Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into pac-verify

(This used to be commit 32143287c7eb452c6ed9ccd15e8cd4e5a907b437)

30 files changed, 41 insertions, 1664 deletions

diff --git a/source4/heimdal/lib/hx509/ca.c b/source4/heimdal/lib/hx509/ca.c
index 55374321ea..5b4d7711e7 100644
--- a/source4/heimdal/lib/hx509/ca.c
+++ b/source4/heimdal/lib/hx509/ca.c
@@ -33,7 +33,7 @@
 
 #include "hx_locl.h"
 #include <pkinit_asn1.h>
-RCSID("$Id: ca.c 22995 2008-04-15 19:31:29Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_ca Hx509 CA functions
diff --git a/source4/heimdal/lib/hx509/cert.c b/source4/heimdal/lib/hx509/cert.c
index 3194526e34..3597896c0c 100644
--- a/source4/heimdal/lib/hx509/cert.c
+++ b/source4/heimdal/lib/hx509/cert.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: cert.c 23457 2008-07-27 12:12:56Z lha $");
+RCSID("$Id$");
 #include "crypto-headers.h"
 #include <rtbl.h>
 
diff --git a/source4/heimdal/lib/hx509/cms.c b/source4/heimdal/lib/hx509/cms.c
index 69e7730f3c..629060a253 100644
--- a/source4/heimdal/lib/hx509/cms.c
+++ b/source4/heimdal/lib/hx509/cms.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: cms.c 23268 2008-06-23 03:23:47Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_cms CMS/PKCS7 message functions.
diff --git a/source4/heimdal/lib/hx509/collector.c b/source4/heimdal/lib/hx509/collector.c
index 8b6ffcb945..d8212927e6 100644
--- a/source4/heimdal/lib/hx509/collector.c
+++ b/source4/heimdal/lib/hx509/collector.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: collector.c 20778 2007-06-01 22:04:13Z lha $");
+RCSID("$Id$");
 
 struct private_key {
     AlgorithmIdentifier alg;
diff --git a/source4/heimdal/lib/hx509/crmf.asn1 b/source4/heimdal/lib/hx509/crmf.asn1
index 97ade264ae..3d8403c8e8 100644
--- a/source4/heimdal/lib/hx509/crmf.asn1
+++ b/source4/heimdal/lib/hx509/crmf.asn1
@@ -1,4 +1,4 @@
--- $Id: crmf.asn1 17102 2006-04-18 13:05:21Z lha $
+-- $Id$
 PKCS10 DEFINITIONS ::=
 
 BEGIN
diff --git a/source4/heimdal/lib/hx509/crypto.c b/source4/heimdal/lib/hx509/crypto.c
index 9334a4a847..e16977c6bf 100644
--- a/source4/heimdal/lib/hx509/crypto.c
+++ b/source4/heimdal/lib/hx509/crypto.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: crypto.c 22855 2008-04-07 18:49:24Z lha $");
+RCSID("$Id$");
 
 struct hx509_crypto;
 
