r15192: Update Samba4 to use current lorikeet-heimdal.

Andrew Bartlett
(This used to be commit f0e538126c5cb29ca14ad0d8281eaa0a715ed94f)

30 files changed, 594 insertions, 1552 deletions

diff --git a/source4/heimdal/lib/krb5/acache.c b/source4/heimdal/lib/krb5/acache.c
index 7cf2c65d89..b38104fc2d 100644
--- a/source4/heimdal/lib/krb5/acache.c
+++ b/source4/heimdal/lib/krb5/acache.c
@@ -37,7 +37,7 @@
 #include <dlfcn.h>
 #endif
 
-RCSID("$Id: acache.c,v 1.14 2005/10/03 08:44:18 lha Exp $");
+RCSID("$Id: acache.c,v 1.15 2006/03/27 04:22:23 lha Exp $");
 
 /* XXX should we fetch these for each open ? */
 static HEIMDAL_MUTEX acc_mutex = HEIMDAL_MUTEX_INITIALIZER;
@@ -218,7 +218,36 @@ make_cred_from_ccred(krb5_context context,
 	}
     }
     
-    cred->flags.b = int2TicketFlags(incred->ticket_flags); /* XXX */
+    cred->flags.i = 0;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDABLE)
+	cred->flags.b.forwardable = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDED)
+	cred->flags.b.forwarded = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXIABLE)
+	cred->flags.b.proxiable = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXY)
+	cred->flags.b.proxy = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_MAY_POSTDATE)
+	cred->flags.b.may_postdate = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_POSTDATED)
+	cred->flags.b.postdated = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INVALID)
+	cred->flags.b.invalid = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_RENEWABLE)
+	cred->flags.b.renewable = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INITIAL)
+	cred->flags.b.initial = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PRE_AUTH)
+	cred->flags.b.pre_authent = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_HW_AUTH)
+	cred->flags.b.hw_authent = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED)
+	cred->flags.b.transited_policy_checked = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE)
+	cred->flags.b.ok_as_delegate = 1;
+    if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_ANONYMOUS)
+	cred->flags.b.anonymous = 1;
+
     return 0;
     
 nomem:
@@ -310,7 +339,36 @@ make_ccred_from_cred(krb5_context context,
     }
     cred->addresses[i] = NULL;
 
-    cred->ticket_flags = TicketFlags2int(incred->flags.b); /* XXX */
+    cred->ticket_flags = 0;
+    if (incred->flags.b.forwardable)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDABLE;
+    if (incred->flags.b.forwarded)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDED;
+    if (incred->flags.b.proxiable)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXIABLE;
+    if (incred->flags.b.proxy)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXY;
+    if (incred->flags.b.may_postdate)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_MAY_POSTDATE;
+    if (incred->flags.b.postdated)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_POSTDATED;
+    if (incred->flags.b.invalid)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INVALID;
+    if (incred->flags.b.renewable)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_RENEWABLE;
+    if (incred->flags.b.initial)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INITIAL;
+    if (incred->flags.b.pre_authent)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PRE_AUTH;
+    if (incred->flags.b.hw_authent)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_HW_AUTH;
+    if (incred->flags.b.transited_policy_checked)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED;
+    if (incred->flags.b.ok_as_delegate)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE;
+    if (incred->flags.b.anonymous)
+	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_ANONYMOUS;
+
     return 0;
 
 fail:    
diff --git a/source4/heimdal/lib/krb5/addr_families.c b/source4/heimdal/lib/krb5/addr_families.c
index cf460ba725..ebdbcfed46 100644
--- a/source4/heimdal/lib/krb5/addr_families.c
+++ b/source4/heimdal/lib/krb5/addr_families.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: addr_families.c,v 1.50 2006/03/17 22:12:13 lha Exp $");
+RCSID("$Id: addr_families.c,v 1.51 2006/04/02 02:17:31 lha Exp $");
 
 struct addr_operations {
     int af;
@@ -1136,6 +1136,7 @@ krb5_make_addrport (krb5_context context,
     if (ret) {
 	krb5_set_error_string(context, "malloc: out of memory");
 	free (*res);
+	*res = NULL;
 	return ret;
     }
     p = (*res)->address.data;
diff --git a/source4/heimdal/lib/krb5/build_auth.c b/source4/heimdal/lib/krb5/build_auth.c
index 1c38721b02..9eff09bb0a 100644
--- a/source4/heimdal/lib/krb5/build_auth.c
+++ b/source4/heimdal/lib/krb5/build_auth.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: build_auth.c,v 1.42 2005/01/05 02:34:53 lukeh Exp $");
+RCSID("$Id: build_auth.c,v 1.43 2006/04/10 08:53:21 lha Exp $");
 
 static krb5_error_code
 make_etypelist(krb5_context context,
@@ -116,13 +116,12 @@ krb5_build_authenticator (krb5_context context,
     krb5_error_code ret;
     krb5_crypto crypto;
 
-    auth = malloc(sizeof(*auth));
+    auth = calloc(1, sizeof(*auth));
     if (auth == NULL) {
 	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
     }
 
-    memset (auth, 0, sizeof(*auth));
     auth->authenticator_vno = 5;
     copy_Realm(&cred->client->realm, &auth->crealm);
     copy_PrincipalName(&cred->client->name, &auth->cname);
@@ -161,10 +160,8 @@ krb5_build_authenticator (krb5_context context,
 
     /* XXX - Copy more to auth_context? */
 
-    if (auth_context) {
-	auth_context->authenticator->ctime = auth->ctime;
-	auth_context->authenticator->cusec = auth->cusec;
-    }
+    auth_context->authenticator->ctime = auth->ctime;
+    auth_context->authenticator->cusec = auth->cusec;
 
     ASN1_MALLOC_ENCODE(Authenticator, buf, buf_size, auth, &len, ret);
     if (ret)
diff --git a/source4/heimdal/lib/krb5/cache.c b/source4/heimdal/lib/krb5/cache.c
index efb2ad1374..b21d42d653 100644
--- a/source4/heimdal/lib/krb5/cache.c
+++ b/source4/heimdal/lib/krb5/cache.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: cache.c,v 1.77 2005/12/13 15:42:36 lha Exp $");
+RCSID("$Id: cache.c,v 1.79 2006/04/02 00:54:48 lha Exp $");
 
 /*
  * Add a new ccache type with operations `ops', overwriting any
@@ -316,7 +316,7 @@ _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
 	}
 	if (append == NULL) {
 	    free(*res);
-	    res = NULL;
+	    *res = NULL;
 	    krb5_set_error_string(context, "malloc - out of memory");
 	    return ENOMEM;
 	}
@@ -324,6 +324,7 @@ _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
 	tlen = strlen(append);
 	tmp = realloc(*res, len + tlen + 1);
 	if (tmp == NULL) {
+	    free(append);
 	    free(*res);
 	    *res = NULL;
 	    krb5_set_error_string(context, "malloc - out of memory");
diff --git a/source4/heimdal/lib/krb5/config_file.c b/source4/heimdal/lib/krb5/config_file.c
index 86e286c638..66051303ed 100644
--- a/source4/heimdal/lib/krb5/config_file.c
+++ b/source4/heimdal/lib/krb5/config_file.c
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: config_file.c,v 1.53 2005/06/16 20:22:53 lha Exp $");
+RCSID("$Id: config_file.c,v 1.54 2006/04/02 00:59:19 lha Exp $");
 
 #ifndef HAVE_NETINFO
 
@@ -574,7 +574,7 @@ krb5_config_vget_strings(krb5_context context,
     }
     if(nstr){
 	char **tmp = realloc(strings, (nstr + 1) * sizeof(*strings));
-	if(strings == NULL)
+	if(tmp == NULL)
 	    goto cleanup;
 	strings = tmp;
 	strings[nstr] = NULL;
diff --git a/source4/heimdal/lib/krb5/crypto.c b/source4/heimdal/lib/krb5/crypto.c
index 039484c650..3a90995283 100644
--- a/source4/heimdal/lib/krb5/crypto.c
+++ b/source4/heimdal/lib/krb5/crypto.c
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: crypto.c,v 1.133 2006/03/07 19:34:55 lha Exp $");
+RCSID("$Id: crypto.c,v 1.134 2006/04/10 08:58:53 lha Exp $");
 
 #undef CRYPTO_DEBUG
 #ifdef CRYPTO_DEBUG
@@ -4096,7 +4096,7 @@ krb5_string_to_key_derived(krb5_context context,
     struct encryption_type *et = _find_enctype(etype);
     krb5_error_code ret;
     struct key_data kd;
-    size_t keylen = et->keytype->bits / 8;
+    size_t keylen;
     u_char *tmp;
 
     if(et == NULL) {
@@ -4104,6 +4104,8 @@ krb5_string_to_key_derived(krb5_context context,
 			       etype);
 	return KRB5_PROG_ETYPE_NOSUPP;
     }
+    keylen = et->keytype->bits / 8;
+
     ALLOC(kd.key, 1);
     if(kd.key == NULL) {
 	krb5_set_error_string (context, "malloc: out of memory");
diff --git a/source4/heimdal/lib/krb5/data.c b/source4/heimdal/lib/krb5/data.c
index 9cf1410e70..3192c4c64f 100644
--- a/source4/heimdal/lib/krb5/data.c
+++ b/source4/heimdal/lib/krb5/data.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: data.c,v 1.19 2004/05/25 21:22:23 lha Exp $");
+RCSID("$Id: data.c,v 1.20 2006/04/02 01:06:07 lha Exp $");
 
 void KRB5_LIB_FUNCTION
 krb5_data_zero(krb5_data *p)
@@ -114,6 +114,7 @@ krb5_copy_data(krb5_context context,
     if(ret) {
 	krb5_clear_error_string (context);
 	free(*outdata);
+	*outdata = NULL;
     }
     return ret;
 }
diff --git a/source4/heimdal/lib/krb5/fcache.c b/source4/heimdal/lib/krb5/fcache.c
index f8ebe837b7..79b809d2a2 100644
--- a/source4/heimdal/lib/krb5/fcache.c
+++ b/source4/heimdal/lib/krb5/fcache.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: fcache.c,v 1.51 2005/08/12 13:31:19 lha Exp $");
+RCSID("$Id: fcache.c,v 1.52 2006/04/02 01:04:37 lha Exp $");
 
 typedef struct krb5_fcache{
     char *filename;
@@ -269,10 +269,11 @@ fcc_gen_new(krb5_context context, krb5_ccache *id)
     }
     fd = mkstemp(file);
     if(fd < 0) {
+	int ret = errno;
+	krb5_set_error_string(context, "mkstemp %s", file);
 	free(f);
 	free(file);
-	krb5_set_error_string(context, "mkstemp %s", file);
-	return errno;
+	return ret;
     }
     close(fd);
     f->filename = file;
diff --git a/source4/heimdal/lib/krb5/get_for_creds.c b/source4/heimdal/lib/krb5/get_for_creds.c
index dafe668b5d..661d05663b 100644
--- a/source4/heimdal/lib/krb5/get_for_creds.c
+++ b/source4/heimdal/lib/krb5/get_for_creds.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_for_creds.c,v 1.48 2006/03/07 19:38:09 lha Exp $");
+RCSID("$Id: get_for_creds.c,v 1.49 2006/04/10 09:28:15 lha Exp $");
 
 static krb5_error_code
 add_addrs(krb5_context context,
@@ -180,10 +180,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
     addrs.len = 0;
     addrs.val = NULL;
 
-    if (in_creds->client && in_creds->client->realm)
-	realm = in_creds->client->realm;
-    else
-	realm = in_creds->server->realm;
+    realm = in_creds->client->realm;
 
     krb5_appdefault_boolean(context, NULL, realm, "no-addresses-ever", 
 			    TRUE, &noaddr_ever);
diff --git a/source4/heimdal/lib/krb5/init_creds.c b/source4/heimdal/lib/krb5/init_creds.c
index 316c2f02eb..88de280a00 100644
--- a/source4/heimdal/lib/krb5/init_creds.c
+++ b/source4/heimdal/lib/krb5/init_creds.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: init_creds.c,v 1.22 2006/02/03 11:42:31 lha Exp $");
+RCSID("$Id: init_creds.c,v 1.23 2006/04/02 01:08:30 lha Exp $");
 
 void KRB5_LIB_FUNCTION
 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
@@ -75,7 +75,7 @@ _krb5_get_init_creds_opt_copy(krb5_context context,
     krb5_get_init_creds_opt *opt;
 
     *out = NULL;
-    opt = malloc(sizeof(*opt));
+    opt = calloc(1, sizeof(*opt));
     if (opt == NULL) {
 	krb5_set_error_string(context, "out of memory");
 	return ENOMEM;
diff --git a/source4/heimdal/lib/krb5/init_creds_pw.c b/source4/heimdal/lib/krb5/init_creds_pw.c
index 3c694624bf..489a88a31b 100644
--- a/source4/heimdal/lib/krb5/init_creds_pw.c
+++ b/source4/heimdal/lib/krb5/init_creds_pw.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: init_creds_pw.c,v 1.90 2005/10/12 12:45:11 lha Exp $");
+RCSID("$Id: init_creds_pw.c,v 1.92 2006/04/02 01:20:15 lha Exp $");
 
 typedef struct krb5_get_init_creds_ctx {
     krb5_kdc_flags flags;
@@ -79,8 +79,10 @@ default_s2k_func(krb5_context context, krb5_enctype type,
 	return ENOMEM;
     ret = krb5_string_to_key_data_salt_opaque(context, type, password,
 					      salt, opaque, *key);
-    if (ret)
+    if (ret) {
 	free(*key);
+	*key = NULL;
+    }
     return ret;
 }
 
@@ -545,23 +547,14 @@ init_creds_init_as_req (krb5_context context,
 	krb5_set_error_string(context, "malloc: out of memory");
 	goto fail;
     }
-    if (creds->client) {
-	ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
-	if (ret)
-	    goto fail;
-	ret = copy_Realm(&creds->client->realm, &a->req_body.realm);
-	if (ret)
-	    goto fail;
-    } else {
-       krb5_realm realm;
 
