
-#if BYTE_ORDER == BIG_ENDIAN
-
-#define u_char_comp(x,y) \
-        (((x)>(y))?(1):(((x)==(y))?(0):(-1)))
-/* This is gross, but... */
-#define lsb_net_ulong_less(x, y) long_less_than((u_char *)&x, (u_char *)&y)
-#define lsb_net_ushort_less(x, y) short_less_than((u_char *)&x, (u_char *)&y)
-
-#define long_less_than(x,y) \
-        (u_char_comp((x)[3],(y)[3])?u_char_comp((x)[3],(y)[3]): \
-	 (u_char_comp((x)[2],(y)[2])?u_char_comp((x)[2],(y)[2]): \
-	  (u_char_comp((x)[1],(y)[1])?u_char_comp((x)[1],(y)[1]): \
-	   (u_char_comp((x)[0],(y)[0])))))
-#define short_less_than(x,y) \
-	  (u_char_comp((x)[1],(y)[1])?u_char_comp((x)[1],(y)[1]): \
-	   (u_char_comp((x)[0],(y)[0])))
+/* Compare x and y in VAX byte order, result is -1, 0 or 1. */
 
-#else /* !WORDS_BIGENDIAN */
+#define krb_lsb_antinet_ulong_less(x, y) (((x) == (y)) ? 0 :  krb_lsb_antinet_ulong_cmp(x, y))
 
-#define lsb_net_ulong_less(x,y) ((x < y) ? -1 : ((x > y) ? 1 : 0))
-#define lsb_net_ushort_less(x,y) ((x < y) ? -1 : ((x > y) ? 1 : 0))
+#define krb_lsb_antinet_ushort_less(x, y) (((x) == (y)) ? 0 : krb_lsb_antinet_ushort_cmp(x, y))
 
-#endif /* !WORDS_BIGENDIAN */
+int krb_lsb_antinet_ulong_cmp(u_int32_t x, u_int32_t y);
+int krb_lsb_antinet_ushort_cmp(u_int16_t x, u_int16_t y);
+u_int32_t lsb_time(time_t t, struct sockaddr_in *src, struct sockaddr_in *dst);
 
 #endif /*  LSB_ADDR_COMP_DEFS */
diff --git a/kerberosIV/krb/mk_auth.c b/kerberosIV/krb/mk_auth.c
new file mode 100644
index 00000000000..343f05acc80
--- /dev/null
+++ b/kerberosIV/krb/mk_auth.c
@@ -0,0 +1,96 @@
+/* $KTH: mk_auth.c,v 1.4 1997/04/01 08:18:35 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+/*
+ * Generate an authenticator for service.instance@realm.
+ * instance is canonicalized by `krb_get_phost'
+ * realm is set to the local realm if realm == NULL
+ * The ticket acquired by `krb_mk_req' is returned in `ticket' and the
+ * authenticator in `buf'.  
+ * Options control the behaviour (see krb_sendauth).
+ */
+
+int
+krb_mk_auth(int32_t options,
+	    KTEXT ticket,
+	    char *service,
+	    char *instance,
+	    char *realm,
+	    u_int32_t checksum,
+	    char *version,
+	    KTEXT buf)
+{
+  char realinst[INST_SZ];
+  char realrealm[REALM_SZ];
+  int ret;
+  unsigned char *p;
+
+  if (options & KOPT_DONT_CANON)
+    strncpy(realinst, instance, sizeof(realinst));
+  else
+    strncpy(realinst, krb_get_phost (instance), sizeof(realinst));
+
+  if (realm == NULL) {
+    ret = krb_get_lrealm (realrealm, 1);
+    if (ret != KSUCCESS)
+      return ret;
+    realm = realrealm;
+  }
+  
+  if(!(options & KOPT_DONT_MK_REQ)) {
+    ret = krb_mk_req (ticket, service, realinst, realm, checksum);
+    if (ret != KSUCCESS)
+      return ret;
+  }
+    
+  p = buf->dat;
+
+  memcpy (p, KRB_SENDAUTH_VERS, KRB_SENDAUTH_VLEN);
+  p += KRB_SENDAUTH_VLEN;
+  memcpy (p, version, KRB_SENDAUTH_VLEN);
+  p += KRB_SENDAUTH_VLEN;
+  p += krb_put_int(ticket->length, p, 4);
+  memcpy(p, ticket->dat, ticket->length);
+  p += ticket->length;
+  buf->length = p - buf->dat;
+  return KSUCCESS;
+}
diff --git a/kerberosIV/krb/mk_err.c b/kerberosIV/krb/mk_err.c
index 4c37a83430a..1a28e4d178a 100644
--- a/kerberosIV/krb/mk_err.c
+++ b/kerberosIV/krb/mk_err.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/mk_err.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: mk_err.c,v 1.6 1997/03/23 03:53:14 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,8 +23,6 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/types.h>
-
 /*
  * This routine creates a general purpose error reply message.  It
  * doesn't use KTEXT because application protocol may have long
@@ -52,26 +44,13 @@ or implied warranty.
  */
 
 int32_t
-krb_mk_err(p, e, e_string)
-	u_char *p;		/* Where to build error packet */
-	int32_t e;		/* Error code */
-	char *e_string;		/* Text of error */
+krb_mk_err(u_char *p, int32_t e, char *e_string)
 {
-    u_char      *start;
-
-    start = p;
-
-    /* Create fixed part of packet */
-    *p++ = (unsigned char) KRB_PROT_VERSION;
-    *p = (unsigned char) AUTH_MSG_APPL_ERR;
-    *p++ |= HOST_BYTE_ORDER;
-
-    /* Add the basic info */
-    bcopy((char *)&e,(char *)p,4); /* err code */
-    p += sizeof(e);
-    (void) strcpy((char *)p,e_string); /* err text */
-    p += strlen(e_string);
-
-    /* And return the length */
-    return p-start;
+    unsigned char *start = p;
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_APPL_ERR, p, 1);
+    
+    p += krb_put_int(e, p, 4);
+    p += krb_put_string(e_string, p);
+    return p - start;
 }
diff --git a/kerberosIV/krb/mk_priv.c b/kerberosIV/krb/mk_priv.c
index b591bc6f59a..6075f361b1f 100644
--- a/kerberosIV/krb/mk_priv.c
+++ b/kerberosIV/krb/mk_priv.c
@@ -1,76 +1,61 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/mk_priv.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: mk_priv.c,v 1.18 1997/04/01 08:18:37 joda Exp $ */
 
 /*
- * This routine constructs a Kerberos 'private msg', i.e.
- * cryptographically sealed with a private session key.
- *
- * Note-- bcopy is used to avoid alignment problems on IBM RT.
- *
- * Note-- It's too bad that it did a long int compare on the RT before.
- *
- * Returns either < 0 ===> error, or resulting size of message
- *
- * Steve Miller    Project Athena  MIT/DEC
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-
 /* application include files */
 #include "lsb_addr_comp.h"
 
-/* static storage */
-static u_int32_t c_length;
-static struct timeval msg_time;
-static u_char msg_time_5ms;
-static int32_t msg_time_sec;
-
 /*
  * krb_mk_priv() constructs an AUTH_MSG_PRIVATE message.  It takes
  * some user data "in" of "length" bytes and creates a packet in "out"
  * consisting of the user data, a timestamp, and the sender's network
  * address.
-#ifndef NOENCRYTION
  * The packet is encrypted by pcbc_encrypt(), using the given
  * "key" and "schedule".
-#endif
  * The length of the resulting packet "out" is
  * returned.
  *
  * It is similar to krb_mk_safe() except for the additional key
  * schedule argument "schedule" and the fact that the data is encrypted
- * rather than appended with a checksum.  Also, the protocol version
- * number is "private_msg_ver", defined in krb_rd_priv.c, rather than
+ * rather than appended with a checksum.  The protocol version is
  * KRB_PROT_VERSION, defined in "krb.h".
  *
  * The "out" packet consists of:
@@ -78,14 +63,12 @@ static int32_t msg_time_sec;
  * Size			Variable		Field
  * ----			--------		-----
  *
- * 1 byte		private_msg_ver		protocol version number
+ * 1 byte		KRB_PROT_VERSION	protocol version number
  * 1 byte		AUTH_MSG_PRIVATE |	message type plus local
  *			HOST_BYTE_ORDER		byte order in low bit
  *
  * 4 bytes		c_length		length of data
-#ifndef NOENCRYPT
  * we encrypt from here with pcbc_encrypt
-#endif
  * 
  * 4 bytes		length			length of user data
  * length		in			user data
@@ -99,111 +82,44 @@ static int32_t msg_time_sec;
  */
 
 int32_t
-krb_mk_priv(in, out, length, schedule, key, sender, receiver)
-	u_char *in;		/* application data */
-	u_char *out;		/* put msg here, leave room for
-                                 * header! breaks if in and out
-                                 * (header stuff) overlap */
-	u_int32_t length;	/* of in data */
-	struct des_ks_struct *schedule;	/* precomputed key schedule */
-	des_cblock *key;	/* encryption key for seed and ivec */
-	struct sockaddr_in *sender; /* sender address */
-	struct sockaddr_in *receiver; /* receiver address */
+krb_mk_priv(void *in, void *out, u_int32_t length, 
+	    struct des_ks_struct *schedule, des_cblock *key, 
+	    struct sockaddr_in *sender, struct sockaddr_in *receiver)
 {
-    register u_char     *p,*q;
-    static       u_char *c_length_ptr;
-
-    /*
-     * get the current time to use instead of a sequence #, since
-     * process lifetime may be shorter than the lifetime of a session
-     * key.
-     */
-    if (gettimeofday(&msg_time,(struct timezone *)0)) {
-        return -1;
-    }
-    msg_time_sec = (int32_t) msg_time.tv_sec;
-    msg_time_5ms = msg_time.tv_usec/5000; /* 5ms quanta */
+    unsigned char *p = (unsigned char*)out;
+    unsigned char *cipher;
 
-    p = out;
+    struct timeval tv;
+    u_int32_t src_addr;
+    u_int32_t len;
 
-    *p++ = private_msg_ver;
-    *p++ = AUTH_MSG_PRIVATE | HOST_BYTE_ORDER;
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_PRIVATE, p, 1);
 
-    /* calculate cipher length */
-    c_length_ptr = p;
-    p += sizeof(c_length);
+    len = 4 + length + 1 + 4 + 4;
+    len = (len + 7) & ~7;
+    p += krb_put_int(len, p, 4);
+    
+    cipher = p;
 
-    q = p;
-
-    /* stuff input length */
-    bcopy((char *)&length,(char *)p,sizeof(length));
-    p += sizeof(length);
-
-#ifdef NOENCRYPTION
-    /* make all the stuff contiguous for checksum */
-#else
-    /* make all the stuff contiguous for checksum and encryption */
-#endif
-    bcopy((char *)in,(char *)p,(int) length);
+    p += krb_put_int(length, p, 4);
+    
+    memcpy(p, in, length);
     p += length;
+    
+    gettimeofday(&tv, NULL);
 
-    /* stuff time 5ms */
-    bcopy((char *)&msg_time_5ms,(char *)p,sizeof(msg_time_5ms));
-    p += sizeof(msg_time_5ms);
-
-    /* stuff source address */
-    bcopy((char *)&sender->sin_addr.s_addr,(char *)p,
-          sizeof(sender->sin_addr.s_addr));
-    p += sizeof(sender->sin_addr.s_addr);
-
-    /*
-     * direction bit is the sign bit of the timestamp.  Ok
-     * until 2038??
-     */
-    /* For compatibility with broken old code, compares are done in VAX 
-       byte order (LSBFIRST) */ 
-    if (lsb_net_ulong_less(sender->sin_addr.s_addr, /* src < recv */ 
-			  receiver->sin_addr.s_addr)==-1) 
-        msg_time_sec =  -msg_time_sec; 
-    else if (lsb_net_ulong_less(sender->sin_addr.s_addr, 
-				receiver->sin_addr.s_addr)==0) 
-        if (lsb_net_ushort_less(sender->sin_port,receiver->sin_port) == -1) 
-            msg_time_sec = -msg_time_sec; 
-    /* stuff time sec */
-    bcopy((char *)&msg_time_sec,(char *)p,sizeof(msg_time_sec));
-    p += sizeof(msg_time_sec);
-
-    /*
-     * All that for one tiny bit!  Heaven help those that talk to
-     * themselves.
-     */
-
-#ifdef notdef
-    /*
-     * calculate the checksum of the length, address, sequence, and
-     * inp data
-     */
-    cksum =  des_quad_cksum(q,NULL,p-q,0,key);
-    if (krb_debug)
-        printf("\ncksum = %u",cksum);
-    /* stuff checksum */
-    bcopy((char *) &cksum,(char *) p,sizeof(cksum));
-    p += sizeof(cksum);
-#endif
-
-    /*
-     * All the data have been assembled, compute length
-     */
+    *p++ =tv.tv_usec / 5000;
+    
+    src_addr = sender->sin_addr.s_addr;
+    p += krb_put_address(src_addr, p);
 
-    c_length = p - q;
-    c_length = ((c_length + sizeof(des_cblock) -1)/sizeof(des_cblock)) *
-        sizeof(des_cblock);
-    /* stuff the length */
-    bcopy((char *) &c_length,(char *)c_length_ptr,sizeof(c_length));
+    p += krb_put_int(lsb_time(tv.tv_sec, sender, receiver), p, 4);
+    
+    memset(p, 0, 7);
 
-#ifndef NOENCRYPTION
-    des_pcbc_encrypt((des_cblock *)q,(des_cblock *)q,(long)(p-q),schedule,key, DES_ENCRYPT);
-#endif /* NOENCRYPTION */
+    des_pcbc_encrypt((des_cblock *)cipher, (des_cblock *)cipher,
+		     len, schedule, key, DES_ENCRYPT);
 
-    return (q - out + c_length);        /* resulting size */
+    return  (cipher - (unsigned char*)out) + len;
 }
diff --git a/kerberosIV/krb/mk_req.c b/kerberosIV/krb/mk_req.c
index f8c4afe38fd..7219fa957ff 100644
--- a/kerberosIV/krb/mk_req.c
+++ b/kerberosIV/krb/mk_req.c
@@ -1,39 +1,72 @@
+/* $KTH: mk_req.c,v 1.17 1997/05/30 17:42:38 bg Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/mk_req.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
-#include <sys/time.h>
-
-static struct   timeval tv_local = { 0, 0 };
 static int lifetime = 255;	/* But no longer than TGT says. */
 
+
+static void
+build_request(KTEXT req, char *name, char *inst, char *realm, 
+	      u_int32_t checksum)
+{
+    struct timeval tv;
+    unsigned char *p = req->dat;
+    
+    p += krb_put_nir(name, inst, realm, p);
+    
+    p += krb_put_int(checksum, p, 4);
+
+
+    /* Fill in the times on the request id */
+    gettimeofday(&tv, NULL);
+
+    *p++ = tv.tv_usec / 5000; /* 5ms */
+    
+    p += krb_put_int(tv.tv_sec, p, 4);
+
+    /* Fill to a multiple of 8 bytes for DES */
+    req->length = ((p - req->dat + 7)/8) * 8;
+}
+
+
 /*
  * krb_mk_req takes a text structure in which an authenticator is to
  * be built, the name of a service, an instance, a realm,
@@ -79,114 +112,90 @@ static int lifetime = 255;	/* But no longer than TGT says. */
  */
 
 int
-krb_mk_req(authent, service, instance, realm, checksum)
-	register KTEXT authent;	/* Place to build the authenticator */
-	char *service;		/* Name of the service */
-	char *instance;		/* Service instance */
-	char *realm;		/* Authentication domain of service */
-	int32_t checksum;	/* Checksum of data (optional) */
+krb_mk_req(KTEXT authent, char *service, char *instance, char *realm, 
+	   int32_t checksum)
 {
-    static KTEXT_ST req_st; /* Temp storage for req id */
-    register KTEXT req_id = &req_st;
-    unsigned char *v = authent->dat; /* Prot version number */
-    unsigned char *t = (authent->dat+1); /* Message type */
-    unsigned char *kv = (authent->dat+2); /* Key version no */
-    unsigned char *tl = (authent->dat+4+strlen(realm)); /* Tkt len */
-    unsigned char *idl = (authent->dat+5+strlen(realm)); /* Reqid len */
+    KTEXT_ST req_st;
+    KTEXT req_id = &req_st;
+
     CREDENTIALS cr;             /* Credentials used by retr */
-    register KTEXT ticket = &(cr.ticket_st); /* Pointer to tkt_st */
+    KTEXT ticket = &(cr.ticket_st); /* Pointer to tkt_st */
     int retval;                 /* Returned by krb_get_cred */
-    static des_key_schedule key_s;
+
     char myrealm[REALM_SZ];
 
-    /* The fixed parts of the authenticator */
-    *v = (unsigned char) KRB_PROT_VERSION;
-    *t = (unsigned char) AUTH_MSG_APPL_REQUEST;
-    *t |= HOST_BYTE_ORDER;
+    unsigned char *p = authent->dat;
 
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    
+    p += krb_put_int(AUTH_MSG_APPL_REQUEST, p, 1);
+    
     /* Get the ticket and move it into the authenticator */
     if (krb_ap_req_debug)
-        printf("Realm: %s\n",realm);
-    /* 
-     * Determine realm of these tickets.  We will send this to the
-     * KDC from which we are requesting tickets so it knows what to
-     * with our session key.
-     */
-    if ((retval = krb_get_tf_realm(TKT_FILE, myrealm)) != KSUCCESS)
-	return(retval);
-    
+        krb_warning("Realm: %s\n", realm);
+
     retval = krb_get_cred(service,instance,realm,&cr);
 
     if (retval == RET_NOTKT) {
-        if ((retval = get_ad_tkt(service,instance,realm,lifetime)))
-            return(retval);
-        if ((retval = krb_get_cred(service,instance,realm,&cr)))
-            return(retval);
+	retval = get_ad_tkt(service, instance, realm, lifetime);
+	if (retval == KSUCCESS)
+	    retval = krb_get_cred(service, instance, realm, &cr);
     }
 
-    if (retval != KSUCCESS) return (retval);
+    if (retval != KSUCCESS)
+	return retval;
 
+
+    /*
+     * With multi realm ticket files either find a matching TGT or
+     * else use the first TGT for inter-realm authentication.
+     *
+     * In myrealm hold the realm of the principal "owning" the
+     * corresponding ticket-granting-ticket.
+     */
+
+    retval = krb_get_cred(KRB_TICKET_GRANTING_TICKET, realm, realm, 0);
+    if (retval == KSUCCESS)
+      strncpy(myrealm, realm, REALM_SZ);
+    else
+      retval = krb_get_tf_realm(TKT_FILE, myrealm);
+    
+    if (retval != KSUCCESS)
+	return retval;
+    
     if (krb_ap_req_debug)
-        printf("%s %s %s %s %s\n", service, instance, realm,
-               cr.pname, cr.pinst);
-    *kv = (unsigned char) cr.kvno;
-    (void) strcpy((char *)(authent->dat+3),realm);
-    *tl = (unsigned char) ticket->length;
-    bcopy((char *)(ticket->dat),(char *)(authent->dat+6+strlen(realm)),
-          ticket->length);
-    authent->length = 6 + strlen(realm) + ticket->length;
-    if (krb_ap_req_debug)
-        printf("Ticket->length = %d\n",ticket->length);
-    if (krb_ap_req_debug)
-        printf("Issue date: %d\n",cr.issue_date);
-
-    /* Build request id */
-    (void) strcpy((char *)(req_id->dat),cr.pname); /* Auth name */
-    req_id->length = strlen(cr.pname)+1;
-    /* Principal's instance */
-    (void) strcpy((char *)(req_id->dat+req_id->length),cr.pinst);
-    req_id->length += strlen(cr.pinst)+1;
-    /* Authentication domain */
-    (void) strcpy((char *)(req_id->dat+req_id->length),myrealm);
-    req_id->length += strlen(myrealm)+1;
-    /* Checksum */
-    bcopy((char *)&checksum,(char *)(req_id->dat+req_id->length),4);
-    req_id->length += 4;
+        krb_warning("serv=%s.%s@%s princ=%s.%s@%s\n", service, instance, realm,
+		    cr.pname, cr.pinst, myrealm);
 
-    /* Fill in the times on the request id */
-    (void) gettimeofday(&tv_local,(struct timezone *) 0);
-    *(req_id->dat+(req_id->length)++) =
-        (unsigned char) tv_local.tv_usec;
-    /* Time (coarse) */
-    bcopy((char *)&(tv_local.tv_sec),
-          (char *)(req_id->dat+req_id->length), 4);
-    req_id->length += 4;
+    p += krb_put_int(cr.kvno, p, 1);
 
-    /* Fill to a multiple of 8 bytes for DES */
-    req_id->length = ((req_id->length+7)/8)*8;
-
-#ifndef NOENCRYPTION
-    des_key_sched(&cr.session,key_s);
-    des_pcbc_encrypt((des_cblock *)req_id->dat,(des_cblock *)req_id->dat,
-	(long)req_id->length,key_s,&cr.session, DES_ENCRYPT);
-    bzero((char *) key_s, sizeof(key_s));
-#endif /* NOENCRYPTION */
-
-    /* Copy it into the authenticator */
-    bcopy((char *)(req_id->dat),(char *)(authent->dat+authent->length),
-          req_id->length);
-    authent->length += req_id->length;
-    /* And set the id length */
-    *idl = (unsigned char) req_id->length;
-    /* clean up */
-    bzero((char *)req_id, sizeof(*req_id));
+    p += krb_put_string(realm, p);
+
+    p += krb_put_int(ticket->length, p, 1);
+
+    build_request(req_id, cr.pname, cr.pinst, myrealm, checksum);
+    
+    encrypt_ktext(req_id, &cr.session, DES_ENCRYPT);
+
+    p += krb_put_int(req_id->length, p, 1);
+
+    memcpy(p, ticket->dat, ticket->length);
+    
+    p += ticket->length;
+    
+    memcpy(p, req_id->dat, req_id->length);
+    
+    p += req_id->length;
+
+    authent->length = p - authent->dat;
+    
+    memset(&cr, 0, sizeof(cr));
+    memset(&req_st, 0, sizeof(req_st));
 
     if (krb_ap_req_debug)
-        printf("Authent->length = %d\n",authent->length);
-    if (krb_ap_req_debug)
-        printf("idl = %d, tl = %d\n",(int) *idl, (int) *tl);
+        krb_warning("Authent->length = %d\n", authent->length);
 
