--- krb5-1.2.4.orig/src/aclocal.m4
+++ krb5-1.2.4/src/aclocal.m4
@@ -1,5 +1,5 @@
 AC_PREREQ(2.12)
-dnl
+<<dnl
 dnl Figure out the top of the source and build trees.  We depend on localdir
 dnl being a relative pathname; we could make it general later, but for now 
 dnl this is good enough.
@@ -1364,10 +1364,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/appl/bsd/Makefile.in
+++ krb5-1.2.4/src/appl/bsd/Makefile.in
@@ -19,9 +19,9 @@
 OBJS= krcp.o krlogin.o krsh.o kcmd.o forward.o  $(SETENVOBJ) \
 	login.o krshd.o krlogind.o $(V4RCPO) $(LIBOBJS)
 
-UCB_RLOGIN = @UCB_RLOGIN@
-UCB_RSH = @UCB_RSH@
-UCB_RCP = @UCB_RCP@
+UCB_RLOGIN = /usr/bin/netkit-rlogin
+UCB_RSH = /usr/bin/netkit-rsh
+UCB_RCP = /usr/bin/rpc
 
 RSH=	-DKRB5_PATH_RLOGIN=\"$(CLIENT_BINDIR)/rlogin\"
 BSD=	-DUCB_RLOGIN=\"$(UCB_RLOGIN)\" \
--- krb5-1.2.4.orig/src/appl/bsd/configure
+++ krb5-1.2.4/src/appl/bsd/configure
@@ -4288,10 +4288,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/appl/bsd/krlogin.c
+++ krb5-1.2.4/src/appl/bsd/krlogin.c
@@ -137,6 +137,12 @@
 #include <sys/ptyvar.h>
 #endif
 #endif
+#undef TIOCGLTC
+/* how do we tell apart irix 5 and irix 4? */
+#if defined(__sgi) && defined(__mips)
+/* IRIX 5: TIOCGLTC doesn't actually work */
+#undef TIOCGLTC
+#endif
 
 #ifndef TIOCPKT_NOSTOP
 /* These values are over-the-wire protocol, *not* local values */
--- krb5-1.2.4.orig/src/appl/gssftp/configure
+++ krb5-1.2.4/src/appl/gssftp/configure
@@ -4070,10 +4070,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/appl/telnet/configure.in
+++ krb5-1.2.4/src/appl/telnet/configure.in
@@ -1,4 +1,7 @@
 AC_INIT(configure.in)
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 CONFIG_RULES
 AC_CONFIG_SUBDIRS(libtelnet telnet telnetd)
 V5_AC_OUTPUT_MAKEFILE
--- krb5-1.2.4.orig/src/appl/telnet/libtelnet/configure
+++ krb5-1.2.4/src/appl/telnet/libtelnet/configure
@@ -545,6 +545,9 @@
 fi
 
 
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 ac_reltopdir=../../../.
 case "$ac_reltopdir" in 
 /*)
@@ -592,7 +595,7 @@
 fi
 
 echo $ac_n "checking for C compiler""... $ac_c" 1>&6
-echo "configure:596: checking for C compiler" >&5
+echo "configure:599: checking for C compiler" >&5
 if test "$with_cc" != ""; then
   if test "$ac_cv_prog_cc" != "" && test "$ac_cv_prog_cc" != "$with_cc"; then
     { echo "configure: error: Specified compiler doesn't match cached compiler name;
@@ -606,14 +609,14 @@
 else
     test -z "$CC" && CC=cc
   cat > conftest.$ac_ext <<EOF
-#line 610 "configure"
+#line 613 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("hi\n");
 ; return 0; }
 EOF
-if { (eval echo configure:617: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:620: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -631,7 +634,7 @@
 # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:635: checking for $ac_word" >&5
+echo "configure:638: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -661,7 +664,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:665: checking for $ac_word" >&5
+echo "configure:668: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -712,7 +715,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:716: checking for $ac_word" >&5
+echo "configure:719: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -744,7 +747,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:748: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:751: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -755,12 +758,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 759 "configure"
+#line 762 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:764: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:767: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -786,12 +789,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:790: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:793: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:795: checking whether we are using GNU C" >&5
+echo "configure:798: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -800,7 +803,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:804: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:807: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -819,7 +822,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:823: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:826: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -942,12 +945,12 @@
 
 
  echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:946: checking for working const" >&5
+echo "configure:949: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 951 "configure"
+#line 954 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -996,7 +999,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1000: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1003: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1031,12 +1034,12 @@
    # Most operating systems have gethostbyname() in the default searched
    # libraries (i.e. libc):
    echo $ac_n "checking for gethostbyname""... $ac_c" 1>&6
-echo "configure:1035: checking for gethostbyname" >&5
+echo "configure:1038: checking for gethostbyname" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gethostbyname'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1040 "configure"
+#line 1043 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gethostbyname(); below.  */
@@ -1059,7 +1062,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1063: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1066: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_gethostbyname=yes"
 else
@@ -1078,7 +1081,7 @@
   echo "$ac_t""no" 1>&6
 # Some OSes (eg. Solaris) place it in libnsl:
      echo $ac_n "checking for gethostbyname in -lnsl""... $ac_c" 1>&6
-echo "configure:1082: checking for gethostbyname in -lnsl" >&5
+echo "configure:1085: checking for gethostbyname in -lnsl" >&5
 ac_lib_var=`echo nsl'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1086,7 +1089,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lnsl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1090 "configure"
+#line 1093 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1097,7 +1100,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1101: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1104: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1124,7 +1127,7 @@
   echo "$ac_t""no" 1>&6
 # Some strange OSes (SINIX) have it in libsocket:
        echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1128: checking for gethostbyname in -lsocket" >&5
+echo "configure:1131: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1132,7 +1135,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1136 "configure"
+#line 1139 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1143,7 +1146,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1147: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1150: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1172,7 +1175,7 @@
           # AC_CHECK_LIB's API is essentially broken so the following
           # ugliness is necessary:
           echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1176: checking for gethostbyname in -lsocket" >&5
+echo "configure:1179: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1180,7 +1183,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1184 "configure"
+#line 1187 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1191,7 +1194,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1195: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1198: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1210,7 +1213,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for gethostbyname in -lresolv""... $ac_c" 1>&6
-echo "configure:1214: checking for gethostbyname in -lresolv" >&5
+echo "configure:1217: checking for gethostbyname in -lresolv" >&5
 ac_lib_var=`echo resolv'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1218,7 +1221,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1222 "configure"
+#line 1225 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1229,7 +1232,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1233: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1236: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1261,12 +1264,12 @@
 fi
 
   echo $ac_n "checking for socket""... $ac_c" 1>&6
-echo "configure:1265: checking for socket" >&5
+echo "configure:1268: checking for socket" >&5
 if eval "test \"`echo '$''{'ac_cv_func_socket'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1270 "configure"
+#line 1273 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char socket(); below.  */
@@ -1289,7 +1292,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1293: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1296: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_socket=yes"
 else
@@ -1307,7 +1310,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1311: checking for socket in -lsocket" >&5
+echo "configure:1314: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1315,7 +1318,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1319 "configure"
+#line 1322 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1326,7 +1329,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1330: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1333: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1352,7 +1355,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1356: checking for socket in -lsocket" >&5
+echo "configure:1359: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1360,7 +1363,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1364 "configure"
+#line 1367 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1371,7 +1374,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1375: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1378: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1397,7 +1400,7 @@
 
   
 echo $ac_n "checking if DNS Kerberos lookup support should be compiled in""... $ac_c" 1>&6
-echo "configure:1401: checking if DNS Kerberos lookup support should be compiled in" >&5
+echo "configure:1404: checking if DNS Kerberos lookup support should be compiled in" >&5
 
   # Check whether --enable-dns or --disable-dns was given.
 if test "${enable_dns+set}" = set; then
@@ -1466,12 +1469,12 @@
 
   if test "$enable_dns" = yes ; then
     echo $ac_n "checking for res_search""... $ac_c" 1>&6
-echo "configure:1470: checking for res_search" >&5
+echo "configure:1473: checking for res_search" >&5
 if eval "test \"`echo '$''{'ac_cv_func_res_search'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1475 "configure"
+#line 1478 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char res_search(); below.  */
@@ -1494,7 +1497,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1498: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1501: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_res_search=yes"
 else
@@ -1512,7 +1515,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for res_search in -lresolv""... $ac_c" 1>&6
-echo "configure:1516: checking for res_search in -lresolv" >&5
+echo "configure:1519: checking for res_search in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_search | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1520,7 +1523,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1524 "configure"
+#line 1527 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1531,7 +1534,7 @@
 res_search()
 ; return 0; }
 EOF
-if { (eval echo configure:1535: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1538: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1571,7 +1574,7 @@
 if test "$with_hesiod" != "no"; then
 	HESIOD_DEFS=-DHESIOD
 	echo $ac_n "checking for res_send in -lresolv""... $ac_c" 1>&6
-echo "configure:1575: checking for res_send in -lresolv" >&5
+echo "configure:1578: checking for res_send in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_send | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1579,7 +1582,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1583 "configure"
+#line 1586 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1590,7 +1593,7 @@
 res_send()
 ; return 0; }
 EOF
-if { (eval echo configure:1594: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1597: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1654,7 +1657,7 @@
 # Extract the first word of "ar", so it can be a program name with args.
 set dummy ar; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1658: checking for $ac_word" >&5
+echo "configure:1661: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_ARCHIVE'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1684,7 +1687,7 @@
 # Extract the first word of "ar", so it can be a program name with args.
 set dummy ar; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1688: checking for $ac_word" >&5
+echo "configure:1691: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_ARADD'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1714,7 +1717,7 @@
 # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1718: checking for $ac_word" >&5
+echo "configure:1721: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_RANLIB'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1744,12 +1747,12 @@
 for ac_func in strcasecmp strdup setsid strerror strftime getopt herror parsetos
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:1748: checking for $ac_func" >&5
+echo "configure:1751: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1753 "configure"
+#line 1756 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -1772,7 +1775,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1776: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1779: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -1801,12 +1804,12 @@
 for ac_func in setenv unsetenv getenv gettosbyname cgetent
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:1805: checking for $ac_func" >&5
+echo "configure:1808: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1810 "configure"
+#line 1813 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -1829,7 +1832,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1833: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1836: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -1854,7 +1857,7 @@
 done
 
 echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6
-echo "configure:1858: checking how to run the C preprocessor" >&5
+echo "configure:1861: checking how to run the C preprocessor" >&5
 # On Suns, sometimes $CPP names a directory.
 if test -n "$CPP" && test -d "$CPP"; then
   CPP=
@@ -1869,13 +1872,13 @@
   # On the NeXT, cc -E runs the code through the compiler's parser,
   # not just through cpp.
   cat > conftest.$ac_ext <<EOF
-#line 1873 "configure"
+#line 1876 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:1879: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:1882: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -1886,13 +1889,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -E -traditional-cpp"
   cat > conftest.$ac_ext <<EOF
-#line 1890 "configure"
+#line 1893 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:1896: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:1899: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -1903,13 +1906,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -nologo -E"
   cat > conftest.$ac_ext <<EOF
-#line 1907 "configure"
+#line 1910 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:1913: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:1916: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -1937,17 +1940,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:1941: checking for $ac_hdr" >&5
+echo "configure:1944: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1946 "configure"
+#line 1949 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:1951: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:1954: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -1979,12 +1982,12 @@
   LIBOBJS="$LIBOBJS setenv.o"
 fi
 echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:1983: checking for working const" >&5
+echo "configure:1986: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1988 "configure"
+#line 1991 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -2033,7 +2036,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2037: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2040: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
--- krb5-1.2.4.orig/src/appl/telnet/libtelnet/configure.in
+++ krb5-1.2.4/src/appl/telnet/libtelnet/configure.in
@@ -1,4 +1,7 @@
 AC_INIT(auth.c)
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 CONFIG_RULES
 AC_PROG_ARCHIVE
 AC_PROG_ARCHIVE_ADD
--- krb5-1.2.4.orig/src/appl/telnet/telnet/ChangeLog
+++ krb5-1.2.4/src/appl/telnet/telnet/ChangeLog
@@ -1,3 +1,9 @@
+2001-11-24  Sam Hartman  <hartmans@mit.edu>
+
+	* commands.c main.c:  telnet help should telnet to a host called
+	help not print an incorrect usage message; patch from  Graeme
+	Mathieson <graeme@mathie.cx> 
+
 2000-05-11  Nalin Dahyabhai  <nalin@redhat.com>
 
 	* commands.c (makeargv): Don't overflow buffer "saveline".
--- krb5-1.2.4.orig/src/appl/telnet/telnet/configure
+++ krb5-1.2.4/src/appl/telnet/telnet/configure
@@ -2854,10 +2854,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/appl/telnet/telnet/commands.c
+++ krb5-1.2.4/src/appl/telnet/telnet/commands.c
@@ -2397,8 +2397,6 @@
     cmd = *argv;
     --argc; ++argv;
     while (argc) {
-	if (isprefix(*argv, "help") || isprefix(*argv, "?"))
-	    goto usage;
 	if (strcmp(*argv, "-l") == 0) {
 	    --argc; ++argv;
 	    if (argc == 0)
@@ -2423,8 +2421,7 @@
 	    continue;
 	}
     usage:
-	printf("usage: %s [-l user] [-a] host-name [port]\r\n", cmd);
-	return 0;
+	return 2;
     }
     if (hostp == 0)
 	goto usage;
--- krb5-1.2.4.orig/src/appl/telnet/telnet/main.c
+++ krb5-1.2.4/src/appl/telnet/telnet/main.c
@@ -324,10 +324,14 @@
 
 		if (setjmp(toplevel) != 0)
 			Exit(0);
-		if (tn(argp - args, args) == 1)
-			return (0);
-		else
-			return (1);
+		{
+			int ret = tn(argp - args, args);
+			switch (ret) {
+				case 1: return 0;
+				case 2: usage();
+				default: return 1;
+			}
+		}
 	}
 	(void)setjmp(toplevel);
 	for (;;) {
--- krb5-1.2.4.orig/src/appl/telnet/telnetd/configure
+++ krb5-1.2.4/src/appl/telnet/telnetd/configure
@@ -2598,10 +2598,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/appl/telnet/configure
+++ krb5-1.2.4/src/appl/telnet/configure
@@ -545,6 +545,9 @@
 fi
 
 
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 ac_reltopdir=../../.
 case "$ac_reltopdir" in 
 /*)
@@ -592,7 +595,7 @@
 fi
 
 echo $ac_n "checking for C compiler""... $ac_c" 1>&6
-echo "configure:596: checking for C compiler" >&5
+echo "configure:599: checking for C compiler" >&5
 if test "$with_cc" != ""; then
   if test "$ac_cv_prog_cc" != "" && test "$ac_cv_prog_cc" != "$with_cc"; then
     { echo "configure: error: Specified compiler doesn't match cached compiler name;
@@ -606,14 +609,14 @@
 else
     test -z "$CC" && CC=cc
   cat > conftest.$ac_ext <<EOF
-#line 610 "configure"
+#line 613 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("hi\n");
 ; return 0; }
 EOF
-if { (eval echo configure:617: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:620: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -631,7 +634,7 @@
 # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:635: checking for $ac_word" >&5
+echo "configure:638: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -661,7 +664,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:665: checking for $ac_word" >&5
+echo "configure:668: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -712,7 +715,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:716: checking for $ac_word" >&5
+echo "configure:719: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -744,7 +747,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:748: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:751: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -755,12 +758,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 759 "configure"
+#line 762 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:764: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:767: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -786,12 +789,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:790: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:793: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:795: checking whether we are using GNU C" >&5
+echo "configure:798: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -800,7 +803,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:804: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:807: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -819,7 +822,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:823: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:826: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -942,12 +945,12 @@
 
 
  echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:946: checking for working const" >&5
+echo "configure:949: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 951 "configure"
+#line 954 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -996,7 +999,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1000: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1003: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1031,12 +1034,12 @@
    # Most operating systems have gethostbyname() in the default searched
    # libraries (i.e. libc):
    echo $ac_n "checking for gethostbyname""... $ac_c" 1>&6
-echo "configure:1035: checking for gethostbyname" >&5
+echo "configure:1038: checking for gethostbyname" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gethostbyname'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1040 "configure"
+#line 1043 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gethostbyname(); below.  */
@@ -1059,7 +1062,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1063: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1066: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_gethostbyname=yes"
 else
@@ -1078,7 +1081,7 @@
   echo "$ac_t""no" 1>&6
 # Some OSes (eg. Solaris) place it in libnsl:
      echo $ac_n "checking for gethostbyname in -lnsl""... $ac_c" 1>&6
-echo "configure:1082: checking for gethostbyname in -lnsl" >&5
+echo "configure:1085: checking for gethostbyname in -lnsl" >&5
 ac_lib_var=`echo nsl'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1086,7 +1089,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lnsl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1090 "configure"
+#line 1093 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1097,7 +1100,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1101: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1104: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1124,7 +1127,7 @@
   echo "$ac_t""no" 1>&6
 # Some strange OSes (SINIX) have it in libsocket:
        echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1128: checking for gethostbyname in -lsocket" >&5
+echo "configure:1131: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1132,7 +1135,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1136 "configure"
+#line 1139 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1143,7 +1146,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1147: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1150: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1172,7 +1175,7 @@
           # AC_CHECK_LIB's API is essentially broken so the following
           # ugliness is necessary:
           echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1176: checking for gethostbyname in -lsocket" >&5
+echo "configure:1179: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1180,7 +1183,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1184 "configure"
+#line 1187 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1191,7 +1194,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1195: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1198: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1210,7 +1213,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for gethostbyname in -lresolv""... $ac_c" 1>&6
-echo "configure:1214: checking for gethostbyname in -lresolv" >&5
+echo "configure:1217: checking for gethostbyname in -lresolv" >&5
 ac_lib_var=`echo resolv'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1218,7 +1221,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1222 "configure"
+#line 1225 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1229,7 +1232,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1233: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1236: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1261,12 +1264,12 @@
 fi
 
   echo $ac_n "checking for socket""... $ac_c" 1>&6
-echo "configure:1265: checking for socket" >&5
+echo "configure:1268: checking for socket" >&5
 if eval "test \"`echo '$''{'ac_cv_func_socket'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1270 "configure"
+#line 1273 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char socket(); below.  */
@@ -1289,7 +1292,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1293: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1296: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_socket=yes"
 else
@@ -1307,7 +1310,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1311: checking for socket in -lsocket" >&5
+echo "configure:1314: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1315,7 +1318,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1319 "configure"
+#line 1322 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1326,7 +1329,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1330: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1333: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1352,7 +1355,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1356: checking for socket in -lsocket" >&5
+echo "configure:1359: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1360,7 +1363,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1364 "configure"
+#line 1367 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1371,7 +1374,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1375: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1378: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1397,7 +1400,7 @@
 
   
 echo $ac_n "checking if DNS Kerberos lookup support should be compiled in""... $ac_c" 1>&6
-echo "configure:1401: checking if DNS Kerberos lookup support should be compiled in" >&5
+echo "configure:1404: checking if DNS Kerberos lookup support should be compiled in" >&5
 
   # Check whether --enable-dns or --disable-dns was given.
 if test "${enable_dns+set}" = set; then
@@ -1466,12 +1469,12 @@
 
   if test "$enable_dns" = yes ; then
     echo $ac_n "checking for res_search""... $ac_c" 1>&6
-echo "configure:1470: checking for res_search" >&5
+echo "configure:1473: checking for res_search" >&5
 if eval "test \"`echo '$''{'ac_cv_func_res_search'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1475 "configure"
+#line 1478 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char res_search(); below.  */
@@ -1494,7 +1497,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1498: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1501: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_res_search=yes"
 else
@@ -1512,7 +1515,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for res_search in -lresolv""... $ac_c" 1>&6
-echo "configure:1516: checking for res_search in -lresolv" >&5
+echo "configure:1519: checking for res_search in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_search | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1520,7 +1523,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1524 "configure"
+#line 1527 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1531,7 +1534,7 @@
 res_search()
 ; return 0; }
 EOF
-if { (eval echo configure:1535: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1538: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1571,7 +1574,7 @@
 if test "$with_hesiod" != "no"; then
 	HESIOD_DEFS=-DHESIOD
 	echo $ac_n "checking for res_send in -lresolv""... $ac_c" 1>&6
-echo "configure:1575: checking for res_send in -lresolv" >&5
+echo "configure:1578: checking for res_send in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_send | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1579,7 +1582,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1583 "configure"
+#line 1586 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1590,7 +1593,7 @@
 res_send()
 ; return 0; }
 EOF
-if { (eval echo configure:1594: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1597: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
--- krb5-1.2.4.orig/src/appl/configure
+++ krb5-1.2.4/src/appl/configure
@@ -2213,10 +2213,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/kdc/configure
+++ krb5-1.2.4/src/kdc/configure
@@ -2694,10 +2694,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/kdc/do_as_req.c
+++ krb5-1.2.4/src/kdc/do_as_req.c
@@ -48,7 +48,7 @@
 static krb5_error_code prepare_error_as PROTOTYPE((krb5_kdc_req *,
 						   int,
 						   krb5_data *, 
-						   krb5_data **));
+						   krb5_data **, const char *));
 
 /*ARGSUSED*/
 krb5_error_code
@@ -441,11 +441,14 @@
 	       errcode ? ", " : "",
 	       errcode ? error_message(errcode) : "");
     if (errcode) {
+	if (status == 0)
+	    status = error_message (errcode);
 	errcode -= ERROR_TABLE_BASE_krb5;
 	if (errcode < 0 || errcode > 128)
 	    errcode = KRB_ERR_GENERIC;
 	    
-	errcode = prepare_error_as(request, errcode, &e_data, response);
+	errcode = prepare_error_as(request, errcode, &e_data, response,
+				   status);
     }
 
     krb5_free_keyblock_contents(kdc_context, &encrypting_key);
@@ -488,11 +491,12 @@
 }
 
 static krb5_error_code
-prepare_error_as (request, error, e_data, response)
+prepare_error_as (request, error, e_data, response, status)
 register krb5_kdc_req *request;
 int error;
 krb5_data *e_data;
 krb5_data **response;
+const char *status;
 {
     krb5_error errpkt;
     krb5_error_code retval;
@@ -507,10 +511,10 @@
     errpkt.error = error;
     errpkt.server = request->server;
     errpkt.client = request->client;
-    errpkt.text.length = strlen(error_message(error+KRB5KDC_ERR_NONE))+1;
+    errpkt.text.length = strlen(status)+1;
     if (!(errpkt.text.data = malloc(errpkt.text.length)))
 	return ENOMEM;
-    (void) strcpy(errpkt.text.data, error_message(error+KRB5KDC_ERR_NONE));
+    (void) strcpy(errpkt.text.data, status);
 
     if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
 	free(errpkt.text.data);
--- krb5-1.2.4.orig/src/kdc/do_tgs_req.c
+++ krb5-1.2.4/src/kdc/do_tgs_req.c
@@ -54,7 +54,7 @@
 						    krb5_ticket *,
 						    int,
 						    const char *,
-						    krb5_data **));
+						    krb5_data **, const char *));
 
 /*ARGSUSED*/
 krb5_error_code
@@ -666,12 +666,14 @@
     }
     
     if (errcode) {
+	if (status == 0)
+	    status = error_message (errcode);
 	errcode -= ERROR_TABLE_BASE_krb5;
 	if (errcode < 0 || errcode > 128)
 	    errcode = KRB_ERR_GENERIC;
 	    
 	retval = prepare_error_tgs(request, header_ticket, errcode,
-				   fromstring, response);
+				   fromstring, response, status);
     }
     
     if (header_ticket)
@@ -693,12 +695,13 @@
 }
 
 static krb5_error_code
-prepare_error_tgs (request, ticket, error, ident, response)
+prepare_error_tgs (request, ticket, error, ident, response, status)
 register krb5_kdc_req *request;
 krb5_ticket *ticket;
 int error;
 const char *ident;
 krb5_data **response;
+const char *status;
 {
     krb5_error errpkt;
     krb5_error_code retval;
@@ -716,10 +719,10 @@
 	errpkt.client = ticket->enc_part2->client;
     else
 	errpkt.client = 0;
-    errpkt.text.length = strlen(error_message(error+KRB5KDC_ERR_NONE))+1;
+    errpkt.text.length = strlen(status) + 1;
     if (!(errpkt.text.data = malloc(errpkt.text.length)))
 	return ENOMEM;
-    (void) strcpy(errpkt.text.data, error_message(error+KRB5KDC_ERR_NONE));
+    (void) strcpy(errpkt.text.data, status);
 
     if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
 	free(errpkt.text.data);
--- krb5-1.2.4.orig/src/kdc/kdc_preauth.c
+++ krb5-1.2.4/src/kdc/kdc_preauth.c
@@ -533,7 +533,7 @@
     while (1) {
 	retval = krb5_dbe_search_enctype(context, client, &start, -1,
 					 -1, 0, &client_key);
-	if (retval == ENOENT)
+	if (retval == KRB5_KDB_NO_MATCHING_KEY)
 	    break;
 	if (retval)
 	    goto cleanup;
--- krb5-1.2.4.orig/src/kdc/kdc_util.c
+++ krb5-1.2.4/src/kdc/kdc_util.c
@@ -157,7 +157,8 @@
 krb5_boolean krb5_is_tgs_principal(principal)
 	krb5_principal	principal;
 {
-	if ((krb5_princ_component(kdc_context, principal, 0)->length ==
+	if (krb5_princ_size(kdc_context, principal) > 0 &&
+	    (krb5_princ_component(kdc_context, principal, 0)->length ==
 	     KRB5_TGS_NAME_SIZE) &&
 	    (!memcmp(krb5_princ_component(kdc_context, principal, 0)->data,
 		     KRB5_TGS_NAME, KRB5_TGS_NAME_SIZE)))
@@ -1195,7 +1196,8 @@
 	    return KRB_AP_ERR_NOT_US;
 	}
 	/* ...and that the second component matches the server realm... */
-	if ((krb5_princ_component(kdc_context, ticket->server, 1)->length !=
+	if (krb5_princ_size(kdc_context, ticket->server) <= 1 ||
+	    (krb5_princ_component(kdc_context, ticket->server, 1)->length !=
 	     krb5_princ_realm(kdc_context, request->server)->length) ||
 	    memcmp(krb5_princ_component(kdc_context, ticket->server, 1)->data,
 		   krb5_princ_realm(kdc_context, request->server)->data,
--- krb5-1.2.4.orig/src/kdc/kdc_util.h
+++ krb5-1.2.4/src/kdc/kdc_util.h
@@ -183,6 +183,7 @@
 				      const krb5_fulladdr *,
 				      int is_secondary,
 				      krb5_data **));
+void enable_v4_crossrealm(char *);
 #else
 #define process_v4(foo,bar,quux,foobar)	KRB5KRB_AP_ERR_BADVERSION
 #endif
--- krb5-1.2.4.orig/src/kdc/kerberos_v4.c
+++ krb5-1.2.4/src/kdc/kerberos_v4.c
@@ -149,7 +149,7 @@
 
 void kerberos_v4 PROTOTYPE((struct sockaddr_in *, KTEXT));
 void kerb_err_reply PROTOTYPE((struct sockaddr_in *, KTEXT, long, char *));
-static int set_tgtkey PROTOTYPE((char *, krb5_kvno));
+static int set_tgtkey PROTOTYPE((char *, krb5_kvno, krb5_boolean));
 
 /* Attributes converted from V5 to V4 - internal representation */
 #define V4_KDB_REQUIRES_PREAUTH  0x1
@@ -182,6 +182,7 @@
 
 static const int v4mode_table_nents = sizeof(v4mode_table)/
 				      sizeof(v4mode_table[0]);
+static int allow_v4_crossrealm = 0;
 
 void process_v4_mode(progname, string)
     const char          *progname;
@@ -210,6 +211,11 @@
     return;
 }
 
+void enable_v4_crossrealm ( char *programname) {
+    allow_v4_crossrealm = 1;
+    krb5_klog_syslog(LOG_ERR, "Enabling v4 cross-realm compatibility; this is a known security hole");
+}
+
 krb5_error_code
 process_v4( pkt, client_fulladdr, is_secondary, resp)
 const krb5_data *pkt;
@@ -401,6 +407,14 @@
 #define MIN5 300
 #define HR21 255
 
+/*
+ * Previously this code returned either a v4 key or a v5 key  and you
+ * could tell from the enctype of the v5 key whether the v4 key was
+ * useful.  Now we return both keys so the code can try both des3 and
+ * des decryption.  We fail if the ticket doesn't have a v4 key.
+ * Also, note as a side effect, the v5 key is basically useless  in
+ * the client case.  It is still returned so the caller can free it.
+ */
 static int
 kerb_get_principal(name, inst, principal, maxn, more, k5key, kvno, issrv)
     char   *name;               /* could have wild card */
@@ -482,8 +496,28 @@
 	    return(0);
 	}
     } else {
-	/* XXX yes I know this is a hardcoded search order */
-	if (krb5_dbe_find_enctype(kdc_context, &entries,
+	if ( krb5_dbe_find_enctype(kdc_context, &entries,
+				  ENCTYPE_DES_CBC_CRC,
+				  KRB5_KDB_SALTTYPE_V4, kvno, &pkey) &&
+	    krb5_dbe_find_enctype(kdc_context, &entries,
+				  ENCTYPE_DES_CBC_CRC,
+				  -1, kvno, &pkey)) {
+	    lt = klog(L_KRB_PERR,
+		      "KDC V4: failed to find key for %s.%s #%d",
+		      name, inst, kvno);
+	    krb5_db_free_principal(kdc_context, &entries, nprinc);
+	    return(0);
+	}
+    }
+
+    if (!compat_decrypt_key(pkey, k, k5key, issrv)) {
+ 	memcpy( &principal->key_low, k, LONGLEN);
+       	memcpy( &principal->key_high, (krb5_ui_4 *) k + 1, LONGLEN);
+    }
+    memset(k, 0, sizeof k);
+    if (issrv) {
+	krb5_free_keyblock_contents (kdc_context, k5key);
+      	if (krb5_dbe_find_enctype(kdc_context, &entries,
 				  ENCTYPE_DES3_CBC_RAW,
 				  -1, kvno, &pkey) &&
 	    krb5_dbe_find_enctype(kdc_context, &entries,
@@ -504,12 +538,10 @@
 	    krb5_db_free_principal(kdc_context, &entries, nprinc);
 	    return(0);
 	}
+	compat_decrypt_key(pkey, k, k5key, issrv);
+	memset (k, 0, sizeof k);
     }
 
-    if (!compat_decrypt_key(pkey, k, k5key, issrv)) {
- 	memcpy( &principal->key_low, k, LONGLEN);
-       	memcpy( &principal->key_high, (krb5_ui_4 *) k + 1, LONGLEN);
-    }
     /* convert v5's entries struct to v4's Principal struct:
      * v5's time-unit for lifetimes is 1 sec, while v4 uses 5 minutes.
      */
@@ -743,21 +775,14 @@
 	    kdb_encrypt_key(key, key, master_key,
 			    master_key_schedule, DECRYPT);
 	    /* construct and seal the ticket */
-	    if (K4KDC_ENCTYPE_OK(k5key.enctype)) {
-		krb_create_ticket(tk, k_flags, a_name_data.name,
-				  a_name_data.instance, local_realm,
-				  client_host.s_addr, (char *) session_key,
-				  lifetime, kerb_time.tv_sec,
-				  s_name_data.name, s_name_data.instance,
-				  key);
-	    } else {
-		krb_cr_tkt_krb5(tk, k_flags, a_name_data.name,
-				a_name_data.instance, local_realm,
-				client_host.s_addr, (char *) session_key,
-				lifetime, kerb_time.tv_sec,
-				s_name_data.name, s_name_data.instance,
-				&k5key);
-	    }
+	    /* We always issue des tickets; the 3des tickets are a broken hack*/
+	    krb_create_ticket(tk, k_flags, a_name_data.name,
+			      a_name_data.instance, local_realm,
+			      client_host.s_addr, (char *) session_key,
+			      lifetime, kerb_time.tv_sec,
+			      s_name_data.name, s_name_data.instance,
+			      key);
+
 	    krb5_free_keyblock_contents(kdc_context, &k5key);
 	    memset(key, 0, sizeof(key));
 	    memset(key_s, 0, sizeof(key_s));
@@ -837,8 +862,15 @@
 	    strncpy(tktrlm, (char *)auth->dat + 3, REALM_SZ);
 	    tktrlm[REALM_SZ-1] = '\0';
 	    kvno = (krb5_kvno)auth->dat[2];
-	    if (set_tgtkey(tktrlm, kvno)) {
-		lt = klog(L_ERR_UNK,
+	    if ((!allow_v4_crossrealm)&&strcmp(tktrlm, local_realm) != 0) {
+	      lt = klog(L_ERR_UNK,
+			"Cross realm ticket from %s denied by policy,", tktrlm);
+	      kerb_err_reply(client, pkt,
+			       KERB_ERR_PRINCIPAL_UNKNOWN, lt);
+		return;
+	    }
+	    if (set_tgtkey(tktrlm, kvno, 0)) {
+	      lt = klog(L_ERR_UNK,
 			  "FAILED set_tgtkey realm %s, kvno %d. Host: %s ",
 			  tktrlm, kvno, inet_ntoa(client_host));
 		/* no better error code */
@@ -848,6 +880,19 @@
 	    }
 	    kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr,
 		ad, 0);
+	    if (kerno) {
+		if (set_tgtkey(tktrlm, kvno, 1)) {
+		    lt = klog(L_ERR_UNK,
+			      "FAILED 3des set_tgtkey realm %s, kvno %d. Host: %s ",
+			      tktrlm, kvno, inet_ntoa(client_host));
+		    /* no better error code */
+		    kerb_err_reply(client, pkt,
+				   KERB_ERR_PRINCIPAL_UNKNOWN, lt);
+		    return;
+		}
+		kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr,
+				   ad, 0);
+	    }
 
 	    if (kerno) {
 		klog(L_ERR_UNK, "FAILED krb_rd_req from %s: %s",
@@ -913,21 +958,13 @@
 	    des_new_random_key(session_key);
 #endif
 
-	    if (K4KDC_ENCTYPE_OK(k5key.enctype)) {
-		krb_create_ticket(tk, k_flags, ad->pname, ad->pinst,
-				  ad->prealm, client_host.s_addr,
-				  (char *) session_key, lifetime,
-				  kerb_time.tv_sec,
-				  s_name_data.name, s_name_data.instance,
-				  key);
-	    } else {
-		krb_cr_tkt_krb5(tk, k_flags, ad->pname, ad->pinst,
-				ad->prealm, client_host.s_addr,
-				(char *) session_key, lifetime,
-				kerb_time.tv_sec,
-				s_name_data.name, s_name_data.instance,
-				&k5key);
-	    }
+	    /* ALways issue des tickets*/
+	    krb_create_ticket(tk, k_flags, ad->pname, ad->pinst,
+			      ad->prealm, client_host.s_addr,
+			      (char *) session_key, lifetime,
+			      kerb_time.tv_sec,
+			      s_name_data.name, s_name_data.instance,
+			      key);
 	    krb5_free_keyblock_contents(kdc_context, &k5key);
 	    memset(key, 0, sizeof(key));
 	    memset(key_s, 0, sizeof(key_s));
@@ -1128,20 +1165,22 @@
 
 /* Set the key for krb_rd_req so we can check tgt */
 static int
-set_tgtkey(r, kvno)
+set_tgtkey(r, kvno, use_3des)
     char   *r;			/* Realm for desired key */
     krb5_kvno kvno;
+    krb5_boolean use_3des;
 {
     int     n;
     static char lastrealm[REALM_SZ] = "";
     static int last_kvno = 0;
+    static krb5_boolean last_use_3des = 0;
     Principal p_st;
     Principal *p = &p_st;
     C_Block key;
     krb5_keyblock k5key;
 
     k5key.contents = NULL;
-    if (!strcmp(lastrealm, r) && last_kvno == kvno)
+    if (!strcmp(lastrealm, r) && last_kvno == kvno && last_use_3des == use_3des)
 	return (KSUCCESS);
 
 /*  log("Getting key for %s", r); */
@@ -1150,11 +1189,12 @@
     if (n == 0)
 	return (KFAILURE);
 
-    if (!K4KDC_ENCTYPE_OK(k5key.enctype)) {
+    if (use_3des&&!K4KDC_ENCTYPE_OK(k5key.enctype)) {
 	krb_set_key_krb5(kdc_context, &k5key);
 	strncpy(lastrealm, r, sizeof(lastrealm) - 1);
 	lastrealm[sizeof(lastrealm) - 1] = '\0';
 	last_kvno = kvno;
+	last_use_3des = use_3des;
     } else {
 	/* unseal tgt key from master key */
 	memcpy(key,                &p->key_low,  4);
--- krb5-1.2.4.orig/src/kdc/main.c
+++ krb5-1.2.4/src/kdc/main.c
@@ -559,7 +559,7 @@
 usage(name)
 char *name;
 {
-    fprintf(stderr, "usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-4 v4mode] [-n]\n", name);
+    fprintf(stderr, "usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-4 v4mode] [-X] [-n]\n", name);
     return;
 }
 
@@ -611,7 +611,7 @@
      * Loop through the option list.  Each time we encounter a realm name,
      * use the previously scanned options to fill in for defaults.
      */
-    while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n4:3")) != -1) {
+    while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n4:X3")) != -1) {
 	switch(c) {
 	case 'r':			/* realm name for db */
 	    if (!find_realm_data(optarg, (krb5_ui_4) strlen(optarg))) {
@@ -661,6 +661,11 @@
 	    v4mode = strdup(optarg);
 #endif
 	    break;
+	case 'X':
+#ifdef KRB5_KRB4_COMPAT
+		enable_v4_crossrealm(argv[0]);
+#endif
+		break;
 	case '3':
 #ifdef ATHENA_DES3_KLUDGE
 	    if (krb5_enctypes_list[krb5_enctypes_length-1].etype
--- krb5-1.2.4.orig/src/clients/kpasswd/kpasswd.M
+++ krb5-1.2.4/src/clients/kpasswd/kpasswd.M
@@ -21,7 +21,8 @@
 .\" this software for any purpose.  It is provided "as is" without express
 .\" or implied warranty.
 .\" "
-.so man1/header.doc
+.ds h ""Kerberos V5 release 1.2.1" "MIT Project Athena"
+
 .TH KPASSWD 1 \*h
 .SH NAME
 kpasswd \- change a user's Kerberos password
--- krb5-1.2.4.orig/src/clients/configure
+++ krb5-1.2.4/src/clients/configure
@@ -2012,10 +2012,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/config/config.guess
+++ krb5-1.2.4/src/config/config.guess
@@ -1,9 +1,9 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000
+#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
 #   Free Software Foundation, Inc.
 
-version='2000-05-30'
+timestamp='2001-03-30'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -32,30 +32,41 @@
 # exits with 0.  Otherwise, it exits with 1.
 #
 # The plan is that this can be called by configure scripts if you
-# don't specify an explicit system type (host/target name).
-#
-# Only a few systems have been added to this list; please add others
-# (but try to keep the structure clean).
-#
+# don't specify an explicit build system type.
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
 Usage: $0 [OPTION]
 
-Output the configuration name of this system.
+Output the configuration name of the system \`$me' is run on.
 
