r20640: Commit part 2/2

Update Heimdal to match current lorikeet-heimdal.  This includes
integrated PAC hooks, so Samba doesn't have to handle this any more.

This also brings in the PKINIT code, hence so many new files.

Andrew Bartlett
(This used to be commit 351f7040f7bb73b9a60b22b564686f7c2f98a729)

22 files changed, 441 insertions, 232 deletions

diff --git a/source4/heimdal/lib/asn1/asn1-common.h b/source4/heimdal/lib/asn1/asn1-common.h
index ab06ae79dd..5f09cd6794 100644
--- a/source4/heimdal/lib/asn1/asn1-common.h
+++ b/source4/heimdal/lib/asn1/asn1-common.h
@@ -1,4 +1,4 @@
-/* $Id: asn1-common.h,v 1.6 2006/10/14 05:09:47 lha Exp $ */
+/* $Id: asn1-common.h,v 1.7 2006/12/28 17:14:10 lha Exp $ */
 
 #include <stddef.h>
 #include <time.h>
@@ -32,6 +32,7 @@ typedef struct heim_universal_string {
     uint32_t *data;
 } heim_universal_string;
 
+typedef char *heim_visible_string;
 
 typedef struct heim_oid {
     size_t length;
diff --git a/source4/heimdal/lib/asn1/der-protos.h b/source4/heimdal/lib/asn1/der-protos.h
index 3aee392c96..7bfe02ebb4 100644
--- a/source4/heimdal/lib/asn1/der-protos.h
+++ b/source4/heimdal/lib/asn1/der-protos.h
@@ -82,6 +82,11 @@ der_copy_utf8string (
 	const heim_utf8_string */*from*/,
 	heim_utf8_string */*to*/);
 
+int
+der_copy_visible_string (
+	const heim_visible_string */*from*/,
+	heim_visible_string */*to*/);
+
 void
 der_free_bit_string (heim_bit_string */*k*/);
 
@@ -112,6 +117,9 @@ der_free_universal_string (heim_universal_string */*k*/);
 void
 der_free_utf8string (heim_utf8_string */*str*/);
 
+void
+der_free_visible_string (heim_visible_string */*str*/);
+
 int
 der_get_bit_string (
 	const unsigned char */*p*/,
@@ -252,6 +260,13 @@ der_get_utf8string (
 	size_t */*size*/);
 
 int
+der_get_visible_string (
+	const unsigned char */*p*/,
+	size_t /*len*/,
+	heim_visible_string */*str*/,
+	size_t */*size*/);
+
+int
 der_heim_bit_string_cmp (
 	const heim_bit_string */*p*/,
 	const heim_bit_string */*q*/);
@@ -332,6 +347,9 @@ der_length_utctime (const time_t */*t*/);
 size_t
 der_length_utf8string (const heim_utf8_string */*data*/);
 
+size_t
+der_length_visible_string (const heim_visible_string */*data*/);
+
 int
 der_match_tag (
 	const unsigned char */*p*/,
@@ -505,6 +523,13 @@ der_put_utf8string (
 	size_t */*size*/);
 
 int
+der_put_visible_string (
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const heim_visible_string */*str*/,
+	size_t */*size*/);
+
+int
 encode_heim_any (
 	unsigned char */*p*/,
 	size_t /*len*/,
diff --git a/source4/heimdal/lib/asn1/der_copy.c b/source4/heimdal/lib/asn1/der_copy.c
index 96eea9c6d7..15e7b817a0 100644
--- a/source4/heimdal/lib/asn1/der_copy.c
+++ b/source4/heimdal/lib/asn1/der_copy.c
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
-RCSID("$Id: der_copy.c,v 1.16 2006/10/14 05:30:02 lha Exp $");
+RCSID("$Id: der_copy.c,v 1.17 2006/12/28 17:14:17 lha Exp $");
 
 int
 der_copy_general_string (const heim_general_string *from, 
@@ -89,6 +89,13 @@ der_copy_universal_string (const heim_universal_string *from,
 }
 
 int
+der_copy_visible_string (const heim_visible_string *from, 
+			 heim_visible_string *to)
+{
+    return der_copy_general_string(from, to);
+}
+
+int
 der_copy_octet_string (const heim_octet_string *from, heim_octet_string *to)
 {
     to->length = from->length;
diff --git a/source4/heimdal/lib/asn1/der_format.c b/source4/heimdal/lib/asn1/der_format.c
index 9655269356..32cf23cb39 100644
--- a/source4/heimdal/lib/asn1/der_format.c
+++ b/source4/heimdal/lib/asn1/der_format.c
@@ -34,7 +34,7 @@
 #include "der_locl.h"
 #include <hex.h>
 
-RCSID("$Id: der_format.c,v 1.6 2006/10/21 18:24:15 lha Exp $");
+RCSID("$Id: der_format.c,v 1.8 2006/11/27 10:32:21 lha Exp $");
 
 int
 der_parse_hex_heim_integer (const char *p, heim_integer *data)
@@ -110,10 +110,13 @@ der_print_heim_oid (const heim_oid *oid, char delim, char **str)
     struct rk_strpool *p = NULL;
     int i;
 
+    if (oid->length == 0)
+	return EINVAL;
+
     for (i = 0; i < oid->length ; i++) {
-	p = rk_strpoolprintf(p, "%d%s", 
-			     oid->components[i],
-			     i < oid->length - 1 ? " " : "");
+	p = rk_strpoolprintf(p, "%d", oid->components[i]);
+	if (p && i < oid->length - 1)
+	    p = rk_strpoolprintf(p, "%c", delim);
 	if (p == NULL) {
 	    *str = NULL;
 	    return ENOMEM;
diff --git a/source4/heimdal/lib/asn1/der_free.c b/source4/heimdal/lib/asn1/der_free.c
index c3a6a17fff..6827486d9f 100644
--- a/source4/heimdal/lib/asn1/der_free.c
+++ b/source4/heimdal/lib/asn1/der_free.c
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
-RCSID("$Id: der_free.c,v 1.13 2006/10/14 05:30:47 lha Exp $");
+RCSID("$Id: der_free.c,v 1.14 2006/12/28 17:14:21 lha Exp $");
 
 void
 der_free_general_string (heim_general_string *str)
@@ -80,6 +80,13 @@ der_free_universal_string (heim_universal_string *k)
 }
 
 void
+der_free_visible_string (heim_visible_string *str)
+{
+    free(*str);
+    *str = NULL;
+}
+
+void
 der_free_octet_string (heim_octet_string *k)
 {
     free(k->data);
diff --git a/source4/heimdal/lib/asn1/der_get.c b/source4/heimdal/lib/asn1/der_get.c
index 7808fa8165..a1ed23f10b 100644
--- a/source4/heimdal/lib/asn1/der_get.c
+++ b/source4/heimdal/lib/asn1/der_get.c
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
-RCSID("$Id: der_get.c,v 1.50 2006/10/19 16:27:44 lha Exp $");
+RCSID("$Id: der_get.c,v 1.51 2006/12/28 17:14:25 lha Exp $");
 
