external/bsd/bind/dist/lib/dns/spnego.c
author martin <martin@NetBSD.org>
Sun, 13 Mar 2016 08:00:24 +0000
branchnetbsd-7-0
changeset 275887 e6987d6aadcd
parent 225017 8c6d5e59d121
child 275950 be734cd1f4d8
permissions -rw-r--r--
Pull up following revision(s) (requested by snj in ticket #1140): distrib/sets/lists/base/ad.aarch64: patch distrib/sets/lists/base/ad.arm: patch distrib/sets/lists/base/ad.mips: patch distrib/sets/lists/base/ad.powerpc: patch distrib/sets/lists/base/md.amd64: patch distrib/sets/lists/base/md.sparc64: patch distrib/sets/lists/base/shl.mi: patch distrib/sets/lists/debug/ad.aarch64: patch distrib/sets/lists/debug/ad.arm: patch distrib/sets/lists/debug/ad.mips: patch distrib/sets/lists/debug/ad.powerpc: patch distrib/sets/lists/debug/md.amd64: patch distrib/sets/lists/debug/md.sparc64: patch distrib/sets/lists/debug/shl.mi: patch doc/3RDPARTY: patch external/bsd/bind/bind2netbsd: up to 1.3 external/bsd/bind/dist/CHANGES: up to 1.20 external/bsd/bind/dist/COPYRIGHT: up to 1.1.1.10 external/bsd/bind/dist/README: up to 1.8 external/bsd/bind/dist/bin/check/check-tool.c: up to 1.8 external/bsd/bind/dist/bin/check/named-checkconf.c: up to 1.12 external/bsd/bind/dist/bin/check/named-checkzone.c: up to 1.8 external/bsd/bind/dist/bin/confgen/keygen.c: up to 1.7 external/bsd/bind/dist/bin/confgen/util.c: up to 1.5 external/bsd/bind/dist/bin/dig/dig.1: up to 1.11 external/bsd/bind/dist/bin/dig/dig.c: up to 1.11 external/bsd/bind/dist/bin/dig/dig.docbook: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dig.html: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dighost.c: up to 1.17 external/bsd/bind/dist/bin/dig/include/dig/dig.h: up to 1.12 external/bsd/bind/dist/bin/dig/nslookup.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8: up to 1.8 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html: up to 1.1.1.10 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c: up to 1.17 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c: up to 1.9 external/bsd/bind/dist/bin/dnssec/dnssec-settime.c: up to 1.13 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c: up to 1.16 external/bsd/bind/dist/bin/named/bind9.xsl: up to 1.1.1.8 external/bsd/bind/dist/bin/named/bind9.xsl.h: up to 1.9 external/bsd/bind/dist/bin/named/client.c: up to 1.15 external/bsd/bind/dist/bin/named/config.c: up to 1.12 external/bsd/bind/dist/bin/named/control.c: up to 1.10 external/bsd/bind/dist/bin/named/controlconf.c: up to 1.11 external/bsd/bind/dist/bin/named/include/named/lwdclient.h: up to 1.5 external/bsd/bind/dist/bin/named/include/named/main.h: up to 1.6 external/bsd/bind/dist/bin/named/include/named/server.h: up to 1.10 external/bsd/bind/dist/bin/named/interfacemgr.c: up to 1.11 external/bsd/bind/dist/bin/named/logconf.c: up to 1.8 external/bsd/bind/dist/bin/named/lwdclient.c: up to 1.5 external/bsd/bind/dist/bin/named/lwresd.c: up to 1.7 external/bsd/bind/dist/bin/named/main.c: up to 1.19 external/bsd/bind/dist/bin/named/named.8: up to 1.8 external/bsd/bind/dist/bin/named/named.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/named/named.html: up to 1.1.1.9 external/bsd/bind/dist/bin/named/query.c: up to 1.21 external/bsd/bind/dist/bin/named/server.c: up to 1.20 external/bsd/bind/dist/bin/named/statschannel.c: up to 1.11 external/bsd/bind/dist/bin/named/update.c: up to 1.12 external/bsd/bind/dist/bin/named/win32/named.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/ntservice.c: up to 1.7 external/bsd/bind/dist/bin/named/win32/os.c: up to 1.9 external/bsd/bind/dist/bin/named/xfrout.c: up to 1.10 external/bsd/bind/dist/bin/nsupdate/nsupdate.1: up to 1.7 external/bsd/bind/dist/bin/nsupdate/nsupdate.c: up to 1.14 external/bsd/bind/dist/bin/nsupdate/nsupdate.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/nsupdate/nsupdate.html: up to 1.1.1.10 external/bsd/bind/dist/bin/pkcs11/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8zc-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8ze-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0o-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0q-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1j-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1l-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.c: up to 1.1.1.5 external/bsd/bind/dist/bin/python/dnssec-coverage.py.in: up to 1.1.1.6 external/bsd/bind/dist/bin/rndc/rndc.8: up to 1.8 external/bsd/bind/dist/bin/rndc/rndc.c: up to 1.14 external/bsd/bind/dist/bin/rndc/rndc.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/rndc/rndc.html: up to 1.1.1.9 external/bsd/bind/dist/bin/rndc/util.c: up to 1.5 external/bsd/bind/dist/bin/tests/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/adb_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/backtrace_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byaddr_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byname_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/cfg_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/compress_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/db/t_db.c: up to 1.8 external/bsd/bind/dist/bin/tests/db_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/dst/dst_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/entropy2_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/entropy_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/fromhex.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/fsaccess_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/gxba_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/gxbn_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/hash_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/inter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/keyboard_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lex_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lfsr_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/log_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwres_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwresconf_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/makejournal.c: up to 1.4 external/bsd/bind/dist/bin/tests/master_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/name_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/names/t_names.c: up to 1.10 external/bsd/bind/dist/bin/tests/net/driver.c: up to 1.7 external/bsd/bind/dist/bin/tests/net/netaddr_multicast.c: up to 1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/find.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/genrsa.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/login.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/random.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/session.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sha1.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sign.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/verify.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-hmacmd5.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-md5sum.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/printmsg.c: delete external/bsd/bind/dist/bin/tests/printmsg.h: delete external/bsd/bind/dist/bin/tests/ratelimiter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rbt/t_rbt.c: up to 1.8 external/bsd/bind/dist/bin/tests/rbt_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rdata_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/serial_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/sig0_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sock_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sym_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/README: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/addzone/tests.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/builtin/Makefile.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/builtin/gethostname.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/builtin/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/checkconf/good-class.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-caa-rr.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-empty.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-unspec.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-gc-msdcs.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-nsap.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/cleanall.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/conf.sh.in: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ditch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dlzexternal/driver.c: up to 1.4 external/bsd/bind/dist/bin/tests/system/dnssec/clean.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/sign.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/prereq.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ednscompliance/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ans4/ans.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/fetchlimit.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named.args: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/root.hint: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/setup.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/filter-aaaa/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/inline/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/inline/ns3/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/masterfile/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.good: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/nameservers.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/prereq.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/nsupdate/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/reclimit/ans2/ans.pl: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/reclimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/reclimit/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/resolver/ns4/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/resolver/ns6/named.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/tests.sh: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/rndc/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test1.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test2.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard1: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2a: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2b: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard3: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rrsetorder/ns4/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rrsetorder/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/rsabigexponent/Makefile.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/rsabigexponent/bigkey.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/sit/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/start.pl: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/staticstub/clean.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/staticstub/ns2/named.conf.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/named.conf.in: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/sign.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/undelegated.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/staticstub/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/statistics/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/clean.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/zone.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/xmlstats.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/fetch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-json.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-xml.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/tkey/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/views/ns2/1.10.in-addr.arpa.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/views/ns2/named2.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/xfer/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/zonechecks/bigserial.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/zonechecks/ns1/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/zonechecks/setup.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/zonechecks/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/task_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/tasks/t_tasks.c: up to 1.8 external/bsd/bind/dist/bin/tests/timer_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/wire_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/zone_test.c: up to 1.9 external/bsd/bind/dist/bin/tools/arpaname.c: up to 1.5 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c: up to 1.8 external/bsd/bind/dist/bin/tools/named-journalprint.c: up to 1.7 external/bsd/bind/dist/bin/tools/named-rrchecker.c: up to 1.1.1.4 external/bsd/bind/dist/bin/win32/BINDInstall/BINDInstallDlg.cpp: up to 1.1.1.10 external/bsd/bind/dist/bin/win32/BINDInstall/VersionInfo.cpp: up to 1.1.1.2 external/bsd/bind/dist/config.h.in: up to 1.12 external/bsd/bind/dist/config.h.win32: up to 1.1.1.12 external/bsd/bind/dist/configure: up to 1.5 external/bsd/bind/dist/configure.in: up to 1.8 external/bsd/bind/dist/contrib/README: up to 1.1.1.3 external/bsd/bind/dist/contrib/scripts/dnssec-keyset.sh: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/Bv9ARM-book.xml: up to 1.1.1.19 external/bsd/bind/dist/doc/arm/Bv9ARM.ch01.html: up to 1.1.1.18 external/bsd/bind/dist/doc/arm/Bv9ARM.ch02.html: up to 1.1.1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html: up to 1.1.1.20 external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch05.html: up to 1.1.1.21 external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch10.html: up to 1.1.1.17 external/bsd/bind/dist/doc/arm/Bv9ARM.ch11.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch12.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch13.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.pdf: up to 1.14 external/bsd/bind/dist/doc/arm/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/doc/arm/html-fixup.pl: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/latex-fixup.pl: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/man.arpaname.