diff --git a/source4/heimdal/lib/hx509/env.c b/source4/heimdal/lib/hx509/env.c
index a124e6ea1c..9d771c506f 100644
--- a/source4/heimdal/lib/hx509/env.c
+++ b/source4/heimdal/lib/hx509/env.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: env.c 22677 2008-03-13 17:35:49Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_env Hx509 enviroment functions
diff --git a/source4/heimdal/lib/hx509/error.c b/source4/heimdal/lib/hx509/error.c
index 25119ed288..9eeecb227c 100644
--- a/source4/heimdal/lib/hx509/error.c
+++ b/source4/heimdal/lib/hx509/error.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: error.c 22332 2007-12-17 01:03:22Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_error Hx509 error reporting functions
diff --git a/source4/heimdal/lib/hx509/hx509-private.h b/source4/heimdal/lib/hx509/hx509-private.h
deleted file mode 100644
index de1fcfa7e6..0000000000
--- a/source4/heimdal/lib/hx509/hx509-private.h
+++ /dev/null
@@ -1,548 +0,0 @@
-/* This is a generated file */
-#ifndef __hx509_private_h__
-#define __hx509_private_h__
-
-#include <stdarg.h>
-
-#if !defined(__GNUC__) && !defined(__attribute__)
-#define __attribute__(x)
-#endif
-
-int
-_hx509_AlgorithmIdentifier_cmp (
-	const AlgorithmIdentifier */*p*/,
-	const AlgorithmIdentifier */*q*/);
-
-int
-_hx509_Certificate_cmp (
-	const Certificate */*p*/,
-	const Certificate */*q*/);
-
-int
-_hx509_Name_to_string (
-	const Name */*n*/,
-	char **/*str*/);
-
-time_t
-_hx509_Time2time_t (const Time */*t*/);
-
-void
-_hx509_abort (
-	const char */*fmt*/,
-	...)
-    __attribute__ ((noreturn, format (printf, 1, 2)));
-
-int
-_hx509_calculate_path (
-	hx509_context /*context*/,
-	int /*flags*/,
-	time_t /*time_now*/,
-	hx509_certs /*anchors*/,
-	unsigned int /*max_depth*/,
-	hx509_cert /*cert*/,
-	hx509_certs /*pool*/,
-	hx509_path */*path*/);
-
-int
-_hx509_cert_assign_key (
-	hx509_cert /*cert*/,
-	hx509_private_key /*private_key*/);
-
-int
-_hx509_cert_get_eku (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	ExtKeyUsage */*e*/);
-
-int
-_hx509_cert_get_keyusage (
-	hx509_context /*context*/,
-	hx509_cert /*c*/,
-	KeyUsage */*ku*/);
-
-int
-_hx509_cert_get_version (const Certificate */*t*/);
-
-int
-_hx509_cert_is_parent_cmp (
-	const Certificate */*subject*/,
-	const Certificate */*issuer*/,
-	int /*allow_self_signed*/);
-
-int
-_hx509_cert_private_decrypt (
-	hx509_context /*context*/,
-	const heim_octet_string */*ciphertext*/,
-	const heim_oid */*encryption_oid*/,
-	hx509_cert /*p*/,
-	heim_octet_string */*cleartext*/);
-
-hx509_private_key
-_hx509_cert_private_key (hx509_cert /*p*/);
-
-int
-_hx509_cert_private_key_exportable (hx509_cert /*p*/);
-
-int
-_hx509_cert_public_encrypt (
-	hx509_context /*context*/,
-	const heim_octet_string */*cleartext*/,
-	const hx509_cert /*p*/,
-	heim_oid */*encryption_oid*/,
-	heim_octet_string */*ciphertext*/);
-
-void
-_hx509_cert_set_release (
-	hx509_cert /*cert*/,
-	_hx509_cert_release_func /*release*/,
-	void */*ctx*/);
-
-int
-_hx509_cert_to_env (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	hx509_env */*env*/);
-
-int
-_hx509_certs_keys_add (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_private_key /*key*/);
-
-void
-_hx509_certs_keys_free (
-	hx509_context /*context*/,
-	hx509_private_key */*keys*/);
-
-int
-_hx509_certs_keys_get (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_private_key **/*keys*/);
-
-hx509_certs
-_hx509_certs_ref (hx509_certs /*certs*/);
-
-int
-_hx509_check_key_usage (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	unsigned /*flags*/,
-	int /*req_present*/);
-
-int
-_hx509_collector_alloc (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	struct hx509_collector **/*collector*/);
-
-int
-_hx509_collector_certs_add (
-	hx509_context /*context*/,
-	struct hx509_collector */*c*/,
-	hx509_cert /*cert*/);
-
-int
-_hx509_collector_collect_certs (
-	hx509_context /*context*/,
-	struct hx509_collector */*c*/,
-	hx509_certs */*ret_certs*/);
-
-int
-_hx509_collector_collect_private_keys (
-	hx509_context /*context*/,
-	struct hx509_collector */*c*/,
-	hx509_private_key **/*keys*/);
-
-void
-_hx509_collector_free (struct hx509_collector */*c*/);
-
-hx509_lock
-_hx509_collector_get_lock (struct hx509_collector */*c*/);
-
-int
-_hx509_collector_private_key_add (
-	hx509_context /*context*/,
-	struct hx509_collector */*c*/,
-	const AlgorithmIdentifier */*alg*/,
-	hx509_private_key /*private_key*/,
-	const heim_octet_string */*key_data*/,
-	const heim_octet_string */*localKeyId*/);
-
-int
-_hx509_create_signature (
-	hx509_context /*context*/,
-	const hx509_private_key /*signer*/,
-	const AlgorithmIdentifier */*alg*/,
-	const heim_octet_string */*data*/,
-	AlgorithmIdentifier */*signatureAlgorithm*/,
-	heim_octet_string */*sig*/);
-
-int
-_hx509_create_signature_bitstring (
-	hx509_context /*context*/,
-	const hx509_private_key /*signer*/,
-	const AlgorithmIdentifier */*alg*/,
-	const heim_octet_string */*data*/,
-	AlgorithmIdentifier */*signatureAlgorithm*/,
-	heim_bit_string */*sig*/);
-
-int
-_hx509_expr_eval (
-	hx509_context /*context*/,
-	hx509_env /*env*/,
-	struct hx_expr */*expr*/);
-
-void
-_hx509_expr_free (struct hx_expr */*expr*/);
-
-struct hx_expr *
-_hx509_expr_parse (const char */*buf*/);
-
-int
-_hx509_find_extension_subject_key_id (
-	const Certificate */*issuer*/,
-	SubjectKeyIdentifier */*si*/);
-
-int
-_hx509_generate_private_key (
-	hx509_context /*context*/,
-	struct hx509_generate_private_context */*ctx*/,
-	hx509_private_key */*private_key*/);
-
-int
-_hx509_generate_private_key_bits (
-	hx509_context /*context*/,
-	struct hx509_generate_private_context */*ctx*/,
-	unsigned long /*bits*/);
-
-void
-_hx509_generate_private_key_free (struct hx509_generate_private_context **/*ctx*/);
-
-int
-_hx509_generate_private_key_init (
-	hx509_context /*context*/,
-	const heim_oid */*oid*/,
-	struct hx509_generate_private_context **/*ctx*/);
-
-int
-_hx509_generate_private_key_is_ca (
-	hx509_context /*context*/,
-	struct hx509_generate_private_context */*ctx*/);
-
-Certificate *
-_hx509_get_cert (hx509_cert /*cert*/);
-
-void
-_hx509_ks_dir_register (hx509_context /*context*/);
-
-void
-_hx509_ks_file_register (hx509_context /*context*/);
-
-void
-_hx509_ks_keychain_register (hx509_context /*context*/);
-
-void
-_hx509_ks_mem_register (hx509_context /*context*/);
-
-void
-_hx509_ks_null_register (hx509_context /*context*/);
-
-void
-_hx509_ks_pkcs11_register (hx509_context /*context*/);
-
-void
-_hx509_ks_pkcs12_register (hx509_context /*context*/);
-
-void
-_hx509_ks_register (
-	hx509_context /*context*/,
-	struct hx509_keyset_ops */*ops*/);
-
-int
-_hx509_lock_find_cert (
-	hx509_lock /*lock*/,