 #include <version.h>
 
@@ -215,6 +215,13 @@ der_get_universal_string (const unsigned char *p, size_t len,
 }
 
 int
+der_get_visible_string (const unsigned char *p, size_t len, 
+			heim_visible_string *str, size_t *size)
+{
+    return der_get_general_string(p, len, str, size);
+}
+
+int
 der_get_octet_string (const unsigned char *p, size_t len, 
 		      heim_octet_string *data, size_t *size)
 {
diff --git a/source4/heimdal/lib/asn1/der_length.c b/source4/heimdal/lib/asn1/der_length.c
index 9b2e9f0998..93cabe466c 100644
--- a/source4/heimdal/lib/asn1/der_length.c
+++ b/source4/heimdal/lib/asn1/der_length.c
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
-RCSID("$Id: der_length.c,v 1.19 2006/10/14 05:26:06 lha Exp $");
+RCSID("$Id: der_length.c,v 1.20 2006/12/28 17:14:28 lha Exp $");
 
 size_t
 _heim_len_unsigned (unsigned val)
@@ -167,6 +167,12 @@ der_length_universal_string (const heim_universal_string *data)
 }
 
 size_t
+der_length_visible_string (const heim_visible_string *data)
+{
+    return strlen(*data);
+}
+
+size_t
 der_length_octet_string (const heim_octet_string *k)
 {
     return k->length;
diff --git a/source4/heimdal/lib/asn1/der_put.c b/source4/heimdal/lib/asn1/der_put.c
index b006f233ca..9ed8f21906 100644
--- a/source4/heimdal/lib/asn1/der_put.c
+++ b/source4/heimdal/lib/asn1/der_put.c
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
-RCSID("$Id: der_put.c,v 1.33 2005/07/12 06:27:23 lha Exp $");
+RCSID("$Id: der_put.c,v 1.34 2006/12/28 17:14:33 lha Exp $");
 
 /*
  * All encoding functions take a pointer `p' to first position in
@@ -231,6 +231,13 @@ der_put_universal_string (unsigned char *p, size_t len,
 }
 
 int
+der_put_visible_string (unsigned char *p, size_t len, 
+			 const heim_visible_string *str, size_t *size)
+{
+    return der_put_general_string(p, len, str, size);
+}
+
+int
 der_put_octet_string (unsigned char *p, size_t len, 
 		      const heim_octet_string *data, size_t *size)
 {
diff --git a/source4/heimdal/lib/asn1/digest.asn1 b/source4/heimdal/lib/asn1/digest.asn1
index 1f8f18b5cd..92bfb23234 100644
--- a/source4/heimdal/lib/asn1/digest.asn1
+++ b/source4/heimdal/lib/asn1/digest.asn1
@@ -1,4 +1,4 @@
--- $Id: digest.asn1,v 1.9 2006/08/25 11:57:54 lha Exp $
+-- $Id: digest.asn1,v 1.10 2006/12/15 19:13:39 lha Exp $
 
 DIGEST DEFINITIONS ::=
 BEGIN
@@ -58,9 +58,43 @@ DigestResponse ::= SEQUENCE  {
     hash-a1		[3] OCTET STRING OPTIONAL
 }
 
+NTLMInit ::= SEQUENCE {
+    flags		[0] INTEGER (0..4294967295),
+    hostname		[1] UTF8String OPTIONAL,
+    domain		[1] UTF8String OPTIONAL
+}
+
+NTLMInitReply ::= SEQUENCE {
+    flags		[0] INTEGER (0..4294967295),
+    opaque		[1] OCTET STRING,
+    targetname		[2] UTF8String,
+    challange		[3] OCTET STRING,
+    targetinfo		[4] OCTET STRING OPTIONAL
+}
+
+NTLMRequest ::= SEQUENCE {
+    flags		[0] INTEGER (0..4294967295),
+    opaque		[1] OCTET STRING,
+    username		[2] UTF8String,
+    targetname		[3] UTF8String,
+    targetinfo		[4] OCTET STRING OPTIONAL,
+    lm			[5] OCTET STRING,
+    ntlm		[6] OCTET STRING,
+    sessionkey		[7] OCTET STRING OPTIONAL
+}
+
+NTLMResponse ::= SEQUENCE {
+    success		[0] BOOLEAN,
+    flags		[1] INTEGER (0..4294967295),
+    sessionkey		[2] OCTET STRING OPTIONAL,
+    tickets		[3] SEQUENCE OF OCTET STRING OPTIONAL
+}
+
 DigestReqInner ::= CHOICE {
     init		[0] DigestInit,
-    digestRequest	[1] DigestRequest
+    digestRequest	[1] DigestRequest,
+    ntlmInit		[2] NTLMInit,
+    ntlmRequest		[3] NTLMRequest
 }
 
 DigestREQ ::= [APPLICATION 128] SEQUENCE {
@@ -71,7 +105,9 @@ DigestREQ ::= [APPLICATION 128] SEQUENCE {
 DigestRepInner ::= CHOICE {
     error		[0] DigestError,
     initReply		[1] DigestInitReply,
-    response		[2] DigestResponse
+    response		[2] DigestResponse,
+    ntlmInitReply	[3] NTLMInitReply,
+    ntlmResponse	[4] NTLMResponse
 }
 
 DigestREP ::= [APPLICATION 129] SEQUENCE {
diff --git a/source4/heimdal/lib/asn1/gen.c b/source4/heimdal/lib/asn1/gen.c
index c3af316c88..3bb9022be8 100644
--- a/source4/heimdal/lib/asn1/gen.c
+++ b/source4/heimdal/lib/asn1/gen.c
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen.c,v 1.69 2006/10/14 05:11:52 lha Exp $");
+RCSID("$Id: gen.c,v 1.70 2006/12/28 17:14:37 lha Exp $");
 
 FILE *headerfile, *codefile, *logfile;
 
@@ -136,6 +136,9 @@ init_generate (const char *filename, const char *base)
 	     "  uint32_t *data;\n"
 	     "} heim_universal_string;\n\n");
     fprintf (headerfile,
+	     "typedef char *heim_visible_string;\n\n"
+	     );
+    fprintf (headerfile,
 	     "typedef struct heim_oid {\n"
 	     "  size_t length;\n"
 	     "  unsigned *components;\n"
@@ -504,6 +507,10 @@ define_asn1 (int level, Type *t)
 	space(level);
 	fprintf (headerfile, "UniversalString");
 	break;
+    case TVisibleString:
+	space(level);
+	fprintf (headerfile, "VisibleString");
+	break;
     case TOID :
 	space(level);
 	fprintf(headerfile, "OBJECT IDENTIFIER");
@@ -736,6 +743,10 @@ define_type (int level, const char *name, Type *t, int typedefp, int preservep)
 	space(level);
 	fprintf (headerfile, "heim_universal_string %s;\n", name);
 	break;
+    case TVisibleString:
+	space(level);
+	fprintf (headerfile, "heim_visible_string %s;\n", name);
+	break;
     case TOID :
 	space(level);
 	fprintf (headerfile, "heim_oid %s;\n", name);
diff --git a/source4/heimdal/lib/asn1/gen_copy.c b/source4/heimdal/lib/asn1/gen_copy.c
index 9455f33c6f..95646d0a3c 100644
--- a/source4/heimdal/lib/asn1/gen_copy.c
+++ b/source4/heimdal/lib/asn1/gen_copy.c
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_copy.c,v 1.18 2006/10/14 05:34:19 lha Exp $");
+RCSID("$Id: gen_copy.c,v 1.19 2006/12/28 17:14:42 lha Exp $");
 
 static int used_fail;
 
@@ -202,6 +202,9 @@ copy_type (const char *from, const char *to, const Type *t, int preserve)
     case TUniversalString:
 	copy_primitive ("universal_string", from, to);
 	break;
+    case TVisibleString:
+	copy_primitive ("visible_string", from, to);
+	break;
     case TTag:
 	copy_type (from, to, t->subtype, preserve);
 	break;
diff --git a/source4/heimdal/lib/asn1/gen_decode.c b/source4/heimdal/lib/asn1/gen_decode.c
index 193dab40e1..19ddbb46db 100644
--- a/source4/heimdal/lib/asn1/gen_decode.c
+++ b/source4/heimdal/lib/asn1/gen_decode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -34,7 +34,7 @@
 #include "gen_locl.h"
 #include "lex.h"
 