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.ddns-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.delv.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dig.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-settime.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-verify.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.genrandom.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.host.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkconf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-journalprint.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-rrchecker.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsec3hash.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsupdate.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.conf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.html: up to 1.8 external/bsd/bind/dist/doc/arm/notes.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.pdf: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.xml: up to 1.1.1.6 external/bsd/bind/dist/doc/misc/rfc-compliance: up to 1.1.1.4 external/bsd/bind/dist/isc-config.sh.in: up to 1.1.1.6 external/bsd/bind/dist/lib/bind9/api: up to 1.1.1.17 external/bsd/bind/dist/lib/bind9/check.c: up to 1.13 external/bsd/bind/dist/lib/dns/adb.c: up to 1.12 external/bsd/bind/dist/lib/dns/api: up to 1.8 external/bsd/bind/dist/lib/dns/cache.c: up to 1.9 external/bsd/bind/dist/lib/dns/callbacks.c: up to 1.6 external/bsd/bind/dist/lib/dns/client.c: up to 1.11 external/bsd/bind/dist/lib/dns/diff.c: up to 1.10 external/bsd/bind/dist/lib/dns/dispatch.c: up to 1.11 external/bsd/bind/dist/lib/dns/dlz.c: up to 1.8 external/bsd/bind/dist/lib/dns/dnssec.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_api.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_openssl.h: up to 1.8 external/bsd/bind/dist/lib/dns/dst_parse.c: up to 1.9 external/bsd/bind/dist/lib/dns/geoip.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/gssapi_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/gssapictx.c: up to 1.9 external/bsd/bind/dist/lib/dns/hmac_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/adb.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/log.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/message.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/name.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/resolver.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/result.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/rrl.h: up to 1.4 external/bsd/bind/dist/lib/dns/include/dns/stats.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/types.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/update.h: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/include/dns/zone.h: up to 1.17 external/bsd/bind/dist/lib/dns/include/dst/dst.h: up to 1.11 external/bsd/bind/dist/lib/dns/journal.c: up to 1.10 external/bsd/bind/dist/lib/dns/keytable.c: up to 1.11 external/bsd/bind/dist/lib/dns/log.c: up to 1.9 external/bsd/bind/dist/lib/dns/master.c: up to 1.15 external/bsd/bind/dist/lib/dns/message.c: up to 1.18 external/bsd/bind/dist/lib/dns/name.c: up to 1.12 external/bsd/bind/dist/lib/dns/ncache.c: up to 1.11 external/bsd/bind/dist/lib/dns/nsec.c: up to 1.10 external/bsd/bind/dist/lib/dns/nsec3.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssl_link.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssldh_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/openssldsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslecdsa_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/opensslgost_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslrsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/order.c: up to 1.5 external/bsd/bind/dist/lib/dns/pkcs11dh_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11dsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11ecdsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11gost_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11rsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/private.c: up to 1.8 external/bsd/bind/dist/lib/dns/rbt.c: up to 1.11 external/bsd/bind/dist/lib/dns/rbtdb.c: up to 1.21 external/bsd/bind/dist/lib/dns/rcode.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata.c: up to 1.13 external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/ch_3/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/afsdb_18.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/caa_257.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/cdnskey_60.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cds_59.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/cname_5.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/dname_39.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/eui48_108.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/eui64_109.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/gpos_27.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hinfo_13.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hip_55.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/isdn_20.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/l32_105.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/l64_106.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/loc_29.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/lp_107.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/mb_7.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/md_3.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mf_4.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mg_8.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/minfo_14.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mr_9.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mx_15.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/naptr_35.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/rdata/generic/nid_104.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ns_2.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3param_51.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec_47.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/null_10.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nxt_30.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c: up to 1.1.1.3 external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/proforma.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ptr_12.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rp_17.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/rt_21.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/spf_99.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/tlsa_52.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/txt_16.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/unspec_103.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/uri_256.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/rdata/generic/x25_19.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/hs_4/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a6_38.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/aaaa_28.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/apl_42.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/kx_36.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap_22.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/px_26.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/srv_33.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c: up to 1.7 external/bsd/bind/dist/lib/dns/request.c: up to 1.10 external/bsd/bind/dist/lib/dns/resolver.c: up to 1.25 external/bsd/bind/dist/lib/dns/result.c: up to 1.7 external/bsd/bind/dist/lib/dns/rootns.c: up to 1.10 external/bsd/bind/dist/lib/dns/rpz.c: up to 1.10 external/bsd/bind/dist/lib/dns/rrl.c: up to 1.5 external/bsd/bind/dist/lib/dns/sdb.c: up to 1.10 external/bsd/bind/dist/lib/dns/sdlz.c: up to 1.10 external/bsd/bind/dist/lib/dns/spnego.c: up to 1.9 external/bsd/bind/dist/lib/dns/tcpmsg.c: up to 1.5 external/bsd/bind/dist/lib/dns/tests/geoip_test.c: up to 1.4 external/bsd/bind/dist/lib/dns/tests/gost_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/tests/master_test.c: up to 1.7 external/bsd/bind/dist/lib/dns/tests/rbt_serialize_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rbt_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rdatasetstats_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/tkey.c: up to 1.10 external/bsd/bind/dist/lib/dns/tsig.c: up to 1.9 external/bsd/bind/dist/lib/dns/update.c: up to 1.5 external/bsd/bind/dist/lib/dns/view.c: up to 1.11 external/bsd/bind/dist/lib/dns/win32/libdns.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/xfrin.c: up to 1.12 external/bsd/bind/dist/lib/dns/zone.c: up to 1.15 external/bsd/bind/dist/lib/irs/api: up to 1.1.1.9 external/bsd/bind/dist/lib/irs/getaddrinfo.c: up to 1.8 external/bsd/bind/dist/lib/isc/api: up to 1.1.1.19 external/bsd/bind/dist/lib/isc/app_api.c: up to 1.8 external/bsd/bind/dist/lib/isc/assertions.c: up to 1.7 external/bsd/bind/dist/lib/isc/backtrace.c: up to 1.8 external/bsd/bind/dist/lib/isc/commandline.c: up to 1.6 external/bsd/bind/dist/lib/isc/entropy.c: up to 1.6 external/bsd/bind/dist/lib/isc/error.c: up to 1.5 external/bsd/bind/dist/lib/isc/heap.c: up to 1.8 external/bsd/bind/dist/lib/isc/hmacmd5.c: up to 1.9 external/bsd/bind/dist/lib/isc/hmacsha.c: up to 1.10 external/bsd/bind/dist/lib/isc/httpd.c: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/app.h: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/json.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/isc/mem.h: up to 1.14 external/bsd/bind/dist/lib/isc/include/isc/platform.h.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/include/isc/print.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/safe.h: up to 1.4 external/bsd/bind/dist/lib/isc/include/isc/util.h: up to 1.11 external/bsd/bind/dist/lib/isc/lex.c: up to 1.7 external/bsd/bind/dist/lib/isc/lib.c: up to 1.8 external/bsd/bind/dist/lib/isc/mem.c: up to 1.13 external/bsd/bind/dist/lib/isc/netaddr.c: up to 1.7 external/bsd/bind/dist/lib/isc/nothreads/include/isc/mutex.h: up to 1.5 external/bsd/bind/dist/lib/isc/pk11.c: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/pool.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/print.c: up to 1.6 external/bsd/bind/dist/lib/isc/pthreads/mutex.c: up to 1.7 external/bsd/bind/dist/lib/isc/regex.c: up to 1.4 external/bsd/bind/dist/lib/isc/rwlock.c: up to 1.9 external/bsd/bind/dist/lib/isc/safe.c: up to 1.4 external/bsd/bind/dist/lib/isc/socket_api.c: up to 1.11 external/bsd/bind/dist/lib/isc/stats.c: up to 1.6 external/bsd/bind/dist/lib/isc/task.c: up to 1.12 external/bsd/bind/dist/lib/isc/tests/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/tests/hash_test.c: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/tests/mem_test.c: up to 1.1.1.2 external/bsd/bind/dist/lib/isc/tests/print_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/tests/regex_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/tests/safe_test.c: up to 1.4 external/bsd/bind/dist/lib/isc/tests/socket_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/timer.c: up to 1.11 external/bsd/bind/dist/lib/isc/unix/app.c: up to 1.14 external/bsd/bind/dist/lib/isc/unix/file.c: up to 1.10 external/bsd/bind/dist/lib/isc/unix/ifiter_ioctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/ifiter_sysctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/include/isc/offset.h: up to 1.5 external/bsd/bind/dist/lib/isc/unix/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/unix/socket.c: up to 1.18 external/bsd/bind/dist/lib/isc/win32/interfaceiter.c: up to 1.7 external/bsd/bind/dist/lib/isc/win32/libisc.def.exclude: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/win32/libisc.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/win32/win32os.c: up to 1.7 external/bsd/bind/dist/lib/isccc/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isccc/alist.c: up to 1.5 external/bsd/bind/dist/lib/isccc/api: up to 1.1.1.11 external/bsd/bind/dist/lib/isccc/cc.c: up to 1.10 external/bsd/bind/dist/lib/isccc/sexpr.c: up to 1.6 external/bsd/bind/dist/lib/isccfg/api: up to 1.1.1.17 external/bsd/bind/dist/lib/isccfg/include/isccfg/cfg.h: up to 1.7 external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h: up to 1.6 external/bsd/bind/dist/lib/isccfg/namedconf.c: up to 1.12 external/bsd/bind/dist/lib/isccfg/parser.c: up to 1.10 external/bsd/bind/dist/lib/isccfg/win32/libisccfg.def: up to 1.1.1.8 external/bsd/bind/dist/lib/lwres/api: up to 1.1.1.14 external/bsd/bind/dist/lib/lwres/herror.c: up to 1.7 external/bsd/bind/dist/lib/lwres/print.c: up to 1.7 external/bsd/bind/dist/lib/lwres/win32/socket.c: up to 1.5 external/bsd/bind/dist/lib/samples/nsprobe.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/resolve.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-async.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-gai.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-request.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/sample-update.c: up to 1.1.1.6 external/bsd/bind/dist/srcid: up to 1.14 external/bsd/bind/dist/version: up to 1.18 external/bsd/bind/dist/win32utils/Configure: up to 1.1.1.5 external/bsd/bind/dist/win32utils/index.html: up to 1.1.1.7 external/bsd/bind/dist/win32utils/legacy/BuildSetup.bat.in: up to 1.1.1.5 external/bsd/bind/include/config.h: up to 1.18 external/bsd/bind/include/dns/enumclass.h: up to 1.8 external/bsd/bind/include/dns/enumtype.h: up to 1.11 external/bsd/bind/include/dns/rdatastruct.h: up to 1.11 external/bsd/bind/include/isc/platform.h: up to 1.21 external/bsd/bind/include/lwres/platform.h: up to 1.7 external/bsd/bind/lib/libbind9/shlib_version: up to 1.16 external/bsd/bind/lib/libdns/shlib_version: up to 1.18 external/bsd/bind/lib/libirs/shlib_version: up to 1.5 external/bsd/bind/lib/libisc/shlib_version: up to 1.18 external/bsd/bind/lib/libisccc/shlib_version: up to 1.16 external/bsd/bind/lib/libisccfg/shlib_version: up to 1.16 external/bsd/bind/lib/liblwres/shlib_version: up to 1.16 Update BIND to 9.10.3-P4.