-	a->req_body.cname = NULL;
-	ret = krb5_get_default_realm(context, &realm);
-	if (ret)
-	    goto fail;
-	ret = copy_Realm(&realm, &a->req_body.realm);
-	free(realm);
-    }
+    ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
+    if (ret)
+	goto fail;
+    ret = copy_Realm(&creds->client->realm, &a->req_body.realm);
+    if (ret)
+	goto fail;
+
     ret = _krb5_principal2principalname (a->req_body.sname, creds->server);
     if (ret)
 	goto fail;
diff --git a/source4/heimdal/lib/krb5/keytab_any.c b/source4/heimdal/lib/krb5/keytab_any.c
index 667788c69d..d5130aaad8 100644
--- a/source4/heimdal/lib/krb5/keytab_any.c
+++ b/source4/heimdal/lib/krb5/keytab_any.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_any.c,v 1.7 2002/10/21 13:36:59 joda Exp $");
+RCSID("$Id: keytab_any.c,v 1.8 2006/04/10 09:20:13 lha Exp $");
 
 struct any_data {
     krb5_keytab kt;
@@ -162,23 +162,22 @@ any_next_entry (krb5_context context,
 	ret = krb5_kt_next_entry(context, ed->a->kt, entry, &ed->cursor);
 	if (ret == 0)
 	    return 0;
-	else if (ret == KRB5_KT_END) {
-	    ret2 = krb5_kt_end_seq_get (context, ed->a->kt, &ed->cursor);
-	    if (ret2)
-		return ret2;
-	    while ((ed->a = ed->a->next) != NULL) {
-		ret2 = krb5_kt_start_seq_get(context, ed->a->kt, &ed->cursor);
-		if (ret2 == 0)
-		    break;
-	    }
-	    if (ed->a == NULL) {
-		krb5_clear_error_string (context);
-		return KRB5_KT_END;
-	    }
-	} else
+	else if (ret != KRB5_KT_END)
 	    return ret;
-    } while (ret == KRB5_KT_END);
-    return ret;
+
+	ret2 = krb5_kt_end_seq_get (context, ed->a->kt, &ed->cursor);
+	if (ret2)
+	    return ret2;
+	while ((ed->a = ed->a->next) != NULL) {
+	    ret2 = krb5_kt_start_seq_get(context, ed->a->kt, &ed->cursor);
+	    if (ret2 == 0)
+		break;
+	}
+	if (ed->a == NULL) {
+	    krb5_clear_error_string (context);
+	    return KRB5_KT_END;
+	}
+    } while (1);
 }
 
 static krb5_error_code
diff --git a/source4/heimdal/lib/krb5/keytab_file.c b/source4/heimdal/lib/krb5/keytab_file.c
index 6ff2680ed1..f9a76e634a 100644
--- a/source4/heimdal/lib/krb5/keytab_file.c
+++ b/source4/heimdal/lib/krb5/keytab_file.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_file.c,v 1.20 2005/07/13 06:08:07 lha Exp $");
+RCSID("$Id: keytab_file.c,v 1.22 2006/04/07 21:57:31 lha Exp $");
 
 #define KRB5_KT_VNO_1 1
 #define KRB5_KT_VNO_2 2
@@ -164,7 +164,7 @@ krb5_kt_ret_principal(krb5_context context,
     int i;
     int ret;
     krb5_principal p;
-    int16_t tmp;
+    int16_t len;
     
     ALLOC(p, 1);
     if(p == NULL) {
@@ -172,25 +172,34 @@ krb5_kt_ret_principal(krb5_context context,
 	return ENOMEM;
     }
 
-    ret = krb5_ret_int16(sp, &tmp);
-    if(ret)
-	return ret;
+    ret = krb5_ret_int16(sp, &len);
+    if(ret) {
+	krb5_set_error_string(context,
+			      "Failed decoding length of keytab principal");
+	goto out;
+    }
     if(krb5_storage_is_flags(sp, KRB5_STORAGE_PRINCIPAL_WRONG_NUM_COMPONENTS))
-	tmp--;
-    p->name.name_string.len = tmp;
+	len--;
+    if (len < 0) {
+	krb5_set_error_string(context, 
+			      "Keytab principal contains invalid length");
+	ret = KRB5_KT_END;
+	goto out;
+    }
     ret = krb5_kt_ret_string(context, sp, &p->realm);
     if(ret)
-	return ret;
-    p->name.name_string.val = calloc(p->name.name_string.len, 
-				     sizeof(*p->name.name_string.val));
+	goto out;
+    p->name.name_string.val = calloc(len, sizeof(*p->name.name_string.val));
     if(p->name.name_string.val == NULL) {
 	krb5_set_error_string (context, "malloc: out of memory");
-	return ENOMEM;
+	ret = ENOMEM;
+	goto out;
     }
+    p->name.name_string.len = len;
     for(i = 0; i < p->name.name_string.len; i++){
 	ret = krb5_kt_ret_string(context, sp, p->name.name_string.val + i);
 	if(ret)
-	    return ret;
+	    goto out;
     }
     if (krb5_storage_is_flags(sp, KRB5_STORAGE_PRINCIPAL_NO_NAME_TYPE))
 	p->name.name_type = KRB5_NT_UNKNOWN;
@@ -199,10 +208,13 @@ krb5_kt_ret_principal(krb5_context context,
 	ret = krb5_ret_int32(sp, &tmp32);
 	p->name.name_type = tmp32;
 	if (ret)
-	    return ret;
+	    goto out;
     }
     *princ = p;
     return 0;
+out:
+    krb5_free_principal(context, p);
+    return ret;
 }
 
 static krb5_error_code
@@ -423,7 +435,7 @@ loop:
 	}
     }
     if(start) *start = pos;
-    if(end) *end = *start + 4 + len;
+    if(end) *end = pos + 4 + len;
  out:
     krb5_storage_seek(cursor->sp, pos + 4 + len, SEEK_SET);
     return ret;
diff --git a/source4/heimdal/lib/krb5/keytab_keyfile.c b/source4/heimdal/lib/krb5/keytab_keyfile.c
index 5c94291e72..32fb48a8a2 100644
--- a/source4/heimdal/lib/krb5/keytab_keyfile.c
+++ b/source4/heimdal/lib/krb5/keytab_keyfile.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_keyfile.c,v 1.17 2005/09/30 11:20:53 lha Exp $");
+RCSID("$Id: keytab_keyfile.c,v 1.18 2006/04/02 01:24:52 lha Exp $");
 
 /* afs keyfile operations --------------------------------------- */
 
@@ -94,6 +94,7 @@ get_cell_and_realm (krb5_context context,
     f = fopen (AFS_SERVERMAGICKRBCONF, "r");
     if (f != NULL) {
 	if (fgets (buf, sizeof(buf), f) == NULL) {
+	    free (d->cell);
 	    fclose (f);
 	    krb5_set_error_string (context, "no realm in %s",
 				   AFS_SERVERMAGICKRBCONF);
diff --git a/source4/heimdal/lib/krb5/keytab_krb4.c b/source4/heimdal/lib/krb5/keytab_krb4.c
index 1a83faca57..19e7f106bf 100644
--- a/source4/heimdal/lib/krb5/keytab_krb4.c
+++ b/source4/heimdal/lib/krb5/keytab_krb4.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_krb4.c,v 1.13 2005/05/19 04:13:18 lha Exp $");
+RCSID("$Id: keytab_krb4.c,v 1.15 2006/04/10 17:10:53 lha Exp $");
 
 struct krb4_kt_data {
     char *filename;
@@ -139,6 +139,11 @@ krb4_kt_start_seq_get_int (krb5_context context,
 	return ret;
     }
     c->sp = krb5_storage_from_fd(c->fd);
+    if(c->sp == NULL) {
+	close(c->fd);
+	free(ed);
+	return ENOMEM;
+    }
     krb5_storage_set_eof_code(c->sp, KRB5_KT_END);
     return 0;
 }
@@ -302,11 +307,11 @@ krb4_kt_add_entry (krb5_context context,
 	}
     }
     sp = krb5_storage_from_fd(fd);
-    krb5_storage_set_eof_code(sp, KRB5_KT_END);
     if(sp == NULL) {
 	close(fd);
 	return ENOMEM;
     }
+    krb5_storage_set_eof_code(sp, KRB5_KT_END);
     ret = krb4_store_keytab_entry(context, entry, sp);
     krb5_storage_free(sp);
     if(close (fd) < 0)
@@ -316,8 +321,8 @@ krb4_kt_add_entry (krb5_context context,
 
 static krb5_error_code
 krb4_kt_remove_entry(krb5_context context,
-		 krb5_keytab id,
-		 krb5_keytab_entry *entry)
+		     krb5_keytab id,
+		     krb5_keytab_entry *entry)
 {
     struct krb4_kt_data *d = id->data;
     krb5_error_code ret;
diff --git a/source4/heimdal/lib/krb5/krb5-private.h b/source4/heimdal/lib/krb5/krb5-private.h
index 8d9b3c62ac..00126d60ed 100644
--- a/source4/heimdal/lib/krb5/krb5-private.h
+++ b/source4/heimdal/lib/krb5/krb5-private.h
@@ -302,19 +302,13 @@ void KRB5_LIB_FUNCTION
 _krb5_pk_cert_free (struct krb5_pk_cert */*cert*/);
 
 krb5_error_code KRB5_LIB_FUNCTION
-_krb5_pk_create_sign (
-	krb5_context /*context*/,
-	const heim_oid */*eContentType*/,
-	krb5_data */*eContent*/,
-	struct krb5_pk_identity */*id*/,
-	krb5_data */*sd_data*/);
-
-krb5_error_code KRB5_LIB_FUNCTION
-_krb5_pk_load_openssl_id (
+_krb5_pk_load_id (
 	krb5_context /*context*/,
 	struct krb5_pk_identity **/*ret_id*/,
 	const char */*user_id*/,
-	const char */*x509_anchors*/,
+	const char */*anchor_id*/,
+	char * const */*chain*/,
+	char * const */*revoke*/,
 	krb5_prompter_fct /*prompter*/,
 	void */*prompter_data*/,
 	char */*password*/);
diff --git a/source4/heimdal/lib/krb5/krb5-protos.h b/source4/heimdal/lib/krb5/krb5-protos.h
index d7e74621ef..56f43f6c3d 100644
--- a/source4/heimdal/lib/krb5/krb5-protos.h
+++ b/source4/heimdal/lib/krb5/krb5-protos.h
@@ -1874,6 +1874,8 @@ krb5_get_init_creds_opt_set_pkinit (
 	krb5_principal /*principal*/,
 	const char */*user_id*/,
 	const char */*x509_anchors*/,
+	char * const * /*chain*/,
+	char * const * /*revoke*/,
 	int /*flags*/,
 	krb5_prompter_fct /*prompter*/,
 	void */*prompter_data*/,
diff --git a/source4/heimdal/lib/krb5/krb5_ccapi.h b/source4/heimdal/lib/krb5/krb5_ccapi.h
index 00c30d7791..29b2ddbecc 100644
--- a/source4/heimdal/lib/krb5/krb5_ccapi.h
+++ b/source4/heimdal/lib/krb5/krb5_ccapi.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5_ccapi.h,v 1.1 2004/09/11 04:00:42 lha Exp $ */
+/* $Id: krb5_ccapi.h,v 1.2 2006/03/27 04:21:06 lha Exp $ */
 
 #ifndef KRB5_CCAPI_H
 #define KRB5_CCAPI_H 1
@@ -43,7 +43,8 @@ enum {
 };
 
 enum {
-    ccapi_version_3 = 3
+    ccapi_version_3 = 3,
+    ccapi_version_4 = 4
 };
 
 enum {
@@ -108,7 +109,21 @@ struct cc_credentials_v5_t {
     cc_time_t endtime;
     cc_time_t renew_till;
     cc_uint32 is_skey;
-    cc_uint32 ticket_flags; /* XXX ticket flags undefined */
+    cc_uint32 ticket_flags;
+#define	KRB5_CCAPI_TKT_FLG_FORWARDABLE			0x40000000
+#define	KRB5_CCAPI_TKT_FLG_FORWARDED			0x20000000
+#define	KRB5_CCAPI_TKT_FLG_PROXIABLE			0x10000000
+#define	KRB5_CCAPI_TKT_FLG_PROXY			0x08000000
+#define	KRB5_CCAPI_TKT_FLG_MAY_POSTDATE			0x04000000
+#define	KRB5_CCAPI_TKT_FLG_POSTDATED			0x02000000
+#define	KRB5_CCAPI_TKT_FLG_INVALID			0x01000000
+#define	KRB5_CCAPI_TKT_FLG_RENEWABLE			0x00800000
+#define	KRB5_CCAPI_TKT_FLG_INITIAL			0x00400000
+#define	KRB5_CCAPI_TKT_FLG_PRE_AUTH			0x00200000
+#define	KRB5_CCAPI_TKT_FLG_HW_AUTH			0x00100000
+#define	KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED	0x00080000
+#define	KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE		0x00040000
+#define	KRB5_CCAPI_TKT_FLG_ANONYMOUS			0x00020000
     cc_data **addresses;
     cc_data ticket;
     cc_data second_ticket;
diff --git a/source4/heimdal/lib/krb5/krbhst.c b/source4/heimdal/lib/krb5/krbhst.c
index ef9f5dbd60..221bd706f4 100644
--- a/source4/heimdal/lib/krb5/krbhst.c
+++ b/source4/heimdal/lib/krb5/krbhst.c
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <resolve.h>
 