-RCSID("$Id: gen_decode.c,v 1.30 2006/09/24 09:13:12 lha Exp $");
+RCSID("$Id: gen_decode.c,v 1.32 2006/12/29 17:30:32 lha Exp $");
 
 static void
 decode_primitive (const char *typename, const char *name, const char *forwstr)
@@ -74,6 +74,7 @@ is_primitive_type(int type)
     case TIA5String:
     case TBMPString:
     case TUniversalString:
+    case TVisibleString:
     case TNull:
 	return 1;
     default:
@@ -191,6 +192,11 @@ find_tag (const Type *t,
 	*ty  = PRIM;
 	*tag = UT_UniversalString;
 	break;
+    case TVisibleString:
+	*cl  = ASN1_C_UNIV;
+	*ty  = PRIM;
+	*tag = UT_VisibleString;
+	break;
     default:
 	abort();
     }
@@ -580,6 +586,9 @@ decode_type (const char *name, const Type *t, int optional,
     case TUniversalString:
 	decode_primitive ("universal_string", name, forwstr);
 	break;
+    case TVisibleString:
+	decode_primitive ("visible_string", name, forwstr);
+	break;
     case TNull:
 	fprintf (codefile, "/* NULL */\n");
 	break;
@@ -620,6 +629,7 @@ generate_type_decode (const Symbol *s)
     case TIA5String:
     case TBMPString:
     case TUniversalString:
+    case TVisibleString:
     case TUTCTime:
     case TNull:
     case TEnumerated:
diff --git a/source4/heimdal/lib/asn1/gen_encode.c b/source4/heimdal/lib/asn1/gen_encode.c
index 4099fbf643..bc2aff86e5 100644
--- a/source4/heimdal/lib/asn1/gen_encode.c
+++ b/source4/heimdal/lib/asn1/gen_encode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_encode.c,v 1.19 2005/08/23 11:52:16 lha Exp $");
+RCSID("$Id: gen_encode.c,v 1.22 2006/12/29 17:30:03 lha Exp $");
 
 static void
 encode_primitive (const char *typename, const char *name)
@@ -151,7 +151,6 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
     case TBitString: {
 	Member *m;
 	int pos;
-	int rest;
 
 	if (ASN1_TAILQ_EMPTY(t->members)) {
 	    encode_primitive("bit_string", name);
@@ -163,6 +162,7 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 		 "unsigned char c = 0;\n");
 	if (!rfc1510_bitstring)
 	    fprintf (codefile,
+		     "int rest = 0;\n"
 		     "int bit_set = 0;\n");
 #if 0
 	pos = t->members->prev->val;
@@ -181,9 +181,7 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 	if (rfc1510_bitstring) {
 	    if (pos < 31)
 		pos = 31;
-	    rest = 7 - (pos % 8);
-	} else
-	    rest = 0;
+	}
 
 	ASN1_TAILQ_FOREACH_REVERSE(m, t->members, memhead, members) {
 	    while (m->val / 8 < pos / 8) {
@@ -192,20 +190,27 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 			     "if (c != 0 || bit_set) {\n");
 		fprintf (codefile,
 			 "if (len < 1) return ASN1_OVERFLOW;\n"
-			 "*p-- = c; len--; ret++;\n"
-			 "c = 0;\n");
+			 "*p-- = c; len--; ret++;\n");
 		if (!rfc1510_bitstring)
 		    fprintf (codefile,
+			     "if (!bit_set) {\n"
+			     "rest = 0;\n"
+			     "while(c) { \n"
+			     "if (c & 1) break;\n"
+			     "c = c >> 1;\n"
+			     "rest++;\n"
+			     "}\n"
 			     "bit_set = 1;\n"
+			     "}\n"
 			     "}\n");
+		fprintf (codefile,
+			 "c = 0;\n");
 		pos -= 8;
 	    }
 	    fprintf (codefile,
 		     "if((%s)->%s) {\n"
 		     "c |= 1<<%d;\n", 
 		     name, m->gen_name, 7 - m->val % 8);
-	    if (!rfc1510_bitstring)
-		rest = 7 - m->val % 8;
 	    fprintf (codefile,
 		     "}\n");
 	}
@@ -218,15 +223,25 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 		 "*p-- = c; len--; ret++;\n");
 	if (!rfc1510_bitstring)
 	    fprintf (codefile,
+		     "if (!bit_set) {\n"
+		     "rest = 0;\n"
+		     "if(c) { \n"
+		     "while(c) { \n"
+		     "if (c & 1) break;\n"
+		     "c = c >> 1;\n"
+		     "rest++;\n"
+		     "}\n"
+		     "}\n"
+		     "}\n"
 		     "}\n");
-	
+
 	fprintf (codefile, 
 		 "if (len < 1) return ASN1_OVERFLOW;\n"
-		 "*p-- = %d;\n"
+		 "*p-- = %s;\n"
 		 "len -= 1;\n"
 		 "ret += 1;\n"
 		 "}\n\n",
-		 rest);
+		 rfc1510_bitstring ? "0" : "rest");
 	constructed = 0;
 	break;
     }
@@ -467,6 +482,10 @@ encode_type (const char *name, const Type *t, const char *tmpstr)
 	encode_primitive ("universal_string", name);
 	constructed = 0;
 	break;
+    case TVisibleString:
+	encode_primitive ("visible_string", name);
+	constructed = 0;
+	break;
     case TNull:
 	fprintf (codefile, "/* NULL */\n");
 	constructed = 0;
@@ -503,6 +522,7 @@ generate_type_encode (const Symbol *s)
     case TIA5String:
     case TBMPString:
     case TUniversalString:
+    case TVisibleString:
     case TNull:
     case TBitString:
     case TEnumerated:
diff --git a/source4/heimdal/lib/asn1/gen_free.c b/source4/heimdal/lib/asn1/gen_free.c
index 2b143bf818..26e02e39dd 100644
--- a/source4/heimdal/lib/asn1/gen_free.c
+++ b/source4/heimdal/lib/asn1/gen_free.c
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_free.c,v 1.16 2006/10/14 05:33:58 lha Exp $");
+RCSID("$Id: gen_free.c,v 1.17 2006/12/28 17:14:54 lha Exp $");
 
 static void
 free_primitive (const char *typename, const char *name)
@@ -160,6 +160,9 @@ free_type (const char *name, const Type *t, int preserve)
     case TUniversalString:
 	free_primitive ("universal_string", name);
 	break;
+    case TVisibleString:
+	free_primitive ("visible_string", name);
+	break;
     case TTag:
 	free_type (name, t->subtype, preserve);
 	break;
diff --git a/source4/heimdal/lib/asn1/gen_length.c b/source4/heimdal/lib/asn1/gen_length.c
index 0c92225b92..7f9dc7257b 100644
--- a/source4/heimdal/lib/asn1/gen_length.c
+++ b/source4/heimdal/lib/asn1/gen_length.c
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_length.c,v 1.21 2006/10/14 05:28:28 lha Exp $");
+RCSID("$Id: gen_length.c,v 1.22 2006/12/28 17:14:57 lha Exp $");
 
 static void
 length_primitive (const char *typename,
@@ -238,6 +238,9 @@ length_type (const char *name, const Type *t,
     case TUniversalString:
 	length_primitive ("universal_string", name, variable);
 	break;
+    case TVisibleString:
+	length_primitive ("visible_string", name, variable);
+	break;
     case TNull:
 	fprintf (codefile, "/* NULL */\n");
 	break;
diff --git a/source4/heimdal/lib/asn1/k5.asn1 b/source4/heimdal/lib/asn1/k5.asn1
index 3f501f0592..a86df38a99 100644
--- a/source4/heimdal/lib/asn1/k5.asn1
+++ b/source4/heimdal/lib/asn1/k5.asn1
@@ -1,4 +1,4 @@
--- $Id: k5.asn1,v 1.50 2006/09/11 13:28:59 lha Exp $
+-- $Id: k5.asn1,v 1.51 2006/11/21 05:17:47 lha Exp $
 