-	const hx509_query */*q*/,
-	hx509_cert */*c*/);
-
-const struct _hx509_password *
-_hx509_lock_get_passwords (hx509_lock /*lock*/);
-
-hx509_certs
-_hx509_lock_unlock_certs (hx509_lock /*lock*/);
-
-struct hx_expr *
-_hx509_make_expr (
-	enum hx_expr_op /*op*/,
-	void */*arg1*/,
-	void */*arg2*/);
-
-int
-_hx509_map_file_os (
-	const char */*fn*/,
-	heim_octet_string */*os*/);
-
-int
-_hx509_match_keys (
-	hx509_cert /*c*/,
-	hx509_private_key /*private_key*/);
-
-int
-_hx509_name_cmp (
-	const Name */*n1*/,
-	const Name */*n2*/,
-	int */*c*/);
-
-int
-_hx509_name_ds_cmp (
-	const DirectoryString */*ds1*/,
-	const DirectoryString */*ds2*/,
-	int */*diff*/);
-
-int
-_hx509_name_from_Name (
-	const Name */*n*/,
-	hx509_name */*name*/);
-
-int
-_hx509_name_modify (
-	hx509_context /*context*/,
-	Name */*name*/,
-	int /*append*/,
-	const heim_oid */*oid*/,
-	const char */*str*/);
-
-int
-_hx509_parse_private_key (
-	hx509_context /*context*/,
-	const heim_oid */*key_oid*/,
-	const void */*data*/,
-	size_t /*len*/,
-	hx509_private_key */*private_key*/);
-
-int
-_hx509_path_append (
-	hx509_context /*context*/,
-	hx509_path */*path*/,
-	hx509_cert /*cert*/);
-
-void
-_hx509_path_free (hx509_path */*path*/);
-
-int
-_hx509_pbe_decrypt (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	const AlgorithmIdentifier */*ai*/,
-	const heim_octet_string */*econtent*/,
-	heim_octet_string */*content*/);
-
-int
-_hx509_pbe_encrypt (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	const AlgorithmIdentifier */*ai*/,
-	const heim_octet_string */*content*/,
-	heim_octet_string */*econtent*/);
-
-void
-_hx509_pi_printf (
-	int (*/*func*/)(void *, const char *),
-	void */*ctx*/,
-	const char */*fmt*/,
-	...);
-
-int
-_hx509_private_key2SPKI (
-	hx509_context /*context*/,
-	hx509_private_key /*private_key*/,
-	SubjectPublicKeyInfo */*spki*/);
-
-void
-_hx509_private_key_assign_rsa (
-	hx509_private_key /*key*/,
-	void */*ptr*/);
-
-int
-_hx509_private_key_export (
-	hx509_context /*context*/,
-	const hx509_private_key /*key*/,
-	heim_octet_string */*data*/);
-
-int
-_hx509_private_key_exportable (hx509_private_key /*key*/);
-
-int
-_hx509_private_key_free (hx509_private_key */*key*/);
-
-BIGNUM *
-_hx509_private_key_get_internal (
-	hx509_context /*context*/,
-	hx509_private_key /*key*/,
-	const char */*type*/);
-
-int
-_hx509_private_key_init (
-	hx509_private_key */*key*/,
-	hx509_private_key_ops */*ops*/,
-	void */*keydata*/);
-
-int
-_hx509_private_key_oid (
-	hx509_context /*context*/,
-	const hx509_private_key /*key*/,
-	heim_oid */*data*/);
-
-int
-_hx509_private_key_private_decrypt (
-	hx509_context /*context*/,
-	const heim_octet_string */*ciphertext*/,
-	const heim_oid */*encryption_oid*/,
-	hx509_private_key /*p*/,
-	heim_octet_string */*cleartext*/);
-
-hx509_private_key
-_hx509_private_key_ref (hx509_private_key /*key*/);
-
-const char *
-_hx509_private_pem_name (hx509_private_key /*key*/);
-
-int
-_hx509_public_encrypt (
-	hx509_context /*context*/,
-	const heim_octet_string */*cleartext*/,
-	const Certificate */*cert*/,
-	heim_oid */*encryption_oid*/,
-	heim_octet_string */*ciphertext*/);
-
-void
-_hx509_query_clear (hx509_query */*q*/);
-
-int
-_hx509_query_match_cert (
-	hx509_context /*context*/,
-	const hx509_query */*q*/,
-	hx509_cert /*cert*/);
-
-void
-_hx509_query_statistic (
-	hx509_context /*context*/,
-	int /*type*/,
-	const hx509_query */*q*/);
-
-int
-_hx509_request_add_dns_name (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	const char */*hostname*/);
-
-int
-_hx509_request_add_eku (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	const heim_oid */*oid*/);
-
-int
-_hx509_request_add_email (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	const char */*email*/);
-
-void
-_hx509_request_free (hx509_request */*req*/);
-
-int
-_hx509_request_get_SubjectPublicKeyInfo (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	SubjectPublicKeyInfo */*key*/);
-
-int
-_hx509_request_get_name (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	hx509_name */*name*/);
-
-int
-_hx509_request_init (
-	hx509_context /*context*/,
-	hx509_request */*req*/);
-
-int
-_hx509_request_parse (
-	hx509_context /*context*/,
-	const char */*path*/,
-	hx509_request */*req*/);
-
-int
-_hx509_request_print (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	FILE */*f*/);
-
-int
-_hx509_request_set_SubjectPublicKeyInfo (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	const SubjectPublicKeyInfo */*key*/);
-
-int
-_hx509_request_set_name (
-	hx509_context /*context*/,
-	hx509_request /*req*/,
-	hx509_name /*name*/);
-
-int
-_hx509_request_to_pkcs10 (
-	hx509_context /*context*/,
-	const hx509_request /*req*/,
-	const hx509_private_key /*signer*/,
-	heim_octet_string */*request*/);
-
-hx509_revoke_ctx
-_hx509_revoke_ref (hx509_revoke_ctx /*ctx*/);
-
-void
-_hx509_sel_yyerror (char */*s*/);
-
-int
-_hx509_set_cert_attribute (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	const heim_oid */*oid*/,
-	const heim_octet_string */*attr*/);
-
-void
-_hx509_unmap_file_os (heim_octet_string */*os*/);
-
-int
-_hx509_unparse_Name (
-	const Name */*aname*/,
-	char **/*str*/);
-
-time_t
-_hx509_verify_get_time (hx509_verify_ctx /*ctx*/);
-
-int
-_hx509_verify_signature (
-	hx509_context /*context*/,
-	const Certificate */*signer*/,
-	const AlgorithmIdentifier */*alg*/,
-	const heim_octet_string */*data*/,
-	const heim_octet_string */*sig*/);
-
-int
-_hx509_verify_signature_bitstring (
-	hx509_context /*context*/,
-	const Certificate */*signer*/,
-	const AlgorithmIdentifier */*alg*/,
-	const heim_octet_string */*data*/,
-	const heim_bit_string */*sig*/);
-
-int
-_hx509_write_file (
-	const char */*fn*/,
-	const void */*data*/,
-	size_t /*length*/);
-
-#endif /* __hx509_private_h__ */
diff --git a/source4/heimdal/lib/hx509/hx509-protos.h b/source4/heimdal/lib/hx509/hx509-protos.h
deleted file mode 100644
index f8e6bc19a4..0000000000
--- a/source4/heimdal/lib/hx509/hx509-protos.h
+++ /dev/null
@@ -1,1080 +0,0 @@
-/* This is a generated file */
-#ifndef __hx509_protos_h__
-#define __hx509_protos_h__
-
-#include <stdarg.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#ifndef HX509_LIB
-#if defined(_WIN32)
-#define HX509_LIB_FUNCTION _stdcall __declspec(dllimport)
-#define HX509_LIB_VARIABLE __declspec(dllimport)
-#else
-#define HX509_LIB_FUNCTION
-#define HX509_LIB_VARIABLE
-#endif
-#endif
-
-void
-hx509_bitstring_print (
-	const heim_bit_string */*b*/,
-	hx509_vprint_func /*func*/,
-	void */*ctx*/);
-
-int
-hx509_ca_sign (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	hx509_cert /*signer*/,
-	hx509_cert */*certificate*/);
-
-int