 Operation modes:
-  -h, --help               print this help, then exit
-  -V, --version            print version number, then exit"
+  -h, --help         print this help, then exit
+  -t, --time-stamp   print date of last modification, then exit
+  -v, --version      print version number, then exit
+
+Report bugs and patches to <config-patches@gnu.org>."
+
+version="\
+GNU config.guess ($timestamp)
+
+Originally written by Per Bothner.
+Copyright (C) 1992, 93, 94, 95, 96, 97, 98, 99, 2000
+Free Software Foundation, Inc.
+
+This is free software; see the source for copying conditions.  There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
 
 help="
 Try \`$me --help' for more information."
 
 # Parse command line
 while test $# -gt 0 ; do
-  case "$1" in
-    --version | --vers* | -V )
+  case $1 in
+    --time-stamp | --time* | -t )
+       echo "$timestamp" ; exit 0 ;;
+    --version | -v )
        echo "$version" ; exit 0 ;;
     --help | --h* | -h )
        echo "$usage"; exit 0 ;;
@@ -64,9 +75,7 @@
     - )	# Use stdin as input.
        break ;;
     -* )
-       exec >&2
-       echo "$me: invalid option $1"
-       echo "$help"
+       echo "$me: invalid option $1$help" >&2
        exit 1 ;;
     * )
        break ;;
@@ -78,19 +87,30 @@
   exit 1
 fi
 
-# Use $HOST_CC if defined. $CC may point to a cross-compiler
-if test x"$CC_FOR_BUILD" = x; then
-  if test x"$HOST_CC" != x; then
-    CC_FOR_BUILD="$HOST_CC"
-  else
-    if test x"$CC" != x; then
-      CC_FOR_BUILD="$CC"
-    else
-      CC_FOR_BUILD=cc
-    fi
-  fi
-fi
 
+dummy=dummy-$$
+trap 'rm -f $dummy.c $dummy.o $dummy.rel $dummy; exit 1' 1 2 15
+
+# CC_FOR_BUILD -- compiler used by this script.
+# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
+# use `HOST_CC' if defined, but it is deprecated.
+
+case $CC_FOR_BUILD,$HOST_CC,$CC in
+ ,,)    echo "int dummy(){}" > $dummy.c
+	for c in cc gcc c89 ; do
+	  ($c $dummy.c -c -o $dummy.o) >/dev/null 2>&1
+	  if test $? = 0 ; then
+	     CC_FOR_BUILD="$c"; break
+	  fi
+	done
+	rm -f $dummy.c $dummy.o $dummy.rel
+	if test x"$CC_FOR_BUILD" = x ; then
+	  CC_FOR_BUILD=no_compiler_found
+	fi
+	;;
+ ,,*)   CC_FOR_BUILD=$CC ;;
+ ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
+esac
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 8/24/94.)
@@ -100,12 +120,9 @@
 
 UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
 UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
-UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
+UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
-dummy=dummy-$$
-trap 'rm -f $dummy.c $dummy.o $dummy; exit 1' 1 2 15
-
 # Note: order is significant - the case branches are not exclusive.
 
 case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
@@ -119,7 +136,7 @@
 	# object file format.
 	# Determine the machine/vendor (is the vendor relevant).
 	case "${UNAME_MACHINE}" in
-	    amiga) machine=m68k-cbm ;;
+	    amiga) machine=m68k-unknown ;;
 	    arm32) machine=arm-unknown ;;
 	    atari*) machine=m68k-atari ;;
 	    sun3*) machine=m68k-sun ;;
@@ -129,16 +146,24 @@
 	    ibmrt|romp-ibm) machine=romp-ibm ;;
 	    *) machine=${UNAME_MACHINE}-unknown ;;
 	esac
-	# The Operating System including object format.
-	if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-		| grep __ELF__ >/dev/null
-	then
-	    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
-	    # Return netbsd for either.  FIX?
-	    os=netbsd
-	else
-	    os=netbsdelf
-	fi
+	# The Operating System including object format, if it has switched
+	# to ELF recently, or will in the future.
+	case "${UNAME_MACHINE}" in
+	    i386|sparc|amiga|arm*|hp300|mvme68k|vax|atari|luna68k|mac68k|news68k|next68k|pc532|sun3*|x68k)
+		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
+			| grep __ELF__ >/dev/null
+		then
+		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
+		    # Return netbsd for either.  FIX?
+		    os=netbsd
+		else
+		    os=netbsdelf
+		fi
+		;;
+	    *)
+	        os=netbsd
+		;;
+	esac
 	# The OS release
 	release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
@@ -215,7 +240,7 @@
 	echo alpha-dec-winnt3.5
 	exit 0 ;;
     Amiga*:UNIX_System_V:4.0:*)
-	echo m68k-cbm-sysv4
+	echo m68k-unknown-sysv4
 	exit 0;;
     amiga:OpenBSD:*:*)
 	echo m68k-unknown-openbsd${UNAME_RELEASE}
@@ -247,7 +272,7 @@
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
 	exit 0;;
-    SR2?01:HI-UX/MPP:*:*)
+    SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
 	echo hppa1.1-hitachi-hiuxmpp
 	exit 0;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
@@ -383,7 +408,7 @@
 EOF
 	$CC_FOR_BUILD $dummy.c -o $dummy \
 	  && ./$dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-	  && rm $dummy.c $dummy && exit 0
+	  && rm -f $dummy.c $dummy && exit 0
 	rm -f $dummy.c $dummy
 	echo mips-mips-riscos${UNAME_RELEASE}
 	exit 0 ;;
@@ -437,6 +462,14 @@
     i?86:AIX:*:*)
 	echo i386-ibm-aix
 	exit 0 ;;
+    ia64:AIX:*:*)
+	if [ -x /usr/bin/oslevel ] ; then
+		IBM_REV=`/usr/bin/oslevel`
+	else
+		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
+	fi
+	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
+	exit 0 ;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
 		sed 's/^		//' << EOF >$dummy.c
@@ -450,7 +483,7 @@
 			exit(0);
 			}
 EOF
-		$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm $dummy.c $dummy && exit 0
+		$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
 		rm -f $dummy.c $dummy
 		echo rs6000-ibm-aix3.2.5
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
@@ -459,9 +492,9 @@
 		echo rs6000-ibm-aix3.2
 	fi
 	exit 0 ;;
-    *:AIX:*:4)
+    *:AIX:*:[45])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | head -1 | awk '{ print $1 }'`
-	if /usr/sbin/lsattr -EHl ${IBM_CPU_ID} | grep POWER >/dev/null 2>&1; then
+	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
 		IBM_ARCH=powerpc
@@ -469,7 +502,7 @@
 	if [ -x /usr/bin/oslevel ] ; then
 		IBM_REV=`/usr/bin/oslevel`
 	else
-		IBM_REV=4.${UNAME_RELEASE}
+		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
 	exit 0 ;;
@@ -495,10 +528,28 @@
 	echo m68k-hp-bsd4.4
 	exit 0 ;;
     9000/[34678]??:HP-UX:*:*)
+	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	case "${UNAME_MACHINE}" in
 	    9000/31? )            HP_ARCH=m68000 ;;
 	    9000/[34]?? )         HP_ARCH=m68k ;;
 	    9000/[678][0-9][0-9])
+              case "${HPUX_REV}" in
+                11.[0-9][0-9])
+                  if [ -x /usr/bin/getconf ]; then
+                    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
+                    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
+                    case "${sc_cpu_version}" in
+                      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
+                      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
+                      532)                      # CPU_PA_RISC2_0
+                        case "${sc_kernel_bits}" in
+                          32) HP_ARCH="hppa2.0n" ;;
+                          64) HP_ARCH="hppa2.0w" ;;
+                        esac ;;
+                    esac
+                  fi ;;
+              esac
+              if [ "${HP_ARCH}" = "" ]; then
               sed 's/^              //' << EOF >$dummy.c
 
               #define _HPUX_SOURCE
@@ -533,11 +584,16 @@
               }
 EOF
 	(CCOPTS= $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null ) && HP_ARCH=`./$dummy`
+	if test -z "$HP_ARCH"; then HP_ARCH=hppa; fi
 	rm -f $dummy.c $dummy
+	fi ;;
 	esac
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
 	exit 0 ;;
+    ia64:HP-UX:*:*)
+	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
+	echo ia64-hp-hpux${HPUX_REV}
+	exit 0 ;;
     3050*:HI-UX:*:*)
 	sed 's/^	//' << EOF >$dummy.c
 	#include <unistd.h>
@@ -564,7 +620,7 @@
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm $dummy.c $dummy && exit 0
+	$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
 	rm -f $dummy.c $dummy
 	echo unknown-hitachi-hiuxwe2
 	exit 0 ;;
@@ -628,23 +684,24 @@
     CRAY*TS:*:*:*)
 	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit 0 ;;
-    CRAY*T3E:*:*:*)
+    CRAY*T3D:*:*:*)
 	echo alpha-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit 0 ;;
+    CRAY*T3E:*:*:*)
+	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
+	exit 0 ;;
     CRAY*SV1:*:*:*)
 	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit 0 ;;
     CRAY-2:*:*:*)
 	echo cray2-cray-unicos
         exit 0 ;;
-    F300:UNIX_System_V:*:*)
+    F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
+	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
         FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
         FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-        echo "f300-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+        echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
         exit 0 ;;
-    F301:UNIX_System_V:*:*)
-       echo f301-fujitsu-uxpv`echo $UNAME_RELEASE | sed 's/ .*//'`
-       exit 0 ;;
     hp300:OpenBSD:*:*)
 	echo m68k-unknown-openbsd${UNAME_RELEASE}
 	exit 0 ;;
@@ -669,6 +726,9 @@
     i*:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit 0 ;;
+    i*:PW*:*)
+	echo ${UNAME_MACHINE}-pc-pw32
+	exit 0 ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
@@ -687,58 +747,41 @@
     *:GNU:*:*)
 	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
 	exit 0 ;;
-    *:Linux:*:*)
-
-	# The BFD linker knows what the default object file format is, so
-	# first see if it will tell us. cd to the root directory to prevent
-	# problems with other programs or directories called `ld' in the path.
-	ld_help_string=`cd /; ld --help 2>&1`
-	ld_supported_emulations=`echo $ld_help_string \
-			 | sed -ne '/supported emulations:/!d
-				    s/[ 	][ 	]*/ /g
-				    s/.*supported emulations: *//
-				    s/ .*//
-				    p'`
-        case "$ld_supported_emulations" in
-	  *ia64)
-		echo "${UNAME_MACHINE}-unknown-linux"
-		exit 0
-		;;
-	  i?86linux)
-		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit 0
-		;;
-	  elf_i?86)
-		echo "${UNAME_MACHINE}-pc-linux"
-		exit 0
-		;;
-	  i?86coff)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit 0
-		;;
-	  sparclinux)
-		echo "${UNAME_MACHINE}-unknown-linux-gnuaout"
-		exit 0
-		;;
-	  armlinux)
-		echo "${UNAME_MACHINE}-unknown-linux-gnuaout"
-		exit 0
-		;;
-	  elf32arm*)
-		echo "${UNAME_MACHINE}-unknown-linux-gnuoldld"
-		exit 0
-		;;
-	  armelf_linux*)
-		echo "${UNAME_MACHINE}-unknown-linux-gnu"
-		exit 0
-		;;
-	  m68klinux)
-		echo "${UNAME_MACHINE}-unknown-linux-gnuaout"
-		exit 0
-		;;
-	  elf32ppc | elf32ppclinux)
-		# Determine Lib Version
-		cat >$dummy.c <<EOF
+    i*86:Minix:*:*)
+	echo ${UNAME_MACHINE}-pc-minix
+	exit 0 ;;
+    arm*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit 0 ;;
+    ia64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux
+	exit 0 ;;
+    m68*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit 0 ;;
+    mips:Linux:*:*)
+	cat >$dummy.c <<EOF
+#ifdef __cplusplus
+#include <stdio.h>  /* for printf() prototype */
+int main (int argc, char *argv[]) {
+#else
+int main (argc, argv) int argc; char *argv[]; {
+#endif
+#ifdef __MIPSEB__
+  printf ("%s-unknown-linux-gnu\n", argv[1]);
+#endif
+#ifdef __MIPSEL__
+  printf ("%sel-unknown-linux-gnu\n", argv[1]);
+#endif
+  return 0;
+}
+EOF
+	$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy "${UNAME_MACHINE}" && rm -f $dummy.c $dummy && exit 0
+	rm -f $dummy.c $dummy
+	;;
+    ppc:Linux:*:*)
+	# Determine Lib Version
+	cat >$dummy.c <<EOF
 #include <features.h>
 #if defined(__GLIBC__)
 extern char __libc_version[];
@@ -751,127 +794,127 @@
 #if defined(__GLIBC__)
   printf("%s %s\n", __libc_version, __libc_release);
 #else
-  printf("unkown\n");
+  printf("unknown\n");
 #endif
   return 0;
 }
 EOF
-		LIBC=""
-		$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null
+	LIBC=""
+	$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null
+	if test "$?" = 0 ; then
+		./$dummy | grep 1\.99 > /dev/null
+		if test "$?" = 0 ; then LIBC="libc1" ; fi
+	fi
+	rm -f $dummy.c $dummy
+	echo powerpc-unknown-linux-gnu${LIBC}
+	exit 0 ;;
+    alpha:Linux:*:*)
+	cat <<EOF >$dummy.s
+	  .data
+	  \$Lformat:
+		.byte 37,100,45,37,120,10,0	# "%d-%x\n"
+	   .text
+		.globl main
+		.align 4
+		.ent main
+	    main:
+		.frame \$30,16,\$26,0
+		ldgp \$29,0(\$27)
+		.prologue 1
+		.long 0x47e03d80 # implver \$0
+		lda \$2,-1
+		.long 0x47e20c21 # amask \$2,\$1
+		lda \$16,\$Lformat
+		mov \$0,\$17
+		not \$1,\$18
+		jsr \$26,printf
+		ldgp \$29,0(\$26)
+		mov 0,\$16
+		jsr \$26,exit
+		.end main
+EOF
+	LIBC=""
+	$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
+	if test "$?" = 0 ; then
+		case `./$dummy` in
+		0-0)	UNAME_MACHINE="alpha" ;;
+		1-0)	UNAME_MACHINE="alphaev5" ;;
+		1-1)    UNAME_MACHINE="alphaev56" ;;
+		1-101)	UNAME_MACHINE="alphapca56" ;;
+		2-303)	UNAME_MACHINE="alphaev6" ;;
+		2-307)	UNAME_MACHINE="alphaev67" ;;
+		esac
+		objdump --private-headers $dummy | \
+		  grep ld.so.1 > /dev/null
 		if test "$?" = 0 ; then
-			./$dummy | grep 1\.99 > /dev/null
-			if test "$?" = 0 ; then
-				LIBC="libc1"
-			fi
+			LIBC="libc1"
 		fi
-		rm -f $dummy.c $dummy
-		echo powerpc-unknown-linux-gnu${LIBC}
+	fi
+	rm -f $dummy.s $dummy
+	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
+	exit 0 ;;
+    parisc:Linux:*:* | hppa:Linux:*:*)
+	# Look for CPU level
+	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
+	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
+	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
+	  *)    echo hppa-unknown-linux-gnu ;;
+	esac
+	exit 0 ;;
+    parisc64:Linux:*:* | hppa64:Linux:*:*)
+	echo hppa64-unknown-linux-gnu
+	exit 0 ;;
+    s390:Linux:*:* | s390x:Linux:*:*)
+	echo ${UNAME_MACHINE}-ibm-linux
+	exit 0 ;;
+    sh*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit 0 ;;
+    sparc:Linux:*:* | sparc64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit 0 ;;
+    x86_64:Linux:*:*)
+	echo x86_64-unknown-linux-gnu
+	exit 0 ;;
+    i?86:Linux:*:*)
+	# The BFD linker knows what the default object file format is, so
+	# first see if it will tell us. cd to the root directory to prevent
+	# problems with other programs or directories called `ld' in the path.
+	ld_supported_emulations=`cd /; ld --help 2>&1 \
+			 | sed -ne '/supported emulations:/!d
+				    s/[ 	][ 	]*/ /g
+				    s/.*supported emulations: *//
+				    s/ .*//
+				    p'`
+        case "$ld_supported_emulations" in
+	  i?86linux)
+		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
 		exit 0
 		;;
-	  shelf_linux)
-		echo "${UNAME_MACHINE}-unknown-linux-gnu"
+	  elf_i?86)
+		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
+		;;
+	  i?86coff)
+		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
 		exit 0
 		;;
 	esac
-
-	if test "${UNAME_MACHINE}" = "alpha" ; then
-		cat <<EOF >$dummy.s
-			.data
-		\$Lformat:
-			.byte 37,100,45,37,120,10,0	# "%d-%x\n"
-
-			.text
-			.globl main
-			.align 4
-			.ent main
-		main:
-			.frame \$30,16,\$26,0
-			ldgp \$29,0(\$27)
-			.prologue 1
-			.long 0x47e03d80 # implver \$0
-			lda \$2,-1
-			.long 0x47e20c21 # amask \$2,\$1
-			lda \$16,\$Lformat
-			mov \$0,\$17
-			not \$1,\$18
-			jsr \$26,printf
-			ldgp \$29,0(\$26)
-			mov 0,\$16
-			jsr \$26,exit
-			.end main
-EOF
-		LIBC=""
-		$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
-		if test "$?" = 0 ; then
-			case `./$dummy` in
-			0-0)
-				UNAME_MACHINE="alpha"
-				;;
-			1-0)
-				UNAME_MACHINE="alphaev5"
-				;;
-			1-1)
-				UNAME_MACHINE="alphaev56"
-				;;
-			1-101)
-				UNAME_MACHINE="alphapca56"
-				;;
-			2-303)
-				UNAME_MACHINE="alphaev6"
-				;;
-			2-307)
-				UNAME_MACHINE="alphaev67"
-				;;
-			esac
-
-			objdump --private-headers $dummy | \
-			  grep ld.so.1 > /dev/null
-			if test "$?" = 0 ; then
-				LIBC="libc1"
-			fi
-		fi
-		rm -f $dummy.s $dummy
-		echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC} ; exit 0
-	elif test "${UNAME_MACHINE}" = "mips" ; then
-	  cat >$dummy.c <<EOF
-#ifdef __cplusplus
-#include <stdio.h>  /* for printf() prototype */
-	int main (int argc, char *argv[]) {
-#else
-	int main (argc, argv) int argc; char *argv[]; {
-#endif
-#ifdef __MIPSEB__
-  printf ("%s-unknown-linux-gnu\n", argv[1]);
-#endif
-#ifdef __MIPSEL__
-  printf ("%sel-unknown-linux-gnu\n", argv[1]);
-#endif
-  return 0;
-}
-EOF
-	  $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy "${UNAME_MACHINE}" && rm $dummy.c $dummy && exit 0
-	  rm -f $dummy.c $dummy
-	elif test "${UNAME_MACHINE}" = "s390"; then
-	  echo s390-ibm-linux && exit 0
-	else
-	  # Either a pre-BFD a.out linker (linux-gnuoldld)
-	  # or one that does not give us useful --help.
-	  # GCC wants to distinguish between linux-gnuoldld and linux-gnuaout.
-	  # If ld does not provide *any* "supported emulations:"
-	  # that means it is gnuoldld.
-	  echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations:"
-	  test $? != 0 && echo "${UNAME_MACHINE}-pc-linux-gnuoldld" && exit 0
-
-	  case "${UNAME_MACHINE}" in
-	  i?86)
-	    VENDOR=pc;
-	    ;;
-	  *)
-	    VENDOR=unknown;
-	    ;;
-	  esac
-	  # Determine whether the default compiler is a.out or elf
-	  cat >$dummy.c <<EOF
+	# Either a pre-BFD a.out linker (linux-gnuoldld)
+	# or one that does not give us useful --help.
+	# GCC wants to distinguish between linux-gnuoldld and linux-gnuaout.
+	# If ld does not provide *any* "supported emulations:"
+	# that means it is gnuoldld.
+	test -z "$ld_supported_emulations" && echo "${UNAME_MACHINE}-pc-linux-gnuoldld" && exit 0
+	case "${UNAME_MACHINE}" in
+	i?86)
+	  VENDOR=pc;
+	  ;;
+	*)
+	  VENDOR=unknown;
+	  ;;
+	esac
+	# Determine whether the default compiler is a.out or elf
+	cat >$dummy.c <<EOF
 #include <features.h>
 #ifdef __cplusplus
 #include <stdio.h>  /* for printf() prototype */
@@ -895,9 +938,10 @@
   return 0;
 }
 EOF
-	  $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy "${UNAME_MACHINE}" && rm $dummy.c $dummy && exit 0
-	  rm -f $dummy.c $dummy
-	fi ;;
+	$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy "${UNAME_MACHINE}" && rm -f $dummy.c $dummy && exit 0
+	rm -f $dummy.c $dummy
+	test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
+	;;
 # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.  earlier versions
 # are messed up and put the nodename in both sysname and nodename.
     i?86:DYNIX/ptx:4*:*)
@@ -974,7 +1018,7 @@
 	exit 0 ;;
     M68*:*:R3V[567]*:*)
 	test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 4850:*:4.0:3.0)
+    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 4850:*:4.0:3.0)
 	OS_REL=''
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
@@ -985,21 +1029,24 @@
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
           && echo i486-ncr-sysv4 && exit 0 ;;
-    m68*:LynxOS:2.*:*)
+    m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
 	exit 0 ;;
     mc68030:UNIX_System_V:4.*:*)
 	echo m68k-atari-sysv4
 	exit 0 ;;
-    i?86:LynxOS:2.*:* | i?86:LynxOS:3.[01]*:*)
+    i?86:LynxOS:2.*:* | i?86:LynxOS:3.[01]*:* | i?86:LynxOS:4.0*:*)
 	echo i386-unknown-lynxos${UNAME_RELEASE}
 	exit 0 ;;
     TSUNAMI:LynxOS:2.*:*)
 	echo sparc-unknown-lynxos${UNAME_RELEASE}
 	exit 0 ;;
-    rs6000:LynxOS:2.*:* | PowerPC:LynxOS:2.*:*)
+    rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
 	exit 0 ;;
+    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
+	echo powerpc-unknown-lynxos${UNAME_RELEASE}
+	exit 0 ;;
     SM[BE]S:UNIX_SV:*:*)
 	echo mips-dde-sysv${UNAME_RELEASE}
 	exit 0 ;;
@@ -1033,7 +1080,7 @@
     mc68*:A/UX:*:*)
 	echo m68k-apple-aux${UNAME_RELEASE}
 	exit 0 ;;
-    news*:NEWS-OS:*:6*)
+    news*:NEWS-OS:6*:*)
 	echo mips-sony-newsos6
 	exit 0 ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
@@ -1076,15 +1123,52 @@
     *:QNX:*:4*)
 	echo i386-pc-qnx
 	exit 0 ;;
-    NSR-W:NONSTOP_KERNEL:*:*)
+    NSR-[KW]:NONSTOP_KERNEL:*:*)
 	echo nsr-tandem-nsk${UNAME_RELEASE}
 	exit 0 ;;
+    *:NonStop-UX:*:*)
+	echo mips-compaq-nonstopux
+	exit 0 ;;
     BS2000:POSIX*:*:*)
 	echo bs2000-siemens-sysv
 	exit 0 ;;
     DS/*:UNIX_System_V:*:*)
 	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
 	exit 0 ;;
+    *:Plan9:*:*)
+	# "uname -m" is not consistent, so use $cputype instead. 386
+	# is converted to i386 for consistency with other x86
+	# operating systems.
+	if test "$cputype" = "386"; then
+	    UNAME_MACHINE=i386
+	else
+	    UNAME_MACHINE="$cputype"
+	fi
+	echo ${UNAME_MACHINE}-unknown-plan9
+	exit 0 ;;
+    i?86:OS/2:*:*)
+	# If we were able to find `uname', then EMX Unix compatibility
+	# is probably installed.
+	echo ${UNAME_MACHINE}-pc-os2-emx
+	exit 0 ;;
+    *:TOPS-10:*:*)
+	echo pdp10-unknown-tops10
+	exit 0 ;;
+    *:TENEX:*:*)
+	echo pdp10-unknown-tenex
+	exit 0 ;;
+    KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
+	echo pdp10-dec-tops20
+	exit 0 ;;
+    XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
+	echo pdp10-xkl-tops20
+	exit 0 ;;
+    *:TOPS-20:*:*)
+	echo pdp10-unknown-tops20
+	exit 0 ;;
+    *:ITS:*:*)
+	echo pdp10-unknown-its
+	exit 0 ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2
@@ -1176,11 +1260,24 @@
 #endif
 
 #if defined (vax)
-#if !defined (ultrix)
-  printf ("vax-dec-bsd\n"); exit (0);
-#else
-  printf ("vax-dec-ultrix\n"); exit (0);
-#endif
+# if !defined (ultrix)
+#  include <sys/param.h>
+#  if defined (BSD)
+#   if BSD == 43
+      printf ("vax-dec-bsd4.3\n"); exit (0);
+#   else
+#    if BSD == 199006
+      printf ("vax-dec-bsd4.3reno\n"); exit (0);
+#    else
+      printf ("vax-dec-bsd\n"); exit (0);
+#    endif
+#   endif
+#  else
+    printf ("vax-dec-bsd\n"); exit (0);
+#  endif
+# else
+    printf ("vax-dec-ultrix\n"); exit (0);
+# endif
 #endif
 
 #if defined (alliant) && defined (i860)
@@ -1191,7 +1288,7 @@
 }
 EOF
 
-$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy && rm $dummy.c $dummy && exit 0
+$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy && rm -f $dummy.c $dummy && exit 0
 rm -f $dummy.c $dummy
 
 # Apollos put the system type in the environment.
@@ -1227,8 +1324,9 @@
 cat >&2 <<EOF
 $0: unable to guess system type
 
-The $version version of this script cannot recognize your system type.
-Please download the most up to date version of the config scripts:
+This script, last modified $timestamp, has failed to recognize
+the operating system you are using. It is advised that you
+download the most up to date version of the config scripts from
 
     ftp://ftp.gnu.org/pub/gnu/config/
 
@@ -1237,7 +1335,7 @@
 pertinent to <config-patches@gnu.org> in order to provide the needed
 information to handle your system.
 
-config.guess version = $version
+config.guess timestamp = $timestamp
 
 uname -m = `(uname -m) 2>/dev/null || echo unknown`
 uname -r = `(uname -r) 2>/dev/null || echo unknown`
@@ -1264,7 +1362,7 @@
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "version='"
+# time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
 # End:
--- krb5-1.2.4.orig/src/config/config.sub
+++ krb5-1.2.4/src/config/config.sub
@@ -1,9 +1,9 @@
 #! /bin/sh
-# Configuration validation subroutine script, version 1.1.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000
+# Configuration validation subroutine script.
+#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
 #   Free Software Foundation, Inc.
 
-version='2000-05-31'
+timestamp='2001-03-30'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -29,7 +29,6 @@
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
-# Written by Per Bothner <bothner@cygnus.com>.
 # Please send patches to <config-patches@gnu.org>.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
@@ -61,16 +60,30 @@
 Canonicalize a configuration name.
 
 Operation modes:
-  -h, --help               print this help, then exit
-  -V, --version            print version number, then exit"
+  -h, --help         print this help, then exit
+  -t, --time-stamp   print date of last modification, then exit
+  -v, --version      print version number, then exit
+
+Report bugs and patches to <config-patches@gnu.org>."
+
+version="\
+GNU config.sub ($timestamp)
+
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+Free Software Foundation, Inc.
+
+This is free software; see the source for copying conditions.  There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
 
 help="
 Try \`$me --help' for more information."
 
 # Parse command line
 while test $# -gt 0 ; do
-  case "$1" in
-    --version | --vers* | -V )
+  case $1 in
+    --time-stamp | --time* | -t )
+       echo "$timestamp" ; exit 0 ;;
+    --version | -v )
        echo "$version" ; exit 0 ;;
     --help | --h* | -h )
        echo "$usage"; exit 0 ;;
@@ -79,9 +92,7 @@
     - )	# Use stdin as input.
        break ;;
     -* )
-       exec >&2
-       echo "$me: invalid option $1"
-       echo "$help"
+       echo "$me: invalid option $1$help"
        exit 1 ;;
 
     *local*)
@@ -106,7 +117,7 @@
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu*)
+  nto-qnx* | linux-gnu* | storm-chaos* | os2-emx*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
@@ -132,7 +143,7 @@
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple)
+	-apple | -axis)
 		os=
 		basic_machine=$1
 		;;
@@ -204,30 +215,39 @@
 case $basic_machine in
 	# Recognize the basic CPU types without company name.
 	# Some are omitted here because they have special meanings below.
-	tahoe | i860 | ia64 | m32r | m68k | m68000 | m88k | ns32k | arc | arm \
-		| arme[lb] | pyramid | mn10200 | mn10300 | tron | a29k \
+	tahoe | i860 | ia64 | m32r | m68k | m68000 | m88k | ns32k | arc \
+	        | arm | arme[lb] | arm[bl]e | armv[2345] | armv[345][lb] | strongarm | xscale \
+		| pyramid | mn10200 | mn10300 | tron | a29k \
 		| 580 | i960 | h8300 \
-		| x86 | ppcbe | mipsbe | mipsle | shbe | shle | armbe | armle \
+		| x86 | ppcbe | mipsbe | mipsle | shbe | shle \
 		| hppa | hppa1.0 | hppa1.1 | hppa2.0 | hppa2.0w | hppa2.0n \
 		| hppa64 \
 		| alpha | alphaev[4-8] | alphaev56 | alphapca5[67] \
 		| alphaev6[78] \
-		| we32k | ns16k | clipper | i370 | sh | powerpc | powerpcle \
-		| 1750a | dsp16xx | pdp11 | mips16 | mips64 | mipsel | mips64el \
+		| we32k | ns16k | clipper | i370 | sh | sh[34] \
+		| powerpc | powerpcle \
+		| 1750a | dsp16xx | pdp10 | pdp11 \
+		| mips16 | mips64 | mipsel | mips64el \
 		| mips64orion | mips64orionel | mipstx39 | mipstx39el \
 		| mips64vr4300 | mips64vr4300el | mips64vr4100 | mips64vr4100el \
-		| mips64vr5000 | miprs64vr5000el | mcore \
+		| mips64vr5000 | miprs64vr5000el | mcore | s390 | s390x \
 		| sparc | sparclet | sparclite | sparc64 | sparcv9 | v850 | c4x \
-		| thumb | d10v | fr30 | avr)
+		| thumb | d10v | d30v | fr30 | avr | openrisc | tic80 \
+		| pj | pjl | h8500)
 		basic_machine=$basic_machine-unknown
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | z8k | v70 | h8500 | w65 | pj | pjl)
+	m6811 | m68hc11 | m6812 | m68hc12)
+		# Motorola 68HC11/12.
+		basic_machine=$basic_machine-unknown
+		os=-none
+		;;
+	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | z8k | v70 | w65)
 		;;
 
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
 	# (2) the word "unknown" tends to confuse beginning users.
-	i[34567]86)
+	i[234567]86 | x86_64)
 	  basic_machine=$basic_machine-pc
 	  ;;
 	# Object if more than one company name word.
@@ -237,27 +257,29 @@
 		;;
 	# Recognize the basic CPU types with company name.
 	# FIXME: clean up the formatting here.
-	vax-* | tahoe-* | i[34567]86-* | i860-* | ia64-* | m32r-* | m68k-* | m68000-* \
-	      | m88k-* | sparc-* | ns32k-* | fx80-* | arc-* | arm-* | c[123]* \
+	vax-* | tahoe-* | i[234567]86-* | i860-* | ia64-* | m32r-* | m68k-* | m68000-* \
+	      | m88k-* | sparc-* | ns32k-* | fx80-* | arc-* | c[123]* \
+	      | arm-*  | armbe-* | armle-* | armv*-* | strongarm-* | xscale-* \
 	      | mips-* | pyramid-* | tron-* | a29k-* | romp-* | rs6000-* \
 	      | power-* | none-* | 580-* | cray2-* | h8300-* | h8500-* | i960-* \
 	      | xmp-* | ymp-* \
-	      | x86-* | ppcbe-* | mipsbe-* | mipsle-* | shbe-* | shle-* | armbe-* | armle-* \
+	      | x86-* | ppcbe-* | mipsbe-* | mipsle-* | shbe-* | shle-* \
 	      | hppa-* | hppa1.0-* | hppa1.1-* | hppa2.0-* | hppa2.0w-* \
 	      | hppa2.0n-* | hppa64-* \
 	      | alpha-* | alphaev[4-8]-* | alphaev56-* | alphapca5[67]-* \
 	      | alphaev6[78]-* \
 	      | we32k-* | cydra-* | ns16k-* | pn-* | np1-* | xps100-* \
 	      | clipper-* | orion-* \
-	      | sparclite-* | pdp11-* | sh-* | powerpc-* | powerpcle-* \
+	      | sparclite-* | pdp10-* | pdp11-* | sh-* | powerpc-* | powerpcle-* \
 	      | sparc64-* | sparcv9-* | sparc86x-* | mips16-* | mips64-* | mipsel-* \
 	      | mips64el-* | mips64orion-* | mips64orionel-* \
 	      | mips64vr4100-* | mips64vr4100el-* | mips64vr4300-* | mips64vr4300el-* \
 	      | mipstx39-* | mipstx39el-* | mcore-* \
-	      | f301-* | armv*-* | s390-* | sv1-* | t3e-* \
+	      | f30[01]-* | f700-* | s390-* | s390x-* | sv1-* | t3e-* \
+	      | [cjt]90-* \
 	      | m88110-* | m680[01234]0-* | m683?2-* | m68360-* | z8k-* | d10v-* \
-	      | thumb-* | v850-* | d30v-* | tic30-* | c30-* | fr30-* \
-	      | bs2000-*)
+	      | thumb-* | v850-* | d30v-* | tic30-* | tic80-* | c30-* | fr30-* \
+	      | bs2000-* | tic54x-* | c54x-* | x86_64-* | pj-* | pjl-*)
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -294,14 +316,14 @@
 		os=-sysv
 		;;
 	amiga | amiga-*)
-		basic_machine=m68k-cbm
+		basic_machine=m68k-unknown
 		;;
 	amigaos | amigados)
-		basic_machine=m68k-cbm
+		basic_machine=m68k-unknown
 		os=-amigaos
 		;;
 	amigaunix | amix)
-		basic_machine=m68k-cbm
+		basic_machine=m68k-unknown
 		os=-sysv4
 		;;
 	apollo68)
@@ -348,13 +370,16 @@
 		basic_machine=cray2-cray
 		os=-unicos
 		;;
-	[ctj]90-cray)
-		basic_machine=c90-cray
+	[cjt]90)
+		basic_machine=${basic_machine}-cray
 		os=-unicos
 		;;
 	crds | unos)
 		basic_machine=m68k-crds
 		;;
+	cris | cris-* | etrax*)
+		basic_machine=cris-axis
+		;;
 	da30 | da30-*)
 		basic_machine=m68k-da30
 		;;
@@ -402,6 +427,10 @@
 		basic_machine=tron-gmicro
 		os=-sysv
 		;;
+	go32)
+		basic_machine=i386-pc
+		os=-go32
+		;;
 	h3050r* | hiux*)
 		basic_machine=hppa1.1-hitachi
 		os=-hiuxwe2
@@ -501,14 +530,6 @@
 		basic_machine=i386-unknown
 		os=-vsta
 		;;
-	i386-go32 | go32)
-		basic_machine=i386-unknown
-		os=-go32
-		;;
-	i386-mingw32 | mingw32)
-		basic_machine=i386-unknown
-		os=-mingw32
-		;;
 	iris | iris4d)
 		basic_machine=mips-sgi
 		case $os in
@@ -534,6 +555,10 @@
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
+	mingw32)
+		basic_machine=i386-pc
+		os=-mingw32
+		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -564,7 +589,7 @@
 		os=-coff
 		;;
 	msdos)
-		basic_machine=i386-unknown
+		basic_machine=i386-pc
 		os=-msdos
 		;;
 	mvs)
@@ -628,6 +653,10 @@
 		basic_machine=i960-intel
 		os=-mon960
 		;;
+	nonstopux)
+		basic_machine=mips-compaq
+		os=-nonstopux
+		;;
 	np1)
 		basic_machine=np1-gould
 		;;
@@ -663,28 +692,28 @@
         pc532 | pc532-*)
 		basic_machine=ns32k-pc532
 		;;
-	pentium | p5 | k5 | k6 | nexen)
+	pentium | p5 | k5 | k6 | nexgen)
 		basic_machine=i586-pc
 		;;
 	pentiumpro | p6 | 6x86 | athlon)
 		basic_machine=i686-pc
 		;;
 	pentiumii | pentium2)
-		basic_machine=i786-pc
+		basic_machine=i686-pc
 		;;
-	pentium-* | p5-* | k5-* | k6-* | nexen-*)
+	pentium-* | p5-* | k5-* | k6-* | nexgen-*)
 		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumii-* | pentium2-*)
-		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pn)
 		basic_machine=pn-gould
 		;;
-	power)	basic_machine=rs6000-ibm
+	power)	basic_machine=power-ibm
 		;;
 	ppc)	basic_machine=powerpc-unknown
 	        ;;
@@ -699,6 +728,10 @@
 	ps2)
 		basic_machine=i386-ibm
 		;;
+	pw32)
+		basic_machine=i586-unknown
+		os=-pw32
+		;;
 	rom68k)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -790,6 +823,10 @@
 		basic_machine=t3e-cray
 		os=-unicos
 		;;
+	tic54x | c54x*)
+		basic_machine=tic54x-unknown
+		os=-coff
+		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -885,12 +922,19 @@
 	vax)
 		basic_machine=vax-dec
 		;;
+	pdp10)
+		# there are many clones, so DEC is not a safe bet
+		basic_machine=pdp10-unknown
+		;;
 	pdp11)
 		basic_machine=pdp11-dec
 		;;
 	we32k)
 		basic_machine=we32k-att
 		;;
+	sh3 | sh4)
+		basic_machine=sh-unknown
+		;;
 	sparc | sparcv9)
 		basic_machine=sparc-sun
 		;;
@@ -913,6 +957,9 @@
 		basic_machine=c4x-none
 		os=-coff
 		;;
+	*-unknown)
+		# Make sure to match an already-canonicalized machine name.
+		;;
 	*)
 		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
 		exit 1
@@ -972,7 +1019,8 @@
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
 	      | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \
-	      | -openstep* | -oskit*)
+	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
+	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* | -os2*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1033,7 +1081,7 @@
 	-ns2 )
 	        os=-nextstep2
 		;;
-	-nsk)
+	-nsk*)
 		os=-nsk
 		;;
 	# Preserve the version number of sinix5.
@@ -1070,7 +1118,7 @@
 	-xenix)
 		os=-xenix
 		;;
-        -*mint | -*MiNT)
+        -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 	        os=-mint
 		;;
 	-none)
@@ -1104,6 +1152,9 @@
 	arm*-semi)
 		os=-aout
 		;;
+	pdp10-*)
+		os=-tops20
+		;;
         pdp11-*)
 		os=-none
 		;;
@@ -1212,7 +1263,7 @@
 	*-masscomp)
 		os=-rtu
 		;;
-	f301-fujitsu)
+	f30[01]-fujitsu | f700-fujitsu)
 		os=-uxpv
 		;;
 	*-rom68k)
@@ -1290,7 +1341,7 @@
 			-mpw* | -macos*)
 				vendor=apple
 				;;
-			-*mint | -*MiNT)
+			-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 				vendor=atari
 				;;
 		esac
@@ -1303,7 +1354,7 @@
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "version='"
+# time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
 # End:
--- krb5-1.2.4.orig/src/config/pre.in
+++ krb5-1.2.4/src/config/pre.in
@@ -210,7 +210,7 @@
 DES425_DEPLIB	= @DES425_DEPLIB@	# $(TOPLIBD)/libdes425$(DEPLIBEXT)
 KRB5_DEPLIB	= $(TOPLIBD)/libkrb5$(DEPLIBEXT)
 CRYPTO_DEPLIB	= $(TOPLIBD)/libk5crypto$(DEPLIBEXT)
-COM_ERR_DEPLIB	= $(TOPLIBD)/libcom_err$(DEPLIBEXT)
+COM_ERR_DEPLIB	= 
 DYN_DEPLIB	= $(TOPLIBD)/libdyn$(DEPLIBEXT)
 