 KERBEROS5 DEFINITIONS ::=
 BEGIN
@@ -70,11 +70,11 @@ PADATA-TYPE ::= INTEGER {
 	KRB5-PADATA-TD-REQ-NONCE(107),		-- INTEGER
 	KRB5-PADATA-TD-REQ-SEQ(108),		-- INTEGER
 	KRB5-PADATA-PA-PAC-REQUEST(128),	-- jbrezak@exchange.microsoft.com
-	KRB5-PADATA-PK-AS-09-BINDING(132),	-- client send this to 
+	KRB5-PADATA-S4U2SELF(129),
+	KRB5-PADATA-PK-AS-09-BINDING(132)	-- client send this to 
 						-- tell KDC that is supports 
 						-- the asCheckSum in the
 						--  PK-AS-REP
-	KRB5-PADATA-S4U2SELF(-17)
 }
 
 AUTHDATA-TYPE ::= INTEGER {
diff --git a/source4/heimdal/lib/asn1/kx509.asn1 b/source4/heimdal/lib/asn1/kx509.asn1
new file mode 100644
index 0000000000..9706b061c3
--- /dev/null
+++ b/source4/heimdal/lib/asn1/kx509.asn1
@@ -0,0 +1,20 @@
+-- $Id: kx509.asn1,v 1.1 2006/12/28 21:05:23 lha Exp $
+
+KX509 DEFINITIONS ::=
+BEGIN
+
+Kx509Request ::= SEQUENCE {
+	authenticator OCTET STRING,
+	pk-hash OCTET STRING,
+	pk-key OCTET STRING
+}
+
+Kx509Response ::= SEQUENCE {
+	error-code[0]	INTEGER (-2147483648..2147483647)
+	      OPTIONAL -- DEFAULT 0 --,
+	hash[1]		OCTET STRING OPTIONAL,
+	certificate[2]	OCTET STRING OPTIONAL,
+	e-text[3]	VisibleString OPTIONAL
+}
+
+END
diff --git a/source4/heimdal/lib/asn1/lex.l b/source4/heimdal/lib/asn1/lex.l
index 4b2c5af062..6ec7b67bb9 100644
--- a/source4/heimdal/lib/asn1/lex.l
+++ b/source4/heimdal/lib/asn1/lex.l
@@ -32,7 +32,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: lex.l,v 1.27 2005/09/13 18:17:16 lha Exp $ */
+/* $Id: lex.l,v 1.31 2006/10/21 11:57:22 lha Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
@@ -58,6 +58,12 @@ static void unterminated(const char *, unsigned);
 
 %}
 
+/* This is for broken old lexes (solaris 10 and hpux) */
+%e 2000
+%p 5000
+%a 5000
+%n 1000
+%o 10000
 
 %%
 ABSENT			{ return kw_ABSENT; }
diff --git a/source4/heimdal/lib/asn1/parse.c b/source4/heimdal/lib/asn1/parse.c
index 29d13ed68d..fc9f195e1f 100644
--- a/source4/heimdal/lib/asn1/parse.c
+++ b/source4/heimdal/lib/asn1/parse.c
@@ -251,7 +251,7 @@
 #include "gen_locl.h"
 #include "der.h"
 
-RCSID("$Id: parse.y,v 1.28 2006/04/28 10:51:35 lha Exp $");
+RCSID("$Id: parse.y,v 1.29 2006/12/28 17:15:02 lha Exp $");
 
 static Type *new_type (Typetype t);
 static struct constraint_spec *new_constraint_spec(enum ctype);
@@ -466,16 +466,16 @@ union yyalloc
 /* YYFINAL -- State number of the termination state. */
 #define YYFINAL  4
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   168
+#define YYLAST   169
 
 /* YYNTOKENS -- Number of terminals. */
 #define YYNTOKENS  98
 /* YYNNTS -- Number of nonterminals. */
 #define YYNNTS  67
 /* YYNRULES -- Number of rules. */
-#define YYNRULES  130
+#define YYNRULES  131
 /* YYNRULES -- Number of states. */
-#define YYNSTATES  201
+#define YYNSTATES  202
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
@@ -538,11 +538,11 @@ static const unsigned short int yyprhs[] =
      167,   171,   176,   180,   184,   189,   191,   193,   195,   197,
      199,   202,   206,   208,   210,   212,   215,   219,   225,   230,
      234,   239,   240,   242,   244,   246,   247,   249,   251,   256,
-     258,   260,   262,   264,   266,   268,   270,   272,   276,   280,
-     283,   285,   288,   292,   294,   298,   303,   305,   306,   310,
-     311,   314,   319,   321,   323,   325,   327,   329,   331,   333,
+     258,   260,   262,   264,   266,   268,   270,   272,   274,   278,
+     282,   285,   287,   290,   294,   296,   300,   305,   307,   308,
+     312,   313,   316,   321,   323,   325,   327,   329,   331,   333,
      335,   337,   339,   341,   343,   345,   347,   349,   351,   353,
-     355
+     355,   357
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS. */
@@ -574,16 +574,16 @@ static const short int yyrhs[] =
      139,   141,   111,    -1,    96,   140,    89,    97,    -1,    -1,
       76,    -1,     6,    -1,    60,    -1,    -1,    27,    -1,    38,
       -1,    86,   111,    84,   154,    -1,   144,    -1,    33,    -1,
-      78,    -1,    61,    -1,    36,    -1,    10,    -1,    79,    -1,
-     147,    -1,   145,    91,   147,    -1,   145,    91,    85,    -1,
-      86,   111,    -1,   146,    -1,   146,    54,    -1,   146,    20,
-     154,    -1,   149,    -1,   148,    91,   149,    -1,    86,    92,
-      89,    93,    -1,   151,    -1,    -1,    94,   152,    95,    -1,
-      -1,   153,   152,    -1,    86,    92,    89,    93,    -1,    86,
-      -1,    89,    -1,   155,    -1,   156,    -1,   160,    -1,   159,
-      -1,   161,    -1,   164,    -1,   163,    -1,   157,    -1,   158,
-      -1,    86,    -1,    88,    -1,    71,    -1,    31,    -1,   162,
-      -1,    89,    -1,    49,    -1,   151,    -1
+      78,    -1,    61,    -1,    81,    -1,    36,    -1,    10,    -1,
+      79,    -1,   147,    -1,   145,    91,   147,    -1,   145,    91,
+      85,    -1,    86,   111,    -1,   146,    -1,   146,    54,    -1,
+     146,    20,   154,    -1,   149,    -1,   148,    91,   149,    -1,
+      86,    92,    89,    93,    -1,   151,    -1,    -1,    94,   152,
+      95,    -1,    -1,   153,   152,    -1,    86,    92,    89,    93,
+      -1,    86,    -1,    89,    -1,   155,    -1,   156,    -1,   160,
+      -1,   159,    -1,   161,    -1,   164,    -1,   163,    -1,   157,
+      -1,   158,    -1,    86,    -1,    88,    -1,    71,    -1,    31,
+      -1,   162,    -1,    89,    -1,    49,    -1,   151,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
@@ -598,11 +598,11 @@ static const unsigned short int yyrline[] =
      456,   464,   470,   478,   486,   493,   494,   497,   508,   513,
      520,   536,   542,   545,   546,   549,   555,   563,   573,   579,
      592,   601,   604,   608,   612,   619,   622,   626,   633,   644,
-     647,   652,   657,   662,   667,   672,   680,   686,   691,   702,
-     713,   719,   725,   733,   739,   746,   759,   760,   763,   770,
-     773,   784,   788,   799,   805,   806,   809,   810,   811,   812,
-     813,   816,   819,   822,   833,   841,   847,   855,   863,   866,
-     871
+     647,   652,   657,   662,   667,   672,   677,   685,   691,   696,
+     707,   718,   724,   730,   738,   744,   751,   764,   765,   768,
+     775,   778,   789,   793,   804,   810,   811,   814,   815,   816,
+     817,   818,   821,   824,   827,   838,   846,   852,   860,   868,
+     871,   876
 };
 #endif
 