-RCSID("$Id: krbhst.c,v 1.53 2005/10/08 15:40:50 lha Exp $");
+RCSID("$Id: krbhst.c,v 1.55 2006/04/02 10:32:20 lha Exp $");
 
 static int
 string_to_proto(const char *string)
@@ -241,8 +241,9 @@ _krb5_krbhost_info_move(krb5_context context,
 			krb5_krbhst_info *from,
 			krb5_krbhst_info **to)
 {
+    size_t hostnamelen = strlen(from->hostname);
     /* trailing NUL is included in structure */
-    *to = calloc(1, sizeof(**to) + strlen(from->hostname)); 
+    *to = calloc(1, sizeof(**to) + hostnamelen); 
     if(*to == NULL) {
 	krb5_set_error_string(context, "malloc - out of memory");
 	return ENOMEM;
@@ -254,7 +255,7 @@ _krb5_krbhost_info_move(krb5_context context,
     (*to)->ai = from->ai;
     from->ai = NULL;
     (*to)->next = NULL;
-    strcpy((*to)->hostname, from->hostname);
+    memcpy((*to)->hostname, from->hostname, hostnamelen + 1);
     return 0;
 }
 
diff --git a/source4/heimdal/lib/krb5/log.c b/source4/heimdal/lib/krb5/log.c
index 4f6381c858..7e478bf1e0 100644
--- a/source4/heimdal/lib/krb5/log.c
+++ b/source4/heimdal/lib/krb5/log.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: log.c,v 1.36 2005/06/17 04:25:05 lha Exp $");
+RCSID("$Id: log.c,v 1.38 2006/04/10 09:41:26 lha Exp $");
 
 struct facility {
     int min;
@@ -284,7 +284,7 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 	ret = open_file(context, f, min, max, NULL, NULL, stderr, 1);
     }else if(strcmp(p, "CONSOLE") == 0){
 	ret = open_file(context, f, min, max, "/dev/console", "w", NULL, 0);
-    }else if(strncmp(p, "FILE:", 4) == 0 && (p[4] == ':' || p[4] == '=')){
+    }else if(strncmp(p, "FILE", 4) == 0 && (p[4] == ':' || p[4] == '=')){
 	char *fn;
 	FILE *file = NULL;
 	int keep_open = 0;
@@ -300,6 +300,7 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 		ret = errno;
 		krb5_set_error_string (context, "open(%s): %s", fn,
 				       strerror(ret));
+		free(fn);
 		return ret;
 	    }
 	    file = fdopen(i, "a");
@@ -308,12 +309,13 @@ krb5_addlog_dest(krb5_context context, krb5_log_facility *f, const char *orig)
 		close(i);
 		krb5_set_error_string (context, "fdopen(%s): %s", fn,
 				       strerror(ret));
+		free(fn);
 		return ret;
 	    }
 	    keep_open = 1;
 	}
 	ret = open_file(context, f, min, max, fn, "a", file, keep_open);
-    }else if(strncmp(p, "DEVICE=", 6) == 0){
+    }else if(strncmp(p, "DEVICE", 6) == 0 && (p[6] == ':' || p[6] == '=')){
 	ret = open_file(context, f, min, max, strdup(p + 7), "w", NULL, 0);
     }else if(strncmp(p, "SYSLOG", 6) == 0 && (p[6] == '\0' || p[6] == ':')){
 	char severity[128] = "";
diff --git a/source4/heimdal/lib/krb5/pkinit.c b/source4/heimdal/lib/krb5/pkinit.c
index 1247bb22ca..fa4fb4699e 100755
--- a/source4/heimdal/lib/krb5/pkinit.c
+++ b/source4/heimdal/lib/krb5/pkinit.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: pkinit.c,v 1.77 2006/02/14 10:08:29 lha Exp $");
+RCSID("$Id: pkinit.c,v 1.88 2006/04/23 21:30:17 lha Exp $");
 
 struct krb5_dh_moduli {
     char *name;
@@ -45,71 +45,35 @@ struct krb5_dh_moduli {
 
 #ifdef PKINIT
 
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <openssl/err.h>
-#include <openssl/dh.h>
-#include <openssl/bn.h>
-#include <openssl/engine.h>
-#include <openssl/ui.h>
-
-#ifdef HAVE_DIRENT_H
-#include <dirent.h>
-#endif
+#include <heim_asn1.h>
+#include <rfc2459_asn1.h>
+#include <cms_asn1.h>
+#include <pkcs8_asn1.h>
+#include <pkcs9_asn1.h>
+#include <pkcs12_asn1.h>
+#include <pkinit_asn1.h>
+#include <asn1_err.h>
+
+#include <der.h>
 
-#include "heim_asn1.h"
-#include "rfc2459_asn1.h"
-#include "cms_asn1.h"
-#include "pkinit_asn1.h"
+#include <hx509.h>
 
 enum {
     COMPAT_WIN2K = 1,
     COMPAT_IETF = 2
 };
 
-#define OPENSSL_ASN1_MALLOC_ENCODE(T, B, BL, S, R)			\
-{									\
-  unsigned char *p;							\
-  (BL) = i2d_##T((S), NULL);						\
-  if ((BL) <= 0) {							\
-     (R) = EINVAL;							\
-  } else {								\
-    (B) = malloc((BL));							\
-    if ((B) == NULL) {							\
-       (R) = ENOMEM;							\
-    } else {								\
-        p = (B);							\
-        (R) = 0;							\
-        (BL) = i2d_##T((S), &p);					\
-        if ((BL) <= 0) {						\
-           free((B));                                          		\
-           (R) = ASN1_OVERRUN;						\
-        }								\
-    }									\
-  }									\
-}
-
-/* ENGING_load_private_key requires a UI_METHOD and data  
- * if to be usable from PAM 
- */
-
-struct krb5_ui_data {
-    krb5_context context;
-    krb5_prompter_fct prompter;
-    void * prompter_data;
-};
-
 struct krb5_pk_identity {
-    EVP_PKEY *private_key;
-    STACK_OF(X509) *cert;
-    STACK_OF(X509) *trusted_certs;
-    STACK_OF(X509_CRL) *crls;
-    ENGINE *engine;
+    hx509_context hx509ctx;
+    hx509_verify_ctx verify_ctx;
+    hx509_certs certs;
+    hx509_certs anchors;
+    hx509_certs certpool;
+    hx509_revoke_ctx revoke;
 };
 
 struct krb5_pk_cert {
-    X509 *cert;
+    hx509_cert cert;
 };
 
 struct krb5_pk_init_ctx_data {
@@ -118,13 +82,16 @@ struct krb5_pk_init_ctx_data {
     krb5_data *clientDHNonce;
     struct krb5_dh_moduli **m;
     int require_binding;
+    int require_eku;
+    int require_krbtgt_otherName;
 };
 
 void KRB5_LIB_FUNCTION
 _krb5_pk_cert_free(struct krb5_pk_cert *cert)
 {
-    if (cert->cert)
-	X509_free(cert->cert);
+    if (cert->cert) {
+	hx509_cert_free(cert->cert);
+    }
     free(cert);
 }
 
@@ -138,7 +105,7 @@ BN_to_integer(krb5_context context, BIGNUM *bn, heim_integer *integer)
 	return ENOMEM;
     }
     BN_bn2bin(bn, integer->data);
-    integer->negative = bn->neg;
+    integer->negative = BN_is_negative(bn);
     return 0;
 }
 
@@ -152,315 +119,44 @@ integer_to_BN(krb5_context context, const char *field, const heim_integer *f)
 	krb5_set_error_string(context, "PKINIT: parsing BN failed %s", field);
 	return NULL;
     }
-    bn->neg = f->negative;
+    BN_set_negative(bn, f->negative);
     return bn;
 }
 
-/*
- * UI ex_data has the callback_data as passed to Engine. This is far
- * from being complete, we will only process one prompt
- */
-
-static int
-krb5_ui_method_read_string(UI *ui, UI_STRING *uis)
-{
-    char *buffer;
-    size_t length;
-    krb5_error_code ret;
-    krb5_prompt prompt;
-    krb5_data password_data;
-    struct krb5_ui_data *ui_data;
-  
-    ui_data = (struct krb5_ui_data *)UI_get_app_data(ui);
-
-    switch (UI_get_string_type(uis)) {
-    case UIT_INFO:
-    case UIT_ERROR:
-	/* looks like the RedHat pam_prompter might handle 
-	 * INFO and ERROR, Will see what happens */
-    case UIT_VERIFY:
-    case UIT_PROMPT:
-	length = UI_get_result_maxsize(uis);
-	buffer = malloc(length);
-	if (buffer == NULL) {
-	    krb5_set_error_string(ui_data->context, "malloc: out of memory");
-	    return 0;
-	}
-	password_data.data = buffer;
-	password_data.length = length;
-
-	prompt.prompt = UI_get0_output_string(uis);
-	prompt.hidden = !(UI_get_input_flags(uis) & UI_INPUT_FLAG_ECHO);
-	prompt.reply  = &password_data;
-	prompt.type   = KRB5_PROMPT_TYPE_PASSWORD;
-  
-	ret = (*ui_data->prompter)(ui_data->context, 
-				   ui_data->prompter_data, 
-				   NULL, NULL, 1, &prompt);
-	if (ret == 0) {
-	    buffer[length - 1] = '\0';
-	    UI_set_result(ui, uis, password_data.data);
-
-	    /*
-	     * RedHat pam_krb5 pam_prompter does a strdup but others
-	     * may copy into buffer. XXX should we just leak the
-	     * memory instead ?
-	     */
-
-	    if (buffer != password_data.data)
-		free(password_data.data);
-	    memset (buffer, 0, length);
-	    free(buffer);
-	    return 1;
-	}
-	memset (buffer, 0, length);
-	free(buffer);
-	break;
-    case UIT_NONE:
-    case UIT_BOOLEAN:
-	/* XXX for now do not handle */
-	break;
-
-    }
-    return 0;
-}
-
 
 static krb5_error_code
-set_digest_alg(DigestAlgorithmIdentifier *id,
-	       const heim_oid *oid,
-	       void *param, size_t length)
-{
-    krb5_error_code ret;
-    if (param) {
-	id->parameters = malloc(sizeof(*id->parameters));
-	if (id->parameters == NULL)
-	    return ENOMEM;
-	id->parameters->data = malloc(length);
-	if (id->parameters->data == NULL) {
-	    free(id->parameters);
-	    id->parameters = NULL;
-	    return ENOMEM;
-	}
-	memcpy(id->parameters->data, param, length);
-	id->parameters->length = length;
-    } else
-	id->parameters = NULL;
-    ret = copy_oid(oid, &id->algorithm);
-    if (ret) {
-	if (id->parameters) {
-	    free(id->parameters->data);
-	    free(id->parameters);
-	    id->parameters = NULL;
-	}
-	return ret;
-    }
-    return 0;
-}
-
-krb5_error_code KRB5_LIB_FUNCTION
 _krb5_pk_create_sign(krb5_context context,
 		     const heim_oid *eContentType,
 		     krb5_data *eContent,
 		     struct krb5_pk_identity *id,
 		     krb5_data *sd_data)
 {
-    SignerInfo *signer_info;
-    X509 *user_cert;
-    heim_integer *serial;
-    krb5_error_code ret;
-    krb5_data buf;
-    SignedData sd;
-    EVP_MD_CTX md;
-    int i;
-    unsigned len;
-    size_t size;
-    
-    X509_NAME *issuer_name;
-
-    memset(&sd, 0, sizeof(sd));
-
-    if (id == NULL)
-	return HEIM_PKINIT_NO_CERTIFICATE;
-    if (id->cert == NULL)
-	return HEIM_PKINIT_NO_CERTIFICATE;
-    if (id->private_key == NULL)
-	return HEIM_PKINIT_NO_PRIVATE_KEY;
-
-    if (sk_X509_num(id->cert) == 0)
-	return HEIM_PKINIT_NO_CERTIFICATE;
-
-    sd.version = 3;
-
-    sd.digestAlgorithms.len = 0;
-    sd.digestAlgorithms.val = NULL;
-    copy_oid(eContentType, &sd.encapContentInfo.eContentType);
-    ALLOC(sd.encapContentInfo.eContent, 1);
-    if (sd.encapContentInfo.eContent == NULL) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
-    }
-
-    ret = krb5_data_copy(&buf, eContent->data, eContent->length);
-    if (ret) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
-    }
-
-    sd.encapContentInfo.eContent->data = buf.data;
-    sd.encapContentInfo.eContent->length = buf.length;
-
-    ALLOC_SEQ(&sd.signerInfos, 1);
-    if (sd.signerInfos.val == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	ret = ENOMEM;
-	goto out;
-    }
-
-    signer_info = &sd.signerInfos.val[0];
-
-    user_cert = sk_X509_value(id->cert, 0);
-    if (user_cert == NULL) {
-	krb5_set_error_string(context, "pkinit: no user certificate");
-	ret = HEIM_PKINIT_NO_CERTIFICATE;
-	goto out;
-    }
-
-    signer_info->version = 1;
-
-    issuer_name = X509_get_issuer_name(user_cert);
-
-    OPENSSL_ASN1_MALLOC_ENCODE(X509_NAME, 
-			       buf.data,
-			       buf.length,
-			       issuer_name,
-			       ret);
-    if (ret) {
-	krb5_set_error_string(context, "pkinit: failed encoding name");
-	goto out;
-    }
-    ret = decode_Name(buf.data, buf.length,
-		      &signer_info->sid.u.issuerAndSerialNumber.issuer,
-		      NULL);
-    free(buf.data);
-    if (ret) {
-	krb5_set_error_string(context, "pkinit: failed to parse Name");
-	goto out;
-    }
-    signer_info->sid.element = choice_CMSIdentifier_issuerAndSerialNumber;
-
-    serial = &signer_info->sid.u.issuerAndSerialNumber.serialNumber;
-    {
-	ASN1_INTEGER *isn = X509_get_serialNumber(user_cert);
-	BIGNUM *bn = ASN1_INTEGER_to_BN(isn, NULL);
-	if (bn == NULL) {
-	    ret = ENOMEM;
-	    krb5_set_error_string(context, "pkinit: failed allocating "
-				  "serial number");
-	    goto out;
-	}
-	ret = BN_to_integer(context, bn, serial);
-	BN_free(bn);
-	if (ret) {
-	    krb5_set_error_string(context, "pkinit: failed encoding "
-				  "serial number");
-	    goto out;
-	}
-    }
-
-    ret = set_digest_alg(&signer_info->digestAlgorithm,
-			 oid_id_secsig_sha_1(), "\x05\x00", 2);
-    if (ret) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	goto out;
-    }
-
-    signer_info->signedAttrs = NULL;
-    signer_info->unsignedAttrs = NULL;
-
-    copy_oid(oid_id_pkcs1_rsaEncryption(),
-	     &signer_info->signatureAlgorithm.algorithm);
-    signer_info->signatureAlgorithm.parameters = NULL;
-
-    buf.data = malloc(EVP_PKEY_size(id->private_key));
-    if (buf.data == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	ret = ENOMEM;
-	goto out;
-    }
-
-    EVP_SignInit(&md, EVP_sha1());
-    EVP_SignUpdate(&md,
-		   sd.encapContentInfo.eContent->data,
-		   sd.encapContentInfo.eContent->length);
-    ret = EVP_SignFinal(&md, buf.data, &len, id->private_key);
-    if (ret != 1) {
-	free(buf.data);
-	krb5_set_error_string(context, "PKINIT: failed to sign with "
-			      "private key: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-	ret = EINVAL;
-	goto out;
-    }
-
-    signer_info->signature.data = buf.data;
-    signer_info->signature.length = len;
-
-    ALLOC_SEQ(&sd.digestAlgorithms, 1);
-    if (sd.digestAlgorithms.val == NULL) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
-    }
-
-    ret = set_digest_alg(&sd.digestAlgorithms.val[0],
-			 oid_id_secsig_sha_1(), "\x05\x00", 2);
-    if (ret) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	goto out;
-    }
+    hx509_cert cert;
+    hx509_query *q;
+    int ret;
 