-    return(KSUCCESS);
+    return KSUCCESS;
 }
 
 /* 
@@ -197,8 +206,7 @@ krb_mk_req(authent, service, instance, realm, checksum)
  */
 
 int
-krb_set_lifetime(newval)
-	int newval;
+krb_set_lifetime(int newval)
 {
     int olife = lifetime;
 
diff --git a/kerberosIV/krb/mk_safe.c b/kerberosIV/krb/mk_safe.c
index 3ee06da4930..1f2abc91244 100644
--- a/kerberosIV/krb/mk_safe.c
+++ b/kerberosIV/krb/mk_safe.c
@@ -1,60 +1,52 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/mk_safe.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: mk_safe.c,v 1.21 1997/04/19 23:18:03 joda Exp $ */
 
 /*
- * This routine constructs a Kerberos 'safe msg', i.e. authenticated
- * using a private session key to seed a checksum. Msg is NOT
- * encrypted.
- *
- *      Note-- bcopy is used to avoid alignment problems on IBM RT
- *
- *      Returns either <0 ===> error, or resulting size of message
- *
- * Steve Miller    Project Athena  MIT/DEC
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-/* system include files */
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-
 /* application include files */
 #include "lsb_addr_comp.h"
 
-/* static storage */
-static u_int32_t cksum;
-static des_cblock big_cksum[2];
-static struct timeval msg_time;
-static u_char msg_time_5ms;
-static int32_t msg_time_sec;
+
+/* from rd_safe.c */
+extern int dqc_type;
+void fixup_quad_cksum(void*, size_t, des_cblock*, void*, void*, int);
 
 /*
  * krb_mk_safe() constructs an AUTH_MSG_SAFE message.  It takes some
@@ -89,89 +81,51 @@ static int32_t msg_time_sec;
  */
 
 int32_t
-krb_mk_safe(in, out, length, key, sender, receiver)
-	u_char *in;		/* application data */
-	u_char *out;		/*
-				 * put msg here, leave room for header!
-				 * breaks if in and out (header stuff)
-				 * overlap
-				 */
-	u_int32_t length;	/* of in data */
-	des_cblock *key;	/* encryption key for seed and ivec */
-	struct sockaddr_in *sender; /* sender address */
-	struct sockaddr_in *receiver; /* receiver address */
+krb_mk_safe(void *in, void *out, u_int32_t length, des_cblock *key, 
+	    struct sockaddr_in *sender, struct sockaddr_in *receiver)
 {
-    register u_char     *p,*q;
+    unsigned char * p = (unsigned char*)out;
+    struct timeval tv;
+    unsigned char *start;
+    u_int32_t src_addr;
 
-    /*
-     * get the current time to use instead of a sequence #, since
-     * process lifetime may be shorter than the lifetime of a session
-     * key.
-     */
-    if (gettimeofday(&msg_time,(struct timezone *)0)) {
-        return  -1;
-    }
-    msg_time_sec = (int32_t) msg_time.tv_sec;
-    msg_time_5ms = msg_time.tv_usec/5000; /* 5ms quanta */
-
-    p = out;
+    p += krb_put_int(KRB_PROT_VERSION, p, 1);
+    p += krb_put_int(AUTH_MSG_SAFE, p, 1);
+    
+    start = p;
 
-    *p++ = KRB_PROT_VERSION;
-    *p++ = AUTH_MSG_SAFE | HOST_BYTE_ORDER;
+    p += krb_put_int(length, p, 4);
 
-    q = p;			/* start for checksum stuff */
-    /* stuff input length */
-    bcopy((char *)&length,(char *)p,sizeof(length));
-    p += sizeof(length);
-
-    /* make all the stuff contiguous for checksum */
-    bcopy((char *)in,(char *)p,(int) length);
+    memcpy(p, in, length);
     p += length;
+    
+    gettimeofday(&tv, NULL);
+
+    *p++ = tv.tv_usec/5000; /* 5ms */
+    
+    src_addr = sender->sin_addr.s_addr;
+    p += krb_put_address(src_addr, p);
+
+    p += krb_put_int(lsb_time(tv.tv_sec, sender, receiver), p, 4);
+
+    {
+	/* We are faking big endian mode, so we need to fix the
+	 * checksum (that is byte order dependent). We always send a
+	 * checksum of the new type, unless we know that we are
+	 * talking to an old client (this requires a call to
+	 * krb_rd_safe first).  
+	 */
+	unsigned char new_checksum[16];
+	unsigned char old_checksum[16];
+	fixup_quad_cksum(start, p - start, key, new_checksum, old_checksum, 0);
+	
+	if((dqc_type == DES_QUAD_GUESS && DES_QUAD_DEFAULT == DES_QUAD_OLD) || 
+	   dqc_type == DES_QUAD_OLD)
+	    memcpy(p, old_checksum, 16);
+	else
+	    memcpy(p, new_checksum, 16);
+    }
+    p += 16;
 
-    /* stuff time 5ms */
-    bcopy((char *)&msg_time_5ms,(char *)p,sizeof(msg_time_5ms));
-    p += sizeof(msg_time_5ms);
-
-    /* stuff source address */
-    bcopy((char *) &sender->sin_addr.s_addr,(char *)p,
-          sizeof(sender->sin_addr.s_addr));
-    p += sizeof(sender->sin_addr.s_addr);
-
-    /*
-     * direction bit is the sign bit of the timestamp.  Ok until
-     * 2038??
-     */
-    /* For compatibility with broken old code, compares are done in VAX 
-       byte order (LSBFIRST) */ 
-    if (lsb_net_ulong_less(sender->sin_addr.s_addr, /* src < recv */ 
-			  receiver->sin_addr.s_addr)==-1) 
-        msg_time_sec =  -msg_time_sec; 
-    else if (lsb_net_ulong_less(sender->sin_addr.s_addr, 
-				receiver->sin_addr.s_addr)==0) 
-        if (lsb_net_ushort_less(sender->sin_port,receiver->sin_port) == -1) 
-            msg_time_sec = -msg_time_sec; 
-    /*
-     * all that for one tiny bit!  Heaven help those that talk to
-     * themselves.
-     */
-
-    /* stuff time sec */
-    bcopy((char *)&msg_time_sec,(char *)p,sizeof(msg_time_sec));
-    p += sizeof(msg_time_sec);
-
-#ifdef NOENCRYPTION
-    cksum = 0;
-    bzero(big_cksum, sizeof(big_cksum));
-#else
-    cksum = des_quad_cksum((des_cblock *)q,big_cksum,p-q,2,key);
-#endif
-    if (krb_debug)
-        printf("\ncksum = %u",(u_int) cksum);
-
-    /* stuff checksum */
-    bcopy((char *)big_cksum,(char *)p,sizeof(big_cksum));
-    p += sizeof(big_cksum);
-
-    return ((int32_t)(p - out));	/* resulting size */
-
+    return p - (unsigned char*)out;
 }
diff --git a/kerberosIV/krb/month_sname.c b/kerberosIV/krb/month_sname.c
index 885809a6603..32542c27501 100644
--- a/kerberosIV/krb/month_sname.c
+++ b/kerberosIV/krb/month_sname.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/month_sname.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: month_sname.c,v 1.5 1997/03/23 03:53:14 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -35,11 +29,9 @@ or implied warranty.
  * month.  Returns 0 if the argument is out of range.
  */
 
-char *
-month_sname(n)
-	int n;
+const char *month_sname(int n)
 {
-    static char *name[] = {
+    static const char *name[] = {
         "Jan","Feb","Mar","Apr","May","Jun",
         "Jul","Aug","Sep","Oct","Nov","Dec"
     };
diff --git a/kerberosIV/krb/name2name.c b/kerberosIV/krb/name2name.c
new file mode 100644
index 00000000000..aa847057353
--- /dev/null
+++ b/kerberosIV/krb/name2name.c
@@ -0,0 +1,102 @@
+/* $KTH: name2name.c,v 1.15 1997/04/30 04:30:36 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+/* convert host to a more fully qualified domain name, returns 0 if
+ * phost is the same as host, 1 otherwise. phost should be
+ * phost_size bytes long.
+ */
+
+int
+krb_name_to_name(const char *host, char *phost, size_t phost_size)
+{
+    struct hostent *hp;
+    struct in_addr adr;
+    const char *tmp;
+    
+    adr.s_addr = inet_addr(host);
+    hp = gethostbyname(host);
+    if (hp == NULL && adr.s_addr != INADDR_NONE)
+	hp = gethostbyaddr((char *)&adr, sizeof(adr), AF_INET);
+    if (hp == NULL)
+	tmp = host;
+    else
+	tmp = hp->h_name;
+    strncpy (phost, tmp, phost_size);
+    phost[phost_size - 1] = '\0';
+
+    if (strcmp(phost, host) == 0)
+	return 0;
+    else
+	return 1;
+}
+
+/* lowercase and truncate */
+
+void
+k_ricercar(char *name)
+{
+    char *p = name;
+    while(*p && *p != '.'){
+	if(isupper(*p))
+	    *p = tolower(*p);
+	p++;
+    }
+    if(*p == '.')
+	*p = 0;
+}
+
+/*
+ * This routine takes an alias for a host name and returns the first
+ * field, in lower case, of its domain name.
+ *
+ * Example: "fOo.BAR.com" -> "foo"
+ */
+
+char *
+krb_get_phost(const char *alias)
+{
+    static char phost[MAXHOSTNAMELEN];
+    
+    krb_name_to_name(alias, phost, sizeof(phost));
+    k_ricercar(phost);
+    return phost;
+}
diff --git a/kerberosIV/krb/netread.c b/kerberosIV/krb/netread.c
index e223b7915ac..0149aba2635 100644
--- a/kerberosIV/krb/netread.c
+++ b/kerberosIV/krb/netread.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/netread.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: netread.c,v 1.7 1997/06/19 23:56:44 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -40,12 +34,10 @@ or implied warranty.
  */
 
 int
-krb_net_read(fd, buf, len)
-	int fd;
-	register char *buf;
-	register int len;
+krb_net_read (int fd, void *v, size_t len)
 {
     int cc, len2 = 0;
+    char *buf = v;
 
     do {
 	cc = read(fd, buf, len);
diff --git a/kerberosIV/krb/netwrite.c b/kerberosIV/krb/netwrite.c
index c95033c0bf2..edd2d80b476 100644
--- a/kerberosIV/krb/netwrite.c
+++ b/kerberosIV/krb/netwrite.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/netwrite.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: netwrite.c,v 1.8 1997/06/19 23:56:25 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -39,13 +33,12 @@ or implied warranty.
  */
 
 int
-krb_net_write(fd, buf, len)
-	int fd;
-	register char *buf;
-	int len;
+krb_net_write(int fd, const void *v, size_t len)
 {
     int cc;
-    register int wrlen = len;
+    int wrlen = len;
+    const char *buf = (const char*)v;
+
     do {
 	cc = write(fd, buf, wrlen);
 	if (cc < 0)
diff --git a/kerberosIV/krb/one.c b/kerberosIV/krb/one.c
index 316d80465f7..d43b2840e08 100644
--- a/kerberosIV/krb/one.c
+++ b/kerberosIV/krb/one.c
@@ -1,11 +1,3 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/one.c,v $
- *
- * $Locker:  $
- */
-
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
 
diff --git a/kerberosIV/krb/parse_name.c b/kerberosIV/krb/parse_name.c
new file mode 100644
index 00000000000..281a3389391
--- /dev/null
+++ b/kerberosIV/krb/parse_name.c
@@ -0,0 +1,199 @@
+/* $KTH: parse_name.c,v 1.4 1997/04/01 08:18:39 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+int
+krb_parse_name(const char *fullname, krb_principal *principal)
+{
+    const char *p;
+    char *ns, *np;
+    enum {n, i, r} pos = n;
+    int quote = 0;
+    ns = np = principal->name;
+
+    principal->name[0] = 0;
+    principal->instance[0] = 0;
+    principal->realm[0] = 0;
+
+    for(p = fullname; *p; p++){
+	if(np - ns == ANAME_SZ - 1) /* XXX they have the same size */
+	    return KNAME_FMT;
+	if(quote){
+	    *np++ = *p;
+	    quote = 0;
+	    continue;
+	}
+	if(*p == '\\')
+	    quote = 1;
+	else if(*p == '.' && pos == n){
+	    *np = 0;
+	    ns = np = principal->instance;
+	    pos = i;
+	}else if(*p == '@' && (pos == n || pos == i)){
+	    *np = 0;
+	    ns = np = principal->realm;
+	    pos = r;
+	}else
+	    *np++ = *p;
+    }
+    *np = 0;
+    if(quote || principal->name[0] == 0)
+	return KNAME_FMT;
+    return KSUCCESS;
+}
+
+int
+kname_parse(char *np, char *ip, char *rp, char *fullname)
+{
+    krb_principal p;
+    int ret;
+    if((ret = krb_parse_name(fullname, &p)) == 0){
+	strcpy(np, p.name);
+	strcpy(ip, p.instance);
+	if(p.realm[0])
+	    strcpy(rp, p.realm);
+    }
+    return ret;
+}
+/*
+ * k_isname() returns 1 if the given name is a syntactically legitimate
+ * Kerberos name; returns 0 if it's not.
+ */
+
+int
+k_isname(char *s)
+{
+    char c;
+    int backslash = 0;
+
+    if (!*s)
+        return 0;
+    if (strlen(s) > ANAME_SZ - 1)
+        return 0;
+    while ((c = *s++)) {
+        if (backslash) {
+            backslash = 0;
+            continue;
+        }
+        switch(c) {
+        case '\\':
+            backslash = 1;
+            break;
+        case '.':
+            return 0;
+            /* break; */
+        case '@':
+            return 0;
+            /* break; */
+        }
+    }
+    return 1;
+}
+
+
+/*
+ * k_isinst() returns 1 if the given name is a syntactically legitimate
+ * Kerberos instance; returns 0 if it's not.
+ */
+
+int
+k_isinst(char *s)
+{
+    char c;
+    int backslash = 0;
+
+    if (strlen(s) > INST_SZ - 1)
+        return 0;
+    while ((c = *s++)) {
+        if (backslash) {
+            backslash = 0;
+            continue;
+        }
+        switch(c) {
+        case '\\':
+            backslash = 1;
+            break;
+        case '.':
+#if     INSTANCE_DOTS_OK
+            break;
+#else   /* INSTANCE_DOTS_OK */
+            return 0; 
+#endif  /* INSTANCE_DOTS_OK */
+            /* break; */
+        case '@':
+            return 0;
+            /* break; */
+        }
+    }
+    return 1;
+}
+
+/*
+ * k_isrealm() returns 1 if the given name is a syntactically legitimate
+ * Kerberos realm; returns 0 if it's not.
+ */
+
+int
+k_isrealm(char *s)
+{
+    char c;
+    int backslash = 0;
+
+    if (!*s)
+        return 0;
+    if (strlen(s) > REALM_SZ - 1)
+        return 0;
+    while ((c = *s++)) {
+        if (backslash) {
+            backslash = 0;
+            continue;
+        }
+        switch(c) {
+        case '\\':
+            backslash = 1;
+            break;
+        case '@':
+            return 0;
+            /* break; */
+        }
+    }
+    return 1;
+}
diff --git a/kerberosIV/krb/pkt_clen.c b/kerberosIV/krb/pkt_clen.c
deleted file mode 100644
index af9d2a12cfa..00000000000
--- a/kerberosIV/krb/pkt_clen.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/pkt_clen.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
-#if defined(horrible_function_using_global_variable_had_to_be_inlined)
-
-#include "krb_locl.h"
-
-/*
- * Given a pointer to an AUTH_MSG_KDC_REPLY packet, return the length of
- * its ciphertext portion.  The external variable "swap_bytes" is assumed
- * to have been set to indicate whether or not the packet is in local
- * byte order.  pkt_clen() takes this into account when reading the
- * ciphertext length out of the packet.
- */
-
-int
-pkt_clen(pkt)
-	KTEXT pkt;
-{
-    static unsigned short temp,temp2;
-    int clen = 0;
-
-    /* Start of ticket list */
-    unsigned char *ptr = pkt_a_realm(pkt) + 10
-	+ strlen((char *)pkt_a_realm(pkt));
-
-    /* Finally the length */
-    bcopy((char *)(++ptr),(char *)&temp,2); /* alignment */
-    if (swap_bytes) {
-        /* assume a short is 2 bytes?? */
-        swab((char *)&temp,(char *)&temp2,2);
-        temp = temp2;
-    }
-
-    clen = (int) temp;
-
-    if (krb_debug)
-	printf("Clen is %d\n",clen);
-    return(clen);
-}
-
-#endif /* defined(horrible_function_using_global_variable_had_to_be_inlined) */
diff --git a/kerberosIV/krb/rd_err.c b/kerberosIV/krb/rd_err.c
index 8b3a26fe8d7..c1024ace9e3 100644
--- a/kerberosIV/krb/rd_err.c
+++ b/kerberosIV/krb/rd_err.c
@@ -1,49 +1,45 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/rd_err.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: rd_err.c,v 1.8 1997/04/01 08:18:40 joda Exp $ */
 
 /*
- * This routine dissects a a Kerberos 'safe msg',
- * checking its integrity, and returning a pointer to the application
- * data contained and its length.
- *
- * Returns 0 (RD_AP_OK) for success or an error code (RD_AP_...)
- *
- * Steve Miller    Project Athena  MIT/DEC
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-/* system include files */
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-
 /*
  * Given an AUTH_MSG_APPL_ERR message, "in" and its length "in_length",
  * return the error code from the message in "code" and the text in
@@ -60,32 +56,27 @@ or implied warranty.
  */
 
 int
-krb_rd_err(in, in_length, code, m_data)
-	u_char *in;		/* pointer to the msg received */
-	u_int32_t in_length;	/* of in msg */
-	int32_t *code;		/* received error code */
-	MSG_DAT *m_data;
+krb_rd_err(u_char *in, u_int32_t in_length, int32_t *code, MSG_DAT *m_data)
 {
-    register u_char *p;
-    int swap_bytes = 0;
-    p = in;                     /* beginning of message */
-
-    if (*p++ != KRB_PROT_VERSION)
-        return(RD_AP_VERSION);
-    if (((*p) & ~1) != AUTH_MSG_APPL_ERR)
-        return(RD_AP_MSG_TYPE);
-    if ((*p++ & 1) != HOST_BYTE_ORDER)
-        swap_bytes++;
-
-    /* safely get code */
-    bcopy((char *)p,(char *)code,sizeof(*code));
-    if (swap_bytes)
-        swap_u_long(*code);
-    p += sizeof(*code);         /* skip over */
-
-    m_data->app_data = p;       /* we're now at the error text
-                                 * message */
-    m_data->app_length = in_length;
+    unsigned char *p = (unsigned char*)in;
+    
+    unsigned char pvno, type;
+    int little_endian;
 
-    return(RD_AP_OK);           /* OK == 0 */
+    pvno = *p++;
+    if(pvno != KRB_PROT_VERSION)
+	return RD_AP_VERSION;
+    
+    type = *p++;
+    little_endian = type & 1;
+    type &= ~1;
+    
+    if(type != AUTH_MSG_APPL_ERR)
+	return RD_AP_MSG_TYPE;
+    
+    p += krb_get_int(p, (u_int32_t *)&code, 4, little_endian);
+    
+    m_data->app_data = p;
+    m_data->app_length = in_length; /* XXX is this correct? */
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/rd_priv.c b/kerberosIV/krb/rd_priv.c
index be52843cb95..9c8c6327dcf 100644
--- a/kerberosIV/krb/rd_priv.c
+++ b/kerberosIV/krb/rd_priv.c
@@ -1,69 +1,50 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/rd_priv.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: rd_priv.c,v 1.24 1997/05/14 17:53:29 joda Exp $ */
 
 /*
- * This routine dissects a a Kerberos 'private msg', decrypting it,
- * checking its integrity, and returning a pointer to the application
- * data contained and its length.
- *
- * Returns 0 (RD_AP_OK) for success or an error code (RD_AP_...).  If
- * the return value is RD_AP_TIME, then either the times are too far
- * out of synch, OR the packet was modified.
- *
- * Steve Miller    Project Athena  MIT/DEC
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-/* system include files */
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-
 /* application include files */
 #include "lsb_addr_comp.h"
 