@@ -682,11 +682,11 @@ static const unsigned char yyr1[] =
      125,   126,   126,   127,   128,   129,   129,   130,   131,   131,
      132,   133,   134,   135,   135,   136,   136,   136,   137,   138,
      139,   140,   140,   140,   140,   141,   141,   141,   142,   143,
-     144,   144,   144,   144,   144,   144,   145,   145,   145,   146,
-     147,   147,   147,   148,   148,   149,   150,   150,   151,   152,
-     152,   153,   153,   153,   154,   154,   155,   155,   155,   155,
-     155,   156,   157,   158,   159,   160,   160,   161,   162,   163,
-     164
+     144,   144,   144,   144,   144,   144,   144,   145,   145,   145,
+     146,   147,   147,   147,   148,   148,   149,   150,   150,   151,
+     152,   152,   153,   153,   153,   154,   154,   155,   155,   155,
+     155,   155,   156,   157,   158,   159,   160,   160,   161,   162,
+     163,   164
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -701,11 +701,11 @@ static const unsigned char yyr2[] =
        3,     4,     3,     3,     4,     1,     1,     1,     1,     1,
        2,     3,     1,     1,     1,     2,     3,     5,     4,     3,
        4,     0,     1,     1,     1,     0,     1,     1,     4,     1,
-       1,     1,     1,     1,     1,     1,     1,     3,     3,     2,
-       1,     2,     3,     1,     3,     4,     1,     0,     3,     0,
-       2,     4,     1,     1,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     1,     1,     1,     3,     3,
+       2,     1,     2,     3,     1,     3,     4,     1,     0,     3,
+       0,     2,     4,     1,     1,     1,     1,     1,     1,     1,
        1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1
+       1,     1
 };
 
 /* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
@@ -716,76 +716,76 @@ static const unsigned char yydefact[] =
        0,     0,     0,     6,     1,     0,     0,     0,     8,     5,
        3,     4,     0,     0,     7,     0,    10,    14,     0,     0,
       23,     0,    13,    15,     0,     2,     0,     9,    18,    20,
-      21,     0,    11,    16,     0,     0,    94,    42,     0,     0,
-      90,    68,    93,    44,    57,     0,     0,    92,     0,     0,
-      69,    91,    95,     0,    67,    81,     0,    25,    29,    33,
-      32,    28,    35,    36,    34,    37,    38,    39,    40,    31,
-      26,    65,    66,    27,    41,    85,    30,    89,    19,    22,
-     107,    53,     0,     0,     0,     0,    45,    55,    56,     0,
-       0,     0,     0,    24,    83,    84,    82,     0,     0,     0,
-      70,    86,    87,     0,   109,    17,   106,     0,     0,     0,
-     100,    96,     0,    52,    47,     0,   126,   129,   125,   123,
-     124,   128,   130,     0,   114,   115,   121,   122,   117,   116,
-     118,   127,   120,   119,     0,    60,    59,     0,    63,    62,
-       0,     0,    88,     0,     0,     0,     0,    72,    73,    74,
-      79,   112,   113,     0,   109,     0,     0,   103,    99,     0,
-      64,     0,   101,     0,     0,    51,     0,    46,    58,    61,
-      80,     0,    75,     0,    71,     0,   108,   110,     0,     0,
-      54,    98,    97,   102,     0,    49,    48,     0,     0,     0,
-      76,     0,     0,   104,    50,    43,    78,     0,   111,   105,
-      77
+      21,     0,    11,    16,     0,     0,    95,    42,     0,     0,
+      90,    68,    94,    44,    57,     0,     0,    92,     0,     0,
+      69,    91,    96,    93,     0,    67,    81,     0,    25,    29,
+      33,    32,    28,    35,    36,    34,    37,    38,    39,    40,
+      31,    26,    65,    66,    27,    41,    85,    30,    89,    19,
+      22,   108,    53,     0,     0,     0,     0,    45,    55,    56,
+       0,     0,     0,     0,    24,    83,    84,    82,     0,     0,
+       0,    70,    86,    87,     0,   110,    17,   107,     0,     0,
+       0,   101,    97,     0,    52,    47,     0,   127,   130,   126,
+     124,   125,   129,   131,     0,   115,   116,   122,   123,   118,
+     117,   119,   128,   121,   120,     0,    60,    59,     0,    63,
+      62,     0,     0,    88,     0,     0,     0,     0,    72,    73,
+      74,    79,   113,   114,     0,   110,     0,     0,   104,   100,
+       0,    64,     0,   102,     0,     0,    51,     0,    46,    58,
+      61,    80,     0,    75,     0,    71,     0,   109,   111,     0,
+       0,    54,    99,    98,   103,     0,    49,    48,     0,     0,
+       0,    76,     0,     0,   105,    50,    43,    78,     0,   112,
+     106,    77
 };
 
 /* YYDEFGOTO[NTERM-NUM]. */
 static const short int yydefgoto[] =
 {
       -1,     2,     8,    13,    18,    19,    21,    22,    23,    27,
-      28,    24,    29,    56,    57,    58,    86,    59,   113,   114,
-      60,   115,    61,    62,    63,    64,    65,    66,    67,    68,
-      69,    70,    71,    72,    73,   100,   146,   147,   148,   149,
-      74,    75,    97,   103,    30,    76,    77,   109,   110,   111,
-     156,   157,   105,   122,   153,   154,   123,   124,   125,   126,
-     127,   128,   129,   130,   131,   132,   133
+      28,    24,    29,    57,    58,    59,    87,    60,   114,   115,
+      61,   116,    62,    63,    64,    65,    66,    67,    68,    69,
+      70,    71,    72,    73,    74,   101,   147,   148,   149,   150,
+      75,    76,    98,   104,    30,    77,    78,   110,   111,   112,
+     157,   158,   106,   123,   154,   155,   124,   125,   126,   127,
+     128,   129,   130,   131,   132,   133,   134
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -99
+#define YYPACT_NINF -100
 static const short int yypact[] =
 {
-     -46,    20,    13,    21,   -99,    11,    23,    25,    54,   -99,
-     -99,   -99,    58,     6,   -99,    90,   -34,    15,    80,    19,
-      16,    18,    15,   -99,    74,   -99,    -7,   -99,    19,   -99,
-     -99,    15,   -99,   -99,    24,    42,   -99,   -99,    17,    26,
-     -99,   -99,   -99,   -73,   -99,    76,    50,   -99,   -45,   -44,
-     -99,   -99,   -99,    51,   -99,     4,   -67,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,   -99,   -16,   -99,   -99,   -99,   -99,
-      27,    28,    33,    37,    47,    37,   -99,   -99,   -99,    51,
-     -72,    51,   -71,    22,   -99,   -99,   -99,    35,    47,    12,
-     -99,   -99,   -99,    51,     2,   -99,   -99,    39,    51,   -75,
-      -8,   -99,    34,    36,   -99,    43,   -99,   -99,   -99,   -99,
-     -99,   -99,   -99,    48,   -99,   -99,   -99,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,   -57,    22,   -99,   -48,    22,   -99,
-     -22,    45,   -99,   120,    51,   122,    46,   -99,   -99,   -99,
-      22,    52,   -99,    53,     2,    57,    -9,   -99,    22,   -53,
-     -99,    47,   -99,    56,   -19,   -99,    47,   -99,   -99,   -99,
-     -99,    49,   -18,    47,   -99,    61,   -99,   -99,    62,    39,
-     -99,   -99,   -99,   -99,    59,   -99,   -99,    60,    63,   128,
-     -99,    64,    66,   -99,   -99,   -99,   -99,    47,   -99,   -99,
-     -99
+     -65,    19,    33,     5,  -100,   -29,   -17,    11,    53,  -100,
+    -100,  -100,    47,    13,  -100,    90,   -34,    18,    81,    20,
+      16,    21,    18,  -100,    76,  -100,    -7,  -100,    20,  -100,
+    -100,    18,  -100,  -100,    23,    43,  -100,  -100,    24,    25,
+    -100,  -100,  -100,    -4,  -100,    77,    46,  -100,   -48,   -45,
+    -100,  -100,  -100,  -100,    51,  -100,     4,   -64,  -100,  -100,
+    -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,  -100,  -100,   -16,  -100,  -100,  -100,
+    -100,    26,    27,    31,    36,    52,    36,  -100,  -100,  -100,
+      51,   -71,    51,   -70,    32,  -100,  -100,  -100,    37,    52,
+      12,  -100,  -100,  -100,    51,   -39,  -100,  -100,    39,    51,
+     -78,    -6,  -100,    35,    40,  -100,    38,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,    56,  -100,  -100,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,  -100,   -72,    32,  -100,   -57,    32,
+    -100,   -36,    45,  -100,   122,    51,   123,    50,  -100,  -100,
+    -100,    32,    44,  -100,    49,   -39,    57,   -22,  -100,    32,
+     -19,  -100,    52,  -100,    59,    10,  -100,    52,  -100,  -100,
+    -100,  -100,    58,   -14,    52,  -100,    61,  -100,  -100,    62,
+      39,  -100,  -100,  -100,  -100,    60,  -100,  -100,    63,    64,
+     133,  -100,    65,    67,  -100,  -100,  -100,  -100,    52,  -100,
+    -100,  -100
 };
 
