r23678: Update to current lorikeet-heimdal (-r 767), which should fix the

panics on hosts without /dev/random.

Andrew Bartlett
(This used to be commit 14a4ddb131993fec72316f7e8e371638749e6f1f)

14 files changed, 136 insertions, 121 deletions

diff --git a/source4/heimdal/lib/gssapi/krb5/acquire_cred.c b/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
index 42b57cdadd..d5c70636bc 100644
--- a/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
+++ b/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: acquire_cred.c 20688 2007-05-17 18:44:31Z lha $");
+RCSID("$Id: acquire_cred.c 21221 2007-06-20 08:42:10Z lha $");
 
 OM_uint32
 __gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
@@ -256,8 +256,8 @@ static OM_uint32 acquire_acceptor_cred
 	if (kret)
 	    goto end;
 	krb5_kt_free_entry(context, &entry);
+	ret = GSS_S_COMPLETE;
     }
-    ret = GSS_S_COMPLETE;
  
 end:
     if (ret != GSS_S_COMPLETE) {
diff --git a/source4/heimdal/lib/gssapi/krb5/display_name.c b/source4/heimdal/lib/gssapi/krb5/display_name.c
index 93fac8d67b..727c447d2a 100644
--- a/source4/heimdal/lib/gssapi/krb5/display_name.c
+++ b/source4/heimdal/lib/gssapi/krb5/display_name.c
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: display_name.c 19031 2006-11-13 18:02:57Z lha $");
+RCSID("$Id: display_name.c 21077 2007-06-12 22:42:56Z lha $");
 
 OM_uint32 _gsskrb5_display_name
            (OM_uint32 * minor_status,
@@ -50,7 +50,8 @@ OM_uint32 _gsskrb5_display_name
 
     GSSAPI_KRB5_INIT (&context);
 
-    kret = krb5_unparse_name (context, name, &buf);
+    kret = krb5_unparse_name_flags (context, name,
+				    KRB5_PRINCIPAL_UNPARSE_DISPLAY, &buf);
     if (kret) {
 	*minor_status = kret;
 	return GSS_S_FAILURE;
diff --git a/source4/heimdal/lib/gssapi/krb5/prf.c b/source4/heimdal/lib/gssapi/krb5/prf.c
index 3eb90d279f..f79c9374a9 100644
--- a/source4/heimdal/lib/gssapi/krb5/prf.c
+++ b/source4/heimdal/lib/gssapi/krb5/prf.c
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: prf.c 20679 2007-05-14 03:12:05Z lha $");
+RCSID("$Id: prf.c 21129 2007-06-18 20:28:44Z lha $");
 
 OM_uint32
 _gsskrb5_pseudo_random(OM_uint32 *minor_status,
@@ -67,6 +67,7 @@ _gsskrb5_pseudo_random(OM_uint32 *minor_status,
     switch(prf_key) {
     case GSS_C_PRF_KEY_FULL:
 	_gsskrb5i_get_acceptor_subkey(ctx, context, &key);
+	break;
     case GSS_C_PRF_KEY_PARTIAL:
 	_gsskrb5i_get_initiator_subkey(ctx, context, &key);
 	break;
diff --git a/source4/heimdal/lib/gssapi/krb5/release_name.c b/source4/heimdal/lib/gssapi/krb5/release_name.c
index a01a9a2a62..80b91930fd 100644
--- a/source4/heimdal/lib/gssapi/krb5/release_name.c
+++ b/source4/heimdal/lib/gssapi/krb5/release_name.c
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: release_name.c 19031 2006-11-13 18:02:57Z lha $");
+RCSID("$Id: release_name.c 21128 2007-06-18 20:26:50Z lha $");
 
 OM_uint32 _gsskrb5_release_name
            (OM_uint32 * minor_status,
@@ -43,8 +43,7 @@ OM_uint32 _gsskrb5_release_name
     krb5_context context;
     krb5_principal name = (krb5_principal)*input_name;
 
-    if (minor_status)
-      *minor_status = 0;
+    *minor_status = 0;
 