/*	$NetBSD: spnego.c,v 1.7.6.1 2016/03/13 08:00:35 martin Exp $	*/

/*
 * Copyright (C) 2006-2015  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
 */

/*! \file
 * \brief
 * Portable SPNEGO implementation.
 *
 * This is part of a portable implementation of the SPNEGO protocol
 * (RFCs 2478 and 4178).  This implementation uses the RFC 4178 ASN.1
 * module but is not a full implementation of the RFC 4178 protocol;
 * at the moment, we only support GSS-TSIG with Kerberos
 * authentication, so we only need enough of the SPNEGO protocol to
 * support that.
 *
 * The files that make up this portable SPNEGO implementation are:
 * \li	spnego.c	(this file)
 * \li	spnego.h	(API SPNEGO exports to the rest of lib/dns)
 * \li	spnego.asn1	(SPNEGO ASN.1 module)
 * \li	spnego_asn1.c	(routines generated from spngo.asn1)
 * \li	spnego_asn1.pl	(perl script to generate spnego_asn1.c)
 *
 * Everything but the functions exported in spnego.h is static, to
 * avoid possible conflicts with other libraries (particularly Heimdal,
 * since much of this code comes from Heimdal by way of mod_auth_kerb).
 *
 * spnego_asn1.c is shipped as part of lib/dns because generating it
 * requires both Perl and the Heimdal ASN.1 compiler.  See
 * spnego_asn1.pl for further details.  We've tried to eliminate all
 * compiler warnings from the generated code, but you may see a few
 * when using a compiler version we haven't tested yet.
 */