-    ALLOC(sd.certificates, 1);
-    if (sd.certificates == NULL) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
-    }
+    ret = hx509_query_alloc(id->hx509ctx, &q);
+    if (ret)
+	return ret;
 
-    i = sk_X509_num(id->cert);
-    sd.certificates->val = malloc(sizeof(sd.certificates->val[0]) * i);
-    if (sd.certificates->val == NULL) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
-    }
-    sd.certificates->len = i;
-
-    for (i = 0; i < sk_X509_num(id->cert); i++) {
-	OPENSSL_ASN1_MALLOC_ENCODE(X509, 
-				   sd.certificates->val[i].data,
-				   sd.certificates->val[i].length,
-				   sk_X509_value(id->cert, i),
-				   ret);
-	if (ret) {
-	    krb5_clear_error_string(context);
-	    goto out;
-	}
-    }
+    hx509_query_match_option(q, HX509_QUERY_OPTION_PRIVATE_KEY);
+    hx509_query_match_option(q, HX509_QUERY_OPTION_KU_DIGITALSIGNATURE);
 
-    ASN1_MALLOC_ENCODE(SignedData, sd_data->data, sd_data->length, 
-		       &sd, &size, ret);
-    if (ret) {
-	krb5_set_error_string(context, "SignedData failed %d", ret);
-	goto out;
-    }
-    if (sd_data->length != size)
-	krb5_abortx(context, "internal ASN1 encoder error");
+    ret = hx509_certs_find(id->hx509ctx, id->certs, q, &cert);
+    hx509_query_free(id->hx509ctx, q);
+    if (ret)
+	return ret;
 
- out:
-    free_SignedData(&sd);
+    ret = hx509_cms_create_signed_1(id->hx509ctx,
+				    eContentType,
+				    eContent->data,
+				    eContent->length,
+				    NULL,
+				    cert,
+				    NULL,
+				    NULL,
+				    sd_data);
+    hx509_cert_free(cert);
 
     return ret;
 }
@@ -813,230 +509,23 @@ _krb5_pk_mk_padata(krb5_context context,
     } else
 	type = COMPAT_IETF;
 
-    return pk_mk_padata(context, type, ctx, req_body, nonce, md);
-}
+    ctx->require_eku = 
+	krb5_config_get_bool_default(context, NULL,
+				     TRUE,
+				     "realms",
+				     req_body->realm,
+				     "pkinit_require_eku",
+				     NULL);
+    ctx->require_krbtgt_otherName = 
+	krb5_config_get_bool_default(context, NULL,
+				     TRUE,
+				     "realms",
+				     req_body->realm,
+				     "pkinit_require_krbtgt_otherName",
+				     NULL);
 
-static krb5_boolean
-pk_peer_compare(krb5_context context,
-		const SignerIdentifier *peer1, 
-		X509 *peer2)
-{
-    switch (peer1->element) {
-    case choice_CMSIdentifier_issuerAndSerialNumber: {
-	ASN1_INTEGER *i;
-	const heim_integer *serial;
-	X509_NAME *name;
-	unsigned char *p;
-	size_t len;
-
-	i = X509_get_serialNumber(peer2);
-	serial = &peer1->u.issuerAndSerialNumber.serialNumber;
-
-	if (i->length != serial->length ||
-	    memcmp(i->data, serial->data, i->length) != 0)
-	    return FALSE;
-
-	p = peer1->u.issuerAndSerialNumber.issuer._save.data;
-	len = peer1->u.issuerAndSerialNumber.issuer._save.length;
-	name = d2i_X509_NAME(NULL, &p, len);
-	if (name == NULL)
-	    return FALSE;
-	
-	if (X509_NAME_cmp(name, X509_get_issuer_name(peer2)) != 0) {
-	    X509_NAME_free(name);
-	    return FALSE;
-	}
-	X509_NAME_free(name);
-	break;
-    }
-    case choice_CMSIdentifier_subjectKeyIdentifier:
-	return FALSE;
-    default:
-	return FALSE;
-    }
-    return TRUE;
-}
 
-static krb5_error_code
-pk_decrypt_key(krb5_context context,
-	       heim_octet_string *encrypted_key,
-	       EVP_PKEY *priv_key,
-	       krb5_keyblock *key)
-{
-    int ret;
-    unsigned char *buf;
-
-    buf = malloc(EVP_PKEY_size(priv_key));
-    if (buf == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-    ret = EVP_PKEY_decrypt(buf,
-			   encrypted_key->data,
-			   encrypted_key->length,
-			   priv_key);
-    if (ret <= 0) {
-	free(buf);
-	krb5_set_error_string(context, "Can't decrypt key: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-	return ENOMEM;
-    }
-
-    key->keytype = 0;
-    key->keyvalue.length = ret;
-    key->keyvalue.data = malloc(ret);
-    if (key->keyvalue.data == NULL) {
-	free(buf);
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-    memcpy(key->keyvalue.data, buf, ret);
-    free(buf);
-    return 0;
-}
-
-
-static krb5_error_code 
-pk_verify_chain_standard(krb5_context context,
-			 struct krb5_pk_identity *id,
-			 const SignerIdentifier *client,
-			 STACK_OF(X509) *chain,
-			 X509 **client_cert)
-{
-    X509_STORE *cert_store = NULL;
-    X509_STORE_CTX *store_ctx = NULL;
-    X509 *cert = NULL;
-    int i;
-    int ret;
-
-    ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
-    for (i = 0; i < sk_X509_num(chain); i++) {
-	cert = sk_X509_value(chain, i);
-	if (pk_peer_compare(context, client, cert) == TRUE) {
-	    ret = 0;
-	    break;
-	}
-    }
-    if (ret) {
-	krb5_set_error_string(context, "PKINIT: verify chain failed "
-			      "to find client in chain");
-	return ret;
-    }
-
-    cert_store = X509_STORE_new();
-    if (cert_store == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_string(context, "PKINIT: can't create X509 store: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-    }
-
-    store_ctx = X509_STORE_CTX_new();
-    if (store_ctx == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_string(context,
-			      "PKINIT: can't create X509 store ctx: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-	goto end;
-    }
-   
-    X509_STORE_CTX_init(store_ctx, cert_store, cert, chain);
-    X509_STORE_CTX_trusted_stack(store_ctx, id->trusted_certs);
-    X509_verify_cert(store_ctx);
-    /* the last checked certificate is in store_ctx->current_cert */
-    krb5_clear_error_string(context);
-    switch(store_ctx->error) {
-    case X509_V_OK:
-	ret = 0;
-	break;
-    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
-	ret = KRB5_KDC_ERR_CANT_VERIFY_CERTIFICATE;
-	krb5_set_error_string(context, "PKINIT: failed to verify "
-			      "certificate: %s ",
-			      X509_verify_cert_error_string(store_ctx->error));
-	break;
-    case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
-    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
-    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
-    case X509_V_ERR_CERT_NOT_YET_VALID:
-    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
-    case X509_V_ERR_CERT_HAS_EXPIRED:
-	ret = KRB5_KDC_ERR_INVALID_CERTIFICATE;
-	krb5_set_error_string(context, "PKINIT: invalid certificate: %s ",
-			      X509_verify_cert_error_string(store_ctx->error));
-	break;
-    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
-    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
-    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
-    case X509_V_ERR_CERT_CHAIN_TOO_LONG:
-    case X509_V_ERR_PATH_LENGTH_EXCEEDED:
-    case X509_V_ERR_INVALID_CA:
-	ret = KRB5_KDC_ERR_INVALID_CERTIFICATE;
-	krb5_set_error_string(context, "PKINIT: unknown CA or can't "
-			      "verify certificate: %s",
-			      X509_verify_cert_error_string(store_ctx->error));
-	break;
-    default:
-	ret = KRB5_KDC_ERR_INVALID_CERTIFICATE; /* XXX */
-	krb5_set_error_string(context, "PKINIT: failed to verify "
-			      "certificate: %s (%ld) ",
-			      X509_verify_cert_error_string(store_ctx->error),
-			      (long)store_ctx->error);
-	break;
-    }
-    if (ret)
-	goto end;
-
-    /* 
-     * Since X509_verify_cert() doesn't do CRL checking at all, we have to
-     * perform own verification against CRLs
-     */
-    /*
-     * XXX add crl checking
-     */
-
-    if (client_cert && cert)
-	*client_cert = X509_dup(cert);
-
- end:
-    if (cert_store)
-	X509_STORE_free(cert_store);
-    if (store_ctx)
-	X509_STORE_CTX_free(store_ctx);
-    return ret;
-}
-
-static int
-cert_to_X509(krb5_context context, CertificateSet *set,
-	     STACK_OF(X509_CRL) **certs)
-{
-    krb5_error_code ret;
-    int i;
-
-    *certs = sk_X509_new_null();
-
-    if (set == NULL)
-	return 0;
-
-    ret = 0;
-    for (i = 0; i < set->len; i++) {
-	unsigned char *p;
-	X509 *cert;
-
-	p = set->val[i].data;
-	cert = d2i_X509(NULL, &p, set->val[i].length);
-	if (cert == NULL) {
-	    ret = ASN1_BAD_FORMAT;
-	    break;
-	}
-	sk_X509_insert(*certs, cert, i);
-    }
-    if (ret) {
-	krb5_set_error_string(context,
-			      "PKINIT: Failed to decode certificate chain");
-	sk_X509_free(*certs);
-	*certs = NULL;
-    }
-    return ret;
+    return pk_mk_padata(context, type, ctx, req_body, nonce, md);
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
@@ -1048,144 +537,67 @@ _krb5_pk_verify_sign(krb5_context context,
 		     krb5_data *content,
 		     struct krb5_pk_cert **signer)
 {
-    STACK_OF(X509) *certificates;
-    SignerInfo *signer_info;
-    const EVP_MD *evp_type;
-    EVP_PKEY *public_key;
-    krb5_error_code ret;
-    EVP_MD_CTX md;
-    X509 *cert = NULL;
-    SignedData sd;
-    size_t size;
-    
-    *signer = NULL;
-    krb5_data_zero(content);
-    contentType->length = 0;
-    contentType->components = NULL;
-
-    memset(&sd, 0, sizeof(sd));
-
-    ret = decode_SignedData(data, length, &sd, &size);
-    if (ret) {
-	krb5_set_error_string(context, 
-			      "PKINIT: decoding failed SignedData: %d",
-			      ret);
-	goto out;
-    }
-
-    if (sd.encapContentInfo.eContent == NULL) {
-	krb5_set_error_string(context, 
-			      "PKINIT: signature missing encapContent");
-	ret = KRB5KRB_AP_ERR_MSG_TYPE;
-	goto out;
-    }
-
-    /* XXX Check CMS version */
-
-    if (sd.signerInfos.len < 1) {
-	krb5_set_error_string(context,
-			      "PKINIT: signature information missing from "
-			      "pkinit response");
-	ret = KRB5_KDC_ERR_INVALID_SIG;
-	goto out;
-    }
-
-    signer_info = &sd.signerInfos.val[0];
-  
-    {
-	CertificateSet set;
-	set.val = sd.certificates->val;
-	set.len = sd.certificates->len;
+    hx509_certs signer_certs;
+    int ret;
 
-	ret = cert_to_X509(context, &set, &certificates);
-    }
-    if (ret) {
-	krb5_set_error_string(context,
-			      "PKINIT: failed to decode Certificates");
-	goto out;
-    }
+    *signer = NULL;
 
-    ret = pk_verify_chain_standard(context, id,
-				   &signer_info->sid,
-				   certificates,
-				   &cert);
-    sk_X509_free(certificates);
+    ret = hx509_cms_verify_signed(id->hx509ctx,
+				  id->verify_ctx,
+				  data,
+				  length,
+				  id->certpool,
+				  contentType,
+				  content,
+				  &signer_certs);
     if (ret)
-	goto out;
-  
-    if (signer_info->signature.length == 0) {
-	free_SignedData(&sd);
-	X509_free(cert);
-	krb5_set_error_string(context, "PKINIT: signature missing from"
-			      "pkinit response");
-	return KRB5_KDC_ERR_INVALID_SIG; 
-    }
-
-    public_key = X509_get_pubkey(cert);
-
-    /* verify signature */
-    if (heim_oid_cmp(&signer_info->digestAlgorithm.algorithm,
-		oid_id_pkcs1_sha1WithRSAEncryption()) == 0)
-	evp_type = EVP_sha1();
-    else if (heim_oid_cmp(&signer_info->digestAlgorithm.algorithm,
-			  oid_id_pkcs1_md5WithRSAEncryption()) == 0) 
-	evp_type = EVP_md5();
-    else if (heim_oid_cmp(&signer_info->digestAlgorithm.algorithm, 
-			  oid_id_secsig_sha_1()) == 0)
-	evp_type = EVP_sha1();
-    else {
-	X509_free(cert);
-	krb5_set_error_string(context, "PKINIT: The requested digest "
-			      "algorithm is not supported");
-	ret = KRB5_KDC_ERR_INVALID_SIG;
-	goto out;
-    }
-
-    EVP_VerifyInit(&md, evp_type);
-    EVP_VerifyUpdate(&md,
-		     sd.encapContentInfo.eContent->data,
-		     sd.encapContentInfo.eContent->length);
-    ret = EVP_VerifyFinal(&md,
-			  signer_info->signature.data,
-			  signer_info->signature.length,
-			  public_key);
-    if (ret != 1) {
-	X509_free(cert);
-	krb5_set_error_string(context, "PKINIT: signature didn't verify: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-	ret = KRB5_KDC_ERR_INVALID_SIG;
-	goto out;
-    }
-
-    ret = copy_oid(&sd.encapContentInfo.eContentType, contentType);
-    if (ret) {
-	krb5_clear_error_string(context);
-	goto out;
-    }
+	return ret;
 
