s4:heimdal: import lorikeet-heimdal-201101310455 (commit aa88eb1a05c4985cc23fb65fc1bad75bdce01c1f)

54 files changed, 192 insertions, 185 deletions

diff --git a/source4/heimdal/base/baselocl.h b/source4/heimdal/base/baselocl.h
index 5f157264c1..b3c81b9460 100644
--- a/source4/heimdal/base/baselocl.h
+++ b/source4/heimdal/base/baselocl.h
@@ -106,11 +106,6 @@ heim_base_atomic_dec(heim_base_atomic_type *x)
 /* tagged strings/object/XXX */
 #define heim_base_is_tagged(x) (((uintptr_t)(x)) & 0x3)
 
-#define heim_base_is_tagged_string(x) ((((uintptr_t)(x)) & 0x3) == 2)
-#define heim_base_make_tagged_string_ptr(x) ((heim_object_t)(((uintptr_t)(x)) | 2))
-#define heim_base_tagged_string_ptr(x) ((char *)(((uintptr_t)(x)) & (~3)))
-
-
 #define heim_base_is_tagged_object(x) ((((uintptr_t)(x)) & 0x3) == 1)
 #define heim_base_make_tagged_object(x, tid) \
     ((heim_object_t)((((uintptr_t)(x)) << 5) | ((tid) << 2) | 0x1))
diff --git a/source4/heimdal/base/heimbase.c b/source4/heimdal/base/heimbase.c
index b8d5d74a9a..7031af9e49 100644
--- a/source4/heimdal/base/heimbase.c
+++ b/source4/heimdal/base/heimbase.c
@@ -159,8 +159,6 @@ _heim_get_isa(heim_object_t ptr)
     if (heim_base_is_tagged(ptr)) {
 	if (heim_base_is_tagged_object(ptr))
 	    return tagged_isa[heim_base_tagged_object_tid(ptr)];
-	if (heim_base_is_tagged_string(ptr))
-	    return &_heim_string_object;
 	heim_abort("not a supported tagged type");
     }
     p = PTR2BASE(ptr);
diff --git a/source4/heimdal/base/heimbase.h b/source4/heimdal/base/heimbase.h
index 17eb12ea5e..d1ca5aa899 100644
--- a/source4/heimdal/base/heimbase.h
+++ b/source4/heimdal/base/heimbase.h
@@ -146,7 +146,6 @@ void	heim_dict_delete_key(heim_dict_t, heim_object_t);
 typedef struct heim_string_data *heim_string_t;
 
 heim_string_t heim_string_create(const char *);
-heim_string_t heim_string_create_with_static(const char *);
 heim_tid_t heim_string_get_type_id(void);
 const char * heim_string_get_utf8(heim_string_t);
 
diff --git a/source4/heimdal/base/string.c b/source4/heimdal/base/string.c
index 414a9161fa..11e8841153 100644
--- a/source4/heimdal/base/string.c
+++ b/source4/heimdal/base/string.c
@@ -44,31 +44,20 @@ string_dealloc(void *ptr)
 static int
 string_cmp(void *a, void *b)
 {
-    if (heim_base_is_tagged_string(a))
-	a = heim_base_tagged_string_ptr(a);
-    if (heim_base_is_tagged_string(b))
-	b = heim_base_tagged_string_ptr(b);
-
     return strcmp(a, b);
 }
 
 static unsigned long
 string_hash(void *ptr)
 {
-    const char *s;
+    const char *s = ptr;
     unsigned long n;
 
-    if (heim_base_is_tagged_string(ptr))
-	s = heim_base_tagged_string_ptr(ptr);
-    else
-	s = ptr;
-
     for (n = 0; *s; ++s)
 	n += *s;
     return n;
 }
 
-
 struct heim_type_data _heim_string_object = {
     HEIM_TID_STRING,
     "string-object",
@@ -100,26 +89,6 @@ heim_string_create(const char *string)
 }
 
 /**
- * Create a string object from a strings allocated in the text segment.
- *
- * Note that static string object wont be auto released with
- * heim_auto_release(), the allocation policy of the string must
- * be manged separately from the returned object. This make this
- * function not very useful for strings in allocated from heap or
- * stack. In that case you should use heim_string_create().
- *
- * @param string the string to create, must be an utf8 string
- *
- * @return string object
- */
-
-heim_string_t
-heim_string_create_with_static(const char *string)
-{
-    return heim_base_make_tagged_string_ptr(string);
-}
-
-/**
  * Return the type ID of string objects
  *
  * @return type id of string objects
diff --git a/source4/heimdal/base/version-script.map b/source4/heimdal/base/version-script.map
index 9886943df1..007052baeb 100644
--- a/source4/heimdal/base/version-script.map
+++ b/source4/heimdal/base/version-script.map
@@ -12,6 +12,7 @@ HEIMDAL_BASE_1.0 {
 		heim_auto_release_create;
 		heim_auto_release_drain;
 		heim_base_once_f;
+		heim_cmp;
 		heim_dict_add_value;
 		heim_dict_copy_value;
 		heim_dict_create;
@@ -22,7 +23,6 @@ HEIMDAL_BASE_1.0 {
 		heim_string_create;
 		heim_string_get_utf8;
 		heim_number_create;
-		heim_string_create_with_static;
 	local:
 		*;
 };
diff --git a/source4/heimdal/kdc/version-script.map b/source4/heimdal/kdc/version-script.map
index 8234ee2ef4..ae16f39faa 100644
--- a/source4/heimdal/kdc/version-script.map
+++ b/source4/heimdal/kdc/version-script.map
@@ -16,6 +16,10 @@ HEIMDAL_KDC_1.0 {
 		krb5_kdc_save_request;
 		krb5_kdc_update_time;
 		krb5_kdc_pk_initialize;
+
+		# needed for digest-service
+		_kdc_db_fetch;
+		_kdc_free_ent;
 	local:
 		*;
 };
diff --git a/source4/heimdal/lib/com_err/lex.c b/source4/heimdal/lib/com_err/lex.c
index f107bba5bd..9a61f5902b 100644
--- a/source4/heimdal/lib/com_err/lex.c
+++ b/source4/heimdal/lib/com_err/lex.c
@@ -1860,7 +1860,7 @@ getstring(void)
 	    continue;
 	}
 	if(c == '\n'){
-	    lex_error_message("unterminated string");
+	    _lex_error_message("unterminated string");
 	    lineno++;
 	    break;
 	}
@@ -1880,7 +1880,7 @@ getstring(void)
 }
 
 void
-lex_error_message (const char *format, ...)
+_lex_error_message (const char *format, ...)
 {
      va_list args;
 
diff --git a/source4/heimdal/lib/com_err/lex.h b/source4/heimdal/lib/com_err/lex.h
index 6c9be77ddf..e158816bbb 100644
--- a/source4/heimdal/lib/com_err/lex.h
+++ b/source4/heimdal/lib/com_err/lex.h
@@ -33,7 +33,7 @@
 