-hx509_ca_sign_self (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	hx509_private_key /*signer*/,
-	hx509_cert */*certificate*/);
-
-int
-hx509_ca_tbs_add_crl_dp_uri (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*uri*/,
-	hx509_name /*issuername*/);
-
-int
-hx509_ca_tbs_add_eku (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const heim_oid */*oid*/);
-
-int
-hx509_ca_tbs_add_san_hostname (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*dnsname*/);
-
-int
-hx509_ca_tbs_add_san_jid (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*jid*/);
-
-int
-hx509_ca_tbs_add_san_ms_upn (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*principal*/);
-
-int
-hx509_ca_tbs_add_san_otherName (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const heim_oid */*oid*/,
-	const heim_octet_string */*os*/);
-
-int
-hx509_ca_tbs_add_san_pkinit (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*principal*/);
-
-int
-hx509_ca_tbs_add_san_rfc822name (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const char */*rfc822Name*/);
-
-void
-hx509_ca_tbs_free (hx509_ca_tbs */*tbs*/);
-
-int
-hx509_ca_tbs_init (
-	hx509_context /*context*/,
-	hx509_ca_tbs */*tbs*/);
-
-int
-hx509_ca_tbs_set_ca (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	int /*pathLenConstraint*/);
-
-int
-hx509_ca_tbs_set_domaincontroller (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/);
-
-int
-hx509_ca_tbs_set_notAfter (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	time_t /*t*/);
-
-int
-hx509_ca_tbs_set_notAfter_lifetime (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	time_t /*delta*/);
-
-int
-hx509_ca_tbs_set_notBefore (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	time_t /*t*/);
-
-int
-hx509_ca_tbs_set_proxy (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	int /*pathLenConstraint*/);
-
-int
-hx509_ca_tbs_set_serialnumber (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const heim_integer */*serialNumber*/);
-
-int
-hx509_ca_tbs_set_spki (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	const SubjectPublicKeyInfo */*spki*/);
-
-int
-hx509_ca_tbs_set_subject (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	hx509_name /*subject*/);
-
-int
-hx509_ca_tbs_set_template (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	int /*flags*/,
-	hx509_cert /*cert*/);
-
-int
-hx509_ca_tbs_subject_expand (
-	hx509_context /*context*/,
-	hx509_ca_tbs /*tbs*/,
-	hx509_env /*env*/);
-
-const struct units *
-hx509_ca_tbs_template_units (void);
-
-int
-hx509_cert_binary (
-	hx509_context /*context*/,
-	hx509_cert /*c*/,
-	heim_octet_string */*os*/);
-
-int
-hx509_cert_check_eku (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	const heim_oid */*eku*/,
-	int /*allow_any_eku*/);
-
-int
-hx509_cert_cmp (
-	hx509_cert /*p*/,
-	hx509_cert /*q*/);
-
-int
-hx509_cert_find_subjectAltName_otherName (
-	hx509_context /*context*/,
-	hx509_cert /*cert*/,
-	const heim_oid */*oid*/,
-	hx509_octet_string_list */*list*/);
-
-void
-hx509_cert_free (hx509_cert /*cert*/);
-
-int
-hx509_cert_get_SPKI (
-	hx509_context /*context*/,
-	hx509_cert /*p*/,
-	SubjectPublicKeyInfo */*spki*/);
-
-int
-hx509_cert_get_SPKI_AlgorithmIdentifier (
-	hx509_context /*context*/,
-	hx509_cert /*p*/,
-	AlgorithmIdentifier */*alg*/);
-
-hx509_cert_attribute
-hx509_cert_get_attribute (
-	hx509_cert /*cert*/,
-	const heim_oid */*oid*/);
-
-int
-hx509_cert_get_base_subject (
-	hx509_context /*context*/,
-	hx509_cert /*c*/,
-	hx509_name */*name*/);
-
-const char *
-hx509_cert_get_friendly_name (hx509_cert /*cert*/);
-
-int
-hx509_cert_get_issuer (
-	hx509_cert /*p*/,
-	hx509_name */*name*/);
-
-time_t
-hx509_cert_get_notAfter (hx509_cert /*p*/);
-
-time_t
-hx509_cert_get_notBefore (hx509_cert /*p*/);
-
-int
-hx509_cert_get_serialnumber (
-	hx509_cert /*p*/,
-	heim_integer */*i*/);
-
-int
-hx509_cert_get_subject (
-	hx509_cert /*p*/,
-	hx509_name */*name*/);
-
-int
-hx509_cert_have_private_key (hx509_cert /*p*/);
-
-int
-hx509_cert_init (
-	hx509_context /*context*/,
-	const Certificate */*c*/,
-	hx509_cert */*cert*/);
-
-int
-hx509_cert_init_data (
-	hx509_context /*context*/,
-	const void */*ptr*/,
-	size_t /*len*/,
-	hx509_cert */*cert*/);
-
-int
-hx509_cert_keyusage_print (
-	hx509_context /*context*/,
-	hx509_cert /*c*/,
-	char **/*s*/);
-
-hx509_cert
-hx509_cert_ref (hx509_cert /*cert*/);
-
-int
-hx509_cert_set_friendly_name (
-	hx509_cert /*cert*/,
-	const char */*name*/);
-
-int
-hx509_certs_add (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_cert /*cert*/);
-
-int
-hx509_certs_append (
-	hx509_context /*context*/,
-	hx509_certs /*to*/,
-	hx509_lock /*lock*/,
-	const char */*name*/);
-
-int
-hx509_certs_end_seq (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_cursor /*cursor*/);
-
-int
-hx509_certs_find (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	const hx509_query */*q*/,
-	hx509_cert */*r*/);
-
-void
-hx509_certs_free (hx509_certs */*certs*/);
-
-int
-hx509_certs_info (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	int (*/*func*/)(void *, const char *),
-	void */*ctx*/);
-
-int
-hx509_certs_init (
-	hx509_context /*context*/,
-	const char */*name*/,
-	int /*flags*/,
-	hx509_lock /*lock*/,
-	hx509_certs */*certs*/);
-
-int
-hx509_certs_iter (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	int (*/*func*/)(hx509_context, void *, hx509_cert),
-	void */*ctx*/);
-
-int
-hx509_certs_merge (
-	hx509_context /*context*/,
-	hx509_certs /*to*/,
-	hx509_certs /*from*/);
-
-int
-hx509_certs_next_cert (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_cursor /*cursor*/,
-	hx509_cert */*cert*/);
-
-int
-hx509_certs_start_seq (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_cursor */*cursor*/);
-
-int
-hx509_certs_store (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	int /*flags*/,
-	hx509_lock /*lock*/);
-
-int
-hx509_ci_print_names (
-	hx509_context /*context*/,
-	void */*ctx*/,
-	hx509_cert /*c*/);
-
-void
-hx509_clear_error_string (hx509_context /*context*/);
-
-int
-hx509_cms_create_signed_1 (
-	hx509_context /*context*/,
-	int /*flags*/,
-	const heim_oid */*eContentType*/,
-	const void */*data*/,
-	size_t /*length*/,
-	const AlgorithmIdentifier */*digest_alg*/,
-	hx509_cert /*cert*/,
-	hx509_peer_info /*peer*/,
-	hx509_certs /*anchors*/,
-	hx509_certs /*pool*/,
-	heim_octet_string */*signed_data*/);
-
-int
-hx509_cms_decrypt_encrypted (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	const void */*data*/,
-	size_t /*length*/,
-	heim_oid */*contentType*/,
-	heim_octet_string */*content*/);
-
-int
-hx509_cms_envelope_1 (
-	hx509_context /*context*/,
-	int /*flags*/,
-	hx509_cert /*cert*/,
-	const void */*data*/,
-	size_t /*length*/,
-	const heim_oid */*encryption_type*/,