-/* static storage */
-static u_int32_t c_length;
-static int swap_bytes;
-static struct timeval local_time;
-static long delta_t;
-
-/* Global! */
-int private_msg_ver = KRB_PROT_VERSION;
-
 /*
-#ifdef NOENCRPYTION
- * krb_rd_priv() checks the integrity of an
-#else
  * krb_rd_priv() decrypts and checks the integrity of an
-#endif
  * AUTH_MSG_PRIVATE message.  Given the message received, "in",
  * the length of that message, "in_length", the key "schedule"
  * and "key", and the network addresses of the
@@ -80,111 +61,62 @@ int private_msg_ver = KRB_PROT_VERSION;
  */
 
 int32_t
-krb_rd_priv(in, in_length, schedule, key, sender, receiver, m_data)
-	u_char *in;		/* pointer to the msg received */
-	u_int32_t in_length;	/* length of "in" msg */
-	struct des_ks_struct *schedule;	/* precomputed key schedule */
-	des_cblock *key;	/* encryption key for seed and ivec */
-	struct sockaddr_in *sender;
-	struct sockaddr_in *receiver;
-	MSG_DAT *m_data;	/*various input/output data from msg */
+krb_rd_priv(void *in, u_int32_t in_length, 
+	    struct des_ks_struct *schedule, des_cblock *key, 
+	    struct sockaddr_in *sender, struct sockaddr_in *receiver, 
+	    MSG_DAT *m_data)
 {
-    register u_char *p,*q;
-    static u_int32_t src_addr;	/* Can't send structs since no
-				 * guarantees on size */
-
-    if (gettimeofday(&local_time,(struct timezone *)0))
-        return  -1;
-
-    p = in;			/* beginning of message */
-    swap_bytes = 0;
-
-    if (*p++ != KRB_PROT_VERSION && *(p-1) != 3)
-        return RD_AP_VERSION;
-    private_msg_ver = *(p-1);
-    if (((*p) & ~1) != AUTH_MSG_PRIVATE)
-        return RD_AP_MSG_TYPE;
-    if ((*p++ & 1) != HOST_BYTE_ORDER)
-        swap_bytes++;
-
-    /* get cipher length */
-    bcopy((char *)p,(char *)&c_length,sizeof(c_length));
-    if (swap_bytes)
-        swap_u_long(c_length);
-    p += sizeof(c_length);
-    /* check for rational length so we don't go comatose */
-    if (VERSION_SZ + MSG_TYPE_SZ + c_length > in_length)
-        return RD_AP_MODIFIED;
-
-
-    q = p;			/* mark start of encrypted stuff */
-
-#ifndef NOENCRYPTION
-    des_pcbc_encrypt((des_cblock *)q,(des_cblock *)q,(long)c_length,schedule,key,DES_DECRYPT);
-#endif
-
-    /* safely get application data length */
-    bcopy((char *) p,(char *)&(m_data->app_length),
-          sizeof(m_data->app_length));
-    if (swap_bytes)
-        swap_u_long(m_data->app_length);
-    p += sizeof(m_data->app_length);    /* skip over */
-
-    if (m_data->app_length + sizeof(c_length) + sizeof(in_length) +
-        sizeof(m_data->time_sec) + sizeof(m_data->time_5ms) +
-        sizeof(src_addr) + VERSION_SZ + MSG_TYPE_SZ
-        > in_length)
-        return RD_AP_MODIFIED;
-
-#ifndef NOENCRYPTION
-    /* we're now at the decrypted application data */
-#endif
-    m_data->app_data = p;
+    unsigned char *p = (unsigned char*)in;
+    int little_endian;
+    u_int32_t clen;
+    struct timeval tv;
+    u_int32_t src_addr;
+    int delta_t;
+
+    unsigned char pvno, type;
+
+    pvno = *p++;
+    if(pvno != KRB_PROT_VERSION)
+	return RD_AP_VERSION;
+    
+    type = *p++;
+    little_endian = type & 1;
+    type &= ~1;
+
+    p += krb_get_int(p, &clen, 4, little_endian);
+    
+    if(clen + 2 > in_length)
+	return RD_AP_MODIFIED;
+
+    des_pcbc_encrypt((des_cblock*)p, (des_cblock*)p, clen, 
+		     schedule, key, DES_DECRYPT);
+    
+    p += krb_get_int(p, &m_data->app_length, 4, little_endian);
+    if(m_data->app_length + 17 > in_length)
+	return RD_AP_MODIFIED;
 
+    m_data->app_data = p;
     p += m_data->app_length;
+    
+    m_data->time_5ms = *p++;
 
-    /* safely get time_5ms */
-    bcopy((char *) p, (char *)&(m_data->time_5ms),
-	  sizeof(m_data->time_5ms));
-    /*  don't need to swap-- one byte for now */
-    p += sizeof(m_data->time_5ms);
-
-    /* safely get src address */
-    bcopy((char *) p,(char *)&src_addr,sizeof(src_addr));
-    /* don't swap, net order always */
-    p += sizeof(src_addr);
-
-    /* safely get time_sec */
-    bcopy((char *) p, (char *)&(m_data->time_sec),
-	  sizeof(m_data->time_sec));
-    if (swap_bytes) swap_u_long(m_data->time_sec);
-
-    p += sizeof(m_data->time_sec);
-
-    /* check direction bit is the sign bit */
-    /* For compatibility with broken old code, compares are done in VAX 
-       byte order (LSBFIRST) */ 
-    if (lsb_net_ulong_less(sender->sin_addr.s_addr,
-			   receiver->sin_addr.s_addr)==-1) 
-	/* src < recv */ 
-	m_data->time_sec =  - m_data->time_sec; 
-    else if (lsb_net_ulong_less(sender->sin_addr.s_addr, 
-				receiver->sin_addr.s_addr)==0) 
-	if (lsb_net_ushort_less(sender->sin_port,receiver->sin_port)==-1)
-	    /* src < recv */
-	    m_data->time_sec =  - m_data->time_sec; 
-    /*
-     * all that for one tiny bit!
-     * Heaven help those that talk to themselves.
-     */
+    p += krb_get_address(p, &src_addr);
+
+    if (!krb_equiv(src_addr, sender->sin_addr.s_addr))
+	return RD_AP_BADD;
+
+    p += krb_get_int(p, (u_int32_t *)&m_data->time_sec, 4, little_endian);
+
+    m_data->time_sec = lsb_time(m_data->time_sec, sender, receiver);
+    
+    gettimeofday(&tv, NULL);
 
     /* check the time integrity of the msg */
-    delta_t = abs((int)((long) local_time.tv_sec
-			- m_data->time_sec));
+    delta_t = abs((int)((long) tv.tv_sec - m_data->time_sec));
     if (delta_t > CLOCK_SKEW)
 	return RD_AP_TIME;
     if (krb_debug)
-	printf("\ndelta_t = %d", (int) delta_t);
+      krb_warning("\ndelta_t = %d", (int) delta_t);
 
     /*
      * caller must check timestamps for proper order and
@@ -193,20 +125,5 @@ krb_rd_priv(in, in_length, schedule, key, sender, receiver, m_data)
      * tightly synchronized clocks.
      */
 
-#ifdef notdef
-    bcopy((char *) p,(char *)&cksum,sizeof(cksum));
-    if (swap_bytes) swap_u_long(cksum)
-    /*
-     * calculate the checksum of the length, sequence,
-     * and input data, on the sending byte order!!
-     */
-    calc_cksum = des_quad_cksum(q,NULL,p-q,0,key);
-
-    if (krb_debug)
-	printf("\ncalc_cksum = %u, received cksum = %u",
-	       calc_cksum, cksum);
-    if (cksum != calc_cksum)
-	return RD_AP_MODIFIED;
-#endif
-    return RD_AP_OK;        /* OK == 0 */
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/rd_req.c b/kerberosIV/krb/rd_req.c
index 61a5f9dcc90..adcbabe8937 100644
--- a/kerberosIV/krb/rd_req.c
+++ b/kerberosIV/krb/rd_req.c
@@ -1,36 +1,45 @@
+/* $KTH: rd_req.c,v 1.24 1997/05/11 11:05:28 assar Exp $ */
+
 /*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/rd_req.c,v $
- *
- * $Locker:  $
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
-
 #include "krb_locl.h"
 
-#include <sys/time.h>
-
 static struct timeval t_local = { 0, 0 };
 
 /*
@@ -75,19 +84,17 @@ static char st_inst[INST_SZ];	/* server's instance */
  */
 
 int
-krb_set_key(key, cvt)
-	char *key;
-	int cvt;
+krb_set_key(void *key, int cvt)
 {
 #ifdef NOENCRYPTION
-    bzero(ky, sizeof(ky));
+    memset(ky, 0, sizeof(ky));
     return KSUCCESS;
 #else /* Encrypt */
     if (cvt)
-        des_string_to_key(key,&ky);
+        des_string_to_key((char*)key, &ky);
     else
-        bcopy(key,(char *)ky,8);
-    return(des_key_sched(&ky,serv_key));
+        memcpy((char*)ky, key, 8);
+    return(des_key_sched(&ky, serv_key));
 #endif /* NOENCRYPTION */
 }
 
@@ -134,75 +141,64 @@ krb_set_key(key, cvt)
  */
 
 int
-krb_rd_req(authent, service, instance, from_addr, ad, fn)
-	register KTEXT authent;	/* The received message */
-	char *service;		/* Service name */
-	char *instance;		/* Service instance */
-	int32_t from_addr;	/* Net address of originating host */
-	AUTH_DAT *ad;		/* Structure to be filled in */
-	char *fn;		/* Filename to get keys from */
+krb_rd_req(KTEXT authent,	/* The received message */
+	   char *service,	/* Service name */
+	   char *instance,	/* Service instance */
+	   int32_t from_addr,	/* Net address of originating host */
+	   AUTH_DAT *ad,	/* Structure to be filled in */
+	   char *fn)		/* Filename to get keys from */
 {
     static KTEXT_ST ticket;     /* Temp storage for ticket */
     static KTEXT tkt = &ticket;
     static KTEXT_ST req_id_st;  /* Temp storage for authenticator */
-    register KTEXT req_id = &req_id_st;
+    KTEXT req_id = &req_id_st;
 
     char realm[REALM_SZ];	/* Realm of issuing kerberos */
-    static des_key_schedule seskey_sched; /* Key sched for session key */
+
     unsigned char skey[KKEY_SZ]; /* Session key from ticket */
     char sname[SNAME_SZ];	/* Service name from ticket */
     char iname[INST_SZ];	/* Instance name from ticket */
     char r_aname[ANAME_SZ];	/* Client name from authenticator */
     char r_inst[INST_SZ];	/* Client instance from authenticator */
     char r_realm[REALM_SZ];	/* Client realm from authenticator */
-    unsigned int r_time_ms;     /* Fine time from authenticator */
-    unsigned long r_time_sec;   /* Coarse time from authenticator */
-    register char *ptr;		/* For stepping through */
+    u_int32_t r_time_sec;	/* Coarse time from authenticator */
     unsigned long delta_t;      /* Time in authenticator - local time */
     long tkt_age;		/* Age of ticket */
-    static int swap_bytes;	/* Need to swap bytes? */
-    static int mutual;		/* Mutual authentication requested? */
     static unsigned char s_kvno;/* Version number of the server's key
 				 * Kerberos used to encrypt ticket */
+
+    struct timeval tv;
     int status;
 
+    int pvno;
+    int type;
+    int little_endian;
+
+    unsigned char *p;
+
     if (authent->length <= 0)
 	return(RD_AP_MODIFIED);
 
-    ptr = (char *) authent->dat;
+    p = authent->dat;
 
     /* get msg version, type and byte order, and server key version */
 
-    /* check version */
-    if (KRB_PROT_VERSION != (unsigned int) *ptr++)
-        return(RD_AP_VERSION);
-
-    /* byte order */
-    swap_bytes = 0;
-    if ((*ptr & 1) != HOST_BYTE_ORDER)
-        swap_bytes++;
-
-    /* check msg type */
-    mutual = 0;
-    switch (*ptr++ & ~1) {
-    case AUTH_MSG_APPL_REQUEST:
-        break;
-    case AUTH_MSG_APPL_REQUEST_MUTUAL:
-        mutual++;
-        break;
-    default:
-        return(RD_AP_MSG_TYPE);
-    }
+    pvno = *p++;
+
+    if(pvno != KRB_PROT_VERSION)
+	return RD_AP_VERSION;
+    
+    type = *p++;
+    
+    little_endian = type & 1;
+    type &= ~1;
+    
+    if(type != AUTH_MSG_APPL_REQUEST && type != AUTH_MSG_APPL_REQUEST_MUTUAL)
+	return RD_AP_MSG_TYPE;
 
-#ifdef lint
-    /* XXX mutual is set but not used; why??? */
-    /* this is a crock to get lint to shut up */
-    if (mutual)
-        mutual = 0;
-#endif /* lint */
-    s_kvno = *ptr++;		/* get server key version */
-    (void) strncpy(realm,ptr, REALM_SZ);   /* And the realm of the issuing KDC */
-    ptr += strlen(ptr) + 1;     /* skip the realm "hint" */
+    s_kvno = *p++;
+
+    p += krb_get_string(p, realm);
 
     /*
      * If "fn" is NULL, key info should already be set; don't
@@ -216,124 +212,110 @@ krb_rd_req(authent, service, instance, from_addr, ad, fn)
                strcmp(st_rlm,realm) || (st_kvno != s_kvno))) {
         if (*fn == 0) fn = KEYFILE;
         st_kvno = s_kvno;
-#ifndef NOENCRYPTION
-        if (read_service_key(service,instance,realm,(int) s_kvno,
-                            fn,(char *)skey))
+        if (read_service_key(service, instance, realm, s_kvno,
+			     fn, (char *)skey))
             return(RD_AP_UNDEC);
-        if ((status = krb_set_key((char *)skey,0)))
+        if ((status = krb_set_key((char*)skey, 0)))
 	    return(status);
-#endif /* !NOENCRYPTION */
-        (void) strcpy(st_rlm,realm);
-        (void) strcpy(st_nam,service);
-        (void) strcpy(st_inst,instance);
+        strcpy(st_rlm, realm);
+        strcpy(st_nam, service);
+        strcpy(st_inst, instance);
     }
 
-    /* Get ticket from authenticator */
-    tkt->length = (int) *ptr++;
-    if ((tkt->length + (ptr+1 - (char *) authent->dat)) > authent->length)
-	return(RD_AP_MODIFIED);
-    bcopy(ptr+1,(char *)(tkt->dat),tkt->length);
+    tkt->length = *p++;
 
-    if (krb_ap_req_debug)
-        log("ticket->length: %d",tkt->length);
+    req_id->length = *p++;
 
-#ifndef NOENCRYPTION
-    /* Decrypt and take apart ticket */
-#endif
+    if(tkt->length + (p - authent->dat) > authent->length)
+	return RD_AP_MODIFIED;
 
-    if (decomp_ticket(tkt,&ad->k_flags,ad->pname,ad->pinst,ad->prealm,
-                      &(ad->address),ad->session, &(ad->life),
-                      &(ad->time_sec),sname,iname,&ky,serv_key))
-        return(RD_AP_UNDEC);
+    memcpy(tkt->dat, p, tkt->length);
+    p += tkt->length;
 
+    if (krb_ap_req_debug)
+        krb_log("ticket->length: %d",tkt->length);
+
+    /* Decrypt and take apart ticket */
+    if (decomp_ticket(tkt, &ad->k_flags, ad->pname, ad->pinst, ad->prealm,
+                      &ad->address, ad->session, &ad->life,
+                      &ad->time_sec, sname, iname, &ky, serv_key))
+        return RD_AP_UNDEC;
+    
     if (krb_ap_req_debug) {
-        log("Ticket Contents.");
-        log(" Aname:   %s.%s",ad->pname,
-            ((int)*(ad->prealm) ? ad->prealm : "Athena"));
-        log(" Service: %s%s%s",sname,((int)*iname ? "." : ""),iname);
+        krb_log("Ticket Contents.");
+        krb_log(" Aname:   %s.%s",ad->pname, ad->prealm);
+        krb_log(" Service: %s", krb_unparse_name_long(sname, iname, NULL));
     }
 
     /* Extract the authenticator */
-    req_id->length = (int) *(ptr++);
-    if ((req_id->length + (ptr + tkt->length - (char *) authent->dat)) >
-	authent->length)
-	return(RD_AP_MODIFIED);
-    bcopy(ptr + tkt->length, (char *)(req_id->dat),req_id->length);
+    
+    if(req_id->length + (p - authent->dat) > authent->length)
+	return RD_AP_MODIFIED;
 
+    memcpy(req_id->dat, p, req_id->length);
+    p = req_id->dat;
+    
 #ifndef NOENCRYPTION
     /* And decrypt it with the session key from the ticket */
-    if (krb_ap_req_debug) log("About to decrypt authenticator");
-    des_key_sched(&ad->session,seskey_sched);
-    des_pcbc_encrypt((des_cblock *)req_id->dat,(des_cblock *)req_id->dat,
-                 (long) req_id->length, seskey_sched,&ad->session,DES_DECRYPT);
-    if (krb_ap_req_debug) log("Done.");
+    if (krb_ap_req_debug) krb_log("About to decrypt authenticator");
+
+    encrypt_ktext(req_id, &ad->session, DES_DECRYPT);
+
+    if (krb_ap_req_debug) krb_log("Done.");
 #endif /* NOENCRYPTION */
 
+    /* cast req_id->length to int? */
 #define check_ptr() if ((ptr - (char *) req_id->dat) > req_id->length) return(RD_AP_MODIFIED);
 
-    ptr = (char *) req_id->dat;
-    (void) strcpy(r_aname,ptr);	/* Authentication name */
-    ptr += strlen(r_aname)+1;
-    check_ptr();
-    (void) strcpy(r_inst,ptr);	/* Authentication instance */
-    ptr += strlen(r_inst)+1;
-    check_ptr();
-    (void) strcpy(r_realm,ptr);	/* Authentication name */
-    ptr += strlen(r_realm)+1;
-    check_ptr();
-    bcopy(ptr,(char *)&ad->checksum,4);	/* Checksum */
-    ptr += 4;
-    check_ptr();
-    if (swap_bytes) swap_u_long(ad->checksum);
-    r_time_ms = *(ptr++);	/* Time (fine) */
-#ifdef lint
-    /* XXX r_time_ms is set but not used.  why??? */
-    /* this is a crock to get lint to shut up */
-    if (r_time_ms)
-        r_time_ms = 0;
-#endif /* lint */
-    check_ptr();
-    /* assume sizeof(r_time_sec) == 4 ?? */
-    bcopy(ptr,(char *)&r_time_sec,4); /* Time (coarse) */
-    if (swap_bytes) swap_u_long(r_time_sec);
+    p += krb_get_nir(p, r_aname, r_inst, r_realm); /* XXX no rangecheck */
+
+    p += krb_get_int(p, &ad->checksum, 4, little_endian);
+
+    p++; /* time_5ms is not used */
+
+    p += krb_get_int(p, &r_time_sec, 4, little_endian);
 
     /* Check for authenticity of the request */
     if (krb_ap_req_debug)
-        log("Pname:   %s %s",ad->pname,r_aname);
-    if (strcmp(ad->pname,r_aname) != 0)
-        return(RD_AP_INCON);
-    if (strcmp(ad->pinst,r_inst) != 0)
-        return(RD_AP_INCON);
+        krb_log("Principal: %s.%s@%s / %s.%s@%s",ad->pname,ad->pinst, ad->prealm, 
+	      r_aname, r_inst, r_realm);
+    if (strcmp(ad->pname, r_aname) != 0 ||
+	strcmp(ad->pinst, r_inst) != 0 ||
+	strcmp(ad->prealm, r_realm) != 0)
+	return RD_AP_INCON;
+    
     if (krb_ap_req_debug)
-        log("Realm:   %s %s",ad->prealm,r_realm);
-    if ((strcmp(ad->prealm,r_realm) != 0))
-        return(RD_AP_INCON);
+        krb_log("Address: %x %x", ad->address, from_addr);
 
-    if (krb_ap_req_debug)
-        log("Address: %d %d",ad->address,from_addr);
+    if (from_addr && (!krb_equiv(ad->address, from_addr)))
+        return RD_AP_BADD;
 
-    (void) gettimeofday(&t_local,(struct timezone *) 0);
-    delta_t = abs((int)(t_local.tv_sec - r_time_sec));
+    gettimeofday(&tv, NULL);
+    delta_t = abs((int)(tv.tv_sec - r_time_sec));
     if (delta_t > CLOCK_SKEW) {
         if (krb_ap_req_debug)
-            log("Time out of range: %d - %d = %d",
-                t_local.tv_sec,r_time_sec,delta_t);
-        return(RD_AP_TIME);
+            krb_log("Time out of range: %lu - %lu = %lu",
+		    (unsigned long)t_local.tv_sec,
+		    (unsigned long)r_time_sec,
+		    (unsigned long)delta_t);
+        return RD_AP_TIME;
     }
 
     /* Now check for expiration of ticket */
 
-    tkt_age = t_local.tv_sec - ad->time_sec;
+    tkt_age = tv.tv_sec - ad->time_sec;
     if (krb_ap_req_debug)
-        log("Time: %d Issue Date: %d Diff: %d Life %x",
-            t_local.tv_sec,ad->time_sec,tkt_age,ad->life);
-
-    if (t_local.tv_sec < ad->time_sec) {
-        if ((ad->time_sec - t_local.tv_sec) > CLOCK_SKEW)
-            return(RD_AP_NYV);
-    }
-    else if (t_local.tv_sec > krb_life_to_time(ad->time_sec, ad->life))
-        return(RD_AP_EXP);
+        krb_log("Time: %ld Issue Date: %lu Diff: %ld Life %x",
+		(long)tv.tv_sec,
+		(unsigned long)ad->time_sec,
+		tkt_age,
+		ad->life);
+    
+    if ((tkt_age < 0) && (-tkt_age > CLOCK_SKEW))
+	return RD_AP_NYV;
+
+    if (tv.tv_sec > krb_life_to_time(ad->time_sec, ad->life))
+        return RD_AP_EXP;
 
     /* All seems OK */
     ad->reply.length = 0;
diff --git a/kerberosIV/krb/rd_safe.c b/kerberosIV/krb/rd_safe.c
index 5d868fa1459..90d97b06365 100644
--- a/kerberosIV/krb/rd_safe.c
+++ b/kerberosIV/krb/rd_safe.c
@@ -1,58 +1,91 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/rd_safe.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
-
-   Export of this software from the United States of America is assumed
-   to require a specific license from the United States Government.
-   It is the responsibility of any person or organization contemplating
-   export to obtain such a license before exporting.
-
-WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-distribute this software and its documentation for any purpose and
-without fee is hereby granted, provided that the above copyright
-notice appear in all copies and that both that copyright notice and
-this permission notice appear in supporting documentation, and that
-the name of M.I.T. not be used in advertising or publicity pertaining
-to distribution of the software without specific, written prior
-permission.  M.I.T. makes no representations about the suitability of
-this software for any purpose.  It is provided "as is" without express
-or implied warranty.
-
-  */
+/* $KTH: rd_safe.c,v 1.24 1997/04/19 23:18:20 joda Exp $ */
 
 /*
- * This routine dissects a a Kerberos 'safe msg', checking its
- * integrity, and returning a pointer to the application data
- * contained and its length.
- *
- * Returns 0 (RD_AP_OK) for success or an error code (RD_AP_...)
- *
- * Steve Miller    Project Athena  MIT/DEC
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include "krb_locl.h"
 
-/* system include files */
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-
 /* application include files */
 #include "lsb_addr_comp.h"
 