 /* $Id$ */
 
-void lex_error_message (const char *, ...)
+void _lex_error_message (const char *, ...)
 __attribute__ ((format (printf, 1, 2)));
 
 int yylex(void);
diff --git a/source4/heimdal/lib/com_err/lex.l b/source4/heimdal/lib/com_err/lex.l
index ac660a1d8c..eb39e0cfb8 100644
--- a/source4/heimdal/lib/com_err/lex.l
+++ b/source4/heimdal/lib/com_err/lex.l
@@ -95,7 +95,7 @@ getstring(void)
 	    continue;
 	}
 	if(c == '\n'){
-	    lex_error_message("unterminated string");
+	    _lex_error_message("unterminated string");
 	    lineno++;
 	    break;
 	}
@@ -115,7 +115,7 @@ getstring(void)
 }
 
 void
-lex_error_message (const char *format, ...)
+_lex_error_message (const char *format, ...)
 {
      va_list args;
 
diff --git a/source4/heimdal/lib/com_err/parse.c b/source4/heimdal/lib/com_err/parse.c
index b2b0fc1090..a97c56f0b2 100644
--- a/source4/heimdal/lib/com_err/parse.c
+++ b/source4/heimdal/lib/com_err/parse.c
@@ -291,7 +291,7 @@ name2number(const char *str)
 void
 yyerror (char *s)
 {
-     lex_error_message ("%s\n", s);
+     _lex_error_message ("%s\n", s);
 }
 #line 296 ""
 /* allocate initial stack or double stack size, up to YYMAXDEPTH */
diff --git a/source4/heimdal/lib/com_err/parse.y b/source4/heimdal/lib/com_err/parse.y
index f628e8804f..194965c349 100644
--- a/source4/heimdal/lib/com_err/parse.y
+++ b/source4/heimdal/lib/com_err/parse.y
@@ -170,5 +170,5 @@ name2number(const char *str)
 void
 yyerror (char *s)
 {
-     lex_error_message ("%s\n", s);
+     _lex_error_message ("%s\n", s);
 }
diff --git a/source4/heimdal/lib/gssapi/gssapi/gssapi.h b/source4/heimdal/lib/gssapi/gssapi/gssapi.h
index 12833ebe14..c67b0a80d7 100644
--- a/source4/heimdal/lib/gssapi/gssapi/gssapi.h
+++ b/source4/heimdal/lib/gssapi/gssapi/gssapi.h
@@ -261,9 +261,12 @@ typedef OM_uint32 gss_qop_t;
 #define GSS_IOV_BUFFER_TYPE_STREAM 10
 #define GSS_IOV_BUFFER_TYPE_SIGN_ONLY 11
 
-#define GSS_IOV_BUFFER_TYPE_FLAG_MASK 0xffff0000
-#define GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE 0x00010000
-#define GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED 0x00020000
+#define GSS_IOV_BUFFER_TYPE_FLAG_MASK		0xffff0000
+#define GSS_IOV_BUFFER_FLAG_ALLOCATE		0x00010000
+#define GSS_IOV_BUFFER_FLAG_ALLOCATED		0x00020000
+
+#define GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE	0x00010000 /* old name */
+#define GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED	0x00020000 /* old name */
 
 #define GSS_IOV_BUFFER_TYPE(_t) ((_t) & ~GSS_IOV_BUFFER_TYPE_FLAG_MASK)
 #define GSS_IOV_BUFFER_FLAGS(_t) ((_t) & GSS_IOV_BUFFER_TYPE_FLAG_MASK)
diff --git a/source4/heimdal/lib/gssapi/krb5/cfx.c b/source4/heimdal/lib/gssapi/krb5/cfx.c
index 1a6e975279..1189718adc 100755
--- a/source4/heimdal/lib/gssapi/krb5/cfx.c
+++ b/source4/heimdal/lib/gssapi/krb5/cfx.c
@@ -216,7 +216,7 @@ _gk_find_buffer(gss_iov_buffer_desc *iov, int iov_count, OM_uint32 type)
 OM_uint32
 _gk_allocate_buffer(OM_uint32 *minor_status, gss_iov_buffer_desc *buffer, size_t size)
 {
-    if (buffer->type & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED) {
+    if (buffer->type & GSS_IOV_BUFFER_FLAG_ALLOCATED) {
 	if (buffer->buffer.length == size)
 	    return GSS_S_COMPLETE;
 	free(buffer->buffer.value);
@@ -228,7 +228,7 @@ _gk_allocate_buffer(OM_uint32 *minor_status, gss_iov_buffer_desc *buffer, size_t
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
-    buffer->type |= GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED;
+    buffer->type |= GSS_IOV_BUFFER_FLAG_ALLOCATED;
 
     return GSS_S_COMPLETE;
 }
@@ -391,7 +391,7 @@ _gssapi_wrap_cfx_iov(OM_uint32 *minor_status,
 	    rrc -= ec;
 	gsshsize += gsstsize;
 	gsstsize = 0;
-    } else if (GSS_IOV_BUFFER_FLAGS(trailer->type) & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE) {
+    } else if (GSS_IOV_BUFFER_FLAGS(trailer->type) & GSS_IOV_BUFFER_FLAG_ALLOCATE) {
 	major_status = _gk_allocate_buffer(minor_status, trailer, gsstsize);
 	if (major_status)
 	    goto failure;
@@ -406,7 +406,7 @@ _gssapi_wrap_cfx_iov(OM_uint32 *minor_status,
      *
      */
 
-    if (GSS_IOV_BUFFER_FLAGS(header->type) & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATE) {
+    if (GSS_IOV_BUFFER_FLAGS(header->type) & GSS_IOV_BUFFER_FLAG_ALLOCATE) {
 	major_status = _gk_allocate_buffer(minor_status, header, gsshsize);
 	if (major_status != GSS_S_COMPLETE)
 	    goto failure;
diff --git a/source4/heimdal/lib/gssapi/mech/context.c b/source4/heimdal/lib/gssapi/mech/context.c
index 96e5edc32b..5ea0ac466b 100644
--- a/source4/heimdal/lib/gssapi/mech/context.c
+++ b/source4/heimdal/lib/gssapi/mech/context.c
@@ -85,17 +85,19 @@ _gss_mg_get_error(const gss_OID mech, OM_uint32 type,
     case GSS_C_GSS_CODE: {
 	if (value != mg->maj_stat || mg->maj_error.length == 0)
 	    break;
-	string->value = malloc(mg->maj_error.length);
+	string->value = malloc(mg->maj_error.length + 1);
 	string->length = mg->maj_error.length;
 	memcpy(string->value, mg->maj_error.value, mg->maj_error.length);
+        ((char *) string->value)[string->length] = '\0';
 	return GSS_S_COMPLETE;
     }
     case GSS_C_MECH_CODE: {
 	if (value != mg->min_stat || mg->min_error.length == 0)
 	    break;
-	string->value = malloc(mg->min_error.length);
+	string->value = malloc(mg->min_error.length + 1);
 	string->length = mg->min_error.length;
 	memcpy(string->value, mg->min_error.value, mg->min_error.length);
+        ((char *) string->value)[string->length] = '\0';
 	return GSS_S_COMPLETE;
     }
     }
diff --git a/source4/heimdal/lib/gssapi/mech/cred.h b/source4/heimdal/lib/gssapi/mech/cred.h
index 01bd882dda..adffe6893e 100644
--- a/source4/heimdal/lib/gssapi/mech/cred.h
+++ b/source4/heimdal/lib/gssapi/mech/cred.h
@@ -28,12 +28,12 @@
  */
 