 /* YYPGOTO[NTERM-NUM].  */
-static const yysigned_char yypgoto[] =
+static const short int yypgoto[] =
 {
-     -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   124,   126,
-     -99,   125,   -99,   -52,   -99,   -99,   -99,   -99,    70,    -4,
-     -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,   -99,   -99,   -99,   -37,   -99,     3,
-     -99,   -15,   -99,    81,     9,   -99,   -98,   -99,   -99,   -99,
-     -99,   -99,   -99,   -99,     5,   -99,   -99
+    -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,   132,   127,
+    -100,   126,  -100,   -53,  -100,  -100,  -100,  -100,    75,    -3,
+    -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,  -100,  -100,  -100,     0,  -100,     3,
+    -100,   -15,  -100,    83,    14,  -100,   -99,  -100,  -100,  -100,
+    -100,  -100,  -100,  -100,     2,  -100,  -100
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -795,44 +795,44 @@ static const yysigned_char yypgoto[] =
 #define YYTABLE_NINF -13
 static const short int yytable[] =
 {
-     142,    93,    35,    36,    37,   189,    17,    38,    89,    91,
-      94,   101,   161,     4,   108,   108,   159,    98,    39,    84,
-     160,    85,   102,   136,   139,    99,    40,    41,     5,    42,
-     143,   144,   181,   108,   164,   145,    43,   135,   167,   138,
-       1,     3,    44,   159,    45,    46,   162,   168,     6,    90,
-      92,   150,   -12,   137,    47,   140,   158,    48,    49,     7,
-      35,    36,    37,   183,    95,    38,   185,   112,   187,   159,
-      50,    51,    52,   169,    99,   190,    39,    53,   116,    54,
-      96,     9,   179,    12,    40,    41,   180,    42,   151,    55,
-      15,   152,   172,    10,    43,    11,   117,    14,    16,   200,
-      44,    20,    45,    46,    25,    26,    34,    31,    32,    81,
-      80,    82,    47,    87,    99,    48,    49,    88,   118,   108,
-      83,   104,   107,   112,   141,   155,   163,   164,    50,    51,
-      52,   166,   171,   119,   173,   120,   121,    54,   165,   174,
-     197,   104,   170,   188,   175,   121,    33,    55,   176,   178,
-     191,   192,   194,   195,    78,   134,    79,   198,   196,   199,
-     186,   106,   182,   177,   193,     0,     0,     0,   184
+     143,    94,    35,    36,    37,    90,    17,    38,    92,   190,
+      95,   102,     5,   160,   162,   109,   109,   161,    39,   165,
+      99,     1,   103,   168,   137,   140,    40,    41,   100,    42,
+     144,   145,     6,     4,   160,   146,    43,   136,   169,   139,
+       3,     9,    44,     7,    45,    46,    91,   152,   163,    93,
+     153,   151,   -12,    10,    47,   160,   159,    48,    49,   170,
+      35,    36,    37,   184,    96,    38,   182,   109,   188,   180,
+      50,    51,    52,   181,    53,   191,    39,    54,   100,    55,
+      97,    11,    12,   117,    40,    41,    14,    42,    85,    56,
+      86,   138,   173,   141,    43,   186,   113,    15,    16,   201,
+      44,   118,    45,    46,    20,    25,    26,    31,    34,    81,
+      82,    32,    47,    89,    88,    48,    49,   109,    83,    84,
+     105,   108,   113,   119,   100,   156,   142,   164,    50,    51,
+      52,   165,    53,   166,   172,   174,   176,    55,   120,   167,
+     121,   122,   171,   175,   177,   198,   105,    56,   122,   179,
+     192,   193,   189,   195,    33,    79,   196,    80,   199,   197,
+     200,   135,   187,   183,   107,   194,   185,     0,     0,   178
 };
 