     GSSAPI_KRB5_INIT (&context);
 
diff --git a/source4/heimdal/lib/gssapi/mech/context.c b/source4/heimdal/lib/gssapi/mech/context.c
index 1691fd9401..e4517bee44 100644
--- a/source4/heimdal/lib/gssapi/mech/context.c
+++ b/source4/heimdal/lib/gssapi/mech/context.c
@@ -1,7 +1,7 @@
 #include "mech/mech_locl.h"
 #include "heim_threads.h"
 
-RCSID("$Id: context.c 19924 2007-01-16 10:17:01Z lha $");
+RCSID("$Id: context.c 21248 2007-06-21 00:45:13Z lha $");
 
 struct mg_thread_ctx {
     gss_OID mech;
@@ -79,7 +79,7 @@ _gss_mg_get_error(const gss_OID mech, OM_uint32 type,
 
     switch (type) {
     case GSS_C_GSS_CODE: {
-	if (value != mg->maj_stat)
+	if (value != mg->maj_stat || mg->maj_error.length == 0)
 	    break;
 	string->value = malloc(mg->maj_error.length);
 	string->length = mg->maj_error.length;
@@ -87,7 +87,7 @@ _gss_mg_get_error(const gss_OID mech, OM_uint32 type,
 	return GSS_S_COMPLETE;
     }
     case GSS_C_MECH_CODE: {
-	if (value != mg->min_stat)
+	if (value != mg->min_stat || mg->min_error.length == 0)
 	    break;
 	string->value = malloc(mg->min_error.length);
 	string->length = mg->min_error.length;
diff --git a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
index 8c5f4d0b08..d1e243d8b8 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_accept_sec_context.c 20626 2007-05-08 13:56:49Z lha $");
+RCSID("$Id: gss_accept_sec_context.c 21237 2007-06-20 11:21:09Z lha $");
 
 static OM_uint32
 parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
@@ -237,9 +237,7 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
 		return (major_status);
 	}
 
-	if (!src_name) {
-		m->gm_release_name(minor_status, &src_mn);
-	} else {
+	if (src_name && src_mn) {
 		/*
 		 * Make a new name and mark it as an MN.
 		 */
@@ -250,13 +248,15 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
 			return (GSS_S_FAILURE);
 		}
 		*src_name = (gss_name_t) name;
+	} else if (src_mn) {
+	    m->gm_release_name(minor_status, &src_mn);
 	}
 
 	if (mech_ret_flags & GSS_C_DELEG_FLAG) {
 		if (!delegated_cred_handle) {
 			m->gm_release_cred(minor_status, &delegated_mc);
 			*ret_flags &= ~GSS_C_DELEG_FLAG;
-		} else {
+		} else if (delegated_mc) {
 			struct _gss_cred *dcred;
 			struct _gss_mechanism_cred *dmc;
 
diff --git a/source4/heimdal/lib/gssapi/mech/gss_display_name.c b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
index e57e5dd795..fc10933692 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_display_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_display_name.c 19952 2007-01-17 10:16:15Z lha $");
+RCSID("$Id: gss_display_name.c 21246 2007-06-20 15:25:19Z lha $");
 
 OM_uint32
 gss_display_name(OM_uint32 *minor_status,
@@ -43,6 +43,11 @@ gss_display_name(OM_uint32 *minor_status,
 	if (output_name_type)
 	    *output_name_type = GSS_C_NO_OID;
 
+	if (name == NULL) {
+		*minor_status = 0;
+		return (GSS_S_BAD_NAME);
+	}
+
 	/*
 	 * If we know it, copy the buffer used to import the name in
 	 * the first place. Otherwise, ask all the MNs in turn if
diff --git a/source4/heimdal/lib/gssapi/mech/gss_display_status.c b/source4/heimdal/lib/gssapi/mech/gss_display_status.c
index c316c26fd7..37ded26db6 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_display_status.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_display_status.c
@@ -59,7 +59,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_display_status.c 20084 2007-01-31 12:12:08Z lha $");
+RCSID("$Id: gss_display_status.c 21247 2007-06-21 00:37:27Z lha $");
 
 static const char *
 calling_error(OM_uint32 v)
@@ -85,7 +85,7 @@ static const char *
 routine_error(OM_uint32 v)
 {
     static const char *msgs[] = {
-	NULL,			/* 0 */
+	"Function completed successfully",			/* 0 */
 	"An unsupported mechanism was requested",
 	"An invalid name was supplied",
 	"A supplied name was of an unsupported type",
@@ -109,9 +109,7 @@ routine_error(OM_uint32 v)
 
     v >>= GSS_C_ROUTINE_ERROR_OFFSET;
 