 struct _gss_mechanism_cred {
-	SLIST_ENTRY(_gss_mechanism_cred) gmc_link;
+	HEIM_SLIST_ENTRY(_gss_mechanism_cred) gmc_link;
 	gssapi_mech_interface	gmc_mech;	/* mechanism ops for MC */
 	gss_OID			gmc_mech_oid;	/* mechanism oid for MC */
 	gss_cred_id_t		gmc_cred;	/* underlying MC */
 };
-SLIST_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
+HEIM_SLIST_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
 
 struct _gss_cred {
 	struct _gss_mechanism_cred_list gc_mc;
diff --git a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
index 19f3bc4bf8..92d7e7f05d 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
@@ -209,7 +209,7 @@ gss_accept_sec_context(OM_uint32 *minor_status,
 	}
 
 	if (cred) {
-		SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
+		HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link)
 			if (mc->gmc_mech == m)
 				break;
 		if (!mc) {
@@ -285,7 +285,7 @@ gss_accept_sec_context(OM_uint32 *minor_status,
 				gss_delete_sec_context(&junk, context_handle, NULL);
 				return (GSS_S_FAILURE);
 			}
-			SLIST_INIT(&dcred->gc_mc);
+			HEIM_SLIST_INIT(&dcred->gc_mc);
 			dmc = malloc(sizeof(struct _gss_mechanism_cred));
 			if (!dmc) {
 				free(dcred);
@@ -296,7 +296,7 @@ gss_accept_sec_context(OM_uint32 *minor_status,
 			dmc->gmc_mech = m;
 			dmc->gmc_mech_oid = &m->gm_mech_oid;
 			dmc->gmc_cred = delegated_mc;
-			SLIST_INSERT_HEAD(&dcred->gc_mc, dmc, gmc_link);
+			HEIM_SLIST_INSERT_HEAD(&dcred->gc_mc, dmc, gmc_link);
 
 			*delegated_cred_handle = (gss_cred_id_t) dcred;
 		}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c b/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c
index 416407a7bf..c9900148c2 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c
@@ -90,7 +90,7 @@ gss_acquire_cred(OM_uint32 *minor_status,
 		*minor_status = ENOMEM;
 		return (GSS_S_FAILURE);
 	}
-	SLIST_INIT(&cred->gc_mc);
+	HEIM_SLIST_INIT(&cred->gc_mc);
 
 	if (mechs == GSS_C_NO_OID_SET)
 		mechs = _gss_mech_oids;
@@ -145,14 +145,14 @@ gss_acquire_cred(OM_uint32 *minor_status,
 			}
 		}
 
-		SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
+		HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
 	}
 
 	/*
 	 * If we didn't manage to create a single credential, return
 	 * an error.
 	 */
-	if (!SLIST_FIRST(&cred->gc_mc)) {
+	if (!HEIM_SLIST_FIRST(&cred->gc_mc)) {
 		free(cred);
 		if (actual_mechs)
 			gss_release_oid_set(minor_status, actual_mechs);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_add_cred.c b/source4/heimdal/lib/gssapi/mech/gss_add_cred.c
index 56fb8ec6a9..19deea5b06 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_add_cred.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_add_cred.c
@@ -106,7 +106,7 @@ gss_add_cred(OM_uint32 *minor_status,
 		*minor_status = ENOMEM;
 		return (GSS_S_FAILURE);
 	}
-	SLIST_INIT(&new_cred->gc_mc);
+	HEIM_SLIST_INIT(&new_cred->gc_mc);
 
 	/*
 	 * We go through all the mc attached to the input_cred_handle
@@ -116,7 +116,7 @@ gss_add_cred(OM_uint32 *minor_status,
 	 */
 	target_mc = 0;
 	if (cred) {
-		SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+		HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 			if (gss_oid_equal(mc->gmc_mech_oid, desired_mech)) {
 				target_mc = mc;
 			}
@@ -127,7 +127,7 @@ gss_add_cred(OM_uint32 *minor_status,
 				*minor_status = ENOMEM;
 				return (GSS_S_FAILURE);
 			}
-			SLIST_INSERT_HEAD(&new_cred->gc_mc, copy_mc, gmc_link);
+			HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, copy_mc, gmc_link);
 		}
 	}
 
@@ -178,7 +178,7 @@ gss_add_cred(OM_uint32 *minor_status,
 		free(mc);
 		return (major_status);
 	}
-	SLIST_INSERT_HEAD(&new_cred->gc_mc, mc, gmc_link);
+	HEIM_SLIST_INSERT_HEAD(&new_cred->gc_mc, mc, gmc_link);
 	*output_cred_handle = (gss_cred_id_t) new_cred;
 
 	return (GSS_S_COMPLETE);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_aeap.c b/source4/heimdal/lib/gssapi/mech/gss_aeap.c
index e98ba970d1..141b6ae5ac 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_aeap.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_aeap.c
@@ -157,7 +157,7 @@ gss_wrap_iov_length(OM_uint32 * minor_status,
 
 /**
  * Free all buffer allocated by gss_wrap_iov() or gss_unwrap_iov() by
- * looking at the GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED flag.
+ * looking at the GSS_IOV_BUFFER_FLAG_ALLOCATED flag.
  *
  * @ingroup gssapi
  */
@@ -176,10 +176,10 @@ gss_release_iov_buffer(OM_uint32 *minor_status,
 	return GSS_S_CALL_INACCESSIBLE_READ;
 
     for (i = 0; i < iov_count; i++) {
-	if ((iov[i].type & GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED) == 0)
+	if ((iov[i].type & GSS_IOV_BUFFER_FLAG_ALLOCATED) == 0)
 	    continue;
 	gss_release_buffer(&junk, &iov[i].buffer);
-	iov[i].type &= ~GSS_IOV_BUFFER_TYPE_FLAG_ALLOCATED;
+	iov[i].type &= ~GSS_IOV_BUFFER_FLAG_ALLOCATED;
     }
     return GSS_S_COMPLETE;
 }
diff --git a/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c b/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c
index fba35c5379..e87931dc78 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c
@@ -99,11 +99,11 @@ gss_canonicalize_name(OM_uint32 *minor_status,
 		return (GSS_S_FAILURE);
 	}
 
-	SLIST_INIT(&name->gn_mn);
+	HEIM_SLIST_INIT(&name->gn_mn);
 	mn->gmn_mech = m;
 	mn->gmn_mech_oid = &m->gm_mech_oid;
 	mn->gmn_name = new_canonical_name;
-	SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+	HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 
 	*output_name = (gss_name_t) name;
 
diff --git a/source4/heimdal/lib/gssapi/mech/gss_compare_name.c b/source4/heimdal/lib/gssapi/mech/gss_compare_name.c
index 14593f6def..70b4b1c206 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_compare_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_compare_name.c
@@ -55,7 +55,7 @@ gss_compare_name(OM_uint32 *minor_status,
 		struct _gss_mechanism_name *mn1;
 		struct _gss_mechanism_name *mn2;
 
-		SLIST_FOREACH(mn1, &name1->gn_mn, gmn_link) {
+		HEIM_SLIST_FOREACH(mn1, &name1->gn_mn, gmn_link) {
 			OM_uint32 major_status;
 
 			major_status = _gss_find_mn(minor_status, name2,
diff --git a/source4/heimdal/lib/gssapi/mech/gss_cred.c b/source4/heimdal/lib/gssapi/mech/gss_cred.c
index b52015b6de..b8fa11185a 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_cred.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_cred.c
@@ -62,7 +62,7 @@ gss_export_cred(OM_uint32 * minor_status,
 	return GSS_S_NO_CRED;
     }
 