 static const short int yycheck[] =
 {
-      98,    53,     9,    10,    11,    23,    40,    14,    53,    53,
-       6,    27,    20,     0,    86,    86,    91,    84,    25,    92,
-      95,    94,    38,    95,    95,    92,    33,    34,     7,    36,
-      18,    19,    85,    86,    91,    23,    43,    89,    95,    91,
-      86,    21,    49,    91,    51,    52,    54,    95,    27,    94,
-      94,   103,    86,    90,    61,    92,   108,    64,    65,    38,
-       9,    10,    11,   161,    60,    14,    85,    86,   166,    91,
-      77,    78,    79,    95,    92,   173,    25,    84,    31,    86,
-      76,    70,    91,    29,    33,    34,    95,    36,    86,    96,
-      84,    89,   144,    70,    43,    70,    49,    39,     8,   197,
-      49,    86,    51,    52,    24,    86,    32,    91,    90,    67,
-      86,    94,    61,    37,    92,    64,    65,    67,    71,    86,
-      94,    94,    94,    86,    89,    86,    92,    91,    77,    78,
-      79,    83,    12,    86,    12,    88,    89,    86,    95,    93,
-      12,    94,    97,    94,    92,    89,    22,    96,    95,    92,
-      89,    89,    93,    93,    28,    85,    31,    93,    95,    93,
-     164,    80,   159,   154,   179,    -1,    -1,    -1,   163
+      99,    54,     9,    10,    11,    53,    40,    14,    53,    23,
+       6,    27,     7,    91,    20,    86,    86,    95,    25,    91,
+      84,    86,    38,    95,    95,    95,    33,    34,    92,    36,
+      18,    19,    27,     0,    91,    23,    43,    90,    95,    92,
+      21,    70,    49,    38,    51,    52,    94,    86,    54,    94,
+      89,   104,    86,    70,    61,    91,   109,    64,    65,    95,
+       9,    10,    11,   162,    60,    14,    85,    86,   167,    91,
+      77,    78,    79,    95,    81,   174,    25,    84,    92,    86,
+      76,    70,    29,    31,    33,    34,    39,    36,    92,    96,
+      94,    91,   145,    93,    43,    85,    86,    84,     8,   198,
+      49,    49,    51,    52,    86,    24,    86,    91,    32,    86,
+      67,    90,    61,    67,    37,    64,    65,    86,    94,    94,
+      94,    94,    86,    71,    92,    86,    89,    92,    77,    78,
+      79,    91,    81,    95,    12,    12,    92,    86,    86,    83,
+      88,    89,    97,    93,    95,    12,    94,    96,    89,    92,
+      89,    89,    94,    93,    22,    28,    93,    31,    93,    95,
+      93,    86,   165,   160,    81,   180,   164,    -1,    -1,   155
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
@@ -844,22 +844,22 @@ static const unsigned char yystos[] =
       86,   104,   105,   106,   109,    24,    86,   107,   108,   110,
      142,    91,    90,   106,    32,     9,    10,    11,    14,    25,
       33,    34,    36,    43,    49,    51,    52,    61,    64,    65,
-      77,    78,    79,    84,    86,    96,   111,   112,   113,   115,
-     118,   120,   121,   122,   123,   124,   125,   126,   127,   128,
-     129,   130,   131,   132,   138,   139,   143,   144,   107,   109,
-      86,    67,    94,    94,    92,    94,   114,    37,    67,    53,
-      94,    53,    94,   111,     6,    60,    76,   140,    84,    92,
-     133,    27,    38,   141,    94,   150,   151,    94,    86,   145,
-     146,   147,    86,   116,   117,   119,    31,    49,    71,    86,
-      88,    89,   151,   154,   155,   156,   157,   158,   159,   160,
-     161,   162,   163,   164,   116,   111,    95,   145,   111,    95,
-     145,    89,   154,    18,    19,    23,   134,   135,   136,   137,
-     111,    86,    89,   152,   153,    86,   148,   149,   111,    91,
-      95,    20,    54,    92,    91,    95,    83,    95,    95,    95,
-      97,    12,   111,    12,    93,    92,    95,   152,    92,    91,
-      95,    85,   147,   154,   162,    85,   117,   154,    94,    23,
-     154,    89,    89,   149,    93,    93,    95,    12,    93,    93,
-     154
+      77,    78,    79,    81,    84,    86,    96,   111,   112,   113,
+     115,   118,   120,   121,   122,   123,   124,   125,   126,   127,
+     128,   129,   130,   131,   132,   138,   139,   143,   144,   107,
+     109,    86,    67,    94,    94,    92,    94,   114,    37,    67,
+      53,    94,    53,    94,   111,     6,    60,    76,   140,    84,
+      92,   133,    27,    38,   141,    94,   150,   151,    94,    86,
+     145,   146,   147,    86,   116,   117,   119,    31,    49,    71,
+      86,    88,    89,   151,   154,   155,   156,   157,   158,   159,
+     160,   161,   162,   163,   164,   116,   111,    95,   145,   111,
+      95,   145,    89,   154,    18,    19,    23,   134,   135,   136,
+     137,   111,    86,    89,   152,   153,    86,   148,   149,   111,
+      91,    95,    20,    54,    92,    91,    95,    83,    95,    95,
+      95,    97,    12,   111,    12,    93,    92,    95,   152,    92,
+      91,    95,    85,   147,   154,   162,    85,   117,   154,    94,
+      23,   154,    89,    89,   149,    93,    93,    95,    12,    93,
+      93,   154
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -1987,29 +1987,37 @@ yyreduce:
   case 93:
 #line 663 "parse.y"
     {
-			(yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, 
-				     TE_EXPLICIT, new_type(TIA5String));
+			(yyval.type) = new_tag(ASN1_C_UNIV, UT_VisibleString, 
+				     TE_EXPLICIT, new_type(TVisibleString));
 		}
     break;
 
   case 94:
 #line 668 "parse.y"
     {
-			(yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, 
-				     TE_EXPLICIT, new_type(TBMPString));
+			(yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, 
+				     TE_EXPLICIT, new_type(TIA5String));
 		}
     break;
 
   case 95:
 #line 673 "parse.y"
     {
+			(yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, 
+				     TE_EXPLICIT, new_type(TBMPString));
+		}
+    break;
+
+  case 96:
+#line 678 "parse.y"
+    {
 			(yyval.type) = new_tag(ASN1_C_UNIV, UT_UniversalString, 
 				     TE_EXPLICIT, new_type(TUniversalString));
 		}
     break;
 
-  case 96:
-#line 681 "parse.y"
+  case 97:
+#line 686 "parse.y"
     {
 			(yyval.members) = emalloc(sizeof(*(yyval.members)));
 			ASN1_TAILQ_INIT((yyval.members));
@@ -2017,16 +2025,16 @@ yyreduce:
 		}
     break;
 
-  case 97:
-#line 687 "parse.y"
+  case 98:
+#line 692 "parse.y"
     {
 			ASN1_TAILQ_INSERT_TAIL((yyvsp[-2].members), (yyvsp[0].member), members);
 			(yyval.members) = (yyvsp[-2].members);
 		}
     break;
 
-  case 98:
-#line 692 "parse.y"
+  case 99:
+#line 697 "parse.y"
     {
 		        struct member *m = ecalloc(1, sizeof(*m));
 			m->name = estrdup("...");
@@ -2037,8 +2045,8 @@ yyreduce:
 		}
     break;
 
-  case 99:
-#line 703 "parse.y"
+  case 100:
+#line 708 "parse.y"
     {
 		  (yyval.member) = emalloc(sizeof(*(yyval.member)));
 		  (yyval.member)->name = (yyvsp[-1].name);
@@ -2049,8 +2057,8 @@ yyreduce:
 		}
     break;
 
-  case 100:
-#line 714 "parse.y"
+  case 101:
+#line 719 "parse.y"
     {
 			(yyval.member) = (yyvsp[0].member);
 			(yyval.member)->optional = 0;
@@ -2058,8 +2066,8 @@ yyreduce:
 		}
     break;
 
-  case 101:
-#line 720 "parse.y"
+  case 102:
+#line 725 "parse.y"
     {
 			(yyval.member) = (yyvsp[-1].member);
 			(yyval.member)->optional = 1;
@@ -2067,8 +2075,8 @@ yyreduce:
 		}
     break;
 
-  case 102:
-#line 726 "parse.y"
+  case 103:
+#line 731 "parse.y"
     {
 			(yyval.member) = (yyvsp[-2].member);
 			(yyval.member)->optional = 0;
@@ -2076,8 +2084,8 @@ yyreduce:
 		}
     break;
 
-  case 103:
-#line 734 "parse.y"
+  case 104:
+#line 739 "parse.y"
     {
 			(yyval.members) = emalloc(sizeof(*(yyval.members)));
 			ASN1_TAILQ_INIT((yyval.members));
@@ -2085,16 +2093,16 @@ yyreduce:
 		}
     break;
 
-  case 104:
-#line 740 "parse.y"
+  case 105:
+#line 745 "parse.y"
     {
 			ASN1_TAILQ_INSERT_TAIL((yyvsp[-2].members), (yyvsp[0].member), members);
 			(yyval.members) = (yyvsp[-2].members);
 		}
     break;
 
-  case 105:
-#line 747 "parse.y"
+  case 106:
+#line 752 "parse.y"
     {
 		  (yyval.member) = emalloc(sizeof(*(yyval.member)));
 		  (yyval.member)->name = (yyvsp[-3].name);
@@ -2107,27 +2115,27 @@ yyreduce:
 		}
     break;
 
-  case 107:
-#line 760 "parse.y"
+  case 108:
+#line 765 "parse.y"
     { (yyval.objid) = NULL; }
     break;
 
-  case 108:
-#line 764 "parse.y"
+  case 109:
+#line 769 "parse.y"
     {
 			(yyval.objid) = (yyvsp[-1].objid);
 		}
     break;
 
-  case 109:
-#line 770 "parse.y"
+  case 110:
+#line 775 "parse.y"
     {
 			(yyval.objid) = NULL;
 		}
     break;
 
-  case 110:
-#line 774 "parse.y"
+  case 111:
+#line 779 "parse.y"
     {
 		        if ((yyvsp[0].objid)) {
 				(yyval.objid) = (yyvsp[0].objid);
@@ -2138,15 +2146,15 @@ yyreduce:
 		}
     break;
 