-	const heim_oid */*contentType*/,
-	heim_octet_string */*content*/);
-
-int
-hx509_cms_unenvelope (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	int /*flags*/,
-	const void */*data*/,
-	size_t /*length*/,
-	const heim_octet_string */*encryptedContent*/,
-	time_t /*time_now*/,
-	heim_oid */*contentType*/,
-	heim_octet_string */*content*/);
-
-int
-hx509_cms_unwrap_ContentInfo (
-	const heim_octet_string */*in*/,
-	heim_oid */*oid*/,
-	heim_octet_string */*out*/,
-	int */*have_data*/);
-
-int
-hx509_cms_verify_signed (
-	hx509_context /*context*/,
-	hx509_verify_ctx /*ctx*/,
-	const void */*data*/,
-	size_t /*length*/,
-	const heim_octet_string */*signedContent*/,
-	hx509_certs /*pool*/,
-	heim_oid */*contentType*/,
-	heim_octet_string */*content*/,
-	hx509_certs */*signer_certs*/);
-
-int
-hx509_cms_wrap_ContentInfo (
-	const heim_oid */*oid*/,
-	const heim_octet_string */*buf*/,
-	heim_octet_string */*res*/);
-
-void
-hx509_context_free (hx509_context */*context*/);
-
-int
-hx509_context_init (hx509_context */*context*/);
-
-void
-hx509_context_set_missing_revoke (
-	hx509_context /*context*/,
-	int /*flag*/);
-
-int
-hx509_crl_add_revoked_certs (
-	hx509_context /*context*/,
-	hx509_crl /*crl*/,
-	hx509_certs /*certs*/);
-
-int
-hx509_crl_alloc (
-	hx509_context /*context*/,
-	hx509_crl */*crl*/);
-
-void
-hx509_crl_free (
-	hx509_context /*context*/,
-	hx509_crl */*crl*/);
-
-int
-hx509_crl_lifetime (
-	hx509_context /*context*/,
-	hx509_crl /*crl*/,
-	int /*delta*/);
-
-int
-hx509_crl_sign (
-	hx509_context /*context*/,
-	hx509_cert /*signer*/,
-	hx509_crl /*crl*/,
-	heim_octet_string */*os*/);
-
-const AlgorithmIdentifier *
-hx509_crypto_aes128_cbc (void);
-
-const AlgorithmIdentifier *
-hx509_crypto_aes256_cbc (void);
-
-int
-hx509_crypto_available (
-	hx509_context /*context*/,
-	int /*type*/,
-	hx509_cert /*source*/,
-	AlgorithmIdentifier **/*val*/,
-	unsigned int */*plen*/);
-
-int
-hx509_crypto_decrypt (
-	hx509_crypto /*crypto*/,
-	const void */*data*/,
-	const size_t /*length*/,
-	heim_octet_string */*ivec*/,
-	heim_octet_string */*clear*/);
-
-const AlgorithmIdentifier *
-hx509_crypto_des_rsdi_ede3_cbc (void);
-
-void
-hx509_crypto_destroy (hx509_crypto /*crypto*/);
-
-int
-hx509_crypto_encrypt (
-	hx509_crypto /*crypto*/,
-	const void */*data*/,
-	const size_t /*length*/,
-	const heim_octet_string */*ivec*/,
-	heim_octet_string **/*ciphertext*/);
-
-const heim_oid *
-hx509_crypto_enctype_by_name (const char */*name*/);
-
-void
-hx509_crypto_free_algs (
-	AlgorithmIdentifier */*val*/,
-	unsigned int /*len*/);
-
-int
-hx509_crypto_get_params (
-	hx509_context /*context*/,
-	hx509_crypto /*crypto*/,
-	const heim_octet_string */*ivec*/,
-	heim_octet_string */*param*/);
-
-int
-hx509_crypto_init (
-	hx509_context /*context*/,
-	const char */*provider*/,
-	const heim_oid */*enctype*/,
-	hx509_crypto */*crypto*/);
-
-const char *
-hx509_crypto_provider (hx509_crypto /*crypto*/);
-
-int
-hx509_crypto_random_iv (
-	hx509_crypto /*crypto*/,
-	heim_octet_string */*ivec*/);
-
-int
-hx509_crypto_select (
-	const hx509_context /*context*/,
-	int /*type*/,
-	const hx509_private_key /*source*/,
-	hx509_peer_info /*peer*/,
-	AlgorithmIdentifier */*selected*/);
-
-int
-hx509_crypto_set_key_data (
-	hx509_crypto /*crypto*/,
-	const void */*data*/,
-	size_t /*length*/);
-
-int
-hx509_crypto_set_key_name (
-	hx509_crypto /*crypto*/,
-	const char */*name*/);
-
-int
-hx509_crypto_set_params (
-	hx509_context /*context*/,
-	hx509_crypto /*crypto*/,
-	const heim_octet_string */*param*/,
-	heim_octet_string */*ivec*/);
-
-int
-hx509_crypto_set_random_key (
-	hx509_crypto /*crypto*/,
-	heim_octet_string */*key*/);
-
-int
-hx509_env_add (
-	hx509_context /*context*/,
-	hx509_env */*env*/,
-	const char */*key*/,
-	const char */*value*/);
-
-int
-hx509_env_add_binding (
-	hx509_context /*context*/,
-	hx509_env */*env*/,
-	const char */*key*/,
-	hx509_env /*list*/);
-
-const char *
-hx509_env_find (
-	hx509_context /*context*/,
-	hx509_env /*env*/,
-	const char */*key*/);
-
-hx509_env
-hx509_env_find_binding (
-	hx509_context /*context*/,
-	hx509_env /*env*/,
-	const char */*key*/);
-
-void
-hx509_env_free (hx509_env */*env*/);
-
-const char *
-hx509_env_lfind (
-	hx509_context /*context*/,
-	hx509_env /*env*/,
-	const char */*key*/,
-	size_t /*len*/);
-
-void
-hx509_err (
-	hx509_context /*context*/,
-	int /*exit_code*/,
-	int /*error_code*/,
-	const char */*fmt*/,
-	...);
-
-void
-hx509_free_error_string (char */*str*/);
-
-void
-hx509_free_octet_string_list (hx509_octet_string_list */*list*/);
-
-int
-hx509_general_name_unparse (
-	GeneralName */*name*/,
-	char **/*str*/);
-
-char *
-hx509_get_error_string (
-	hx509_context /*context*/,
-	int /*error_code*/);
-
-int
-hx509_get_one_cert (
-	hx509_context /*context*/,
-	hx509_certs /*certs*/,
-	hx509_cert */*c*/);
-
-int
-hx509_lock_add_cert (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	hx509_cert /*cert*/);
-
-int
-hx509_lock_add_certs (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/,
-	hx509_certs /*certs*/);
-
-int
-hx509_lock_add_password (
-	hx509_lock /*lock*/,
-	const char */*password*/);
-
-int
-hx509_lock_command_string (
-	hx509_lock /*lock*/,
-	const char */*string*/);
-
-void
-hx509_lock_free (hx509_lock /*lock*/);
-
-int
-hx509_lock_init (
-	hx509_context /*context*/,
-	hx509_lock */*lock*/);
-
-int
-hx509_lock_prompt (
-	hx509_lock /*lock*/,
-	hx509_prompt */*prompt*/);
-
-void
-hx509_lock_reset_certs (
-	hx509_context /*context*/,
-	hx509_lock /*lock*/);
-
-void
-hx509_lock_reset_passwords (hx509_lock /*lock*/);
-
-void
-hx509_lock_reset_promper (hx509_lock /*lock*/);
-
-int
-hx509_lock_set_prompter (
-	hx509_lock /*lock*/,
-	hx509_prompter_fct /*prompt*/,
-	void */*data*/);
-
-int
-hx509_name_binary (
-	const hx509_name /*name*/,
-	heim_octet_string */*os*/);
-
-int
-hx509_name_cmp (
-	hx509_name /*n1*/,
-	hx509_name /*n2*/);
-
-int
-hx509_name_copy (
-	hx509_context /*context*/,
-	const hx509_name /*from*/,
-	hx509_name */*to*/);
-
-int
-hx509_name_expand (
-	hx509_context /*context*/,
-	hx509_name /*name*/,
-	hx509_env /*env*/);
-
-void
-hx509_name_free (hx509_name */*name*/);
-
-int
-hx509_name_is_null_p (const hx509_name /*name*/);
-
-int
-hx509_name_normalize (
-	hx509_context /*context*/,
-	hx509_name /*name*/);
-
-int
-hx509_name_to_Name (
-	const hx509_name /*from*/,
-	Name */*to*/);
-
-int
-hx509_name_to_string (
-	const hx509_name /*name*/,
-	char **/*str*/);
-
-int
-hx509_ocsp_request (
-	hx509_context /*context*/,
-	hx509_certs /*reqcerts*/,
-	hx509_certs /*pool*/,
-	hx509_cert /*signer*/,
-	const AlgorithmIdentifier */*digest*/,
-	heim_octet_string */*request*/,