-    content->data = malloc(sd.encapContentInfo.eContent->length);
-    if (content->data == NULL) {
+    *signer = calloc(1, sizeof(**signer));
+    if (*signer == NULL) {
 	krb5_clear_error_string(context);
 	ret = ENOMEM;
 	goto out;
     }
-    content->length = sd.encapContentInfo.eContent->length;
-    memcpy(content->data,sd.encapContentInfo.eContent->data,content->length);
+	
+    /* XXX */
+    {
+	hx509_cursor cursor;
 
-    *signer = malloc(sizeof(**signer));
-    if (*signer == NULL) {
-	krb5_clear_error_string(context);
-	ret = ENOMEM;
-	goto out;
+	ret = hx509_certs_start_seq(id->hx509ctx,
+				    signer_certs,
+				    &cursor);
+	if (ret) {
+	    krb5_clear_error_string(context);
+	    goto out;
+	}
+	ret = hx509_certs_next_cert(id->hx509ctx,
+				    signer_certs,
+				    cursor,
+				    &(*signer)->cert);
+	if (ret) {
+	    krb5_clear_error_string(context);
+	    goto out;
+	}
+	ret = hx509_certs_end_seq(id->hx509ctx,
+				  signer_certs,
+				  cursor);
+	if (ret) {
+	    krb5_clear_error_string(context);
+	    goto out;
+	}
     }
-    (*signer)->cert = cert;
 
- out:
-    free_SignedData(&sd);
+out:
+    hx509_certs_free(&signer_certs);
     if (ret) {
-	free_oid(contentType);
-	krb5_data_free(content);
+	if (*signer) {
+	    hx509_cert_free((*signer)->cert);
+	    free(*signer);
+	    *signer = NULL;
+	}
     }
+
     return ret;
 }
 
@@ -1297,10 +709,60 @@ get_reply_key(krb5_context context,
 
 
 static krb5_error_code
-pk_verify_host(krb5_context context, struct krb5_pk_cert *host)
+pk_verify_host(krb5_context context,
+	       struct krb5_pk_init_ctx_data *ctx,
+	       struct krb5_pk_cert *host)
 {
-    /* XXX */
-    return 0;
+    krb5_error_code ret = 0;
+
+    if (ctx->require_eku) {
+	ret = hx509_cert_check_eku(ctx->id->hx509ctx, host->cert,
+				   oid_id_pkkdcekuoid(), 0);
+	if (ret) {
+	    krb5_clear_error_string(context);
+	    return ret;
+	}
+    }
+    if (ctx->require_krbtgt_otherName) {
+	hx509_octet_string_list list;
+	krb5_error_code ret;
+	int i;
+
+	ret = hx509_cert_find_subjectAltName_otherName(host->cert,
+						       oid_id_pkinit_san(),
+						       &list);
+	if (ret) {
+	    krb5_clear_error_string(context);
+	    return ret;
+	}
+
+	for (i = 0; i < list.len; i++) {
+	    KRB5PrincipalName r;
+	    ret = decode_KRB5PrincipalName(list.val[i].data,
+					   list.val[i].length,
+					   &r,
+					   NULL);
+	    if (ret) {
+		krb5_clear_error_string(context);
+		break;
+	    }
+
+#if 0
+	    if (r.principalName.name.len != 2) {
+		krb5_clear_error_string(context);
+		ret = EINVAL;
+	    }
+#endif
+	    /* XXX verify realm */
+
+	    free_KRB5PrincipalName(&r);
+	    if (ret)
+		break;
+	}
+	hx509_free_octet_string_list(&list);
+    }
+
+    return ret;
 }
 
 static krb5_error_code
@@ -1316,33 +778,12 @@ pk_rd_pa_reply_enckey(krb5_context context,
 	       	      krb5_keyblock **key) 
 {
     krb5_error_code ret;
-    EnvelopedData ed;
-    krb5_keyblock tmp_key;
-    krb5_crypto crypto;
-    krb5_data plain;
-    KeyTransRecipientInfo *ri;
-    int length;
+    struct krb5_pk_cert *host = NULL;
     size_t size;
-    X509 *user_cert;
+    int length;
     void *p;
-    krb5_boolean bret;
     krb5_data content;
     heim_oid contentType = { 0, NULL };
-    struct krb5_pk_cert *host = NULL;
-    heim_octet_string encryptedContent;
-    heim_octet_string *any;
-    krb5_data ivec;
-    krb5_data params;
-
-
-    memset(&tmp_key, 0, sizeof(tmp_key));
-    memset(&ed, 0, sizeof(ed));
-    krb5_data_zero(&plain);
-    krb5_data_zero(&content);
-    krb5_data_zero(&encryptedContent);
-    krb5_data_zero(&ivec);
-
-    user_cert = sk_X509_value(ctx->id->cert, 0);
 
     if (heim_oid_cmp(oid_id_pkcs7_envelopedData(), &rep->contentType)) {
 	krb5_set_error_string(context, "PKINIT: Invalid content type");
@@ -1354,106 +795,17 @@ pk_rd_pa_reply_enckey(krb5_context context,
 	return EINVAL;
     }
 
-    ret = decode_EnvelopedData(rep->content->data,
+    ret = hx509_cms_unenvelope(ctx->id->hx509ctx,
+			       ctx->id->certs,
+			       rep->content->data,
 			       rep->content->length,
-			       &ed,
-			       &size);
-    if (ret) {
-	free_EnvelopedData(&ed);
-	return ret;
-    }
-
-    if (ed.recipientInfos.len != 1) {
-	free_EnvelopedData(&ed);
-	krb5_set_error_string(context, "pkinit: Number of recipient infos "
-			      "not one (%d)",
-			      ed.recipientInfos.len);
-	return EINVAL; /* XXX */
-    }
-
-    ri = &ed.recipientInfos.val[0];
-
-    /* XXX make SignerIdentifier and RecipientIdentifier the same */
-    bret = pk_peer_compare(context, (SignerIdentifier *)&ri->rid, user_cert);
-    if (bret == FALSE) {
-	ret = KRB5KRB_AP_ERR_BADMATCH; /* XXX */
-	goto out;
-    }
-
-    if (heim_oid_cmp(oid_id_pkcs1_rsaEncryption(),
-		     &ri->keyEncryptionAlgorithm.algorithm)) {
-	krb5_set_error_string(context, "PKINIT: invalid content type");
-	return EINVAL;
-    }
-    
-    ret = pk_decrypt_key(context, &ri->encryptedKey,
-			 ctx->id->private_key, &tmp_key);
-    if (ret)
-	goto out;
-
-  
-    /* 
-     * Try to verify content type. We can't do this for W2K case
-     * because W2K/W2K3 sends id-pkcs7-data, but Windows Vista sends
-     * id-pkcs7-signedData to all versions, even W2K clients.
-     */
-
-    if (type != COMPAT_WIN2K) {
-	if (heim_oid_cmp(&ed.encryptedContentInfo.contentType, oid_id_pkcs7_signedData())) {
-	    ret = KRB5KRB_AP_ERR_MSG_TYPE;
-	    goto out;
-	}
-    }
-
-    if (ed.encryptedContentInfo.encryptedContent == NULL) {
-	krb5_set_error_string(context, "PKINIT: OPTIONAL encryptedContent "
-			      "field not filled in in KDC reply");
-	ret = KRB5_BADMSGTYPE;
-	goto out;
-    }
-
-    any = ed.encryptedContentInfo.encryptedContent;
-    ret = der_get_octet_string(any->data, any->length,
-			       &encryptedContent, NULL);
-    if (ret) {
-	krb5_set_error_string(context,
-			      "PKINIT: encryptedContent content invalid");
-	goto out;
-    }
-
-    if (ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters == NULL){
-	krb5_set_error_string(context,
-			      "PKINIT: encryptedContent parameter missing");
-	ret = KRB5_BADMSGTYPE;
-	goto out;
-    }
-
-    params.data = ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters->data;
-    params.length = ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters->length;
-
-    ret = _krb5_oid_to_enctype(context,
-			       &ed.encryptedContentInfo.contentEncryptionAlgorithm.algorithm,
-			       &tmp_key.keytype);
-    if (ret)
-	goto out;
-
-    ret = krb5_crypto_init(context, &tmp_key, 0, &crypto);
-    if (ret)
-	goto out;
-
-    ret = krb5_crypto_get_params(context, crypto, &params, &ivec);
+			       &contentType,
+			       &content);
     if (ret)
-	goto out;
-
-    ret = krb5_decrypt_ivec(context, crypto,
-			    0,
-			    encryptedContent.data,
-			    encryptedContent.length,
-			    &plain,
-			    ivec.data);
+	return ret;
 
-    p = plain.data;
-    length = plain.length;
+    p = content.data;
+    length = content.length;
 
     /* win2k uses ContentInfo */
     if (type == COMPAT_WIN2K) {
@@ -1472,6 +824,13 @@ pk_rd_pa_reply_enckey(krb5_context context,
 	    krb5_set_error_string(context, "PKINIT: Invalid content type");
 	    goto out;
 	}
+	if (ci.content == NULL) {
+	    ret = EINVAL; /* XXX */
+	    krb5_set_error_string(context, "PKINIT: Invalid content type");
+	    goto out;
+	}
+	krb5_data_free(&content);
+	content = *ci.content;
 	p = ci.content->data;
 	length = ci.content->length;
     }
@@ -1487,7 +846,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
 	goto out;
 
     /* make sure that it is the kdc's certificate */
-    ret = pk_verify_host(context, host);
+    ret = pk_verify_host(context, ctx, host);
     if (ret) {
 	krb5_set_error_string(context, "PKINIT: failed verify host: %d", ret);
 	goto out;
@@ -1528,11 +887,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
     if (host)
 	_krb5_pk_cert_free(host);
     free_oid(&contentType);
-    free_octet_string(&encryptedContent);
     krb5_data_free(&content);
-    krb5_free_keyblock_contents(context, &tmp_key);
-    krb5_data_free(&plain);
-    krb5_data_free(&ivec);
 
     return ret;
 }
@@ -1550,7 +905,6 @@ pk_rd_pa_reply_dh(krb5_context context,
                   krb5_keyblock **key)
 {
     unsigned char *p, *dh_gen_key = NULL;
-    ASN1_INTEGER *dh_pub_key = NULL;
     struct krb5_pk_cert *host = NULL;
     BIGNUM *kdc_dh_pubkey = NULL;
     KDCDHKeyInfo kdc_dh_info;
@@ -1584,7 +938,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 	goto out;
 
     /* make sure that it is the kdc's certificate */
-    ret = pk_verify_host(context, host);
+    ret = pk_verify_host(context, ctx, host);
     if (ret)
 	goto out;
 
@@ -1623,7 +977,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 	}
     } else {
 	if (k_n) {
-	    krb5_set_error_string(context, "pkinit; got server nonce "
+	    krb5_set_error_string(context, "pkinit: got server nonce "
 				  "without key expiration");
 	    ret = KRB5KRB_ERR_GENERIC;
 	    goto out;
@@ -1634,22 +988,24 @@ pk_rd_pa_reply_dh(krb5_context context,
 
     p = kdc_dh_info.subjectPublicKey.data;
     size = (kdc_dh_info.subjectPublicKey.length + 7) / 8;
-    dh_pub_key = d2i_ASN1_INTEGER(NULL, &p, size);
-    if (dh_pub_key == NULL) {
-	krb5_set_error_string(context,
-			      "PKINIT: Can't parse KDC's DH public key");
-	ret = KRB5KRB_ERR_GENERIC;
-	goto out;
-    }
 
-    kdc_dh_pubkey = ASN1_INTEGER_to_BN(dh_pub_key, NULL);
-    if (kdc_dh_pubkey == NULL) {
-	krb5_set_error_string(context,
-			      "PKINIT: Can't convert KDC's DH public key");
-	ret = KRB5KRB_ERR_GENERIC;
-	goto out;
-    }
+    {
+	DHPublicKey k;
+	ret = decode_DHPublicKey(p, size, &k, NULL);
+	if (ret) {
+	    krb5_set_error_string(context, "pkinit: can't decode "
+				  "without key expiration");
+	    goto out;
+	}
 
+	kdc_dh_pubkey = integer_to_BN(context, "DHPublicKey", &k);
+	free_DHPublicKey(&k);
+	if (kdc_dh_pubkey == NULL) {
+	    ret = KRB5KRB_ERR_GENERIC;
+	    goto out;
+	}
+    }
+    
     dh_gen_keylen = DH_size(ctx->dh);
     size = BN_num_bytes(ctx->dh->p);
     if (size < dh_gen_keylen)
@@ -1667,8 +1023,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 				   kdc_dh_pubkey, ctx->dh);
     if (dh_gen_keylen == -1) {
 	krb5_set_error_string(context, 
-			      "PKINIT: Can't compute Diffie-Hellman key (%s)",
-			      ERR_error_string(ERR_get_error(), NULL));
+			      "PKINIT: Can't compute Diffie-Hellman key");
 	ret = KRB5KRB_ERR_GENERIC;
 	goto out;
     }
@@ -1700,8 +1055,6 @@ pk_rd_pa_reply_dh(krb5_context context,
 	memset(dh_gen_key, 0, DH_size(ctx->dh));
 	free(dh_gen_key);
     }
-    if (dh_pub_key)
-	ASN1_INTEGER_free(dh_pub_key);
     if (host)
 	_krb5_pk_cert_free(host);
     if (content.data)
@@ -1726,7 +1079,7 @@ _krb5_pk_rd_pa_reply(krb5_context context,
     ContentInfo ci;
     size_t size;
 