-/* static storage */
-static des_cblock calc_cksum[2];
-static des_cblock big_cksum[2];
-static int swap_bytes;
-static struct timeval local_time;
-static u_int32_t delta_t;
+/* Generate two checksums in the given byteorder of the data, one
+ * new-form and one old-form. It has to be done this way to be
+ * compatible with the old version of des_quad_cksum.
+ */
+
+/* des_quad_chsum-type; 0 == unknown, 1 == new PL10++, 2 == old */
+int dqc_type = DES_QUAD_DEFAULT;
+
+void
+fixup_quad_cksum(void *start, size_t len, des_cblock *key, 
+		 void *new_checksum, void *old_checksum, int little)
+{
+    des_quad_cksum((des_cblock*)start, (des_cblock*)new_checksum, len, 2, key);
+    if(HOST_BYTE_ORDER){
+	if(little){
+	    memcpy(old_checksum, new_checksum, 16);
+	}else{
+	    u_int32_t *tmp = (u_int32_t*)new_checksum;
+	    memcpy(old_checksum, new_checksum, 16);
+	    swap_u_16(old_checksum);
+	    swap_u_long(tmp[0]);
+	    swap_u_long(tmp[1]);
+	    swap_u_long(tmp[2]);
+	    swap_u_long(tmp[3]);
+	}
+    }else{
+	if(little){
+	    u_int32_t *tmp = (u_int32_t*)new_checksum;
+	    swap_u_long(tmp[0]);
+	    swap_u_long(tmp[1]);
+	    swap_u_long(tmp[2]);
+	    swap_u_long(tmp[3]);
+	    memcpy(old_checksum, new_checksum, 16);
+	}else{
+	    u_int32_t tmp[4];
+	    tmp[0] = ((u_int32_t*)new_checksum)[3];
+	    tmp[1] = ((u_int32_t*)new_checksum)[2];
+	    tmp[2] = ((u_int32_t*)new_checksum)[1];
+	    tmp[3] = ((u_int32_t*)new_checksum)[0];
+	    memcpy(old_checksum, tmp, 16);
+	}
+    }
+}
 
 /*
  * krb_rd_safe() checks the integrity of an AUTH_MSG_SAFE message.
@@ -72,93 +105,53 @@ static u_int32_t delta_t;
  */
 
 int32_t
-krb_rd_safe(in, in_length, key, sender, receiver, m_data)
-	u_char *in;		/* pointer to the msg received */
-	u_int32_t in_length;	/* length of "in" msg */
-	des_cblock *key;	/* encryption key for seed and ivec */
-	struct sockaddr_in *sender; /* sender's address */
-	struct sockaddr_in *receiver; /* receiver's address -- me */
-	MSG_DAT *m_data;	/* where to put message information */
+krb_rd_safe(void *in, u_int32_t in_length, des_cblock *key, 
+	    struct sockaddr_in *sender, struct sockaddr_in *receiver, 
+	    MSG_DAT *m_data)
 {
-    register u_char     *p,*q;
-    static      u_int32_t  src_addr; /* Can't send structs since no
-                                   * guarantees on size */
-    /* Be very conservative */
-    if (sizeof(src_addr) != sizeof(struct in_addr)) {
-        fprintf(stderr,"\n\
-krb_rd_safe protocol err sizeof(src_addr) != sizeof(struct in_addr)");
-        exit(-1);
-    }
-
-    if (gettimeofday(&local_time,(struct timezone *)0))
-        return  -1;
-
-    p = in;                     /* beginning of message */
-    swap_bytes = 0;
+    unsigned char *p = (unsigned char*)in, *start;
+
+    unsigned char pvno, type;
+    int little_endian;
+    struct timeval tv;
+    u_int32_t src_addr;
+    int delta_t;
+    
+
+    pvno = *p++;
+    if(pvno != KRB_PROT_VERSION)
+	return RD_AP_VERSION;
+    
+    type = *p++;
+    little_endian = type & 1;
+    type &= ~1;
+    if(type != AUTH_MSG_SAFE)
+	return RD_AP_MSG_TYPE;
+
+    start = p;
+    
+    p += krb_get_int(p, &m_data->app_length, 4, little_endian);
+    
+    if(m_data->app_length + 31 > in_length)
+	return RD_AP_MODIFIED;
+    
+    m_data->app_data = p;
 
-    if (*p++ != KRB_PROT_VERSION)       return RD_AP_VERSION;
-    if (((*p) & ~1) != AUTH_MSG_SAFE) return RD_AP_MSG_TYPE;
-    if ((*p++ & 1) != HOST_BYTE_ORDER) swap_bytes++;
-
-    q = p;                      /* mark start of cksum stuff */
-
-    /* safely get length */
-    bcopy((char *)p,(char *)&(m_data->app_length),
-          sizeof(m_data->app_length));
-    if (swap_bytes) swap_u_long(m_data->app_length);
-    p += sizeof(m_data->app_length); /* skip over */
+    p += m_data->app_length;
 
-    if (m_data->app_length + sizeof(in_length)
-        + sizeof(m_data->time_sec) + sizeof(m_data->time_5ms)
-        + sizeof(big_cksum) + sizeof(src_addr)
-        + VERSION_SZ + MSG_TYPE_SZ > in_length)
-        return(RD_AP_MODIFIED);
+    m_data->time_5ms = *p++;
 
-    m_data->app_data = p;       /* we're now at the application data */
+    p += krb_get_address(p, &src_addr);
 
-    /* skip app data */
-    p += m_data->app_length;
+    if (!krb_equiv(src_addr, sender->sin_addr.s_addr))
+        return RD_AP_BADD;
 
-    /* safely get time_5ms */
-    bcopy((char *)p, (char *)&(m_data->time_5ms),
-          sizeof(m_data->time_5ms));
-
-    /* don't need to swap-- one byte for now */
-    p += sizeof(m_data->time_5ms);
-
-    /* safely get src address */
-    bcopy((char *)p,(char *)&src_addr,sizeof(src_addr));
-
-    /* don't swap, net order always */
-    p += sizeof(src_addr);
-
-    /* safely get time_sec */
-    bcopy((char *)p, (char *)&(m_data->time_sec),
-          sizeof(m_data->time_sec));
-    if (swap_bytes)
-        swap_u_long(m_data->time_sec);
-    p += sizeof(m_data->time_sec);
-
-    /* check direction bit is the sign bit */
-    /* For compatibility with broken old code, compares are done in VAX 
-       byte order (LSBFIRST) */ 
-    if (lsb_net_ulong_less(sender->sin_addr.s_addr,
-			   receiver->sin_addr.s_addr)==-1) 
-	/* src < recv */ 
-	m_data->time_sec =  - m_data->time_sec; 
-    else if (lsb_net_ulong_less(sender->sin_addr.s_addr, 
-				receiver->sin_addr.s_addr)==0) 
-	if (lsb_net_ushort_less(sender->sin_port,receiver->sin_port)==-1)
-	    /* src < recv */
-	    m_data->time_sec =  - m_data->time_sec; 
+    p += krb_get_int(p, (u_int32_t *)&m_data->time_sec, 4, little_endian);
+    m_data->time_sec = lsb_time(m_data->time_sec, sender, receiver);
+    
+    gettimeofday(&tv, NULL);
 
-    /*
-     * All that for one tiny bit!  Heaven help those that talk to
-     * themselves.
-     */
-
-    /* check the time integrity of the msg */
-    delta_t = abs((int)((long) local_time.tv_sec - m_data->time_sec));
+    delta_t = abs((int)((long) tv.tv_sec - m_data->time_sec));
     if (delta_t > CLOCK_SKEW) return RD_AP_TIME;
 
     /*
@@ -167,20 +160,19 @@ krb_rd_safe protocol err sizeof(src_addr) != sizeof(struct in_addr)");
      * and we don't assume tightly synchronized clocks.
      */
 
-    bcopy((char *)p,(char *)big_cksum,sizeof(big_cksum));
-    if (swap_bytes) swap_u_16(big_cksum);
-
-#ifdef NOENCRYPTION
-    bzero(calc_cksum, sizeof(calc_cksum));
-#else
-    des_quad_cksum((des_cblock *)q,calc_cksum,p-q,2,key);
-#endif
-
-    if (krb_debug)
-        printf("\ncalc_cksum = %u, received cksum = %u",
-               (u_int) calc_cksum[0], (u_int) big_cksum[0]);
-    if (bcmp((char *)big_cksum,(char *)calc_cksum,sizeof(big_cksum)))
-        return(RD_AP_MODIFIED);
-
-    return(RD_AP_OK);           /* OK == 0 */
+    {
+	unsigned char new_checksum[16];
+	unsigned char old_checksum[16];
+	fixup_quad_cksum(start, p - start, key, 
+			 new_checksum, old_checksum, little_endian);
+	if((dqc_type == DES_QUAD_GUESS || dqc_type == DES_QUAD_NEW) && 
+	   memcmp(new_checksum, p, 16) == 0)
+	    dqc_type = DES_QUAD_NEW;
+	else if((dqc_type == DES_QUAD_GUESS || dqc_type == DES_QUAD_OLD) && 
+		memcmp(old_checksum, p, 16) == 0)
+	    dqc_type = DES_QUAD_OLD;
+	else
+	    return RD_AP_MODIFIED;
+    }
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/read_service_key.c b/kerberosIV/krb/read_service_key.c
index 31ba2e84ee0..5bee36177f2 100644
--- a/kerberosIV/krb/read_service_key.c
+++ b/kerberosIV/krb/read_service_key.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/read_service_key.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: read_service_key.c,v 1.8 1997/03/23 03:53:16 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -62,15 +56,13 @@ or implied warranty.
  */
 
 
-/*ARGSUSED */
 int
-read_service_key(service, instance, realm, kvno, file, key)
-	char *service;		/* Service Name */
-	char *instance;		/* Instance name or "*" */
-	char *realm;		/* Realm */
-	int kvno;		/* Key version number */
-	char *file;		/* Filename */
-	char *key;		/* Pointer to key to be filled in */
+read_service_key(char *service,	/* Service Name */
+		 char *instance, /* Instance name or "*" */
+		 char *realm,	/* Realm */
+		 int kvno,	/* Key version number */
+		 char *file,	/* Filename */
+		 char *key)	/* Pointer to key to be filled in */
 {
     char serv[SNAME_SZ];
     char inst[INST_SZ];
@@ -78,18 +70,18 @@ read_service_key(service, instance, realm, kvno, file, key)
     unsigned char vno;          /* Key version number */
     int wcard;
 
-    int stab, open(const char *, int, ...);
+    int stab;
 
-    if ((stab = open(file, 0, 0)) < 0)
+    if ((stab = open(file, O_RDONLY, 0)) < 0)
         return(KFAILURE);
 
     wcard = (instance[0] == '*') && (instance[1] == '\0');
 
     while (getst(stab,serv,SNAME_SZ) > 0) { /* Read sname */
-        (void) getst(stab,inst,INST_SZ); /* Instance */
-        (void) getst(stab,rlm,REALM_SZ); /* Realm */
+        getst(stab,inst,INST_SZ); /* Instance */
+        getst(stab,rlm,REALM_SZ); /* Realm */
         /* Vers number */
-        if (read(stab,(char *)&vno,1) != 1) {
+        if (read(stab, &vno, 1) != 1) {
 	    close(stab);
             return(KFAILURE);
 	}
@@ -105,29 +97,20 @@ read_service_key(service, instance, realm, kvno, file, key)
         if (!wcard && strcmp(inst,instance))
             continue;
         if (wcard)
-            (void) strncpy(instance,inst,INST_SZ);
+            strncpy(instance,inst,INST_SZ);
         /* Is this the right realm */
-#ifdef ATHENA_COMPAT
-	/* XXX For backward compatibility:  if keyfile says "Athena"
-	   and caller wants "ATHENA.MIT.EDU", call it a match */
-        if (strcmp(rlm,realm) &&
-	    (strcmp(rlm,"Athena") ||
-	     strcmp(realm,"ATHENA.MIT.EDU")))
-	    continue;
-#else /* ! ATHENA_COMPAT */
         if (strcmp(rlm,realm)) 
 	    continue;
-#endif /* ATHENA_COMPAT */
 
         /* How about the key version number */
         if (kvno && kvno != (int) vno)
             continue;
 
-        (void) close(stab);
+        close(stab);
         return(KSUCCESS);
     }
 
     /* Can't find the requested service */
-    (void) close(stab);
+    close(stab);
     return(KFAILURE);
 }
diff --git a/kerberosIV/krb/realm_parse.c b/kerberosIV/krb/realm_parse.c
new file mode 100644
index 00000000000..8ce892c1835
--- /dev/null
+++ b/kerberosIV/krb/realm_parse.c
@@ -0,0 +1,88 @@
+/* $KTH: realm_parse.c,v 1.10 1997/06/01 03:14:50 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+static int
+realm_parse(char *realm, int length, const char *file)
+{
+    FILE *F;
+    char tr[128];
+    char *p;
+    
+    if ((F = fopen(file,"r")) == NULL)
+	return -1;
+    
+    while(fgets(tr, sizeof(tr), F)){
+	char *unused = NULL;
+	p = strtok_r(tr, " \t\n\r", &unused);
+	if(p && strcasecmp(p, realm) == 0){
+	    fclose(F);
+	    strncpy(realm, p, length);
+	    return 0;
+	}
+    }
+    fclose(F);
+    return -1;
+}
+
+static const char *const files[] = KRB_CNF_FILES;
+
+int
+krb_realm_parse(char *realm, int length)
+{
+    int i;
+  
+    const char *dir = getenv("KRBCONFDIR");
+
+    /* First try user specified file */
+    if (dir != 0) {
+      char fname[MAXPATHLEN];
+
+      if(k_concat(fname, sizeof(fname), dir, "/krb.conf", NULL) == 0)
+	  if (realm_parse(realm, length, fname) == 0)
+	      return 0;
+    }
+
+    for (i = 0; files[i] != NULL; i++)
+	if (realm_parse(realm, length, files[i]) == 0)
+	    return 0;
+    return -1;
+}
diff --git a/kerberosIV/krb/recvauth.c b/kerberosIV/krb/recvauth.c
index d5706120d42..f1286ebe3f6 100644
--- a/kerberosIV/krb/recvauth.c
+++ b/kerberosIV/krb/recvauth.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/recvauth.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: recvauth.c,v 1.18 1997/07/05 01:35:15 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,18 +23,6 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <syslog.h>
-
-/*
- * If the protocol changes, you will need to change the version string
- * and make appropriate changes in krb_sendauth.c
- * be sure to support old versions of krb_sendauth!
- */
-#define	KRB_SENDAUTH_VERS	"AUTHV0.1" /* MUST be KRB_SENDAUTH_VLEN
-					      chars */
-
 /*
  * krb_recvauth() reads (and optionally responds to) a message sent
  * using krb_sendauth().  The "options" argument is a bit-field of
@@ -73,21 +55,6 @@ or implied warranty.
  *
  * See krb_sendauth() for the format of the received client message.
  *
- * This routine supports another client format, for backward
- * compatibility, consisting of:
- *
- * Size			Variable		Field
- * ----			--------		-----
- *
- * string		tmp_buf, tkt_len	length of ticket, in
- * 						ascii
- *
- * char			' ' (space char)	separator
- *
- * tkt_len		ticket->dat		the ticket
- *
- * This old-style version does not support mutual authentication.
- *
  * krb_recvauth() first reads the protocol version string from the
  * given file descriptor.  If it doesn't match the current protocol
  * version (KRB_SENDAUTH_VERS), the old-style format is assumed.  In
@@ -122,174 +89,104 @@ or implied warranty.
  * other error code is returned.
  */
 
-#ifndef max
-#define	max(a,b) (((a) > (b)) ? (a) : (b))
-#endif /* max */
+static int
+send_error_reply(int fd)
+{
+    unsigned char tmp[4] = { 255, 255, 255, 255 };
+    if(krb_net_write(fd, tmp, sizeof(tmp)) != sizeof(tmp))
+	return -1;
+    return 0;
+}
 
 int
-krb_recvauth(options, fd, ticket, service, instance, faddr, laddr, kdata,
-	     filename, schedule, version)
-	int32_t options;	/* bit-pattern of options */
-	int fd;			/* file descr. to read from */
-	KTEXT ticket;		/* storage for client's ticket */
-	char *service;		/* service expected */
-	char *instance;		/* inst expected (may be filled in) */
-	struct sockaddr_in *faddr; /* address of foreign host on fd */
-	struct sockaddr_in *laddr; /* local address */
-	AUTH_DAT *kdata;	/* kerberos data (returned) */
-	char *filename;		/* name of file with service keys */
-	struct des_ks_struct *schedule;	/* key schedule (return) */
-	char *version;		/* version string (filled in) */
+krb_recvauth(int32_t options,	/* bit-pattern of options */
+	     int fd,		/* file descr. to read from */
+	     KTEXT ticket,	/* storage for client's ticket */
+	     char *service,	/* service expected */
+	     char *instance,	/* inst expected (may be filled in) */
+	     struct sockaddr_in *faddr,	/* address of foreign host on fd */
+	     struct sockaddr_in *laddr,	/* local address */
+	     AUTH_DAT *kdata,	/* kerberos data (returned) */
+	     char *filename,	/* name of file with service keys */
+	     struct des_ks_struct *schedule, /* key schedule (return) */
+	     char *version)	/* version string (filled in) */
 {
-
-    int i, cc, old_vers = 0;
+    int cc;
     char krb_vers[KRB_SENDAUTH_VLEN + 1]; /* + 1 for the null terminator */
-    char *cp;
     int rem;
-    long tkt_len, priv_len;
-    u_int32_t cksum;
+    int32_t priv_len;
     u_char tmp_buf[MAX_KTXT_LEN+max(KRB_SENDAUTH_VLEN+1,21)];
 
-    /* read the protocol version number */
-    if (krb_net_read(fd, krb_vers, KRB_SENDAUTH_VLEN) !=
-	KRB_SENDAUTH_VLEN)
+    if (!(options & KOPT_IGNORE_PROTOCOL)) {
+	/* read the protocol version number */
+	if (krb_net_read(fd, krb_vers, KRB_SENDAUTH_VLEN) != KRB_SENDAUTH_VLEN)
 	    return(errno);
-    krb_vers[KRB_SENDAUTH_VLEN] = '\0';
-
-    /* check version string */
-    if (strcmp(krb_vers,KRB_SENDAUTH_VERS)) {
-	/* Assume the old version of sendkerberosdata: send ascii
-	   length, ' ', and ticket. */
-	if (options & KOPT_DO_MUTUAL)
-	    return(KFAILURE);	 /* XXX can't do old style with mutual auth */
-	old_vers = 1;
-
-	/* copy what we have read into tmp_buf */
-	(void) bcopy(krb_vers, (char *) tmp_buf, KRB_SENDAUTH_VLEN);
-
-	/* search for space, and make it a null */
-	for (i = 0; i < KRB_SENDAUTH_VLEN; i++)
-	    if (tmp_buf[i]== ' ') {
-		tmp_buf[i] = '\0';
-		/* point cp to the beginning of the real ticket */
-		cp = (char *) &tmp_buf[i+1];
-		break;
-	    }
-
-	if (i == KRB_SENDAUTH_VLEN)
-	    /* didn't find the space, keep reading to find it */
-	    for (; i<20; i++) {
-		if (read(fd, (char *)&tmp_buf[i], 1) != 1) {
-		    return(KFAILURE);
-		}
-		if (tmp_buf[i] == ' ') {
-		    tmp_buf[i] = '\0';
-		    /* point cp to the beginning of the real ticket */
-		    cp = (char *) &tmp_buf[i+1];
-		    break;
-		}
-	    }
-
-	tkt_len = (long) atoi((char *) tmp_buf);
-
-	/* sanity check the length */
-	if ((i==20)||(tkt_len<=0)||(tkt_len>MAX_KTXT_LEN))
-	    return(KFAILURE);
-
-	if (i < KRB_SENDAUTH_VLEN) {
-	    /* since we already got the space, and part of the ticket,
-	       we read fewer bytes to get the rest of the ticket */
-	    if (krb_net_read(fd, (char *)(tmp_buf+KRB_SENDAUTH_VLEN),
-			     (int) (tkt_len - KRB_SENDAUTH_VLEN + 1 + i))
-		!= (int)(tkt_len - KRB_SENDAUTH_VLEN + 1 + i))
-		return(errno);
-	} else {
-	    if (krb_net_read(fd, (char *)(tmp_buf+i), (int)tkt_len) !=
-		(int) tkt_len)
-		return(errno);
-	}
-	ticket->length = tkt_len;
-	/* copy the ticket into the struct */
-	(void) bcopy(cp, (char *) ticket->dat, ticket->length);
-
-    } else {
-	/* read the application version string */
-	if (krb_net_read(fd, version, KRB_SENDAUTH_VLEN) !=
-	    KRB_SENDAUTH_VLEN)
-	    return(errno);
-	version[KRB_SENDAUTH_VLEN] = '\0';
+	krb_vers[KRB_SENDAUTH_VLEN] = '\0';
+    }
 
-	/* get the length of the ticket */
-	if (krb_net_read(fd, (char *)&tkt_len, sizeof(tkt_len)) !=
-	    sizeof(tkt_len))
-	    return(errno);
+    /* read the application version string */
+    if (krb_net_read(fd, version, KRB_SENDAUTH_VLEN) != KRB_SENDAUTH_VLEN)
+	return(errno);
+    version[KRB_SENDAUTH_VLEN] = '\0';
+
+    /* get the length of the ticket */
+    {
+	char tmp[4];
+	if (krb_net_read(fd, tmp, 4) != 4)
+	    return -1;
+	krb_get_int(tmp, &ticket->length, 4, 0);
+    }
     
-	/* sanity check */
-	ticket->length = ntohl((unsigned long)tkt_len);
-	if ((ticket->length <= 0) || (ticket->length > MAX_KTXT_LEN)) {
-	    if (options & KOPT_DO_MUTUAL) {
-		rem = KFAILURE;
-		goto mutual_fail;
-	    } else
-		return(KFAILURE); /* XXX there may still be junk on the fd? */
-	}
-
-	/* read the ticket */
-	if (krb_net_read(fd, (char *) ticket->dat, ticket->length)
-	    != ticket->length)
-	    return(errno);
+    /* sanity check */
+    if (ticket->length <= 0 || ticket->length > MAX_KTXT_LEN) {
+	if (options & KOPT_DO_MUTUAL) {
+	    if(send_error_reply(fd))
+		return -1;
+	    return KFAILURE;
+	} else
+	    return KFAILURE; /* XXX there may still be junk on the fd? */
     }
+
+    /* read the ticket */
+    if (krb_net_read(fd, ticket->dat, ticket->length) != ticket->length)
+	return -1;
     /*
      * now have the ticket.  decrypt it to get the authenticated
      * data.
      */
-    rem = krb_rd_req(ticket,service,instance,faddr->sin_addr.s_addr,
-		     kdata,filename);
-
-    if (old_vers) return(rem);	 /* XXX can't do mutual with old client */
+    rem = krb_rd_req(ticket, service, instance, faddr->sin_addr.s_addr,
+		     kdata, filename);
 