-    if (v == 0)
-	return "";
-    else if (v >= sizeof(msgs)/sizeof(*msgs))
+    if (v >= sizeof(msgs)/sizeof(*msgs))
 	return "unknown routine error";
     else
 	return msgs[v];
diff --git a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
index 3aab0b9bbc..4ff81fdf2d 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_duplicate_name.c 19953 2007-01-17 11:16:35Z lha $");
+RCSID("$Id: gss_duplicate_name.c 21219 2007-06-20 08:27:11Z lha $");
 
 OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
     const gss_name_t src_name,
@@ -44,7 +44,7 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
 	/*
 	 * If this name has a value (i.e. it didn't come from
 	 * gss_canonicalize_name(), we re-import the thing. Otherwise,
-	 * we make an empty name to hold the MN copy.
+	 * we make copy of each mech names.
 	 */
 	if (name->gn_value.value) {
 		major_status = gss_import_name(minor_status,
@@ -52,6 +52,10 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
 		if (major_status != GSS_S_COMPLETE)
 			return (major_status);
 		new_name = (struct _gss_name *) *dest_name;
+		
+		SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+			_gss_find_mn(new_name, mn->gmn_mech_oid);
+		}
 	} else {
 		new_name = malloc(sizeof(struct _gss_name));
 		if (!new_name) {
@@ -59,17 +63,30 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
 			return (GSS_S_FAILURE);
 		}
 		memset(new_name, 0, sizeof(struct _gss_name));
-		SLIST_INIT(&name->gn_mn);
+		SLIST_INIT(&new_name->gn_mn);
 		*dest_name = (gss_name_t) new_name;
-	}
+		
+		SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+			struct _gss_mechanism_name *new_mn;
+			
+			new_mn = malloc(sizeof(*new_mn));
+			if (!new_mn) {
+				*minor_status = ENOMEM;
+				return GSS_S_FAILURE;
+			}
+			new_mn->gmn_mech = mn->gmn_mech;
+			new_mn->gmn_mech_oid = mn->gmn_mech_oid;
+			
+			major_status = 
+			    mn->gmn_mech->gm_duplicate_name(minor_status,
+				mn->gmn_name, &new_mn->gmn_name);
+			if (major_status != GSS_S_COMPLETE) {
+				free(new_mn);
+				continue;
+			}
+			SLIST_INSERT_HEAD(&new_name->gn_mn, new_mn, gmn_link);
+		}
 
-	/*
-	 * Import the new name into any mechanisms listed in the
-	 * original name. We could probably get away with only doing
-	 * this if the original was canonical.
-	 */
-	SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
-		_gss_find_mn(new_name, mn->gmn_mech_oid);
 	}
 
 	return (GSS_S_COMPLETE);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
index 5cce30c6bd..d45baac602 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_context.c 19958 2007-01-17 13:56:18Z lha $");
+RCSID("$Id: gss_inquire_context.c 21125 2007-06-18 20:11:07Z lha $");
 
 OM_uint32
 gss_inquire_context(OM_uint32 *minor_status,
@@ -79,7 +79,8 @@ gss_inquire_context(OM_uint32 *minor_status,
 	if (src_name) {
 		name = _gss_make_name(m, src_mn);
 		if (!name) {
-			*mech_type = GSS_C_NO_OID;
+			if (mech_type)
+				*mech_type = GSS_C_NO_OID;
 			m->gm_release_name(minor_status, &src_mn);
 			*minor_status = 0;
 			return (GSS_S_FAILURE);
@@ -90,8 +91,10 @@ gss_inquire_context(OM_uint32 *minor_status,
 	if (targ_name) {
 		name = _gss_make_name(m, targ_mn);
 		if (!name) {
-			*mech_type = GSS_C_NO_OID;
-			gss_release_name(minor_status, src_name);
+			if (mech_type)
+				*mech_type = GSS_C_NO_OID;
+			if (src_name)
+				gss_release_name(minor_status, src_name);
 			m->gm_release_name(minor_status, &targ_mn);
 			*minor_status = 0;
 			return (GSS_S_FAILURE);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
index a4ace9e9e9..aa83efb0c2 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_cred_by_mech.c 19960 2007-01-17 15:09:24Z lha $");
+RCSID("$Id: gss_inquire_cred_by_mech.c 21124 2007-06-18 20:08:24Z lha $");
 