/*
 * Portions of this code were derived from mod_auth_kerb and Heimdal.
 * These packages are available from:
 *
 *   http://modauthkerb.sourceforge.net/
 *   http://www.pdc.kth.se/heimdal/
 *
 * and were released under the following licenses:
 *
 * ----------------------------------------------------------------
 *
 * Copyright (c) 2004 Masarykova universita
 * (Masaryk University, Brno, Czech Republic)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice,
 *    this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the University nor the names of its contributors may
 *    be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * ----------------------------------------------------------------
 *
 * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
 * (Royal Institute of Technology, Stockholm, Sweden).
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the Institute nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * XXXSRA We should omit this file entirely in Makefile.in via autoconf,
 * but this will keep it from generating errors until that's written.
 */

#ifdef GSSAPI

/*
 * XXXSRA Some of the following files are almost certainly unnecessary,
 * but using this list (borrowed from gssapictx.c) gets rid of some
 * whacky compilation errors when building with MSVC and should be
 * harmless in any case.
 */

#include <config.h>

#include <stdlib.h>
#include <errno.h>

#include <isc/buffer.h>
#include <isc/dir.h>
#include <isc/entropy.h>
#include <isc/lex.h>
#include <isc/mem.h>
#include <isc/once.h>
#include <isc/random.h>
#include <isc/safe.h>
#include <isc/string.h>
#include <isc/time.h>
#include <isc/util.h>

#include <dns/fixedname.h>
#include <dns/name.h>
#include <dns/rdata.h>
#include <dns/rdataclass.h>
#include <dns/result.h>
#include <dns/types.h>
#include <dns/keyvalues.h>
#include <dns/log.h>

#include <dst/gssapi.h>
#include <dst/result.h>

#include "dst_internal.h"

/*
 * The API we export
 */
#include "spnego.h"

/* asn1_err.h */
/* Generated from ../../../lib/asn1/asn1_err.et */

#ifndef ERROR_TABLE_BASE_asn1
/* these may be brought in already via gssapi_krb5.h */
typedef enum asn1_error_number {
	ASN1_BAD_TIMEFORMAT = 1859794432,
	ASN1_MISSING_FIELD = 1859794433,
	ASN1_MISPLACED_FIELD = 1859794434,
	ASN1_TYPE_MISMATCH = 1859794435,
	ASN1_OVERFLOW = 1859794436,
	ASN1_OVERRUN = 1859794437,
	ASN1_BAD_ID = 1859794438,
	ASN1_BAD_LENGTH = 1859794439,
	ASN1_BAD_FORMAT = 1859794440,
	ASN1_PARSE_ERROR = 1859794441
} asn1_error_number;

#define ERROR_TABLE_BASE_asn1 1859794432
#endif

#define __asn1_common_definitions__

typedef struct octet_string {
	size_t length;
	void *data;
} octet_string;

typedef char *general_string;

typedef char *utf8_string;

typedef struct oid {
	size_t length;
	unsigned *components;
} oid;

/* der.h */

typedef enum {
	ASN1_C_UNIV = 0, ASN1_C_APPL = 1,
	ASN1_C_CONTEXT = 2, ASN1_C_PRIVATE = 3
} Der_class;

typedef enum {
	PRIM = 0, CONS = 1
} Der_type;

/* Universal tags */

enum {
	UT_Boolean = 1,
	UT_Integer = 2,
	UT_BitString = 3,
	UT_OctetString = 4,
	UT_Null = 5,
	UT_OID = 6,
	UT_Enumerated = 10,
	UT_Sequence = 16,
	UT_Set = 17,
	UT_PrintableString = 19,
	UT_IA5String = 22,
	UT_UTCTime = 23,
	UT_GeneralizedTime = 24,
	UT_VisibleString = 26,
	UT_GeneralString = 27
};

#define ASN1_INDEFINITE 0xdce0deed

static int
der_get_length(const unsigned char *p, size_t len,
	       size_t * val, size_t * size);

static int
der_get_octet_string(const unsigned char *p, size_t len,
		     octet_string * data, size_t * size);
static int
der_get_oid(const unsigned char *p, size_t len,
	    oid * data, size_t * size);
static int
der_get_tag(const unsigned char *p, size_t len,
	    Der_class * class, Der_type * type,
	    int *tag, size_t * size);

static int
der_match_tag(const unsigned char *p, size_t len,
	      Der_class class, Der_type type,
	      int tag, size_t * size);
static int
der_match_tag_and_length(const unsigned char *p, size_t len,
			 Der_class class, Der_type type, int tag,
			 size_t * length_ret, size_t * size);

static int
decode_oid(const unsigned char *p, size_t len,
	   oid * k, size_t * size);

static int
decode_enumerated(const unsigned char *p, size_t len, void *num, size_t *size);

static int
decode_octet_string(const unsigned char *, size_t, octet_string *, size_t *);

static int
der_put_int(unsigned char *p, size_t len, int val, size_t *);

static int
der_put_length(unsigned char *p, size_t len, size_t val, size_t *);

static int
der_put_octet_string(unsigned char *p, size_t len,
		     const octet_string * data, size_t *);
static int
der_put_oid(unsigned char *p, size_t len,
	    const oid * data, size_t * size);
static int
der_put_tag(unsigned char *p, size_t len, Der_class class, Der_type type,
	    int tag, size_t *);
static int
der_put_length_and_tag(unsigned char *, size_t, size_t,
		       Der_class, Der_type, int, size_t *);

static int
encode_enumerated(unsigned char *p, size_t len, const void *data, size_t *);

static int
encode_octet_string(unsigned char *p, size_t len,
		    const octet_string * k, size_t *);
static int
encode_oid(unsigned char *p, size_t len,
	   const oid * k, size_t *);

static void
free_octet_string(octet_string * k);

static void
free_oid  (oid * k);

static size_t
length_len(size_t len);

static int
fix_dce(size_t reallen, size_t * len);

/*
 * Include stuff generated by the ASN.1 compiler.
 */

#include "spnego_asn1.c"

static unsigned char gss_krb5_mech_oid_bytes[] = {
	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x01, 0x02, 0x02
};

static gss_OID_desc gss_krb5_mech_oid_desc = {
	sizeof(gss_krb5_mech_oid_bytes),
	gss_krb5_mech_oid_bytes
};

static gss_OID GSS_KRB5_MECH = &gss_krb5_mech_oid_desc;

static unsigned char gss_mskrb5_mech_oid_bytes[] = {
	0x2a, 0x86, 0x48, 0x82, 0xf7, 0x12, 0x01, 0x02, 0x02
};

static gss_OID_desc gss_mskrb5_mech_oid_desc = {
	sizeof(gss_mskrb5_mech_oid_bytes),
	gss_mskrb5_mech_oid_bytes
};

static gss_OID GSS_MSKRB5_MECH = &gss_mskrb5_mech_oid_desc;

static unsigned char gss_spnego_mech_oid_bytes[] = {
	0x2b, 0x06, 0x01, 0x05, 0x05, 0x02
};

static gss_OID_desc gss_spnego_mech_oid_desc = {
	sizeof(gss_spnego_mech_oid_bytes),
	gss_spnego_mech_oid_bytes
};

static gss_OID GSS_SPNEGO_MECH = &gss_spnego_mech_oid_desc;

/* spnegokrb5_locl.h */

static OM_uint32
gssapi_spnego_encapsulate(OM_uint32 *,
			  unsigned char *,
			  size_t,
			  gss_buffer_t,
			  const gss_OID);

static OM_uint32
gssapi_spnego_decapsulate(OM_uint32 *,
			  gss_buffer_t,
			  unsigned char **,
			  size_t *,
			  const gss_OID);