     /* if we are doing mutual auth, compose a response */
     if (options & KOPT_DO_MUTUAL) {
-	if (rem != KSUCCESS)
+	if (rem != KSUCCESS){
 	    /* the krb_rd_req failed */
-	    goto mutual_fail;
-
+	    if(send_error_reply(fd))
+		return -1;
+	    return rem;
+	}
+	
 	/* add one to the (formerly) sealed checksum, and re-seal it
 	   for return to the client */
-	cksum = kdata->checksum + 1;
-	cksum = htonl(cksum);
+	{ 
+	    unsigned char cs[4];
+	    krb_put_int(kdata->checksum + 1, cs, 4);
 #ifndef NOENCRYPTION
-	des_key_sched(&kdata->session,schedule);
+	    des_key_sched(&kdata->session,schedule);
 #endif
-	priv_len = krb_mk_priv((unsigned char *)&cksum,
-			       tmp_buf,
-			       (unsigned long) sizeof(cksum),
-			       schedule,
-			       &kdata->session,
-			       laddr,
-			       faddr);
-	if (priv_len < 0) {
-	    /* re-sealing failed; notify the client */
-	    rem = KFAILURE;	 /* XXX */
-mutual_fail:
-	    priv_len = -1;
-	    tkt_len = htonl((unsigned long) priv_len);
-	    /* a length of -1 is interpreted as an authentication
-	       failure by the client */
-	    if ((cc = krb_net_write(fd, (char *)&tkt_len, sizeof(tkt_len)))
-		!= sizeof(tkt_len))
-		return(cc);
-	    return(rem);
-	} else {
-	    /* re-sealing succeeded, send the private message */
-	    tkt_len = htonl((unsigned long)priv_len);
-	    if ((cc = krb_net_write(fd, (char *)&tkt_len, sizeof(tkt_len)))
-		 != sizeof(tkt_len))
-		return(cc);
-	    if ((cc = krb_net_write(fd, (char *)tmp_buf, (int) priv_len))
-		!= (int) priv_len)
-		return(cc);
+	    priv_len = krb_mk_priv(cs, 
+				   tmp_buf+4, 
+				   4,
+				   schedule,
+				   &kdata->session,
+				   laddr,
+				   faddr);
 	}
+	/* mk_priv will never fail */
+	priv_len += krb_put_int(priv_len, tmp_buf, 4);
+	
+	if((cc = krb_net_write(fd, tmp_buf, priv_len)) != priv_len)
+	    return -1;
     }
-    return(rem);
+    return rem;
 }
diff --git a/kerberosIV/krb/resolve.c b/kerberosIV/krb/resolve.c
new file mode 100644
index 00000000000..2fe607d13af
--- /dev/null
+++ b/kerberosIV/krb/resolve.c
@@ -0,0 +1,232 @@
+/* $KTH: resolve.c,v 1.12 1997/10/28 15:37:39 bg Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+#include "resolve.h"
+
+#define DECL(X) {#X, T_##X}
+
+static struct stot{
+    char *name;
+    int type;
+}stot[] = {
+    DECL(A),
+    DECL(NS),
+    DECL(CNAME),
+    DECL(PTR),
+    DECL(MX),
+    DECL(TXT),
+    DECL(AFSDB),
+    DECL(SRV),
+    {NULL, 	0}
+};
+
+static int
+string_to_type(const char *name)
+{
+    struct stot *p = stot;
+    for(p = stot; p->name; p++)
+	if(strcasecmp(name, p->name) == 0)
+	    return p->type;
+    return -1;
+}
+
+#if 0
+static char *
+type_to_string(int type)
+{
+    struct stot *p = stot;
+    for(p = stot; p->name; p++)
+	if(type == p->type)
+	    return p->name;
+    return NULL;
+}
+#endif
+
+void
+dns_free_data(struct dns_reply *r)
+{
+    struct resource_record *rr;
+    if(r->q.domain)
+	free(r->q.domain);
+    for(rr = r->head; rr;){
+	struct resource_record *tmp = rr;
+	if(rr->domain)
+	    free(rr->domain);
+	if(rr->u.data)
+	    free(rr->u.data);
+	rr = rr->next;
+	free(tmp);
+    }
+    free (r);
+}
+
+static struct dns_reply*
+parse_reply(unsigned char *data, int len)
+{
+    unsigned char *p;
+    char host[128];
+    int status;
+    
+    struct dns_reply *r;
+    struct resource_record **rr;
+    
+    r = (struct dns_reply*)malloc(sizeof(struct dns_reply));
+    memset(r, 0, sizeof(struct dns_reply));
+
+    p = data;
+    memcpy(&r->h, p, sizeof(HEADER));
+    p += sizeof(HEADER);
+    status = dn_expand(data, data + len, p, host, sizeof(host));
+    if(status < 0){
+	dns_free_data(r);
+	return NULL;
+    }
+    r->q.domain = strdup(host);
+    p += status;
+    r->q.type = (p[0] << 8 | p[1]);
+    p += 2;
+    r->q.class = (p[0] << 8 | p[1]);
+    p += 2;
+    rr = &r->head;
+    while(p < data + len){
+	int type, class, ttl, size;
+	status = dn_expand(data, data + len, p, host, sizeof(host));
+	if(status < 0){
+	    dns_free_data(r);
+	    return NULL;
+	}
+	p += status;
+	type = (p[0] << 8) | p[1];
+	p += 2;
+	class = (p[0] << 8) | p[1];
+	p += 2;
+	ttl = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
+	p += 4;
+	size = (p[0] << 8) | p[1];
+	p += 2;
+	*rr = (struct resource_record*)calloc(1, 
+					      sizeof(struct resource_record));
+	(*rr)->domain = strdup(host);
+	(*rr)->type = type;
+	(*rr)->class = class;
+	(*rr)->ttl = ttl;
+	(*rr)->size = size;
+	switch(type){
+	case T_NS:
+	case T_CNAME:
+	case T_PTR:
+	    status = dn_expand(data, data + len, p, host, sizeof(host));
+	    if(status < 0){
+		dns_free_data(r);
+		return NULL;
+	    }
+	    (*rr)->u.txt = strdup(host);
+	    break;
+	case T_MX:
+	case T_AFSDB:{
+	    status = dn_expand(data, data + len, p + 2, host, sizeof(host));
+	    if(status < 0){
+		dns_free_data(r);
+		return NULL;
+	    }
+	    (*rr)->u.mx = (struct mx_record*)malloc(sizeof(struct mx_record) + 
+						    strlen(host));
+	    (*rr)->u.mx->preference = (p[0] << 8) | p[1];
+	    strcpy((*rr)->u.mx->domain, host);
+	    break;
+	}
+	case T_SRV:{
+	    status = dn_expand(data, data + len, p + 6, host, sizeof(host));
+	    if(status < 0){
+		dns_free_data(r);
+		return NULL;
+	    }
+	    (*rr)->u.srv = 
+		(struct srv_record*)malloc(sizeof(struct srv_record) + 
+					   strlen(host));
+	    (*rr)->u.srv->priority = (p[0] << 8) | p[1];
+	    (*rr)->u.srv->weight = (p[2] << 8) | p[3];
+	    (*rr)->u.srv->port = (p[4] << 8) | p[5];
+	    strcpy((*rr)->u.srv->target, host);
+	    break;
+	}
+	case T_TXT:{
+	    (*rr)->u.txt = (char*)malloc(size + 1);
+	    strncpy((*rr)->u.txt, (char*)p + 1, *p);
+	    (*rr)->u.txt[*p] = 0;
+	    break;
+	}
+	    
+	default:
+	    (*rr)->u.data = (unsigned char*)malloc(size);
+	    memcpy((*rr)->u.data, p, size);
+	}
+	p += size;
+	rr = &(*rr)->next;
+    }
+    *rr = NULL;
+    return r;
+}
+
+struct dns_reply *
+dns_lookup(const char *domain, const char *type_name)
+{
+    unsigned char reply[1024];
+    int len;
+    int type;
+    struct dns_reply *r = NULL;
+    u_long old_options;
+    
+    type = string_to_type(type_name);
+    if (krb_dns_debug) {
+        old_options = _res.options;
+	_res.options |= RES_DEBUG;
+	krb_warning("dns_lookup(%s, %s)\n", domain, type_name);
+    }
+    len = res_search(domain, C_IN, type, reply, sizeof(reply));
+    if (krb_dns_debug) {
+        _res.options = old_options;
+	krb_warning("dns_lookup(%s, %s) --> %d\n", domain, type_name, len);
+    }
+    if (len >= 0)
+	r = parse_reply(reply, len);
+    return r;
+}
diff --git a/kerberosIV/krb/resolve.h b/kerberosIV/krb/resolve.h
new file mode 100644
index 00000000000..30c2a1fc629
--- /dev/null
+++ b/kerberosIV/krb/resolve.h
@@ -0,0 +1,95 @@
+/* $KTH: resolve.h,v 1.5 1997/05/14 17:41:25 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* THIS IS NOT (yet) A PUBLIC INTERFACE */
+
+
+#ifndef __RESOLVE_H__
+#define __RESOLVE_H__
+
+/* We use these, but they are not always present in <arpa/nameser.h> */
+
+struct dns_query{
+    char *domain;
+    unsigned type;
+    unsigned class;
+};
+
+struct mx_record{
+    unsigned  preference;
+    char domain[1];
+};
+
+struct srv_record{
+    unsigned priority;
+    unsigned weight;
+    unsigned port;
+    char target[1];
+};
+
+struct resource_record{
+    char *domain;
+    unsigned type;
+    unsigned class;
+    unsigned ttl;
+    unsigned size;
+    union {
+	void *data;
+	struct mx_record *mx;
+	struct mx_record *afsdb; /* mx and afsdb are identical */
+	struct srv_record *srv;
+	struct in_addr *a;
+	char *txt;
+    }u;
+    struct resource_record *next;
+};
+
+struct dns_reply{
+    HEADER h;
+    struct dns_query q;
+    struct resource_record *head;
+};
+
+
+struct dns_reply* dns_lookup(const char *, const char *);
+
+void dns_free_data(struct dns_reply *r);
+
+#endif /* __RESOLVE_H__ */
diff --git a/kerberosIV/krb/rw.c b/kerberosIV/krb/rw.c
new file mode 100644
index 00000000000..7ee546050a2
--- /dev/null
+++ b/kerberosIV/krb/rw.c
@@ -0,0 +1,128 @@
+/* $KTH: rw.c,v 1.8 1997/04/01 08:18:44 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* Almost all programs use these routines (implicitly) so it's a good
+ * place to put the version string. */
+
+#include "version.h"
+
+#include "krb_locl.h"
+
+int
+krb_get_int(void *f, u_int32_t *to, int size, int lsb)
+{
+    int i;
+    unsigned char *from = (unsigned char *)f;
+
+    *to = 0;
+    if(lsb){
+	for(i = size-1; i >= 0; i--)
+	    *to = (*to << 8) | from[i];
+    }else{
+	for(i = 0; i < size; i++)
+	    *to = (*to << 8) | from[i];
+    }
+    return size;
+}
+
+int
+krb_put_int(u_int32_t from, void *to, int size)
+{
+    int i;
+    unsigned char *p = (unsigned char *)to;
+    for(i = size - 1; i >= 0; i--){
+	p[i] = from & 0xff;
+	from >>= 8;
+    }
+    return size;
+}
+
+
+/* addresses are always sent in network byte order */
+
+int
+krb_get_address(void *from, u_int32_t *to)
+{
+    unsigned char *p = (unsigned char*)from;
+    *to = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]);
+    return 4;
+}
+
+int
+krb_put_address(u_int32_t addr, void *to)
+{
+    return krb_put_int(ntohl(addr), to, 4);
+}
+
+int
+krb_put_string(char *from, void *to)
+{
+    strcpy((char *)to, from);
+    return strlen(from) + 1;
+}
+
+int
+krb_get_string(void *from, char *to)
+{
+    return krb_put_string(from, to);
+}
+
+int
+krb_get_nir(void *from, char *name, char *instance, char *realm)
+{
+    char *p = (char *)from;
+
+    p += krb_get_string(p, name);
+    p += krb_get_string(p, instance);
+    if(realm)
+	p += krb_get_string(p, realm);
+    return p - (char *)from;
+}
+
+int
+krb_put_nir(char *name, char *instance, char *realm, void *to)
+{
+    char *p = (char *)to;
+    p += krb_put_string(name, p);
+    p += krb_put_string(instance, p);
+    if(realm)
+	p += krb_put_string(realm, p);
+    return p - (char *)to;
+}
diff --git a/kerberosIV/krb/save_credentials.c b/kerberosIV/krb/save_credentials.c
index b9b58d48704..d9ef94b449d 100644
--- a/kerberosIV/krb/save_credentials.c
+++ b/kerberosIV/krb/save_credentials.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/save_credentials.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: save_credentials.c,v 1.5 1997/03/23 03:53:17 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -42,16 +36,14 @@ or implied warranty.
  */
 
 int
-save_credentials(service, instance, realm, session, lifetime, kvno,
-		 ticket, issue_date)
-	char *service;		/* Service name */
-	char *instance;		/* Instance */
-	char *realm;		/* Auth domain */
-	unsigned char *session;	/* Session key */
-	int lifetime;		/* Lifetime */
-	int kvno;		/* Key version number */
-	KTEXT ticket;		/* The ticket itself */
-	int32_t issue_date;	/* The issue time */
+save_credentials(char *service,	/* Service name */
+		 char *instance, /* Instance */
+		 char *realm,	/* Auth domain */
+		 unsigned char *session, /* Session key */
+		 int lifetime,	/* Lifetime */
+		 int kvno,	/* Key version number */
+		 KTEXT ticket,	/* The ticket itself */
+		 int32_t issue_date) /* The issue time */
 {
     int tf_status;   /* return values of the tf_util calls */
 
@@ -62,6 +54,6 @@ save_credentials(service, instance, realm, session, lifetime, kvno,
     /* Save credentials by appending to the ticket file */
     tf_status = tf_save_cred(service, instance, realm, session,
 			     lifetime, kvno, ticket, issue_date);
-    (void) tf_close();
+    tf_close();
     return (tf_status);
 }
diff --git a/kerberosIV/krb/send_to_kdc.c b/kerberosIV/krb/send_to_kdc.c
index aa19c4065cb..f7a5865ad93 100644
--- a/kerberosIV/krb/send_to_kdc.c
+++ b/kerberosIV/krb/send_to_kdc.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/send_to_kdc.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: send_to_kdc.c,v 1.47 1997/11/07 17:31:38 bg Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,28 +23,15 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-
-#define S_AD_SZ sizeof(struct sockaddr_in)
+struct host {
+    struct sockaddr_in addr;
+    enum krb_host_proto proto;
+};
 
-static int krb_udp_port = 0;
-
-/* CLIENT_KRB_TIMEOUT indicates the time to wait before
- * retrying a server.  It's defined in "krb.h".
- */
-static struct timeval timeout = { CLIENT_KRB_TIMEOUT, 0};
-static char *prog = "send_to_kdc";
-static send_recv(KTEXT pkt, KTEXT rpkt, int f, struct sockaddr_in *_to, struct hostent *addrs);
-
-/*
- * This file contains two routines, send_to_kdc() and send_recv().
- * send_recv() is a static routine used by send_to_kdc().
- */
+static const char *prog = "send_to_kdc";
+static send_recv(KTEXT pkt, KTEXT rpkt, int f,
+		 struct sockaddr_in *adr, struct host *addrs,
+		 int h_hosts);
 
 /*
  * send_to_kdc() sends a message to the Kerberos authentication
@@ -79,246 +60,300 @@ static send_recv(KTEXT pkt, KTEXT rpkt, int f, struct sockaddr_in *_to, struct h
  *		  after several retries
  */
 
+/* always use the admin server */
+static int krb_use_admin_server_flag = 0;
+
 int
-send_to_kdc(pkt, rpkt, realm)
-	KTEXT pkt;
-	KTEXT rpkt;
-	char *realm;
+krb_use_admin_server(int flag)
 {
-    int i, f;
+    int old = krb_use_admin_server_flag;
+    krb_use_admin_server_flag = flag;
+    return old;
+}
+
+int
+send_to_kdc(KTEXT pkt, KTEXT rpkt, char *realm)
+{
+    int i;
     int no_host; /* was a kerberos host found? */
     int retry;
     int n_hosts;
     int retval;
-    struct sockaddr_in to;
-    struct hostent *host, *hostlist;
-    char *cp;
-    char krbhst[MAX_HSTNM];
+    struct hostent *host;
     char lrealm[REALM_SZ];
+    struct krb_host *k_host;
+    struct host *hosts = malloc(sizeof(*hosts));
+
+    if (hosts == NULL)
+	return SKDC_CANT;
 
     /*
      * If "realm" is non-null, use that, otherwise get the
      * local realm.
      */
     if (realm)
-	(void) strcpy(lrealm, realm);
+	strcpy(lrealm, realm);
     else
 	if (krb_get_lrealm(lrealm,1)) {
 	    if (krb_debug)
-		fprintf(stderr, "%s: can't get local realm\n", prog);
+		krb_warning("%s: can't get local realm\n", prog);
 	    return(SKDC_CANT);
 	}
     if (krb_debug)
-        printf("lrealm is %s\n", lrealm);
-    if (krb_udp_port == 0) {
-        register struct servent *sp;
-        if ((sp = getservbyname("kerberos","udp")) == 0) {
-            if (krb_debug)
-                fprintf(stderr, "%s: Can't get kerberos/udp service\n",
-                        prog);
-            krb_udp_port = 750; /* Was return(SKDC_CANT); */
-        }
-        else
-	    krb_udp_port = sp->s_port;
-        if (krb_debug)
-            printf("krb_udp_port is %d\n", krb_udp_port);
-    }
-    bzero((char *)&to, S_AD_SZ);
-    hostlist = (struct hostent *) malloc(sizeof(struct hostent));
-    if (!hostlist)
-        return (/*errno */SKDC_CANT);
-    if ((f = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
-        if (krb_debug)
-            fprintf(stderr,"%s: Can't open socket\n", prog);
-        return(SKDC_CANT);
-    }
-    /* from now on, exit through rtn label for cleanup */
+	krb_warning("lrealm is %s\n", lrealm);
 
     no_host = 1;
     /* get an initial allocation */
     n_hosts = 0;
-    bzero((char *)&hostlist[n_hosts], sizeof(struct hostent));
-    for (i = 1; krb_get_krbhst(krbhst, lrealm, i) == KSUCCESS; ++i) {
-        if (krb_debug) {
-            printf("Getting host entry for %s...",krbhst);
-            (void) fflush(stdout);
-        }
-        host = gethostbyname(krbhst);
+    for (i = 1; (k_host = krb_get_host(i, lrealm, krb_use_admin_server_flag)); 
+	 ++i) {
+	char *p;
+
+        if (krb_debug)
+	    krb_warning("Getting host entry for %s...", k_host->host);
+        host = gethostbyname(k_host->host);
         if (krb_debug) {
-            printf("%s.\n",
-                   host ? "Got it" : "Didn't get it");
-            (void) fflush(stdout);
+	    krb_warning("%s.\n",
+			host ? "Got it" : "Didn't get it");
         }
         if (!host)
             continue;
         no_host = 0;    /* found at least one */
-        n_hosts++;
-        /* preserve host network address to check later
-         * (would be better to preserve *all* addresses,
-         * take care of that later)
-         */
-        hostlist = (struct hostent *)
-            realloc((char *)hostlist,
-                    (unsigned)
-                    sizeof(struct hostent)*(n_hosts+1));
-        if (!hostlist)
-            return /*errno */SKDC_CANT;
-        bcopy((char *)host, (char *)&hostlist[n_hosts-1],
-              sizeof(struct hostent));
-        host = &hostlist[n_hosts-1];
-        cp = malloc((unsigned)host->h_length);
-        if (!cp) {
-            retval = /*errno */SKDC_CANT;
-            goto rtn;
-        }
-        bcopy((char *)host->h_addr, cp, host->h_length);
-/* At least Sun OS version 3.2 (or worse) and Ultrix version 2.2
-   (or worse) only return one name ... */
-#if defined(h_addr)
-        host->h_addr_list = (char **)malloc(2*sizeof(char *));
-        if (!host->h_addr_list) {
-            retval = /*errno */SKDC_CANT;
-            goto rtn;
-        }
-        host->h_addr_list[1] = NULL;
-#endif /* defined(h_addr) */
-        host->h_addr = cp;
-        bzero((char *)&hostlist[n_hosts],
-              sizeof(struct hostent));
-        to.sin_family = host->h_addrtype;
-        bcopy(host->h_addr, (char *)&to.sin_addr,
-              host->h_length);
-        to.sin_port = krb_udp_port;
-        if (send_recv(pkt, rpkt, f, &to, hostlist)) {
-            retval = KSUCCESS;
-            goto rtn;
-        }
-        if (krb_debug) {
-            printf("Timeout, error, or wrong descriptor\n");
-            (void) fflush(stdout);
-        }
+	while ((p = *(host->h_addr_list)++)) {
+	    hosts = realloc(hosts, sizeof(*hosts) * (n_hosts + 1));
+	    if (hosts == NULL)
+		return SKDC_CANT;
+	    memset (&hosts[n_hosts].addr, 0, sizeof(hosts[n_hosts].addr));
+	    hosts[n_hosts].addr.sin_family = host->h_addrtype;
+	    hosts[n_hosts].addr.sin_port = htons(k_host->port);
+	    hosts[n_hosts].proto = k_host->proto;
+	    memcpy(&hosts[n_hosts].addr.sin_addr, p,
+		   sizeof(hosts[n_hosts].addr.sin_addr));
+	    ++n_hosts;
+	    if (send_recv(pkt, rpkt, hosts[n_hosts-1].proto,
+			  &hosts[n_hosts-1].addr, hosts, n_hosts)) {
+		retval = KSUCCESS;
+		goto rtn;
+	    }
+	    if (krb_debug) {
+		krb_warning("Timeout, error, or wrong descriptor\n");
+	    }
+	}
     }
     if (no_host) {
 	if (krb_debug)
-	    fprintf(stderr, "%s: can't find any Kerberos host.\n",
-		    prog);
+	    krb_warning("%s: can't find any Kerberos host.\n",
+			prog);
         retval = SKDC_CANT;
         goto rtn;
     }
     /* retry each host in sequence */
     for (retry = 0; retry < CLIENT_KRB_RETRY; ++retry) {
-        for (host = hostlist; host->h_name != (char *)NULL; host++) {
-            to.sin_family = host->h_addrtype;
-            bcopy(host->h_addr, (char *)&to.sin_addr,
-                  host->h_length);
-            if (send_recv(pkt, rpkt, f, &to, hostlist)) {
-                retval = KSUCCESS;
-                goto rtn;
-            }
+	for (i = 0; i < n_hosts; ++i) {
+	    if (send_recv(pkt, rpkt,
+			  hosts[i].proto,
+			  &hosts[i].addr,
+			  hosts,
+			  n_hosts)) {
+		retval = KSUCCESS;
+		goto rtn;
+	    }
         }
     }
     retval = SKDC_RETRY;
 rtn:
-    (void) close(f);
-    if (hostlist) {
-        register struct hostent *hp;
-        for (hp = hostlist; hp->h_name; hp++)
-#if defined(h_addr)
-            if (hp->h_addr_list) {
-#endif /* defined(h_addr) */
-                if (hp->h_addr)
-                    free(hp->h_addr);
-#if defined(h_addr)
-                free((char *)hp->h_addr_list);
-            }
-#endif /* defined(h_addr) */
-        free((char *)hostlist);
-    }
+    free(hosts);
     return(retval);
 }
 