-    SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+    HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 	if (mc->gmc_mech->gm_export_cred == NULL) {
 	    *minor_status = 0;
 	    return GSS_S_NO_CRED;
@@ -75,7 +75,7 @@ gss_export_cred(OM_uint32 * minor_status,
 	return GSS_S_FAILURE;
     }
 
-    SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+    HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 
 	major = mc->gmc_mech->gm_export_cred(minor_status,
 					     mc->gmc_cred, &buffer);
@@ -138,7 +138,7 @@ gss_import_cred(OM_uint32 * minor_status,
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
-    SLIST_INIT(&cred->gc_mc);
+    HEIM_SLIST_INIT(&cred->gc_mc);
 
     *cred_handle = (gss_cred_id_t)cred;
 
@@ -201,12 +201,12 @@ gss_import_cred(OM_uint32 * minor_status,
 	mc->gmc_mech_oid = &m->gm_mech_oid;
 	mc->gmc_cred = mcred;
 
-	SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
+	HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
     }
     krb5_storage_free(sp);
     sp = NULL;
 
-    if (SLIST_EMPTY(&cred->gc_mc)) {
+    if (HEIM_SLIST_EMPTY(&cred->gc_mc)) {
 	major = GSS_S_NO_CRED;
 	goto out;
     }
diff --git a/source4/heimdal/lib/gssapi/mech/gss_display_name.c b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
index 599e79861a..524a586fbe 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_display_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
@@ -67,7 +67,7 @@ gss_display_name(OM_uint32 *minor_status,
 		*minor_status = 0;
 		return (GSS_S_COMPLETE);
 	} else {
-		SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+		HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
 			major_status = mn->gmn_mech->gm_display_name(
 				minor_status, mn->gmn_name,
 				output_name_buffer,
diff --git a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
index 3d3a56802f..053825bbc3 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
@@ -53,7 +53,7 @@ gss_duplicate_name(OM_uint32 *minor_status,
 			return (major_status);
 		new_name = (struct _gss_name *) *dest_name;
 		
-		SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+		HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
 		    struct _gss_mechanism_name *mn2;
 		    _gss_find_mn(minor_status, new_name,
 				 mn->gmn_mech_oid, &mn2);
@@ -65,10 +65,10 @@ gss_duplicate_name(OM_uint32 *minor_status,
 			return (GSS_S_FAILURE);
 		}
 		memset(new_name, 0, sizeof(struct _gss_name));
-		SLIST_INIT(&new_name->gn_mn);
+		HEIM_SLIST_INIT(&new_name->gn_mn);
 		*dest_name = (gss_name_t) new_name;
 		
-		SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+		HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
 			struct _gss_mechanism_name *new_mn;
 			
 			new_mn = malloc(sizeof(*new_mn));
@@ -86,7 +86,7 @@ gss_duplicate_name(OM_uint32 *minor_status,
 				free(new_mn);
 				continue;
 			}
-			SLIST_INSERT_HEAD(&new_name->gn_mn, new_mn, gmn_link);
+			HEIM_SLIST_INSERT_HEAD(&new_name->gn_mn, new_mn, gmn_link);
 		}
 
 	}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_export_name.c b/source4/heimdal/lib/gssapi/mech/gss_export_name.c
index 6bc5ee8d1c..3e6e626819 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_export_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_export_name.c
@@ -43,7 +43,7 @@ gss_export_name(OM_uint32 *minor_status,
 	 * one, otherwise export based on the first mechanism in our
 	 * list.
 	 */
-	mn = SLIST_FIRST(&name->gn_mn);
+	mn = HEIM_SLIST_FIRST(&name->gn_mn);
 	if (!mn) {
 		*minor_status = 0;
 		return (GSS_S_NAME_NOT_MN);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_import_name.c b/source4/heimdal/lib/gssapi/mech/gss_import_name.c
index 90dc0c1e94..574c058fc2 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_import_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_import_name.c
@@ -209,7 +209,7 @@ gss_import_name(OM_uint32 *minor_status,
 		return (GSS_S_FAILURE);
 	}
 
-	SLIST_INIT(&name->gn_mn);
+	HEIM_SLIST_INIT(&name->gn_mn);
 
 	major_status = _gss_copy_oid(minor_status,
 	    name_type, &name->gn_type);
@@ -228,7 +228,7 @@ gss_import_name(OM_uint32 *minor_status,
 	 * for those supported this nametype.
 	 */
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		int present = 0;
 
 		major_status = gss_test_oid_set_member(minor_status, 
@@ -257,14 +257,14 @@ gss_import_name(OM_uint32 *minor_status,
 
 		mn->gmn_mech = &m->gm_mech;
 		mn->gmn_mech_oid = &m->gm_mech_oid;
-		SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+		HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 	}
 
 	/*
 	 * If we can't find a mn for the name, bail out already here.
 	 */
 
-	mn = SLIST_FIRST(&name->gn_mn);
+	mn = HEIM_SLIST_FIRST(&name->gn_mn);
 	if (!mn) {
 		*minor_status = 0;
 		major_status = GSS_S_NAME_NOT_MN;
diff --git a/source4/heimdal/lib/gssapi/mech/gss_indicate_mechs.c b/source4/heimdal/lib/gssapi/mech/gss_indicate_mechs.c
index 8560bc7c41..59a1dcf22b 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_indicate_mechs.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_indicate_mechs.c
@@ -43,7 +43,7 @@ gss_indicate_mechs(OM_uint32 *minor_status,
 	if (major_status)
 		return (major_status);
 	
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_indicate_mechs) {
 			major_status = m->gm_mech.gm_indicate_mechs(
 			    minor_status, &set);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c b/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c
index 5da035d15a..cf111ecbae 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c
@@ -37,7 +37,7 @@ _gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
 	if (cred == NULL)
 		return GSS_C_NO_CREDENTIAL;
 
-	SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+	HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 		if (gss_oid_equal(mech_type, mc->gmc_mech_oid))
 			return mc->gmc_cred;
 	}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred.c
index 50d9c0b8da..1db0f23303 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred.c
@@ -78,7 +78,7 @@ gss_inquire_cred(OM_uint32 *minor_status,
 			*minor_status = ENOMEM;
 			return (GSS_S_FAILURE);
 		}
-		SLIST_INIT(&name->gn_mn);
+		HEIM_SLIST_INIT(&name->gn_mn);
 	} else {
 		name = NULL;
 	}
@@ -96,7 +96,7 @@ gss_inquire_cred(OM_uint32 *minor_status,
 	if (cred) {
 		struct _gss_mechanism_cred *mc;
 
-		SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+		HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 			gss_name_t mc_name;
 			OM_uint32 mc_lifetime;
 
@@ -116,7 +116,7 @@ gss_inquire_cred(OM_uint32 *minor_status,
 				mn->gmn_mech = mc->gmc_mech;
 				mn->gmn_mech_oid = mc->gmc_mech_oid;
 				mn->gmn_name = mc_name;
-				SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+				HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 			} else {
 				mc->gmc_mech->gm_release_name(minor_status,
 				    &mc_name);
@@ -131,7 +131,7 @@ gss_inquire_cred(OM_uint32 *minor_status,
 			found++;
 		}
 	} else {
-		SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+		HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 			gss_name_t mc_name;
 			OM_uint32 mc_lifetime;
 