-	heim_octet_string */*nonce*/);
-
-int
-hx509_ocsp_verify (
-	hx509_context /*context*/,
-	time_t /*now*/,
-	hx509_cert /*cert*/,
-	int /*flags*/,
-	const void */*data*/,
-	size_t /*length*/,
-	time_t */*expiration*/);
-
-void
-hx509_oid_print (
-	const heim_oid */*oid*/,
-	hx509_vprint_func /*func*/,
-	void */*ctx*/);
-
-int
-hx509_oid_sprint (
-	const heim_oid */*oid*/,
-	char **/*str*/);
-
-int
-hx509_parse_name (
-	hx509_context /*context*/,
-	const char */*str*/,
-	hx509_name */*name*/);
-
-int
-hx509_peer_info_alloc (
-	hx509_context /*context*/,
-	hx509_peer_info */*peer*/);
-
-void
-hx509_peer_info_free (hx509_peer_info /*peer*/);
-
-int
-hx509_peer_info_set_cert (
-	hx509_peer_info /*peer*/,
-	hx509_cert /*cert*/);
-
-int
-hx509_peer_info_set_cms_algs (
-	hx509_context /*context*/,
-	hx509_peer_info /*peer*/,
-	const AlgorithmIdentifier */*val*/,
-	size_t /*len*/);
-
-int
-hx509_pem_add_header (
-	hx509_pem_header **/*headers*/,
-	const char */*header*/,
-	const char */*value*/);
-
-const char *
-hx509_pem_find_header (
-	const hx509_pem_header */*h*/,
-	const char */*header*/);
-
-void
-hx509_pem_free_header (hx509_pem_header */*headers*/);
-
-int
-hx509_pem_read (
-	hx509_context /*context*/,
-	FILE */*f*/,
-	hx509_pem_read_func /*func*/,
-	void */*ctx*/);
-
-int
-hx509_pem_write (
-	hx509_context /*context*/,
-	const char */*type*/,
-	hx509_pem_header */*headers*/,
-	FILE */*f*/,
-	const void */*data*/,
-	size_t /*size*/);
-
-void
-hx509_print_stdout (
-	void */*ctx*/,
-	const char */*fmt*/,
-	va_list /*va*/);
-
-int
-hx509_prompt_hidden (hx509_prompt_type /*type*/);
-
-int
-hx509_query_alloc (
-	hx509_context /*context*/,
-	hx509_query **/*q*/);
-
-void
-hx509_query_free (
-	hx509_context /*context*/,
-	hx509_query */*q*/);
-
-int
-hx509_query_match_cmp_func (
-	hx509_query */*q*/,
-	int (*/*func*/)(void *, hx509_cert),
-	void */*ctx*/);
-
-int
-hx509_query_match_eku (
-	hx509_query */*q*/,
-	const heim_oid */*eku*/);
-
-int
-hx509_query_match_expr (
-	hx509_context /*context*/,
-	hx509_query */*q*/,
-	const char */*expr*/);
-
-int
-hx509_query_match_friendly_name (
-	hx509_query */*q*/,
-	const char */*name*/);
-
-int
-hx509_query_match_issuer_serial (
-	hx509_query */*q*/,
-	const Name */*issuer*/,
-	const heim_integer */*serialNumber*/);
-
-void
-hx509_query_match_option (
-	hx509_query */*q*/,
-	hx509_query_option /*option*/);
-
-void
-hx509_query_statistic_file (
-	hx509_context /*context*/,
-	const char */*fn*/);
-
-void
-hx509_query_unparse_stats (
-	hx509_context /*context*/,
-	int /*printtype*/,
-	FILE */*out*/);
-
-int
-hx509_revoke_add_crl (
-	hx509_context /*context*/,
-	hx509_revoke_ctx /*ctx*/,
-	const char */*path*/);
-
-int
-hx509_revoke_add_ocsp (
-	hx509_context /*context*/,
-	hx509_revoke_ctx /*ctx*/,
-	const char */*path*/);
-
-void
-hx509_revoke_free (hx509_revoke_ctx */*ctx*/);
-
-int
-hx509_revoke_init (
-	hx509_context /*context*/,
-	hx509_revoke_ctx */*ctx*/);
-
-int
-hx509_revoke_ocsp_print (
-	hx509_context /*context*/,
-	const char */*path*/,
-	FILE */*out*/);
-
-int
-hx509_revoke_verify (
-	hx509_context /*context*/,
-	hx509_revoke_ctx /*ctx*/,
-	hx509_certs /*certs*/,
-	time_t /*now*/,
-	hx509_cert /*cert*/,
-	hx509_cert /*parent_cert*/);
-
-void
-hx509_set_error_string (
-	hx509_context /*context*/,
-	int /*flags*/,
-	int /*code*/,
-	const char */*fmt*/,
-	...);
-
-void
-hx509_set_error_stringv (
-	hx509_context /*context*/,
-	int /*flags*/,
-	int /*code*/,
-	const char */*fmt*/,
-	va_list /*ap*/);
-
-const AlgorithmIdentifier *
-hx509_signature_md2 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_md5 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_pkcs1_x509 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_md2 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_md5 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_sha1 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_sha256 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_sha384 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_sha512 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_sha1 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_sha256 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_sha384 (void);
-
-const AlgorithmIdentifier *
-hx509_signature_sha512 (void);
-
-int
-hx509_unparse_der_name (
-	const void */*data*/,
-	size_t /*length*/,
-	char **/*str*/);
-
-int
-hx509_validate_cert (
-	hx509_context /*context*/,
-	hx509_validate_ctx /*ctx*/,
-	hx509_cert /*cert*/);
-
-void
-hx509_validate_ctx_add_flags (
-	hx509_validate_ctx /*ctx*/,
-	int /*flags*/);
-
-void
-hx509_validate_ctx_free (hx509_validate_ctx /*ctx*/);
-
-int
-hx509_validate_ctx_init (
-	hx509_context /*context*/,
-	hx509_validate_ctx */*ctx*/);
-
-void
-hx509_validate_ctx_set_print (
-	hx509_validate_ctx /*ctx*/,
-	hx509_vprint_func /*func*/,
-	void */*c*/);
-
-void
-hx509_verify_attach_anchors (
-	hx509_verify_ctx /*ctx*/,
-	hx509_certs /*set*/);
-
-void
-hx509_verify_attach_revoke (
-	hx509_verify_ctx /*ctx*/,
-	hx509_revoke_ctx /*revoke_ctx*/);
-
-void
-hx509_verify_ctx_f_allow_default_trustanchors (
-	hx509_verify_ctx /*ctx*/,
-	int /*boolean*/);
-
-void
-hx509_verify_destroy_ctx (hx509_verify_ctx /*ctx*/);
-
-int
-hx509_verify_hostname (
-	hx509_context /*context*/,
-	const hx509_cert /*cert*/,
-	int /*flags*/,
-	hx509_hostname_type /*type*/,
-	const char */*hostname*/,
-	const struct sockaddr */*sa*/,
-	int /*sa_size*/);
-
-int
-hx509_verify_init_ctx (
-	hx509_context /*context*/,
-	hx509_verify_ctx */*ctx*/);
-
-int
-hx509_verify_path (
-	hx509_context /*context*/,
-	hx509_verify_ctx /*ctx*/,
-	hx509_cert /*cert*/,
-	hx509_certs /*pool*/);
-
-void
-hx509_verify_set_max_depth (
-	hx509_verify_ctx /*ctx*/,
-	unsigned int /*max_depth*/);
-
-void
-hx509_verify_set_proxy_certificate (
-	hx509_verify_ctx /*ctx*/,
-	int /*boolean*/);
-
-void
-hx509_verify_set_strict_rfc3280_verification (
-	hx509_verify_ctx /*ctx*/,
-	int /*boolean*/);
-
-void
-hx509_verify_set_time (
-	hx509_verify_ctx /*ctx*/,
-	time_t /*t*/);
-
-int
-hx509_verify_signature (
-	hx509_context /*context*/,
-	const hx509_cert /*signer*/,
-	const AlgorithmIdentifier */*alg*/,
-	const heim_octet_string */*data*/,
-	const heim_octet_string */*sig*/);
-
-void
-hx509_xfree (void */*ptr*/);
-
-int
-yywrap (void);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* __hx509_protos_h__ */
diff --git a/source4/heimdal/lib/hx509/hx509.h b/source4/heimdal/lib/hx509/hx509.h
index d2a6b06e0c..289f8d04a7 100644
--- a/source4/heimdal/lib/hx509/hx509.h
+++ b/source4/heimdal/lib/hx509/hx509.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: hx509.h 22908 2008-04-08 08:16:32Z lha $ */
+/* $Id$ */
 