/* mod_auth_kerb.c */

static int
cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
{
	unsigned char *p;
	size_t len;

	if (token->length == 0U)
		return (GSS_S_DEFECTIVE_TOKEN);

	p = token->value;
	if (*p++ != 0x60)
		return (GSS_S_DEFECTIVE_TOKEN);
	len = *p++;
	if (len & 0x80) {
		if ((len & 0x7f) > 4U)
			return (GSS_S_DEFECTIVE_TOKEN);
		p += len & 0x7f;
	}
	if (*p++ != 0x06)
		return (GSS_S_DEFECTIVE_TOKEN);

	if (((OM_uint32) *p++) != gssoid->length)
		return (GSS_S_DEFECTIVE_TOKEN);

	return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
}

/* accept_sec_context.c */
/*
 * SPNEGO wrapper for Kerberos5 GSS-API kouril@ics.muni.cz, 2003 (mostly
 * based on Heimdal code)
 */

static OM_uint32
code_NegTokenArg(OM_uint32 * minor_status,
		 const NegTokenResp * resp,
		 unsigned char **outbuf,
		 size_t * outbuf_size)
{
	OM_uint32 ret;
	u_char *buf;
	size_t buf_size, buf_len = 0;

	buf_size = 1024;
	buf = malloc(buf_size);
	if (buf == NULL) {
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	do {
		ret = encode_NegTokenResp(buf + buf_size - 1,
					  buf_size,
					  resp, &buf_len);
		if (ret == 0) {
			size_t tmp;

			ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
						     buf_size - buf_len,
						     buf_len,
						     ASN1_C_CONTEXT,
						     CONS,
						     1,
						     &tmp);
			if (ret == 0)
				buf_len += tmp;
		}
		if (ret) {
			if (ret == ASN1_OVERFLOW) {
				u_char *tmp;

				buf_size *= 2;
				tmp = realloc(buf, buf_size);
				if (tmp == NULL) {
					*minor_status = ENOMEM;
					free(buf);
					return (GSS_S_FAILURE);
				}
				buf = tmp;
			} else {
				*minor_status = ret;
				free(buf);
				return (GSS_S_FAILURE);
			}
		}
	} while (ret == ASN1_OVERFLOW);

	*outbuf = malloc(buf_len);
	if (*outbuf == NULL) {
		*minor_status = ENOMEM;
		free(buf);
		return (GSS_S_FAILURE);
	}
	memmove(*outbuf, buf + buf_size - buf_len, buf_len);
	*outbuf_size = buf_len;

	free(buf);

	return (GSS_S_COMPLETE);
}

static OM_uint32
send_reject(OM_uint32 * minor_status,
	    gss_buffer_t output_token)
{
	NegTokenResp resp;
	OM_uint32 ret;

	resp.negState = malloc(sizeof(*resp.negState));
	if (resp.negState == NULL) {
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	*(resp.negState) = reject;

	resp.supportedMech = NULL;
	resp.responseToken = NULL;
	resp.mechListMIC = NULL;

	ret = code_NegTokenArg(minor_status, &resp,
			       (unsigned char **)&output_token->value,
			       &output_token->length);
	free_NegTokenResp(&resp);
	if (ret)
		return (ret);

	return (GSS_S_BAD_MECH);
}

static OM_uint32
send_accept(OM_uint32 * minor_status,
	    gss_buffer_t output_token,
	    gss_buffer_t mech_token,
	    const gss_OID pref)
{
	NegTokenResp resp;
	OM_uint32 ret;

	memset(&resp, 0, sizeof(resp));
	resp.negState = malloc(sizeof(*resp.negState));
	if (resp.negState == NULL) {
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	*(resp.negState) = accept_completed;

	resp.supportedMech = malloc(sizeof(*resp.supportedMech));
	if (resp.supportedMech == NULL) {
		free_NegTokenResp(&resp);
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	ret = der_get_oid(pref->elements,
			  pref->length,
			  resp.supportedMech,
			  NULL);
	if (ret) {
		free_NegTokenResp(&resp);
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	if (mech_token != NULL && mech_token->length != 0U) {
		resp.responseToken = malloc(sizeof(*resp.responseToken));
		if (resp.responseToken == NULL) {
			free_NegTokenResp(&resp);
			*minor_status = ENOMEM;
			return (GSS_S_FAILURE);
		}
		resp.responseToken->length = mech_token->length;
		resp.responseToken->data = mech_token->value;
	}

	ret = code_NegTokenArg(minor_status, &resp,
			       (unsigned char **)&output_token->value,
			       &output_token->length);
	if (resp.responseToken != NULL) {
		free(resp.responseToken);
		resp.responseToken = NULL;
	}
	free_NegTokenResp(&resp);
	if (ret)
		return (ret);

	return (GSS_S_COMPLETE);
}

OM_uint32
gss_accept_sec_context_spnego(OM_uint32 *minor_status,
			      gss_ctx_id_t *context_handle,
			      const gss_cred_id_t acceptor_cred_handle,
			      const gss_buffer_t input_token_buffer,
			      const gss_channel_bindings_t input_chan_bindings,
			      gss_name_t *src_name,
			      gss_OID *mech_type,
			      gss_buffer_t output_token,
			      OM_uint32 *ret_flags,
			      OM_uint32 *time_rec,
			      gss_cred_id_t *delegated_cred_handle)
{
	NegTokenInit init_token;
	OM_uint32 major_status;
	OM_uint32 minor_status2;
	gss_buffer_desc ibuf, obuf;
	gss_buffer_t ot = NULL;
	gss_OID pref = GSS_KRB5_MECH;
	unsigned char *buf;
	size_t buf_size;
	size_t len, taglen, ni_len;
	int found = 0;
	int ret;
	unsigned i;

	/*
	 * Before doing anything else, see whether this is a SPNEGO
	 * PDU.  If not, dispatch to the GSSAPI library and get out.
	 */

	if (cmp_gss_type(input_token_buffer, GSS_SPNEGO_MECH))
		return (gss_accept_sec_context(minor_status,
					       context_handle,
					       acceptor_cred_handle,
					       input_token_buffer,
					       input_chan_bindings,
					       src_name,
					       mech_type,
					       output_token,
					       ret_flags,
					       time_rec,
					       delegated_cred_handle));