@@ -153,7 +153,7 @@ gss_inquire_cred(OM_uint32 *minor_status,
 				mn->gmn_mech = &m->gm_mech;
 				mn->gmn_mech_oid = &m->gm_mech_oid;
 				mn->gmn_name = mc_name;
-				SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+				HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 			} else if (mc_name) {
 				m->gm_mech.gm_release_name(minor_status,
 				    &mc_name);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
index f71bd6993f..e7746e4657 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
@@ -60,7 +60,7 @@ gss_inquire_cred_by_mech(OM_uint32 *minor_status,
 
 	if (cred_handle != GSS_C_NO_CREDENTIAL) {
 		struct _gss_cred *cred = (struct _gss_cred *) cred_handle;
-		SLIST_FOREACH(mcp, &cred->gc_mc, gmc_link)
+		HEIM_SLIST_FOREACH(mcp, &cred->gc_mc, gmc_link)
 			if (mcp->gmc_mech == m)
 				break;
 		if (!mcp)
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_oid.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_oid.c
index 72d3048039..900370a5db 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_oid.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_oid.c
@@ -50,7 +50,7 @@ gss_inquire_cred_by_oid (OM_uint32 *minor_status,
 	if (cred == NULL)
 		return GSS_S_NO_CRED;
 
-	SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+	HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 		gss_buffer_set_t rset = GSS_C_NO_BUFFER_SET;
 		int i;
 
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_mechs_for_name.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_mechs_for_name.c
index 1ad7b58dbb..f8eab82dc1 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_mechs_for_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_mechs_for_name.c
@@ -52,7 +52,7 @@ gss_inquire_mechs_for_name(OM_uint32 *minor_status,
 	 * name's type is supported by the mechanism. If it is, add
 	 * the mechanism to the set.
 	 */
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		major_status = gss_inquire_names_for_mech(minor_status,
 		    &m->gm_mech_oid, &name_types);
 		if (major_status) {
diff --git a/source4/heimdal/lib/gssapi/mech/gss_krb5.c b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
index f4290a2a5a..594b41ef8e 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_krb5.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
@@ -197,7 +197,7 @@ gsskrb5_register_acceptor_identity(const char *identity)
 	buffer.value = rk_UNCONST(identity);
 	buffer.length = strlen(identity);
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_set_sec_context_option == NULL)
 			continue;
 		m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -227,7 +227,7 @@ gsskrb5_set_dns_canonicalize(int flag)
 	buffer.value = &b;
 	buffer.length = sizeof(b);
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_set_sec_context_option == NULL)
 			continue;
 		m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -501,7 +501,7 @@ gsskrb5_set_send_to_kdc(struct gsskrb5_send_to_kdc *c)
 	buffer.length = 0;
     }
 
-    SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+    HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 	if (m->gm_mech.gm_set_sec_context_option == NULL)
 	    continue;
 	m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -532,7 +532,7 @@ gss_krb5_ccache_name(OM_uint32 *minor_status,
     buffer.value = rk_UNCONST(name);
     buffer.length = strlen(name);
 
-    SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+    HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 	if (m->gm_mech.gm_set_sec_context_option == NULL)
 	    continue;
 	m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -820,7 +820,7 @@ gsskrb5_set_default_realm(const char *realm)
 	buffer.value = rk_UNCONST(realm);
 	buffer.length = strlen(realm);
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_set_sec_context_option == NULL)
 			continue;
 		m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -882,7 +882,7 @@ gsskrb5_set_time_offset(int offset)
 	buffer.value = &o;
 	buffer.length = sizeof(o);
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_set_sec_context_option == NULL)
 			continue;
 		m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -905,7 +905,7 @@ gsskrb5_get_time_offset(int *offset)
 	buffer.value = &o;
 	buffer.length = sizeof(o);
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_set_sec_context_option == NULL)
 			continue;
 		maj_stat = m->gm_mech.gm_set_sec_context_option(&junk, NULL,
@@ -932,7 +932,7 @@ gsskrb5_plugin_register(struct gsskrb5_krb5_plugin *c)
     buffer.value = c;
     buffer.length = sizeof(*c);
 
-    SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+    HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 	if (m->gm_mech.gm_set_sec_context_option == NULL)
 	    continue;
 	m->gm_mech.gm_set_sec_context_option(&junk, NULL,
diff --git a/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c b/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c
index b1368db91c..a68d345e30 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c
@@ -194,7 +194,7 @@ add_builtin(gssapi_mech_interface mech)
     if (m->gm_name_types == NULL)
 	gss_create_empty_oid_set(&minor_status, &m->gm_name_types);
 
-    SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
+    HEIM_SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
     return 0;
 }
 
@@ -217,7 +217,7 @@ _gss_load_mech(void)
 
 	HEIMDAL_MUTEX_lock(&_gss_mech_mutex);
 
-	if (SLIST_FIRST(&_gss_mechs)) {
+	if (HEIM_SLIST_FIRST(&_gss_mechs)) {
 		HEIMDAL_MUTEX_unlock(&_gss_mech_mutex);
 		return;
 	}
@@ -262,7 +262,7 @@ _gss_load_mech(void)
 		 * Check for duplicates, already loaded mechs.
 		 */
 		found = 0;
-		SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+		HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 			if (gss_oid_equal(&m->gm_mech.gm_mech_oid, &mech_oid)) {
 				found = 1;
 				free(mech_oid.elements);
@@ -276,7 +276,11 @@ _gss_load_mech(void)
 #define RTLD_LOCAL 0
 #endif
 
-		so = dlopen(lib, RTLD_LAZY | RTLD_LOCAL);
+#ifndef RTLD_GROUP
+#define RTLD_GROUP 0
+#endif
+
+		so = dlopen(lib, RTLD_LAZY | RTLD_LOCAL | RTLD_GROUP);
 		if (!so) {
 /*			fprintf(stderr, "dlopen: %s\n", dlerror()); */
 			free(mech_oid.elements);
@@ -338,7 +342,7 @@ _gss_load_mech(void)
 		OPTSYM(unwrap_iov);
 		OPTSYM(wrap_iov_length);
 
-		SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
+		HEIM_SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
 		continue;
 
 	bad:
@@ -358,7 +362,7 @@ __gss_get_mechanism(gss_const_OID mech)
         struct _gss_mech_switch	*m;
 
 	_gss_load_mech();
-	SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (gss_oid_equal(&m->gm_mech.gm_mech_oid, mech))
 			return &m->gm_mech;
 	}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_mo.c b/source4/heimdal/lib/gssapi/mech/gss_mo.c
index 354229f7ae..31235f54d5 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_mo.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_mo.c
@@ -249,7 +249,7 @@ gss_inquire_mech_for_saslname(OM_uint32 *minor_status,
 
     *mech_type = NULL;
 
-    SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+    HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 
 	major = mo_value(&m->gm_mech_oid, GSS_C_MA_SASL_MECH_NAME, &name);
 	if (major)
@@ -295,7 +295,7 @@ gss_indicate_mechs_by_attrs(OM_uint32 * minor_status,
 
     _gss_load_mech();
 
-    SLIST_FOREACH(ms, &_gss_mechs, gm_link) {
+    HEIM_SLIST_FOREACH(ms, &_gss_mechs, gm_link) {
 	gssapi_mech_interface mi = &ms->gm_mech;
 
 	if (desired_mech_attrs) {
@@ -388,7 +388,7 @@ gss_inquire_attrs_for_mech(OM_uint32 * minor_status,
 