 PTY_DEPLIB	= $(TOPLIBD)/libpty$(DEPLIBEXT)
--- krb5-1.2.4.orig/src/include/configure.in
+++ krb5-1.2.4/src/include/configure.in
@@ -1,4 +1,7 @@
 AC_INIT(configure.in)
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 CONFIG_RULES
 AC_CONFIG_HEADER(krb5/autoconf.h)
 AC_PROG_INSTALL
--- krb5-1.2.4.orig/src/include/krb5.hin
+++ krb5-1.2.4/src/include/krb5.hin
@@ -302,7 +302,7 @@
 #define	krb5_princ_size(context, princ) (princ)->length
 #define	krb5_princ_type(context, princ) (princ)->type
 #define	krb5_princ_name(context, princ) (princ)->data
-#define	krb5_princ_component(context, princ,i) ((princ)->data + i)
+#define	krb5_princ_component(context, princ,i) (i < krb5_princ_size(context, princ) ? ((princ)->data + i) : NULL)
 
 /*
  * end "base-defs.h"
--- krb5-1.2.4.orig/src/include/krb5/stock/osconf.h
+++ krb5-1.2.4/src/include/krb5/stock/osconf.h
@@ -110,8 +110,8 @@
  * krb5 slave support follows
  */
 
-#define KPROP_DEFAULT_FILE "@LOCALSTATEDIR/krb5kdc/slave_datatrans"
-#define KPROPD_DEFAULT_FILE "@LOCALSTATEDIR/krb5kdc/from_master"
+#define KPROP_DEFAULT_FILE "/var/lib/krb5kdc/slave_datatrans"
+#define KPROPD_DEFAULT_FILE "/var/lib/krb5kdc/from_master"
 #define KPROPD_DEFAULT_KDB5_UTIL "@PREFIX/sbin/kdb5_util"
 #define KPROPD_DEFAULT_KDB5_EDIT "@PREFIX/sbin/kdb5_edit"
 #define KPROPD_DEFAULT_KRB_DB DEFAULT_KDB_FILE
--- krb5-1.2.4.orig/src/include/configure
+++ krb5-1.2.4/src/include/configure
@@ -551,6 +551,9 @@
 fi
 
 
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 ac_reltopdir=../.
 case "$ac_reltopdir" in 
 /*)
@@ -598,7 +601,7 @@
 fi
 
 echo $ac_n "checking for C compiler""... $ac_c" 1>&6
-echo "configure:602: checking for C compiler" >&5
+echo "configure:605: checking for C compiler" >&5
 if test "$with_cc" != ""; then
   if test "$ac_cv_prog_cc" != "" && test "$ac_cv_prog_cc" != "$with_cc"; then
     { echo "configure: error: Specified compiler doesn't match cached compiler name;
@@ -612,14 +615,14 @@
 else
     test -z "$CC" && CC=cc
   cat > conftest.$ac_ext <<EOF
-#line 616 "configure"
+#line 619 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("hi\n");
 ; return 0; }
 EOF
-if { (eval echo configure:623: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:626: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -637,7 +640,7 @@
 # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:641: checking for $ac_word" >&5
+echo "configure:644: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -667,7 +670,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:671: checking for $ac_word" >&5
+echo "configure:674: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -718,7 +721,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:722: checking for $ac_word" >&5
+echo "configure:725: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -750,7 +753,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:754: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:757: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -761,12 +764,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 765 "configure"
+#line 768 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:770: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:773: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -792,12 +795,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:796: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:799: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:801: checking whether we are using GNU C" >&5
+echo "configure:804: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -806,7 +809,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:810: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:813: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -825,7 +828,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:829: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:832: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -948,12 +951,12 @@
 
 
  echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:952: checking for working const" >&5
+echo "configure:955: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 957 "configure"
+#line 960 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -1002,7 +1005,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1006: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1009: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1037,12 +1040,12 @@
    # Most operating systems have gethostbyname() in the default searched
    # libraries (i.e. libc):
    echo $ac_n "checking for gethostbyname""... $ac_c" 1>&6
-echo "configure:1041: checking for gethostbyname" >&5
+echo "configure:1044: checking for gethostbyname" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gethostbyname'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1046 "configure"
+#line 1049 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gethostbyname(); below.  */
@@ -1065,7 +1068,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1069: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1072: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_gethostbyname=yes"
 else
@@ -1084,7 +1087,7 @@
   echo "$ac_t""no" 1>&6
 # Some OSes (eg. Solaris) place it in libnsl:
      echo $ac_n "checking for gethostbyname in -lnsl""... $ac_c" 1>&6
-echo "configure:1088: checking for gethostbyname in -lnsl" >&5
+echo "configure:1091: checking for gethostbyname in -lnsl" >&5
 ac_lib_var=`echo nsl'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1092,7 +1095,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lnsl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1096 "configure"
+#line 1099 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1103,7 +1106,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1107: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1110: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1130,7 +1133,7 @@
   echo "$ac_t""no" 1>&6
 # Some strange OSes (SINIX) have it in libsocket:
        echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1134: checking for gethostbyname in -lsocket" >&5
+echo "configure:1137: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1138,7 +1141,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1142 "configure"
+#line 1145 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1149,7 +1152,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1153: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1156: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1178,7 +1181,7 @@
           # AC_CHECK_LIB's API is essentially broken so the following
           # ugliness is necessary:
           echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1182: checking for gethostbyname in -lsocket" >&5
+echo "configure:1185: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1186,7 +1189,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1190 "configure"
+#line 1193 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1197,7 +1200,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1201: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1204: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1216,7 +1219,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for gethostbyname in -lresolv""... $ac_c" 1>&6
-echo "configure:1220: checking for gethostbyname in -lresolv" >&5
+echo "configure:1223: checking for gethostbyname in -lresolv" >&5
 ac_lib_var=`echo resolv'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1224,7 +1227,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1228 "configure"
+#line 1231 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1235,7 +1238,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1239: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1242: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1267,12 +1270,12 @@
 fi
 
   echo $ac_n "checking for socket""... $ac_c" 1>&6
-echo "configure:1271: checking for socket" >&5
+echo "configure:1274: checking for socket" >&5
 if eval "test \"`echo '$''{'ac_cv_func_socket'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1276 "configure"
+#line 1279 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char socket(); below.  */
@@ -1295,7 +1298,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1299: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1302: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_socket=yes"
 else
@@ -1313,7 +1316,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1317: checking for socket in -lsocket" >&5
+echo "configure:1320: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1321,7 +1324,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1325 "configure"
+#line 1328 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1332,7 +1335,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1336: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1339: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1358,7 +1361,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1362: checking for socket in -lsocket" >&5
+echo "configure:1365: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1366,7 +1369,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1370 "configure"
+#line 1373 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1377,7 +1380,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1381: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1384: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1403,7 +1406,7 @@
 
   
 echo $ac_n "checking if DNS Kerberos lookup support should be compiled in""... $ac_c" 1>&6
-echo "configure:1407: checking if DNS Kerberos lookup support should be compiled in" >&5
+echo "configure:1410: checking if DNS Kerberos lookup support should be compiled in" >&5
 
   # Check whether --enable-dns or --disable-dns was given.
 if test "${enable_dns+set}" = set; then
@@ -1472,12 +1475,12 @@
 
   if test "$enable_dns" = yes ; then
     echo $ac_n "checking for res_search""... $ac_c" 1>&6
-echo "configure:1476: checking for res_search" >&5
+echo "configure:1479: checking for res_search" >&5
 if eval "test \"`echo '$''{'ac_cv_func_res_search'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1481 "configure"
+#line 1484 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char res_search(); below.  */
@@ -1500,7 +1503,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1504: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1507: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_res_search=yes"
 else
@@ -1518,7 +1521,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for res_search in -lresolv""... $ac_c" 1>&6
-echo "configure:1522: checking for res_search in -lresolv" >&5
+echo "configure:1525: checking for res_search in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_search | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1526,7 +1529,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1530 "configure"
+#line 1533 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1537,7 +1540,7 @@
 res_search()
 ; return 0; }
 EOF
-if { (eval echo configure:1541: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1544: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1577,7 +1580,7 @@
 if test "$with_hesiod" != "no"; then
 	HESIOD_DEFS=-DHESIOD
 	echo $ac_n "checking for res_send in -lresolv""... $ac_c" 1>&6
-echo "configure:1581: checking for res_send in -lresolv" >&5
+echo "configure:1584: checking for res_send in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_send | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1585,7 +1588,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1589 "configure"
+#line 1592 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1596,7 +1599,7 @@
 res_send()
 ; return 0; }
 EOF
-if { (eval echo configure:1600: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1603: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1670,7 +1673,7 @@
 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
 # ./install, which can be erroneously created by make from ./install.sh.
 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
-echo "configure:1674: checking for a BSD compatible install" >&5
+echo "configure:1677: checking for a BSD compatible install" >&5
 if test -z "$INSTALL"; then
 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1727,7 +1730,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1731: checking for $ac_word" >&5
+echo "configure:1734: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_AWK'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1759,7 +1762,7 @@
 # Extract the first word of "flex", so it can be a program name with args.
 set dummy flex; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1763: checking for $ac_word" >&5
+echo "configure:1766: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_LEX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1793,7 +1796,7 @@
   *) ac_lib=l ;;
   esac
   echo $ac_n "checking for yywrap in -l$ac_lib""... $ac_c" 1>&6
-echo "configure:1797: checking for yywrap in -l$ac_lib" >&5
+echo "configure:1800: checking for yywrap in -l$ac_lib" >&5
 ac_lib_var=`echo $ac_lib'_'yywrap | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1801,7 +1804,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-l$ac_lib  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1805 "configure"
+#line 1808 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1812,7 +1815,7 @@
 yywrap()
 ; return 0; }
 EOF
-if { (eval echo configure:1816: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1819: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1835,12 +1838,12 @@
 fi
 
 echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:1839: checking for working const" >&5
+echo "configure:1842: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1844 "configure"
+#line 1847 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -1889,7 +1892,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1893: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1896: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1912,12 +1915,12 @@
 for ac_func in strdup labs setvbuf memmove bcopy inet_ntoa inet_aton
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:1916: checking for $ac_func" >&5
+echo "configure:1919: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1921 "configure"
+#line 1924 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -1940,7 +1943,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1944: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1947: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -1965,7 +1968,7 @@
 done
 
 echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6
-echo "configure:1969: checking how to run the C preprocessor" >&5
+echo "configure:1972: checking how to run the C preprocessor" >&5
 # On Suns, sometimes $CPP names a directory.
 if test -n "$CPP" && test -d "$CPP"; then
   CPP=
@@ -1980,13 +1983,13 @@
   # On the NeXT, cc -E runs the code through the compiler's parser,
   # not just through cpp.
   cat > conftest.$ac_ext <<EOF
-#line 1984 "configure"
+#line 1987 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:1990: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:1993: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -1997,13 +2000,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -E -traditional-cpp"
   cat > conftest.$ac_ext <<EOF
-#line 2001 "configure"
+#line 2004 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2007: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2010: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -2014,13 +2017,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -nologo -E"
   cat > conftest.$ac_ext <<EOF
-#line 2018 "configure"
+#line 2021 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2024: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2027: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -2045,7 +2048,7 @@
 echo "$ac_t""$CPP" 1>&6
 
 echo $ac_n "checking for yylineno declaration""... $ac_c" 1>&6
-echo "configure:2049: checking for yylineno declaration" >&5
+echo "configure:2052: checking for yylineno declaration" >&5
 if eval "test \"`echo '$''{'krb5_cv_type_yylineno'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2071,17 +2074,17 @@
 
 ac_safe=`echo "dirent.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for dirent.h""... $ac_c" 1>&6
-echo "configure:2075: checking for dirent.h" >&5
+echo "configure:2078: checking for dirent.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2080 "configure"
+#line 2083 "configure"
 #include "confdefs.h"
 #include <dirent.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2085: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2088: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2106,12 +2109,12 @@
 fi
 
 echo $ac_n "checking for uid_t in sys/types.h""... $ac_c" 1>&6
-echo "configure:2110: checking for uid_t in sys/types.h" >&5
+echo "configure:2113: checking for uid_t in sys/types.h" >&5
 if eval "test \"`echo '$''{'ac_cv_type_uid_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2115 "configure"
+#line 2118 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 EOF
@@ -2141,17 +2144,17 @@
 
 ac_safe=`echo "termios.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for termios.h""... $ac_c" 1>&6
-echo "configure:2145: checking for termios.h" >&5
+echo "configure:2148: checking for termios.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2150 "configure"
+#line 2153 "configure"
 #include "confdefs.h"
 #include <termios.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2155: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2158: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2168,12 +2171,12 @@
 if eval "test \"`echo '$ac_cv_header_'$ac_safe`\" = yes"; then
   echo "$ac_t""yes" 1>&6
   echo $ac_n "checking for tcsetattr""... $ac_c" 1>&6
-echo "configure:2172: checking for tcsetattr" >&5
+echo "configure:2175: checking for tcsetattr" >&5
 if eval "test \"`echo '$''{'ac_cv_func_tcsetattr'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2177 "configure"
+#line 2180 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char tcsetattr(); below.  */
@@ -2196,7 +2199,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2200: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2203: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_tcsetattr=yes"
 else
@@ -2224,12 +2227,12 @@
 
 
 echo $ac_n "checking POSIX signal handlers""... $ac_c" 1>&6
-echo "configure:2228: checking POSIX signal handlers" >&5
+echo "configure:2231: checking POSIX signal handlers" >&5
 if eval "test \"`echo '$''{'krb5_cv_has_posix_signals'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2233 "configure"
+#line 2236 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #include <signal.h>
@@ -2241,7 +2244,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2245: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2248: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_has_posix_signals=yes
 else
@@ -2279,17 +2282,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:2283: checking for $ac_hdr" >&5
+echo "configure:2286: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2288 "configure"
+#line 2291 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2293: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2296: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2318,12 +2321,12 @@
 
 
 echo $ac_n "checking for stdarg.h""... $ac_c" 1>&6
-echo "configure:2322: checking for stdarg.h" >&5
+echo "configure:2325: checking for stdarg.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_stdarg_h'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2327 "configure"
+#line 2330 "configure"
 #include "confdefs.h"
 #include <stdarg.h>
 int main() {
@@ -2338,7 +2341,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2342: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2345: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_header_stdarg_h=yes
 else
@@ -2358,12 +2361,12 @@
 else
 
 echo $ac_n "checking for varargs.h""... $ac_c" 1>&6
-echo "configure:2362: checking for varargs.h" >&5
+echo "configure:2365: checking for varargs.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_varargs_h'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2367 "configure"
+#line 2370 "configure"
 #include "confdefs.h"
 #include <varargs.h>
 int main() {
@@ -2378,7 +2381,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2382: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2385: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_header_varargs_h=yes
 else
@@ -2406,17 +2409,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:2410: checking for $ac_hdr" >&5
+echo "configure:2413: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2415 "configure"
+#line 2418 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2420: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2423: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2445,12 +2448,12 @@
 for ac_func in inet_ntop inet_pton getipnodebyname getipnodebyaddr getaddrinfo getnameinfo
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:2449: checking for $ac_func" >&5
+echo "configure:2452: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2454 "configure"
+#line 2457 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -2473,7 +2476,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2477: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2480: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -2508,13 +2511,13 @@
   yes | try)
 	
 echo $ac_n "checking for IPv6 compile-time support""... $ac_c" 1>&6
-echo "configure:2512: checking for IPv6 compile-time support" >&5
+echo "configure:2515: checking for IPv6 compile-time support" >&5
 if eval "test \"`echo '$''{'krb5_cv_inet6'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   
 cat > conftest.$ac_ext <<EOF
-#line 2518 "configure"
+#line 2521 "configure"
 #include "confdefs.h"
 
 #ifdef HAVE_SYS_TYPES_H
@@ -2540,7 +2543,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2544: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2547: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_inet6=yes
 else
@@ -2568,7 +2571,7 @@
 esac
 
 echo $ac_n "checking for ANSI stdio""... $ac_c" 1>&6
-echo "configure:2572: checking for ANSI stdio" >&5
+echo "configure:2575: checking for ANSI stdio" >&5
 if eval "test \"`echo '$''{'krb5_cv_has_ansi_stdio'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2576,7 +2579,7 @@
   krb5_cv_has_ansi_stdio=yes
 else
   cat > conftest.$ac_ext <<EOF
-#line 2580 "configure"
+#line 2583 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main()
@@ -2589,7 +2592,7 @@
   exit(0);
 }
 EOF
-if { (eval echo configure:2593: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:2596: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   krb5_cv_has_ansi_stdio=yes
 else
@@ -2611,19 +2614,19 @@
 fi
 
 echo $ac_n "checking prototype support""... $ac_c" 1>&6
-echo "configure:2615: checking prototype support" >&5
+echo "configure:2618: checking prototype support" >&5
 if eval "test \"`echo '$''{'krb5_cv_has_prototypes'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2620 "configure"
+#line 2623 "configure"
 #include "confdefs.h"
 int x(double y, int z);
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:2627: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2630: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_has_prototypes=yes
 else
@@ -2649,19 +2652,19 @@
 fi
 
 echo $ac_n "checking prototypes in structs""... $ac_c" 1>&6
-echo "configure:2653: checking prototypes in structs" >&5
+echo "configure:2656: checking prototypes in structs" >&5
 if eval "test \"`echo '$''{'krb5_cv_struct_prototypes'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2658 "configure"
+#line 2661 "configure"
 #include "confdefs.h"
 typedef int i_t; typedef struct foo { int (*foofn)(i_t, i_t); } *footype;
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:2665: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2668: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_struct_prototypes=yes
 else
@@ -2681,19 +2684,19 @@
 
 fi
 echo $ac_n "checking void""... $ac_c" 1>&6
-echo "configure:2685: checking void" >&5
+echo "configure:2688: checking void" >&5
 if eval "test \"`echo '$''{'krb5_cv_has_void_type'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2690 "configure"
+#line 2693 "configure"
 #include "confdefs.h"
 void x();
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:2697: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2700: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_has_void_type=yes
 else
@@ -2713,7 +2716,7 @@
 
 fi
 echo $ac_n "checking size of short""... $ac_c" 1>&6
-echo "configure:2717: checking size of short" >&5
+echo "configure:2720: checking size of short" >&5
 if eval "test \"`echo '$''{'ac_cv_sizeof_short'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2721,7 +2724,7 @@
     { echo "configure: error: can not run test program while cross compiling" 1>&2; exit 1; }
 else
   cat > conftest.$ac_ext <<EOF
-#line 2725 "configure"
+#line 2728 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 main()
@@ -2732,7 +2735,7 @@
   exit(0);
 }
 EOF
-if { (eval echo configure:2736: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:2739: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_sizeof_short=`cat conftestval`
 else
@@ -2752,7 +2755,7 @@
 
 
 echo $ac_n "checking size of int""... $ac_c" 1>&6
-echo "configure:2756: checking size of int" >&5
+echo "configure:2759: checking size of int" >&5
 if eval "test \"`echo '$''{'ac_cv_sizeof_int'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2760,7 +2763,7 @@
     { echo "configure: error: can not run test program while cross compiling" 1>&2; exit 1; }
 else
   cat > conftest.$ac_ext <<EOF
-#line 2764 "configure"
+#line 2767 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 main()
@@ -2771,7 +2774,7 @@
   exit(0);
 }
 EOF
-if { (eval echo configure:2775: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:2778: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_sizeof_int=`cat conftestval`
 else
@@ -2791,7 +2794,7 @@
 
 
 echo $ac_n "checking size of long""... $ac_c" 1>&6
-echo "configure:2795: checking size of long" >&5
+echo "configure:2798: checking size of long" >&5
 if eval "test \"`echo '$''{'ac_cv_sizeof_long'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2799,7 +2802,7 @@
     { echo "configure: error: can not run test program while cross compiling" 1>&2; exit 1; }
 else
   cat > conftest.$ac_ext <<EOF
-#line 2803 "configure"
+#line 2806 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 main()
@@ -2810,7 +2813,7 @@
   exit(0);
 }
 EOF
-if { (eval echo configure:2814: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:2817: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_sizeof_long=`cat conftestval`
 else
@@ -2830,12 +2833,12 @@
 
 
 echo $ac_n "checking whether time.h and sys/time.h may both be included""... $ac_c" 1>&6
-echo "configure:2834: checking whether time.h and sys/time.h may both be included" >&5
+echo "configure:2837: checking whether time.h and sys/time.h may both be included" >&5
 if eval "test \"`echo '$''{'ac_cv_header_time'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2839 "configure"
+#line 2842 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #include <sys/time.h>
@@ -2844,7 +2847,7 @@
 struct tm *tp;
 ; return 0; }
 EOF
-if { (eval echo configure:2848: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2851: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_header_time=yes
 else
@@ -2865,12 +2868,12 @@
 fi
 
 echo $ac_n "checking for ANSI C header files""... $ac_c" 1>&6
-echo "configure:2869: checking for ANSI C header files" >&5
+echo "configure:2872: checking for ANSI C header files" >&5
 if eval "test \"`echo '$''{'ac_cv_header_stdc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2874 "configure"
+#line 2877 "configure"
 #include "confdefs.h"
 #include <stdlib.h>
 #include <stdarg.h>
@@ -2878,7 +2881,7 @@
 #include <float.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2882: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2885: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2895,7 +2898,7 @@
 if test $ac_cv_header_stdc = yes; then
   # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
 cat > conftest.$ac_ext <<EOF
-#line 2899 "configure"
+#line 2902 "configure"
 #include "confdefs.h"
 #include <string.h>
 EOF
@@ -2913,7 +2916,7 @@
 if test $ac_cv_header_stdc = yes; then
   # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
 cat > conftest.$ac_ext <<EOF
-#line 2917 "configure"
+#line 2920 "configure"
 #include "confdefs.h"
 #include <stdlib.h>
 EOF
@@ -2934,7 +2937,7 @@
   :
 else
   cat > conftest.$ac_ext <<EOF
-#line 2938 "configure"
+#line 2941 "configure"
 #include "confdefs.h"
 #include <ctype.h>
 #define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
@@ -2945,7 +2948,7 @@
 exit (0); }
 
 EOF
-if { (eval echo configure:2949: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:2952: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -2969,12 +2972,12 @@
 fi
 
 echo $ac_n "checking for time_t""... $ac_c" 1>&6
-echo "configure:2973: checking for time_t" >&5
+echo "configure:2976: checking for time_t" >&5
 if eval "test \"`echo '$''{'ac_cv_type_time_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2978 "configure"
+#line 2981 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -3002,7 +3005,7 @@
 fi
 
 echo $ac_n "checking for replay cache directory""... $ac_c" 1>&6
-echo "configure:3006: checking for replay cache directory" >&5
+echo "configure:3009: checking for replay cache directory" >&5
 if eval "test \"`echo '$''{'krb5_cv_sys_rcdir'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
--- krb5-1.2.4.orig/src/kadmin/ktutil/ktutil_funcs.c
+++ krb5-1.2.4/src/kadmin/ktutil/ktutil_funcs.c
@@ -515,6 +515,9 @@
 		lp1->entry = lp->entry;
 	}
     }
+    umask(0077); /*Changing umask for all of ktutil is OK
+		  * We don't ever write out anything that should use
+		  * default umask.*/
     fp = fopen(name, "w");
     if (!fp) {
 	retval = EIO;
--- krb5-1.2.4.orig/src/kadmin/v4server/kadm_ser_wrap.c
+++ krb5-1.2.4/src/kadmin/v4server/kadm_ser_wrap.c
@@ -170,14 +170,21 @@
     u_char *retdat, *tmpdat;
     int retval, retlen;
 
-    if (strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) {
+    if ((*dat_len < KADM_VERSIZE + sizeof(krb5_ui_4))
+	|| strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) {
 	errpkt(dat, dat_len, KADM_BAD_VER);
 	return KADM_BAD_VER;
     }
     in_len = KADM_VERSIZE;
     /* get the length */
-    if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0)
+    if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0
+	|| (r_len > *dat_len - KADM_VERSIZE - sizeof(krb5_ui_4))
+	|| (*dat_len - r_len - KADM_VERSIZE -
+	    sizeof(krb5_ui_4) > sizeof(authent.dat))) {
+	errpkt(dat, dat_len, KADM_LENGTH_ERROR);
 	return KADM_LENGTH_ERROR;
+    }
+
     in_len += retc;
     authent.length = *dat_len - r_len - KADM_VERSIZE - sizeof(krb5_ui_4);
     memcpy((char *)authent.dat, (char *)(*dat) + in_len, authent.length);
--- krb5-1.2.4.orig/src/kadmin/configure
+++ krb5-1.2.4/src/kadmin/configure
@@ -3302,10 +3302,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/krb524/configure
+++ krb5-1.2.4/src/krb524/configure
@@ -2013,10 +2013,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/krb524/cnv_tkt_skey.c
+++ krb5-1.2.4/src/krb524/cnv_tkt_skey.c
@@ -167,25 +167,7 @@
 				 sname,
 				 sinst,
 				 v4_skey->contents);
-     } else {
-	 /* Force enctype to be raw if using DES3. */
-	 if (v4_skey->enctype == ENCTYPE_DES3_CBC_SHA1 ||
-	     v4_skey->enctype == ENCTYPE_LOCAL_DES3_HMAC_SHA1)
-	     v4_skey->enctype = ENCTYPE_DES3_CBC_RAW;
-	 ret = krb_cr_tkt_krb5(v4tkt,
-			       0, /* flags */			     
-			       pname,
-			       pinst,
-			       prealm,
-			       *((unsigned long *)kaddr.contents),
-			       (char *) v5etkt->session->contents,
-			       lifetime,
-			       /* issue_data */
-			       server_time,
-			       sname,
-			       sinst,
-			       v4_skey);
-     }
+     } else  abort();
 
      krb5_free_enc_tkt_part(context, v5etkt);
      v5tkt->enc_part2 = NULL;
--- krb5-1.2.4.orig/src/krb524/krb524d.c
+++ krb5-1.2.4/src/krb524/krb524d.c
@@ -48,6 +48,7 @@
 void *handle;
 
 int use_keytab, use_master;
+int allow_v4_crossrealm = 0;
 char *keytab = NULL;
 krb5_keytab kt;
 
@@ -105,7 +106,10 @@
      config_params.mask = 0;
      
      while (argc) {
-	  if (strncmp(*argv, "-k", 2) == 0)
+       if (strncmp(*argv, "-X", 2) == 0) {
+	 allow_v4_crossrealm = 1;
+       }
+       else if (strncmp(*argv, "-k", 2) == 0)
 	       use_keytab = 1;
 	  else if (strncmp(*argv, "-m", 2) == 0)
 	       use_master = 1;
@@ -142,7 +146,6 @@
      saddr.sin_addr.s_addr = INADDR_ANY;
      serv = getservbyname(KRB524_SERVICE, "udp");
      if (serv == NULL) {
-	  com_err(whoami, 0, "service entry not found, using %d", KRB524_PORT);
 	  saddr.sin_port = htons(KRB524_PORT);
      } else
 	  saddr.sin_port = serv->s_port;
@@ -299,18 +302,6 @@
 	  goto error;
 
      if ((ret = lookup_service_key(context, v5tkt->server,
-				   ENCTYPE_DES3_CBC_RAW,
-				   0, /* highest kvno */
-				   &v4_service_key, &v4kvno)) &&
-	 (ret = lookup_service_key(context, v5tkt->server,
-				   ENCTYPE_LOCAL_DES3_HMAC_SHA1,
-				   0,
-				   &v4_service_key, &v4kvno)) &&
-	 (ret = lookup_service_key(context, v5tkt->server,
-				   ENCTYPE_DES3_CBC_SHA1,
-				   0,
-				   &v4_service_key, &v4kvno)) &&
-	 (ret = lookup_service_key(context, v5tkt->server,
 				   ENCTYPE_DES_CBC_CRC,
 				   0,
 				   &v4_service_key, &v4kvno)))
@@ -318,8 +309,19 @@
 
      if (debug)
 	  printf("service key retrieved\n");
+     if ((ret = krb5_decrypt_tkt_part(context, &v5_service_key, v5tkt))) {
+       goto error;
+     }
+
+    if (!(allow_v4_crossrealm || krb5_realm_compare(context, v5tkt->server,
+						    v5tkt->enc_part2->client))) {
+ret =  KRB5KDC_ERR_POLICY ;
+ goto error;
+    }
+    krb5_free_enc_tkt_part(context, v5tkt->enc_part2);
+    v5tkt->enc_part2= NULL;
 
-     ret = krb524_convert_tkt_skey(context, v5tkt, &v4tkt, &v5_service_key,
+         ret = krb524_convert_tkt_skey(context, v5tkt, &v4tkt, &v5_service_key,
 				   &v4_service_key,
 				   (struct sockaddr_in *)&saddr);
      if (ret)
--- krb5-1.2.4.orig/src/lib/crypto/configure
+++ krb5-1.2.4/src/lib/crypto/configure
@@ -2107,10 +2107,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/kdb/configure
+++ krb5-1.2.4/src/lib/kdb/configure
@@ -2283,10 +2283,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/kdb/kdb_xdr.c
+++ krb5-1.2.4/src/lib/kdb/kdb_xdr.c
@@ -726,6 +726,7 @@
     krb5_key_data	*datap;
     krb5_error_code	ret;
 
+    ret = 0;
     if (kvno == -1 && stype == -1 && ktype == -1)
 	kvno = 0;
 
--- krb5-1.2.4.orig/src/lib/kdb/keytab.c
+++ krb5-1.2.4/src/lib/kdb/keytab.c
@@ -28,6 +28,8 @@
 #include "k5-int.h"
 #include "kdb_kt.h"
 
+static int
+is_xrealm_tgt(krb5_context, krb5_const_principal);
 krb5_error_code krb5_ktkdb_close KRB5_PROTOTYPE((krb5_context, krb5_keytab));
 
 krb5_error_code krb5_ktkdb_get_entry KRB5_PROTOTYPE((krb5_context, krb5_keytab, krb5_const_principal,
@@ -98,6 +100,8 @@
     krb5_db_entry 	  db_entry;
     krb5_boolean 	  more = 0;
     int 	 	  n = 0;
+    int xrealm_tgt = is_xrealm_tgt(context, principal);
+    int similar;
 
     /* Open database */
     /* krb5_db_init(context); */
@@ -121,16 +125,31 @@
     if (kerror)
 	goto error;
 
+    /* For cross realm tgts, we match whatever enctype is provided;
+     * for other principals, we only match the first enctype that is
+     * found.  Since the TGS and AS code do the same thing, then we
+     * will only successfully decrypt  tickets we have issued.*/
     kerror = krb5_dbe_find_enctype(context, &db_entry,
-				   enctype, -1, kvno, &key_data);
+				   xrealm_tgt?enctype:-1,
+				   -1, kvno, &key_data);
     if (kerror)
 	goto error;
 
+
     kerror = krb5_dbekd_decrypt_key_data(context, master_key,
 					 key_data, &entry->key, NULL);
     if (kerror)
 	goto error;
 
+    kerror = krb5_c_enctype_compare(context, enctype, entry->key.enctype, &similar);
+    if (kerror)
+	goto error;
+
+    if (!similar) {
+		kerror = KRB5_KDB_NO_PERMITTED_KEY;
+	goto error;
+    }
+
     /*
      * Coerce the enctype of the output keyblock in case we got an
      * inexact match on the enctype; this behavior will go away when
@@ -148,3 +167,27 @@
     krb5_db_close_database(context);
     return(kerror);
 }
+
+/*
+ * is_xrealm_tgt: Returns true if the principal is a cross-realm  TGT
+ * principal-- a principal with first component  krbtgt and second
+ * component not equal to realm.
+ */
+static int
+is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
+{
+    krb5_data *dat;
+    if (krb5_princ_size(context, princ) != 2)
+	return 0;
+    dat = krb5_princ_component(context, princ, 0);
+    if (strncmp("krbtgt", dat->data, dat->length) != 0)
+	return 0;
+    dat = krb5_princ_component(context, princ, 1);
+    if (dat->length != princ->realm.length)
+	return 1;
+    if (strcmp(dat->data, princ->realm.data) == 0)
+	return 0;
+    return 1;
+
+}
+
--- krb5-1.2.4.orig/src/lib/des425/configure
+++ krb5-1.2.4/src/lib/des425/configure
@@ -2196,10 +2196,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/gssapi/Makefile.in
+++ krb5-1.2.4/src/lib/gssapi/Makefile.in
@@ -28,8 +28,8 @@
 STOBJLISTS=OBJS.ST generic/OBJS.ST krb5/OBJS.ST
 SHLIB_EXPDEPS=\
 	$(TOPLIBD)/libkrb5$(SHLIBEXT) \
-	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT)
+	$(TOPLIBD)/libk5crypto$(SHLIBEXT) 
+
 SHLIB_EXPLIBS=-lkrb5 -lk5crypto -lcom_err
 SHLIB_DIRS=-L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
--- krb5-1.2.4.orig/src/lib/gssapi/krb5/accept_sec_context.c
+++ krb5-1.2.4/src/lib/gssapi/krb5/accept_sec_context.c
@@ -81,8 +81,9 @@
 
 /* Decode, decrypt and store the forwarded creds in the local ccache. */
 static krb5_error_code
-rd_and_store_for_creds(context, inbuf, out_cred)
+rd_and_store_for_creds(context, auth_context, inbuf, out_cred)
     krb5_context context;
+    krb5_auth_context auth_context;
     krb5_data *inbuf;
     krb5_gss_cred_id_t *out_cred;
 {
@@ -91,15 +92,39 @@
     krb5_ccache ccache = NULL;
     krb5_gss_cred_id_t cred = NULL;
     extern krb5_cc_ops krb5_mcc_ops;
-    krb5_auth_context auth_context = NULL;
+    krb5_auth_context new_auth_ctx = NULL;
+	krb5_int32 flags_org;
 
-    if ((retval = krb5_auth_con_init(context, &auth_context)))
-	return(retval);
-
-    krb5_auth_con_setflags(context, auth_context, 0);
-
-    if ((retval = krb5_rd_cred(context, auth_context, inbuf, &creds, NULL))) 
-	goto cleanup;
+	if (retval = krb5_auth_con_getflags(context, auth_context, &flags_org))
+		return retval;
+	krb5_auth_con_setflags(context, auth_context, 0);
+
+	/* By the time krb5_rd_cred is called here (after krb5_rd_req has been */
+	/* called in krb5_gss_accept_sec_context), the "keyblock" field of */
+	/* auth_context contains a pointer to the session key, and the */
+	/* "remote_subkey" field might contain a session subkey.  Either of */
+	/* these (the "remote_subkey" if it isn't NULL, otherwise the */
+	/* "keyblock") might have been used to encrypt the encrypted part of */
+	/* the KRB_CRED message that contains the forwarded credentials.  (The */
+	/* Java Crypto and Security Implementation from the DSTC in Australia */
+	/* always uses the session key.  But apparently it never negotiates a */
+	/* subkey, so this code works fine against a JCSI client.)  Up to the */
+	/* present, though, GSSAPI clients linked against the MIT code (which */
+	/* is almost all GSSAPI clients) don't encrypt the KRB_CRED message at */
+	/* all -- at this level.  So if the first call to krb5_rd_cred fails, */
+	/* we should call it a second time with another auth context freshly */
+	/* created by krb5_auth_con_init.  All of its keyblock fields will be */
+	/* NULL, so krb5_rd_cred will assume that the KRB_CRED message is */
+	/* unencrypted.  (The MIT code doesn't actually send the KRB_CRED */
+	/* message in the clear -- the "authenticator" whose "checksum" ends up */
+	/* containing the KRB_CRED message does get encrypted.) */
+	if (krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)) {
+		if (retval = krb5_auth_con_init(context, &new_auth_ctx))
+			goto cleanup;
+		krb5_auth_con_setflags(context, new_auth_ctx, 0);
+		if (retval = krb5_rd_cred(context, new_auth_ctx, inbuf, &creds, NULL))
+			goto cleanup;
+		}
 
     /* Lots of kludging going on here... Some day the ccache interface
        will be rewritten though */
@@ -162,8 +187,10 @@
     if (out_cred)
 	*out_cred = cred; /* return credential */
 
-    if (auth_context)
-	krb5_auth_con_free(context, auth_context);
+	if (new_auth_ctx)
+		krb5_auth_con_free(context, new_auth_ctx);
+
+	krb5_auth_con_setflags(context, auth_context, flags_org);
 
     return retval;
 }
@@ -426,12 +453,16 @@
 	   goto fail;
        }
 
-       TREAD_STR(ptr, ptr2, reqcksum.length);
-       if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) {
-	   code = 0;
-	   major_status = GSS_S_BAD_BINDINGS;
-	   goto fail;
-       }
+		TREAD_STR(ptr, ptr2, reqcksum.length);
+		/* If server has chosen not to use channel bindings, ignore */
+		/* any channel bindings sent by the client. */
+		if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS) {
+			if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) {
+				code = 0;
+				major_status = GSS_S_BAD_BINDINGS;
+				goto fail;
+				}
+			}
 
        xfree(reqcksum.contents);
        reqcksum.contents = 0;
@@ -476,7 +507,7 @@
 
 		   /* store the delegated credential */
 
-		   if (code = rd_and_store_for_creds(context, &option,
+		   if (code = rd_and_store_for_creds(context, auth_context, &option,
 						     (delegated_cred_handle) ?
 						     &deleg_cred : NULL)) {
 		       major_status = GSS_S_FAILURE;
--- krb5-1.2.4.orig/src/lib/gssapi/configure
+++ krb5-1.2.4/src/lib/gssapi/configure
@@ -2510,10 +2510,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/kadm5/clnt/Makefile.in
+++ krb5-1.2.4/src/lib/kadm5/clnt/Makefile.in
@@ -11,12 +11,10 @@
 SHLIB_EXPDEPS=\
 	$(TOPLIBD)/libgssrpc$(SHLIBEXT) \
 	$(TOPLIBD)/libgssapi_krb5$(SHLIBEXT) \
-	$(TOPLIBD)/libkdb5$(SHLIBEXT) \
 	$(TOPLIBD)/libkrb5$(SHLIBEXT) \
 	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT) \
 	$(TOPLIBD)/libdyn$(SHLIBEXT)
-SHLIB_EXPLIBS=-lgssrpc -lgssapi_krb5 -lkdb5 -lkrb5 -lk5crypto -lcom_err -ldyn
+SHLIB_EXPLIBS=-lgssrpc -lgssapi_krb5  -lkrb5 -lk5crypto -lcom_err -ldyn
 SHLIB_DIRS=-L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
 RELDIR=kadm5/clnt
--- krb5-1.2.4.orig/src/lib/kadm5/srv/Makefile.in
+++ krb5-1.2.4/src/lib/kadm5/srv/Makefile.in
@@ -18,7 +18,6 @@
 	$(TOPLIBD)/libkdb5$(SHLIBEXT) \
 	$(TOPLIBD)/libkrb5$(SHLIBEXT) \
 	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT) \
 	$(TOPLIBD)/libdyn$(SHLIBEXT)
 SHLIB_EXPLIBS=-lgssrpc -lgssapi_krb5 -lkdb5  -lkrb5 -lk5crypto -lcom_err -ldyn @GEN_LIB@ @AIX_DB_LIB@
 SHLIB_DIRS=-L$(TOPLIBD)
--- krb5-1.2.4.orig/src/lib/kadm5/srv/server_acl.c
+++ krb5-1.2.4/src/lib/kadm5/srv/server_acl.c
@@ -640,39 +640,37 @@
 	    continue;
 