	/*
	 * If we get here, it's SPNEGO.
	 */

	memset(&init_token, 0, sizeof(init_token));

	ret = gssapi_spnego_decapsulate(minor_status, input_token_buffer,
					&buf, &buf_size, GSS_SPNEGO_MECH);
	if (ret)
		return (ret);

	ret = der_match_tag_and_length(buf, buf_size, ASN1_C_CONTEXT, CONS,
				       0, &len, &taglen);
	if (ret)
		return (ret);

	ret = decode_NegTokenInit(buf + taglen, len, &init_token, &ni_len);
	if (ret) {
		*minor_status = EINVAL;	/* XXX */
		return (GSS_S_DEFECTIVE_TOKEN);
	}

	for (i = 0; !found && i < init_token.mechTypes.len; ++i) {
		unsigned char mechbuf[17];
		size_t mech_len;

		ret = der_put_oid(mechbuf + sizeof(mechbuf) - 1,
				  sizeof(mechbuf),
				  &init_token.mechTypes.val[i],
				  &mech_len);
		if (ret) {
			free_NegTokenInit(&init_token);
			return (GSS_S_DEFECTIVE_TOKEN);
		}
		if (mech_len == GSS_KRB5_MECH->length &&
		    isc_safe_memequal(GSS_KRB5_MECH->elements,
				      mechbuf + sizeof(mechbuf) - mech_len,
				      mech_len))
		{
			found = 1;
			break;
		}
		if (mech_len == GSS_MSKRB5_MECH->length &&
		    isc_safe_memequal(GSS_MSKRB5_MECH->elements,
				      mechbuf + sizeof(mechbuf) - mech_len,
				      mech_len))
		{
			found = 1;
			if (i == 0)
				pref = GSS_MSKRB5_MECH;
			break;
		}
	}

	if (!found) {
		free_NegTokenInit(&init_token);
		return (send_reject(minor_status, output_token));
	}

	if (i == 0 && init_token.mechToken != NULL) {
		ibuf.length = init_token.mechToken->length;
		ibuf.value = init_token.mechToken->data;

		major_status = gss_accept_sec_context(minor_status,
						      context_handle,
						      acceptor_cred_handle,
						      &ibuf,
						      input_chan_bindings,
						      src_name,
						      mech_type,
						      &obuf,
						      ret_flags,
						      time_rec,
						      delegated_cred_handle);
		if (GSS_ERROR(major_status)) {
			free_NegTokenInit(&init_token);
			send_reject(&minor_status2, output_token);
			return (major_status);
		}
		ot = &obuf;
	}
	ret = send_accept(&minor_status2, output_token, ot, pref);
	free_NegTokenInit(&init_token);
	if (ot != NULL && ot->length != 0U)
		gss_release_buffer(&minor_status2, ot);

	return (ret);
}

/* decapsulate.c */

static OM_uint32
gssapi_verify_mech_header(u_char ** str,
			  size_t total_len,
			  const gss_OID mech)
{
	size_t len, len_len, mech_len, foo;
	int e;
	u_char *p = *str;

	if (total_len < 1U)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (*p++ != 0x60)
		return (GSS_S_DEFECTIVE_TOKEN);
	e = der_get_length(p, total_len - 1, &len, &len_len);
	if (e || 1 + len_len + len != total_len)
		return (GSS_S_DEFECTIVE_TOKEN);
	p += len_len;
	if (*p++ != 0x06)
		return (GSS_S_DEFECTIVE_TOKEN);
	e = der_get_length(p, total_len - 1 - len_len - 1,
			   &mech_len, &foo);
	if (e)
		return (GSS_S_DEFECTIVE_TOKEN);
	p += foo;
	if (mech_len != mech->length)
		return (GSS_S_BAD_MECH);
	if (!isc_safe_memequal(p, mech->elements, mech->length))
		return (GSS_S_BAD_MECH);
	p += mech_len;
	*str = p;
	return (GSS_S_COMPLETE);
}

/*
 * Remove the GSS-API wrapping from `in_token' giving `buf and buf_size' Does
 * not copy data, so just free `in_token'.
 */

static OM_uint32
gssapi_spnego_decapsulate(OM_uint32 *minor_status,
			  gss_buffer_t input_token_buffer,
			  unsigned char **buf,
			  size_t *buf_len,
			  const gss_OID mech)
{
	u_char *p;
	OM_uint32 ret;

	p = input_token_buffer->value;
	ret = gssapi_verify_mech_header(&p,
					input_token_buffer->length,
					mech);
	if (ret) {
		*minor_status = ret;
		return (GSS_S_FAILURE);
	}
	*buf_len = input_token_buffer->length -
		(p - (u_char *) input_token_buffer->value);
	*buf = p;
	return (GSS_S_COMPLETE);
}

/* der_free.c */

static void
free_octet_string(octet_string *k)
{
	free(k->data);
	k->data = NULL;
}

static void
free_oid(oid *k)
{
	free(k->components);
	k->components = NULL;
}

/* der_get.c */

/*
 * All decoding functions take a pointer `p' to first position in which to
 * read, from the left, `len' which means the maximum number of characters we
 * are able to read, `ret' were the value will be returned and `size' where
 * the number of used bytes is stored. Either 0 or an error code is returned.
 */

static int
der_get_unsigned(const unsigned char *p, size_t len,
		 unsigned *ret, size_t *size)
{
	unsigned val = 0;
	size_t oldlen = len;

	while (len--)
		val = val * 256 + *p++;
	*ret = val;
	if (size)
		*size = oldlen;
	return (0);
}

static int
der_get_int(const unsigned char *p, size_t len,
	    int *ret, size_t *size)
{
	int val = 0;
	size_t oldlen = len;

	if (len > 0U) {
		val = (signed char)*p++;
		while (--len)
			val = val * 256 + *p++;
	}
	*ret = val;
	if (size)
		*size = oldlen;
	return (0);
}

static int
der_get_length(const unsigned char *p, size_t len,
	       size_t *val, size_t *size)
{
	size_t v;

	if (len <= 0U)
		return (ASN1_OVERRUN);
	--len;
	v = *p++;
	if (v < 128U) {
		*val = v;
		if (size)
			*size = 1;
	} else {
		int e;
		size_t l;
		unsigned tmp;

		if (v == 0x80U) {
			*val = ASN1_INDEFINITE;
			if (size)
				*size = 1;
			return (0);
		}
		v &= 0x7F;
		if (len < v)
			return (ASN1_OVERRUN);
		e = der_get_unsigned(p, v, &tmp, &l);
		if (e)
			return (e);
		*val = tmp;
		if (size)
			*size = l + 1;
	}
	return (0);
}

static int
der_get_octet_string(const unsigned char *p, size_t len,
		     octet_string *data, size_t *size)
{
	data->length = len;
	if (len != 0U) {
		data->data = malloc(len);
		if (data->data == NULL)
			return (ENOMEM);
		memmove(data->data, p, len);
	} else
		data->data = NULL;
	if (size)
		*size = len;
	return (0);
}

static int
der_get_oid(const unsigned char *p, size_t len,
	    oid *data, size_t *size)
{
	int n;
	size_t oldlen = len;

	data->components = NULL;
	data->length = 0;
	if (len < 1U)
		return (ASN1_OVERRUN);

	data->components = malloc(len * sizeof(*data->components));
	if (data->components == NULL && len != 0U)
		return (ENOMEM);
	data->components[0] = (*p) / 40;
	data->components[1] = (*p) % 40;
	--len;
	++p;
	for (n = 2; len > 0U; ++n) {
		unsigned u = 0;

		do {
			--len;
			u = u * 128 + (*p++ % 128);
		} while (len > 0U && p[-1] & 0x80);
		data->components[n] = u;
	}
	if (p[-1] & 0x80) {
		free_oid(data);
		return (ASN1_OVERRUN);
	}
	data->length = n;
	if (size)
		*size = oldlen;
	return (0);
}

static int
der_get_tag(const unsigned char *p, size_t len,
	    Der_class *class, Der_type *type,
	    int *tag, size_t *size)
{
	if (len < 1U)
		return (ASN1_OVERRUN);
	*class = (Der_class) (((*p) >> 6) & 0x03);
	*type = (Der_type) (((*p) >> 5) & 0x01);
	*tag = (*p) & 0x1F;
	if (size)
		*size = 1;
	return (0);
}

static int
der_match_tag(const unsigned char *p, size_t len,
	      Der_class class, Der_type type,
	      int tag, size_t *size)
{
	size_t l;
	Der_class thisclass;
	Der_type thistype;
	int thistag;
	int e;