 	_gss_load_mech();
 
-	SLIST_FOREACH(m, &_gss_mechs, gm_link)
+	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link)
 	    add_all_mo(&m->gm_mech, known_mech_attrs, GSS_MO_MA);
     }
 
diff --git a/source4/heimdal/lib/gssapi/mech/gss_names.c b/source4/heimdal/lib/gssapi/mech/gss_names.c
index 6a7ccd5c71..4b470c775f 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_names.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_names.c
@@ -38,7 +38,7 @@ _gss_find_mn(OM_uint32 *minor_status, struct _gss_name *name, gss_OID mech,
 
 	*output_mn = NULL;
 
-	SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+	HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
 		if (gss_oid_equal(mech, mn->gmn_mech_oid))
 			break;
 	}
@@ -72,7 +72,7 @@ _gss_find_mn(OM_uint32 *minor_status, struct _gss_name *name, gss_OID mech,
 
 		mn->gmn_mech = m;
 		mn->gmn_mech_oid = &m->gm_mech_oid;
-		SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+		HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 	}
 	*output_mn = mn;
 	return 0;
@@ -99,11 +99,11 @@ _gss_make_name(gssapi_mech_interface m, gss_name_t new_mn)
 		return (0);
 	}
 
-	SLIST_INIT(&name->gn_mn);
+	HEIM_SLIST_INIT(&name->gn_mn);
 	mn->gmn_mech = m;
 	mn->gmn_mech_oid = &m->gm_mech_oid;
 	mn->gmn_name = new_mn;
-	SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
+	HEIM_SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link);
 
 	return (name);
 }
diff --git a/source4/heimdal/lib/gssapi/mech/gss_release_cred.c b/source4/heimdal/lib/gssapi/mech/gss_release_cred.c
index 591ef49ab2..341f9f658c 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_release_cred.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_release_cred.c
@@ -59,9 +59,9 @@ gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
 	if (*cred_handle == GSS_C_NO_CREDENTIAL)
 	    return (GSS_S_COMPLETE);
 
-	while (SLIST_FIRST(&cred->gc_mc)) {
-		mc = SLIST_FIRST(&cred->gc_mc);
-		SLIST_REMOVE_HEAD(&cred->gc_mc, gmc_link);
+	while (HEIM_SLIST_FIRST(&cred->gc_mc)) {
+		mc = HEIM_SLIST_FIRST(&cred->gc_mc);
+		HEIM_SLIST_REMOVE_HEAD(&cred->gc_mc, gmc_link);
 		mc->gmc_mech->gm_release_cred(minor_status, &mc->gmc_cred);
 		free(mc);
 	}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_release_name.c b/source4/heimdal/lib/gssapi/mech/gss_release_name.c
index 28fb75d966..759eaec4c3 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_release_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_release_name.c
@@ -58,10 +58,10 @@ gss_release_name(OM_uint32 *minor_status,
 
 	if (name->gn_type.elements)
 		free(name->gn_type.elements);
-	while (SLIST_FIRST(&name->gn_mn)) {
+	while (HEIM_SLIST_FIRST(&name->gn_mn)) {
 		struct _gss_mechanism_name *mn;
-		mn = SLIST_FIRST(&name->gn_mn);
-		SLIST_REMOVE_HEAD(&name->gn_mn, gmn_link);
+		mn = HEIM_SLIST_FIRST(&name->gn_mn);
+		HEIM_SLIST_REMOVE_HEAD(&name->gn_mn, gmn_link);
 		mn->gmn_mech->gm_release_name(minor_status,
 					      &mn->gmn_name);
 		free(mn);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
index adae7a622e..62be485a07 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
@@ -54,9 +54,9 @@ gss_set_cred_option (OM_uint32 *minor_status,
 		if (cred == NULL)
 		    return GSS_S_FAILURE;
 
-		SLIST_INIT(&cred->gc_mc);
+		HEIM_SLIST_INIT(&cred->gc_mc);
 
-		SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+		HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 
 			if (m->gm_mech.gm_set_cred_option == NULL)
 				continue;
@@ -81,7 +81,7 @@ gss_set_cred_option (OM_uint32 *minor_status,
 				continue;
 			}
 			one_ok = 1;
-			SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
+			HEIM_SLIST_INSERT_HEAD(&cred->gc_mc, mc, gmc_link);
 		}
 		*cred_handle = (gss_cred_id_t)cred;
 		if (!one_ok) {
@@ -91,7 +91,7 @@ gss_set_cred_option (OM_uint32 *minor_status,
 	} else {
 		gssapi_mech_interface	m;
 
-		SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
+		HEIM_SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
 			m = mc->gmc_mech;
 	
 			if (m == NULL)
diff --git a/source4/heimdal/lib/gssapi/mech/mech_switch.h b/source4/heimdal/lib/gssapi/mech/mech_switch.h
index 56e3b7dea7..7ed3d4d4aa 100644
--- a/source4/heimdal/lib/gssapi/mech/mech_switch.h
+++ b/source4/heimdal/lib/gssapi/mech/mech_switch.h
@@ -30,13 +30,13 @@
 #include <gssapi_mech.h>
 
 struct _gss_mech_switch {
-	SLIST_ENTRY(_gss_mech_switch)	gm_link;
+	HEIM_SLIST_ENTRY(_gss_mech_switch)	gm_link;
 	gss_OID_desc			gm_mech_oid;
 	gss_OID_set			gm_name_types;
 	void				*gm_so;
 	gssapi_mech_interface_desc	gm_mech;
 };
-SLIST_HEAD(_gss_mech_switch_list, _gss_mech_switch);
+HEIM_SLIST_HEAD(_gss_mech_switch_list, _gss_mech_switch);
 extern struct _gss_mech_switch_list _gss_mechs;
 extern gss_OID_set _gss_mech_oids;
 
diff --git a/source4/heimdal/lib/gssapi/mech/mechqueue.h b/source4/heimdal/lib/gssapi/mech/mechqueue.h
index 7a05c94bf8..95941bab7e 100644
--- a/source4/heimdal/lib/gssapi/mech/mechqueue.h
+++ b/source4/heimdal/lib/gssapi/mech/mechqueue.h
@@ -34,20 +34,18 @@
 #ifndef	_MECHQUEUE_H_
 #define	_MECHQUEUE_H_
 
-#ifndef SLIST_HEAD
-
 /*
  * Singly-linked List definitions.
  */
-#define	SLIST_HEAD(name, type)						\
+#define	HEIM_SLIST_HEAD(name, type)						\
 struct name {								\
 	struct type *slh_first;	/* first element */			\
 }
 
-#define	SLIST_HEAD_INITIALIZER(head)					\
+#define	HEIM_SLIST_HEAD_INITIALIZER(head)					\
 	{ NULL }
 
-#define	SLIST_ENTRY(type)						\
+#define	HEIM_SLIST_ENTRY(type)						\
 struct {								\
 	struct type *sle_next;	/* next element */			\
 }
@@ -55,27 +53,27 @@ struct {								\
 /*
  * Singly-linked List functions.
  */
-#define	SLIST_INIT(head) do {						\
+#define	HEIM_SLIST_INIT(head) do {						\
 	(head)->slh_first = NULL;					\
 } while (/*CONSTCOND*/0)
 