 OM_uint32
 gss_inquire_cred_by_mech(OM_uint32 *minor_status,
@@ -78,12 +78,16 @@ gss_inquire_cred_by_mech(OM_uint32 *minor_status,
 		return (major_status);
 	}
 
-	name = _gss_make_name(m, mn);
-	if (!name) {
+	if (cred_name) {
+	    name = _gss_make_name(m, mn);
+	    if (!name) {
 		m->gm_release_name(minor_status, &mn);
 		return (GSS_S_NO_CRED);
-	}
+	    }
+	    *cred_name = (gss_name_t) name;
+	} else
+	    m->gm_release_name(minor_status, &mn);
+
 
-	*cred_name = (gss_name_t) name;
 	return (GSS_S_COMPLETE);
 }
diff --git a/source4/heimdal/lib/gssapi/mech/gss_krb5.c b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
index 2500928baf..9e77f42982 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_krb5.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_krb5.c 20383 2007-04-18 08:49:53Z lha $");
+RCSID("$Id: gss_krb5.c 21123 2007-06-18 20:05:26Z lha $");
 
 #include <krb5.h>
 #include <roken.h>
@@ -650,7 +650,7 @@ gsskrb5_extract_authz_data_from_sec_context(OM_uint32 *minor_status,
     if (der_put_oid((unsigned char *)oid_flat.elements + oid_flat.length - 1, 
 		    oid_flat.length, &oid, &size) != 0) {
 	free(oid.components);
-
+	free(oid_flat.elements);
 	*minor_status = EINVAL;
 	return GSS_S_FAILURE;
     }
diff --git a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
index 78c8cc79c1..c32291396f 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_set_cred_option.c 20626 2007-05-08 13:56:49Z lha $");
+RCSID("$Id: gss_set_cred_option.c 21126 2007-06-18 20:19:59Z lha $");
 
 OM_uint32
 gss_set_cred_option (OM_uint32 *minor_status,
@@ -64,7 +64,9 @@ gss_set_cred_option (OM_uint32 *minor_status,
 
 			mc = malloc(sizeof(*mc));
 			if (mc == NULL) {
-			    /* XXX free the other mc's */
+			    *cred_handle = (gss_cred_id_t)cred;
+			    gss_release_cred(minor_status, cred_handle);
+			    *minor_status = ENOMEM;
 			    return GSS_S_FAILURE;
 			}
 
diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 106897b9b0..d20c913bf0 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 20929 2007-06-05 21:19:22Z lha $");
+RCSID("$Id: accept_sec_context.c 21243 2007-06-20 15:16:22Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -540,12 +540,12 @@ acceptor_start
 	    gss_cred_id_t *delegated_cred_handle
 	   )
 {
-    OM_uint32 ret, ret2, minor;
-    NegTokenInit ni;
-    size_t ni_len;
+    OM_uint32 ret, junk, minor;
+    NegotiationToken nt;
+    size_t nt_len;
+    NegTokenInit *ni;
     int i;
     gss_buffer_desc data;
-    size_t len, taglen;
     gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
     gss_buffer_desc mech_output_token;
     gss_buffer_desc mech_buf;
@@ -555,6 +555,9 @@ acceptor_start
     int get_mic = 0;
     int first_ok = 0;
 
+    if (src_name)
+	*src_name = GSS_C_NO_NAME;
+
     mech_output_token.value = NULL;
     mech_output_token.length = 0;
     mech_buf.value = NULL;
@@ -582,39 +585,30 @@ acceptor_start
     if (ret)
 	return ret;
 
-    ret = der_match_tag_and_length(data.value, data.length,
-				   ASN1_C_CONTEXT, CONS,
-				   0,
-				   &len, &taglen);
+    ret = decode_NegotiationToken(data.value, data.length, &nt, &nt_len);
+    gss_release_buffer(minor_status, &data);
     if (ret) {
 	*minor_status = ret;
-	return GSS_S_FAILURE;
-    }
-
-    if (len > data.length - taglen) {
-	*minor_status = ASN1_OVERRUN;
-	return GSS_S_FAILURE;
+	return GSS_S_DEFECTIVE_TOKEN;
     }
-
-    ret = decode_NegTokenInit((const unsigned char *)data.value + taglen, 
-				  len, &ni, &ni_len);
-    if (ret) {
-	*minor_status = ret;
+    if (nt.element != choice_NegotiationToken_negTokenInit) {
+	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
+    ni = &nt.u.negTokenInit;
 