 	/* We've matched the principal.  If we have a target, then try it */
-	if (entry->ae_target) {
-	    if (!strcmp(entry->ae_target, "*"))
-		break;
+	if (entry->ae_target && strcmp(entry->ae_target, "*")) {
 	    if (!entry->ae_target_princ && !entry->ae_target_bad) {
 		kret = krb5_parse_name(kcontext, entry->ae_target,
 				       &entry->ae_target_princ);
 		if (kret)
 		    entry->ae_target_bad = 1;
 	    }
-	}
-	if (entry->ae_target_bad) {
-	    DPRINT(DEBUG_ACL, acl_debug_level,
-		   ("Bad target in ACL entry for %s\n", entry->ae_name));
-	    entry->ae_name_bad = 1;
-	    continue;
-	}
-	if (entry->ae_target && !dest_princ)
-	    matchgood = 0;
-	else if (entry->ae_target && entry->ae_target_princ && dest_princ) {
-	    if (acl_match_data(&entry->ae_target_princ->realm,
-			       &dest_princ->realm, 1, (wildstate_t *)0) &&
-		(entry->ae_target_princ->length == dest_princ->length)) {
-		for (i=0; i<dest_princ->length; i++) {
-		    if (!acl_match_data(&entry->ae_target_princ->data[i],
-					&dest_princ->data[i], 1, &state)) {
-			matchgood = 0;
-			break;
+	    if (entry->ae_target_bad) {
+	        DPRINT(DEBUG_ACL, acl_debug_level,
+		       ("Bad target in ACL entry for %s\n", entry->ae_name));
+	        entry->ae_name_bad = 1;
+	        continue;
+	    }
+	    if (!dest_princ)
+	        matchgood = 0;
+	    else if (entry->ae_target_princ && dest_princ) {
+	        if (acl_match_data(&entry->ae_target_princ->realm,
+			           &dest_princ->realm, 1, (wildstate_t *)0) &&
+		    (entry->ae_target_princ->length == dest_princ->length)) {
+		    for (i=0; i<dest_princ->length; i++) {
+		        if (!acl_match_data(&entry->ae_target_princ->data[i],
+			  		    &dest_princ->data[i], 1, &state)) {
+			    matchgood = 0;
+			    break;
+		        }
 		    }
-		}
+	        }
+	        else
+		    matchgood = 0;
 	    }
-	    else
-		matchgood = 0;
-	}
+        }
 	if (!matchgood)
 	    continue;
 
--- krb5-1.2.4.orig/src/lib/kadm5/configure
+++ krb5-1.2.4/src/lib/kadm5/configure
@@ -3300,10 +3300,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/krb4/Makefile.in
+++ krb5-1.2.4/src/lib/krb4/Makefile.in
@@ -17,13 +17,13 @@
 # Depends on libkrb5, expect to find
 #	krb5_init_context, krb5_free_context, profile_get_values
 #
-KRB4_CRYPTO_LIBS=-ldes425
+KRB4_CRYPTO_LIBS=-Wl,-Bsymbolic -ldes425
 
 SHLIB_EXPDEPS = \
 	$(TOPLIBD)/libdes425$(SHLIBEXT) \
 	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
 	$(TOPLIBD)/libkrb5$(SHLIBEXT)
-SHLIB_EXPLIBS=-lkrb5 -lcom_err -ldes425 -lk5crypto
+SHLIB_EXPLIBS=-lkrb5 -lcom_err -Wl,-Bsymbolic -ldes425 -lk5crypto
 SHLIB_DIRS=-L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
 
--- krb5-1.2.4.orig/src/lib/krb4/configure
+++ krb5-1.2.4/src/lib/krb4/configure
@@ -2525,10 +2525,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/krb4/mk_priv.c
+++ krb5-1.2.4/src/lib/krb4/mk_priv.c
@@ -19,6 +19,7 @@
 
 #include <stdio.h>
 #include <string.h>
+#include <assert.h>
 
 #define	DEFINE_SOCKADDR		/* Ask for sockets declarations from krb.h. */
 #include "krb.h"
@@ -94,12 +95,15 @@
     register u_char     *p,*q;
     u_char *c_length_ptr;
     extern int private_msg_ver; /* in krb_rd_priv.c */
+    des_key_schedule ks;
+    
 
     unsigned KRB4_32 c_length;
     u_char msg_time_5ms;
     unsigned KRB4_32 msg_time_sec;
     unsigned KRB4_32 msg_time_usec;
 
+    
     /*
      * get the current time to use instead of a sequence #, since
      * process lifetime may be shorter than the lifetime of a session
@@ -196,9 +200,15 @@
     memcpy((char *)c_length_ptr, (char *) &c_length, sizeof(c_length));
 
 #ifndef NOENCRYPTION
+    if (!schedule) {
+      assert(des_key_sched(key, ks) == 0);
+	schedule = ks;
+	}
     /* pcbc encrypt, pad as needed, use key as ivec */
     pcbc_encrypt((C_Block *) q,(C_Block *) q, (long) (p-q), schedule,
                  (C_Block *)key, ENCRYPT);
+    memset(ks, 0, sizeof(ks));
+    
 #endif /* NOENCRYPTION */
 
     return (q - out + c_length);        /* resulting size */
--- krb5-1.2.4.orig/src/lib/krb4/rd_priv.c
+++ krb5-1.2.4/src/lib/krb4/rd_priv.c
@@ -23,6 +23,7 @@
 /* system include files */
 #include <stdio.h>
 #include <string.h>
+#include <assert.h>
 
 /* application include files */
 #define	DEFINE_SOCKADDR		/* Ask for sockets declarations from krb.h. */
@@ -81,7 +82,7 @@
     int swap_bytes;
     unsigned KRB4_32 t_local;
     KRB4_32 delta_t;		/* Difference between timestamps */
-
+    des_key_schedule ks;
     p = in;			/* beginning of message */
     swap_bytes = 0;
 
@@ -112,9 +113,14 @@
     q = p;			/* mark start of encrypted stuff */
 
 #ifndef NOENCRYPTION
+    if (!schedule) {
+      assert(des_key_sched(key, ks) == 0);
+	schedule = ks;
+	}
     /* pcbc decrypt, use key as ivec */
     pcbc_encrypt((C_Block *)q, (C_Block *)q, (long)c_length,
                  schedule, (C_Block *)key, DECRYPT);
+    memset(ks, 0, sizeof(ks));
 #endif
 
     /* safely get application data length */
--- krb5-1.2.4.orig/src/lib/krb5/Makefile.in
+++ krb5-1.2.4/src/lib/krb5/Makefile.in
@@ -56,8 +56,8 @@
 
 RELDIR=krb5
 SHLIB_EXPDEPS = \
-	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT)
+	$(TOPLIBD)/libk5crypto$(SHLIBEXT) 
+
 SHLIB_EXPLIBS=-lk5crypto -lcom_err @GEN_LIB@ @RESOLV_LIB@
 SHLIB_DIRS=-L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
--- krb5-1.2.4.orig/src/lib/krb5/asn.1/asn1_get.c
+++ krb5-1.2.4/src/lib/krb5/asn.1/asn1_get.c
@@ -143,6 +143,8 @@
       if(retval) return retval;
       len = (len<<8) + (int)o;
     }
+    if (len < 0)
+      return ASN1_OVERRUN;
     if (indef != NULL && !len)
       *indef = 1;
     if(retlen != NULL) *retlen = len;
--- krb5-1.2.4.orig/src/lib/krb5/krb/rd_cred.c
+++ krb5-1.2.4/src/lib/krb5/krb/rd_cred.c
@@ -55,24 +55,22 @@
 /*----------------------- krb5_rd_cred_basic -----------------------*/
 
 static krb5_error_code 
-krb5_rd_cred_basic(context, pcreddata, pkeyblock, local_addr, remote_addr,
+krb5_rd_cred_basic(context, pcreddata, pkeyblock, 
 		   replaydata, pppcreds)
     krb5_context          context;
     krb5_data		* pcreddata;
     krb5_keyblock 	* pkeyblock;
-    krb5_address  	* local_addr;
-    krb5_address  	* remote_addr;
     krb5_replay_data    * replaydata;
     krb5_creds        *** pppcreds;
 {
-    krb5_error_code       retval;
-    krb5_cred 		* pcred;
+  krb5_error_code       retval;
+  krb5_cred 		* pcred;
     krb5_int32 		  ncreds;
     krb5_int32 		  i = 0;
     krb5_cred_enc_part 	  encpart;
 
     /* decode cred message */
-    if ((retval = decode_krb5_cred(pcreddata, &pcred)))
+        if ((retval = decode_krb5_cred(pcreddata, &pcred)))
     	return retval;
 
     memset(&encpart, 0, sizeof(encpart));
@@ -80,38 +78,6 @@
     if ((retval = decrypt_credencdata(context, pcred, pkeyblock, &encpart)))
 	goto cleanup_cred;
 
-    /*
-     * Only check the remote address if the KRB_CRED message was
-     * protected by encryption.  If it came in the checksum field of
-     * an init_sec_context message, skip over this check.
-     */
-    if (remote_addr && encpart.s_address && pkeyblock != NULL) {
-	if (!krb5_address_compare(context, remote_addr, encpart.s_address)) {
-	    retval = KRB5KRB_AP_ERR_BADADDR;
-	    goto cleanup_cred;
-	}
-    }
-
-    if (encpart.r_address) {
-        if (local_addr) {
-            if (!krb5_address_compare(context, local_addr, encpart.r_address)) {
-                retval = KRB5KRB_AP_ERR_BADADDR;
-                goto cleanup_cred;
-            }
-        } else {
-            krb5_address **our_addrs;
-
-            if ((retval = krb5_os_localaddr(context, &our_addrs))) {
-                goto cleanup_cred;
-            }
-            if (!krb5_address_search(context, encpart.r_address, our_addrs)) {
-                krb5_free_addresses(context, our_addrs);
-                retval =  KRB5KRB_AP_ERR_BADADDR;
-                goto cleanup_cred;
-            }
-            krb5_free_addresses(context, our_addrs);
-        }
-    }
 
     replaydata->timestamp = encpart.timestamp;
     replaydata->usec = encpart.usec;
@@ -232,54 +198,12 @@
       (auth_context->rcache == NULL))
         return KRB5_RC_REQUIRED;
 
-{
-    krb5_address * premote_fulladdr = NULL;
-    krb5_address * plocal_fulladdr = NULL;
-    krb5_address remote_fulladdr;
-    krb5_address local_fulladdr;
-    CLEANUP_INIT(2);
-
-    if (auth_context->local_addr) {
-    	if (auth_context->local_port) {
-            if (!(retval = krb5_make_fulladdr(context,auth_context->local_addr,
-                                 	      auth_context->local_port, 
-					      &local_fulladdr))){
-                CLEANUP_PUSH(local_fulladdr.contents, free);
-	        plocal_fulladdr = &local_fulladdr;
-            } else {
-	        return retval;
-            }
-	} else {
-            plocal_fulladdr = auth_context->local_addr;
-        }
-    }
-
-    if (auth_context->remote_addr) {
-    	if (auth_context->remote_port) {
-            if (!(retval = krb5_make_fulladdr(context,auth_context->remote_addr,
-                                 	      auth_context->remote_port, 
-					      &remote_fulladdr))){
-                CLEANUP_PUSH(remote_fulladdr.contents, free);
-	        premote_fulladdr = &remote_fulladdr;
-            } else {
-	        return retval;
-            }
-	} else {
-            premote_fulladdr = auth_context->remote_addr;
-        }
-    }
 
     if ((retval = krb5_rd_cred_basic(context, pcreddata, keyblock,
-				     plocal_fulladdr, premote_fulladdr,
 				     &replaydata, pppcreds))) {
-        CLEANUP_DONE();
-	return retval;
+      return retval;
     }
 
-    CLEANUP_DONE();
-}
-
-
     if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) {
         krb5_donot_replay replay;
         krb5_timestamp currenttime;
@@ -327,4 +251,3 @@
     return retval;
 }
 
-
--- krb5-1.2.4.orig/src/lib/krb5/krb/unparse.c
+++ krb5-1.2.4/src/lib/krb5/krb/unparse.c
@@ -150,7 +150,8 @@
 		*q++ = COMPONENT_SEP;
 	}
 
-	q--;			/* Back up last component separator */
+	if (i > 0)
+	    q--;		/* Back up last component separator */
 	*q++ = REALM_SEP;
 	
 	cp = krb5_princ_realm(context, principal)->data;
--- krb5-1.2.4.orig/src/lib/krb5/krb/walk_rtree.c
+++ krb5-1.2.4/src/lib/krb5/krb/walk_rtree.c
@@ -93,6 +93,27 @@
 #define max(x,y) ((x) > (y) ? (x) : (y))
 #endif
 
+/*
+ * xxx The following function is very confusing to read and probably
+ * is buggy.  It should be documented better.  Here is what I've
+ * learned about it doing a quick bug fixing walk through.  The
+ * function takes a client and server realm name and returns the set
+ * of realms (in a field called tree) that you need to get tickets in
+ * in order to get from the source realm to the destination realm.  It
+ * takes a realm separater character (normally ., but presumably there
+ * for all those X.500 realms) .  There are two modes it runs in: the
+ * ANL krb5.confmode and the hierarchy mode.  The ANL mode is
+ * fairly obvious.  The hierarchy mode looks for common components in
+ * both the client and server realms.  In general, the pointer scp and
+ * ccp are used to walk through the client and server realms.  The
+ * com_sdot and com_cdot pointers point to (I think) the beginning of
+ * the common part of the realm names.  I.E. strcmp(com_cdot,
+ * com_sdot) ==0 is roughly an invarient.  However, there are cases
+ * where com_sdot and com_cdot are set to point before the start of
+ * the client or server strings.  I think this only happens when there
+ * are no common components.  --hartmans 2002/03/14
+ */
+
 krb5_error_code
 krb5_walk_realm_tree(context, client, server, tree, realm_branch_char)
     krb5_context context;
@@ -115,6 +136,10 @@
 	char *cap_client, *cap_server;
 	char **cap_nodes;
         krb5_error_code cap_code;
+#endif
+	if (!(client->data &&server->data))
+	  return KRB5_NO_TKT_IN_RLM;
+#ifdef CONFIGURABLE_AUTHENTICATION_PATH
 	if ((cap_client = (char *)malloc(client->length + 1)) == NULL)
 		return ENOMEM;
 	strncpy(cap_client, client->data, client->length);
--- krb5-1.2.4.orig/src/lib/krb5/posix/Makefile.in
+++ krb5-1.2.4/src/lib/krb5/posix/Makefile.in
@@ -8,10 +8,10 @@
 ##DOS##OBJFILE=..\$(OUTPRE)$(PREFIXDIR).lst
 ##WIN16##LIBNAME=..\krb5.lib
 
-STLIBOBJS=setenv.o @LIBOBJS@
+STLIBOBJS=setenv.o @LIBOBJS@ k5_comerr_glue.o
 MACSRCS = getuid.c strcasecmp.c strdup.c
 
-OBJS = $(OUTPRE)setenv.$(OBJEXT)	@LIBOBJS@
+OBJS = $(OUTPRE)setenv.$(OBJEXT)	@LIBOBJS@ k5_comerr_glue.o
 
 all-unix:: all-libobjs
 clean-unix:: clean-libobjs
--- krb5-1.2.4.orig/src/lib/krb5/posix/k5_comerr_glue.c
+++ krb5-1.2.4/src/lib/krb5/posix/k5_comerr_glue.c
@@ -0,0 +1,123 @@
+/*
+ * Created from error_message.c for Debian by Sam Hartman <hartmans@mit.edu>
+ * The com_err in e2fsprogs does not include functions needed by some krb5 libs like
+ * add_error_table and remove_error_table
+ * However, we want to use that com_err to avoid having multiple com_errs in Debian.
+ * Thus, this glue file blasts through the appropriate abstraction layers and
+ * adds those functions.  It should be used only by internals
+ * of the MIT Kerberos code until those functions are in the upstream sources.
+ */
+
+/*
+ * Copyright 1997 by Massachusetts Institute of Technology
+ * 
+ * Copyright 1987, 1988 by MIT Student Information Processing Board
+ *
+ * Permission to use, copy, modify, and distribute this software
+ * and its documentation for any purpose and without fee is
+ * hereby granted, provided that the above copyright notice
+ * appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation,
+ * and that the names of M.I.T. and the M.I.T. S.I.P.B. not be
+ * used in advertising or publicity pertaining to distribution
+ * of the software without specific, written prior permission.
+ * Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. and the M.I.T. S.I.P.B. make no representations about
+ * the suitability of this software for any purpose.  It is
+ * provided "as is" without express or implied warranty.
+ */
+
+#include <stdio.h>
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+#include <string.h>
+#include "com_err.h"
+#include "../../../util/et/error_table.h"
+
+#ifdef macintosh
+#include <ErrorLib.h>
+#endif
+
+#if defined(_MSDOS) || defined(_WIN32)
+#define HAVE_STRERROR
+#endif
+
+#ifdef macintosh
+#define sys_nerr 100   /* XXX - What is this? */
+#endif
+
+#if !defined(HAVE_STRERROR) && !defined(SYS_ERRLIST_DECLARED)
+extern char const * const sys_errlist[];
+#ifndef macintosh
+extern const int sys_nerr;
+#endif
+#endif
+
+
+
+#ifdef _MSDOS
+/*
+ * Win16 applications cannot call malloc while the DLL is being
+ * initialized...  To get around this, we pre-allocate an array
+ * sufficient to hold several error tables.
+ */
+#define PREALLOCATE_ETL 32
+static struct et_list etl[PREALLOCATE_ETL];
+static int etl_used = 0;
+#endif
+
+KRB5_DLLIMP errcode_t KRB5_CALLCONV
+add_error_table(et)
+    const struct error_table FAR * et;
+{
+    struct et_list *el = _et_list;
+
+    while (el) {
+	if (el->table->base == et->base)
+	    return EEXIST;
+	el = el->next;
+    }
+
+#ifdef _MSDOS
+    if (etl_used < PREALLOCATE_ETL)
+	el = &etl[etl_used++];
+    else
+#endif
+	if (!(el = (struct et_list *)malloc(sizeof(struct et_list))))
+	    return ENOMEM;
+
+    el->table = et;
+    el->next = _et_list;
+    _et_list = el;
+
+    return 0;
+}
+
+KRB5_DLLIMP errcode_t KRB5_CALLCONV
+remove_error_table(et)
+    const struct error_table FAR * et;
+{
+    struct et_list *el = _et_list;
+    struct et_list *el2 = 0;
+
+    while (el) {
+	if (el->table->base == et->base) {
+	    if (el2)	/* Not the beginning of the list */
+		el2->next = el->next;
+	    else
+		_et_list = el->next;
+#ifdef _MSDOS
+	    if ((el < etl) || (el > &etl[PREALLOCATE_ETL-1]))
+#endif
+		(void) free(el);
+	    return 0;
+	}
+	el2 = el;
+	el = el->next;
+    }
+    return ENOENT;
+}
+
--- krb5-1.2.4.orig/src/lib/krb5/configure
+++ krb5-1.2.4/src/lib/krb5/configure
@@ -2738,10 +2738,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/krb5util/configure
+++ krb5-1.2.4/src/lib/krb5util/configure
@@ -2124,10 +2124,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/rpc/Makefile.in
+++ krb5-1.2.4/src/lib/rpc/Makefile.in
@@ -15,7 +15,6 @@
 	$(TOPLIBD)/libgssapi_krb5$(SHLIBEXT) \
 	$(TOPLIBD)/libkrb5$(SHLIBEXT) \
 	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT) \
 	$(TOPLIBD)/libdyn$(SHLIBEXT)
 SHLIB_EXPLIBS=-lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -ldyn
 SHLIB_DIRS=-L$(TOPLIBD)
--- krb5-1.2.4.orig/src/lib/rpc/unit-test/configure
+++ krb5-1.2.4/src/lib/rpc/unit-test/configure
@@ -2773,10 +2773,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/lib/rpc/xdr_array.c
+++ krb5-1.2.4/src/lib/rpc/xdr_array.c
@@ -75,7 +75,8 @@
 		return (FALSE);
 	}
 	c = *sizep;
-	if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) {
+	if ((c > maxsize || c > LASTUNSIGNED / elsize)
+	    && (xdrs->x_op != XDR_FREE)) {
 		return (FALSE);
 	}
 	nodesize = c * elsize;
--- krb5-1.2.4.orig/src/lib/rpc/xdr_mem.c
+++ krb5-1.2.4/src/lib/rpc/xdr_mem.c
@@ -47,6 +47,8 @@
 #include <gssrpc/xdr.h>
 #include <netinet/in.h>
 #include <stdio.h>
+#include <string.h>
+#include <limits.h>
 
 static bool_t	xdrmem_getlong();
 static bool_t	xdrmem_putlong();
@@ -83,7 +85,7 @@
 	xdrs->x_op = op;
 	xdrs->x_ops = &xdrmem_ops;
 	xdrs->x_private = xdrs->x_base = addr;
-	xdrs->x_handy = size;
+	xdrs->x_handy = (size > INT_MAX) ? INT_MAX : size; /* XXX */
 }
 
 static void
@@ -98,8 +100,10 @@
 	long *lp;
 {
 
-	if ((xdrs->x_handy -= sizeof(rpc_int32)) < 0)
+	if (xdrs->x_handy < sizeof(rpc_int32))
 		return (FALSE);
+	else
+		xdrs->x_handy -= sizeof(rpc_int32);
 	*lp = (long)ntohl(*((rpc_u_int32 *)(xdrs->x_private)));
 	xdrs->x_private += sizeof(rpc_int32);
 	return (TRUE);
@@ -111,8 +115,10 @@
 	long *lp;
 {
 
-	if ((xdrs->x_handy -= sizeof(rpc_int32)) < 0)
+	if (xdrs->x_handy < sizeof(rpc_int32))
 		return (FALSE);
+	else
+		xdrs->x_handy -= sizeof(rpc_int32);
 	*(rpc_int32 *)xdrs->x_private = (rpc_int32)htonl((rpc_u_int32)(*lp));
 	xdrs->x_private += sizeof(rpc_int32);
 	return (TRUE);
@@ -125,8 +131,10 @@
 	register unsigned int len;
 {
 
-	if ((xdrs->x_handy -= len) < 0)
+	if (xdrs->x_handy < len)
 		return (FALSE);
+	else
+		xdrs->x_handy -= len;
 	memmove(addr, xdrs->x_private, len);
 	xdrs->x_private += len;
 	return (TRUE);
@@ -139,8 +147,10 @@
 	register unsigned int len;
 {
 
-	if ((xdrs->x_handy -= len) < 0)
+	if (xdrs->x_handy < len)
 		return (FALSE);
+	else
+		xdrs->x_handy -= len;
 	memmove(xdrs->x_private, addr, len);
 	xdrs->x_private += len;
 	return (TRUE);
@@ -179,7 +189,7 @@
 {
 	rpc_int32 *buf = 0;
 
-	if (xdrs->x_handy >= len) {
+	if (len >= 0 && xdrs->x_handy >= len) {
 		xdrs->x_handy -= len;
 		buf = (rpc_int32 *) xdrs->x_private;
 		xdrs->x_private += len;
--- krb5-1.2.4.orig/src/lib/rpc/configure
+++ krb5-1.2.4/src/lib/rpc/configure
@@ -2604,10 +2604,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/slave/ChangeLog
+++ krb5-1.2.4/src/slave/ChangeLog
@@ -1,3 +1,10 @@
+2001-11-24  Sam Hartman  <hartmans@mit.edu>
+
+	* kpropd.c (do_standalone): Default to KPROP port
+
+	* kprop.c (open_connection): Default to 754 rather than an error,
+	Debian bug #120010 
+
 2000-05-08  Nalin Dahyabhai  <nalin@redhat.com>
 
 	* kprop.c (open_connection): New argument indicates output buffer
--- krb5-1.2.4.orig/src/slave/configure
+++ krb5-1.2.4/src/slave/configure
@@ -2055,10 +2055,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/slave/kprop.c
+++ krb5-1.2.4/src/slave/kprop.c
@@ -332,13 +332,11 @@
 	if(!port) {
 		sp = getservbyname(KPROP_SERVICE, "tcp");
 		if (sp == 0) {
-			(void) strncpy(Errmsg, KPROP_SERVICE, ErrmsgSz - 1);
-			Errmsg[ErrmsgSz - 1] = '\0';
-			(void) strncat(Errmsg, "/tcp: unknown service", ErrmsgSz - 1 - strlen(Errmsg));
-			*fd = -1;
-			return(0);
+			sin.sin_port = htons(KPROP_PORT);
+		
+		} else {
+		  sin.sin_port = sp->s_port;
 		}
-		sin.sin_port = sp->s_port;
 	} else
 		sin.sin_port = port;
 	s = socket(AF_INET, SOCK_STREAM, 0);
--- krb5-1.2.4.orig/src/slave/kprop.h
+++ krb5-1.2.4/src/slave/kprop.h
@@ -29,6 +29,8 @@
 #define KPROP_SERVICE_NAME "host"
 #define TGT_SERVICE_NAME "krbtgt"
 #define KPROP_SERVICE "krb5_prop"
+#define KPROP_PORT 754
+
 #define KPROP_CKSUMTYPE CKSUMTYPE_RSA_MD4_DES
 
 #define KPROP_PROT_VERSION "kprop5_01"
--- krb5-1.2.4.orig/src/slave/kpropd.c
+++ krb5-1.2.4/src/slave/kpropd.c
@@ -182,9 +182,9 @@
 		sp = getservbyname(KPROP_SERVICE, "tcp");
 		if (sp == NULL) {
 			com_err(progname, 0, "%s/tcp: unknown service", KPROP_SERVICE);
-			exit(1);
+			sin.sin_port = htons(KPROP_PORT);
 		}
-		sin.sin_port = sp->s_port;
+		else sin.sin_port = sp->s_port;
 	} else {
 		sin.sin_port = port;
 	}
--- krb5-1.2.4.orig/src/tests/configure
+++ krb5-1.2.4/src/tests/configure
@@ -1948,10 +1948,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/util/et/Makefile.in
+++ krb5-1.2.4/src/util/et/Makefile.in
@@ -16,9 +16,9 @@
 LIBMAJOR=3
 LIBMINOR=0
 
-all-unix:: all-liblinks
-clean-unix:: clean-liblinks clean-libs clean-libobjs
-install-unix:: install-libs
+all-unix:: 
+clean-unix:: 
+install-unix:: 
 
 LINTFLAGS=-uhvb 
 LINTFILES= error_message.c et_name.c init_et.c com_err.c
--- krb5-1.2.4.orig/src/util/et/configure.in
+++ krb5-1.2.4/src/util/et/configure.in
@@ -1,4 +1,7 @@
 AC_INIT(error_table.y)
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 CONFIG_RULES
 AC_CONST
 AC_PROG_LEX
@@ -23,6 +26,4 @@
 AC_CHECK_FUNCS(strerror)
 AC_HEADER_STDARG
 AC_HAVE_HEADERS(stdlib.h)
-KRB5_BUILD_LIBOBJS
-KRB5_BUILD_LIBRARY
 V5_AC_OUTPUT_MAKEFILE
--- krb5-1.2.4.orig/src/util/et/et.pbexp
+++ krb5-1.2.4/src/util/et/et.pbexp
@@ -1,7 +1,7 @@
 #
 # comerr library Macintosh export file
 #
-# $Header: /cvs/krbdev/krb5/src/util/et/Attic/et.pbexp,v 1.1.2.1.2.1 2001/10/30 01:30:43 meeroh Exp $
+# $Header: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/util/et/et.pbexp,v 1.1.1.2 2002/01/10 11:06:26 hartmans Exp $
 
 _com_err
 _com_err_va
--- krb5-1.2.4.orig/src/util/et/configure
+++ krb5-1.2.4/src/util/et/configure
@@ -35,12 +35,6 @@
   --enable-dns-for-realm  enable DNS lookups of Kerberos realm names"
 ac_help="$ac_help
   --with-hesiod[=path]    compile with hesiod support"
-ac_help="$ac_help
-  --disable-static        don't build static libraries"
-ac_help="$ac_help
-  --enable-shared         build shared libraries"
-ac_help="$ac_help
-  --enable-profiled       build profiled libraries"
 
 # Initialize some variables set by options.
 # The variables have the same names as the options, with
@@ -551,6 +545,9 @@
 fi
 
 
+# Comment added for Debian by Sam Hartman <hartmans@debian.org>
+# This script must be modified  in Debian because aclocal.m4 was modified 
+# and we want to get around timestamp lossage.
 ac_reltopdir=../../.
 case "$ac_reltopdir" in 
 /*)
@@ -598,7 +595,7 @@
 fi
 
 echo $ac_n "checking for C compiler""... $ac_c" 1>&6
-echo "configure:602: checking for C compiler" >&5
+echo "configure:599: checking for C compiler" >&5
 if test "$with_cc" != ""; then
   if test "$ac_cv_prog_cc" != "" && test "$ac_cv_prog_cc" != "$with_cc"; then
     { echo "configure: error: Specified compiler doesn't match cached compiler name;
@@ -612,14 +609,14 @@
 else
     test -z "$CC" && CC=cc
   cat > conftest.$ac_ext <<EOF
-#line 616 "configure"
+#line 613 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("hi\n");
 ; return 0; }
 EOF
-if { (eval echo configure:623: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:620: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -637,7 +634,7 @@
 # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:641: checking for $ac_word" >&5
+echo "configure:638: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -667,7 +664,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:671: checking for $ac_word" >&5
+echo "configure:668: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -718,7 +715,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:722: checking for $ac_word" >&5
+echo "configure:719: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -750,7 +747,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:754: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:751: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -761,12 +758,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 765 "configure"
+#line 762 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:770: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:767: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -792,12 +789,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:796: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:793: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:801: checking whether we are using GNU C" >&5
+echo "configure:798: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -806,7 +803,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:810: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:807: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -825,7 +822,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:829: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:826: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -948,12 +945,12 @@
 
 
  echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:952: checking for working const" >&5
+echo "configure:949: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 957 "configure"
+#line 954 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -1002,7 +999,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1006: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1003: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1037,12 +1034,12 @@
    # Most operating systems have gethostbyname() in the default searched
    # libraries (i.e. libc):
    echo $ac_n "checking for gethostbyname""... $ac_c" 1>&6
-echo "configure:1041: checking for gethostbyname" >&5
+echo "configure:1038: checking for gethostbyname" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gethostbyname'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1046 "configure"
+#line 1043 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gethostbyname(); below.  */
@@ -1065,7 +1062,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1069: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1066: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_gethostbyname=yes"
 else
@@ -1084,7 +1081,7 @@
   echo "$ac_t""no" 1>&6
 # Some OSes (eg. Solaris) place it in libnsl:
      echo $ac_n "checking for gethostbyname in -lnsl""... $ac_c" 1>&6
-echo "configure:1088: checking for gethostbyname in -lnsl" >&5
+echo "configure:1085: checking for gethostbyname in -lnsl" >&5
 ac_lib_var=`echo nsl'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1092,7 +1089,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lnsl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1096 "configure"
+#line 1093 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1103,7 +1100,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1107: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1104: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1130,7 +1127,7 @@
   echo "$ac_t""no" 1>&6
 # Some strange OSes (SINIX) have it in libsocket:
        echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1134: checking for gethostbyname in -lsocket" >&5
+echo "configure:1131: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1138,7 +1135,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1142 "configure"
+#line 1139 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1149,7 +1146,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1153: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1150: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1178,7 +1175,7 @@
           # AC_CHECK_LIB's API is essentially broken so the following
           # ugliness is necessary:
           echo $ac_n "checking for gethostbyname in -lsocket""... $ac_c" 1>&6
-echo "configure:1182: checking for gethostbyname in -lsocket" >&5
+echo "configure:1179: checking for gethostbyname in -lsocket" >&5
 ac_lib_var=`echo socket'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1186,7 +1183,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1190 "configure"
+#line 1187 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1197,7 +1194,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1201: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1198: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1216,7 +1213,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for gethostbyname in -lresolv""... $ac_c" 1>&6
-echo "configure:1220: checking for gethostbyname in -lresolv" >&5
+echo "configure:1217: checking for gethostbyname in -lresolv" >&5
 ac_lib_var=`echo resolv'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1224,7 +1221,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1228 "configure"
+#line 1225 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1235,7 +1232,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:1239: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1236: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1267,12 +1264,12 @@
 fi
 
   echo $ac_n "checking for socket""... $ac_c" 1>&6
-echo "configure:1271: checking for socket" >&5
+echo "configure:1268: checking for socket" >&5
 if eval "test \"`echo '$''{'ac_cv_func_socket'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1276 "configure"
+#line 1273 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char socket(); below.  */
@@ -1295,7 +1292,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1299: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1296: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_socket=yes"
 else
@@ -1313,7 +1310,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1317: checking for socket in -lsocket" >&5
+echo "configure:1314: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1321,7 +1318,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1325 "configure"
+#line 1322 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1332,7 +1329,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1336: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1333: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1358,7 +1355,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:1362: checking for socket in -lsocket" >&5
+echo "configure:1359: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1366,7 +1363,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket -lnsl $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1370 "configure"
+#line 1367 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1377,7 +1374,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:1381: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1378: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1403,7 +1400,7 @@
 
   
 echo $ac_n "checking if DNS Kerberos lookup support should be compiled in""... $ac_c" 1>&6
-echo "configure:1407: checking if DNS Kerberos lookup support should be compiled in" >&5
+echo "configure:1404: checking if DNS Kerberos lookup support should be compiled in" >&5
 
   # Check whether --enable-dns or --disable-dns was given.
 if test "${enable_dns+set}" = set; then
@@ -1472,12 +1469,12 @@
 
   if test "$enable_dns" = yes ; then
     echo $ac_n "checking for res_search""... $ac_c" 1>&6
-echo "configure:1476: checking for res_search" >&5
+echo "configure:1473: checking for res_search" >&5
 if eval "test \"`echo '$''{'ac_cv_func_res_search'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1481 "configure"
+#line 1478 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char res_search(); below.  */
@@ -1500,7 +1497,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1504: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1501: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_res_search=yes"
 else
@@ -1518,7 +1515,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for res_search in -lresolv""... $ac_c" 1>&6
-echo "configure:1522: checking for res_search in -lresolv" >&5
+echo "configure:1519: checking for res_search in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_search | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1526,7 +1523,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1530 "configure"
+#line 1527 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1537,7 +1534,7 @@
 res_search()
 ; return 0; }
 EOF
-if { (eval echo configure:1541: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1538: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1577,7 +1574,7 @@
 if test "$with_hesiod" != "no"; then
 	HESIOD_DEFS=-DHESIOD
 	echo $ac_n "checking for res_send in -lresolv""... $ac_c" 1>&6
-echo "configure:1581: checking for res_send in -lresolv" >&5
+echo "configure:1578: checking for res_send in -lresolv" >&5
 ac_lib_var=`echo resolv'_'res_send | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1585,7 +1582,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lresolv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1589 "configure"
+#line 1586 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1596,7 +1593,7 @@
 res_send()
 ; return 0; }
 EOF
-if { (eval echo configure:1600: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1597: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1658,12 +1655,12 @@
 
 
 echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:1662: checking for working const" >&5
+echo "configure:1659: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 1667 "configure"
+#line 1664 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -1712,7 +1709,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:1716: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1713: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -1735,7 +1732,7 @@
 # Extract the first word of "flex", so it can be a program name with args.
 set dummy flex; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1739: checking for $ac_word" >&5
+echo "configure:1736: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_LEX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1769,7 +1766,7 @@
   *) ac_lib=l ;;
   esac
   echo $ac_n "checking for yywrap in -l$ac_lib""... $ac_c" 1>&6
-echo "configure:1773: checking for yywrap in -l$ac_lib" >&5
+echo "configure:1770: checking for yywrap in -l$ac_lib" >&5
 ac_lib_var=`echo $ac_lib'_'yywrap | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1777,7 +1774,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-l$ac_lib  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 1781 "configure"
+#line 1778 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -1788,7 +1785,7 @@
 yywrap()
 ; return 0; }
 EOF
-if { (eval echo configure:1792: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1789: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -1815,7 +1812,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1819: checking for $ac_word" >&5
+echo "configure:1816: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_YACC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1850,7 +1847,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1854: checking for $ac_word" >&5
+echo "configure:1851: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_AWK'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1891,7 +1888,7 @@
 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
 # ./install, which can be erroneously created by make from ./install.sh.
 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
-echo "configure:1895: checking for a BSD compatible install" >&5
+echo "configure:1892: checking for a BSD compatible install" >&5
 if test -z "$INSTALL"; then
 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -1946,7 +1943,7 @@
 # Extract the first word of "ar", so it can be a program name with args.
 set dummy ar; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1950: checking for $ac_word" >&5
+echo "configure:1947: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_ARCHIVE'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1976,7 +1973,7 @@
 # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1980: checking for $ac_word" >&5
+echo "configure:1977: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_RANLIB'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2004,7 +2001,7 @@
 fi
 
 echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6
-echo "configure:2008: checking how to run the C preprocessor" >&5
+echo "configure:2005: checking how to run the C preprocessor" >&5
 # On Suns, sometimes $CPP names a directory.
 if test -n "$CPP" && test -d "$CPP"; then
   CPP=
@@ -2019,13 +2016,13 @@
   # On the NeXT, cc -E runs the code through the compiler's parser,
   # not just through cpp.
   cat > conftest.$ac_ext <<EOF
-#line 2023 "configure"
+#line 2020 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2029: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2026: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -2036,13 +2033,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -E -traditional-cpp"
   cat > conftest.$ac_ext <<EOF
-#line 2040 "configure"
+#line 2037 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2046: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2043: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -2053,13 +2050,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -nologo -E"
   cat > conftest.$ac_ext <<EOF
-#line 2057 "configure"
+#line 2054 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2063: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2060: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -2084,7 +2081,7 @@
 echo "$ac_t""$CPP" 1>&6
 
 echo $ac_n "checking for yylineno declaration""... $ac_c" 1>&6
-echo "configure:2088: checking for yylineno declaration" >&5
+echo "configure:2085: checking for yylineno declaration" >&5
 if eval "test \"`echo '$''{'krb5_cv_type_yylineno'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2108,12 +2105,12 @@
   fi
 
 echo $ac_n "checking for sys_errlist declaration""... $ac_c" 1>&6
-echo "configure:2112: checking for sys_errlist declaration" >&5
+echo "configure:2109: checking for sys_errlist declaration" >&5
 if eval "test \"`echo '$''{'krb5_cv_decl_sys_errlist'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2117 "configure"
+#line 2114 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 #include <errno.h>
@@ -2121,7 +2118,7 @@
 1+sys_nerr;
 ; return 0; }
 EOF
-if { (eval echo configure:2125: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2122: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   krb5_cv_decl_sys_errlist=yes
 else
@@ -2148,19 +2145,19 @@
   # This means that sys_errlist is not declared in errno.h, but may still
   # be in libc.
   echo $ac_n "checking for sys_errlist in libc""... $ac_c" 1>&6
-echo "configure:2152: checking for sys_errlist in libc" >&5
+echo "configure:2149: checking for sys_errlist in libc" >&5
 if eval "test \"`echo '$''{'krb5_cv_var_sys_errlist'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2157 "configure"
+#line 2154 "configure"
 #include "confdefs.h"
 extern int sys_nerr;
 int main() {
 1+sys_nerr;
 ; return 0; }
 EOF
-if { (eval echo configure:2164: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2161: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   krb5_cv_var_sys_errlist=yes
 else
@@ -2188,12 +2185,12 @@
   fi
 fi
 echo $ac_n "checking for perror declaration""... $ac_c" 1>&6
-echo "configure:2192: checking for perror declaration" >&5
+echo "configure:2189: checking for perror declaration" >&5
 if eval "test \"`echo '$''{'krb5_cv_decl_perror'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2197 "configure"
+#line 2194 "configure"
 #include "confdefs.h"
 #include <errno.h>
 EOF
@@ -2218,12 +2215,12 @@
 for ac_func in strerror
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:2222: checking for $ac_func" >&5
+echo "configure:2219: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2227 "configure"
+#line 2224 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -2246,7 +2243,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2250: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2247: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -2273,12 +2270,12 @@
 
 
 echo $ac_n "checking for stdarg.h""... $ac_c" 1>&6
-echo "configure:2277: checking for stdarg.h" >&5
+echo "configure:2274: checking for stdarg.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_stdarg_h'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2282 "configure"
+#line 2279 "configure"
 #include "confdefs.h"
 #include <stdarg.h>
 int main() {
@@ -2293,7 +2290,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2297: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2294: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_header_stdarg_h=yes
 else
@@ -2313,12 +2310,12 @@
 else
 
 echo $ac_n "checking for varargs.h""... $ac_c" 1>&6
-echo "configure:2317: checking for varargs.h" >&5
+echo "configure:2314: checking for varargs.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_varargs_h'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2322 "configure"
+#line 2319 "configure"
 #include "confdefs.h"
 #include <varargs.h>
 int main() {
@@ -2333,7 +2330,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:2337: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2334: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_header_varargs_h=yes
 else
@@ -2360,17 +2357,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:2364: checking for $ac_hdr" >&5
+echo "configure:2361: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 2369 "configure"
+#line 2366 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:2374: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:2371: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -2396,516 +2393,6 @@
 fi
 done
 