 #ifndef HEIMDAL_HX509_H
 #define HEIMDAL_HX509_H 1
diff --git a/source4/heimdal/lib/hx509/hx509_err.et b/source4/heimdal/lib/hx509/hx509_err.et
index 8fc5cb8f2f..c1dfaf587e 100644
--- a/source4/heimdal/lib/hx509/hx509_err.et
+++ b/source4/heimdal/lib/hx509/hx509_err.et
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: hx509_err.et 22329 2007-12-15 05:13:14Z lha $"
+id "$Id$"
 
 error_table hx
 prefix HX509
diff --git a/source4/heimdal/lib/hx509/hx_locl.h b/source4/heimdal/lib/hx509/hx_locl.h
index d2db3354c7..4cf7a54e13 100644
--- a/source4/heimdal/lib/hx509/hx_locl.h
+++ b/source4/heimdal/lib/hx509/hx_locl.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: hx_locl.h 23189 2008-05-23 15:04:27Z lha $ */
+/* $Id$ */
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
@@ -69,6 +69,7 @@
 
 #include <der.h>
 
+#define HC_DEPRECATED_CRYPTO
 #include "crypto-headers.h"
 
 struct hx509_keyset_ops;
diff --git a/source4/heimdal/lib/hx509/keyset.c b/source4/heimdal/lib/hx509/keyset.c
index 1fceb849ec..bb36221aff 100644
--- a/source4/heimdal/lib/hx509/keyset.c
+++ b/source4/heimdal/lib/hx509/keyset.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: keyset.c 22851 2008-04-07 18:49:07Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_keyset Certificate store operations
diff --git a/source4/heimdal/lib/hx509/ks_dir.c b/source4/heimdal/lib/hx509/ks_dir.c
index 0dabc78c52..17a3ae4745 100644
--- a/source4/heimdal/lib/hx509/ks_dir.c
+++ b/source4/heimdal/lib/hx509/ks_dir.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_dir.c 23460 2008-07-27 12:14:03Z lha $");
+RCSID("$Id$");
 #include <dirent.h>
 
 /*
diff --git a/source4/heimdal/lib/hx509/ks_file.c b/source4/heimdal/lib/hx509/ks_file.c
index 25ceb1c64f..bb8dce3a4e 100644
--- a/source4/heimdal/lib/hx509/ks_file.c
+++ b/source4/heimdal/lib/hx509/ks_file.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_file.c 23459 2008-07-27 12:13:31Z lha $");
+RCSID("$Id$");
 
 typedef enum { USE_PEM, USE_DER } outformat;
 
diff --git a/source4/heimdal/lib/hx509/ks_keychain.c b/source4/heimdal/lib/hx509/ks_keychain.c
index f8181975d9..e51b0ab6a0 100644
--- a/source4/heimdal/lib/hx509/ks_keychain.c
+++ b/source4/heimdal/lib/hx509/ks_keychain.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_keychain.c 22084 2007-11-16 20:12:30Z lha $");
+RCSID("$Id$");
 
 #ifdef HAVE_FRAMEWORK_SECURITY
 
diff --git a/source4/heimdal/lib/hx509/ks_mem.c b/source4/heimdal/lib/hx509/ks_mem.c
index efa19eb19c..043f19b3e4 100644
--- a/source4/heimdal/lib/hx509/ks_mem.c
+++ b/source4/heimdal/lib/hx509/ks_mem.c
@@ -195,8 +195,8 @@ mem_addkey(hx509_context context,
 	return ENOMEM;
     }
     mem->keys = ptr;
-    mem->keys[i++] = _hx509_private_key_ref(key);
-    mem->keys[i++] = NULL;
+    mem->keys[i] = _hx509_private_key_ref(key);
+    mem->keys[i + 1] = NULL;
     return 0;
 }
 
diff --git a/source4/heimdal/lib/hx509/ks_null.c b/source4/heimdal/lib/hx509/ks_null.c
index 3be259fc60..0b571c8406 100644
--- a/source4/heimdal/lib/hx509/ks_null.c
+++ b/source4/heimdal/lib/hx509/ks_null.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_null.c 20901 2007-06-04 23:14:08Z lha $");
+RCSID("$Id$");
 
 
 static int
diff --git a/source4/heimdal/lib/hx509/ks_p11.c b/source4/heimdal/lib/hx509/ks_p11.c
index bf46e6604e..19db6004ce 100644
--- a/source4/heimdal/lib/hx509/ks_p11.c
+++ b/source4/heimdal/lib/hx509/ks_p11.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_p11.c 22899 2008-04-07 18:52:36Z lha $");
+RCSID("$Id$");
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 #endif
@@ -503,7 +503,7 @@ iterate_entries(hx509_context context,
 {
     CK_OBJECT_HANDLE object;
     CK_ULONG object_count;
-    int ret, i;
+    int ret, ret2, i;
 
     ret = P11FUNC(p, FindObjectsInit, (session, search_data, num_search_data));
     if (ret != CKR_OK) {
@@ -557,13 +557,12 @@ iterate_entries(hx509_context context,
 	query[i].pValue = NULL;
     }
 