-    if (ni.mechTypes.len < 1) {
-	free_NegTokenInit(&ni);
+    if (ni->mechTypes.len < 1) {
+	free_NegotiationToken(&nt);
 	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 
-    ret = copy_MechTypeList(&ni.mechTypes, &ctx->initiator_mech_types);
+    ret = copy_MechTypeList(&ni->mechTypes, &ctx->initiator_mech_types);
     if (ret) {
 	HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
-	free_NegTokenInit(&ni);
+	free_NegotiationToken(&nt);
 	*minor_status = ret;
 	return GSS_S_FAILURE;
     }
@@ -627,17 +621,17 @@ acceptor_start
      */
 
     ret = select_mech(minor_status,
-		      &ni.mechTypes.val[0], 
+		      &ni->mechTypes.val[0], 
 		      0,
 		      &preferred_mech_type);
 
-    if (ret == 0 && ni.mechToken != NULL) {
+    if (ret == 0 && ni->mechToken != NULL) {
 	gss_cred_id_t mech_delegated_cred = GSS_C_NO_CREDENTIAL;
 	gss_cred_id_t mech_cred;
 	gss_buffer_desc ibuf;
 
-	ibuf.length = ni.mechToken->length;
-	ibuf.value = ni.mechToken->data;
+	ibuf.length = ni->mechToken->length;
+	ibuf.value = ni->mechToken->data;
 	mech_input_token = &ibuf;
 
 	if (acceptor_cred != NULL)
@@ -668,12 +662,12 @@ acceptor_start
 	    if (ret == GSS_S_COMPLETE)
 		ctx->open = 1;
 
-	    if (delegated_cred_handle)
+	    if (mech_delegated_cred && delegated_cred_handle)
 		ret = _gss_spnego_alloc_cred(minor_status,
 					     mech_delegated_cred,
 					     delegated_cred_handle);
 	    else
-		gss_release_cred(&ret2, &mech_delegated_cred);
+		gss_release_cred(&junk, &mech_delegated_cred);
 
 	    ret = acceptor_complete(minor_status,
 				    ctx,
@@ -681,7 +675,7 @@ acceptor_start
 				    &mech_buf,
 				    mech_input_token,
 				    &mech_output_token,
-				    ni.mechListMIC,
+				    ni->mechListMIC,
 				    output_token);
 	    if (ret != GSS_S_COMPLETE)
 		goto out;
@@ -697,9 +691,9 @@ acceptor_start
     if (!first_ok) {
 
 	/* Call glue layer to find first mech we support */
-	for (i = 1; i < ni.mechTypes.len; ++i) {
+	for (i = 1; i < ni->mechTypes.len; ++i) {
 	    ret = select_mech(minor_status,
-			      &ni.mechTypes.val[i],
+			      &ni->mechTypes.val[i],
 			      1,
 			      &preferred_mech_type);
 	    if (ret == 0)
@@ -707,7 +701,7 @@ acceptor_start
 	}
 	if (preferred_mech_type == GSS_C_NO_OID) {
 	    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
-	    free_NegTokenInit(&ni);
+	    free_NegotiationToken(&nt);
 	    return GSS_S_BAD_MECH;
 	}
 
@@ -735,7 +729,8 @@ out:
 	free(mech_buf.value);
 	mech_buf.value = NULL;
     }
-    free_NegTokenInit(&ni);
+    free_NegotiationToken(&nt);
+
 
     if (ret == GSS_S_COMPLETE) {
 	if (src_name != NULL && ctx->mech_src_name != NULL) {
@@ -746,8 +741,7 @@ out:
 		name->mech = ctx->mech_src_name;
 		ctx->mech_src_name = NULL;
 		*src_name = (gss_name_t)name;
-	    } else
-		*src_name = GSS_C_NO_NAME;
+	    }
 	}
         if (delegated_cred_handle != NULL) {
 	    *delegated_cred_handle = ctx->delegated_cred_id;
@@ -790,10 +784,9 @@ acceptor_continue
 	   )
 {
     OM_uint32 ret, ret2, minor;
-    NegTokenResp na;
-    size_t na_len;
-    gss_buffer_desc data;
-    size_t len, taglen;
+    NegotiationToken nt;
+    size_t nt_len;
+    NegTokenResp *na;
     unsigned int negResult = accept_incomplete;
     gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
     gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
@@ -810,45 +803,34 @@ acceptor_continue
      * context token (negTokenInit).
      */
 