-echo $ac_n "checking host system type""... $ac_c" 1>&6
-echo "configure:2401: checking host system type" >&5
-if eval "test \"`echo '$''{'krb5_cv_host'+set}'`\" = set"; then
-  echo $ac_n "(cached) $ac_c" 1>&6
-else
-  
-# Make sure we can run config.sub.
-if ${CONFIG_SHELL-/bin/sh} $ac_config_sub sun4 >/dev/null 2>&1; then :
-else { echo "configure: error: can not run $ac_config_sub" 1>&2; exit 1; }
-fi
-
-echo $ac_n "checking host system type""... $ac_c" 1>&6
-echo "configure:2412: checking host system type" >&5
-
-host_alias=$host
-case "$host_alias" in
-NONE)
-  case $nonopt in
-  NONE)
-    if host_alias=`${CONFIG_SHELL-/bin/sh} $ac_config_guess`; then :
-    else { echo "configure: error: can not guess host type; you must specify one" 1>&2; exit 1; }
-    fi ;;
-  *) host_alias=$nonopt ;;
-  esac ;;
-esac
-
-host=`${CONFIG_SHELL-/bin/sh} $ac_config_sub $host_alias`
-host_cpu=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'`
-host_vendor=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\2/'`
-host_os=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'`
-echo "$ac_t""$host" 1>&6
-
-krb5_cv_host=$host
-fi
-
-echo "$ac_t""$krb5_cv_host" 1>&6
-
-#
-# Set up some defaults.
-#
-STLIBEXT=.a
-# Default to being unable to build shared libraries.
-SHLIBEXT=.so-nobuild
-SHLIBVEXT=.so.v-nobuild
-SHLIBSEXT=.so.s-nobuild
-# Most systems support profiled libraries.
-PFLIBEXT=_p.a
-# Most systems install shared libs as mode 644, etc. while hpux wants 755
-INSTALL_SHLIB='$(INSTALL_DATA)'
-
-STOBJEXT=.o
-SHOBJEXT=.so
-PFOBJEXT=.po
-# Default for systems w/o shared libraries
-CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-
-# Set up architecture-specific variables.
-case $krb5_cv_host in
-alpha*-dec-osf*)
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	# Alpha OSF/1 doesn't need separate PIC objects
-	SHOBJEXT=.o
-	LDCOMBINE='ld -shared -expect_unresolved \* -update_registry $(BUILDTOP)/so_locations -soname lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-rpath $(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	# Need -oldstyle_liblookup to avoid picking up shared libs from
-	# other builds.  OSF/1 / Tru64 ld programs look through the entire
-	# library path for shared libs prior to looking through the
-	# entire library path for static libs.
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) -Wl,-oldstyle_liblookup'
-	# $(PROG_RPATH) is here to handle things like a shared tcl library
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`:$(PROG_RPATH):/usr/shlib:/usr/ccs/lib:/usr/lib/cmplrs/cc:/usr/lib:/usr/local/lib; export LD_LIBRARY_PATH; _RLD_ROOT=/dev/dummy/d; export _RLD_ROOT;'
-	;;
-
-# HPUX *seems* to work under 10.20.
-# 
-# Note: "-Wl,+s" when building executables enables the use of the
-# SHLIB_PATH environment variable for finding shared libraries 
-# in non-standard directories.  If a non-standard search-path for
-#  shared libraries is compiled into the executable (using 
-# -Wl,+b,$KRB5_SHLIBDIR), then the order of "-Wl,+b,..." and "-Wl,+s" 
-# on the commandline of the linker will determine which path
-# (compiled-in or SHLIB_PATH) will be searched first.
-#
-*-*-hpux*)
-	if test "$krb5_cv_prog_gcc" = yes; then
-		PICFLAGS=-fPIC
-	else
-		PICFLAGS=+z
-	fi
-	INSTALL_SHLIB='$(INSTALL)'
-	SHLIBEXT=.sl
-	SHLIBVEXT='.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.$(LIBMAJOR)'
-	if test "$krb5_cv_prog_gcc" = yes; then
-		SHLIB_EXPFLAGS='-Wl,+s -Wl,+b,$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-		LDCOMBINE='gcc -fPIC -shared -Wl,+h,lib$(LIB)$(SHLIBSEXT)'
-	else
-		SHLIB_EXPFLAGS='+s +b $(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-		LDCOMBINE='ld -b +h lib$(LIB)$(SHLIBSEXT)'
-	fi
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,+s -Wl,+b,$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='SHLIB_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export SHLIB_PATH;'
-	;;
-
-mips-sgi-irix6.3)	# This is a Kludge; see below
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	SHOBJEXT=.o
-	# Kludge follows: (gcc makes n32 object files but ld expects o32, so we reeducate ld)
-	if test "$krb5_cv_prog_gcc" = yes; then
-		LDCOMBINE='ld -n32 -shared -ignore_unresolved -update_registry $(BUILDTOP)/so_locations -soname lib$(LIB)$(SHLIBSEXT)'
-	else
-		LDCOMBINE='ld -shared -ignore_unresolved -update_registry $(BUILDTOP)/so_locations -soname lib$(LIB)$(SHLIBSEXT)'
-	fi
-	SHLIB_EXPFLAGS='-rpath $(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	# no gprof for Irix...
-	PROFFLAGS=-p
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	# This grossness is necessary due to the presence of *three*
-	# supported ABIs on Irix, and the precedence of the rpath over
-	# LD_LIBRARY*_PATH.  Like OSF/1, _RLD*_ROOT needs to be set to
-	# work around this lossage.
-	add='`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`'
-	dummy=/dev/dummmy/d
-	# Set the N32 and 64 variables first because the unqualified
-	# variables affect all three and can cause the sed command to fail.
-	RUN_ENV="LD_LIBRARYN32_PATH=$add:/usr/lib32:/usr/lib32/internal:/lib32:/opt/lib32; export LD_LIBRARYN32_PATH; _RLDN32_ROOT=$dummy; export _RLDN32_ROOT; LD_LIBRARY64_PATH=$add:/usr/lib64:/usr/lib64/internal:/lib64:/opt/lib64; export LD_LIBRARY64_PATH; _RLD64_ROOT=$dummy; export _RLD64_ROOT; LD_LIBRARY_PATH=$add:/usr/lib:/usr/lib/internal:/lib:/lib/cmplrs/cc:/usr/lib/cmplrs/cc:/opt/lib; export LD_LIBRARY_PATH; _RLD_ROOT=$dummy; export _RLD_ROOT;"
-	;;
-
-mips-sgi-irix*)
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	SHOBJEXT=.o
-	LDCOMBINE='ld -shared -ignore_unresolved -update_registry $(BUILDTOP)/so_locations -soname lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-rpath $(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	# no gprof for Irix...
-	PROFFLAGS=-p
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	# This grossness is necessary due to the presence of *three*
-	# supported ABIs on Irix, and the precedence of the rpath over
-	# LD_LIBRARY*_PATH.  Like OSF/1, _RLD*_ROOT needs to be set to
-	# work around this lossage.
-	add='`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`'
-	dummy=/dev/dummmy/d
-	# Set the N32 and 64 variables first because the unqualified
-	# variables affect all three and can cause the sed command to fail.
-	RUN_ENV="LD_LIBRARYN32_PATH=$add:/usr/lib32:/usr/lib32/internal:/lib32:/opt/lib32; export LD_LIBRARYN32_PATH; _RLDN32_ROOT=$dummy; export _RLDN32_ROOT; LD_LIBRARY64_PATH=$add:/usr/lib64:/usr/lib64/internal:/lib64:/opt/lib64; export LD_LIBRARY64_PATH; _RLD64_ROOT=$dummy; export _RLD64_ROOT; LD_LIBRARY_PATH=$add:/usr/lib:/usr/lib/internal:/lib:/lib/cmplrs/cc:/usr/lib/cmplrs/cc:/opt/lib; export LD_LIBRARY_PATH; _RLD_ROOT=$dummy; export _RLD_ROOT;"
-	;;
-
-# untested...
-mips-sni-sysv4)
-	if test "$krb5_cv_prog_gcc" = yes; then
-		PICFLAGS=-fpic
-		LDCOMBINE='$(CC) -G -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
-	else
-		PICFLAGS=-Kpic
-		LDCOMBINE='$(CC) -G -h lib$(LIB)$(SHLIBSEXT)'
-	fi
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	SHLIBEXT=.so
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -R$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	PROFFLAGS=-pg
-	;;
-
-mips-*-netbsd*)
-	PICFLAGS=-fPIC
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	LDCOMBINE='ld -shared -soname lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	PROFFLAGS=-pg
-	;;
-
-*-*-netbsd*)
-	PICFLAGS=-fpic
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBEXT=.so
-	LDCOMBINE='ld -Bshareable'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -R$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	PROFFLAGS=-pg
-	;;
-
-*-*-freebsd*)
-	if test -x /usr/bin/objformat ; then
-		objformat=`/usr/bin/objformat`
-	else
-		objformat="aout"
-	fi
-	PICFLAGS=-fpic
-	if test "x$objformat" = "xelf" ; then
-		SHLIBVEXT='.so.$(LIBMAJOR)'
-		CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	else
-		SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-		CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -R$(PROG_RPATH)'
-	fi
-	SHLIBEXT=.so
-	LDCOMBINE='ld -Bshareable'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	PROFFLAGS=-pg
-	;;
-
-*-*-openbsd*)
-	PICFLAGS=-fpic
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBEXT=.so
-	LDCOMBINE='ld -Bshareable'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -R$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	PROFFLAGS=-pg
-	;;
-
-*-*-macos10* | *-*-rhapsody*)
-	PICFLAGS=-fno-common
-	SHLIBVEXT='.$(LIBMAJOR).$(LIBMINOR).dylib'
-	SHLIBSEXT='.$(LIBMAJOR).dylib'
-	SHLIB_EXPFLAGS='$(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	SHLIBEXT=.dylib
-	SHOBJEXT=.so
-	LDCOMBINE='cc -undefined warning -dynamiclib -dylib_compatibility_version=$(LIBMAJOR).$(LIBMINOR) -dylib_current_version=$(LIBMAJOR).$(LIBMINOR)'
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -dynamic'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='DYLD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export DYLD_LIBRARY_PATH;'
-	;;
-
-*-*-solaris*)
-	if test "$krb5_cv_prog_gcc" = yes; then
-		PICFLAGS=-fpic
-		LDCOMBINE='$(CC) -shared -h lib$(LIB)$(SHLIBSEXT)'
-	else
-		PICFLAGS=-Kpic
-		# Solaris cc doesn't default to stuffing the SONAME field...
-		LDCOMBINE='$(CC) -dy -G -z text -h lib$(LIB)$(SHLIBSEXT)'
-	fi
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(PURE) $(CC) $(PROG_LIBPATH) -R$(PROG_RPATH)'
-	CC_LINK_STATIC='$(PURE) $(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	;;
-
-*-*-sunos*)
-	PICFLAGS=-fpic
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBEXT=.so
-	# The following grossness is to prevent relative paths from
-	# creeping into the RPATH of an executable or library built
-	# under SunOS; the explicit setting of LD_LIBRARY_PATH does
-	# does not make it into the output file, while directories
-	# passed by "-Ldirname" do.
-	LDCOMBINE='LD_LIBRARY_PATH=`echo $(SHLIB_DIRS) | sed -e "s/-L//g" -e "s/ /:/g"` ld -dp -assert pure-text'
-	SHLIB_EXPFLAGS='-L$(SHLIB_RDIRS) $(SHLIB_EXPLIBS)'
-	PROFFLAGS=-pg
-	CC_LINK_SHARED='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"` $(PURE) $(CC) -L$(PROG_RPATH)'
-	CC_LINK_STATIC='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g` $(PURE) $(CC)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	;;
-*-*-linux*)
-	PICFLAGS=-fPIC
-	SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBSEXT='.so.$(LIBMAJOR)'
-	SHLIBEXT=.so
-	# Linux ld doesn't default to stuffing the SONAME field...
-	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
-	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
-	;;
-
-*-*-aix*)
-	SHLIBVEXT='.a.$(LIBMAJOR).$(LIBMINOR)'
-	SHLIBEXT=.a
-	# AIX doesn't need separate PIC objects
-	SHOBJEXT=.o
-	LDCOMBINE='$(BUILDTOP)/util/makeshlib $(LIBMAJOR).$(LIBMINOR)'
-	SHLIB_EXPFLAGS='  $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
-	PROFFLAGS=-pg
-	if test "$krb5_cv_prog_gcc" = "yes" ; then
- 	  CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Xlinker -bex4:$(BUILDTOP)/util/aix.bincmds '
-	else
-	  CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -bex4:$(BUILDTOP)/util/aix.bincmds '
-	fi
-	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
-	# $(PROG_RPATH) is here to handle things like a shared tcl library
-	RUN_ENV='LIBPATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`:$(PROG_RPATH):/usr/lib:/usr/local/lib; export LIBPATH; '
-
-esac
-
-# Check whether to build static libraries.
-# Check whether --enable-static or --disable-static was given.
-if test "${enable_static+set}" = set; then
-  enableval="$enable_static"
-  :
-else
-  enableval=yes
-fi
-
-
-if test "$enableval" = no && test "$krb5_force_static" != yes; then
-	echo "$ac_t""Disabling static libraries." 1>&6
-	LIBLINKS=
-	LIBLIST=
-	OBJLISTS=
-else
-	LIBLIST='lib$(LIB)$(STLIBEXT)'
-	LIBLINKS='$(TOPLIBD)/lib$(LIB)$(STLIBEXT)'
-	OBJLISTS=OBJS.ST
-	LIBINSTLIST=install-static
-	DEPLIBEXT=$STLIBEXT
-fi
-
-# Check whether to build shared libraries.
-# Check whether --enable-shared or --disable-shared was given.
-if test "${enable_shared+set}" = set; then
-  enableval="$enable_shared"
-  if test "$enableval" = yes; then
-	case "$SHLIBEXT" in
-	.so-nobuild)
-		echo "configure: warning: shared libraries not supported on this architecture" 1>&2
-		RUN_ENV=
-		CC_LINK="$CC_LINK_STATIC"
-		;;
-	*)
-		# set this now because some logic below may reset SHLIBEXT
-		DEPLIBEXT=$SHLIBEXT
-		if test "$krb5_force_static" = "yes"; then
-			echo "$ac_t""Forcing static libraries." 1>&6
-			# avoid duplicate rules generation for AIX and such
-			SHLIBEXT=.so-nobuild
-			SHLIBVEXT=.so.v-nobuild
-			SHLIBSEXT=.so.s-nobuild
-		else
-			echo "$ac_t""Enabling shared libraries." 1>&6
-			# Clear some stuff in case of AIX, etc.
-			if test "$STLIBEXT" = "$SHLIBEXT" ; then
-				STLIBEXT=.a-nobuild
-				LIBLIST=
-				LIBLINKS=
-				OBJLISTS=
-				LIBINSTLIST=
-			fi
-			LIBLIST="$LIBLIST "'lib$(LIB)$(SHLIBEXT)'
-			LIBLINKS="$LIBLINKS "'$(TOPLIBD)/lib$(LIB)$(SHLIBEXT) $(TOPLIBD)/lib$(LIB)$(SHLIBVEXT)'
-			case "$SHLIBSEXT" in
-			.so.s-nobuild)
-				LIBINSTLIST="$LIBINSTLIST install-shared"
-				;;
-			*)
-				LIBLIST="$LIBLIST "'lib$(LIB)$(SHLIBSEXT)'
-				LIBLINKS="$LIBLINKS "'$(TOPLIBD)/lib$(LIB)$(SHLIBSEXT)'
-				LIBINSTLIST="$LIBINSTLIST install-shlib-soname"
-				;;
-			esac
-			OBJLISTS="$OBJLISTS OBJS.SH"
-		fi
-		CC_LINK="$CC_LINK_SHARED"
-		if test "$STLIBEXT" = "$SHLIBEXT" ; then
-		  STLIBEXT=".a-no-build"
-		  LIBINSTLIST="install-shared" #don't install static
-		fi
-		;;
-	esac
-else
-	RUN_ENV=
-	CC_LINK="$CC_LINK_STATIC"
-	SHLIBEXT=.so-nobuild
-	SHLIBVEXT=.so.v-nobuild
-	SHLIBSEXT=.so.s-nobuild
-fi
-else
-  	RUN_ENV=
-	CC_LINK="$CC_LINK_STATIC"
-	SHLIBEXT=.so-nobuild
-	SHLIBVEXT=.so.v-nobuild
-	SHLIBSEXT=.so.s-nobuild
-fi
-
-if test -z "$LIBLIST"; then
-	{ echo "configure: error: must enable one of shared or static libraries" 1>&2; exit 1; }
-fi
-
-# Check whether to build profiled libraries.
-# Check whether --enable-profiled or --disable-profiled was given.
-if test "${enable_profiled+set}" = set; then
-  enableval="$enable_profiled"
-  if test "$enableval" = yes; then
-	case $PFLIBEXT in
-	.po-nobuild)
-		echo "$ac_t""Profiled libraries not supported on this architecture." 1>&6
-		;;
-	*)
-		echo "$ac_t""Enabling profiled libraries." 1>&6
-		LIBLIST="$LIBLIST "'lib$(LIB)$(PFLIBEXT)'
-		LIBLINKS="$LIBLINKS "'$(TOPLIBD)/lib$(LIB)$(PFLIBEXT)'
-		OBJLISTS="$OBJLISTS OBJS.PF"
-		LIBINSTLIST="$LIBINSTLIST install-profiled"
-		;;
-	esac
-fi
-fi
-
-
-# add frag for building library objects
-krb5_append_frags=$ac_config_fragdir/libobj.in:$krb5_append_frags
-
-
-
-
-
-
-echo $ac_n "checking whether ln -s works""... $ac_c" 1>&6
-echo "configure:2841: checking whether ln -s works" >&5
-if eval "test \"`echo '$''{'ac_cv_prog_LN_S'+set}'`\" = set"; then
-  echo $ac_n "(cached) $ac_c" 1>&6
-else
-  rm -f conftestdata
-if ln -s X conftestdata 2>/dev/null
-then
-  rm -f conftestdata
-  ac_cv_prog_LN_S="ln -s"
-else
-  ac_cv_prog_LN_S=ln
-fi
-fi
-LN_S="$ac_cv_prog_LN_S"
-if test "$ac_cv_prog_LN_S" = "ln -s"; then
-  echo "$ac_t""yes" 1>&6
-else
-  echo "$ac_t""no" 1>&6
-fi
-
-
-
-
-# Extract the first word of "ar", so it can be a program name with args.
-set dummy ar; ac_word=$2
-echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2867: checking for $ac_word" >&5
-if eval "test \"`echo '$''{'ac_cv_prog_AR'+set}'`\" = set"; then
-  echo $ac_n "(cached) $ac_c" 1>&6
-else
-  if test -n "$AR"; then
-  ac_cv_prog_AR="$AR" # Let the user override the test.
-else
-  IFS="${IFS= 	}"; ac_save_ifs="$IFS"; IFS=":"
-  ac_dummy="$PATH"
-  for ac_dir in $ac_dummy; do
-    test -z "$ac_dir" && ac_dir=.
-    if test -f $ac_dir/$ac_word; then
-      ac_cv_prog_AR="ar"
-      break
-    fi
-  done
-  IFS="$ac_save_ifs"
-  test -z "$ac_cv_prog_AR" && ac_cv_prog_AR="false"
-fi
-fi
-AR="$ac_cv_prog_AR"
-if test -n "$AR"; then
-  echo "$ac_t""$AR" 1>&6
-else
-  echo "$ac_t""no" 1>&6
-fi
-
-# add frag for building libraries
-krb5_append_frags=$ac_config_fragdir/lib.in:$krb5_append_frags
-# null out SHLIB_EXPFLAGS because we lack any dependencies
-SHLIB_EXPFLAGS=
-
-
-
-
-
-
-
-
-
-
-
-
 ac_v5_makefile_dirs=.
 filelist=""
 for x in $ac_v5_makefile_dirs; do
@@ -3084,31 +2571,6 @@
 s%@ARCHIVE@%$ARCHIVE%g
 s%@RANLIB@%$RANLIB%g
 s%@CPP@%$CPP%g
-s%@host@%$host%g
-s%@host_alias@%$host_alias%g
-s%@host_cpu@%$host_cpu%g
-s%@host_vendor@%$host_vendor%g
-s%@host_os@%$host_os%g
-s%@OBJLISTS@%$OBJLISTS%g
-s%@STOBJEXT@%$STOBJEXT%g
-s%@SHOBJEXT@%$SHOBJEXT%g
-s%@PFOBJEXT@%$PFOBJEXT%g
-s%@PICFLAGS@%$PICFLAGS%g
-s%@PROFFLAGS@%$PROFFLAGS%g
-s%@LN_S@%$LN_S%g
-s%@AR@%$AR%g
-s%@LIBLIST@%$LIBLIST%g
-s%@LIBLINKS@%$LIBLINKS%g
-s%@LDCOMBINE@%$LDCOMBINE%g
-s%@LDCOMBINE_TAIL@%$LDCOMBINE_TAIL%g
-s%@SHLIB_EXPFLAGS@%$SHLIB_EXPFLAGS%g
-s%@INSTALL_SHLIB@%$INSTALL_SHLIB%g
-s%@STLIBEXT@%$STLIBEXT%g
-s%@SHLIBEXT@%$SHLIBEXT%g
-s%@SHLIBVEXT@%$SHLIBVEXT%g
-s%@SHLIBSEXT@%$SHLIBSEXT%g
-s%@PFLIBEXT@%$PFLIBEXT%g
-s%@LIBINSTLIST@%$LIBINSTLIST%g
 
 CEOF
 EOF
--- krb5-1.2.4.orig/src/util/profile/Makefile.in
+++ krb5-1.2.4/src/util/profile/Makefile.in
@@ -41,7 +41,7 @@
 LIB=profile
 LIBMAJOR=1
 LIBMINOR=1
-SHLIB_EXPDEPS = $(TOPLIBD)/libcom_err$(SHLIBEXT)
+SHLIB_EXPDEPS = 
 SHLIB_EXPLIBS = -lcom_err
 SHLIB_DIRS = -L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
--- krb5-1.2.4.orig/src/util/profile/configure
+++ krb5-1.2.4/src/util/profile/configure
@@ -2349,10 +2349,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/util/profile/profile.pbexp
+++ krb5-1.2.4/src/util/profile/profile.pbexp
@@ -1,7 +1,7 @@
 #
 # _profile library Macintosh export file
 #
-# $Header: /cvs/krbdev/krb5/src/util/profile/Attic/profile.pbexp,v 1.1.4.2 2000/10/08 00:39:04 meeroh Exp $
+# $Header: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/util/profile/profile.pbexp,v 1.1.1.1 2001/03/02 10:35:52 hartmans Exp $
 
 ___InitializeProfileLib 
 
--- krb5-1.2.4.orig/src/util/pty/Makefile.in
+++ krb5-1.2.4/src/util/pty/Makefile.in
@@ -36,8 +36,8 @@
 