-/*
- * try to send out and receive message.
- * return 1 on success, 0 on failure
- */
+static int udp_socket(void)
+{
+    return socket(AF_INET, SOCK_DGRAM, 0);
+}
 
-static int
-send_recv(pkt, rpkt, f, _to, addrs)
-	KTEXT pkt;
-	KTEXT rpkt;
-	int f;
-	struct sockaddr_in *_to;
-	struct hostent *addrs;
+static int udp_connect(int s, struct sockaddr_in *adr)
+{
+    return connect(s, (struct sockaddr*)adr, sizeof(*adr));
+}
+
+static int udp_send(int s, struct sockaddr_in* adr, KTEXT pkt)
 {
-    fd_set readfds;
-    register struct hostent *hp;
-    struct sockaddr_in from;
-    int sin_size;
-    int numsent;
+    return send(s, pkt->dat, pkt->length, 0);
+}
 
-    if (krb_debug) {
-        if (_to->sin_family == AF_INET)
-            printf("Sending message to %s...",
-                   inet_ntoa(_to->sin_addr));
-        else
-            printf("Sending message...");
-        (void) fflush(stdout);
-    }
-    if ((numsent = sendto(f,(char *)(pkt->dat), pkt->length, 0, 
-			  (struct sockaddr *)_to,
-                          S_AD_SZ)) != pkt->length) {
-        if (krb_debug)
-            printf("sent only %d/%d\n",numsent, pkt->length);
-        return 0;
+static int tcp_socket(void)
+{
+    return socket(AF_INET, SOCK_STREAM, 0);
+}
+
+static int tcp_connect(int s, struct sockaddr_in *adr)
+{
+    return connect(s, (struct sockaddr*)adr, sizeof(*adr));
+}
+
+static int tcp_send(int s, struct sockaddr_in* adr, KTEXT pkt)
+{
+    unsigned char len[4];
+    krb_put_int(pkt->length, len, 4);
+    if(send(s, len, sizeof(len), 0) != sizeof(len))
+	return -1;
+    return send(s, pkt->dat, pkt->length, 0);
+}
+
+static int udptcp_recv(void *buf, size_t len, KTEXT rpkt)
+{
+    memcpy(rpkt->dat, buf, len);
+    rpkt->length = len;
+    return 0;
+}
+
+static int url_parse(const char *url, char *host, size_t len, short *port)
+{
+    const char *p;
+    if(strncmp(url, "http://", 7))
+	return -1;
+    url += 7;
+    strncpy(host, url, len);
+    p = strchr(url, ':');
+    if(p){
+	*port = atoi(p+1);
+	if(p - url >= len)
+	    return -1;
+	host[p - url] = 0;
+    }else{
+	*port = 80;
+	host[len - 1] = 0;
     }
-    if (krb_debug) {
-        printf("Sent\nWaiting for reply...");
-        (void) fflush(stdout);
+    return 0;
+}
+
+#define PROXY_VAR "krb4_proxy"
+
+static int http_connect(int s, struct sockaddr_in *adr)
+{
+    char *proxy = getenv(PROXY_VAR);
+    char host[MAXHOSTNAMELEN + 1];
+    short port;
+    struct hostent *hp;
+    struct sockaddr_in sin;
+    if(proxy == NULL)
+	return tcp_connect(s, adr);
+    if(url_parse(proxy, host, sizeof(host), &port) < 0)
+	return -1;
+    hp = gethostbyname(host);
+    if(hp == NULL)
+	return -1;
+    memset(&sin, 0, sizeof(sin));
+    sin.sin_family = AF_INET;
+    memcpy(&sin.sin_addr, hp->h_addr, sizeof(sin.sin_addr));
+    sin.sin_port = htons(port);
+    return connect(s, (struct sockaddr*)&sin, sizeof(sin));
+}
+
+static int http_send(int s, struct sockaddr_in* adr, KTEXT pkt)
+{
+    char *str;
+    char *msg;
+
+    base64_encode(pkt->dat, pkt->length, &str);
+    if(getenv(PROXY_VAR)){
+	asprintf(&msg, "GET http://%s:%d/%s HTTP/1.0\r\n\r\n",
+		 inet_ntoa(adr->sin_addr),
+		 ntohs(adr->sin_port),
+		 str);
+    }else
+	asprintf(&msg, "GET %s HTTP/1.0\r\n\r\n", str);
+    free(str);
+	
+    if(send(s, msg, strlen(msg), 0) != strlen(msg)){
+	free(msg);
+	return -1;
     }
-    FD_ZERO(&readfds);
-    FD_SET(f, &readfds);
-    errno = 0;
-    /* select - either recv is ready, or timeout */
-    /* see if timeout or error or wrong descriptor */
-    if (select(f + 1, &readfds, (fd_set *)0, (fd_set *)0, &timeout) < 1
-        || !FD_ISSET(f, &readfds)) {
-        if (krb_debug) {
-	    long rfds;
-	    bcopy(&readfds, &rfds, sizeof(rfds));
-            fprintf(stderr, "select failed: readfds=%lx",
-                    rfds);
-            perror("");
-        }
-        return 0;
+    free(msg);
+    return 0;
+}
+
+static int http_recv(void *buf, size_t len, KTEXT rpkt)
+{
+    char *p;
+    char *tmp = malloc(len + 1);
+    memcpy(tmp, buf, len);
+    tmp[len] = 0;
+    p = strstr(tmp, "\r\n\r\n");
+    if(p == NULL){
+	free(tmp);
+	return -1;
     }
-    sin_size = sizeof(from);
-    if (recvfrom(f, (char *)(rpkt->dat), sizeof(rpkt->dat), 0,
-		 (struct sockaddr *)&from, &sin_size)
-        < 0) {
-        if (krb_debug)
-            perror("recvfrom");
-        return 0;
+    p += 4;
+    memcpy(rpkt->dat, p, (tmp + len) - p);
+    rpkt->length = (tmp + len) - p;
+    free(tmp);
+    return 0;
+}
+
+static struct proto_descr {
+    int proto;
+    int stream_flag;
+    int (*socket)(void);
+    int (*connect)(int, struct sockaddr_in*);
+    int (*send)(int, struct sockaddr_in*, KTEXT);
+    int (*recv)(void*, size_t, KTEXT);
+} protos[] = {
+    { PROTO_UDP, 0, udp_socket, udp_connect, udp_send, udptcp_recv },
+    { PROTO_TCP, 1, tcp_socket, tcp_connect, tcp_send, udptcp_recv },
+    { PROTO_HTTP, 1, tcp_socket, http_connect, http_send, http_recv }
+};
+
+static int
+send_recv(KTEXT pkt, KTEXT rpkt, int proto, struct sockaddr_in *adr,
+	  struct host *addrs, int n_hosts)
+{
+    int i;
+    int s;
+    unsigned char buf[2048];
+    int offset = 0;
+    
+    for(i = 0; i < sizeof(protos) / sizeof(protos[0]); i++){
+	if(protos[i].proto == proto)
+	    break;
     }
-    if (krb_debug) {
-        printf("received packet from %s\n", inet_ntoa(from.sin_addr));
-        fflush(stdout);
+    if(i == sizeof(protos) / sizeof(protos[0]))
+	return FALSE;
+    if((s = (*protos[i].socket)()) < 0)
+	return FALSE;
+    if((*protos[i].connect)(s, adr) < 0){
+	close(s);
+	return FALSE;
     }
-    for (hp = addrs; hp->h_name != (char *)NULL; hp++) {
-        if (!bcmp(hp->h_addr, (char *)&from.sin_addr.s_addr,
-                  hp->h_length)) {
-            if (krb_debug) {
-                printf("Received it\n");
-                (void) fflush(stdout);
-            }
-            return 1;
-        }
-        if (krb_debug)
-            fprintf(stderr,
-                    "packet not from %lx\n",
-                    from.sin_addr.s_addr);
+    if((*protos[i].send)(s, adr, pkt) < 0){
+	close(s);
+	return FALSE;
     }
-    if (krb_debug)
-        fprintf(stderr, "%s: received packet from wrong host! (%x)\n",
-                "send_to_kdc(send_rcv)", (int)from.sin_addr.s_addr);
-    return 0;
+    do{
+	fd_set readfds;
+	struct timeval timeout;
+	int len;
+	timeout.tv_sec = CLIENT_KRB_TIMEOUT;
+	timeout.tv_usec = 0;
+	FD_ZERO(&readfds);
+	FD_SET(s, &readfds);
+	
+	/* select - either recv is ready, or timeout */
+	/* see if timeout or error or wrong descriptor */
+	if(select(s + 1, &readfds, 0, 0, &timeout) < 1 
+	   || !FD_ISSET(s, &readfds)) {
+	    if (krb_debug)
+		krb_warning("select failed: errno = %d\n", errno);
+	    close(s);
+	    return FALSE;
+	}
+	len = recv(s, buf + offset, sizeof(buf) - offset, 0);
+	if(len <= 0)
+	    break;
+	offset += len;
+    }while(protos[i].stream_flag);
+    close(s);
+    if((*protos[i].recv)(buf, offset, rpkt) < 0)
+	return FALSE;
+    return TRUE;
 }
diff --git a/kerberosIV/krb/sendauth.c b/kerberosIV/krb/sendauth.c
index 14637548597..96ff7c30ba5 100644
--- a/kerberosIV/krb/sendauth.c
+++ b/kerberosIV/krb/sendauth.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/sendauth.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: sendauth.c,v 1.15 1997/04/18 14:11:36 joda Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,25 +23,10 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <syslog.h>
-
 /*
- * If the protocol changes, you will need to change the version string
- * and make appropriate changes in krb_recvauth.c
- */
-#define	KRB_SENDAUTH_VERS "AUTHV0.1" /* MUST be KRB_SENDAUTH_VLEN chars */
-
-
-/*
- * This file contains two routines: krb_sendauth() and krb_sendsrv().
- *
  * krb_sendauth() transmits a ticket over a file descriptor for a
  * desired service, instance, and realm, doing mutual authentication
  * with the server if desired.
- *
- * krb_sendsvc() sends a service name to a remote knetd server.
  */
 
 /*
@@ -113,157 +92,72 @@ or implied warranty.
  * ticket->length	ticket->dat		ticket itself
  */
 
-/*
- * XXX: Note that krb_rd_priv() is coded in such a way that
- * "msg_data->app_data" will be pointing into "priv_buf", which
- * will disappear when krb_sendauth() returns.
- */
-
 int
-krb_sendauth(options, fd, ticket, service, inst, realm, checksum,
-	     msg_data, cred, schedule, laddr, faddr, version)
-	int32_t options;	/* bit-pattern of options */
-	int fd;			/* file descriptor to write onto */
-	KTEXT ticket;		/* where to put ticket (return); or
+krb_sendauth(int32_t options,	/* bit-pattern of options */
+	     int fd,		/* file descriptor to write onto */
+	     KTEXT ticket,	/* where to put ticket (return); or
 				 * supplied in case of KOPT_DONT_MK_REQ */
-	char *service;		/* service name, instance, realm */
-	char *inst;		/* checksum to include in request */
-	char *realm;		/* mutual auth MSG_DAT (return) */
-	u_int32_t checksum;	/* credentials (return) */
-	MSG_DAT *msg_data;	/* key schedule (return) */
-	CREDENTIALS *cred;	/* local address */
-	struct des_ks_struct *schedule;
-	struct sockaddr_in *faddr; /* address of foreign host on fd */
-	struct sockaddr_in *laddr;
-	char *version;		/* version string */
+	     char *service,	/* service name, instance, realm */
+	     char *instance,
+	     char *realm,
+	     u_int32_t checksum, /* checksum to include in request */
+	     MSG_DAT *msg_data,	/* mutual auth MSG_DAT (return) */
+	     CREDENTIALS *cred,	/* credentials (return) */
+	     struct des_ks_struct *schedule, /* key schedule (return) */
+	     struct sockaddr_in *laddr, /* local address */
+	     struct sockaddr_in *faddr,	/* address of foreign host on fd */
+	     char *version)	/* version string */
 {
-    int rem, i, cc;
-    char srv_inst[INST_SZ];
-    char krb_realm[REALM_SZ];
-    char buf[BUFSIZ];
-    u_int32_t tkt_len;
-    u_char priv_buf[1024];
-    u_int32_t cksum;
-
-    rem=KSUCCESS;
-
-    /* get current realm if not passed in */
-    if (!realm) {
-	rem = krb_get_lrealm(krb_realm,1);
-	if (rem != KSUCCESS)
-	    return(rem);
-	realm = krb_realm;
-    }
-
-    /* copy instance into local storage, canonicalizing if desired */
-    if (options & KOPT_DONT_CANON)
-	(void) strncpy(srv_inst, inst, INST_SZ);
-    else
-	(void) strncpy(srv_inst, krb_get_phost(inst), INST_SZ);
-
-    /* get the ticket if desired */
-    if (!(options & KOPT_DONT_MK_REQ)) {
-	rem = krb_mk_req(ticket, service, srv_inst, realm, checksum);
-	if (rem != KSUCCESS)
-	    return(rem);
-    }
-
-#ifdef ATHENA_COMPAT
-    /* this is only for compatibility with old servers */
-    if (options & KOPT_DO_OLDSTYLE) {
-	(void) snprintf(buf, sizeof(buf), "%d ", ticket->length);
-	(void) write(fd, buf, strlen(buf));
-	(void) write(fd, (char *) ticket->dat, ticket->length);
-	return(rem);
+    int ret;
+    KTEXT_ST buf;
+    char realrealm[REALM_SZ];
+
+    if (realm == NULL) {
+	ret = krb_get_lrealm (realrealm, 1);
+	if (ret != KSUCCESS)
+	    return ret;
+	realm = realrealm;
     }
-#endif /* ATHENA_COMPAT */
-    /* if mutual auth, get credentials so we have service session
-       keys for decryption below */
-    if (options & KOPT_DO_MUTUAL)
-	if ((cc = krb_get_cred(service, srv_inst, realm, cred)))
-	    return(cc);
-
-    /* zero the buffer */
-    (void) bzero(buf, BUFSIZ);
-
-    /* insert version strings */
-    (void) strncpy(buf, KRB_SENDAUTH_VERS, KRB_SENDAUTH_VLEN);
-    (void) strncpy(buf+KRB_SENDAUTH_VLEN, version, KRB_SENDAUTH_VLEN);
-
-    /* increment past vers strings */
-    i = 2*KRB_SENDAUTH_VLEN;
-
-    /* put ticket length into buffer */
-    tkt_len = htonl(ticket->length);
-    (void) bcopy((char *) &tkt_len, buf+i, sizeof(tkt_len));
-    i += sizeof(tkt_len);
-
-    /* put ticket into buffer */
-    (void) bcopy((char *) ticket->dat, buf+i, ticket->length);
-    i += ticket->length;
-
-    /* write the request to the server */
-    if ((cc = krb_net_write(fd, buf, i)) != i)
-	return(cc);
-
-    /* mutual authentication, if desired */
+    ret = krb_mk_auth (options, ticket, service, instance, realm, checksum,
+		       version, &buf);
+    if (ret != KSUCCESS)
+	return ret;
+    ret = krb_net_write(fd, buf.dat, buf.length);
+    if(ret < 0)
+	return -1;
+      
     if (options & KOPT_DO_MUTUAL) {
-	/* get the length of the reply */
-	if (krb_net_read(fd, (char *) &tkt_len, sizeof(tkt_len)) !=
-	    sizeof(tkt_len))
-	    return(errno);
-	tkt_len = ntohl(tkt_len);
-
-	/* if the length is negative, the server failed to recognize us. */
-	if ((tkt_len < 0) || (tkt_len > sizeof(priv_buf)))
-	    return(KFAILURE);	 /* XXX */
-	/* read the reply... */
-	if (krb_net_read(fd, (char *)priv_buf, (int) tkt_len) != (int) tkt_len)
-	    return(errno);
-
-	/* ...and decrypt it */
-#ifndef NOENCRYPTION
-	des_key_sched(&cred->session,schedule);
-#endif
-	if ((cc = krb_rd_priv(priv_buf, tkt_len, schedule,
-			     &cred->session, faddr, laddr, msg_data)))
-	    return(cc);
-
-	/* fetch the (modified) checksum */
-	(void) bcopy((char *)msg_data->app_data, (char *)&cksum,
-		     sizeof(cksum));
-	cksum = ntohl(cksum);
-
-	/* if it doesn't match, fail */
-	if (cksum != checksum + 1)
-	    return(KFAILURE);	 /* XXX */
+	char tmp[4];
+	u_int32_t len;
+	char inst[INST_SZ];
+
+	ret = krb_net_read (fd, tmp, 4);
+	if (ret < 0)
+	    return -1;
+
+	krb_get_int (tmp, &len, 4, 0);
+	if (len == 0xFFFFFFFF || len > sizeof(buf.dat))
+	    return KFAILURE;
+	buf.length = len;
+	ret = krb_net_read (fd, buf.dat, len);
+	if (ret < 0)
+	    return -1;
+
+	if (options & KOPT_DONT_CANON)
+	    strncpy (inst, instance, sizeof(inst));
+	else
+	    strncpy (inst, krb_get_phost(instance), sizeof(inst));
+
+	ret = krb_get_cred (service, inst, realm, cred);
+	if (ret != KSUCCESS)
+	    return ret;
+
+	des_key_sched(&cred->session, schedule);
+
+	ret = krb_check_auth (&buf, checksum, msg_data, &cred->session, 
+			      schedule, laddr, faddr);
+	if (ret != KSUCCESS)
+	    return ret;
     }
-    return(KSUCCESS);
-}
-
-#ifdef ATHENA_COMPAT
-/*
- * krb_sendsvc
- */
-
-int
-krb_sendsvc(fd, service)
-	int fd;
-	char *service;
-{
-    /* write the service name length and then the service name to
-       the fd */
-    u_int32_t serv_length;
-    int cc;
-
-    serv_length = htonl(strlen(service));
-    if ((cc = krb_net_write(fd, (char *) &serv_length,
-	sizeof(serv_length)))
-	!= sizeof(serv_length))
-	return(cc);
-    if ((cc = krb_net_write(fd, service, strlen(service)))
-	!= strlen(service))
-	return(cc);
-    return(KSUCCESS);
+    return KSUCCESS;
 }
-#endif /* ATHENA_COMPAT */
diff --git a/kerberosIV/krb/shlib_version b/kerberosIV/krb/shlib_version
index 890c57389b5..3066b9771e7 100644
--- a/kerberosIV/krb/shlib_version
+++ b/kerberosIV/krb/shlib_version
@@ -1,2 +1,2 @@
-major=4
-minor=1
+major=5
+minor=0
diff --git a/kerberosIV/krb/fgetst.c b/kerberosIV/krb/stime.c
index dfc268fb3f2..b3f5ce270ec 100644
--- a/kerberosIV/krb/fgetst.c
+++ b/kerberosIV/krb/stime.c
@@ -1,14 +1,8 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/fgetst.c,v $
- *
- * $Locker:  $
- */
-
-/* 
-  Copyright (C) 1989 by the Massachusetts Institute of Technology
+/* $KTH: stime.c,v 1.6 1997/05/02 14:29:20 assar Exp $ */
 
+/*
+  Copyright 1985, 1986, 1987, 1988 by the Massachusetts Institute of Technology.
+ 
    Export of this software from the United States of America is assumed
    to require a specific license from the United States Government.
    It is the responsibility of any person or organization contemplating
@@ -25,31 +19,28 @@ permission.  M.I.T. makes no representations about the suitability of
 this software for any purpose.  It is provided "as is" without express
 or implied warranty.
 