-    ret = P11FUNC(p, FindObjectsFinal, (session));
-    if (ret != CKR_OK) {
-	return -2;
+    ret2 = P11FUNC(p, FindObjectsFinal, (session));
+    if (ret2 != CKR_OK) {
+	return ret2;
     }
 
-
-    return 0;
+    return ret;
 }
 		
 static BIGNUM *
diff --git a/source4/heimdal/lib/hx509/ks_p12.c b/source4/heimdal/lib/hx509/ks_p12.c
index 3ab824a330..53590c768c 100644
--- a/source4/heimdal/lib/hx509/ks_p12.c
+++ b/source4/heimdal/lib/hx509/ks_p12.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_p12.c 23413 2008-07-26 18:34:53Z lha $");
+RCSID("$Id$");
 
 struct ks_pkcs12 {
     hx509_certs certs;
diff --git a/source4/heimdal/lib/hx509/lock.c b/source4/heimdal/lib/hx509/lock.c
index e835aee35a..df1acea042 100644
--- a/source4/heimdal/lib/hx509/lock.c
+++ b/source4/heimdal/lib/hx509/lock.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: lock.c 22327 2007-12-15 04:49:37Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_lock Locking and unlocking certificates and encrypted data.
diff --git a/source4/heimdal/lib/hx509/name.c b/source4/heimdal/lib/hx509/name.c
index ccc33a3e55..a34e09e847 100644
--- a/source4/heimdal/lib/hx509/name.c
+++ b/source4/heimdal/lib/hx509/name.c
@@ -33,7 +33,7 @@
 
 #include "hx_locl.h"
 #include <wind.h>
-RCSID("$Id: name.c 22677 2008-03-13 17:35:49Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_name PKIX/X.509 Names
diff --git a/source4/heimdal/lib/hx509/ocsp.asn1 b/source4/heimdal/lib/hx509/ocsp.asn1
index d8ecd66ccf..eb090a4cc7 100644
--- a/source4/heimdal/lib/hx509/ocsp.asn1
+++ b/source4/heimdal/lib/hx509/ocsp.asn1
@@ -1,5 +1,5 @@
 -- From rfc2560
--- $Id: ocsp.asn1 19576 2006-12-30 12:40:43Z lha $
+-- $Id$
 OCSP DEFINITIONS EXPLICIT TAGS::=
 
 BEGIN
diff --git a/source4/heimdal/lib/hx509/peer.c b/source4/heimdal/lib/hx509/peer.c
index eb0ecd2bde..9845ce051f 100644
--- a/source4/heimdal/lib/hx509/peer.c
+++ b/source4/heimdal/lib/hx509/peer.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: peer.c 22345 2007-12-26 19:03:51Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_peer Hx509 crypto selecting functions
diff --git a/source4/heimdal/lib/hx509/pkcs10.asn1 b/source4/heimdal/lib/hx509/pkcs10.asn1
index 518fe3bfa3..f3fe37b1bf 100644
--- a/source4/heimdal/lib/hx509/pkcs10.asn1
+++ b/source4/heimdal/lib/hx509/pkcs10.asn1
@@ -1,4 +1,4 @@
--- $Id: pkcs10.asn1 16918 2006-04-01 09:46:57Z lha $
+-- $Id$
 PKCS10 DEFINITIONS ::=
 
 BEGIN
diff --git a/source4/heimdal/lib/hx509/print.c b/source4/heimdal/lib/hx509/print.c
index c1594ff047..92d7811909 100644
--- a/source4/heimdal/lib/hx509/print.c
+++ b/source4/heimdal/lib/hx509/print.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: print.c 22538 2008-01-27 13:05:47Z lha $");
+RCSID("$Id$");
 
 /**
  * @page page_print Hx509 printing functions
diff --git a/source4/heimdal/lib/hx509/req.c b/source4/heimdal/lib/hx509/req.c
index f374044ca6..1ffa0a53cf 100644
--- a/source4/heimdal/lib/hx509/req.c
+++ b/source4/heimdal/lib/hx509/req.c
@@ -33,7 +33,7 @@
 
 #include "hx_locl.h"
 #include <pkcs10_asn1.h>
-RCSID("$Id: req.c 23413 2008-07-26 18:34:53Z lha $");
+RCSID("$Id$");
 
 struct hx509_request_data {
     hx509_name name;
diff --git a/source4/heimdal/lib/hx509/revoke.c b/source4/heimdal/lib/hx509/revoke.c
index 8325c4723d..a36ec964d2 100644
--- a/source4/heimdal/lib/hx509/revoke.c
+++ b/source4/heimdal/lib/hx509/revoke.c
@@ -50,7 +50,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: revoke.c 23413 2008-07-26 18:34:53Z lha $");
+RCSID("$Id$");
 
 struct revoke_crl {
     char *path;
@@ -1515,10 +1515,13 @@ hx509_crl_sign(hx509_context context,
 					    &c.signatureAlgorithm,
 					    &c.signatureValue);
     free(os->data);
+    if (ret) {
+	hx509_set_error_string(context, 0, ret, "Failed to sign CRL");
+	goto out;
+    }
 
     ASN1_MALLOC_ENCODE(CRLCertificateList, os->data, os->length,
 		       &c, &size, ret);
-    free_CRLCertificateList(&c);
     if (ret) {
 	hx509_set_error_string(context, 0, ret, "failed to encode CRL");
 	goto out;
@@ -1526,6 +1529,8 @@ hx509_crl_sign(hx509_context context,
     if (size != os->length)
 	_hx509_abort("internal ASN.1 encoder error");
 
+    free_CRLCertificateList(&c);
+
     return 0;
 
 out:
diff --git a/source4/heimdal/lib/hx509/test_name.c b/source4/heimdal/lib/hx509/test_name.c
index 6dcf542d01..7326fe632a 100644
--- a/source4/heimdal/lib/hx509/test_name.c
+++ b/source4/heimdal/lib/hx509/test_name.c
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
-RCSID("$Id: test_name.c 22677 2008-03-13 17:35:49Z lha $");
+RCSID("$Id$");
 
 static int
 test_name(hx509_context context, const char *name)