 
 SRCS=pty_err.c $(CFILES)
-SHLIB_EXPDEPS = \
-	$(TOPLIBD)/libcom_err$(SHLIBEXT)
+SHLIB_EXPDEPS = 
+
 SHLIB_EXPLIBS= -lcom_err 
 SHLIB_DIRS=-L$(TOPLIBD)
 SHLIB_RDIRS=$(KRB5_LIBDIR)
--- krb5-1.2.4.orig/src/util/pty/configure
+++ krb5-1.2.4/src/util/pty/configure
@@ -3831,10 +3831,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/util/ss/configure
+++ krb5-1.2.4/src/util/ss/configure
@@ -2757,10 +2757,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/src/configure
+++ krb5-1.2.4/src/configure
@@ -2072,10 +2072,10 @@
 	SHLIBEXT=.so
 	# Linux ld doesn't default to stuffing the SONAME field...
 	# Use objdump -x to examine the fields of the library
-	LDCOMBINE='ld -shared -h lib$(LIB)$(SHLIBSEXT)'
-	SHLIB_EXPFLAGS='-R$(SHLIB_RDIRS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS) -lc'
+	LDCOMBINE='$(CC) -shared -Wl,-h -Wl,lib$(LIB)$(SHLIBSEXT)'
+	SHLIB_EXPFLAGS=' $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
 	PROFFLAGS=-pg
-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -Wl,-rpath -Wl,$(PROG_RPATH)'
+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) '
 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)'
 	RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`; export LD_LIBRARY_PATH;'
 	;;
--- krb5-1.2.4.orig/debian/changelog
+++ krb5-1.2.4/debian/changelog
@@ -0,0 +1,275 @@
+krb5 (1.2.4-5woody4) stable-security; urgency=high
+
+  * Patch for CERT VU#623217 and VU#442569: Cryptographic weaknesses in
+    Kerberos 4
+     - Add -X option to krb5kdc and krb524d.  By default  cross-realm is
+       no longer supported for krb4 as it is a security hole.
+     - Add protection to isolate krb5 keys from krb4 especially for the
+       TGS key
+     - Remove support for the MIT extension to krb4 to use 3DES keys as it
+       is insecure.
+  * Patch to various DOS issues where the KDC assumes principal names have
+    certain components.  Fixes CAN-2003-0072 
+  * Patch for CERT VU#516825: Additional errors in XDR that may lead to
+    denial of service. 
+
+ -- Sam Hartman <hartmans@debian.org>  Mon, 17 Mar 2003 23:18:51 -0500
+
+krb5 (1.2.4-5woody3) stable-security; urgency=high
+
+  * Fix remote root vulnerability in the v4 kadmind (kadmind4); buffer
+    overflow in network packet handling..  Fortunately
+    this daemon is not run by default  in the Debian packages but it is
+    provided.
+
+ -- Sam Hartman <hartmans@debian.org>  Tue, 22 Oct 2002 17:57:44 -0400
+
+krb5 (1.2.4-5woody2) stable; urgency=low
+
+  * Fix protocol bug  which prevents  Microsoft clients from getting the
+    correct set of encryption types.  Appropriate for stable because this
+    is a significant interoperability issue, Closes: 162794
+
+ -- Sam Hartman <hartmans@debian.org>  Sun, 29 Sep 2002 21:21:59 -0400
+
+krb5 (1.2.4-5woody1) stable-security; urgency=high
+
+  * Woody security update
+  * Fix bug in xdr_array.c, closes potential remote root vulnerability in
+    admin server 
+
+ -- Sam Hartman <hartmans@debian.org>  Fri,  2 Aug 2002 13:38:55 -0400
+
+krb5 (1.2.4-5) unstable; urgency=low
+
+  * Pull up bugfix from 1.2.5 beta1  to src/lib/krb5/asn.1/asn1_get.c
+  * This should be the last thing we need from 1.2.5; Debian has all the
+    1.2.5 changes besides the API reorg.  I'm not checking an API reorg
+    this close to woody release.
+
+ -- Sam Hartman <hartmans@debian.org>  Fri, 12 Apr 2002 12:16:49 -0400
+
+krb5 (1.2.4-4) unstable; urgency=low
+
+  * Suggest rather than recommend krb5-user from libkrb53, closes: #140116
+  * Fix null pointer dereference in krb5 library; pull patch from  1.2.5 beta1
+
+ -- Sam Hartman <hartmans@debian.org>  Wed, 10 Apr 2002 14:19:49 -0400
+
+krb5 (1.2.4-3) unstable; urgency=medium
+
+  * Move from non-us to main
+
+ -- Sam Hartman <hartmans@debian.org>  Sat, 16 Mar 2002 15:04:44 -0500
+
+krb5 (1.2.4-2) unstable; urgency=low
+
+  * Don't respect umask when writing out srvtabs; you always want them
+    0600 and if you don't you can chmod later, closes: #135988
+  * To work with Heimdal, accept encrypted creds in
+    gss_accept_sec_context, closes: #135962
+  * Fix kadmin ACL bug.  Targets (a cool but undocumented ACL feature)
+    didn't work quite right.  They do now.
+
+ -- Sam Hartman <hartmans@debian.org>  Sun,  3 Mar 2002 18:53:40 -0500
+
+krb5 (1.2.4-1) unstable; urgency=low
+
+  * Don't check address in krb5_rd_cred; upstream patch also applied to
+    their CVS, closes: #132226
+  * Patch from Ken Raeburn to improve over-the-wire errors from KDC,
+    included because I happened to be testing it and it seemed to work
+  * New upstream release
+
+ -- Sam Hartman <hartmans@debian.org>  Fri,  1 Mar 2002 00:44:26 -0500
+
+krb5 (1.2.3-2) unstable; urgency=low
+
+  * We want to be able to use krb4 and libssl's libcrypto in the same
+    program.  To do this, we make libkrb4 bind libdes425 -Bsymbolic and we
+    allow krb_mk_priv and krb_rd_priv to take null schedule arguments.
+
+ -- Sam Hartman <hartmans@debian.org>  Tue, 15 Jan 2002 12:17:40 -0500
+
+krb5 (1.2.3-1) unstable; urgency=low
+
+  * New upstream version, closes: #110932
+  * Use alternatives for rsh, closes: #122710
+  * Major version of libkadm5 bumped; we no longer conflict with heimdal there
+
+ -- Sam hartman <hartmans@debian.org>  Thu, 10 Jan 2002 06:59:13 -0500
+
+krb5 (1.2.2-8) unstable; urgency=low
+
+  * Oops, call htons around port numbers in kprop patch
+  * Register with doc-base, closes: #100463
+  * Move krb5.conf and kdc.conf manpages into krb5-doc; krb5-doc now
+    conflicts with heimdal-docs, closes: #121141
+
+ -- Sam Hartman <hartmans@debian.org>  Sun, 25 Nov 2001 23:47:35 -0500
+
+krb5 (1.2.2-7) unstable; urgency=low
+
+      * Forward only tickets we believe the remote side knows the enctype
+    of, closes: #99320 
+  * Start krb5-kdc and krb5-admin-server before RPC services, thanks Hein
+    Roehrig, closes: #88604
+  * Install krb5.conf and kdc.conf man pages in krb5-user.  This is not
+    ideal but installing them in krb5-config won't work as they are
+    implementation dependent, closes: #109522
+  * Install kprop manpage, thanks Steve   Langasek, closes: #120040
+  * Fix FHS  paths with kprop; store files in /var/lib/krb5kdc, thanks
+    again Steve, closes: #120050
+  * Telnet help should open a connection to the host help not give you a
+    usage message, thanks Graeme Mathieson <graeme@mathie.cx> for a patch
+    which will be sent upstream, closes: #118730
+  * Fix kprop handling of service name.  If we can't find what we are
+    looking for in /etc/services default to the obvious correct answer;
+    thanks Steve, will commit  upstream, closes: #120010
+
+ -- Sam Hartman <hartmans@debian.org>  Sat, 24 Nov 2001 22:10:16 -0500
+
+krb5 (1.2.2-6) unstable; urgency=high
+
+  * Include telnetd security patch for ring buffer issue from upstream
+  * Conflict with the right Heimdal libs, closes: #103872
+
+ -- Sam Hartman <hartmans@debian.org>  Wed,  1 Aug 2001 15:19:43 -0400
+
+krb5 (1.2.2-5) unstable; urgency=low
+
+  * Use krb5-config; remove our own krb5.conf handling..  Note this is the
+    krb5-config package for /etc/krb5.conf, not the krb5-config library
+    helper command. 
+  * 
+  * Conflict with kerberos4kth-services, closes: #93303
+  * Update config.guess and config.sub, closes: #97585
+  * Have telnetd depend on krb5-rsh-server.  I suspect this will make
+    people grumpy and we need a better fix.  Really, Kerberized rlogin is
+    better than telnetd from a security standpoint, so I'm OK with it for
+    now.  Closes: #96695
+
+ -- Sam Hartman <hartmans@debian.org>  Wed, 16 May 2001 17:44:47 -0400
+
+krb5 (1.2.2-4) unstable; urgency=low
+
+  * Fix shared libraries to build with gcc not ld to properly include
+    -lgcc symbols, closes: #94407 
+
+ -- Sam Hartman <hartmans@debian.org>  Fri, 20 Apr 2001 02:47:21 -0400
+
+krb5 (1.2.2-3) unstable; urgency=high
+
+  * Fix vulnerability with glob call.  CERT claims that Linux is not
+    vulnerable, but I believe the krb5 implementation is.  The result of
+    glob was copied  into a fixed-sized buffer.  This fixes that
+    closes: #93689 
+  * Provide ftp-server not ftpd, closes: #93531
+  * Do not link kadm5clnt against kdb5.  
+
+ -- Sam Hartman <hartmans@debian.org>  Wed, 11 Apr 2001 19:50:17 -0400
+
+krb5 (1.2.2-2) unstable; urgency=low
+
+  * Work to provide an alternative for telnet and to be a telnet-client,
+    closes: 87914 
+    * libkrb5-dev depends on comerr-dev, closes: #87489
+  * Make clean target remove configure-stamp
+
+ -- Sam Hartman <hartmans@debian.org>  Mon,  5 Mar 2001 08:25:17 -0500
+
+krb5 (1.2.2-1) unstable; urgency=low
+
+  * New Upstream version, Closes: #82546
+  * Depend on debconf, closes: #87490
+  * Fix debconf formatting issue, closes: #84447
+  * Create sample ACL file, closes: #84448
+  * Fix lintian warnings and override as appropriate
+  * Upgrade to policy 3.5 moving stuff out of examples.
+
+ -- Sam Hartman <hartmans@debian.org>  Fri,  2 Mar 2001 11:32:06 -0500
+
+krb5 (1.2.1-9) unstable; urgency=low
+
+  * Do not use TIOCGLTC anywhere
+  * Build without TCL, closes: #81977
+  * Fix krb5-admin-server restart, closes: #81070
+  * With the new dpkg-source, files get diffed in the wrong order  for us
+    to prevent autoconf from getting run just by mangling things and
+    making sure we change every configure script.  So, touch every
+    configure script  in debian/rules.
+
+ -- Sam Hartman <hartmans@debian.org>  Sat, 13 Jan 2001 19:27:37 -0500
+
+krb5 (1.2.1-8) unstable; urgency=low
+
+  * Use separate build directory because the source tree supports it and
+    it works around failures in the upstream clean target, closes: #78954
+  * Make sure we modify all the configure scripts since we modify
+    aclocal.m4 so that time stamps don't cause autoconf to be run.
+  * Add bison and debhelper as build-depends, closes: #79643
+  * New maintainer address
+
+ -- Sam Hartman <hartmans@debian.org>  Sat, 23 Dec 2000 16:20:24 -0500
+
+krb5 (1.2.1-7) unstable; urgency=low
+
+  * Do not conflict with libss.a
+  * Upload to Debian(Closes: BUG#78499)
+
+ -- Sam Hartman <hartmans@mit.edu>  Mon,  4 Dec 2000 04:15:50 -0500
+
+krb5 (1.2.1-6) unstable; urgency=low
+
+  * Fix kpasswd manpage.
+  * Split out libkadm5 to avoid Heimdal conflict
+
+  * Conflict with kerberos4kth.
+  * Remove runpaths from libs and executables.
+
+ -- Sam Hartman <hartmans@mit.edu>  Wed, 29 Nov 2000 12:18:22 -0500
+
+krb5 (1.2.1-5) unstable; urgency=low
+
+  * If libkrb53 was preconfigured, then krb5.conf could overide explicit
+    user input.
+
+ -- Sam Hartman <hartmans@mit.edu>  Sat, 25 Nov 2000 17:01:26 -0500
+
+krb5 (1.2.1-4) unstable; urgency=low
+
+  * Write init.d scripts for kdc and admin server.
+  * Ask what admin programs to run and what krb4 mode to use.
+  * Populate initial kdc.conf if needed.
+  * New script (krb5_newrealm) to set up a Kerberos realm
+  * Document KDC issues.
+  * Make libkrb53.config work again so libkrb53 installs
+
+ -- Sam Hartman <hartmans@mit.edu>  Sat, 18 Nov 2000 17:22:16 -0500
+
+krb5 (1.2.1-3) unstable; urgency=low
+
+  * Add KDC packages
+  * Install login.krb5  Sadly, it is needed to make forwarded credentials
+    work.  This is unfortunate; it is not a  good login program. 
+
+ -- Sam Hartman <hartmans@mit.edu>  Wed,  8 Nov 2000 16:10:13 -0500
+
+krb5 (1.2.1-2) unstable; urgency=low
+
+  * Add copyright and README.debian
+  * Ship kadmin in krb5-user.
+  * Add services to inetd.conf
+  * Add support for generating krb5.conf
+
+ -- Sam Hartman <hartmans@mit.edu>  Thu,  2 Nov 2000 17:29:59 -0500
+
+krb5 (1.2.1-1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Sam Hartman <hartmans@permabit.com>  Thu, 19 Oct 2000 16:05:06 -0400
+
+Local variables:
+mode: debian-changelog
+End:
--- krb5-1.2.4.orig/debian/README.Debian
+++ krb5-1.2.4/debian/README.Debian
@@ -0,0 +1,20 @@
+MIT Kerberos for Debian
+
+MIt distributes the Kerberos sources a series of PGP-signed tarballs
+tarred up into a single .tar file.  In order to create the Debian
+Original upstream sources (.orig.tar.gz), I checked the PGP signatures
+and untarred all the .tar.gz files, repacking the resulting krb5-1.2.1
+directory.
+
+MIT Kerberos includes its own version of libcom_err, which is also
+included in e2fsprogs.  To avoid introducing yet another com_err into
+Debian, I patched the Kerberos sources to use the e2fsprogs com_err.
+This required adding a k5_comerr_glue.c to libkrb5 to implement
+several functions not included in the e2fsprogs com_err.  This is an
+abstraction violation.  Fortunately, work is underway to unify all the
+different versions of com_err so this can go away in the future.
+
+I do not install any of the sample clients and servers.  As a general
+rule these are not useful unless you are doing development.  In such a
+situation, you probably want to build them from source.
+
--- krb5-1.2.4.orig/debian/patch.1.2.7.DOS
+++ krb5-1.2.4/debian/patch.1.2.7.DOS
@@ -0,0 +1,61 @@
+? src/patch-1.2.6
+Index: src/include/krb5.hin
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/include/krb5.hin,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 krb5.hin
+--- src/include/krb5.hin	10 Jan 2002 11:04:06 -0000	1.1.1.2
++++ src/include/krb5.hin	18 Mar 2003 01:25:00 -0000
+@@ -302,7 +302,7 @@
+ #define	krb5_princ_size(context, princ) (princ)->length
+ #define	krb5_princ_type(context, princ) (princ)->type
+ #define	krb5_princ_name(context, princ) (princ)->data
+-#define	krb5_princ_component(context, princ,i) ((princ)->data + i)
++#define	krb5_princ_component(context, princ,i) (i < krb5_princ_size(context, princ) ? ((princ)->data + i) : NULL)
+ 
+ /*
+  * end "base-defs.h"
+Index: src/kdc/kdc_util.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/kdc/kdc_util.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 kdc_util.c
+--- src/kdc/kdc_util.c	10 Jan 2002 11:03:58 -0000	1.1.1.2
++++ src/kdc/kdc_util.c	18 Mar 2003 01:25:01 -0000
+@@ -157,7 +157,8 @@
+ krb5_boolean krb5_is_tgs_principal(principal)
+ 	krb5_principal	principal;
+ {
+-	if ((krb5_princ_component(kdc_context, principal, 0)->length ==
++	if (krb5_princ_size(kdc_context, principal) > 0 &&
++	    (krb5_princ_component(kdc_context, principal, 0)->length ==
+ 	     KRB5_TGS_NAME_SIZE) &&
+ 	    (!memcmp(krb5_princ_component(kdc_context, principal, 0)->data,
+ 		     KRB5_TGS_NAME, KRB5_TGS_NAME_SIZE)))
+@@ -1195,7 +1196,8 @@
+ 	    return KRB_AP_ERR_NOT_US;
+ 	}
+ 	/* ...and that the second component matches the server realm... */
+-	if ((krb5_princ_component(kdc_context, ticket->server, 1)->length !=
++	if (krb5_princ_size(kdc_context, ticket->server) <= 1 ||
++	    (krb5_princ_component(kdc_context, ticket->server, 1)->length !=
+ 	     krb5_princ_realm(kdc_context, request->server)->length) ||
+ 	    memcmp(krb5_princ_component(kdc_context, ticket->server, 1)->data,
+ 		   krb5_princ_realm(kdc_context, request->server)->data,
+Index: src/lib/krb5/krb/unparse.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/lib/krb5/krb/unparse.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 unparse.c
+--- src/lib/krb5/krb/unparse.c	20 Oct 2000 07:15:19 -0000	1.1.1.1
++++ src/lib/krb5/krb/unparse.c	18 Mar 2003 01:25:01 -0000
+@@ -150,7 +150,8 @@
+ 		*q++ = COMPONENT_SEP;
+ 	}
+ 
+-	q--;			/* Back up last component separator */
++	if (i > 0)
++	    q--;		/* Back up last component separator */
+ 	*q++ = REALM_SEP;
+ 	
+ 	cp = krb5_princ_realm(context, principal)->data;
--- krb5-1.2.4.orig/debian/README.KDC
+++ krb5-1.2.4/debian/README.KDC
@@ -0,0 +1,43 @@
+		   Running a Debian Kerberos Realm
+
+
+You will want to install the krb5-kdc and krb5-admin-server on your
+mast KDC and at least krb5-kdc on any slave KDCs you have.  You may
+wish to install krb5-admin-server on slaves in case you need them to
+become the master KDC in a hurry.
+
+You should look at the KDC configuration file (/etc/krb5kdc/kdc.conf)
+and adjust the parameters appropriately.  If you expect to be using a
+lot of Kerberos4 services, you should either remove +preauth from the
+default principal flags or select full krb4 support when prompted by
+debconf.  (You can run dpkg-reconfigure on krb5-kdc to see this prompt
+again.)  If you remove +preauth from the flags then principals will by
+default not require preauthentication.  This is somewhat less secure
+in that it opens you to offline dictionary attacks, but this level of
+security is what people have been suffering with throughout the
+lifetime of Kerberos4.  You can turn on requires_preauth for specific
+high-security principals in kadmin.  If you simply select full krb4
+support, then Kerberos5 clients will require preauthentication, but
+all principals will be accepted for Kerberos4.  This has a similar
+vulnerability to dictionary attacks.
+
+By default principals are created with both DES and 3DES keys.  This
+means that if you ever decide at some point in the future that you no
+longer have any DES services, you can get the full security benefits
+of 3DES by dropping it from supported_enctypes in
+/etc/krb5kdc/kdc.conf and from permitted_enctypes in /etc/krb5.conf.
+Note however, that for some services, like AFS and Zephyr, you may
+need to only create single DES keys.  You might do this by for
+example:
+
+    kadmin.local -e des-cbc-crc:normal -q "ktadd afs/ATHENA.MIT.EDU"
+
+
+
+You will probably want to create /etc/krb5kdc/kadm5.acl to include a
+list of users who are authorized to run kadmin in your realm.  The
+kadmind documentation provides examples.
+
+
+--Sam Hartman <hartmans@mit.edu>
+
--- krb5-1.2.4.orig/debian/patch.1.2.7.more_xdr
+++ krb5-1.2.4/debian/patch.1.2.7.more_xdr
@@ -0,0 +1,83 @@
+? src/patch-1.2.6
+Index: src/lib/rpc/xdr_mem.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/lib/rpc/xdr_mem.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 xdr_mem.c
+--- src/lib/rpc/xdr_mem.c	20 Oct 2000 07:15:19 -0000	1.1.1.1
++++ src/lib/rpc/xdr_mem.c	18 Mar 2003 04:13:52 -0000
+@@ -47,6 +47,8 @@
+ #include <gssrpc/xdr.h>
+ #include <netinet/in.h>
+ #include <stdio.h>
++#include <string.h>
++#include <limits.h>
+ 
+ static bool_t	xdrmem_getlong();
+ static bool_t	xdrmem_putlong();
+@@ -83,7 +85,7 @@
+ 	xdrs->x_op = op;
+ 	xdrs->x_ops = &xdrmem_ops;
+ 	xdrs->x_private = xdrs->x_base = addr;
+-	xdrs->x_handy = size;
++	xdrs->x_handy = (size > INT_MAX) ? INT_MAX : size; /* XXX */
+ }
+ 
+ static void
+@@ -98,8 +100,10 @@
+ 	long *lp;
+ {
+ 
+-	if ((xdrs->x_handy -= sizeof(rpc_int32)) < 0)
++	if (xdrs->x_handy < sizeof(rpc_int32))
+ 		return (FALSE);
++	else
++		xdrs->x_handy -= sizeof(rpc_int32);
+ 	*lp = (long)ntohl(*((rpc_u_int32 *)(xdrs->x_private)));
+ 	xdrs->x_private += sizeof(rpc_int32);
+ 	return (TRUE);
+@@ -111,8 +115,10 @@
+ 	long *lp;
+ {
+ 
+-	if ((xdrs->x_handy -= sizeof(rpc_int32)) < 0)
++	if (xdrs->x_handy < sizeof(rpc_int32))
+ 		return (FALSE);
++	else
++		xdrs->x_handy -= sizeof(rpc_int32);
+ 	*(rpc_int32 *)xdrs->x_private = (rpc_int32)htonl((rpc_u_int32)(*lp));
+ 	xdrs->x_private += sizeof(rpc_int32);
+ 	return (TRUE);
+@@ -125,8 +131,10 @@
+ 	register unsigned int len;
+ {
+ 
+-	if ((xdrs->x_handy -= len) < 0)
++	if (xdrs->x_handy < len)
+ 		return (FALSE);
++	else
++		xdrs->x_handy -= len;
+ 	memmove(addr, xdrs->x_private, len);
+ 	xdrs->x_private += len;
+ 	return (TRUE);
+@@ -139,8 +147,10 @@
+ 	register unsigned int len;
+ {
+ 
+-	if ((xdrs->x_handy -= len) < 0)
++	if (xdrs->x_handy < len)
+ 		return (FALSE);
++	else
++		xdrs->x_handy -= len;
+ 	memmove(xdrs->x_private, addr, len);
+ 	xdrs->x_private += len;
+ 	return (TRUE);
+@@ -179,7 +189,7 @@
+ {
+ 	rpc_int32 *buf = 0;
+ 
+-	if (xdrs->x_handy >= len) {
++	if (len >= 0 && xdrs->x_handy >= len) {
+ 		xdrs->x_handy -= len;
+ 		buf = (rpc_int32 *) xdrs->x_private;
+ 		xdrs->x_private += len;
--- krb5-1.2.4.orig/debian/patch.1.2.krb4.xrealm
+++ krb5-1.2.4/debian/patch.1.2.krb4.xrealm
@@ -0,0 +1,474 @@
+? patch-1.2.6
+? patch-1.2.7
+Index: kdc/kdc_util.h
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/kdc/kdc_util.h,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 kdc_util.h
+--- kdc/kdc_util.h	10 Jan 2002 11:03:58 -0000	1.1.1.2
++++ kdc/kdc_util.h	17 Mar 2003 07:43:00 -0000
+@@ -183,6 +183,7 @@
+ 				      const krb5_fulladdr *,
+ 				      int is_secondary,
+ 				      krb5_data **));
++void enable_v4_crossrealm(char *);
+ #else
+ #define process_v4(foo,bar,quux,foobar)	KRB5KRB_AP_ERR_BADVERSION
+ #endif
+Index: kdc/kerberos_v4.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/kdc/kerberos_v4.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 kerberos_v4.c
+--- kdc/kerberos_v4.c	20 Oct 2000 07:15:19 -0000	1.1.1.1
++++ kdc/kerberos_v4.c	17 Mar 2003 07:43:03 -0000
+@@ -149,7 +149,7 @@
+ 
+ void kerberos_v4 PROTOTYPE((struct sockaddr_in *, KTEXT));
+ void kerb_err_reply PROTOTYPE((struct sockaddr_in *, KTEXT, long, char *));
+-static int set_tgtkey PROTOTYPE((char *, krb5_kvno));
++static int set_tgtkey PROTOTYPE((char *, krb5_kvno, krb5_boolean));
+ 
+ /* Attributes converted from V5 to V4 - internal representation */
+ #define V4_KDB_REQUIRES_PREAUTH  0x1
+@@ -182,6 +182,7 @@
+ 
+ static const int v4mode_table_nents = sizeof(v4mode_table)/
+ 				      sizeof(v4mode_table[0]);
++static int allow_v4_crossrealm = 0;
+ 
+ void process_v4_mode(progname, string)
+     const char          *progname;
+@@ -210,6 +211,11 @@
+     return;
+ }
+ 
++void enable_v4_crossrealm ( char *programname) {
++    allow_v4_crossrealm = 1;
++    krb5_klog_syslog(LOG_ERR, "Enabling v4 cross-realm compatibility; this is a known security hole");
++}
++
+ krb5_error_code
+ process_v4( pkt, client_fulladdr, is_secondary, resp)
+ const krb5_data *pkt;
+@@ -401,6 +407,14 @@
+ #define MIN5 300
+ #define HR21 255
+ 
++/*
++ * Previously this code returned either a v4 key or a v5 key  and you
++ * could tell from the enctype of the v5 key whether the v4 key was
++ * useful.  Now we return both keys so the code can try both des3 and
++ * des decryption.  We fail if the ticket doesn't have a v4 key.
++ * Also, note as a side effect, the v5 key is basically useless  in
++ * the client case.  It is still returned so the caller can free it.
++ */
+ static int
+ kerb_get_principal(name, inst, principal, maxn, more, k5key, kvno, issrv)
+     char   *name;               /* could have wild card */
+@@ -482,8 +496,28 @@
+ 	    return(0);
+ 	}
+     } else {
+-	/* XXX yes I know this is a hardcoded search order */
+-	if (krb5_dbe_find_enctype(kdc_context, &entries,
++	if ( krb5_dbe_find_enctype(kdc_context, &entries,
++				  ENCTYPE_DES_CBC_CRC,
++				  KRB5_KDB_SALTTYPE_V4, kvno, &pkey) &&
++	    krb5_dbe_find_enctype(kdc_context, &entries,
++				  ENCTYPE_DES_CBC_CRC,
++				  -1, kvno, &pkey)) {
++	    lt = klog(L_KRB_PERR,
++		      "KDC V4: failed to find key for %s.%s #%d",
++		      name, inst, kvno);
++	    krb5_db_free_principal(kdc_context, &entries, nprinc);
++	    return(0);
++	}
++    }
++
++    if (!compat_decrypt_key(pkey, k, k5key, issrv)) {
++ 	memcpy( &principal->key_low, k, LONGLEN);
++       	memcpy( &principal->key_high, (krb5_ui_4 *) k + 1, LONGLEN);
++    }
++    memset(k, 0, sizeof k);
++    if (issrv) {
++	krb5_free_keyblock_contents (kdc_context, k5key);
++      	if (krb5_dbe_find_enctype(kdc_context, &entries,
+ 				  ENCTYPE_DES3_CBC_RAW,
+ 				  -1, kvno, &pkey) &&
+ 	    krb5_dbe_find_enctype(kdc_context, &entries,
+@@ -504,12 +538,10 @@
+ 	    krb5_db_free_principal(kdc_context, &entries, nprinc);
+ 	    return(0);
+ 	}
++	compat_decrypt_key(pkey, k, k5key, issrv);
++	memset (k, 0, sizeof k);
+     }
+ 
+-    if (!compat_decrypt_key(pkey, k, k5key, issrv)) {
+- 	memcpy( &principal->key_low, k, LONGLEN);
+-       	memcpy( &principal->key_high, (krb5_ui_4 *) k + 1, LONGLEN);
+-    }
+     /* convert v5's entries struct to v4's Principal struct:
+      * v5's time-unit for lifetimes is 1 sec, while v4 uses 5 minutes.
+      */
+@@ -743,21 +775,14 @@
+ 	    kdb_encrypt_key(key, key, master_key,
+ 			    master_key_schedule, DECRYPT);
+ 	    /* construct and seal the ticket */
+-	    if (K4KDC_ENCTYPE_OK(k5key.enctype)) {
+-		krb_create_ticket(tk, k_flags, a_name_data.name,
+-				  a_name_data.instance, local_realm,
+-				  client_host.s_addr, (char *) session_key,
+-				  lifetime, kerb_time.tv_sec,
+-				  s_name_data.name, s_name_data.instance,
+-				  key);
+-	    } else {
+-		krb_cr_tkt_krb5(tk, k_flags, a_name_data.name,
+-				a_name_data.instance, local_realm,
+-				client_host.s_addr, (char *) session_key,
+-				lifetime, kerb_time.tv_sec,
+-				s_name_data.name, s_name_data.instance,
+-				&k5key);
+-	    }
++	    /* We always issue des tickets; the 3des tickets are a broken hack*/
++	    krb_create_ticket(tk, k_flags, a_name_data.name,
++			      a_name_data.instance, local_realm,
++			      client_host.s_addr, (char *) session_key,
++			      lifetime, kerb_time.tv_sec,
++			      s_name_data.name, s_name_data.instance,
++			      key);
++
+ 	    krb5_free_keyblock_contents(kdc_context, &k5key);
+ 	    memset(key, 0, sizeof(key));
+ 	    memset(key_s, 0, sizeof(key_s));
+@@ -837,8 +862,15 @@
+ 	    strncpy(tktrlm, (char *)auth->dat + 3, REALM_SZ);
+ 	    tktrlm[REALM_SZ-1] = '\0';
+ 	    kvno = (krb5_kvno)auth->dat[2];
+-	    if (set_tgtkey(tktrlm, kvno)) {
+-		lt = klog(L_ERR_UNK,
++	    if ((!allow_v4_crossrealm)&&strcmp(tktrlm, local_realm) != 0) {
++	      lt = klog(L_ERR_UNK,
++			"Cross realm ticket from %s denied by policy,", tktrlm);
++	      kerb_err_reply(client, pkt,
++			       KERB_ERR_PRINCIPAL_UNKNOWN, lt);
++		return;
++	    }
++	    if (set_tgtkey(tktrlm, kvno, 0)) {
++	      lt = klog(L_ERR_UNK,
+ 			  "FAILED set_tgtkey realm %s, kvno %d. Host: %s ",
+ 			  tktrlm, kvno, inet_ntoa(client_host));
+ 		/* no better error code */
+@@ -848,6 +880,19 @@
+ 	    }
+ 	    kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr,
+ 		ad, 0);
++	    if (kerno) {
++		if (set_tgtkey(tktrlm, kvno, 1)) {
++		    lt = klog(L_ERR_UNK,
++			      "FAILED 3des set_tgtkey realm %s, kvno %d. Host: %s ",
++			      tktrlm, kvno, inet_ntoa(client_host));
++		    /* no better error code */
++		    kerb_err_reply(client, pkt,
++				   KERB_ERR_PRINCIPAL_UNKNOWN, lt);
++		    return;
++		}
++		kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr,
++				   ad, 0);
++	    }
+ 
+ 	    if (kerno) {
+ 		klog(L_ERR_UNK, "FAILED krb_rd_req from %s: %s",
+@@ -913,21 +958,13 @@
+ 	    des_new_random_key(session_key);
+ #endif
+ 
+-	    if (K4KDC_ENCTYPE_OK(k5key.enctype)) {
+-		krb_create_ticket(tk, k_flags, ad->pname, ad->pinst,
+-				  ad->prealm, client_host.s_addr,
+-				  (char *) session_key, lifetime,
+-				  kerb_time.tv_sec,
+-				  s_name_data.name, s_name_data.instance,
+-				  key);
+-	    } else {
+-		krb_cr_tkt_krb5(tk, k_flags, ad->pname, ad->pinst,
+-				ad->prealm, client_host.s_addr,
+-				(char *) session_key, lifetime,
+-				kerb_time.tv_sec,
+-				s_name_data.name, s_name_data.instance,
+-				&k5key);
+-	    }
++	    /* ALways issue des tickets*/
++	    krb_create_ticket(tk, k_flags, ad->pname, ad->pinst,
++			      ad->prealm, client_host.s_addr,
++			      (char *) session_key, lifetime,
++			      kerb_time.tv_sec,
++			      s_name_data.name, s_name_data.instance,
++			      key);
+ 	    krb5_free_keyblock_contents(kdc_context, &k5key);
+ 	    memset(key, 0, sizeof(key));
+ 	    memset(key_s, 0, sizeof(key_s));
+@@ -1128,20 +1165,22 @@
+ 
+ /* Set the key for krb_rd_req so we can check tgt */
+ static int
+-set_tgtkey(r, kvno)
++set_tgtkey(r, kvno, use_3des)
+     char   *r;			/* Realm for desired key */
+     krb5_kvno kvno;
++    krb5_boolean use_3des;
+ {
+     int     n;
+     static char lastrealm[REALM_SZ] = "";
+     static int last_kvno = 0;
++    static krb5_boolean last_use_3des = 0;
+     Principal p_st;
+     Principal *p = &p_st;
+     C_Block key;
+     krb5_keyblock k5key;
+ 
+     k5key.contents = NULL;
+-    if (!strcmp(lastrealm, r) && last_kvno == kvno)
++    if (!strcmp(lastrealm, r) && last_kvno == kvno && last_use_3des == use_3des)
+ 	return (KSUCCESS);
+ 
+ /*  log("Getting key for %s", r); */
+@@ -1150,11 +1189,12 @@
+     if (n == 0)
+ 	return (KFAILURE);
+ 
+-    if (!K4KDC_ENCTYPE_OK(k5key.enctype)) {
++    if (use_3des&&!K4KDC_ENCTYPE_OK(k5key.enctype)) {
+ 	krb_set_key_krb5(kdc_context, &k5key);
+ 	strncpy(lastrealm, r, sizeof(lastrealm) - 1);
+ 	lastrealm[sizeof(lastrealm) - 1] = '\0';
+ 	last_kvno = kvno;
++	last_use_3des = use_3des;
+     } else {
+ 	/* unseal tgt key from master key */
+ 	memcpy(key,                &p->key_low,  4);
+Index: kdc/main.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/kdc/main.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 main.c
+--- kdc/main.c	10 Jan 2002 11:03:59 -0000	1.1.1.2
++++ kdc/main.c	17 Mar 2003 07:43:03 -0000
+@@ -559,7 +559,7 @@
+ usage(name)
+ char *name;
+ {
+-    fprintf(stderr, "usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-4 v4mode] [-n]\n", name);
++    fprintf(stderr, "usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-4 v4mode] [-X] [-n]\n", name);
+     return;
+ }
+ 
+@@ -611,7 +611,7 @@
+      * Loop through the option list.  Each time we encounter a realm name,
+      * use the previously scanned options to fill in for defaults.
+      */
+-    while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n4:3")) != -1) {
++    while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n4:X3")) != -1) {
+ 	switch(c) {
+ 	case 'r':			/* realm name for db */
+ 	    if (!find_realm_data(optarg, (krb5_ui_4) strlen(optarg))) {
+@@ -661,6 +661,11 @@
+ 	    v4mode = strdup(optarg);
+ #endif
+ 	    break;
++	case 'X':
++#ifdef KRB5_KRB4_COMPAT
++		enable_v4_crossrealm(argv[0]);
++#endif
++		break;
+ 	case '3':
+ #ifdef ATHENA_DES3_KLUDGE
+ 	    if (krb5_enctypes_list[krb5_enctypes_length-1].etype
+Index: krb524/cnv_tkt_skey.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/krb524/cnv_tkt_skey.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 cnv_tkt_skey.c
+--- krb524/cnv_tkt_skey.c	2 Mar 2001 10:30:28 -0000	1.1.1.2
++++ krb524/cnv_tkt_skey.c	17 Mar 2003 07:43:03 -0000
+@@ -167,25 +167,7 @@
+ 				 sname,
+ 				 sinst,
+ 				 v4_skey->contents);
+-     } else {
+-	 /* Force enctype to be raw if using DES3. */
+-	 if (v4_skey->enctype == ENCTYPE_DES3_CBC_SHA1 ||
+-	     v4_skey->enctype == ENCTYPE_LOCAL_DES3_HMAC_SHA1)
+-	     v4_skey->enctype = ENCTYPE_DES3_CBC_RAW;
+-	 ret = krb_cr_tkt_krb5(v4tkt,
+-			       0, /* flags */			     
+-			       pname,
+-			       pinst,
+-			       prealm,
+-			       *((unsigned long *)kaddr.contents),
+-			       (char *) v5etkt->session->contents,
+-			       lifetime,
+-			       /* issue_data */
+-			       server_time,
+-			       sname,
+-			       sinst,
+-			       v4_skey);
+-     }
++     } else  abort();
+ 
+      krb5_free_enc_tkt_part(context, v5etkt);
+      v5tkt->enc_part2 = NULL;
+Index: krb524/krb524d.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/krb524/krb524d.c,v
+retrieving revision 1.3
+diff -u -r1.3 krb524d.c
+--- krb524/krb524d.c	10 Jan 2002 11:19:22 -0000	1.3
++++ krb524/krb524d.c	17 Mar 2003 07:43:03 -0000
+@@ -48,6 +48,7 @@
+ void *handle;
+ 
+ int use_keytab, use_master;
++int allow_v4_crossrealm = 0;
+ char *keytab = NULL;
+ krb5_keytab kt;
+ 
+@@ -105,7 +106,10 @@
+      config_params.mask = 0;
+      
+      while (argc) {
+-	  if (strncmp(*argv, "-k", 2) == 0)
++       if (strncmp(*argv, "-X", 2) == 0) {
++	 allow_v4_crossrealm = 1;
++       }
++       else if (strncmp(*argv, "-k", 2) == 0)
+ 	       use_keytab = 1;
+ 	  else if (strncmp(*argv, "-m", 2) == 0)
+ 	       use_master = 1;
+@@ -298,18 +302,6 @@
+ 	  goto error;
+ 
+      if ((ret = lookup_service_key(context, v5tkt->server,
+-				   ENCTYPE_DES3_CBC_RAW,
+-				   0, /* highest kvno */
+-				   &v4_service_key, &v4kvno)) &&
+-	 (ret = lookup_service_key(context, v5tkt->server,
+-				   ENCTYPE_LOCAL_DES3_HMAC_SHA1,
+-				   0,
+-				   &v4_service_key, &v4kvno)) &&
+-	 (ret = lookup_service_key(context, v5tkt->server,
+-				   ENCTYPE_DES3_CBC_SHA1,
+-				   0,
+-				   &v4_service_key, &v4kvno)) &&
+-	 (ret = lookup_service_key(context, v5tkt->server,
+ 				   ENCTYPE_DES_CBC_CRC,
+ 				   0,
+ 				   &v4_service_key, &v4kvno)))
+@@ -317,8 +309,19 @@
+ 
+      if (debug)
+ 	  printf("service key retrieved\n");
++     if ((ret = krb5_decrypt_tkt_part(context, &v5_service_key, v5tkt))) {
++       goto error;
++     }
++
++    if (!(allow_v4_crossrealm || krb5_realm_compare(context, v5tkt->server,
++						    v5tkt->enc_part2->client))) {
++ret =  KRB5KDC_ERR_POLICY ;
++ goto error;
++    }
++    krb5_free_enc_tkt_part(context, v5tkt->enc_part2);
++    v5tkt->enc_part2= NULL;
+ 
+-     ret = krb524_convert_tkt_skey(context, v5tkt, &v4tkt, &v5_service_key,
++         ret = krb524_convert_tkt_skey(context, v5tkt, &v4tkt, &v5_service_key,
+ 				   &v4_service_key,
+ 				   (struct sockaddr_in *)&saddr);
+      if (ret)
+Index: lib/kdb/keytab.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/lib/kdb/keytab.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 keytab.c
+--- lib/kdb/keytab.c	10 Jan 2002 11:04:42 -0000	1.1.1.2
++++ lib/kdb/keytab.c	17 Mar 2003 07:43:03 -0000
+@@ -28,6 +28,8 @@
+ #include "k5-int.h"
+ #include "kdb_kt.h"
+ 
++static int
++is_xrealm_tgt(krb5_context, krb5_const_principal);
+ krb5_error_code krb5_ktkdb_close KRB5_PROTOTYPE((krb5_context, krb5_keytab));
+ 
+ krb5_error_code krb5_ktkdb_get_entry KRB5_PROTOTYPE((krb5_context, krb5_keytab, krb5_const_principal,
+@@ -98,6 +100,8 @@
+     krb5_db_entry 	  db_entry;
+     krb5_boolean 	  more = 0;
+     int 	 	  n = 0;
++    int xrealm_tgt = is_xrealm_tgt(context, principal);
++    int similar;
+ 
+     /* Open database */
+     /* krb5_db_init(context); */
+@@ -121,16 +125,31 @@
+     if (kerror)
+ 	goto error;
+ 
++    /* For cross realm tgts, we match whatever enctype is provided;
++     * for other principals, we only match the first enctype that is
++     * found.  Since the TGS and AS code do the same thing, then we
++     * will only successfully decrypt  tickets we have issued.*/
+     kerror = krb5_dbe_find_enctype(context, &db_entry,
+-				   enctype, -1, kvno, &key_data);
++				   xrealm_tgt?enctype:-1,
++				   -1, kvno, &key_data);
+     if (kerror)
+ 	goto error;
+ 
++
+     kerror = krb5_dbekd_decrypt_key_data(context, master_key,
+ 					 key_data, &entry->key, NULL);
+     if (kerror)
+ 	goto error;
+ 
++    kerror = krb5_c_enctype_compare(context, enctype, entry->key.enctype, &similar);
++    if (kerror)
++	goto error;
++
++    if (!similar) {
++		kerror = KRB5_KDB_NO_PERMITTED_KEY;
++	goto error;
++    }
++
+     /*
+      * Coerce the enctype of the output keyblock in case we got an
+      * inexact match on the enctype; this behavior will go away when
+@@ -148,3 +167,27 @@
+     krb5_db_close_database(context);
+     return(kerror);
+ }
++
++/*
++ * is_xrealm_tgt: Returns true if the principal is a cross-realm  TGT
++ * principal-- a principal with first component  krbtgt and second
++ * component not equal to realm.
++ */
++static int
++is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
++{
++    krb5_data *dat;
++    if (krb5_princ_size(context, princ) != 2)
++	return 0;
++    dat = krb5_princ_component(context, princ, 0);
++    if (strncmp("krbtgt", dat->data, dat->length) != 0)
++	return 0;
++    dat = krb5_princ_component(context, princ, 1);
++    if (dat->length != princ->realm.length)
++	return 1;
++    if (strcmp(dat->data, princ->realm.data) == 0)
++	return 0;
++    return 1;
++
++}
++
--- krb5-1.2.4.orig/debian/control
+++ krb5-1.2.4/debian/control
@@ -0,0 +1,146 @@
+source: krb5
+Section: net
+Priority: optional
+Build-Depends: comerr-dev, libncurses5-dev, docbook-to-man, debhelper (>= 2.2.12), bison
+Standards-Version: 3.5.0
+Maintainer: Sam Hartman <hartmans@debian.org>
+
+Package: libkadm55
+Section: libs
+Depends: libkrb53 (= ${Source-Version})
+Architecture: any
+Description: MIT Kerberos administration runtime libraries
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: libkrb53
+Section: libs
+Architecture: any
+Depends: ${shlibs:Depends}, debconf
+Suggests: krb5-doc, krb5-user
+Description: MIT Kerberos runtime libraries
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-user
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), libkadm55 (= ${Source-Version}), krb5-config