-    /* Check for PK-INIT -27 */
+    /* Check for IETF PK-INIT first */
     if (pa->padata_type == KRB5_PADATA_PK_AS_REP) {
 	PA_PK_AS_REP rep;
 
@@ -1747,7 +1100,7 @@ _krb5_pk_rd_pa_reply(krb5_context context,
 				     &size);
 	    if (ret) {
 		krb5_set_error_string(context,
-				      "PKINIT: -25 decoding failed DH "
+				      "PKINIT: decoding failed DH "
 				      "ContentInfo: %d", ret);
 
 		free_PA_PK_AS_REP(&rep);
@@ -1821,7 +1174,7 @@ _krb5_pk_rd_pa_reply(krb5_context context,
 		return ret;
 	    }
 	    ret = pk_rd_pa_reply_enckey(context, COMPAT_WIN2K, &ci, ctx,
-					etype, hi, nonce, NULL, pa, key);
+					etype, hi, nonce, req_buffer, pa, key);
 	    free_ContentInfo(&ci);
 	    break;
 	default:
@@ -1837,598 +1190,158 @@ _krb5_pk_rd_pa_reply(krb5_context context,
     return ret;
 }
 
-static int
-ssl_pass_cb(char *buf, int size, int rwflag, void *u)
+struct prompter {
+    krb5_context context;
+    krb5_prompter_fct prompter;
+    void *prompter_data;
+};
+
+static int 
+hx_pass_prompter(void *data, const hx509_prompt *prompter)
 {
     krb5_error_code ret;
     krb5_prompt prompt;
     krb5_data password_data;
-    krb5_prompter_fct prompter = u;
+    struct prompter *p = data;
    
-    password_data.data   = buf;
-    password_data.length = size;
+    password_data.data   = prompter->reply->data;
+    password_data.length = prompter->reply->length;
     prompt.prompt = "Enter your private key passphrase: ";
     prompt.hidden = 1;
     prompt.reply  = &password_data;
-    prompt.type   = KRB5_PROMPT_TYPE_PASSWORD;
+    if (prompter->hidden)
+	prompt.type   = KRB5_PROMPT_TYPE_PASSWORD;
+    else
+	prompt.type   = KRB5_PROMPT_TYPE_PREAUTH; /* XXX */
    
-    ret = (*prompter)(NULL, NULL, NULL, NULL, 1, &prompt);
+    ret = (*p->prompter)(p->context, p->prompter_data, NULL, NULL, 1, &prompt);
     if (ret) {
-	memset (buf, 0, size);
+	memset (prompter->reply->data, 0, prompter->reply->length);
 	return 0;
     }
-    return strlen(buf);
-}
-
-static krb5_error_code
-load_openssl_cert(krb5_context context,
-		  const char *file,
-		  STACK_OF(X509) **c)
-{
-    STACK_OF(X509) *certificate;
-    krb5_error_code ret;
-    FILE *f;
-
-    f = fopen(file, "r");
-    if (f == NULL) {
-	ret = errno;
-	krb5_set_error_string(context, "PKINIT: open failed %s: %s", 
-			      file, strerror(ret));
-	return ret;
-    }
-
-    certificate = sk_X509_new_null();
-    while (1) {
-	/* see http://www.openssl.org/docs/crypto/pem.html section BUGS */
-	X509 *cert;
-	cert = PEM_read_X509(f, NULL, NULL, NULL);
-	if (cert == NULL) {
-	    if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE) {
-		/* End of file reached. no error */
-		ERR_clear_error();
-		break;
-	    }
-	    krb5_set_error_string(context, "PKINIT: Can't read certificate");
-	    fclose(f);
-	    return HEIM_PKINIT_CERTIFICATE_INVALID;
-	}
-	sk_X509_insert(certificate, cert, sk_X509_num(certificate));
-    }
-    fclose(f);
-    if (sk_X509_num(certificate) == 0) {
-	krb5_set_error_string(context, "PKINIT: No certificate found");
-	return HEIM_PKINIT_NO_CERTIFICATE;
-    }
-    *c = certificate;
-    return 0;
-}
-
-static krb5_error_code
-load_openssl_file(krb5_context context,
-		  char *password,
-		  krb5_prompter_fct prompter,
-		  void *prompter_data,
-		  const char *user_id,
-		  struct krb5_pk_identity *id)
-{
-    krb5_error_code ret;
-    STACK_OF(X509) *certificate = NULL;
-    char *cert_file = NULL, *key_file;
-    EVP_PKEY *private_key = NULL;
-    FILE *f;
-
-    cert_file = strdup(user_id);
-    if (cert_file == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-    key_file = strchr(cert_file, ',');
-    if (key_file == NULL) {
-	krb5_set_error_string(context, "PKINIT: key file missing");
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	goto out;
-    }
-    *key_file++ = '\0';
-
-    ret = load_openssl_cert(context, cert_file, &certificate);
-    if (ret)
-	goto out;
-
-    /* load private key */
-    f = fopen(key_file, "r");
-    if (f == NULL) {
-	ret = errno;
-	krb5_set_error_string(context, "PKINIT: open %s: %s",
-			      key_file, strerror(ret));
-	goto out;
-    }
-    if (password == NULL || password[0] == '\0') {
-	if (prompter == NULL)
-	    prompter = krb5_prompter_posix;
-	private_key = PEM_read_PrivateKey(f, NULL, ssl_pass_cb, prompter);
-    } else
-	private_key = PEM_read_PrivateKey(f, NULL, NULL, password);
-    fclose(f);
-    if (private_key == NULL) {
-	krb5_set_error_string(context, "PKINIT: Can't read private key");
-	ret = HEIM_PKINIT_PRIVATE_KEY_INVALID;
-	goto out;
-    }
-    ret = X509_check_private_key(sk_X509_value(certificate, 0), private_key);
-    if (ret != 1) {
-	ret = HEIM_PKINIT_PRIVATE_KEY_INVALID;
-	krb5_set_error_string(context,
-			      "PKINIT: The private key doesn't match "
-			      "the public key certificate");
-	goto out;
-    }
-
-    id->private_key = private_key;
-    id->cert = certificate;
-
-    return 0;
- out:
-    if (cert_file)
-	free(cert_file);
-    if (certificate)
-	sk_X509_pop_free(certificate, X509_free);
-    if (private_key)
-	EVP_PKEY_free(private_key);
-
-    return ret;
-}
-
-static int
-add_pair(krb5_context context, char *str, char ***cmds, int *num)
-{
-    char **c;
-    char *p;
-    int i;
-
-    p = strchr(str, ':');
-    if (p) {
-	*p = '\0';
-	p++;
-    }
-
-    /* filter out dup keys */
-    for (i = 0; i < *num; i++)
-	if (strcmp((*cmds)[i * 2], str) == 0)
-	    return 0;
-
-    c = realloc(*cmds, sizeof(*c) * ((*num + 1) * 2));
-    if (c == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-
-    c[(*num * 2)] = str;
-    c[(*num * 2) + 1] = p;
-    *num += 1;
-    *cmds = c;
-    return 0;
-}
-
-static krb5_error_code
-eval_pairs(krb5_context context, ENGINE *e, const char *name,
-	   const char *type, char **cmds, int num)
-{
-    int i;
-
-    for (i = 0; i < num; i++) {
-	char *a1 = cmds[i * 2], *a2 = cmds[(i * 2) + 1];
-	if(!ENGINE_ctrl_cmd_string(e, a1, a2, 0)) {
-	    krb5_set_error_string(context,
-				  "PKINIT: Failed %scommand (%s - %s:%s): %s", 
-				  type, name, a1, a2 ? a2 : "(NULL)",
-				  ERR_error_string(ERR_get_error(), NULL));
-	    return HEIM_PKINIT_NO_PRIVATE_KEY;
-	}
-    }
-    return 0;
-}
-
-struct engine_context {
-    char **pre_cmds;
-    char **post_cmds;
-    int num_pre;
-    int num_post;
-    char *engine_name;
-    char *cert_file;
-    char *key_id;
-};
-
-static krb5_error_code
-parse_openssl_engine_conf(krb5_context context, 
-			  struct engine_context *ctx,
-			  char *line)
-{
-    krb5_error_code ret;
-    char *last, *p, *q;
-
-    for (p = strtok_r(line, ",", &last);
-	 p != NULL;
-	 p = strtok_r(NULL, ",", &last)) {
-
-	q = strchr(p, '=');
-	if (q == NULL) {
-	    krb5_set_error_string(context, 
-				  "PKINIT: openssl engine configuration "
-				  "key %s missing = and thus value", p);
-	    return HEIM_PKINIT_NO_PRIVATE_KEY;
-	}
-	*q = '\0';
-	q++;
-	if (strcasecmp("PRE", p) == 0) {
-	    ret = add_pair(context, q, &ctx->pre_cmds, &ctx->num_pre);
-	    if (ret)
-		return ret;
-	} else if (strcasecmp("POST", p) == 0) {
-	    ret = add_pair(context, q, &ctx->post_cmds, &ctx->num_post);
-	    if (ret)
-		return ret;
-	} else if (strcasecmp("KEY", p) == 0) {
-	    ctx->key_id = q;
-	} else if (strcasecmp("CERT", p) == 0) {
-	    ctx->cert_file = q;
-	} else if (strcasecmp("ENGINE", p) == 0) {
-	    ctx->engine_name = q;
-	} else {
-	    krb5_set_error_string(context, 
-				  "PKINIT: openssl engine configuration "
-				  "key %s is unknown", p);
-	    return HEIM_PKINIT_NO_PRIVATE_KEY;
-	}
-    }
-    return 0;
-}
-
-
-static krb5_error_code
-load_openssl_engine(krb5_context context,
-		    char *password,
-		    krb5_prompter_fct prompter,
-		    void *prompter_data,
-		    const char *string,
-		    struct krb5_pk_identity *id)
-{
-    struct engine_context ctx;
-    krb5_error_code ret;
-    const char *f;
-    char *file_conf = NULL, *user_conf = NULL;
-    ENGINE *e = NULL;
-
-    memset(&ctx, 0, sizeof(ctx));
-
-    ENGINE_load_builtin_engines();
-
-    user_conf = strdup(string);
-    if (user_conf == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-
-    ret = parse_openssl_engine_conf(context, &ctx, user_conf);
-    if (ret)
-	goto out;
-
-    f = krb5_config_get_string_default(context, NULL, NULL,
-				       "libdefaults", 
-				       "pkinit-openssl-engine", 
-				       NULL);
-    if (f) {
-	file_conf = strdup(f);
-	if (file_conf) {
-	    ret = parse_openssl_engine_conf(context, &ctx, file_conf);
-	    if (ret)
-		goto out;
-	}
-    }
-
-    if (ctx.cert_file == NULL) {
-	krb5_set_error_string(context, 
-			      "PKINIT: openssl engine missing certificate");
-	ret = HEIM_PKINIT_NO_CERTIFICATE;
-	goto out;
-    }
-    if (ctx.key_id == NULL) {
-	krb5_set_error_string(context,
-			      "PKINIT: openssl engine missing key id");
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	goto out;
-    }
-    if (ctx.engine_name == NULL) {
-	krb5_set_error_string(context,
-			      "PKINIT: openssl engine missing engine name");
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	goto out;
-    }
-
-    e = ENGINE_by_id(ctx.engine_name);
-    if (e == NULL) {
-	krb5_set_error_string(context, 
-			      "PKINIT: failed getting openssl engine %s: %s", 
-			      ctx.engine_name,
-			      ERR_error_string(ERR_get_error(), NULL));
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	goto out;
-    }
-
-    ret = eval_pairs(context, e, ctx.engine_name, "pre", 
-		     ctx.pre_cmds, ctx.num_pre);
-    if (ret)
-	goto out;
-
-    if(!ENGINE_init(e)) {
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	krb5_set_error_string(context,
-			      "PKINIT: openssl engine init %s failed: %s", 
-			      ctx.engine_name,
-			      ERR_error_string(ERR_get_error(), NULL));
-	ENGINE_free(e);
-	goto out;
-    }
-
-    ret = eval_pairs(context, e, ctx.engine_name, "post", 
-		     ctx.post_cmds, ctx.num_post);
-    if (ret)
-	goto out;
-
-    /*
-     * If the engine supports a LOAD_CERT_CTRL function, lets try
-     * it. OpenSC support this function. Eventially this should be
-     * a ENGINE_load_cert function if it failes, treat it like a
-     * non fatal error.
-     */
-    {
-	struct {
-	    const char * cert_id;
-	    X509 * cert;
-	} parms;
-
-	parms.cert_id = ctx.cert_file;
-	parms.cert = NULL;
-	ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); 
-	if (parms.cert) {
-	    id->cert = sk_X509_new_null();
-	    sk_X509_insert(id->cert, parms.cert, 0);	
-	}  
-    }
-
-    if (id->cert == NULL) {
-	ret = load_openssl_cert(context, ctx.cert_file, &id->cert);
-	if (ret)
-	    goto out;
-    }
-
-    {
-	UI_METHOD * krb5_ui_method = NULL;
-	struct krb5_ui_data ui_data;
-
-	krb5_ui_method = UI_create_method("Krb5 ui method");
-	if (krb5_ui_method == NULL) {
-	    krb5_set_error_string(context,
-				  "PKINIT: failed to setup prompter "
-				  "function: %s",
-				  ERR_error_string(ERR_get_error(), NULL));
-	    ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	    goto out;
-	}
-	UI_method_set_reader(krb5_ui_method, krb5_ui_method_read_string);
-
-	ui_data.context = context;
-	ui_data.prompter = prompter;
-	if (prompter == NULL)
-	    ui_data.prompter = krb5_prompter_posix;
-	ui_data.prompter_data = prompter_data;
-
-    	id->private_key = ENGINE_load_private_key(e,
-						  ctx.key_id, 
-						  krb5_ui_method,
-						  (void*) &ui_data);
-	UI_destroy_method(krb5_ui_method);
-    }
-	
-    if (id->private_key == NULL) {
-	krb5_set_error_string(context,
-			      "PKINIT: failed to load private key: %s",
-			      ERR_error_string(ERR_get_error(), NULL));
-	ret = HEIM_PKINIT_NO_PRIVATE_KEY;
-	goto out;
-    }
-
-    ret = X509_check_private_key(sk_X509_value(id->cert, 0), id->private_key);
-    if (ret != 1) {
-	ret = HEIM_PKINIT_PRIVATE_KEY_INVALID;
-	krb5_set_error_string(context,
-			      "PKINIT: The private key doesn't match "
-			      "the public key certificate");
-	goto out;
-    }
-
-    if (user_conf)
-	free(user_conf);
-    if (file_conf)
-	free(file_conf);
-
-    id->engine = e;
-
-    return 0;
-
- out:
-    if (user_conf)
-	free(user_conf);
-    if (file_conf)
-	free(file_conf);
-    if (e) {
-	ENGINE_finish(e); /* make sure all shared libs are unloaded */
-	ENGINE_free(e);
-    }
-	
-    return ret;
+    return strlen(prompter->reply->data);
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
-_krb5_pk_load_openssl_id(krb5_context context,
-			 struct krb5_pk_identity **ret_id,
-			 const char *user_id,
-			 const char *x509_anchors,
-			 krb5_prompter_fct prompter,
-			 void *prompter_data,
-			 char *password)
+_krb5_pk_load_id(krb5_context context,
+		 struct krb5_pk_identity **ret_id,
+		 const char *user_id,
+		 const char *anchor_id,
+		 char * const *chain,
+		 char * const *revoke,
+		 krb5_prompter_fct prompter,
+		 void *prompter_data,
+		 char *password)
 {
-    STACK_OF(X509) *trusted_certs = NULL;
     struct krb5_pk_identity *id = NULL;
-    krb5_error_code ret;
-    struct dirent *file;
-    char *dirname = NULL;
-    DIR *dir;
-    FILE *f;
-    krb5_error_code (*load_pair)(krb5_context, 
-				 char *, 
-				 krb5_prompter_fct,
-				 void *,
-				 const char *,
-				 struct krb5_pk_identity *) = NULL;
-
+    hx509_lock lock = NULL;
+    struct prompter p;
+    int ret;
 