	e = der_get_tag(p, len, &thisclass, &thistype, &thistag, &l);
	if (e)
		return (e);
	if (class != thisclass || type != thistype)
		return (ASN1_BAD_ID);
	if (tag > thistag)
		return (ASN1_MISPLACED_FIELD);
	if (tag < thistag)
		return (ASN1_MISSING_FIELD);
	if (size)
		*size = l;
	return (0);
}

static int
der_match_tag_and_length(const unsigned char *p, size_t len,
			 Der_class class, Der_type type, int tag,
			 size_t *length_ret, size_t *size)
{
	size_t l, ret = 0;
	int e;

	e = der_match_tag(p, len, class, type, tag, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;
	e = der_get_length(p, len, length_ret, &l);
	if (e)
		return (e);
	/* p += l; */
	len -= l;
	POST(len);
	ret += l;
	if (size)
		*size = ret;
	return (0);
}

static int
decode_enumerated(const unsigned char *p, size_t len, void *num, size_t *size)
{
	size_t ret = 0;
	size_t l, reallen;
	int e;

	e = der_match_tag(p, len, ASN1_C_UNIV, PRIM, UT_Enumerated, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;
	e = der_get_length(p, len, &reallen, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;
	e = der_get_int(p, reallen, num, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	if (size)
		*size = ret;
	return (0);
}

static int
decode_octet_string(const unsigned char *p, size_t len,
		    octet_string *k, size_t *size)
{
	size_t ret = 0;
	size_t l;
	int e;
	size_t slen;

	k->data = NULL;
	k->length = 0;

	e = der_match_tag(p, len, ASN1_C_UNIV, PRIM, UT_OctetString, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;

	e = der_get_length(p, len, &slen, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;
	if (len < slen)
		return (ASN1_OVERRUN);

	e = der_get_octet_string(p, slen, k, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	if (size)
		*size = ret;
	return (0);
}

static int
decode_oid(const unsigned char *p, size_t len,
	   oid *k, size_t *size)
{
	size_t ret = 0;
	size_t l;
	int e;
	size_t slen;

	e = der_match_tag(p, len, ASN1_C_UNIV, PRIM, UT_OID, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;

	e = der_get_length(p, len, &slen, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	ret += l;
	if (len < slen)
		return (ASN1_OVERRUN);

	e = der_get_oid(p, slen, k, &l);
	if (e)
		return (e);
	p += l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	if (size)
		*size = ret;
	return (0);
}

static int
fix_dce(size_t reallen, size_t *len)
{
	if (reallen == ASN1_INDEFINITE)
		return (1);
	if (*len < reallen)
		return (-1);
	*len = reallen;
	return (0);
}

/* der_length.c */

static size_t
len_unsigned(unsigned val)
{
	size_t ret = 0;

	do {
		++ret;
		val /= 256;
	} while (val);
	return (ret);
}

static size_t
length_len(size_t len)
{
	if (len < 128U)
		return (1);
	else
		return (len_unsigned((unsigned int)len) + 1);
}


/* der_put.c */

/*
 * All encoding functions take a pointer `p' to first position in which to
 * write, from the right, `len' which means the maximum number of characters
 * we are able to write.  The function returns the number of characters
 * written in `size' (if non-NULL). The return value is 0 or an error.
 */

static int
der_put_unsigned(unsigned char *p, size_t len, unsigned val, size_t *size)
{
	unsigned char *base = p;

	if (val) {
		while (len > 0U && val) {
			*p-- = val % 256;
			val /= 256;
			--len;
		}
		if (val != 0)
			return (ASN1_OVERFLOW);
		else {
			*size = base - p;
			return (0);
		}
	} else if (len < 1U)
		return (ASN1_OVERFLOW);
	else {
		*p = 0;
		*size = 1;
		return (0);
	}
}

static int
der_put_int(unsigned char *p, size_t len, int val, size_t *size)
{
	unsigned char *base = p;

	if (val >= 0) {
		do {
			if (len < 1U)
				return (ASN1_OVERFLOW);
			*p-- = val % 256;
			len--;
			val /= 256;
		} while (val);
		if (p[1] >= 128) {
			if (len < 1U)
				return (ASN1_OVERFLOW);
			*p-- = 0;
			len--;
		}
	} else {
		val = ~val;
		do {
			if (len < 1U)
				return (ASN1_OVERFLOW);
			*p-- = ~(val % 256);
			len--;
			val /= 256;
		} while (val);
		if (p[1] < 128) {
			if (len < 1U)
				return (ASN1_OVERFLOW);
			*p-- = 0xff;
			len--;
		}
	}
	*size = base - p;
	return (0);
}

static int
der_put_length(unsigned char *p, size_t len, size_t val, size_t *size)
{
	if (len < 1U)
		return (ASN1_OVERFLOW);
	if (val < 128U) {
		*p = (unsigned char)val;
		*size = 1;
		return (0);
	} else {
		size_t l;
		int e;

		e = der_put_unsigned(p, len - 1, (unsigned int)val, &l);
		if (e)
			return (e);
		p -= l;
		*p = 0x80 | (unsigned char)l;
		*size = l + 1;
		return (0);
	}
}

static int
der_put_octet_string(unsigned char *p, size_t len,
		     const octet_string *data, size_t *size)
{
	if (len < data->length)
		return (ASN1_OVERFLOW);
	p -= data->length;
	len -= data->length;
	POST(len);
	memmove(p + 1, data->data, data->length);
	*size = data->length;
	return (0);
}

static int
der_put_oid(unsigned char *p, size_t len,
	    const oid *data, size_t *size)
{
	unsigned char *base = p;
	size_t n;

	for (n = data->length; n >= 3u; --n) {
		unsigned	u = data->components[n - 1];

		if (len < 1U)
			return (ASN1_OVERFLOW);
		*p-- = u % 128;
		u /= 128;
		--len;
		while (u > 0) {
			if (len < 1U)
				return (ASN1_OVERFLOW);
			*p-- = 128 + u % 128;
			u /= 128;
			--len;
		}
	}
	if (len < 1U)
		return (ASN1_OVERFLOW);
	*p-- = 40 * data->components[0] + data->components[1];
	*size = base - p;
	return (0);
}

static int
der_put_tag(unsigned char *p, size_t len, Der_class class, Der_type type,
	    int tag, size_t *size)
{
	if (len < 1U)
		return (ASN1_OVERFLOW);
	*p = (class << 6) | (type << 5) | tag;	/* XXX */
	*size = 1;
	return (0);
}

static int
der_put_length_and_tag(unsigned char *p, size_t len, size_t len_val,
		       Der_class class, Der_type type, int tag, size_t *size)
{
	size_t ret = 0;
	size_t l;
	int e;

	e = der_put_length(p, len, len_val, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	ret += l;
	e = der_put_tag(p, len, class, type, tag, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	*size = ret;
	return (0);
}

static int
encode_enumerated(unsigned char *p, size_t len, const void *data, size_t *size)
{
	unsigned num = *(const unsigned *)data;
	size_t ret = 0;
	size_t l;
	int e;

	e = der_put_int(p, len, num, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	ret += l;
	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_Enumerated, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	*size = ret;
	return (0);
}

static int
encode_octet_string(unsigned char *p, size_t len,
		    const octet_string *k, size_t *size)
{
	size_t ret = 0;
	size_t l;
	int e;

	e = der_put_octet_string(p, len, k, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	ret += l;
	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_OctetString, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	*size = ret;
	return (0);
}

static int
encode_oid(unsigned char *p, size_t len,
	   const oid *k, size_t *size)
{
	size_t ret = 0;
	size_t l;
	int e;

	e = der_put_oid(p, len, k, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	ret += l;
	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_OID, &l);
	if (e)
		return (e);
	p -= l;
	len -= l;
	POST(p); POST(len);
	ret += l;
	*size = ret;
	return (0);
}