+Conflicts: heimdal-clients, kerberos4kth-user, suidmanager (<< 0.50), kerberos4kth-services
+Description: Basic programs to authenticate using MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-clients
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), krb5-config
+Suggests: rsh-client
+Conflicts:  kerberos4kth-clients, kerberos4kth-services, heimdal-clients
+Provides: telnet-client
+Description: Secure replacements for ftp, telnet and rsh using MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-rsh-server
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), netbase, krb5-config
+Provides: rsh-server
+Description: Secure replacements for rshd and rlogind  using MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-ftpd
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), netbase, krb5-config
+Conflicts: ftpd
+Priority: extra
+Provides: ftp-server
+Description: Secure FTP server supporting MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-telnetd
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), netbase, krb5-config, krb5-rsh-server
+Conflicts: telnetd, telnet-server
+Provides: telnet-server
+Priority: extra
+Description: Secure telnet server supporting MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-kdc
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), krb5-user, debconf
+Description: Mit Kerberos key server (KDC)
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-admin-server
+Architecture: any
+Depends: ${shlibs:Depends}, libkrb53 (= ${Source-Version}), krb5-kdc, debconf
+Description: Mit Kerberos master server (kadmind)
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: libkrb5-dev
+Section: devel
+Architecture: any
+Depends:  libkrb53 (= ${Source-Version}), libkadm55 (= ${Source-Version}), comerr-dev
+Conflicts: heimdal-dev
+Suggests: krb5-doc
+Description: Headers and development libraries for MIT Kerberos
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
+Package: krb5-doc
+Architecture: all
+Conflicts: heimdal-docs
+Replaces: krb5-user (<< 1.2.2-8)
+Description: Documentation for krb5
+ Kerberos is a system for authenticating users and services on a network.
+ Kerberos is a trusted third-party service.  That means that there is a
+ third party (the kerberos server) that is trusted by all the entities on
+ the network (users and services, usually called "principals").
+ .
+ This is the MIT reference implementation of Kerberos5.
+
--- krb5-1.2.4.orig/debian/copyright
+++ krb5-1.2.4/debian/copyright
@@ -0,0 +1,95 @@
+This package was debianized by Sam Hartman <hartmans@permabit.com> on
+Thu, 19 Oct 2000 16:05:06 -0400.
+
+It was downloaded from <http://web.mit.edu/kerberos
+
+Upstream Author(s): <MIt Kerberos Team <krbdev@mit.edu>
+
+Copyright:
+
+Copyright (C) 1985-2000 by the Massachusetts Institute of Technology.
+
+All rights reserved.
+
+Export of this software from the United States of America may require
+a specific license from the United States Government.  It is the
+responsibility of any person or organization contemplating export to
+obtain such a license before exporting.
+
+WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+distribute this software and its documentation for any purpose and
+without fee is hereby granted, provided that the above copyright
+notice appear in all copies and that both that copyright notice and
+this permission notice appear in supporting documentation, and that
+the name of M.I.T. not be used in advertising or publicity pertaining
+to distribution of the software without specific, written prior
+permission.  Furthermore if you modify this software you must label
+your software as modified software and not distribute it in such a
+fashion that it might be confused with the original MIT software.
+M.I.T. makes no representations about the suitability of this software
+for any purpose.  It is provided "as is" without express or implied
+warranty.
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+
+Individual source code files are copyright MIT, Cygnus Support,
+OpenVision, Oracle, Sun Soft, FundsXpress, and others.
+
+Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira,
+and Zephyr are trademarks of the Massachusetts Institute of Technology
+(MIT).  No commercial use of these trademarks may be made without
+prior written permission of MIT.
+
+"Commercial use" means use of a name in a product or other for-profit
+manner.  It does NOT prevent a commercial firm from referring to the
+MIT trademarks in order to convey information (although in doing so,
+recognition of their trademark status should be given).
+
+----
+
+The following copyright and permission notice applies to the
+OpenVision Kerberos Administration system located in kadmin/create,
+kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions
+of lib/rpc:
+
+   Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved
+
+   WARNING: Retrieving the OpenVision Kerberos Administration system 
+   source code, as described below, indicates your acceptance of the 
+   following terms.  If you do not agree to the following terms, do not 
+   retrieve the OpenVision Kerberos administration system.
+
+   You may freely use and distribute the Source Code and Object Code
+   compiled from it, with or without modification, but this Source
+   Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY,
+   INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR
+   FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER
+   EXPRESS OR IMPLIED.  IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY
+   FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF 
+   SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR
+   CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, 
+   WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE 
+   CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY 
+   OTHER REASON.
+
+   OpenVision retains all copyrights in the donated Source Code. OpenVision
+   also retains copyright to derivative works of the Source Code, whether
+   created by OpenVision or by a third party. The OpenVision copyright 
+   notice must be preserved if derivative works are made based on the 
+   donated Source Code.
+
+   OpenVision Technologies, Inc. has donated this Kerberos 
+   Administration system to MIT for inclusion in the standard 
+   Kerberos 5 distribution.  This donation underscores our 
+   commitment to continuing Kerberos technology development 
+   and our gratitude for the valuable work which has been 
+   performed by MIT and the Kerberos community.
+
+----
+
+    Portions contributed by Matt Crawford <crawdad@fnal.gov> were
+    work performed at Fermi National Accelerator Laboratory, which is
+    operated by Universities Research Association, Inc., under
+    contract DE-AC02-76CHO3000 with the U.S. Department of Energy.
--- krb5-1.2.4.orig/debian/kdc.conf
+++ krb5-1.2.4/debian/kdc.conf
@@ -0,0 +1,17 @@
+[kdcdefaults]
+	kdc_ports = 750,88
+
+[realms]
+@MYREALM = {
+		database_name = /var/lib/krb5kdc/principal
+		admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
+		acl_file = /etc/krb5kdc/kadm5.acl
+		key_stash_file = /etc/krb5kdc/stash
+		kdc_ports = 750,88
+		max_life = 10h 0m 0s
+		max_renewable_life = 7d 0h 0m 0s
+		master_key_type = des3-hmac-sha1
+		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
+		default_principal_flags = +preauth
+	}
+
--- krb5-1.2.4.orig/debian/krb4-openssh.patch
+++ krb5-1.2.4/debian/krb4-openssh.patch
@@ -0,0 +1,96 @@
+Index: lib/krb4/Makefile.in
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb4/Makefile.in,v
+retrieving revision 1.1
+retrieving revision 1.3
+diff -u -r1.1 -r1.3
+--- lib/krb4/Makefile.in	20 Oct 2000 07:15:19 -0000	1.1
++++ lib/krb4/Makefile.in	15 Jan 2002 17:41:44 -0000	1.3
+@@ -17,13 +17,13 @@
+ # Depends on libkrb5, expect to find
+ #	krb5_init_context, krb5_free_context, profile_get_values
+ #
+-KRB4_CRYPTO_LIBS=-ldes425
++KRB4_CRYPTO_LIBS=-Wl,-Bsymbolic -ldes425
+ 
+ SHLIB_EXPDEPS = \
+ 	$(TOPLIBD)/libdes425$(SHLIBEXT) \
+ 	$(TOPLIBD)/libk5crypto$(SHLIBEXT) \
+ 	$(TOPLIBD)/libkrb5$(SHLIBEXT)
+-SHLIB_EXPLIBS=-lkrb5 -lcom_err -ldes425 -lk5crypto
++SHLIB_EXPLIBS=-lkrb5 -lcom_err -Wl,-Bsymbolic -ldes425 -lk5crypto
+ SHLIB_DIRS=-L$(TOPLIBD)
+ SHLIB_RDIRS=$(KRB5_LIBDIR)
+ 
+Index: lib/krb4/mk_priv.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb4/mk_priv.c,v
+retrieving revision 1.1
+retrieving revision 1.2
+diff -u -r1.1 -r1.2
+--- lib/krb4/mk_priv.c	20 Oct 2000 07:15:19 -0000	1.1
++++ lib/krb4/mk_priv.c	15 Jan 2002 15:33:19 -0000	1.2
+@@ -94,12 +94,15 @@
+     register u_char     *p,*q;
+     u_char *c_length_ptr;
+     extern int private_msg_ver; /* in krb_rd_priv.c */
++    des_key_schedule ks;
++    
+ 
+     unsigned KRB4_32 c_length;
+     u_char msg_time_5ms;
+     unsigned KRB4_32 msg_time_sec;
+     unsigned KRB4_32 msg_time_usec;
+ 
++    
+     /*
+      * get the current time to use instead of a sequence #, since
+      * process lifetime may be shorter than the lifetime of a session
+@@ -196,9 +199,15 @@
+     memcpy((char *)c_length_ptr, (char *) &c_length, sizeof(c_length));
+ 
+ #ifndef NOENCRYPTION
++    if (!schedule) {
++      assert(des_key_sched(key, ks) == 0);
++	schedule = ks;
++	}
+     /* pcbc encrypt, pad as needed, use key as ivec */
+     pcbc_encrypt((C_Block *) q,(C_Block *) q, (long) (p-q), schedule,
+                  (C_Block *)key, ENCRYPT);
++    memset(ks, 0, sizeof(ks));
++    
+ #endif /* NOENCRYPTION */
+ 
+     return (q - out + c_length);        /* resulting size */
+Index: lib/krb4/rd_priv.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb4/rd_priv.c,v
+retrieving revision 1.1
+retrieving revision 1.2
+diff -u -r1.1 -r1.2
+--- lib/krb4/rd_priv.c	20 Oct 2000 07:15:19 -0000	1.1
++++ lib/krb4/rd_priv.c	15 Jan 2002 15:33:19 -0000	1.2
+@@ -81,7 +81,7 @@
+     int swap_bytes;
+     unsigned KRB4_32 t_local;
+     KRB4_32 delta_t;		/* Difference between timestamps */
+-
++    des_key_schedule ks;
+     p = in;			/* beginning of message */
+     swap_bytes = 0;
+ 
+@@ -112,9 +112,14 @@
+     q = p;			/* mark start of encrypted stuff */
+ 
+ #ifndef NOENCRYPTION
++    if (!schedule) {
++      assert(des_key_sched(key, ks) == 0);
++	schedule = ks;
++	}
+     /* pcbc decrypt, use key as ivec */
+     pcbc_encrypt((C_Block *)q, (C_Block *)q, (long)c_length,
+                  schedule, (C_Block *)key, DECRYPT);
++    memset(ks, 0, sizeof(ks));
+ #endif
+ 
+     /* safely get application data length */
--- krb5-1.2.4.orig/debian/krb5-1.2.3.orig.tar.gz.asc
+++ krb5-1.2.4/debian/krb5-1.2.3.orig.tar.gz.asc
@@ -0,0 +1,9 @@
+-----BEGIN PGP SIGNATURE-----
+Version: PGP 6.5.8
+
+iQCVAwUAPDzM8KbDgE/zdoE9AQH5nAQAzDNPmwUUeVNL9QJ9xAFbcqxPearsegLu
+PylG95tRjw4ZZ8fwpA2CtaAjYMtDLOW+lyY+8TZErzKSHcfVLLVn/O0SDwItkhZo
+v86RdxgzWUGA/C/2FuRCHbkQcxvdDT/xTtK1QG5PFFRF6XKwy2mMjLblmtqaVBwu
+X/Tbt7oRTgA=
+=4gRi
+-----END PGP SIGNATURE-----
--- krb5-1.2.4.orig/debian/krb5-admin-server.conffiles
+++ krb5-1.2.4/debian/krb5-admin-server.conffiles
@@ -0,0 +1 @@
+/etc/init.d/krb5-admin-server
--- krb5-1.2.4.orig/debian/krb5-admin-server.config
+++ krb5-1.2.4/debian/krb5-admin-server.config
@@ -0,0 +1,12 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule || exit
+
+db_version 2.0
+db_input high krb5-admin-server/newrealm || true
+db_get krb5-kdc/debconf
+if [ $RET = yes ] ; then
+    db_input low krb5-admin-server/kadmind ||true
+    db_input low krb5-admin-server/v5passwdd || true
+    fi
+db_go
--- krb5-1.2.4.orig/debian/krb5-admin-server.files
+++ krb5-1.2.4/debian/krb5-admin-server.files
@@ -0,0 +1,7 @@
+usr/sbin/kadmind
+usr/sbin/kadmin.local
+usr/sbin/v5passwdd
+usr/sbin/kadmind4
+usr/share/man/man8/kadmind.8
+usr/share/man/man8/kprop.8
+usr/sbin/kprop
--- krb5-1.2.4.orig/debian/krb5-admin-server.init
+++ krb5-1.2.4/debian/krb5-admin-server.init
@@ -0,0 +1,104 @@
+#! /bin/sh
+#
+# Init script for krb5-admin-server
+#		This file should be used to construct scripts for /etc/init.d.
+#
+#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
+
+#		Modified for Debian GNU/Linux
+#		by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+# Modifed for krb5 package by Sam Hartman <hartmans@mit.edu>
+#
+# Version:	@(#)skeleton  1.8  03-Mar-1998  miquels@cistron.nl
+#
+
+# drop fd's we don't need
+# this helps with debconf
+exec </dev/null
+exec 3>/dev/null
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DESC="Kerberos Administration Servers"
+
+test -f /usr/sbin/kadmind || exit 0
+
+test -f /etc/krb5kdc/kadm5.keytab || exit 0
+
+test -f /etc/default/krb5-admin-server && . /etc/default/krb5-admin-server
+
+case "$1" in 
+  start)
+	echo -n "Starting $DESC: "
+
+	if [ "x$RUN_KADMIND" = "xtrue" ] ; then
+	    start-stop-daemon --start --quiet \
+		--exec /usr/sbin/kadmind
+	    echo -n "kadmind"
+	    fi
+	if [ "x$RUN_V5PASSWDD" = "xtrue" ] ; then
+	    start-stop-daemon --quiet --start --exec /usr/sbin/v5passwdd
+	    echo -n " v5passwdd"
+	    fi
+	echo "."
+	;;
+  stop)
+	echo -n "Stopping $DESC: "
+        if [ "x$RUN_KADMIND" =  "xtrue" ] ; then
+	    start-stop-daemon --stop --quiet \
+		--exec /usr/sbin/kadmind
+	    echo -n "kadmind"
+	    fi
+	if [ "x$RUN_V5PASSWDD" = "xtrue" ] ;then 
+	    start-stop-daemon --stop --quiet --exec /usr/sbin/v5passwdd
+	    echo -n " v5passwdd"
+	    fi
+	echo "."
+
+	;;
+  #reload)
+	#
+	#	If the daemon can reload its config files on the fly
+	#	for example by sending it SIGHUP, do it here.
+	#
+	#	If the daemon responds to changes in its config file
+	#	directly anyway, make this a do-nothing entry.
+	#
+	# echo "Reloading $DESC configuration files."
+	# start-stop-daemon --stop --signal 1 --quiet --pidfile \
+	#	/var/run/$NAME.pid --exec $DAEMON
+  #;;
+  restart|force-reload)
+	#
+	#	If the "reload" option is implemented, move the "force-reload"
+	#	option to the "reload" entry above. If not, "force-reload" is
+	#	just the same as "restart".
+	#
+	echo -n "Restarting $DESC: "
+        if [ "x$RUN_KADMIND" =  "xtrue" ] ; then
+	    start-stop-daemon --stop --quiet \
+		--exec /usr/sbin/kadmind
+	    echo -n "kadmind"
+	    fi
+	if [ "x$RUN_V5PASSWDD" = "xtrue" ] ;then 
+	    start-stop-daemon --stop --quiet --exec /usr/sbin/v5passwdd
+	    echo -n " v5passwdd"
+	    fi
+	sleep 1
+	if [ "x$RUN_KADMIND" = "xtrue" ] ; then
+	    start-stop-daemon --start --quiet \
+		--exec /usr/sbin/kadmind
+	    fi
+	if [ "x$RUN_V5PASSWDD" = "xtrue" ] ; then
+	    start-stop-daemon --quiet --start --exec /usr/sbin/v5passwdd
+	    fi
+	echo "."
+	;;
+  *)
+	N=/etc/init.d/$NAME
+	# echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $N {start|stop|restart|force-reload}" >&2
+	exit 1
+	;;
+esac
+
+exit 0
--- krb5-1.2.4.orig/debian/krb5-admin-server.links
+++ krb5-1.2.4/debian/krb5-admin-server.links
@@ -0,0 +1 @@
+kadmin.8.gz usr/share/man/man8/kadmin.local.8.gz
--- krb5-1.2.4.orig/debian/krb5-admin-server.lintian
+++ krb5-1.2.4/debian/krb5-admin-server.lintian
@@ -0,0 +1 @@
+krb5-admin-server: link-to-undocumented-manpage
--- krb5-1.2.4.orig/debian/krb5-admin-server.postinst
+++ krb5-1.2.4/debian/krb5-admin-server.postinst
@@ -0,0 +1,28 @@
+#! /bin/sh -e
+
+
+
+if [ "configure" = "$1" ] ; then
+	. /usr/share/debconf/confmodule || exit 
+	db_version 2.0
+
+	db_get krb5-kdc/debconf
+	DEBCONF=$RET
+
+
+	    if [ $DEBCONF = "yes" ] ; then
+	    echo \#Automatically generated--do not edit \
+	      >/etc/default/krb5-admin-server
+	    echo \# Run dpkg-reconfigure krb5-admin-server to change \
+	      >>/etc/default/krb5-admin-server
+	    db_get krb5-admin-server/kadmind
+	    echo RUN_KADMIND=$RET \
+	      >>/etc/default/krb5-admin-server
+	    db_get krb5-admin-server/v5passwdd
+	    echo RUN_V5PASSWDD=$RET >>/etc/default/krb5-admin-server
+	    fi
+	fi
+
+
+#DEBHELPER#
+
--- krb5-1.2.4.orig/debian/krb5-admin-server.templates
+++ krb5-1.2.4/debian/krb5-admin-server.templates
@@ -0,0 +1,34 @@
+Template: krb5-admin-server/newrealm
+Type: note
+Description: Setting up a Kerberos Realm
+ This package contains the administrative tools necessary to run on
+ the Kerberos master server.  However, installing this package does
+ not automatically set up a Kerberos realm.  Doing so requires
+ entering passwords and as such is not well-suited for package
+ installation.  To create the realm, run the krb5_newrealm command.
+ You may also wish to read /usr/share/doc/krb5-kdc/README.KDC and the
+ administration guide found in the krb5-doc package.
+ .
+ Don't forget to set up DNS information so your clients can find your
+ KDC and admin servers.  Doing so is documented in the administration
+ guide.
+
+Template: krb5-admin-server/kadmind
+Type: boolean
+Default: true
+Description: Run the Kerberos5 administration daemon (kadmind)?
+  Kadmind serves requests to add/modify/remove principals in the
+  Kerberos database.  It also must be running for the kpasswd program
+  to be used to change passwords.  Normally, this daemon runs on the
+  master KDC.
+
+Template: krb5-admin-server/v5passwdd
+Type: boolean
+Default: false
+Description: Run the v5passwdd password changing service?
+  V5passwdd implements a simple password changing protocol that small
+  clients can use to change passwords without the overhead of a
+  complete implementation of the Kadmin RPC.
+  .
+  This service will not be needed unless you have clients that require
+  it, so it is disabled by default.
--- krb5-1.2.4.orig/debian/krb5-admin-server.undocumented
+++ krb5-1.2.4/debian/krb5-admin-server.undocumented
@@ -0,0 +1 @@
+v5passwdd.8
--- krb5-1.2.4.orig/debian/krb5-clients.files
+++ krb5-1.2.4/debian/krb5-clients.files
@@ -0,0 +1,12 @@
+usr/bin/ftp
+usr/share/man/man1/ftp.1
+usr/bin/telnet.krb5
+usr/share/man/man1/telnet.krb5.1
+usr/bin/krb5-rsh
+usr/share/man/man1/krb5-rsh.1
+usr/bin/krb5-rlogin
+usr/share/man/man1/krb5-rlogin.1
+usr/bin/rcp
+usr/share/man/man1/rcp.1
+usr/bin/v4rcp
+usr/share/man/man1/v4rcp.1
--- krb5-1.2.4.orig/debian/krb5-clients.postinst
+++ krb5-1.2.4/debian/krb5-clients.postinst
@@ -0,0 +1,29 @@
+#!/bin/sh -e
+if [ "configure" = "$1" ] ; then
+    if [ x$2 != x ] ;then
+	if dpkg --compare-versions $2 lt 1.2.3 ; then
+	    for foo in  rlogin rsh; do
+		dpkg-divert --quiet --package krb5-clients --rename \
+		    --divert /usr/bin/$foo.nokrb --remove /usr/bin/$foo ||true
+		dpkg-divert --quiet --package krb5-clients --rename \
+		    --divert /usr/share/man/man1/$foo.nokrb.1.gz \
+		    --remove /usr/share/man/man1/$foo.1.gz ||true
+	    done
+	    fi
+	fi
+
+    update-alternatives --install /usr/bin/telnet telnet /usr/bin/telnet.krb5 105 \
+	--slave /usr/share/man/man1/telnet.1.gz telnet.1.gz /usr/share/man/man1/telnet.krb5.1.gz
+    for foo in rsh rlogin; do
+	update-alternatives --install /usr/bin/$foo $foo /usr/bin/krb5-$foo 105 \
+	    --slave /usr/share/man/man1/$foo.1.gz $foo.1.gz /usr/share/man/man1/krb5-$1.1.gz
+	done
+    
+    fi
+
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
--- krb5-1.2.4.orig/debian/krb5-clients.postrm
+++ krb5-1.2.4/debian/krb5-clients.postrm
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+if [ remove = "$1" ] ; then
+	for foo in   rcp ftp; do
+		dpkg-divert --quiet --package krb5-clients --rename \
+			--divert /usr/bin/$foo.nokrb --remove /usr/bin/$foo
+		dpkg-divert --quiet --package krb5-clients --rename \
+				--divert /usr/share/man/man1/$foo.nokrb.1.gz \
+				--remove /usr/share/man/man1/$foo.1.gz
+		done
+	fi
+
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-clients.preinst
+++ krb5-1.2.4/debian/krb5-clients.preinst
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+if [ install = "$1" ] ; then
+	for foo in  rlogin rsh rcp ftp; do
+		dpkg-divert --quiet --package krb5-clients --rename \
+			--divert /usr/bin/$foo.nokrb --add /usr/bin/$foo
+		dpkg-divert --quiet --package krb5-clients --rename \
+				--divert /usr/share/man/man1/$foo.nokrb.1.gz \
+				--add /usr/share/man/man1/$foo.1.gz
+		done
+	fi
+
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-clients.prerm
+++ krb5-1.2.4/debian/krb5-clients.prerm
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/share/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	update-alternatives --remove telnet /usr/bin/telnet.krb5
+	for foo in rsh rlogin; do
+	    update-alternatives --remove $foo /usr/bin/krb5-$foo
+	    done
+        ;;
+    failed-upgrade)
+        ;;
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-doc.doc-base.admin
+++ krb5-1.2.4/debian/krb5-doc.doc-base.admin
@@ -0,0 +1,10 @@
+Document: krb5-admin
+Title: Kerberos Version 5 Administrator's Guide
+Author: MIT
+Abstract: Administration guide for MIt Kerberos Version 5.
+ .
+Section: Apps/System
+
+Format: HTML
+Index: /usr/share/doc/krb5-doc/admin.html
+Files: /usr/share/doc/krb5-doc/admin*html
--- krb5-1.2.4.orig/debian/krb5-doc.doc-base.install
+++ krb5-1.2.4/debian/krb5-doc.doc-base.install
@@ -0,0 +1,10 @@
+Document: krb5-install
+Title: Installing Kerberos Version 5
+Author: MIT
+Abstract: Installation guide for MIt Kerberos Version 5.
+ .
+Section: Apps/System
+
+Format: HTML
+Index: /usr/share/doc/krb5-doc/install.html
+Files: /usr/share/doc/krb5-doc/install*html
--- krb5-1.2.4.orig/debian/krb5-doc.docs
+++ krb5-1.2.4/debian/krb5-doc.docs
@@ -0,0 +1,15 @@
+doc/admin-guide.ps
+doc/admin.html
+doc/admin_foot.html
+doc/admin_toc.html
+doc/install-guide.ps
+doc/install.html
+doc/install_foot.html
+doc/install_toc.html
+doc/krb425-guide.ps
+doc/krb425.html
+doc/krb425_toc.html
+doc/user-guide.html
+doc/user-guide.ps
+doc/user-guide_foot.html
+doc/user-guide_toc.html
--- krb5-1.2.4.orig/debian/krb5-doc.files
+++ krb5-1.2.4/debian/krb5-doc.files
@@ -0,0 +1 @@
+usr/share/man/man5/*
--- krb5-1.2.4.orig/debian/krb5-ftpd.files
+++ krb5-1.2.4/debian/krb5-ftpd.files
@@ -0,0 +1,2 @@
+usr/sbin/ftpd
+usr/share/man/man8/ftpd.8
--- krb5-1.2.4.orig/debian/krb5-ftpd.postinst
+++ krb5-1.2.4/debian/krb5-ftpd.postinst
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+# $Id: krb5-ftpd.postinst,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+if [ "$1" = configure -a -z "$2" ]; then
+	update-inetd --group Kerberos --add "ftp		stream	tcp	nowait	root	/usr/sbin/tcpd	/usr/sbin/ftpd -a"
+else
+	update-inetd --enable ftp
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-ftpd.prerm
+++ krb5-1.2.4/debian/krb5-ftpd.prerm
@@ -0,0 +1,9 @@
+#!/bin/bash -e
+# $Id: krb5-ftpd.prerm,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+# If netbase is not installed, then we don't need to do the remove.
+if command -v update-inetd >/dev/null 2>&1; then
+        update-inetd --disable ftp
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-kdc.conffiles
+++ krb5-1.2.4/debian/krb5-kdc.conffiles
@@ -0,0 +1 @@
+/etc/init.d/krb5-kdc
--- krb5-1.2.4.orig/debian/krb5-kdc.config
+++ krb5-1.2.4/debian/krb5-kdc.config
@@ -0,0 +1,26 @@
+#!/bin/sh  -e
+set -e
+. /usr/share/debconf/confmodule || exit
+db_version 2.0
+
+db_input "low" krb5-kdc/debconf || true
+db_go
+
+db_get krb5-kdc/debconf
+if [ $RET = "yes" ] ; then
+	db_input medium krb5-kdc/krb4-mode ||true
+	db_go
+	RET=""
+	db_get krb5-kdc/run-krb524 || true
+	if [ "x$RET" = x ] ; then
+	    db_get krb5-kdc/krb4-mode
+		if [ $RET = disable ] ; then
+		    db_set krb5-kdc/run-krb524 false
+			    else
+				    db_set krb5-kdc/run-krb524 true
+					    fi
+						fi
+    db_input low krb5-kdc/run-krb524 ||true
+						db_go
+fi
+
--- krb5-1.2.4.orig/debian/krb5-kdc.dirs
+++ krb5-1.2.4/debian/krb5-kdc.dirs
@@ -0,0 +1,3 @@
+var/lib/krb5kdc
+etc/krb5kdc
+usr/share/krb5
--- krb5-1.2.4.orig/debian/krb5-kdc.docs
+++ krb5-1.2.4/debian/krb5-kdc.docs
@@ -0,0 +1 @@
+debian/README.KDC
--- krb5-1.2.4.orig/debian/krb5-kdc.files
+++ krb5-1.2.4/debian/krb5-kdc.files
@@ -0,0 +1,7 @@
+usr/sbin/krb5kdc
+usr/sbin/kdb5_util
+usr/sbin/kpropd
+usr/sbin/krb524d
+usr/share/man/man8/krb5kdc.8
+usr/share/man/man8/kdb5_util.8
+usr/share/man/man8/kpropd.8
--- krb5-1.2.4.orig/debian/krb5-kdc.init
+++ krb5-1.2.4/debian/krb5-kdc.init
@@ -0,0 +1,92 @@
+#! /bin/sh
+#
+# Init script for krb5kdc
+#		This file should be used to construct scripts for /etc/init.d.
+#
+#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
+
+#		Modified for Debian GNU/Linux
+#		by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+# Modifed for krb5 package by Sam Hartman <hartmans@mit.edu>
+#
+# Version:	@(#)skeleton  1.8  03-Mar-1998  miquels@cistron.nl
+#
+
+# drop fd's we don't need
+# this helps with debconf
+exec </dev/null
+exec 3>/dev/null
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/krb5kdc
+NAME=krb5kdc
+DESC="Kerberos KDC"
+
+test -f $DAEMON || exit 0
+
+test -f /etc/krb5kdc/stash || exit 0
+
+test -f /etc/default/krb5-kdc && . /etc/default/krb5-kdc
+if [ "x$KRB4_MODE" != x ] ;then
+    ARGS="-4$KRB4_MODE $ARGS"
+    fi
+
+case "$1" in 
+  start)
+	echo -n "Starting $DESC: "
+	start-stop-daemon --start --quiet \
+		--exec $DAEMON -- $ARGS
+	echo -n "$NAME"
+	if [ "x$RUN_KRB524D" = "xtrue" ] ; then
+	    start-stop-daemon --quiet --start --exec /usr/sbin/krb524d -- -m
+	    echo -n " krb524d"
+	    fi
+	echo "."
+	;;
+  stop)
+	echo -n "Stopping $DESC: "
+	start-stop-daemon --stop --quiet \
+		--exec $DAEMON
+	echo -n "$NAME"
+	if [ "x$RUN_KRB524D" = "xtrue" ] ;then 
+	    start-stop-daemon  --stop --quiet --exec /usr/sbin/krb524d
+	    echo -n " krb524d"
+	    fi
+	echo "."
+
+	;;
+  #reload)
+	#
+	#	If the daemon can reload its config files on the fly
+	#	for example by sending it SIGHUP, do it here.
+	#
+	#	If the daemon responds to changes in its config file
+	#	directly anyway, make this a do-nothing entry.
+	#
+	# echo "Reloading $DESC configuration files."
+	# start-stop-daemon --stop --signal 1 --quiet --pidfile \
+	#	/var/run/$NAME.pid --exec $DAEMON
+  #;;
+  restart|force-reload)
+	#
+	#	If the "reload" option is implemented, move the "force-reload"
+	#	option to the "reload" entry above. If not, "force-reload" is
+	#	just the same as "restart".
+	#
+	echo -n "Restarting $DESC: "
+	start-stop-daemon --stop --quiet --pidfile \
+		/var/run/$NAME.pid --exec $DAEMON
+	sleep 1
+	start-stop-daemon --start --quiet --pidfile \
+		/var/run/$NAME.pid --exec $DAEMON
+	echo "$NAME."
+	;;
+  *)
+	N=/etc/init.d/$NAME
+	# echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $N {start|stop|restart|force-reload}" >&2
+	exit 1
+	;;
+esac
+
+exit 0
--- krb5-1.2.4.orig/debian/krb5-kdc.lintian
+++ krb5-1.2.4/debian/krb5-kdc.lintian
@@ -0,0 +1,2 @@
+krb5-kdc: link-to-undocumented-manpage
+krb5-kdc: non-standard-dir-perm
--- krb5-1.2.4.orig/debian/krb5-kdc.postinst
+++ krb5-1.2.4/debian/krb5-kdc.postinst
@@ -0,0 +1,33 @@
+#! /bin/sh
+
+set -e 
+export KRB5LD_DEFAULT_REALM
+if [ "configure" = "$1" ] ; then
+	. /usr/share/debconf/confmodule || exit 
+	db_version 2.0
+	db_get krb5-config/default_realm
+	KRB5LD_DEFAULT_REALM="$RET"
+
+	db_get krb5-kdc/debconf
+	DEBCONF=$RET
+
+	if [ \( ! -f /etc/krb5kdc/kdc.conf \) -a $DEBCONF = "yes" ] ; then
+		sed -e s/@MYREALM/$KRB5LD_DEFAULT_REALM/ \
+		    /usr/share/krb5/kdc.conf.template \
+		    >/etc/krb5kdc/kdc.conf
+		fi
+
+	if [ $DEBCONF = "yes" ] ; then
+		echo \#Automatically generated--do not edit \
+		  >/etc/default/krb5-kdc
+		echo \# Run dpkg-reconfigure krb5-kdc to change >>/etc/default/krb5-kdc
+		db_get krb5-kdc/krb4-mode
+		echo KRB4_MODE=$RET >>/etc/default/krb5-kdc
+		db_get krb5-kdc/run-krb524 
+		echo RUN_KRB524D=$RET \
+		    >>/etc/default/krb5-kdc
+		fi
+	fi
+
+#DEBHELPER#
+
--- krb5-1.2.4.orig/debian/krb5-kdc.postrm
+++ krb5-1.2.4/debian/krb5-kdc.postrm
@@ -0,0 +1,12 @@
+#!/bin/sh -e
+
+if [ $1 = "purge" ] ; then
+	rm -f /etc/krb5kdc/kdc.conf 2>/dev/null || true
+	rm -f /etc/default/krb5-kdc 2>/dev/null ||true
+	rm -f /etc/krb5kdc/kadm5.keytab 2>/dev/null || true
+	rm -f /etc/krb5kdc/kadm5.acl 2>/dev/null || true
+	rm -f /etc/krb5kdc/stash 2>/dev/null || true
+	fi
+
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-kdc.templates
+++ krb5-1.2.4/debian/krb5-kdc.templates
@@ -0,0 +1,34 @@
+Template: krb5-kdc/debconf
+Default: yes
+Type: select
+Choices: yes, no
+Description: Should debconf create Kerberos KDC Configuration? 
+ Many sites will wish to have this script automatically create
+ Kerberos KDC configuration files in /etc/krb5kdc.  By default an
+ example template will be copied into this directory with local
+ parameters filled in.  Some sites who already have
+ infrastructure to manage their own Kerberos configuration will wish
+ to disable any automatic configuration changes.
+
+Template: krb5-kdc/krb4-mode
+Default: nopreauth
+Type: select
+Choices: disable, full, nopreauth
+Description: What Kerberos4 compatibility mode should be used?
+ By default, Kerberos4 requests are allowed from principals that do
+ not require preauthentication.  This allows Kerberos4 services to
+ exist while requiring most users to use Kerberos5 clients to get their
+ initial tickets.  These tickets can then be converted to Kerberos4
+ tickets.  Alternatively, the mode can be set to full, allowing
+ Kerberos4 to get initial tickets even when preauthentication would
+ normally be required, or to disable, which will disable all Kerberos4
+ support.
+
+Template: krb5-kdc/run-krb524
+Type: boolean
+Description: Run a krb524d?
+ Krb524d is a daemon that converts Kerberos5 tickets into Kerberos4
+ tickets for the krb524init program.  If you have Kerberos4 enabled
+ at all, then you probably want to run this program.  Especially when
+ Kerberos4 compatibility is set to nopreauth, krb524d is important if
+ you have any Kerberos4 services.
--- krb5-1.2.4.orig/debian/krb5-kdc.undocumented
+++ krb5-1.2.4/debian/krb5-kdc.undocumented
@@ -0,0 +1 @@
+krb524d.8
--- krb5-1.2.4.orig/debian/krb5-rsh-server.files
+++ krb5-1.2.4/debian/krb5-rsh-server.files
@@ -0,0 +1,6 @@
+usr/sbin/klogind
+usr/share/man/man8/klogind.8
+usr/sbin/kshd
+usr/share/man/man8/kshd.8
+usr/sbin/login.krb5
+usr/share/man/man8/login.krb5.8
--- krb5-1.2.4.orig/debian/krb5-rsh-server.postinst
+++ krb5-1.2.4/debian/krb5-rsh-server.postinst
@@ -0,0 +1,12 @@
+#!/bin/sh -e
+# $Id: krb5-rsh-server.postinst,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+if [ "$1" = configure -a -z "$2" ]; then
+	update-inetd --group Kerberos --add "kshell		stream	tcp	nowait	root	/usr/sbin/tcpd	/usr/sbin/kshd -5ec"
+update-inetd --group Kerberos --add "eklogin		stream	tcp	nowait	root	/usr/sbin/tcpd	/usr/sbin/klogind -5ec"
+
+else
+	update-inetd --enable kshell,eklogin
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-rsh-server.prerm
+++ krb5-1.2.4/debian/krb5-rsh-server.prerm
@@ -0,0 +1,9 @@
+#!/bin/sh -e
+# $Id: krb5-rsh-server.prerm,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+# If netbase is not installed, then we don't need to do the remove.
+if command -v update-inetd >/dev/null 2>&1; then
+        update-inetd --disable kshell,eklogin
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-telnetd.files
+++ krb5-1.2.4/debian/krb5-telnetd.files
@@ -0,0 +1,2 @@
+usr/sbin/telnetd
+usr/share/man/man8/telnetd.8
--- krb5-1.2.4.orig/debian/krb5-telnetd.postinst
+++ krb5-1.2.4/debian/krb5-telnetd.postinst
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+# $Id: krb5-telnetd.postinst,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+if [ "$1" = configure -a -z "$2" ]; then
+	update-inetd --group Kerberos --add "telnet		stream	tcp	nowait	root	/usr/sbin/tcpd	/usr/sbin/telnetd -a user"
+else
+	update-inetd --enable telnet
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-telnetd.prerm
+++ krb5-1.2.4/debian/krb5-telnetd.prerm
@@ -0,0 +1,9 @@
+#!/bin/bash -e
+# $Id: krb5-telnetd.prerm,v 1.1 2000/10/26 01:31:46 hartmans Exp $
+
+# If netbase is not installed, then we don't need to do the remove.
+if command -v update-inetd >/dev/null 2>&1; then
+        update-inetd --disable telnet
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/krb5-user.files
+++ krb5-1.2.4/debian/krb5-user.files
@@ -0,0 +1,19 @@
+usr/bin/klist
+usr/share/man/man1/klist.1
+usr/bin/kinit
+usr/share/man/man1/kinit.1
+usr/bin/kvno
+usr/share/man/man1/kvno.1
+usr/sbin/ktutil
+usr/share/man/man8/ktutil.8
+usr/bin/kpasswd
+usr/share/man/man1/kpasswd.1
+usr/bin/kdestroy
+usr/share/man/man1/kdestroy.1
+usr/bin/v5passwd
+usr/share/man/man1/v5passwd.1
+usr/bin/krb524init
+usr/bin/ksu
+usr/share/man/man1/ksu.1
+usr/sbin/kadmin
+usr/share/man/man8/kadmin.8
--- krb5-1.2.4.orig/debian/krb5-user.lintian
+++ krb5-1.2.4/debian/krb5-user.lintian
@@ -0,0 +1,2 @@
+krb5-user: link-to-undocumented-manpage
+krb5-user: setuid-binary
--- krb5-1.2.4.orig/debian/krb5-user.suid
+++ krb5-1.2.4/debian/krb5-user.suid
@@ -0,0 +1 @@
+usr/bin/ksu
--- krb5-1.2.4.orig/debian/krb5-user.undocumented
+++ krb5-1.2.4/debian/krb5-user.undocumented
@@ -0,0 +1 @@
+krb524init.1
--- krb5-1.2.4.orig/debian/krb5.conf
+++ krb5-1.2.4/debian/krb5.conf
@@ -0,0 +1,78 @@
+[libdefaults]
+	default_realm = ATHENA.MIT.EDU
+	default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+	default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+	krb4_config = /etc/krb.conf
+	krb4_realms = /etc/krb.realms
+	kdc_timesync = 1
+	ccache_type = 4
+	forwardable = true
+	proxiable = true
+
+[realms]
+	ATHENA.MIT.EDU = {
+		kdc = kerberos.mit.edu:88
+		kdc = kerberos-1.mit.edu:88
+		kdc = kerberos-2.mit.edu:88
+		kdc = kerberos-3.mit.edu:88
+		admin_server = kerberos.mit.edu
+		default_domain = mit.edu
+	}
+	MEDIA-LAB.MIT.EDU = {
+		kdc = kerberos.media.mit.edu
+		admin_server = kerberos.media.mit.edu
+	}
+	ZONE.MIT.EDU = {
+		kdc = casio.mit.edu
+		kdc = seiko.mit.edu
+		admin_server = casio.mit.edu
+	}
+	MOOF.MIT.EDU = {
+		kdc = three-headed-dogcow.mit.edu:88
+		kdc = three-headed-dogcow-1.mit.edu:88
+		admin_server = three-headed-dogcow.mit.edu
+	}
+	CYGNUS.COM = {
+		kdc = KERBEROS.CYGNUS.COM
+		kdc = KERBEROS-1.CYGNUS.COM
+		admin_server = KERBEROS.CYGNUS.COM
+	}
+	GREY17.ORG = {
+		kdc = kerberos.grey17.org
+		admin_server = kerberos.grey17.org
+	}
+	IHTFP.ORG = {
+		kdc = kerberos.ihtfp.org
+		admin_server = kerberos.ihtfp.org
+	}
+	GNU.ORG = {
+		kdc = kerberos.gnu.org
+		kdc = kerberos-2.gnu.org
+		kdc = kerberos-3.gnu.org
+		admin_server = kerberos.gnu.org
+	}
+	1TS.ORG = {
+		kdc = kerberos.1ts.org
+		admin_server = kerberos.1ts.org
+	}
+	GRATUITOUS.ORG = {
+		kdc = kerberos.gratuitous.org
+		admin_server = kerberos.gratuitous.org
+	}
+	DOOMCOM.ORG = {
+		kdc = kerberos.doomcom.org
+		admin_server = kerberos.doomcom.org
+	}
+
+[domain_realm]
+	.mit.edu = ATHENA.MIT.EDU
+	mit.edu = ATHENA.MIT.EDU
+	.media.mit.edu = MEDIA-LAB.MIT.EDU
+	media.mit.edu = MEDIA-LAB.MIT.EDU
+	.whoi.edu = ATHENA.MIT.EDU
+	whoi.edu = ATHENA.MIT.EDU
+
+[login]
+	krb4_convert = true
+	krb4_get_tickets = true
--- krb5-1.2.4.orig/debian/krb5_newrealm
+++ krb5-1.2.4/debian/krb5_newrealm
@@ -0,0 +1,43 @@
+#!/bin/sh -e
+
+cat <<eof
+This script should be run on the master KDC/admin server to initialize
+a Kerberos realm.  It will ask you to type in a master key password.
+This password will be used to generate a key that is stored in
+/etc/krb5kdc/stash.  You should try to remember this password, but it
+is much more important that it be a strong password than that it be
+remembered.  However, if you lose the password and /etc/krb5kdc/stash,
+you cannot decrypt your Kerberos database.
+eof
+
+kdb5_util create -s
+kadmin.local -q "ktadd -k /etc/krb5kdc/kadm5.keytab kadmin/admin"
+kadmin.local -q "ktadd -k /etc/krb5kdc/kadm5.keytab kadmin/changepw"
+/etc/init.d/krb5-kdc start || true
+/etc/init.d/krb5-admin-server start ||true 
+if [ ! -r /etc/krb5kdc/kadm5.acl ] ; then
+    cat <<EOF >/etc/krb5kdc/kadm5.acl
+# This file Is the access control list for krb5 administration.
+# When this file is edited run /etc/init.d/krb5-admin-server restart to activate
+# One common way to set up Kerberos administration is to allow any principal 
+# ending in /admin  is given full administrative rights.
+# To enable this, uncomment the following line:
+# */admin *
+EOF
+    fi
+cat <<eof
+
+
+Now that your realm is set up you may wish to create an administrative
+principal using the addprinc subcommand of the kadmin.local program.
+Then, this principal can be added to /etc/krb5kdc/kadm5.acl so that
+you can use the kadmin program on other computers.  Kerberos admin
+principals usually belong to a single user and end in /admin.  For
+example, if jruser is a Kerberos administrator, then in addition to
+the normal jruser principal, a jruser/admin principal should be