     *ret_id = NULL;
 
-    if (x509_anchors == NULL) {
-	krb5_set_error_string(context, "PKINIT: No root ca directory given");
+    if (anchor_id == NULL) {
+	krb5_set_error_string(context, "PKINIT: No anchor given");
 	return HEIM_PKINIT_NO_VALID_CA;
     }
 
     if (user_id == NULL) {
 	krb5_set_error_string(context,
-			      "PKINIT: No user X509 source given given");
+			      "PKINIT: No user certificate given");
 	return HEIM_PKINIT_NO_PRIVATE_KEY;
     }
 
-    /* 
-     *
-     */
-
-    if (strncasecmp(user_id, "FILE:", 5) == 0) {
-	load_pair = load_openssl_file;
-	user_id += 5;
-    } else if (strncasecmp(user_id, "ENGINE:", 7) == 0) {
-	load_pair = load_openssl_engine;
-	user_id += 7;
-    } else {
-	krb5_set_error_string(context, "PKINIT: user identity not FILE");
-	return HEIM_PKINIT_NO_CERTIFICATE;
-    }
-    if (strncasecmp(x509_anchors, "OPENSSL-ANCHOR-DIR:", 19) != 0) {
-	krb5_set_error_string(context, "PKINIT: anchor OPENSSL-ANCHOR-DIR");
-	return HEIM_PKINIT_NO_VALID_CA;
-    }
-    x509_anchors += 19;
+    /* load cert */
 
-    id = malloc(sizeof(*id));
+    id = calloc(1, sizeof(*id));
     if (id == NULL) {
 	krb5_set_error_string(context, "malloc: out of memory");
 	ret = ENOMEM;
 	goto out;
     }	
-    memset(id, 0, sizeof(*id));
-
-    OpenSSL_add_all_algorithms();
-    ERR_load_crypto_strings();
 
-    
-    ret = (*load_pair)(context, password, prompter, prompter_data, user_id, id);
+    ret = hx509_context_init(&id->hx509ctx);
     if (ret)
 	goto out;
 
-    /* load anchors */
+    ret = hx509_lock_init(id->hx509ctx, &lock);
+    if (password)
+	hx509_lock_add_password(lock, password);
 
-    dirname = strdup(x509_anchors);
-    if (dirname == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	ret = ENOMEM;
-	goto out;
-    }
+    if (prompter) {
+	p.context = context;
+	p.prompter = prompter;
+	p.prompter_data = prompter_data;
 
-    {
-	size_t len;
-	len = strlen(dirname);
-	if (dirname[len - 1] == '/')
-	    dirname[len - 1] = '\0';
+	ret = hx509_lock_set_prompter(lock, hx_pass_prompter, &p);
+	if (ret)
+	    goto out;
     }
 
-    /* read ca certificates */
-    dir = opendir(dirname);
-    if (dir == NULL) {
-	ret = errno;
-	krb5_set_error_string(context, "PKINIT: open directory %s: %s",
-			      dirname, strerror(ret));
+    ret = hx509_certs_init(id->hx509ctx, user_id, 0, NULL, &id->certs);
+    if (ret)
 	goto out;
-    }
 
-    trusted_certs = sk_X509_new_null();
-    while ((file = readdir(dir)) != NULL) {
-	X509 *cert;
-	char *filename;
+    ret = hx509_certs_init(id->hx509ctx, anchor_id, 0, NULL, &id->anchors);
+    if (ret)
+	goto out;
 
-	/*
-	 * Assume the certificate filenames constist of hashed subject
-	 * name followed by suffix ".0"
-	 */
+    ret = hx509_certs_init(id->hx509ctx, "MEMORY:pkinit-cert-chain", 
+			   0, NULL, &id->certpool);
+    if (ret)
+	goto out;
 
-	if (strlen(file->d_name) == 10 && strcmp(&file->d_name[8],".0") == 0) {
-	    asprintf(&filename, "%s/%s", dirname, file->d_name);
-	    if (filename == NULL) {
-		ret = ENOMEM;
-		krb5_set_error_string(context, "malloc: out or memory");
-		goto out;
-	    }
-	    f = fopen(filename, "r");
-	    if (f == NULL) {
-		ret = errno;
-		krb5_set_error_string(context, "PKINIT: open %s: %s",
-				      filename, strerror(ret));
-		free(filename);
-		closedir(dir);
-		goto out;
-	    }
-	    cert = PEM_read_X509(f, NULL, NULL, NULL);
-	    fclose(f);
-	    if (cert != NULL) {
-		/* order of the certs is not important */
-		sk_X509_push(trusted_certs, cert);
-	    }
-	    free(filename);
+    while (chain && *chain) {
+	ret = hx509_certs_append(id->hx509ctx, id->certpool, NULL, *chain);
+	if (ret) {
+	    krb5_set_error_string(context,
+				  "pkinit failed to load chain %s",
+				  *chain);
+	    goto out;
 	}
+	chain++;
     }
-    closedir(dir);
 
-    if (sk_X509_num(trusted_certs) == 0) {
-	krb5_set_error_string(context,
-			      "PKINIT: No CA certificate(s) found in %s",
-			      dirname);
-	ret = HEIM_PKINIT_NO_VALID_CA;
-	goto out;
-    }
+    if (revoke) {
+	ret = hx509_revoke_init(id->hx509ctx, &id->revoke);
+	if (ret) {
+	    krb5_set_error_string(context, "revoke failed to init");
+	    goto out;
+	}
 
-    id->trusted_certs = trusted_certs;
+	while (*revoke) {
+	    ret = hx509_revoke_add_crl(id->hx509ctx, id->revoke, *revoke);
+	    if (ret) {
+		krb5_set_error_string(context,
+				      "pkinit failed to load revoke %s",
+				      *revoke);
+		goto out;
+	    }
+	    revoke++;
+	}
+    } else
+	hx509_context_set_missing_revoke(id->hx509ctx, 1);
 
-    *ret_id = id;
+    ret = hx509_verify_init_ctx(id->hx509ctx, &id->verify_ctx);
+    if (ret)
+	goto out;
 
-    return 0;
+    hx509_verify_attach_anchors(id->verify_ctx, id->anchors);
+    hx509_verify_attach_revoke(id->verify_ctx, id->revoke);
 
- out:
-    if (dirname)
-	free(dirname);
-    if (trusted_certs)
-	sk_X509_pop_free(trusted_certs, X509_free);
-    if (id) {
-	if (id->cert)
-	    sk_X509_pop_free(id->cert, X509_free);
-	if (id->private_key)
-	    EVP_PKEY_free(id->private_key);
+out:
+    if (ret) {
+	hx509_verify_destroy_ctx(id->verify_ctx);
+	hx509_certs_free(&id->certs);
+	hx509_certs_free(&id->anchors);
+	hx509_certs_free(&id->certpool);
+	hx509_revoke_free(&id->revoke);
+	hx509_context_free(&id->hx509ctx);
 	free(id);
-    }
+    } else
+	*ret_id = id;
+
+    hx509_lock_free(lock);
 
     return ret;
 }
@@ -2704,17 +1617,12 @@ _krb5_get_init_creds_opt_free_pkinit(krb5_get_init_creds_opt *opt)
 	DH_free(ctx->dh);
 	ctx->dh = NULL;
     if (ctx->id) {
-	if (ctx->id->cert)
-	    sk_X509_pop_free(ctx->id->cert, X509_free);
-	if (ctx->id->trusted_certs)
-	    sk_X509_pop_free(ctx->id->trusted_certs, X509_free);
-	if (ctx->id->private_key)
-	    EVP_PKEY_free(ctx->id->private_key);
-	if (ctx->id->engine) {
-		ENGINE_finish(ctx->id->engine); /* unload shared libs etc */
-	    ENGINE_free(ctx->id->engine);
-		ctx->id->engine = NULL;
-	}
+	hx509_verify_destroy_ctx(ctx->id->verify_ctx);
+	hx509_certs_free(&ctx->id->certs);
+	hx509_certs_free(&ctx->id->anchors);
+	hx509_certs_free(&ctx->id->certpool);
+	hx509_context_free(&ctx->id->hx509ctx);
+
 	if (ctx->clientDHNonce) {
 	    krb5_free_data(NULL, ctx->clientDHNonce);
 	    ctx->clientDHNonce = NULL;
@@ -2734,6 +1642,8 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
 				   krb5_principal principal,
 				   const char *user_id,
 				   const char *x509_anchors,
+				   char * const * chain,
+				   char * const * revoke,
 				   int flags,
 				   krb5_prompter_fct prompter,
 				   void *prompter_data,
@@ -2757,14 +1667,18 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
     opt->opt_private->pk_init_ctx->id = NULL;
     opt->opt_private->pk_init_ctx->clientDHNonce = NULL;
     opt->opt_private->pk_init_ctx->require_binding = 0;
-
-    ret = _krb5_pk_load_openssl_id(context,
-				   &opt->opt_private->pk_init_ctx->id,
-				   user_id,
-				   x509_anchors,
-				   prompter,
-				   prompter_data,
-				   password);
+    opt->opt_private->pk_init_ctx->require_eku = 1;
+    opt->opt_private->pk_init_ctx->require_krbtgt_otherName = 1;
+
+    ret = _krb5_pk_load_id(context,
+			   &opt->opt_private->pk_init_ctx->id,
+			   user_id,
+			   x509_anchors,
+			   chain,
+			   revoke,
+			   prompter,
+			   prompter_data,
+			   password);
     if (ret) {
 	free(opt->opt_private->pk_init_ctx);
 	opt->opt_private->pk_init_ctx = NULL;
diff --git a/source4/heimdal/lib/krb5/principal.c b/source4/heimdal/lib/krb5/principal.c
index 6cc49945cc..34086b1fbe 100644
--- a/source4/heimdal/lib/krb5/principal.c
+++ b/source4/heimdal/lib/krb5/principal.c
@@ -41,7 +41,7 @@
 #include <fnmatch.h>
 #include "resolve.h"
 
-RCSID("$Id: principal.c,v 1.92 2005/12/11 17:48:13 lha Exp $");
+RCSID("$Id: principal.c,v 1.94 2006/04/10 10:10:01 lha Exp $");
 
 #define princ_num_comp(P) ((P)->name.name_string.len)
 #define princ_type(P) ((P)->name.name_type)
@@ -105,7 +105,7 @@ parse_name(krb5_context context,
 {
     krb5_error_code ret;
     heim_general_string *comp;
-    heim_general_string realm;
+    heim_general_string realm = NULL;
     int ncomp;
 
     const char *p;
@@ -246,6 +246,7 @@ exit:
 	free(comp[--n]);
     }
     free(comp);
+    free(realm);
     free(s);
     return ret;
 }
@@ -825,16 +826,21 @@ krb5_425_conv_principal_ext2(krb5_context context,
 	struct dns_reply *r;
 
 	r = dns_lookup(instance, "aaaa");
-	if (r && r->head && r->head->type == T_AAAA) {
-	    inst = strdup(r->head->domain);
+	if (r) {
+	    if (r->head && r->head->type == T_AAAA) {
+		inst = strdup(r->head->domain);
+		dns_free_data(r);
+		passed = TRUE;
+	    }
 	    dns_free_data(r);
-	    passed = TRUE;
 	} else {
 	    r = dns_lookup(instance, "a");
-	    if(r && r->head && r->head->type == T_A) {
-		inst = strdup(r->head->domain);
+	    if (r) {
+		if(r->head && r->head->type == T_A) {
+		    inst = strdup(r->head->domain);
+		    passed = TRUE;
+		}
 		dns_free_data(r);
-		passed = TRUE;
 	    }
 	}
 #else
diff --git a/source4/heimdal/lib/krb5/rd_cred.c b/source4/heimdal/lib/krb5/rd_cred.c
index d62adadf26..520b3a1418 100644
--- a/source4/heimdal/lib/krb5/rd_cred.c
+++ b/source4/heimdal/lib/krb5/rd_cred.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_cred.c,v 1.26 2005/11/02 08:36:42 lha Exp $");
+RCSID("$Id: rd_cred.c,v 1.28 2006/04/02 02:27:33 lha Exp $");
 
 static krb5_error_code
 compare_addrs(krb5_context context,
@@ -257,8 +257,10 @@ krb5_rd_cred(krb5_context context,
 