-#define	SLIST_INSERT_AFTER(slistelm, elm, field) do {			\
+#define	HEIM_SLIST_INSERT_AFTER(slistelm, elm, field) do {			\
 	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
 	(slistelm)->field.sle_next = (elm);				\
 } while (/*CONSTCOND*/0)
 
-#define	SLIST_INSERT_HEAD(head, elm, field) do {			\
+#define	HEIM_SLIST_INSERT_HEAD(head, elm, field) do {			\
 	(elm)->field.sle_next = (head)->slh_first;			\
 	(head)->slh_first = (elm);					\
 } while (/*CONSTCOND*/0)
 
-#define	SLIST_REMOVE_HEAD(head, field) do {				\
+#define	HEIM_SLIST_REMOVE_HEAD(head, field) do {				\
 	(head)->slh_first = (head)->slh_first->field.sle_next;		\
 } while (/*CONSTCOND*/0)
 
-#define	SLIST_REMOVE(head, elm, type, field) do {			\
+#define	HEIM_SLIST_REMOVE(head, elm, type, field) do {			\
 	if ((head)->slh_first == (elm)) {				\
-		SLIST_REMOVE_HEAD((head), field);			\
+		HEIM_SLIST_REMOVE_HEAD((head), field);			\
 	}								\
 	else {								\
 		struct type *curelm = (head)->slh_first;		\
@@ -86,16 +84,14 @@ struct {								\
 	}								\
 } while (/*CONSTCOND*/0)
 
-#define	SLIST_FOREACH(var, head, field)					\
+#define	HEIM_SLIST_FOREACH(var, head, field)					\
 	for((var) = (head)->slh_first; (var); (var) = (var)->field.sle_next)
 
 /*
  * Singly-linked List access methods.
  */
-#define	SLIST_EMPTY(head)	((head)->slh_first == NULL)
-#define	SLIST_FIRST(head)	((head)->slh_first)
-#define	SLIST_NEXT(elm, field)	((elm)->field.sle_next)
-
-#endif /* SLIST_HEAD */
+#define	HEIM_SLIST_EMPTY(head)	((head)->slh_first == NULL)
+#define	HEIM_SLIST_FIRST(head)	((head)->slh_first)
+#define	HEIM_SLIST_NEXT(elm, field)	((elm)->field.sle_next)
 
 #endif	/* !_MECHQUEUE_H_ */
diff --git a/source4/heimdal/lib/gssapi/mech/name.h b/source4/heimdal/lib/gssapi/mech/name.h
index baf8e06147..4baeebf36a 100644
--- a/source4/heimdal/lib/gssapi/mech/name.h
+++ b/source4/heimdal/lib/gssapi/mech/name.h
@@ -28,12 +28,12 @@
  */
 
 struct _gss_mechanism_name {
-	SLIST_ENTRY(_gss_mechanism_name) gmn_link;
+	HEIM_SLIST_ENTRY(_gss_mechanism_name) gmn_link;
 	gssapi_mech_interface	gmn_mech;	/* mechanism ops for MN */
 	gss_OID			gmn_mech_oid;	/* mechanism oid for MN */
 	gss_name_t		gmn_name;	/* underlying MN */
 };
-SLIST_HEAD(_gss_mechanism_name_list, _gss_mechanism_name);
+HEIM_SLIST_HEAD(_gss_mechanism_name_list, _gss_mechanism_name);
 
 struct _gss_name {
 	gss_OID_desc		gn_type;	/* type of name */
diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h
index 1b0468a481..fffda7aef0 100644
--- a/source4/heimdal/lib/hdb/hdb.h
+++ b/source4/heimdal/lib/hdb/hdb.h
@@ -36,6 +36,8 @@
 #ifndef __HDB_H__
 #define __HDB_H__
 
+#include <krb5.h>
+
 #include <hdb_err.h>
 
 #include <heim_asn1.h>
diff --git a/source4/heimdal/lib/hx509/crypto.c b/source4/heimdal/lib/hx509/crypto.c
index a38226d94c..5d66b681d9 100644
--- a/source4/heimdal/lib/hx509/crypto.c
+++ b/source4/heimdal/lib/hx509/crypto.c
@@ -1506,8 +1506,8 @@ static struct hx509_private_key_ops *private_algs[] = {
     NULL
 };
 
-static hx509_private_key_ops *
-find_private_alg(const heim_oid *oid)
+hx509_private_key_ops *
+hx509_find_private_alg(const heim_oid *oid)
 {
     int i;
     for (i = 0; private_algs[i]; i++) {
@@ -1770,7 +1770,7 @@ _hx509_parse_private_key(hx509_context context,
 
     *private_key = NULL;
 
-    ops = find_private_alg(&keyai->algorithm);
+    ops = hx509_find_private_alg(&keyai->algorithm);
     if (ops == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_SIG_ALG_NO_SUPPORTED;
@@ -1865,7 +1865,7 @@ _hx509_generate_private_key(hx509_context context,
 
     *private_key = NULL;
 
-    ops = find_private_alg(ctx->key_oid);
+    ops = hx509_find_private_alg(ctx->key_oid);
     if (ops == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_SIG_ALG_NO_SUPPORTED;
diff --git a/source4/heimdal/lib/hx509/hx509.h b/source4/heimdal/lib/hx509/hx509.h
index 1a5e2f3080..3954b54b1c 100644
--- a/source4/heimdal/lib/hx509/hx509.h
+++ b/source4/heimdal/lib/hx509/hx509.h
@@ -48,6 +48,7 @@ typedef struct hx509_crypto_data *hx509_crypto;
 typedef struct hx509_lock_data *hx509_lock;
 typedef struct hx509_name_data *hx509_name;
 typedef struct hx509_private_key *hx509_private_key;
+typedef struct hx509_private_key_ops hx509_private_key_ops;
 typedef struct hx509_validate_ctx_data *hx509_validate_ctx;
 typedef struct hx509_verify_ctx_data *hx509_verify_ctx;
 typedef struct hx509_revoke_ctx_data *hx509_revoke_ctx;
diff --git a/source4/heimdal/lib/hx509/hx_locl.h b/source4/heimdal/lib/hx509/hx_locl.h
index 3e3ab23c6d..a0a5235c75 100644
--- a/source4/heimdal/lib/hx509/hx_locl.h
+++ b/source4/heimdal/lib/hx509/hx_locl.h
@@ -82,7 +82,6 @@ typedef struct hx509_path hx509_path;
 
 typedef void (*_hx509_cert_release_func)(struct hx509_cert_data *, void *);
 
-typedef struct hx509_private_key_ops hx509_private_key_ops;
 