+created.
+
+Don't forget to set up DNS information so your clients can find your
+KDC and admin servers.  Doing so is documented in the administration
+guide.
+eof
--- krb5-1.2.4.orig/debian/krb5_newrealm.sgml
+++ krb5-1.2.4/debian/krb5_newrealm.sgml
@@ -0,0 +1,27 @@
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V3.1//EN">
+<refentry>
+  <refmeta>
+    <refentrytitle>krb5_newrealm</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+  <refnamediv>
+    <refname>krb5_newrealm</refname>
+    <refpurpose>Create a new Kerberos Realm</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <!-- one of (CALLOUTLIST GLOSSLIST ITEMIZEDLIST ORDEREDLIST SEGMENTEDLIST SIMPLELIST VARIABLELIST CAUTION IMPORTANT NOTE TIP WARNING LITERALLAYOUT PROGRAMLISTING PROGRAMLISTINGCO SCREEN SCREENCO SCREENSHOT SYNOPSIS CMDSYNOPSIS FUNCSYNOPSIS FORMALPARA PARA SIMPARA ADDRESS BLOCKQUOTE GRAPHIC GRAPHICCO MEDIAOBJECT MEDIAOBJECTCO INFORMALEQUATION INFORMALEXAMPLE INFORMALFIGURE INFORMALTABLE EQUATION EXAMPLE FIGURE TABLE MSGSET PROCEDURE SIDEBAR QANDASET ANCHOR BRIDGEHEAD COMMENT HIGHLIGHTS ABSTRACT AUTHORBLURB EPIGRAPH INDEXTERM REFSECT2) -->
+    <cmdsynopsis>
+      <!-- one of (SBR GROUP ARG COMMAND) -->
+      <command>krb5_newrealm</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+  <refsect1>
+    <title>Description</title> <para>This script attempts to create a
+    Kerberos realm.  It assumes that none of the realm components
+    exists.  It creates the database and populates
+    <filename>/etc/krb5kdc/kadm5.keytab</filename> which contains keys
+    necessary for akdmind to run.  
+    </para>
+</refsect1> 
+</refentry>
+
--- krb5-1.2.4.orig/debian/libkadm55.files
+++ krb5-1.2.4/debian/libkadm55.files
@@ -0,0 +1 @@
+usr/lib/libkadm5*.so.*
--- krb5-1.2.4.orig/debian/libkadm55.postinst
+++ krb5-1.2.4/debian/libkadm55.postinst
@@ -0,0 +1,9 @@
+#! /bin/sh
+
+set -e 
+
+if [ "configure" = "$1" ] ; then
+    ldconfig
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/libkrb5-dev.files
+++ krb5-1.2.4/debian/libkrb5-dev.files
@@ -0,0 +1,4 @@
+usr/lib/lib*.a
+usr/lib/lib*.so
+usr/include/*
+usr/bin/krb5-config
--- krb5-1.2.4.orig/debian/libkrb5-dev.lintian
+++ krb5-1.2.4/debian/libkrb5-dev.lintian
@@ -0,0 +1 @@
+libkrb5-dev: link-to-undocumented-manpage
--- krb5-1.2.4.orig/debian/libkrb5-dev.undocumented
+++ krb5-1.2.4/debian/libkrb5-dev.undocumented
@@ -0,0 +1 @@
+krb5-config.1
--- krb5-1.2.4.orig/debian/libkrb53.dirs
+++ krb5-1.2.4/debian/libkrb53.dirs
@@ -0,0 +1 @@
+usr/share/krb5
--- krb5-1.2.4.orig/debian/libkrb53.docs
+++ krb5-1.2.4/debian/libkrb53.docs
@@ -0,0 +1 @@
+README
--- krb5-1.2.4.orig/debian/libkrb53.files
+++ krb5-1.2.4/debian/libkrb53.files
@@ -0,0 +1 @@
+usr/lib/lib*so.*
--- krb5-1.2.4.orig/debian/libkrb53.lintian
+++ krb5-1.2.4/debian/libkrb53.lintian
@@ -0,0 +1 @@
+libkrb53: shared-lib-without-dependency-information
--- krb5-1.2.4.orig/debian/libkrb53.postinst
+++ krb5-1.2.4/debian/libkrb53.postinst
@@ -0,0 +1,14 @@
+#! /bin/sh
+
+set -e 
+export KRB5LD_DEFAULT_REALM
+if [ "configure" = "$1" ] ; then
+    ldconfig
+
+fi
+
+#DEBHELPER#
+
+
+
+
--- krb5-1.2.4.orig/debian/libkrb53.postrm
+++ krb5-1.2.4/debian/libkrb53.postrm
@@ -0,0 +1,7 @@
+#!/bin/sh -e
+
+if [ "purge" = "$1" ] ; then
+    rm /etc/krb5.conf 2>/dev/null ||true
+fi
+
+#DEBHELPER#
--- krb5-1.2.4.orig/debian/libkrb53.shlibs
+++ krb5-1.2.4/debian/libkrb53.shlibs
@@ -0,0 +1,9 @@
+libdes425 3 libkrb53 (>= 1.2.3-2)
+libdyn 1 libkrb53
+libgssapi_krb5 2 libkrb53
+libgssrpc 3 libkrb53
+libk5crypto 3 libkrb53
+libkdb5 3 libkrb53
+libkrb4 2 libkrb53 (>= 1.2.3-2)
+libkrb5 3 libkrb53
+libpty 1 libkrb53
--- krb5-1.2.4.orig/debian/patch.asn1_get
+++ krb5-1.2.4/debian/patch.asn1_get
@@ -0,0 +1,16 @@
+Index: src/lib/krb5/asn.1//asn1_get.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb5/asn.1/asn1_get.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 asn1_get.c
+--- src/lib/krb5/asn.1//asn1_get.c	2 Mar 2001 10:32:15 -0000	1.1.1.2
++++ src/lib/krb5/asn.1//asn1_get.c	12 Apr 2002 16:13:53 -0000
+@@ -143,6 +143,8 @@
+       if(retval) return retval;
+       len = (len<<8) + (int)o;
+     }
++    if (len < 0)
++      return ASN1_OVERRUN;
+     if (indef != NULL && !len)
+       *indef = 1;
+     if(retlen != NULL) *retlen = len;
--- krb5-1.2.4.orig/debian/patch.etype_info_works
+++ krb5-1.2.4/debian/patch.etype_info_works
@@ -0,0 +1,31 @@
+Index: src/kdc/kdc_preauth.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/kdc/kdc_preauth.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 kdc_preauth.c
+--- kdc_preauth.c	2000/10/20 07:15:19	1.1.1.1
++++ kdc_preauth.c	2002/09/30 01:06:16
+@@ -533,7 +533,7 @@
+     while (1) {
+ 	retval = krb5_dbe_search_enctype(context, client, &start, -1,
+ 					 -1, 0, &client_key);
+-	if (retval == ENOENT)
++	if (retval == KRB5_KDB_NO_MATCHING_KEY)
+ 	    break;
+ 	if (retval)
+ 	    goto cleanup;
+Index: src/lib/kdb/kdb_xdr.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/kdb/kdb_xdr.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 kdb_xdr.c
+--- kdb_xdr.c	2002/01/10 11:04:42	1.1.1.2
++++ kdb_xdr.c	2002/09/30 01:06:16
+@@ -726,6 +726,7 @@
+     krb5_key_data	*datap;
+     krb5_error_code	ret;
+ 
++    ret = 0;
+     if (kvno == -1 && stype == -1 && ktype == -1)
+ 	kvno = 0;
+ 
--- krb5-1.2.4.orig/debian/patch.fwd_creds_understand_session_key
+++ krb5-1.2.4/debian/patch.fwd_creds_understand_session_key
@@ -0,0 +1,61 @@
+Index: src/lib/krb5/krb/ChangeLog
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb5/krb/ChangeLog,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 ChangeLog
+--- ChangeLog	2001/03/02 10:32:21	1.1.1.2
++++ ChangeLog	2001/11/25 03:45:33
+@@ -1,3 +1,10 @@
++2001-11-24  Sam Hartman  <hartmans@mit.edu>
++
++	* fwd_tgt.c (krb5_fwd_tgt_creds): Get a session key for the
++	forwarded tgt that is the same as the  session key for  the
++	auth_context.  This  is an enctype we know the remote side
++	supports.  
++
+ 2001-01-30  Tom Yu  <tlyu@mit.edu>
+ 
+ 	* preauth.c (krb5_obtain_padata): Don't dereference a NULL pointer
+Index: src/lib/krb5/krb/fwd_tgt.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb5/krb/fwd_tgt.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 fwd_tgt.c
+--- fwd_tgt.c	2000/10/20 07:15:19	1.1.1.1
++++ fwd_tgt.c	2001/11/25 03:37:18
+@@ -53,6 +53,8 @@
+     krb5_flags kdcoptions;
+     int close_cc = 0;
+     int free_rhost = 0;
++    krb5_enctype enctype = 0;
++    krb5_keyblock *session_key;
+ 
+     memset((char *)&creds, 0, sizeof(creds));
+     memset((char *)&tgt, 0, sizeof(creds));
+@@ -71,7 +73,15 @@
+ 	memcpy(rhost, server->data[1].data, server->data[1].length);
+ 	rhost[server->data[1].length] = '\0';
+     }
+-
++    retval = krb5_auth_con_getkey (context, auth_context, &session_key);
++    if (retval)
++      goto errout;
++    if (session_key) {
++      enctype = session_key->enctype;
++      krb5_free_keyblock (context, session_key);
++      session_key = NULL;
++    }
++    
+     retval = krb5_os_hostaddr(context, rhost, &addrs);
+     if (retval)
+ 	goto errout;
+@@ -111,7 +121,8 @@
+ 	retval = KRB5_NO_TKT_SUPPLIED;
+ 	goto errout;
+     }
+-
++    
++    creds.keyblock.enctype = enctype;
+     creds.times = tgt.times;
+     creds.times.starttime = 0;
+     kdcoptions = flags2options(tgt.ticket_flags)|KDC_OPT_FORWARDED;
--- krb5-1.2.4.orig/debian/patch.gssapi_accept_encrypted_creds
+++ krb5-1.2.4/debian/patch.gssapi_accept_encrypted_creds
@@ -0,0 +1,111 @@
+Index: src/lib/gssapi/krb5//accept_sec_context.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/gssapi/krb5/accept_sec_context.c,v
+retrieving revision 1.1.1.3
+diff -u -r1.1.1.3 accept_sec_context.c
+--- src/lib/gssapi/krb5//accept_sec_context.c	10 Jan 2002 11:04:48 -0000	1.1.1.3
++++ src/lib/gssapi/krb5//accept_sec_context.c	3 Mar 2002 22:26:05 -0000
+@@ -81,8 +81,9 @@
+ 
+ /* Decode, decrypt and store the forwarded creds in the local ccache. */
+ static krb5_error_code
+-rd_and_store_for_creds(context, inbuf, out_cred)
++rd_and_store_for_creds(context, auth_context, inbuf, out_cred)
+     krb5_context context;
++    krb5_auth_context auth_context;
+     krb5_data *inbuf;
+     krb5_gss_cred_id_t *out_cred;
+ {
+@@ -91,15 +92,39 @@
+     krb5_ccache ccache = NULL;
+     krb5_gss_cred_id_t cred = NULL;
+     extern krb5_cc_ops krb5_mcc_ops;
+-    krb5_auth_context auth_context = NULL;
++    krb5_auth_context new_auth_ctx = NULL;
++	krb5_int32 flags_org;
+ 
+-    if ((retval = krb5_auth_con_init(context, &auth_context)))
+-	return(retval);
+-
+-    krb5_auth_con_setflags(context, auth_context, 0);
+-
+-    if ((retval = krb5_rd_cred(context, auth_context, inbuf, &creds, NULL))) 
+-	goto cleanup;
++	if (retval = krb5_auth_con_getflags(context, auth_context, &flags_org))
++		return retval;
++	krb5_auth_con_setflags(context, auth_context, 0);
++
++	/* By the time krb5_rd_cred is called here (after krb5_rd_req has been */
++	/* called in krb5_gss_accept_sec_context), the "keyblock" field of */
++	/* auth_context contains a pointer to the session key, and the */
++	/* "remote_subkey" field might contain a session subkey.  Either of */
++	/* these (the "remote_subkey" if it isn't NULL, otherwise the */
++	/* "keyblock") might have been used to encrypt the encrypted part of */
++	/* the KRB_CRED message that contains the forwarded credentials.  (The */
++	/* Java Crypto and Security Implementation from the DSTC in Australia */
++	/* always uses the session key.  But apparently it never negotiates a */
++	/* subkey, so this code works fine against a JCSI client.)  Up to the */
++	/* present, though, GSSAPI clients linked against the MIT code (which */
++	/* is almost all GSSAPI clients) don't encrypt the KRB_CRED message at */
++	/* all -- at this level.  So if the first call to krb5_rd_cred fails, */
++	/* we should call it a second time with another auth context freshly */
++	/* created by krb5_auth_con_init.  All of its keyblock fields will be */
++	/* NULL, so krb5_rd_cred will assume that the KRB_CRED message is */
++	/* unencrypted.  (The MIT code doesn't actually send the KRB_CRED */
++	/* message in the clear -- the "authenticator" whose "checksum" ends up */
++	/* containing the KRB_CRED message does get encrypted.) */
++	if (krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)) {
++		if (retval = krb5_auth_con_init(context, &new_auth_ctx))
++			goto cleanup;
++		krb5_auth_con_setflags(context, new_auth_ctx, 0);
++		if (retval = krb5_rd_cred(context, new_auth_ctx, inbuf, &creds, NULL))
++			goto cleanup;
++		}
+ 
+     /* Lots of kludging going on here... Some day the ccache interface
+        will be rewritten though */
+@@ -162,8 +187,10 @@
+     if (out_cred)
+ 	*out_cred = cred; /* return credential */
+ 
+-    if (auth_context)
+-	krb5_auth_con_free(context, auth_context);
++	if (new_auth_ctx)
++		krb5_auth_con_free(context, new_auth_ctx);
++
++	krb5_auth_con_setflags(context, auth_context, flags_org);
+ 
+     return retval;
+ }
+@@ -426,12 +453,16 @@
+ 	   goto fail;
+        }
+ 
+-       TREAD_STR(ptr, ptr2, reqcksum.length);
+-       if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) {
+-	   code = 0;
+-	   major_status = GSS_S_BAD_BINDINGS;
+-	   goto fail;
+-       }
++		TREAD_STR(ptr, ptr2, reqcksum.length);
++		/* If server has chosen not to use channel bindings, ignore */
++		/* any channel bindings sent by the client. */
++		if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS) {
++			if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) {
++				code = 0;
++				major_status = GSS_S_BAD_BINDINGS;
++				goto fail;
++				}
++			}
+ 
+        xfree(reqcksum.contents);
+        reqcksum.contents = 0;
+@@ -476,7 +507,7 @@
+ 
+ 		   /* store the delegated credential */
+ 
+-		   if (code = rd_and_store_for_creds(context, &option,
++		   if (code = rd_and_store_for_creds(context, auth_context, &option,
+ 						     (delegated_cred_handle) ?
+ 						     &deleg_cred : NULL)) {
+ 		       major_status = GSS_S_FAILURE;
--- krb5-1.2.4.orig/debian/patch.kadmin.acl
+++ krb5-1.2.4/debian/patch.kadmin.acl
@@ -0,0 +1,70 @@
+Index: src/lib/kadm5/srv//server_acl.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/kadm5/srv/server_acl.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 server_acl.c
+--- src/lib/kadm5/srv//server_acl.c	20 Oct 2000 07:15:19 -0000	1.1.1.1
++++ src/lib/kadm5/srv//server_acl.c	3 Mar 2002 02:20:16 -0000
+@@ -640,39 +640,37 @@
+ 	    continue;
+ 
+ 	/* We've matched the principal.  If we have a target, then try it */
+-	if (entry->ae_target) {
+-	    if (!strcmp(entry->ae_target, "*"))
+-		break;
++	if (entry->ae_target && strcmp(entry->ae_target, "*")) {
+ 	    if (!entry->ae_target_princ && !entry->ae_target_bad) {
+ 		kret = krb5_parse_name(kcontext, entry->ae_target,
+ 				       &entry->ae_target_princ);
+ 		if (kret)
+ 		    entry->ae_target_bad = 1;
+ 	    }
+-	}
+-	if (entry->ae_target_bad) {
+-	    DPRINT(DEBUG_ACL, acl_debug_level,
+-		   ("Bad target in ACL entry for %s\n", entry->ae_name));
+-	    entry->ae_name_bad = 1;
+-	    continue;
+-	}
+-	if (entry->ae_target && !dest_princ)
+-	    matchgood = 0;
+-	else if (entry->ae_target && entry->ae_target_princ && dest_princ) {
+-	    if (acl_match_data(&entry->ae_target_princ->realm,
+-			       &dest_princ->realm, 1, (wildstate_t *)0) &&
+-		(entry->ae_target_princ->length == dest_princ->length)) {
+-		for (i=0; i<dest_princ->length; i++) {
+-		    if (!acl_match_data(&entry->ae_target_princ->data[i],
+-					&dest_princ->data[i], 1, &state)) {
+-			matchgood = 0;
+-			break;
++	    if (entry->ae_target_bad) {
++	        DPRINT(DEBUG_ACL, acl_debug_level,
++		       ("Bad target in ACL entry for %s\n", entry->ae_name));
++	        entry->ae_name_bad = 1;
++	        continue;
++	    }
++	    if (!dest_princ)
++	        matchgood = 0;
++	    else if (entry->ae_target_princ && dest_princ) {
++	        if (acl_match_data(&entry->ae_target_princ->realm,
++			           &dest_princ->realm, 1, (wildstate_t *)0) &&
++		    (entry->ae_target_princ->length == dest_princ->length)) {
++		    for (i=0; i<dest_princ->length; i++) {
++		        if (!acl_match_data(&entry->ae_target_princ->data[i],
++			  		    &dest_princ->data[i], 1, &state)) {
++			    matchgood = 0;
++			    break;
++		        }
+ 		    }
+-		}
++	        }
++	        else
++		    matchgood = 0;
+ 	    }
+-	    else
+-		matchgood = 0;
+-	}
++        }
+ 	if (!matchgood)
+ 	    continue;
+ 
--- krb5-1.2.4.orig/debian/patch.kadmind4_root_exploit
+++ krb5-1.2.4/debian/patch.kadmind4_root_exploit
@@ -0,0 +1,31 @@
+Index: src/kadmin/v4server//kadm_ser_wrap.c
+===================================================================
+RCS file: /afs/sipb.mit.edu/project/debian/cvs/krb5/src/kadmin/v4server/kadm_ser_wrap.c,v
+retrieving revision 1.1.1.1.2.2
+diff -u -r1.1.1.1.2.2 kadm_ser_wrap.c
+--- kadm_ser_wrap.c	2002/10/22 22:06:22	1.1.1.1.2.2
++++ kadm_ser_wrap.c	2002/10/22 22:10:27
+@@ -170,14 +170,21 @@
+     u_char *retdat, *tmpdat;
+     int retval, retlen;
+ 
+-    if (strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) {
++    if ((*dat_len < KADM_VERSIZE + sizeof(krb5_ui_4))
++	|| strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) {
+ 	errpkt(dat, dat_len, KADM_BAD_VER);
+ 	return KADM_BAD_VER;
+     }
+     in_len = KADM_VERSIZE;
+     /* get the length */
+-    if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0)
++    if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0
++	|| (r_len > *dat_len - KADM_VERSIZE - sizeof(krb5_ui_4))
++	|| (*dat_len - r_len - KADM_VERSIZE -
++	    sizeof(krb5_ui_4) > sizeof(authent.dat))) {
++	errpkt(dat, dat_len, KADM_LENGTH_ERROR);
+ 	return KADM_LENGTH_ERROR;
++    }
++
+     in_len += retc;
+     authent.length = *dat_len - r_len - KADM_VERSIZE - sizeof(krb5_ui_4);
+     memcpy((char *)authent.dat, (char *)(*dat) + in_len, authent.length);
--- krb5-1.2.4.orig/debian/patch.kdc_error_messages
+++ krb5-1.2.4/debian/patch.kdc_error_messages
@@ -0,0 +1,119 @@
+Index: src/kdc/do_as_req.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/kdc/do_as_req.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 do_as_req.c
+--- src/kdc/do_as_req.c	10 Jan 2002 11:03:58 -0000	1.1.1.2
++++ src/kdc/do_as_req.c	28 Feb 2002 03:03:41 -0000
+@@ -48,7 +48,7 @@
+ static krb5_error_code prepare_error_as PROTOTYPE((krb5_kdc_req *,
+ 						   int,
+ 						   krb5_data *, 
+-						   krb5_data **));
++						   krb5_data **, const char *));
+ 
+ /*ARGSUSED*/
+ krb5_error_code
+@@ -441,11 +441,14 @@
+ 	       errcode ? ", " : "",
+ 	       errcode ? error_message(errcode) : "");
+     if (errcode) {
++	if (status == 0)
++	    status = error_message (errcode);
+ 	errcode -= ERROR_TABLE_BASE_krb5;
+ 	if (errcode < 0 || errcode > 128)
+ 	    errcode = KRB_ERR_GENERIC;
+ 	    
+-	errcode = prepare_error_as(request, errcode, &e_data, response);
++	errcode = prepare_error_as(request, errcode, &e_data, response,
++				   status);
+     }
+ 
+     krb5_free_keyblock_contents(kdc_context, &encrypting_key);
+@@ -488,11 +491,12 @@
+ }
+ 
+ static krb5_error_code
+-prepare_error_as (request, error, e_data, response)
++prepare_error_as (request, error, e_data, response, status)
+ register krb5_kdc_req *request;
+ int error;
+ krb5_data *e_data;
+ krb5_data **response;
++const char *status;
+ {
+     krb5_error errpkt;
+     krb5_error_code retval;
+@@ -507,10 +511,10 @@
+     errpkt.error = error;
+     errpkt.server = request->server;
+     errpkt.client = request->client;
+-    errpkt.text.length = strlen(error_message(error+KRB5KDC_ERR_NONE))+1;
++    errpkt.text.length = strlen(status)+1;
+     if (!(errpkt.text.data = malloc(errpkt.text.length)))
+ 	return ENOMEM;
+-    (void) strcpy(errpkt.text.data, error_message(error+KRB5KDC_ERR_NONE));
++    (void) strcpy(errpkt.text.data, status);
+ 
+     if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
+ 	free(errpkt.text.data);
+Index: src/kdc/do_tgs_req.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/kdc/do_tgs_req.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 do_tgs_req.c
+--- src/kdc/do_tgs_req.c	10 Jan 2002 11:03:58 -0000	1.1.1.2
++++ src/kdc/do_tgs_req.c	28 Feb 2002 03:03:43 -0000
+@@ -54,7 +54,7 @@
+ 						    krb5_ticket *,
+ 						    int,
+ 						    const char *,
+-						    krb5_data **));
++						    krb5_data **, const char *));
+ 
+ /*ARGSUSED*/
+ krb5_error_code
+@@ -666,12 +666,14 @@
+     }
+     
+     if (errcode) {
++	if (status == 0)
++	    status = error_message (errcode);
+ 	errcode -= ERROR_TABLE_BASE_krb5;
+ 	if (errcode < 0 || errcode > 128)
+ 	    errcode = KRB_ERR_GENERIC;
+ 	    
+ 	retval = prepare_error_tgs(request, header_ticket, errcode,
+-				   fromstring, response);
++				   fromstring, response, status);
+     }
+     
+     if (header_ticket)
+@@ -693,12 +695,13 @@
+ }
+ 
+ static krb5_error_code
+-prepare_error_tgs (request, ticket, error, ident, response)
++prepare_error_tgs (request, ticket, error, ident, response, status)
+ register krb5_kdc_req *request;
+ krb5_ticket *ticket;
+ int error;
+ const char *ident;
+ krb5_data **response;
++const char *status;
+ {
+     krb5_error errpkt;
+     krb5_error_code retval;
+@@ -716,10 +719,10 @@
+ 	errpkt.client = ticket->enc_part2->client;
+     else
+ 	errpkt.client = 0;
+-    errpkt.text.length = strlen(error_message(error+KRB5KDC_ERR_NONE))+1;
++    errpkt.text.length = strlen(status) + 1;
+     if (!(errpkt.text.data = malloc(errpkt.text.length)))
+ 	return ENOMEM;
+-    (void) strcpy(errpkt.text.data, error_message(error+KRB5KDC_ERR_NONE));
++    (void) strcpy(errpkt.text.data, status);
+ 
+     if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
+ 	free(errpkt.text.data);
--- krb5-1.2.4.orig/debian/patch.kprop_service_name
+++ krb5-1.2.4/debian/patch.kprop_service_name
@@ -0,0 +1,78 @@
+Index: src/slave//ChangeLog
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/slave/ChangeLog,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 ChangeLog
+--- ChangeLog	2000/10/20 07:15:19	1.1.1.1
++++ ChangeLog	2001/11/25 02:00:29
+@@ -1,3 +1,10 @@
++2001-11-24  Sam Hartman  <hartmans@mit.edu>
++
++	* kpropd.c (do_standalone): Default to KPROP port
++
++	* kprop.c (open_connection): Default to 754 rather than an error,
++	Debian bug #120010 
++
+ 2000-05-08  Nalin Dahyabhai  <nalin@redhat.com>
+ 
+ 	* kprop.c (open_connection): New argument indicates output buffer
+Index: src/slave//kprop.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/slave/kprop.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 kprop.c
+--- kprop.c	2000/10/20 07:15:19	1.1.1.1
++++ kprop.c	2001/11/25 01:54:09
+@@ -332,13 +332,11 @@
+ 	if(!port) {
+ 		sp = getservbyname(KPROP_SERVICE, "tcp");
+ 		if (sp == 0) {
+-			(void) strncpy(Errmsg, KPROP_SERVICE, ErrmsgSz - 1);
+-			Errmsg[ErrmsgSz - 1] = '\0';
+-			(void) strncat(Errmsg, "/tcp: unknown service", ErrmsgSz - 1 - strlen(Errmsg));
+-			*fd = -1;
+-			return(0);
++			sin.sin_port = htons(KPROP_PORT);
++		
++		} else {
++		  sin.sin_port = sp->s_port;
+ 		}
+-		sin.sin_port = sp->s_port;
+ 	} else
+ 		sin.sin_port = port;
+ 	s = socket(AF_INET, SOCK_STREAM, 0);
+Index: src/slave//kprop.h
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/slave/kprop.h,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 kprop.h
+--- kprop.h	2000/10/20 07:15:19	1.1.1.1
++++ kprop.h	2001/11/25 01:54:09
+@@ -29,6 +29,8 @@
+ #define KPROP_SERVICE_NAME "host"
+ #define TGT_SERVICE_NAME "krbtgt"
+ #define KPROP_SERVICE "krb5_prop"
++#define KPROP_PORT 754
++
+ #define KPROP_CKSUMTYPE CKSUMTYPE_RSA_MD4_DES
+ 
+ #define KPROP_PROT_VERSION "kprop5_01"
+Index: src/slave//kpropd.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/slave/kpropd.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 kpropd.c
+--- kpropd.c	2000/10/20 07:15:19	1.1.1.1
++++ kpropd.c	2001/11/25 02:00:29
+@@ -182,9 +182,9 @@
+ 		sp = getservbyname(KPROP_SERVICE, "tcp");
+ 		if (sp == NULL) {
+ 			com_err(progname, 0, "%s/tcp: unknown service", KPROP_SERVICE);
+-			exit(1);
++			sin.sin_port = htons(KPROP_PORT);
+ 		}
+-		sin.sin_port = sp->s_port;
++		else sin.sin_port = sp->s_port;
+ 	} else {
+ 		sin.sin_port = port;
+ 	}
--- krb5-1.2.4.orig/debian/patch.krb5_rd_cred_no_ip_check
+++ krb5-1.2.4/debian/patch.krb5_rd_cred_no_ip_check
@@ -0,0 +1,137 @@
+Index: src/lib/krb5/krb/rd_cred.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb5/krb/rd_cred.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 rd_cred.c
+--- src/lib/krb5/krb/rd_cred.c	10 Jan 2002 11:05:24 -0000	1.1.1.2
++++ src/lib/krb5/krb/rd_cred.c	27 Feb 2002 21:25:58 -0000
+@@ -55,24 +55,22 @@
+ /*----------------------- krb5_rd_cred_basic -----------------------*/
+ 
+ static krb5_error_code 
+-krb5_rd_cred_basic(context, pcreddata, pkeyblock, local_addr, remote_addr,
++krb5_rd_cred_basic(context, pcreddata, pkeyblock, 
+ 		   replaydata, pppcreds)
+     krb5_context          context;
+     krb5_data		* pcreddata;
+     krb5_keyblock 	* pkeyblock;
+-    krb5_address  	* local_addr;
+-    krb5_address  	* remote_addr;
+     krb5_replay_data    * replaydata;
+     krb5_creds        *** pppcreds;
+ {
+-    krb5_error_code       retval;
+-    krb5_cred 		* pcred;
++  krb5_error_code       retval;
++  krb5_cred 		* pcred;
+     krb5_int32 		  ncreds;
+     krb5_int32 		  i = 0;
+     krb5_cred_enc_part 	  encpart;
+ 
+     /* decode cred message */
+-    if ((retval = decode_krb5_cred(pcreddata, &pcred)))
++        if ((retval = decode_krb5_cred(pcreddata, &pcred)))
+     	return retval;
+ 
+     memset(&encpart, 0, sizeof(encpart));
+@@ -80,38 +78,6 @@
+     if ((retval = decrypt_credencdata(context, pcred, pkeyblock, &encpart)))
+ 	goto cleanup_cred;
+ 
+-    /*
+-     * Only check the remote address if the KRB_CRED message was
+-     * protected by encryption.  If it came in the checksum field of
+-     * an init_sec_context message, skip over this check.
+-     */
+-    if (remote_addr && encpart.s_address && pkeyblock != NULL) {
+-	if (!krb5_address_compare(context, remote_addr, encpart.s_address)) {
+-	    retval = KRB5KRB_AP_ERR_BADADDR;
+-	    goto cleanup_cred;
+-	}
+-    }
+-
+-    if (encpart.r_address) {
+-        if (local_addr) {
+-            if (!krb5_address_compare(context, local_addr, encpart.r_address)) {
+-                retval = KRB5KRB_AP_ERR_BADADDR;
+-                goto cleanup_cred;
+-            }
+-        } else {
+-            krb5_address **our_addrs;
+-
+-            if ((retval = krb5_os_localaddr(context, &our_addrs))) {
+-                goto cleanup_cred;
+-            }
+-            if (!krb5_address_search(context, encpart.r_address, our_addrs)) {
+-                krb5_free_addresses(context, our_addrs);
+-                retval =  KRB5KRB_AP_ERR_BADADDR;
+-                goto cleanup_cred;
+-            }
+-            krb5_free_addresses(context, our_addrs);
+-        }
+-    }
+ 
+     replaydata->timestamp = encpart.timestamp;
+     replaydata->usec = encpart.usec;
+@@ -232,54 +198,12 @@
+       (auth_context->rcache == NULL))
+         return KRB5_RC_REQUIRED;
+ 
+-{
+-    krb5_address * premote_fulladdr = NULL;
+-    krb5_address * plocal_fulladdr = NULL;
+-    krb5_address remote_fulladdr;
+-    krb5_address local_fulladdr;
+-    CLEANUP_INIT(2);
+-
+-    if (auth_context->local_addr) {
+-    	if (auth_context->local_port) {
+-            if (!(retval = krb5_make_fulladdr(context,auth_context->local_addr,
+-                                 	      auth_context->local_port, 
+-					      &local_fulladdr))){
+-                CLEANUP_PUSH(local_fulladdr.contents, free);
+-	        plocal_fulladdr = &local_fulladdr;
+-            } else {
+-	        return retval;
+-            }
+-	} else {
+-            plocal_fulladdr = auth_context->local_addr;
+-        }
+-    }
+-
+-    if (auth_context->remote_addr) {
+-    	if (auth_context->remote_port) {
+-            if (!(retval = krb5_make_fulladdr(context,auth_context->remote_addr,
+-                                 	      auth_context->remote_port, 
+-					      &remote_fulladdr))){
+-                CLEANUP_PUSH(remote_fulladdr.contents, free);
+-	        premote_fulladdr = &remote_fulladdr;
+-            } else {
+-	        return retval;
+-            }
+-	} else {
+-            premote_fulladdr = auth_context->remote_addr;
+-        }
+-    }
+ 
+     if ((retval = krb5_rd_cred_basic(context, pcreddata, keyblock,
+-				     plocal_fulladdr, premote_fulladdr,
+ 				     &replaydata, pppcreds))) {
+-        CLEANUP_DONE();
+-	return retval;
++      return retval;
+     }
+ 
+-    CLEANUP_DONE();
+-}
+-
+-
+     if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) {
+         krb5_donot_replay replay;
+         krb5_timestamp currenttime;
+@@ -326,5 +250,4 @@
+     	krb5_xfree(*pppcreds);
+     return retval;
+ }
+-
+ 
--- krb5-1.2.4.orig/debian/patch.ktutil-umask
+++ krb5-1.2.4/debian/patch.ktutil-umask
@@ -0,0 +1,17 @@
+Index: src/kadmin/ktutil//ktutil_funcs.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/kadmin/ktutil/ktutil_funcs.c,v
+retrieving revision 1.1.1.2
+diff -u -r1.1.1.2 ktutil_funcs.c
+--- src/kadmin/ktutil//ktutil_funcs.c	1 Mar 2002 05:01:14 -0000	1.1.1.2
++++ src/kadmin/ktutil//ktutil_funcs.c	3 Mar 2002 00:59:15 -0000
+@@ -515,6 +515,9 @@
+ 		lp1->entry = lp->entry;
+ 	}
+     }
++    umask(0077); /*Changing umask for all of ktutil is OK
++		  * We don't ever write out anything that should use
++		  * default umask.*/
+     fp = fopen(name, "w");
+     if (!fp) {
+ 	retval = EIO;
--- krb5-1.2.4.orig/debian/patch.telnet.help
+++ krb5-1.2.4/debian/patch.telnet.help
@@ -0,0 +1,69 @@
+Index: src/appl/telnet//telnet/ChangeLog
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/appl/telnet/telnet/ChangeLog,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 ChangeLog
+--- ChangeLog	2000/10/20 07:15:19	1.1.1.1
++++ ChangeLog	2001/11/25 02:53:47
+@@ -1,3 +1,9 @@
++2001-11-24  Sam Hartman  <hartmans@mit.edu>
++
++	* commands.c main.c:  telnet help should telnet to a host called
++	help not print an incorrect usage message; patch from  Graeme
++	Mathieson <graeme@mathie.cx> 
++
+ 2000-05-11  Nalin Dahyabhai  <nalin@redhat.com>
+ 
+ 	* commands.c (makeargv): Don't overflow buffer "saveline".
+Index: src/appl/telnet//telnet/commands.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/appl/telnet/telnet/commands.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 commands.c
+--- commands.c	2000/10/20 07:15:19	1.1.1.1
++++ commands.c	2001/11/25 02:51:39
+@@ -2397,8 +2397,6 @@
+     cmd = *argv;
+     --argc; ++argv;
+     while (argc) {
+-	if (isprefix(*argv, "help") || isprefix(*argv, "?"))
+-	    goto usage;
+ 	if (strcmp(*argv, "-l") == 0) {
+ 	    --argc; ++argv;
+ 	    if (argc == 0)
+@@ -2423,8 +2421,7 @@
+ 	    continue;
+ 	}
+     usage:
+-	printf("usage: %s [-l user] [-a] host-name [port]\r\n", cmd);
+-	return 0;
++	return 2;
+     }
+     if (hostp == 0)
+ 	goto usage;
+Index: src/appl/telnet//telnet/main.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/appl/telnet/telnet/main.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 main.c
+--- main.c	2000/10/20 07:15:19	1.1.1.1
++++ main.c	2001/11/25 02:51:39
+@@ -324,10 +324,14 @@
+ 
+ 		if (setjmp(toplevel) != 0)
+ 			Exit(0);
+-		if (tn(argp - args, args) == 1)
+-			return (0);
+-		else
+-			return (1);
++		{
++			int ret = tn(argp - args, args);
++			switch (ret) {
++				case 1: return 0;
++				case 2: usage();
++				default: return 1;
++			}
++		}
+ 	}
+ 	(void)setjmp(toplevel);
+ 	for (;;) {
--- krb5-1.2.4.orig/debian/patch.walk_realm_tree
+++ krb5-1.2.4/debian/patch.walk_realm_tree
@@ -0,0 +1,46 @@
+Index: src/lib/krb5/krb/walk_rtree.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/krb5/krb/walk_rtree.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 walk_rtree.c
+--- src/lib/krb5/krb/walk_rtree.c	20 Oct 2000 07:15:19 -0000	1.1.1.1
++++ src/lib/krb5/krb/walk_rtree.c	10 Apr 2002 18:18:20 -0000
+@@ -93,6 +93,27 @@
+ #define max(x,y) ((x) > (y) ? (x) : (y))
+ #endif
+ 
++/*
++ * xxx The following function is very confusing to read and probably
++ * is buggy.  It should be documented better.  Here is what I've
++ * learned about it doing a quick bug fixing walk through.  The
++ * function takes a client and server realm name and returns the set
++ * of realms (in a field called tree) that you need to get tickets in
++ * in order to get from the source realm to the destination realm.  It
++ * takes a realm separater character (normally ., but presumably there
++ * for all those X.500 realms) .  There are two modes it runs in: the
++ * ANL krb5.confmode and the hierarchy mode.  The ANL mode is
++ * fairly obvious.  The hierarchy mode looks for common components in
++ * both the client and server realms.  In general, the pointer scp and
++ * ccp are used to walk through the client and server realms.  The
++ * com_sdot and com_cdot pointers point to (I think) the beginning of
++ * the common part of the realm names.  I.E. strcmp(com_cdot,
++ * com_sdot) ==0 is roughly an invarient.  However, there are cases
++ * where com_sdot and com_cdot are set to point before the start of
++ * the client or server strings.  I think this only happens when there
++ * are no common components.  --hartmans 2002/03/14
++ */
++
+ krb5_error_code
+ krb5_walk_realm_tree(context, client, server, tree, realm_branch_char)
+     krb5_context context;
+@@ -115,6 +136,10 @@
+ 	char *cap_client, *cap_server;
+ 	char **cap_nodes;
+         krb5_error_code cap_code;
++#endif
++	if (!(client->data &&server->data))
++	  return KRB5_NO_TKT_IN_RLM;
++#ifdef CONFIGURABLE_AUTHENTICATION_PATH
+ 	if ((cap_client = (char *)malloc(client->length + 1)) == NULL)
+ 		return ENOMEM;
+ 	strncpy(cap_client, client->data, client->length);
--- krb5-1.2.4.orig/debian/patch.xdr_array
+++ krb5-1.2.4/debian/patch.xdr_array
@@ -0,0 +1,17 @@
+Index: src/lib/rpc//xdr_array.c
+===================================================================
+RCS file: /afs/sipb/project/debian/cvs/krb5/src/lib/rpc/xdr_array.c,v
+retrieving revision 1.1.1.1
+diff -u -r1.1.1.1 xdr_array.c
+--- xdr_array.c	2000/10/20 07:15:19	1.1.1.1
++++ xdr_array.c	2002/08/02 17:36:46
+@@ -75,7 +75,8 @@
+ 		return (FALSE);
+ 	}
+ 	c = *sizep;
+-	if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) {
++	if ((c > maxsize || c > LASTUNSIGNED / elsize)
++	    && (xdrs->x_op != XDR_FREE)) {
+ 		return (FALSE);
+ 	}
+ 	nodesize = c * elsize;
--- krb5-1.2.4.orig/debian/rules
+++ krb5-1.2.4/debian/rules
@@ -0,0 +1,139 @@
+#!/usr/bin/make -f
+# Sample debian/rules that uses debhelper. 
+# GNU copyright 1997 by Joey Hess.
+#
+# This version is for a hypothetical package that builds an
+# architecture-dependant package, as well as an architecture-independent
+# package.
+
+# Uncomment this to turn on verbose mode. 
+#export DH_VERBOSE=1
+
+# This is the debhelper compatability version to use.
+export DH_COMPAT=2
+
+# This has to be exported to make some magic below work.
+export DH_OPTIONS
+
+CCOPTS=-g -O2
+LINTIAN_PACKAGES = libkrb53 krb5-user krb5-kdc krb5-admin-server libkrb5-dev
+
+build: build-stamp
+configure-stamp:
+	dh_testdir
+	-mkdir build
+# We touch each configure file so that we do not attempt to use autoconf
+	find src -name configure -print |xargs touch
+	(cd build; ../src/configure --prefix=/usr --enable-shared \
+		--with-ccopts="$(CCOPTS) -D_REENTRANT" --localstatedir=/etc \
+		--mandir=/usr/share/man --without-tcl)
+	touch configure-stamp
+
+build-stamp: configure-stamp
+	(cd build; $(MAKE) all)
+	touch build-stamp
+
+clean:
+	dh_testdir
+	dh_testroot
+	# Add here commands to clean up after the build process.
+	-rm -r build
+	-rm build-stamp configure-stamp
+	dh_clean
+
+install: DH_OPTIONS=
+install: build
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	# Add here commands to install the package into debian/tmp.
+	(cd build; $(MAKE) install DESTDIR=`pwd`/../debian/tmp)
+
+	rm debian/tmp/usr/lib/libss*
+	mv debian/tmp/usr/bin/telnet debian/tmp/usr/bin/telnet.krb5
+	mv debian/tmp/usr/share/man/man1/telnet.1  \
+		debian/tmp/usr/share/man/man1/telnet.krb5.1
+	for foo in rlogin rsh ; do \
+	mv debian/tmp/usr/bin/$$foo debian/tmp/usr/bin/krb5-$$foo; \
+	mv debian/tmp/usr/share/man/man1/$$foo.1 \
+		debian/tmp/usr/share/man/man1/krb5-$$foo.1 ; \
+	done
+
+	dh_movefiles
+	docbook-to-man debian/krb5_newrealm.sgml \
+		>debian/krb5-admin-server/usr/share/man/man8/krb5_newrealm.8
+	install -o root -g root -m 755 debian/krb5_newrealm \
+		debian/krb5-admin-server/usr/sbin
+	cp debian/krb5.conf debian/libkrb53/usr/share/krb5/krb5.conf.template
+	cp debian/kdc.conf debian/krb5-kdc/usr/share/krb5/kdc.conf.template
+	for foo in $(LINTIAN_PACKAGES) ; do \
+		install -d debian/$$foo/usr/share/lintian/overrides; \
+		cp debian/$$foo.lintian debian/$$foo/usr/share/lintian/overrides/$$foo; \
+		done
+# Build architecture-independent files here.
+# Pass -i to all debhelper commands in this target to reduce clutter.
+binary-indep: DH_OPTIONS=-i
+binary-indep: build install
+	# Need this version of debhelper for DH_OPTIONS to work.
+	dh_testdir
+	dh_testroot
+#	dh_installdebconf
+	dh_installdocs
+	dh_installexamples
+	dh_installmenu
+#	dh_installemacsen
+#	dh_installpam
+#	dh_installinit
+	dh_installcron
+#	dh_installmanpages
+	dh_installinfo
+	dh_undocumented
+	dh_installchangelogs 
+	dh_link
+	dh_compress
+	dh_fixperms
+	# You may want to make some executables suid here.
+	dh_installdeb
+#	dh_perl
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+# Build architecture-dependent files here.
+# Pass -a to all debhelper commands in this target to reduce clutter.
+binary-arch: DH_OPTIONS=-a
+binary-arch: build install
+	dh_testdir
+	dh_testroot
+	dh_installdebconf
+	dh_installdocs
+	dh_installexamples
+	dh_installmenu
+#	dh_installemacsen
+#	dh_installpam
+	dh_installinit -- defaults 18 18
+	dh_installcron
+#	dh_installmanpages
+	dh_installinfo
+	dh_undocumented
+	dh_installchangelogs 
+	dh_strip
+	dh_link
+	dh_compress
+	dh_fixperms
+	# You may want to make some executables suid here.
+	chmod u+s debian/krb5-user/usr/bin/ksu
+	chmod 700 debian/krb5-kdc/var/lib/krb5kdc
+	chmod 700 debian/krb5-kdc/etc/krb5kdc
+	dh_makeshlibs
+	dh_installdeb
+#	dh_perl
+	dh_shlibdeps -l`pwd`/debian/libkrb53/usr/lib
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install