-  case 111:
-#line 785 "parse.y"
+  case 112:
+#line 790 "parse.y"
     {
 			(yyval.objid) = new_objid((yyvsp[-3].name), (yyvsp[-1].constant));
 		}
     break;
 
-  case 112:
-#line 789 "parse.y"
+  case 113:
+#line 794 "parse.y"
     {
 		    Symbol *s = addsym((yyvsp[0].name));
 		    if(s->stype != SValue ||
@@ -2159,15 +2167,15 @@ yyreduce:
 		}
     break;
 
-  case 113:
-#line 800 "parse.y"
+  case 114:
+#line 805 "parse.y"
     {
 		    (yyval.objid) = new_objid(NULL, (yyvsp[0].constant));
 		}
     break;
 
-  case 123:
-#line 823 "parse.y"
+  case 124:
+#line 828 "parse.y"
     {
 			Symbol *s = addsym((yyvsp[0].name));
 			if(s->stype != SValue)
@@ -2178,8 +2186,8 @@ yyreduce:
 		}
     break;
 
-  case 124:
-#line 834 "parse.y"
+  case 125:
+#line 839 "parse.y"
     {
 			(yyval.value) = emalloc(sizeof(*(yyval.value)));
 			(yyval.value)->type = stringvalue;
@@ -2187,8 +2195,8 @@ yyreduce:
 		}
     break;
 
-  case 125:
-#line 842 "parse.y"
+  case 126:
+#line 847 "parse.y"
     {
 			(yyval.value) = emalloc(sizeof(*(yyval.value)));
 			(yyval.value)->type = booleanvalue;
@@ -2196,8 +2204,8 @@ yyreduce:
 		}
     break;
 
-  case 126:
-#line 848 "parse.y"
+  case 127:
+#line 853 "parse.y"
     {
 			(yyval.value) = emalloc(sizeof(*(yyval.value)));
 			(yyval.value)->type = booleanvalue;
@@ -2205,8 +2213,8 @@ yyreduce:
 		}
     break;
 
-  case 127:
-#line 856 "parse.y"
+  case 128:
+#line 861 "parse.y"
     {
 			(yyval.value) = emalloc(sizeof(*(yyval.value)));
 			(yyval.value)->type = integervalue;
@@ -2214,14 +2222,14 @@ yyreduce:
 		}
     break;
 
-  case 129:
-#line 867 "parse.y"
+  case 130:
+#line 872 "parse.y"
     {
 		}
     break;
 
-  case 130:
-#line 872 "parse.y"
+  case 131:
+#line 877 "parse.y"
     {
 			(yyval.value) = emalloc(sizeof(*(yyval.value)));
 			(yyval.value)->type = objectidentifiervalue;
@@ -2234,7 +2242,7 @@ yyreduce:
     }
 
 /* Line 1126 of yacc.c.  */
-#line 2238 "parse.c"
+#line 2246 "parse.c"
 
   yyvsp -= yylen;
   yyssp -= yylen;
@@ -2502,7 +2510,7 @@ yyreturn:
 }
 
 
-#line 879 "parse.y"
+#line 884 "parse.y"
 
 
 void
diff --git a/source4/heimdal/lib/asn1/parse.y b/source4/heimdal/lib/asn1/parse.y
index 2238478284..029cef9f0f 100644
--- a/source4/heimdal/lib/asn1/parse.y
+++ b/source4/heimdal/lib/asn1/parse.y
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: parse.y,v 1.27 2005/12/14 09:44:36 lha Exp $ */
+/* $Id: parse.y,v 1.29 2006/12/28 17:15:02 lha Exp $ */
 
 %{
 #ifdef HAVE_CONFIG_H
@@ -45,7 +45,7 @@
 #include "gen_locl.h"
 #include "der.h"
 
-RCSID("$Id: parse.y,v 1.27 2005/12/14 09:44:36 lha Exp $");
+RCSID("$Id: parse.y,v 1.29 2006/12/28 17:15:02 lha Exp $");
 
 static Type *new_type (Typetype t);
 static struct constraint_spec *new_constraint_spec(enum ctype);
@@ -537,8 +537,10 @@ Constraint	: '(' ConstraintSpec ')'
 		{
 		    $$ = $2;
 		}
+		;
 
 ConstraintSpec	: GeneralConstraint
+		;
 
 GeneralConstraint: ContentsConstraint
 		| UserDefinedConstraint
@@ -657,6 +659,11 @@ RestrictedCharactedStringType: kw_GeneralString
 			$$ = new_tag(ASN1_C_UNIV, UT_PrintableString, 
 				     TE_EXPLICIT, new_type(TPrintableString));
 		}
+		| kw_VisibleString
+		{
+			$$ = new_tag(ASN1_C_UNIV, UT_VisibleString, 
+				     TE_EXPLICIT, new_type(TVisibleString));
+		}
 		| kw_IA5String
 		{
 			$$ = new_tag(ASN1_C_UNIV, UT_IA5String, 
diff --git a/source4/heimdal/lib/asn1/rfc2459.asn1 b/source4/heimdal/lib/asn1/rfc2459.asn1
index eebbc3211b..430674a5ee 100644
--- a/source4/heimdal/lib/asn1/rfc2459.asn1
+++ b/source4/heimdal/lib/asn1/rfc2459.asn1
@@ -406,13 +406,31 @@ CRLReason ::= ENUMERATED {
 	aACompromise           (10)
 }
 
+id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
+            dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
+
+id-pkix-on OBJECT IDENTIFIER ::= { id-pkix 8 }
+id-pkix-on-dnsSRV OBJECT IDENTIFIER ::= { id-pkix-on 7 }
+
+id-pkix-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
+id-pkix-kp-serverAuth OBJECT IDENTIFIER ::= { id-pkix-kp 1 }
+id-pkix-kp-clientAuth OBJECT IDENTIFIER ::= { id-pkix-kp 2 }
+id-pkix-kp-emailProtection OBJECT IDENTIFIER ::= { id-pkix-kp 4 }
+id-pkix-kp-timeStamping OBJECT IDENTIFIER ::= { id-pkix-kp 8 }
+id-pkix-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-pkix-kp 9 }
+
 -- RFC 3820 Proxy Certificate Profile
 
-id-pkix-pe OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
-            dod(6) internet(1) security(5) mechanisms(5) pkix(7) 1 }
+id-pkix-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
 
 id-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pkix-pe 14 }
 
+id-pkix-ppl  OBJECT IDENTIFIER ::= { id-pkix 21 }
+
+id-pkix-ppl-anyLanguage     OBJECT IDENTIFIER ::= { id-pkix-ppl 0 }
+id-pkix-ppl-inheritAll      OBJECT IDENTIFIER ::= { id-pkix-ppl 1 }
+id-pkix-ppl-independent     OBJECT IDENTIFIER ::= { id-pkix-ppl 2 }
+
 ProxyPolicy ::= SEQUENCE {
 	policyLanguage		OBJECT IDENTIFIER,
 	policy			OCTET STRING OPTIONAL
diff --git a/source4/heimdal/lib/asn1/symbol.h b/source4/heimdal/lib/asn1/symbol.h
index 93a6e019bd..436bd043a1 100644
--- a/source4/heimdal/lib/asn1/symbol.h
+++ b/source4/heimdal/lib/asn1/symbol.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: symbol.h,v 1.13 2005/12/06 19:59:52 lha Exp $ */
+/* $Id: symbol.h,v 1.14 2006/12/28 17:15:05 lha Exp $ */
 
 #ifndef _SYMBOL_H
 #define _SYMBOL_H
@@ -60,7 +60,8 @@ enum typetype {
     TUTCTime, 
     TUTF8String,
     TBMPString,
-    TUniversalString
+    TUniversalString,
+    TVisibleString
 };
 
 typedef enum typetype Typetype;