-    data.value  = input_token_buffer->value;
-    data.length = input_token_buffer->length;
-
-    ret = der_match_tag_and_length(data.value, data.length,
-				   ASN1_C_CONTEXT, CONS,
-				   1,
-				   &len, &taglen);
+    ret = decode_NegotiationToken(input_token_buffer->value, 
+				  input_token_buffer->length,
+				  &nt, &nt_len);
     if (ret) {
 	*minor_status = ret;
-	return GSS_S_FAILURE;
-    }
-
-    if (len > data.length - taglen) {
-	*minor_status = ASN1_OVERRUN;
-	return GSS_S_FAILURE;
+	return GSS_S_DEFECTIVE_TOKEN;
     }
-
-    ret = decode_NegTokenResp((const unsigned char *)data.value + taglen, 
-			      len, &na, &na_len);
-    if (ret) {
-	*minor_status = ret;
+    if (nt.element != choice_NegotiationToken_negTokenResp) {
+	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
+    na = &nt.u.negTokenResp;
 
-    if (na.negResult != NULL) {
-	negResult = *(na.negResult);
+    if (na->negResult != NULL) {
+	negResult = *(na->negResult);
     }
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 
     {
 	gss_buffer_desc ibuf, obuf;
-	int require_mic, get_mic;
+	int require_mic, get_mic = 0;
 	int require_response;
 	heim_octet_string *mic;
 
-	if (na.responseToken != NULL) {
-	    ibuf.length = na.responseToken->length;
-	    ibuf.value = na.responseToken->data;
+	if (na->responseToken != NULL) {
+	    ibuf.length = na->responseToken->length;
+	    ibuf.value = na->responseToken->data;
 	    mech_input_token = &ibuf;
 	} else {
 	    ibuf.value = NULL;
@@ -901,7 +883,7 @@ acceptor_continue
 		mech_output_token = &obuf;
 	    }
 	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
-		free_NegTokenResp(&na);
+		free_NegotiationToken(&nt);
 		send_reject (minor_status, output_token);
 		HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 		return ret;
@@ -919,7 +901,7 @@ acceptor_continue
 
 	ctx->require_mic = require_mic;
 
-	mic = na.mechListMIC;
+	mic = na->mechListMIC;
 	if (mic != NULL)
 	    require_mic = 1;
 
@@ -930,7 +912,7 @@ acceptor_continue
 				    &mech_buf,
 				    mech_input_token,
 				    mech_output_token,
-				    na.mechListMIC,
+				    na->mechListMIC,
 				    output_token);
 
 	if (ctx->mech_flags & GSS_C_DCE_STYLE)
@@ -964,16 +946,19 @@ acceptor_continue
 	    gss_release_buffer(&minor, mech_output_token);
 	if (mech_buf.value != NULL)
 	    free(mech_buf.value);
-	free_NegTokenResp(&na);
+	free_NegotiationToken(&nt);
     }
 
     if (ret == GSS_S_COMPLETE) {
-	if (src_name != NULL) {
-	    ret2 = gss_duplicate_name(minor_status,
-				      ctx->mech_src_name,
-				      src_name);
-	    if (ret2 != GSS_S_COMPLETE)
-		ret = ret2;
+	if (src_name != NULL && ctx->mech_src_name != NULL) {
+	    spnego_name name;
+
+	    name = calloc(1, sizeof(*name));
+	    if (name) {
+		name->mech = ctx->mech_src_name;
+		ctx->mech_src_name = NULL;
+		*src_name = (gss_name_t)name;
+	    }
 	}
         if (delegated_cred_handle != NULL) {
 	    *delegated_cred_handle = ctx->delegated_cred_id;