-  */
+ */
 
 #include "krb_locl.h"
 
 /*
- * fgetst takes a file descriptor, a character pointer, and a count.
- * It reads from the file it has either read "count" characters, or
- * until it reads a null byte.  When finished, what has been read exists
- * in "s". If "count" characters were actually read, the last is changed
- * to a null, so the returned string is always null-terminated.  fgetst
- * returns the number of characters read, including the null terminator. 
+ * Given a pointer to a long containing the number of seconds
+ * since the beginning of time (midnight 1 Jan 1970 GMT), return
+ * a string containing the local time in the form:
+ *
+ * "25-Jan-1988 10:17:56"
  */
 
-int
-fgetst(f, s, n)
-	FILE *f;
-	register char *s;
-	int n;
+const char *
+krb_stime(time_t *t)
 {
-    register count = n;
-    int     ch;		/* NOT char; otherwise you don't see EOF */
-
-    while ((ch = getc(f)) != EOF && ch && --count) {
-	*s++ = ch;
-    }
-    *s = '\0';
-    return (n - count);
+    static char st[40];
+    struct tm *tm;
+
+    tm = localtime(t);
+    snprintf(st, sizeof(st),
+	     "%2d-%s-%04d %02d:%02d:%02d",tm->tm_mday,
+	     month_sname(tm->tm_mon + 1),tm->tm_year + 1900,
+	     tm->tm_hour, tm->tm_min, tm->tm_sec);
+    return st;
 }
diff --git a/kerberosIV/krb/str2key.c b/kerberosIV/krb/str2key.c
index 681f4bfee57..8e967a63610 100644
--- a/kerberosIV/krb/str2key.c
+++ b/kerberosIV/krb/str2key.c
@@ -1,13 +1,6 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/str2key.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: str2key.c,v 1.10 1997/03/23 03:53:19 joda Exp $ */
 
-/*
- * This defines the Andrew string_to_key function.  It accepts a password
+/* This defines the Andrew string_to_key function.  It accepts a password
  * string as input and converts its via a one-way encryption algorithm to a DES
  * encryption key.  It is compatible with the original Andrew authentication
  * service password database.
@@ -15,13 +8,8 @@
 
 #include "krb_locl.h"
 
-/*
-EXPORT void afs_string_to_key(char *passwd, char *cell, des_cblock *key);
-*/
-
 static void
-mklower(s)
-	char *s;
+mklower(char *s)
 {
     for (; *s; s++)
         if ('A' <= *s && *s <= 'Z')
@@ -32,17 +20,14 @@ mklower(s)
  * Short passwords, i.e 8 characters or less.
  */
 static void
-afs_cmu_StringToKey (str, cell, key)
-	char *str;
-	char *cell;
-	des_cblock *key;
+afs_cmu_StringToKey (char *str, char *cell, des_cblock *key)
 {
     char  password[8+1];	/* crypt is limited to 8 chars anyway */
     int   i;
     int   passlen;
 
-    bzero (key, sizeof(key));
-    bzero(password, sizeof(password));
+    memset (key, 0, sizeof(key));
+    memset(password, 0, sizeof(password));
 
     strncpy (password, cell, 8);
     passlen = strlen (str);
@@ -56,7 +41,7 @@ afs_cmu_StringToKey (str, cell, key)
 
     /* crypt only considers the first 8 characters of password but for some
        reason returns eleven characters of result (plus the two salt chars). */
-    strncpy((void *)key, (char *)des_crypt(password, "#~") + 2, sizeof(des_cblock));
+    strncpy((char *)key, (char *)crypt(password, "#~") + 2, sizeof(des_cblock));
 
     /* parity is inserted into the LSB so leftshift each byte up one bit.  This
        allows ascii characters with a zero MSB to retain as much significance
@@ -72,38 +57,30 @@ afs_cmu_StringToKey (str, cell, key)
     des_fixup_key_parity (key);
 }
 
-#undef  BUFSIZ
-#define	BUFSIZ		512
-
 /*
  * Long passwords, i.e 9 characters or more.
-*/
+ */
 static void
-afs_transarc_StringToKey (str, cell, key)
-	char *str;
-	char *cell;
-	des_cblock *key;
+afs_transarc_StringToKey (char *str, char *cell, des_cblock *key)
 {
     des_key_schedule schedule;
     des_cblock temp_key;
     des_cblock ivec;
-    char password[BUFSIZ];
+    char password[512];
     int  passlen;
 
-    strncpy (password, str, sizeof(password)-1);
-    password[sizeof(password)-1] = '\0';
+    strncpy (password, str, sizeof(password));
     if ((passlen = strlen (password)) < sizeof(password)-1)
         strncat (password, cell, sizeof(password)-passlen);
-    if ((passlen = strlen(password)) > sizeof(password))
-	passlen = sizeof(password);
+    if ((passlen = strlen(password)) > sizeof(password)) passlen = sizeof(password);
 
-    bcopy ("kerberos", &ivec, 8);
-    bcopy ("kerberos", &temp_key, 8);
+    memcpy(&ivec, "kerberos", 8);
+    memcpy(&temp_key, "kerberos", 8);
     des_fixup_key_parity (&temp_key);
     des_key_sched (&temp_key, schedule);
     des_cbc_cksum ((des_cblock *)password, &ivec, passlen, schedule, &ivec);
 
-    bcopy (&ivec, &temp_key, 8);
+    memcpy(&temp_key, &ivec, 8);
     des_fixup_key_parity (&temp_key);
     des_key_sched (&temp_key, schedule);
     des_cbc_cksum ((des_cblock *)password, key, passlen, schedule, &ivec);
@@ -111,18 +88,13 @@ afs_transarc_StringToKey (str, cell, key)
     des_fixup_key_parity (key);
 }
 
-#undef  REALM_SZ
-#define	REALM_SZ	41
-
 void
-afs_string_to_key(str, cell, key)
-	char *str;
-	char *cell;
-	des_cblock *key;
+afs_string_to_key(char *str, char *cell, des_cblock *key)
 {
-    char  realm[REALM_SZ];
-    (void)strcpy(realm, cell);
-    (void)mklower(realm);
+    char realm[REALM_SZ+1];
+    strncpy(realm, cell, REALM_SZ);
+    realm[REALM_SZ] = 0;
+    mklower(realm);
 
     if (strlen(str) > 8)
         afs_transarc_StringToKey (str, realm, key);
diff --git a/kerberosIV/krb/strtok_r.c b/kerberosIV/krb/strtok_r.c
new file mode 100644
index 00000000000..30c4874d469
--- /dev/null
+++ b/kerberosIV/krb/strtok_r.c
@@ -0,0 +1,61 @@
+/* $KTH: strtok_r.c,v 1.4 1997/05/19 03:05:47 assar Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <string.h>
+
+char *
+strtok_r(char *s1, const char *s2, char **lasts)
+{
+  char *ret;
+
+  if (s1 == NULL)
+    s1 = *lasts;
+  while(*s1 && strchr(s2, *s1))
+    ++s1;
+  if(*s1 == '\0')
+    return NULL;
+  ret = s1;
+  while(*s1 && !strchr(s2, *s1))
+    ++s1;
+  if(*s1)
+    *s1++ = '\0';
+  *lasts = s1;
+  return ret;
+}
diff --git a/kerberosIV/krb/tf_util.c b/kerberosIV/krb/tf_util.c
index 37254df1cc1..f37c2f242d6 100644
--- a/kerberosIV/krb/tf_util.c
+++ b/kerberosIV/krb/tf_util.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/tf_util.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: tf_util.c,v 1.25 1997/11/04 09:44:28 bg Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -26,29 +20,18 @@ this software for any purpose.  It is provided "as is" without express
 or implied warranty.
 
   */
-
+        
 #include "krb_locl.h"
 
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/file.h>
-
-#ifdef TKT_SHMEM
-#include <sys/param.h>
-#include <sys/ipc.h>
-#include <sys/shm.h>
-#endif /* TKT_SHMEM */
-
 #define TOO_BIG -1
 #define TF_LCK_RETRY ((unsigned)2)	/* seconds to sleep before
 					 * retry if ticket file is
 					 * locked */
+#define	TF_LCK_RETRY_COUNT	(50)	/* number of retries	*/
 
-#ifdef TKT_SHMEM
-static char *krb_shm_addr = 0;
-static char *tmp_shm_addr = 0;
-static char krb_dummy_skey[8] = {0,0,0,0,0,0,0,0};
-#endif /* TKT_SHMEM */
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
 
 /*
  * fd must be initialized to something that won't ever occur as a real
@@ -63,12 +46,13 @@ static char krb_dummy_skey[8] = {0,0,0,0,0,0,0,0};
  *	c. In tf_close, be sure it gets reinitialized to a negative
  *	   number. 
  */
-static  fd = -1;
-static	curpos;				/* Position in tfbfr */
-static	lastpos;			/* End of tfbfr */
+static  int fd = -1;
+static	int curpos;				/* Position in tfbfr */
+static	int lastpos;			/* End of tfbfr */
 static	char tfbfr[BUFSIZ];		/* Buffer for ticket data */
 
-static tf_gets(register char *s, int n), tf_read(register char *s, register int n);
+static int tf_gets(char *s, int n);
+static int tf_read(void *s, int n);
 
 /*
  * This file contains routines for manipulating the ticket cache file.
@@ -101,8 +85,12 @@ static tf_gets(register char *s, int n), tf_read(register char *s, register int
  *
  * tf_get_pname() returns the principal's name.
  *
+ * tf_put_pname() writes the principal's name to the ticket file.
+ *
  * tf_get_pinst() returns the principal's instance (may be null).
  *
+ * tf_put_pinst() writes the instance.
+ *
  * tf_get_cred() returns the next CREDENTIALS record.
  *
  * tf_save_cred() appends a new CREDENTIAL record to the ticket file.
@@ -133,133 +121,148 @@ static tf_gets(register char *s, int n), tf_read(register char *s, register int
  */
 
 int
-tf_init(tf_name, rw)
-	char *tf_name;
-	int rw;
+tf_init(char *tf_name, int rw)
 {
-    int     wflag;
-    uid_t   me, getuid(void);
-    struct stat stat_buf;
-#ifdef TKT_SHMEM
-    char shmidname[MaxPathLen]; 
-    FILE *sfp;
-    int shmid;
-#endif
-
-    switch (rw) {
-    case R_TKT_FIL:
-	wflag = 0;
-	break;
-    case W_TKT_FIL:
-	wflag = 1;
-	break;
+  /* Unix implementation */
+  int wflag;
+  struct stat stat_buf;
+  int i_retry;
+
+  switch (rw) {
+  case R_TKT_FIL:
+    wflag = 0;
+    break;
+  case W_TKT_FIL:
+    wflag = 1;
+    break;
+  default:
+    if (krb_debug)
+      krb_warning("tf_init: illegal parameter\n");
+    return TKT_FIL_ACC;
+  }
+  if (lstat(tf_name, &stat_buf) < 0)
+    switch (errno) {
+    case ENOENT:
+      return NO_TKT_FIL;
     default:
-	if (krb_debug) fprintf(stderr, "tf_init: illegal parameter\n");
-	return TKT_FIL_ACC;
+      return TKT_FIL_ACC;
     }
-    if (lstat(tf_name, &stat_buf) < 0)
-	switch (errno) {
-	case ENOENT:
-	    return NO_TKT_FIL;
-	default:
-	    return TKT_FIL_ACC;
-	}
-    me = getuid();
-    if ((stat_buf.st_uid != me && me != 0) ||
-	((stat_buf.st_mode & S_IFMT) != S_IFREG))
-	return TKT_FIL_ACC;
-#ifdef TKT_SHMEM
-    (void) strcpy(shmidname, tf_name);
-    (void) strcat(shmidname, ".shm");
-    if (stat(shmidname,&stat_buf) < 0)
-	return(TKT_FIL_ACC);
-    if ((stat_buf.st_uid != me && me != 0) ||
-	((stat_buf.st_mode & S_IFMT) != S_IFREG))
-	return TKT_FIL_ACC;
-#endif /* TKT_SHMEM */
-
-    /*
-     * If "wflag" is set, open the ticket file in append-writeonly mode
-     * and lock the ticket file in exclusive mode.  If unable to lock
-     * the file, sleep and try again.  If we fail again, return with the
-     * proper error message. 
-     */
-
-    curpos = sizeof(tfbfr);
-
-#ifdef TKT_SHMEM
-    sfp = fopen(shmidname, "r");	/* only need read/write on the
-					   actual tickets */
-    if (sfp == 0)
-    	return TKT_FIL_ACC;
-    shmid = -1;
-    {
-	char buf[BUFSIZ];
-	int val;			/* useful for debugging fscanf */
-	/* We provide our own buffer here since some STDIO libraries
-	   barf on unbuffered input with fscanf() */
-
-	setbuf(sfp, buf);
-	if ((val = fscanf(sfp,"%d",&shmid)) != 1) {
-	    (void) fclose(sfp);
-	    return TKT_FIL_ACC;
-	}
-	if (shmid < 0) {
-	    (void) fclose(sfp);
-	    return TKT_FIL_ACC;
-	}
-	(void) fclose(sfp);
+  if (!S_ISREG(stat_buf.st_mode))
+    return TKT_FIL_ACC;
+
+  /* The code tries to guess when the calling program is running
+   * set-uid and prevent unauthorized access.
+   *
+   * All library functions now assume that the right set of userids
+   * are set upon entry, therefore it's not strictly necessary to
+   * perform these test for programs adhering to these assumptions.
+   */
+  {
+    uid_t me = getuid();
+    if (stat_buf.st_uid != me && me != 0)
+      return TKT_FIL_ACC;
+  }
+
+  /*
+   * If "wflag" is set, open the ticket file in append-writeonly mode
+   * and lock the ticket file in exclusive mode.  If unable to lock
+   * the file, sleep and try again.  If we fail again, return with the
+   * proper error message. 
+   */
+
+  curpos = sizeof(tfbfr);
+
+    
+  if (wflag) {
+    fd = open(tf_name, O_RDWR | O_BINARY, 0600);
+    if (fd < 0) {
+      return TKT_FIL_ACC;
     }
-    /*
-    * global krb_shm_addr is initialized to 0.  Ultrix bombs when you try and
-    * attach the same segment twice so we need this check.
-    */
-    if (!krb_shm_addr) {
-    	if ((krb_shm_addr = shmat(shmid,0,0)) == -1){
-		if (krb_debug)
-		    fprintf(stderr,
-			    "cannot attach shared memory for segment %d\n",
-			    shmid);
-		krb_shm_addr = 0;	/* reset so we catch further errors */
-		return TKT_FIL_ACC;
-	    }
+    for (i_retry = 0; i_retry < TF_LCK_RETRY_COUNT; i_retry++) {
+      if (k_flock(fd, K_LOCK_EX | K_LOCK_NB) < 0) {
+	if (krb_debug)
+	  krb_warning("tf_init: retry %d of write lock of `%s'.\n",
+		      i_retry, tf_name);
+	sleep (TF_LCK_RETRY);
+      } else {
+	return KSUCCESS;		/* all done */
+      }
     }
-    tmp_shm_addr = krb_shm_addr;
-#endif /* TKT_SHMEM */
-    
-    if (wflag) {
-	fd = open(tf_name, O_RDWR, 0600);
-	if (fd < 0) {
-	    return TKT_FIL_ACC;
-	}
-	if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
-	    sleep(TF_LCK_RETRY);
-	    if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
-		(void) close(fd);
-		fd = -1;
-		return TKT_FIL_LCK;
-	    }
-	}
-	return KSUCCESS;
+    close (fd);
+    fd = -1;
+    return TKT_FIL_LCK;
+  }
+  /*
+   * Otherwise "wflag" is not set and the ticket file should be opened
+   * for read-only operations and locked for shared access. 
+   */
+
+  fd = open(tf_name, O_RDONLY | O_BINARY, 0600);
+  if (fd < 0) {
+    return TKT_FIL_ACC;
+  }
+
+  for (i_retry = 0; i_retry < TF_LCK_RETRY_COUNT; i_retry++) {
+    if (k_flock(fd, K_LOCK_SH | K_LOCK_NB) < 0) {
+      if (krb_debug)
+	krb_warning("tf_init: retry %d of read lock of `%s'.\n",
+		    i_retry, tf_name);
+      sleep (TF_LCK_RETRY);
+    } else {
+      return KSUCCESS;		/* all done */
     }
-    /*
-     * Otherwise "wflag" is not set and the ticket file should be opened
-     * for read-only operations and locked for shared access. 
-     */
+  }
+  /* failure */
+  close(fd);
+  fd = -1;
+  return TKT_FIL_LCK;
+}
 
-    fd = open(tf_name, O_RDONLY, 0600);
-    if (fd < 0) {
-	return TKT_FIL_ACC;
+/*
+ * tf_create() should be called when creating a new ticket file.
+ * The only argument is the name of the ticket file.
+ * After calling this, it should be possible to use other tf_* functions.
+ *
+ * New algoritm for creating ticket file:
+ * 1. try to erase contents of existing file.
+ * 2. try to remove old file.
+ * 3. try to open with O_CREAT and O_EXCL
+ * 4. if this fails, someone has created a file in between 1 and 2 and
+ *    we should fail.  Otherwise, all is wonderful.
+ */
+
+int
+tf_create(char *tf_name)
+{
+  struct stat statbuf;
+  char garbage[BUFSIZ];
+
+  fd = open(tf_name, O_RDWR | O_BINARY, 0);
+  if (fd >= 0) {
+    if (fstat (fd, &statbuf) == 0) {
+      int i;
+
+      for (i = 0; i < statbuf.st_size; i += sizeof(garbage))
+	write (fd, garbage, sizeof(garbage));
     }
-    if (flock(fd, LOCK_SH | LOCK_NB) < 0) {
-	sleep(TF_LCK_RETRY);
-	if (flock(fd, LOCK_SH | LOCK_NB) < 0) {
-	    (void) close(fd);
-	    fd = -1;
-	    return TKT_FIL_LCK;
-	}
+    close (fd);
+  }
+
+  if (unlink (tf_name) && errno != ENOENT)
+    return TKT_FIL_ACC;
+
+  fd = open(tf_name, O_RDWR | O_CREAT | O_EXCL | O_BINARY, 0600);
+  if (fd < 0)
+    return TKT_FIL_ACC;
+  if (k_flock(fd, K_LOCK_EX | K_LOCK_NB) < 0) {
+    sleep(TF_LCK_RETRY);
+    if (k_flock(fd, K_LOCK_EX | K_LOCK_NB) < 0) {
+      close(fd);
+      fd = -1;
+      return TKT_FIL_LCK;
     }
-    return KSUCCESS;
+  }
+  return KSUCCESS;
 }
 
 /*
@@ -272,17 +275,41 @@ tf_init(tf_name, rw)
  */
 
 int
-tf_get_pname(p)
-	char *p;
+tf_get_pname(char *p)
 {
-    if (fd < 0) {
-	if (krb_debug)
-	    fprintf(stderr, "tf_get_pname called before tf_init.\n");
-	return TKT_FIL_INI;
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning("tf_get_pname called before tf_init.\n");
+    return TKT_FIL_INI;
+  }
+  if (tf_gets(p, ANAME_SZ) < 2)	/* can't be just a null */
+    {
+      if (krb_debug) 
+	krb_warning ("tf_get_pname: pname < 2.\n");
+      return TKT_FIL_FMT;
     }
-    if (tf_gets(p, ANAME_SZ) < 2)	/* can't be just a null */
-	return TKT_FIL_FMT;
-    return KSUCCESS;
+  return KSUCCESS;
+}
+
+/*
+ * tf_put_pname() sets the principal's name in the ticket file. Call
+ * after tf_create().
+ */
+
+int
+tf_put_pname(char *p)
+{
+  unsigned count;
+
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning("tf_put_pname called before tf_create.\n");
+    return TKT_FIL_INI;
+  }
+  count = strlen(p)+1;
+  if (write(fd,p,count) != count)
+    return(KFAILURE);
+  return KSUCCESS;
 }
 
 /*
@@ -296,17 +323,41 @@ tf_get_pname(p)
  */
 
 int
-tf_get_pinst(inst)
-	char *inst;
+tf_get_pinst(char *inst)
 {
-    if (fd < 0) {
-	if (krb_debug)
-	    fprintf(stderr, "tf_get_pinst called before tf_init.\n");
-	return TKT_FIL_INI;
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning("tf_get_pinst called before tf_init.\n");
+    return TKT_FIL_INI;
+  }
+  if (tf_gets(inst, INST_SZ) < 1)
+    {
+      if (krb_debug)
+	krb_warning("tf_get_pinst: inst_sz < 1.\n");
+      return TKT_FIL_FMT;
     }
-    if (tf_gets(inst, INST_SZ) < 1)
-	return TKT_FIL_FMT;
-    return KSUCCESS;
+  return KSUCCESS;
+}
+
+/*
+ * tf_put_pinst writes the principal's instance to the ticket file.
+ * Call after tf_create.
+ */
+
+int
+tf_put_pinst(char *inst)
+{
+  unsigned count;
+
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning("tf_put_pinst called before tf_create.\n");
+    return TKT_FIL_INI;
+  }
+  count = strlen(inst)+1;
+  if (write(fd,inst,count) != count)
+    return(KFAILURE);
+  return KSUCCESS;
 }
 