 	ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length, 
 			   &cred.tickets.val[i], &len, ret);
-	if (ret)
+	if (ret) {
+	    free(creds);
 	    goto out;
+	}
 	if(creds->ticket.length != len)
 	    krb5_abortx(context, "internal error in ASN.1 encoder");
 	copy_EncryptionKey (&kci->key, &creds->session);
@@ -302,6 +304,7 @@ krb5_rd_cred(krb5_context context,
 	for(i = 0; (*ret_creds)[i]; i++)
 	    krb5_free_creds(context, (*ret_creds)[i]);
 	free(*ret_creds);
+	*ret_creds = NULL;
     }
     return ret;
 }
diff --git a/source4/heimdal/lib/krb5/rd_priv.c b/source4/heimdal/lib/krb5/rd_priv.c
index bf82ad556e..c52ac175fd 100644
--- a/source4/heimdal/lib/krb5/rd_priv.c
+++ b/source4/heimdal/lib/krb5/rd_priv.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_priv.c,v 1.32 2006/03/18 22:15:57 lha Exp $");
+RCSID("$Id: rd_priv.c,v 1.33 2006/04/12 16:18:10 lha Exp $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_priv(krb5_context context,
@@ -50,8 +50,8 @@ krb5_rd_priv(krb5_context context,
     krb5_keyblock *key;
     krb5_crypto crypto;
 
-    if (outdata)
-	krb5_data_zero(outdata);
+    if (outbuf)
+	krb5_data_zero(outbuf);
 
     if ((auth_context->flags & 
 	 (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE)) &&
@@ -161,7 +161,7 @@ krb5_rd_priv(krb5_context context,
 	 (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE))) {
 	/* if these fields are not present in the priv-part, silently
            return zero */
-	krb5_data_zero(outdata);
+	memset(outdata, 0, sizeof(*outdata));
 	if(part.timestamp)
 	    outdata->timestamp = *part.timestamp;
 	if(part.usec)
diff --git a/source4/heimdal/lib/krb5/rd_req.c b/source4/heimdal/lib/krb5/rd_req.c
index 313c14f6e6..0d4635b964 100644
--- a/source4/heimdal/lib/krb5/rd_req.c
+++ b/source4/heimdal/lib/krb5/rd_req.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_req.c,v 1.61 2005/11/29 18:22:51 lha Exp $");
+RCSID("$Id: rd_req.c,v 1.63 2006/04/10 10:14:44 lha Exp $");
 
 static krb5_error_code
 decrypt_tkt_enc_part (krb5_context context,
@@ -279,8 +279,10 @@ krb5_verify_authenticator_checksum(krb5_context context,
 				      &authenticator);
     if(ret)
 	return ret;
-    if(authenticator->cksum == NULL)
+    if(authenticator->cksum == NULL) {
+	krb5_free_authenticator(context, &authenticator);
 	return -17;
+    }
     ret = krb5_auth_con_getkey(context, ac, &key);
     if(ret) {
 	krb5_free_authenticator(context, &authenticator);
@@ -340,6 +342,9 @@ krb5_verify_ap_req2(krb5_context context,
     krb5_error_code ret;
     EtypeList etypes;
     
+    if (ticket)
+	*ticket = NULL;
+
     if (auth_context && *auth_context) {
 	ac = *auth_context;
     } else {
@@ -348,13 +353,12 @@ krb5_verify_ap_req2(krb5_context context,
 	    return ret;
     }
 
-    t = malloc(sizeof(*t));
+    t = calloc(1, sizeof(*t));
     if (t == NULL) {
 	ret = ENOMEM;
 	krb5_clear_error_string (context);
 	goto out;
     }
-    memset(t, 0, sizeof(*t));
 
     if (ap_req->ap_options.use_session_key && ac->keyblock){
 	ret = krb5_decrypt_ticket(context, &ap_req->ticket, 
@@ -372,14 +376,17 @@ krb5_verify_ap_req2(krb5_context context,
     if(ret)
 	goto out;
 
-    _krb5_principalname2krb5_principal(&t->server, ap_req->ticket.sname, 
-				       ap_req->ticket.realm);
-    _krb5_principalname2krb5_principal(&t->client, t->ticket.cname, 
-				       t->ticket.crealm);
+    ret = _krb5_principalname2krb5_principal(&t->server, ap_req->ticket.sname, 
+					     ap_req->ticket.realm);
+    if (ret) goto out;
+    ret = _krb5_principalname2krb5_principal(&t->client, t->ticket.cname, 
+					     t->ticket.crealm);
+    if (ret) goto out;
 
     /* save key */
 
-    krb5_copy_keyblock(context, &t->ticket.key, &ac->keyblock);
+    ret = krb5_copy_keyblock(context, &t->ticket.key, &ac->keyblock);
+    if (ret) goto out;
 
     ret = decrypt_authenticator (context,
 				 &t->ticket.key,
diff --git a/source4/heimdal/lib/krb5/replay.c b/source4/heimdal/lib/krb5/replay.c
index ec99f86c7c..b89f150159 100644
--- a/source4/heimdal/lib/krb5/replay.c
+++ b/source4/heimdal/lib/krb5/replay.c
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <vis.h>
 
-RCSID("$Id: replay.c,v 1.10 2004/05/25 21:41:15 lha Exp $");
+RCSID("$Id: replay.c,v 1.12 2006/04/10 17:13:49 lha Exp $");
 
 struct krb5_rcache_data {
     char *name;
@@ -58,6 +58,7 @@ krb5_rc_resolve_type(krb5_context context,
 		     krb5_rcache *id,
 		     const char *type)
 {
+    *id = NULL;
     if(strcmp(type, "FILE")) {
 	krb5_set_error_string (context, "replay cache type %s not supported",
 			       type);
@@ -77,6 +78,9 @@ krb5_rc_resolve_full(krb5_context context,
 		     const char *string_name)
 {
     krb5_error_code ret;
+
+    *id = NULL;
+
     if(strncmp(string_name, "FILE:", 5)) {
 	krb5_set_error_string (context, "replay cache type %s not supported",
 			       string_name);
@@ -86,6 +90,10 @@ krb5_rc_resolve_full(krb5_context context,
     if(ret)
 	return ret;
     ret = krb5_rc_resolve(context, *id, string_name + 5);
+    if (ret) {
+	krb5_rc_close(context, *id);
+	*id = NULL;
+    }
     return ret;
 }
 
diff --git a/source4/heimdal/lib/krb5/send_to_kdc.c b/source4/heimdal/lib/krb5/send_to_kdc.c
index d3d21aea3f..0bcafa70a1 100644
--- a/source4/heimdal/lib/krb5/send_to_kdc.c
+++ b/source4/heimdal/lib/krb5/send_to_kdc.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: send_to_kdc.c,v 1.57 2006/03/07 19:39:59 lha Exp $");
+RCSID("$Id: send_to_kdc.c,v 1.58 2006/04/02 02:32:03 lha Exp $");
 
 struct send_and_recv {
 	krb5_send_and_recv_func_t func;
@@ -231,6 +231,7 @@ send_and_recv_http(int fd,
 	s[rep->length] = 0;
 	p = strstr(s, "\r\n\r\n");
 	if(p == NULL) {
+	    krb5_data_zero(rep);
 	    free(s);
 	    return -1;
 	}
@@ -238,12 +239,14 @@ send_and_recv_http(int fd,
 	rep->data = s;
 	rep->length -= p - s;
 	if(rep->length < 4) { /* remove length */
+	    krb5_data_zero(rep);
 	    free(s);
 	    return -1;
 	}
 	rep->length -= 4;
 	_krb5_get_int(p, &rep_len, 4);
 	if (rep_len != rep->length) {
+	    krb5_data_zero(rep);
 	    free(s);
 	    return -1;
 	}
diff --git a/source4/heimdal/lib/krb5/store.c b/source4/heimdal/lib/krb5/store.c
index 42667765fb..4a567bb379 100644
--- a/source4/heimdal/lib/krb5/store.c
+++ b/source4/heimdal/lib/krb5/store.c
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include "store-int.h"
 
-RCSID("$Id: store.c,v 1.50 2005/06/17 04:36:33 lha Exp $");
+RCSID("$Id: store.c,v 1.51 2006/04/07 22:23:20 lha Exp $");
 
 #define BYTEORDER_IS(SP, V) (((SP)->flags & KRB5_STORAGE_BYTEORDER_MASK) == (V))
 #define BYTEORDER_IS_LE(SP) BYTEORDER_IS((SP), KRB5_STORAGE_BYTEORDER_LE)
@@ -420,7 +420,7 @@ krb5_ret_principal(krb5_storage *sp,
 
     if(krb5_storage_is_flags(sp, KRB5_STORAGE_PRINCIPAL_NO_NAME_TYPE))
 	type = KRB5_NT_UNKNOWN;
-    else 	if((ret = krb5_ret_int32(sp, &type))){
+    else if((ret = krb5_ret_int32(sp, &type))){
 	free(p);
 	return ret;
     }
@@ -430,18 +430,31 @@ krb5_ret_principal(krb5_storage *sp,
     }
     if(krb5_storage_is_flags(sp, KRB5_STORAGE_PRINCIPAL_WRONG_NUM_COMPONENTS))
 	ncomp--;
+    if (ncomp < 0) {
+	free(p);
+	return EINVAL;
+    }
     p->name.name_type = type;
     p->name.name_string.len = ncomp;
     ret = krb5_ret_string(sp, &p->realm);
-    if(ret) return ret;
+    if(ret) {
+	free(p);
+	return ret;
+    }
     p->name.name_string.val = calloc(ncomp, sizeof(*p->name.name_string.val));
-    if(p->name.name_string.val == NULL){
+    if(p->name.name_string.val == NULL && ncomp != 0){
 	free(p->realm);
 	return ENOMEM;
     }
     for(i = 0; i < ncomp; i++){
 	ret = krb5_ret_string(sp, &p->name.name_string.val[i]);
-	if(ret) return ret; /* XXX */
+	if(ret) {
+	    while (i >= 0)
+		free(p->name.name_string.val[i--]);
+	    free(p->realm);
+	    free(p);
+	    return ret;
+	}
     }
     *princ = p;
     return 0;
diff --git a/source4/heimdal/lib/krb5/transited.c b/source4/heimdal/lib/krb5/transited.c
index 9e24db0da0..7f18b30c88 100644
--- a/source4/heimdal/lib/krb5/transited.c
+++ b/source4/heimdal/lib/krb5/transited.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: transited.c,v 1.16 2005/06/17 04:53:35 lha Exp $");
+RCSID("$Id: transited.c,v 1.18 2006/04/10 10:26:35 lha Exp $");
 
 /* this is an attempt at one of the most horrible `compression'
    schemes that has ever been invented; it's so amazingly brain-dead
@@ -100,8 +100,10 @@ make_path(krb5_context context, struct tr_realm *r,
 	p = from + strlen(from);
 	while(1){
 	    while(p >= from && *p != '/') p--;
-	    if(p == from)
+	    if(p == from) {
+		r->next = path; /* XXX */
 		return KRB5KDC_ERR_POLICY;
+	    }
 	    if(strncmp(to, from, p - from) == 0)
 		break;
 	    tmp = calloc(1, sizeof(*tmp));
@@ -166,10 +168,13 @@ expand_realms(krb5_context context,
     for(r = realms; r; r = r->next){
 	if(r->trailing_dot){
 	    char *tmp;
-	    size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
+	    size_t len;
 
 	    if(prev_realm == NULL)
 		prev_realm = client_realm;
+
+	    len = strlen(r->realm) + strlen(prev_realm) + 1;
+
 	    tmp = realloc(r->realm, len);
 	    if(tmp == NULL){
 		free_realms(realms);
diff --git a/source4/heimdal/lib/krb5/v4_glue.c b/source4/heimdal/lib/krb5/v4_glue.c
index c66b06c09f..dd294c8943 100644
--- a/source4/heimdal/lib/krb5/v4_glue.c
+++ b/source4/heimdal/lib/krb5/v4_glue.c
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: v4_glue.c,v 1.2 2005/04/24 13:44:02 lha Exp $");
+RCSID("$Id: v4_glue.c,v 1.3 2006/04/02 01:39:54 lha Exp $");
 
 #include "krb5-v4compat.h"
 
@@ -155,19 +155,20 @@ write_v4_cc(krb5_context context, const char *tkfile,
 
     fd = open(path, O_WRONLY|O_CREAT, 0600);
     if (fd < 0) {
-	free(path);
+	ret = errno;
 	krb5_set_error_string(context, 
 			      "krb5_krb_tf_setup: error opening file %s", 
 			      path);
-	return errno;
+	free(path);
+	return ret;
     }
 
     if (fstat(fd, &sb) != 0 || !S_ISREG(sb.st_mode)) {
-	free(path);
-	close(fd);
 	krb5_set_error_string(context, 
 			      "krb5_krb_tf_setup: tktfile %s is not a file",
 			      path);
+	free(path);
+	close(fd);
 	return KRB5_FCC_PERM;
     }
 
@@ -178,11 +179,11 @@ write_v4_cc(krb5_context context, const char *tkfile,
 	    break;
     }
     if (i == KRB5_TF_LCK_RETRY_COUNT) {
-	free(path);
-	close(fd);
 	krb5_set_error_string(context,
 			      "krb5_krb_tf_setup: failed to lock %s",
 			      path);
+	free(path);
+	close(fd);
 	return KRB5_FCC_PERM;
     }
 
@@ -190,11 +191,11 @@ write_v4_cc(krb5_context context, const char *tkfile,
 	ret = ftruncate(fd, 0);
 	if (ret < 0) {
 	    flock(fd, LOCK_UN);
-	    free(path);
-	    close(fd);
 	    krb5_set_error_string(context,
 				  "krb5_krb_tf_setup: failed to truncate %s",
 				  path);
+	    free(path);
+	    close(fd);
 	    return KRB5_FCC_PERM;
 	}
     }