 #include "sel.h"
 
diff --git a/source4/heimdal/lib/hx509/version-script.map b/source4/heimdal/lib/hx509/version-script.map
index c0666d81c9..4748fa1d0f 100644
--- a/source4/heimdal/lib/hx509/version-script.map
+++ b/source4/heimdal/lib/hx509/version-script.map
@@ -4,6 +4,7 @@ HEIMDAL_X509_1.2 {
 	global:
 		_hx509_cert_assign_key;
 		_hx509_cert_private_key;
+		_hx509_cert_public_encrypt;
 		_hx509_certs_keys_free;
 		_hx509_certs_keys_get;
 		_hx509_expr_eval;
@@ -16,8 +17,12 @@ HEIMDAL_X509_1.2 {
 		_hx509_generate_private_key_is_ca;
 		_hx509_map_file_os;
 		_hx509_name_from_Name;
+		_hx509_parse_private_key;
+		_hx509_private_key_assign_rsa;
 		_hx509_private_key2SPKI;
 		_hx509_private_key_free;
+		_hx509_private_key_init;
+		_hx509_private_key_private_decrypt;
 		_hx509_private_key_ref;
 		_hx509_request_add_dns_name;
 		_hx509_request_add_email;
@@ -146,6 +151,7 @@ HEIMDAL_X509_1.2 {
 		hx509_err;
 		hx509_free_error_string;
 		hx509_free_octet_string_list;
+		hx509_find_private_alg;
 		hx509_general_name_unparse;
 		hx509_get_error_string;
 		hx509_get_one_cert;
diff --git a/source4/heimdal/lib/krb5/config_file.c b/source4/heimdal/lib/krb5/config_file.c
index d08c5b5851..89f778823d 100644
--- a/source4/heimdal/lib/krb5/config_file.c
+++ b/source4/heimdal/lib/krb5/config_file.c
@@ -877,12 +877,7 @@ next_component_string(char * begin, char * delims, char **state)
 
     end = begin;
     while (*end == '"') {
-        char * t;
-        while ((t = strchr(end + 1, '"')) != NULL && *(t - 1) == '\\') {
-            --t;
-            memmove(t, t + 1, strlen(t));
-            end = t;
-        }
+        char * t = strchr(end + 1, '"');
 
         if (t)
             end = ++t;
diff --git a/source4/heimdal/lib/krb5/crypto-algs.c b/source4/heimdal/lib/krb5/crypto-algs.c
index 5bd14ce09d..5e468f360a 100644
--- a/source4/heimdal/lib/krb5/crypto-algs.c
+++ b/source4/heimdal/lib/krb5/crypto-algs.c
@@ -74,9 +74,9 @@ struct encryption_type *_krb5_etypes[] = {
     &_krb5_enctype_old_des3_cbc_sha1,
 #endif
 #ifdef HEIM_WEAK_CRYPTO
-    &_krb5_enctype_des_cbc_crc,
-    &_krb5_enctype_des_cbc_md4,
     &_krb5_enctype_des_cbc_md5,
+    &_krb5_enctype_des_cbc_md4,
+    &_krb5_enctype_des_cbc_crc,
     &_krb5_enctype_des_cbc_none,
     &_krb5_enctype_des_cfb64_none,
     &_krb5_enctype_des_pcbc_none,
diff --git a/source4/heimdal/lib/krb5/keytab.c b/source4/heimdal/lib/krb5/keytab.c
index d1ffd57738..e060774533 100644
--- a/source4/heimdal/lib/krb5/keytab.c
+++ b/source4/heimdal/lib/krb5/keytab.c
@@ -164,6 +164,36 @@ krb5_kt_register(krb5_context context,
     return 0;
 }
 
+static const char *
+keytab_name(const char * name, const char ** ptype, size_t * ptype_len)
+{
+    const char * residual;
+
+    residual = strchr(name, ':');
+
+    if (residual == NULL
+
+#ifdef _WIN32
+
+        /* Avoid treating <drive>:<path> as a keytab type
+         * specification */
+
+        || name + 1 == residual
+#endif
+        ) {
+
+        *ptype = "FILE";
+        *ptype_len = strlen(*ptype);
+        residual = name;
+    } else {
+        *ptype = name;
+        *ptype_len = residual - name;
+        residual++;
+    }
+
+    return residual;
+}
+
 /**
  * Resolve the keytab name (of the form `type:residual') in `name'
  * into a keytab in `id'.
@@ -189,16 +219,7 @@ krb5_kt_resolve(krb5_context context,
     size_t type_len;
     krb5_error_code ret;
 
-    residual = strchr(name, ':');
-    if(residual == NULL) {
-	type = "FILE";
-	type_len = strlen(type);
-	residual = name;
-    } else {
-	type = name;
-	type_len = residual - name;
-	residual++;
-    }
+    residual = keytab_name(name, &type, &type_len);
 
     for(i = 0; i < context->num_kt_types; i++) {
 	if(strncasecmp(type, context->kt_types[i].prefix, type_len) == 0)
diff --git a/source4/heimdal/lib/krb5/keytab_any.c b/source4/heimdal/lib/krb5/keytab_any.c
index d056964769..d5ac4883db 100644
--- a/source4/heimdal/lib/krb5/keytab_any.c
+++ b/source4/heimdal/lib/krb5/keytab_any.c
@@ -61,7 +61,7 @@ any_resolve(krb5_context context, const char *name, krb5_keytab id)
     char buf[256];
 
     while (strsep_copy(&name, ",", buf, sizeof(buf)) != -1) {
-	a = malloc(sizeof(*a));
+	a = calloc(1, sizeof(*a));
 	if (a == NULL) {
 	    ret = ENOMEM;
 	    goto fail;
diff --git a/source4/heimdal/lib/krb5/pkinit.c b/source4/heimdal/lib/krb5/pkinit.c
index 1bf922baf6..7a8502727e 100644
--- a/source4/heimdal/lib/krb5/pkinit.c
+++ b/source4/heimdal/lib/krb5/pkinit.c
@@ -2214,7 +2214,21 @@ _krb5_parse_moduli(krb5_context context, const char *file,
     if (file == NULL)
 	file = MODULI_FILE;
 
+#ifdef KRB5_USE_PATH_TOKENS
+    {
+        char * exp_file;
+
+        if (_krb5_expand_path_tokens(context, file, &exp_file) == 0) {
+            f = fopen(exp_file, "r");
+            krb5_xfree(exp_file);
+        } else {
+            f = NULL;
+        }
+    }
+#else
     f = fopen(file, "r");
+#endif
+
     if (f == NULL) {
 	*moduli = m;
 	return 0;
diff --git a/source4/heimdal/lib/roken/roken-common.h b/source4/heimdal/lib/roken/roken-common.h
index 6a09da40e4..a819d510d0 100644
--- a/source4/heimdal/lib/roken/roken-common.h
+++ b/source4/heimdal/lib/roken/roken-common.h
@@ -148,14 +148,7 @@
 #define MAXPATHLEN (1024+4)
 #endif
 
-#else/* !_WIN32 */
-
-/* Minimize conflict with WinNT.h */
-#ifdef SLIST_ENTRY
-#undef SLIST_ENTRY
-#endif
-
-#endif	/* _WIN32 */
+#endif	/* !_WIN32 */
 
 #ifndef PATH_MAX
 #define PATH_MAX MAX_PATH
diff --git a/source4/heimdal/lib/roken/roken.h.in b/source4/heimdal/lib/roken/roken.h.in
index e7cb1598fb..1ca3c10dc9 100644
--- a/source4/heimdal/lib/roken/roken.h.in
+++ b/source4/heimdal/lib/roken/roken.h.in
@@ -262,12 +262,18 @@ struct sockaddr_dl;
 #endif
 
 #ifndef HAVE_SSIZE_T
+#ifndef SSIZE_T_DEFINED
+#ifdef ssize_t
+#undef ssize_t
+#endif
 #ifdef _WIN64
 typedef __int64 ssize_t;
 #else
 typedef int ssize_t;
 #endif
-#endif
+#define SSIZE_T_DEFINED
+#endif  /* SSIZE_T_DEFINED */
+#endif  /* HAVE_SSIZE_T */
 
 #include <roken-common.h>