 /*
@@ -321,61 +372,68 @@ tf_get_pinst(inst)
  */
 
 int
-tf_get_cred(c)
-	CREDENTIALS *c;
+tf_get_cred(CREDENTIALS *c)
 {
-    KTEXT   ticket = &c->ticket_st;	/* pointer to ticket */
-    int     k_errno;
-
-    if (fd < 0) {
-	if (krb_debug)
-	    fprintf(stderr, "tf_get_cred called before tf_init.\n");
-	return TKT_FIL_INI;
+  KTEXT   ticket = &c->ticket_st;	/* pointer to ticket */
+  int     k_errno;
+
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning ("tf_get_cred called before tf_init.\n");
+    return TKT_FIL_INI;
+  }
+  if ((k_errno = tf_gets(c->service, SNAME_SZ)) < 2)
+    switch (k_errno) {
+    case TOO_BIG:
+      if (krb_debug)
+	krb_warning("tf_get_cred: too big service cred.\n");
+    case 1:		/* can't be just a null */
+      tf_close();
+      if (krb_debug)
+	krb_warning("tf_get_cred: null service cred.\n");
+      return TKT_FIL_FMT;
+    case 0:
+      return EOF;
     }
-    if ((k_errno = tf_gets(c->service, SNAME_SZ)) < 2)
-	switch (k_errno) {
-	case TOO_BIG:
-	case 1:		/* can't be just a null */
-	    tf_close();
-	    return TKT_FIL_FMT;
-	case 0:
-	    return EOF;
-	}
-    if ((k_errno = tf_gets(c->instance, INST_SZ)) < 1)
-	switch (k_errno) {
-	case TOO_BIG:
-	    return TKT_FIL_FMT;
-	case 0:
-	    return EOF;
-	}
-    if ((k_errno = tf_gets(c->realm, REALM_SZ)) < 2)
-	switch (k_errno) {
-	case TOO_BIG:
-	case 1:		/* can't be just a null */
-	    tf_close();
-	    return TKT_FIL_FMT;
-	case 0:
-	    return EOF;
-	}
-    if (
-	tf_read((char *) (c->session), DES_KEY_SZ) < 1 ||
-	tf_read((char *) &(c->lifetime), sizeof(c->lifetime)) < 1 ||
-	tf_read((char *) &(c->kvno), sizeof(c->kvno)) < 1 ||
-	tf_read((char *) &(ticket->length), sizeof(ticket->length))
-	< 1 ||
-    /* don't try to read a silly amount into ticket->dat */
-	ticket->length > MAX_KTXT_LEN ||
-	tf_read((char *) (ticket->dat), ticket->length) < 1 ||
-	tf_read((char *) &(c->issue_date), sizeof(c->issue_date)) < 1
-	) {
-	tf_close();
-	return TKT_FIL_FMT;
+  if ((k_errno = tf_gets(c->instance, INST_SZ)) < 1)
+    switch (k_errno) {
+    case TOO_BIG:
+      if (krb_debug)
+	krb_warning ("tf_get_cred: too big instance cred.\n");
+      return TKT_FIL_FMT;
+    case 0:
+      return EOF;
     }
-#ifdef TKT_SHMEM
-    bcopy(tmp_shm_addr,c->session,KEY_SZ);
-    tmp_shm_addr += KEY_SZ;
-#endif /* TKT_SHMEM */
-    return KSUCCESS;
+  if ((k_errno = tf_gets(c->realm, REALM_SZ)) < 2)
+    switch (k_errno) {
+    case TOO_BIG:
+      if (krb_debug)
+	krb_warning ("tf_get_cred: too big realm cred.\n");
+    case 1:		/* can't be just a null */
+      tf_close();
+      if (krb_debug)
+	krb_warning ("tf_get_cred: null realm cred.\n");
+      return TKT_FIL_FMT;
+    case 0:
+      return EOF;
+    }
+  if (
+      tf_read((c->session), DES_KEY_SZ) < 1 ||
+      tf_read(&(c->lifetime), sizeof(c->lifetime)) < 1 ||
+      tf_read(&(c->kvno), sizeof(c->kvno)) < 1 ||
+      tf_read(&(ticket->length), sizeof(ticket->length))
+      < 1 ||
+      /* don't try to read a silly amount into ticket->dat */
+      ticket->length > MAX_KTXT_LEN ||
+      tf_read((ticket->dat), ticket->length) < 1 ||
+      tf_read(&(c->issue_date), sizeof(c->issue_date)) < 1
+      ) {
+    tf_close();
+    if (krb_debug)
+      krb_warning ("tf_get_cred: failed tf_read.\n");
+    return TKT_FIL_FMT;
+  }
+  return KSUCCESS;
 }
 
 /*
@@ -387,23 +445,14 @@ tf_get_cred(c)
  */
 
 void
-tf_close()
+tf_close(void)
 {
-    if (!(fd < 0)) {
-#ifdef TKT_SHMEM
-	if (shmdt(krb_shm_addr)) {
-	    /* what kind of error? */
-	    if (krb_debug)
-		fprintf(stderr, "shmdt 0x%x: errno %d",krb_shm_addr, errno);
-	} else {
-	    krb_shm_addr = 0;
-	}
-#endif /* TKT_SHMEM */
-	(void) flock(fd, LOCK_UN);
-	(void) close(fd);
-	fd = -1;		/* see declaration of fd above */
-    }
-    bzero(tfbfr, sizeof(tfbfr));
+  if (!(fd < 0)) {
+    k_flock(fd, K_LOCK_UN);
+    close(fd);
+    fd = -1;		/* see declaration of fd above */
+  }
+  memset(tfbfr, 0, sizeof(tfbfr));
 }
 
 /*
@@ -425,32 +474,30 @@ tf_close()
  */
 
 static int
-tf_gets(s, n)
-	register char *s;
-	int n;
+tf_gets(char *s, int n)
 {
-    register count;
-
-    if (fd < 0) {
-	if (krb_debug)
-	    fprintf(stderr, "tf_gets called before tf_init.\n");
-	return TKT_FIL_INI;
+  int count;
+
+  if (fd < 0) {
+    if (krb_debug)
+      krb_warning ("tf_gets called before tf_init.\n");
+    return TKT_FIL_INI;
+  }
+  for (count = n - 1; count > 0; --count) {
+    if (curpos >= sizeof(tfbfr)) {
+      lastpos = read(fd, tfbfr, sizeof(tfbfr));
+      curpos = 0;
     }
-    for (count = n - 1; count > 0; --count) {
-	if (curpos >= sizeof(tfbfr)) {
-	    lastpos = read(fd, tfbfr, sizeof(tfbfr));
-	    curpos = 0;
-	}
-	if (curpos == lastpos) {
-	    tf_close();
-	    return 0;
-	}
-	*s = tfbfr[curpos++];
-	if (*s++ == '\0')
-	    return (n - count);
+    if (curpos == lastpos) {
+      tf_close();
+      return 0;
     }
-    tf_close();
-    return TOO_BIG;
+    *s = tfbfr[curpos++];
+    if (*s++ == '\0')
+      return (n - count);
+  }
+  tf_close();
+  return TOO_BIG;
 }
 
 /*
@@ -467,28 +514,25 @@ tf_gets(s, n)
  */
 
 static int
-tf_read(s, n)
-	register char *s;
-	register int n;
+tf_read(void *v, int n)
 {
-    register count;
+  char *s = (char *)v;
+  int count;
     
-    for (count = n; count > 0; --count) {
-	if (curpos >= sizeof(tfbfr)) {
-	    lastpos = read(fd, tfbfr, sizeof(tfbfr));
-	    curpos = 0;
-	}
-	if (curpos == lastpos) {
-	    tf_close();
-	    return 0;
-	}
-	*s++ = tfbfr[curpos++];
+  for (count = n; count > 0; --count) {
+    if (curpos >= sizeof(tfbfr)) {
+      lastpos = read(fd, tfbfr, sizeof(tfbfr));
+      curpos = 0;
+    }
+    if (curpos == lastpos) {
+      tf_close();
+      return 0;
     }
-    return n;
+    *s++ = tfbfr[curpos++];
+  }
+  return n;
 }
      
-char   *tkt_string(void);
-
 /*
  * tf_save_cred() appends an incoming ticket to the end of the ticket
  * file.  You must call tf_init() before calling tf_save_cred().
@@ -502,89 +546,102 @@ char   *tkt_string(void);
  * Returns KSUCCESS if all goes well, TKT_FIL_INI if tf_init() wasn't
  * called previously, and KFAILURE for anything else that went wrong.
  */
-
+ 
+int
+tf_save_cred(char *service,	/* Service name */
+	     char *instance,	/* Instance */
+	     char *realm,	/* Auth domain */
+	     unsigned char *session, /* Session key */
+	     int lifetime,	/* Lifetime */
+	     int kvno,		/* Key version number */
+	     KTEXT ticket,	/* The ticket itself */
+	     u_int32_t issue_date) /* The issue time */
+{
+  int count;			/* count for write */
+
+  if (fd < 0) {			/* fd is ticket file as set by tf_init */
+    if (krb_debug)
+      krb_warning ("tf_save_cred called before tf_init.\n");
+    return TKT_FIL_INI;
+  }
+  /* Find the end of the ticket file */
+  lseek(fd, 0L, SEEK_END);
+
+  /* Write the ticket and associated data */
+  /* Service */
+  count = strlen(service) + 1;
+  if (write(fd, service, count) != count)
+    goto bad;
+  /* Instance */
+  count = strlen(instance) + 1;
+  if (write(fd, instance, count) != count)
+    goto bad;
+  /* Realm */
+  count = strlen(realm) + 1;
+  if (write(fd, realm, count) != count)
+    goto bad;
+  /* Session key */
+  if (write(fd, session, 8) != 8)
+    goto bad;
+  /* Lifetime */
+  if (write(fd, &lifetime, sizeof(int)) != sizeof(int))
+    goto bad;
+  /* Key vno */
+  if (write(fd, &kvno, sizeof(int)) != sizeof(int))
+    goto bad;
+  /* Tkt length */
+  if (write(fd, &(ticket->length), sizeof(int)) !=
+      sizeof(int))
+    goto bad;
+  /* Ticket */
+  count = ticket->length;
+  if (write(fd, ticket->dat, count) != count)
+    goto bad;
+  /* Issue date */
+  if (write(fd, &issue_date, sizeof(issue_date)) != sizeof(issue_date))
+    goto bad;
+
+  return (KSUCCESS);
+bad:
+  return (KFAILURE);
+}
+	  
 int
-tf_save_cred(service, instance, realm, session,
-	     lifetime, kvno, ticket, issue_date)
-	char *service;		/* Service name */
-	char *instance;		/* Instance */
-	char *realm;		/* Auth domain */
-	unsigned char *session;	/* Session key */
-	int lifetime;		/* Lifetime */
-	int kvno;		/* Key version number */
-	KTEXT ticket;		/* The ticket itself */
-	u_int32_t issue_date;	/* The issue time */
+tf_setup(CREDENTIALS *cred, char *pname, char *pinst)
 {
+    int ret;
+    ret = tf_create(tkt_string());
+    if (ret != KSUCCESS)
+	return ret;
+
+    if (tf_put_pname(pname) != KSUCCESS ||
+	tf_put_pinst(pinst) != KSUCCESS) {
+	tf_close();
+	return INTK_ERR;
+    }
 
-    off_t   lseek(int, off_t, int);
-    int     count;		/* count for write */
-#ifdef TKT_SHMEM
-    int	    *skey_check;
-#endif /* TKT_SHMEM */
+    ret = tf_save_cred(cred->service, cred->instance, cred->realm, 
+		       cred->session, cred->lifetime, cred->kvno,
+		       &cred->ticket_st, cred->issue_date);
+    tf_close();
+    return ret;
+}
 
-    if (fd < 0) {		/* fd is ticket file as set by tf_init */
-	  if (krb_debug)
-	      fprintf(stderr, "tf_save_cred called before tf_init.\n");
-	  return TKT_FIL_INI;
+int
+in_tkt(char *pname, char *pinst)
+{
+  int ret;
+  
+  ret = tf_create (tkt_string());
+  if (ret != KSUCCESS)
+    return ret;
+
+    if (tf_put_pname(pname) != KSUCCESS ||
+	tf_put_pinst(pinst) != KSUCCESS) {
+	tf_close();
+	return INTK_ERR;
     }
-    /* Find the end of the ticket file */
-    (void) lseek(fd, 0L, 2);
-#ifdef TKT_SHMEM
-    /* scan to end of existing keys: pick first 'empty' slot.
-       we assume that no real keys will be completely zero (it's a weak
-       key under DES) */
-
-    skey_check = (int *) krb_shm_addr;
-
-    while (*skey_check && *(skey_check+1))
-	skey_check += 2;
-    tmp_shm_addr = (char *)skey_check;
-#endif /* TKT_SHMEM */
-
-    /* Write the ticket and associated data */
-    /* Service */
-    count = strlen(service) + 1;
-    if (write(fd, service, count) != count)
-	goto bad;
-    /* Instance */
-    count = strlen(instance) + 1;
-    if (write(fd, instance, count) != count)
-	goto bad;
-    /* Realm */
-    count = strlen(realm) + 1;
-    if (write(fd, realm, count) != count)
-	goto bad;
-    /* Session key */
-#ifdef TKT_SHMEM
-    bcopy(session,tmp_shm_addr,8);
-    tmp_shm_addr+=8;
-    if (write(fd,krb_dummy_skey,8) != 8)
-	goto bad;
-#else /* ! TKT_SHMEM */
-    if (write(fd, (char *) session, 8) != 8)
-	goto bad;
-#endif /* TKT_SHMEM */
-    /* Lifetime */
-    if (write(fd, (char *) &lifetime, sizeof(int)) != sizeof(int))
-	goto bad;
-    /* Key vno */
-    if (write(fd, (char *) &kvno, sizeof(int)) != sizeof(int))
-	goto bad;
-    /* Tkt length */
-    if (write(fd, (char *) &(ticket->length), sizeof(int)) !=
-	sizeof(int))
-	goto bad;
-    /* Ticket */
-    count = ticket->length;
-    if (write(fd, (char *) (ticket->dat), count) != count)
-	goto bad;
-    /* Issue date */
-    if (write(fd, (char *) &issue_date, sizeof(issue_date))
-	!= sizeof(issue_date))
-	goto bad;
-
-    /* Actually, we should check each write for success */
-    return (KSUCCESS);
-bad:
-    return (KFAILURE);
+
+    tf_close();
+    return KSUCCESS;
 }
diff --git a/kerberosIV/krb/tkt_string.c b/kerberosIV/krb/tkt_string.c
index 1c63f0346e8..5bc67e2562c 100644
--- a/kerberosIV/krb/tkt_string.c
+++ b/kerberosIV/krb/tkt_string.c
@@ -1,10 +1,4 @@
-/*
- * This software may now be redistributed outside the US.
- *
- * $Source: /cvs/OpenBSD/src/kerberosIV/krb/Attic/tkt_string.c,v $
- *
- * $Locker:  $
- */
+/* $KTH: tkt_string.c,v 1.11 1997/10/24 10:18:07 assar Exp $ */
 
 /* 
   Copyright (C) 1989 by the Massachusetts Institute of Technology
@@ -29,9 +23,6 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-#include <sys/param.h>
-#include <sys/types.h>
-
 /*
  * This routine is used to generate the name of the file that holds
  * the user's cache of server tickets and associated session keys.
@@ -49,21 +40,18 @@ or implied warranty.
 static char krb_ticket_string[MAXPATHLEN] = "";
 
 char *
-tkt_string()
+tkt_string(void)
 {
     char *env;
-    uid_t getuid(void);
 
     if (!*krb_ticket_string) {
         if ((env = getenv("KRBTKFILE"))) {
-	    (void) strncpy(krb_ticket_string, env,
+	    strncpy(krb_ticket_string, env,
 			   sizeof(krb_ticket_string)-1);
 	    krb_ticket_string[sizeof(krb_ticket_string)-1] = '\0';
 	} else {
-	    /* 32 bits of signed integer will always fit in 11 characters
-	     (including the sign), so no need to worry about overflow */
-	    (void) snprintf(krb_ticket_string, sizeof(krb_ticket_string),
-	    		    "%s%u", TKT_ROOT, getuid());
+	    snprintf(krb_ticket_string, sizeof(krb_ticket_string),
+		     "%s%u",TKT_ROOT,(unsigned)getuid());
         }
     }
     return krb_ticket_string;
@@ -81,11 +69,10 @@ tkt_string()
  */
 
 void
-krb_set_tkt_string(val)
-	char *val;
+krb_set_tkt_string(const char *val)
 {
 
-    (void) strncpy(krb_ticket_string, val, sizeof(krb_ticket_string)-1);
+    strncpy(krb_ticket_string, val, sizeof(krb_ticket_string)-1);
     krb_ticket_string[sizeof(krb_ticket_string)-1] = '\0';
 
     return;
diff --git a/kerberosIV/krb/unparse_name.c b/kerberosIV/krb/unparse_name.c
new file mode 100644
index 00000000000..e7cde58fda7
--- /dev/null
+++ b/kerberosIV/krb/unparse_name.c
@@ -0,0 +1,105 @@
+/* $KTH: unparse_name.c,v 1.7 1997/04/01 08:18:46 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+static void
+quote_string(char *quote, char *from, char *to)
+{
+    while(*from){
+	if(strchr(quote, *from))
+	    *to++ = '\\';
+	*to++ = *from++;
+    }
+    *to = 0;
+}
+
+/* To be compatible with old functions, we quote differently in each
+   part of the principal*/
+
+char *
+krb_unparse_name_r(krb_principal *pr, char *fullname)
+{
+    quote_string("'@\\", pr->name, fullname);
+    if(pr->instance[0]){
+	strcat(fullname, ".");
+	quote_string("@\\", pr->instance, fullname + strlen(fullname));
+    }
+    if(pr->realm[0]){
+	strcat(fullname, "@");
+	quote_string("\\", pr->realm, fullname + strlen(fullname));
+    }
+    return fullname;
+}
+
+char *
+krb_unparse_name_long_r(char *name, char *instance, char *realm,
+			char *fullname)
+{
+    krb_principal pr;
+    memset(&pr, 0, sizeof(pr));
+    strcpy(pr.name, name);
+    if(instance)
+	strcpy(pr.instance, instance);
+    if(realm)
+	strcpy(pr.realm, realm);
+    return krb_unparse_name_r(&pr, fullname);
+}
+
+char *
+krb_unparse_name(krb_principal *pr)
+{
+    static char principal[MAX_K_NAME_SZ];
+    krb_unparse_name_r(pr, principal);
+    return principal;
+}
+
+char *
+krb_unparse_name_long(char *name, char *instance, char *realm)
+{
+    krb_principal pr;
+    memset(&pr, 0, sizeof(pr));
+    strcpy(pr.name, name);
+    if(instance)
+	strcpy(pr.instance, instance);
+    if(realm)
+	strcpy(pr.realm, realm);
+    return krb_unparse_name(&pr);
+}
diff --git a/kerberosIV/krb/util.c b/kerberosIV/krb/util.c
new file mode 100644
index 00000000000..b187276ffd7
--- /dev/null
+++ b/kerberosIV/krb/util.c
@@ -0,0 +1,76 @@
+/* $KTH: util.c,v 1.6 1996/10/05 00:18:34 joda Exp $ */
+
+/*
+  Copyright 1988 by the Massachusetts Institute of Technology.
+
+   Export of this software from the United States of America is assumed
+   to require a specific license from the United States Government.
+   It is the responsibility of any person or organization contemplating
+   export to obtain such a license before exporting.
+
+WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+distribute this software and its documentation for any purpose and
+without fee is hereby granted, provided that the above copyright
+notice appear in all copies and that both that copyright notice and
+this permission notice appear in supporting documentation, and that
+the name of M.I.T. not be used in advertising or publicity pertaining
+to distribution of the software without specific, written prior
+permission.  M.I.T. makes no representations about the suitability of
+this software for any purpose.  It is provided "as is" without express
+or implied warranty.
+
+  Miscellaneous debug printing utilities
+ */
+
+#include "krb_locl.h"
+
+/*
+ * Print some of the contents of the given authenticator structure
+ * (AUTH_DAT defined in "krb.h").  Fields printed are:
+ *
+ * pname, pinst, prealm, netaddr, flags, cksum, timestamp, session
+ */
+
+void
+ad_print(AUTH_DAT *x)
+{
+    /*
+     * Print the contents of an auth_dat struct.
+     */
+    struct in_addr address;
+    address.s_addr = x->address;
+    printf("\n%s %s %s %s flags %u cksum 0x%X\n\ttkt_tm 0x%X sess_key",
+           x->pname, x->pinst, x->prealm,
+           inet_ntoa(address), x->k_flags,
+           x->checksum, x->time_sec);
+    printf("[8] =");
+#ifdef NOENCRYPTION
+    placebo_cblock_print(x->session);
+#else
+    des_cblock_print_file(&x->session,stdout);
+#endif
+    /* skip reply for now */
+}
+
+/*
+ * Print in hex the 8 bytes of the given session key.
+ *
+ * Printed format is:  " 0x { x, x, x, x, x, x, x, x }"
+ */
+
+#ifdef NOENCRYPTION
+placebo_cblock_print(x)
+    des_cblock x;
+{
+    unsigned char *y = (unsigned char *) x;
+    int i = 0;
+
+    printf(" 0x { ");
+
+    while (i++ <8) {
+        printf("%x",*y++);
+        if (i<8) printf(", ");
+    }
+    printf(" }");
+}
+#endif
diff --git a/kerberosIV/krb/verify_user.c b/kerberosIV/krb/verify_user.c
new file mode 100644
index 00000000000..0058a00a64f
--- /dev/null
+++ b/kerberosIV/krb/verify_user.c
@@ -0,0 +1,111 @@
+/* $KTH: verify_user.c,v 1.8 1997/04/01 08:18:46 joda Exp $ */
+
+/*
+ * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the Kungliga Tekniska
+ *      Högskolan and its contributors.
+ * 
+ * 4. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "krb_locl.h"
+
+/* Verify user with password. If secure, also verify against local
+ * service key, this can (usually) only be done by root.
+ *
+ * As a side effect, fresh tickets are obtained.
+ *
+ * Returns zero if ok, a positive kerberos error or -1 for system
+ * errors.
+ */
+
+int
+krb_verify_user(char *name, char *instance, char *realm, char *password, 
+		int secure, char *linstance)
+{
+    int ret;
+    ret = krb_get_pw_in_tkt(name, instance, realm,
+			    KRB_TICKET_GRANTING_TICKET,
+			    realm,
+			    DEFAULT_TKT_LIFE, password);
+    if(ret != KSUCCESS)
+	return ret;
+
+    if(secure){
+	struct hostent *hp;
+	int32_t addr;
+	
+	KTEXT_ST ticket;
+	AUTH_DAT auth;
+
+	char lrealm[REALM_SZ];
+	char hostname[MAXHOSTNAMELEN];
+	char *phost;
+
+	if (k_gethostname(hostname, sizeof(hostname)) == -1) {
+	    dest_tkt();
+	    return -1;
+	}
+
+	hp = gethostbyname(hostname);
+	if(hp == NULL){
+	    dest_tkt();
+	    return -1;
+	}
+	memcpy(&addr, hp->h_addr, sizeof(addr));
+
+	ret = krb_get_lrealm(lrealm, 1);
+	if(ret != KSUCCESS){
+	    dest_tkt();
+	    return ret;
+	}
+	phost = krb_get_phost(hostname);
+	
+	if (linstance == NULL)
+	    linstance = "rcmd";
+
+	ret = krb_mk_req(&ticket, linstance, phost, lrealm, 33);
+	if(ret != KSUCCESS){
+	    dest_tkt();
+	    return ret;
+	}
+	
+	ret = krb_rd_req(&ticket, linstance, phost, addr, &auth, "");
+	if(ret != KSUCCESS){
+	    dest_tkt();
+	    return ret;
+	}
+    }
+    return 0;
+}
+