/* encapsulate.c */

static void
gssapi_encap_length(size_t data_len,
		    size_t *len,
		    size_t *total_len,
		    const gss_OID mech)
{
	size_t len_len;

	*len = 1 + 1 + mech->length + data_len;

	len_len = length_len(*len);

	*total_len = 1 + len_len + *len;
}

static u_char *
gssapi_mech_make_header(u_char *p,
			size_t len,
			const gss_OID mech)
{
	int e;
	size_t len_len, foo;

	*p++ = 0x60;
	len_len = length_len(len);
	e = der_put_length(p + len_len - 1, len_len, len, &foo);
	if (e || foo != len_len)
		return (NULL);
	p += len_len;
	*p++ = 0x06;
	*p++ = mech->length;
	memmove(p, mech->elements, mech->length);
	p += mech->length;
	return (p);
}

/*
 * Give it a krb5_data and it will encapsulate with extra GSS-API wrappings.
 */

static OM_uint32
gssapi_spnego_encapsulate(OM_uint32 * minor_status,
			  unsigned char *buf,
			  size_t buf_size,
			  gss_buffer_t output_token,
			  const gss_OID mech)
{
	size_t len, outer_len;
	u_char *p;

	gssapi_encap_length(buf_size, &len, &outer_len, mech);

	output_token->length = outer_len;
	output_token->value = malloc(outer_len);
	if (output_token->value == NULL) {
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}
	p = gssapi_mech_make_header(output_token->value, len, mech);
	if (p == NULL) {
		if (output_token->length != 0U)
			gss_release_buffer(minor_status, output_token);
		return (GSS_S_FAILURE);
	}
	memmove(p, buf, buf_size);
	return (GSS_S_COMPLETE);
}

/* init_sec_context.c */
/*
 * SPNEGO wrapper for Kerberos5 GSS-API kouril@ics.muni.cz, 2003 (mostly
 * based on Heimdal code)
 */

static int
add_mech(MechTypeList * mech_list, gss_OID mech)
{
	MechType *tmp;
	int ret;

	tmp = realloc(mech_list->val, (mech_list->len + 1) * sizeof(*tmp));
	if (tmp == NULL)
		return (ENOMEM);
	mech_list->val = tmp;

	ret = der_get_oid(mech->elements, mech->length,
			  &mech_list->val[mech_list->len], NULL);
	if (ret)
		return (ret);

	mech_list->len++;
	return (0);
}

/*
 * return the length of the mechanism in token or -1
 * (which implies that the token was bad - GSS_S_DEFECTIVE_TOKEN
 */

static ssize_t
gssapi_krb5_get_mech(const u_char *ptr,
		     size_t total_len,
		     const u_char **mech_ret)
{
	size_t len, len_len, mech_len, foo;
	const u_char *p = ptr;
	int e;

	if (total_len < 1U)
		return (-1);
	if (*p++ != 0x60)
		return (-1);
	e = der_get_length (p, total_len - 1, &len, &len_len);
	if (e || 1 + len_len + len != total_len)
		return (-1);
	p += len_len;
	if (*p++ != 0x06)
		return (-1);
	e = der_get_length (p, total_len - 1 - len_len - 1,
			    &mech_len, &foo);
	if (e)
		return (-1);
	p += foo;
	*mech_ret = p;
	return (mech_len);
}

static OM_uint32
spnego_initial(OM_uint32 *minor_status,
	       const gss_cred_id_t initiator_cred_handle,
	       gss_ctx_id_t *context_handle,
	       const gss_name_t target_name,
	       const gss_OID mech_type,
	       OM_uint32 req_flags,
	       OM_uint32 time_req,
	       const gss_channel_bindings_t input_chan_bindings,
	       const gss_buffer_t input_token,
	       gss_OID *actual_mech_type,
	       gss_buffer_t output_token,
	       OM_uint32 *ret_flags,
	       OM_uint32 *time_rec)
{
	NegTokenInit token_init;
	OM_uint32 major_status, minor_status2;
	gss_buffer_desc	krb5_output_token = GSS_C_EMPTY_BUFFER;
	unsigned char *buf = NULL;
	size_t buf_size;
	size_t len;
	int ret;

	(void)mech_type;

	memset(&token_init, 0, sizeof(token_init));

	ret = add_mech(&token_init.mechTypes, GSS_KRB5_MECH);
	if (ret) {
		*minor_status = ret;
		ret = GSS_S_FAILURE;
		goto end;
	}

	major_status = gss_init_sec_context(minor_status,
					    initiator_cred_handle,
					    context_handle,
					    target_name,
					    GSS_KRB5_MECH,
					    req_flags,
					    time_req,
					    input_chan_bindings,
					    input_token,
					    actual_mech_type,
					    &krb5_output_token,
					    ret_flags,
					    time_rec);
	if (GSS_ERROR(major_status)) {
		ret = major_status;
		goto end;
	}
	if (krb5_output_token.length > 0U) {
		token_init.mechToken = malloc(sizeof(*token_init.mechToken));
		if (token_init.mechToken == NULL) {
			*minor_status = ENOMEM;
			ret = GSS_S_FAILURE;
			goto end;
		}
		token_init.mechToken->data = krb5_output_token.value;
		token_init.mechToken->length = krb5_output_token.length;
	}
	/*
	 * The MS implementation of SPNEGO seems to not like the mechListMIC
	 * field, so we omit it (it's optional anyway)
	 */

	buf_size = 1024;
	buf = malloc(buf_size);
	if (buf == NULL) {
		*minor_status = ENOMEM;
		ret = GSS_S_FAILURE;
		goto end;
	}

	do {
		ret = encode_NegTokenInit(buf + buf_size - 1,
					  buf_size,
					  &token_init, &len);
		if (ret == 0) {
			size_t tmp;

			ret = der_put_length_and_tag(buf + buf_size - len - 1,
						     buf_size - len,
						     len,
						     ASN1_C_CONTEXT,
						     CONS,
						     0,
						     &tmp);
			if (ret == 0)
				len += tmp;
		}
		if (ret) {
			if (ret == ASN1_OVERFLOW) {
				u_char *tmp;

				buf_size *= 2;
				tmp = realloc(buf, buf_size);
				if (tmp == NULL) {
					*minor_status = ENOMEM;
					ret = GSS_S_FAILURE;
					goto end;
				}
				buf = tmp;
			} else {
				*minor_status = ret;
				ret = GSS_S_FAILURE;
				goto end;
			}
		}
	} while (ret == ASN1_OVERFLOW);

	ret = gssapi_spnego_encapsulate(minor_status,
					buf + buf_size - len, len,
					output_token, GSS_SPNEGO_MECH);
	if (ret == GSS_S_COMPLETE)
		ret = major_status;

end:
	if (token_init.mechToken != NULL) {
		free(token_init.mechToken);
		token_init.mechToken = NULL;
	}
	free_NegTokenInit(&token_init);
	if (krb5_output_token.length != 0U)
		gss_release_buffer(&minor_status2, &krb5_output_token);
	if (buf)
		free(buf);

	return (ret);
}

static OM_uint32
spnego_reply(OM_uint32 *minor_status,
	     const gss_cred_id_t initiator_cred_handle,
	     gss_ctx_id_t *context_handle,
	     const gss_name_t target_name,
	     const gss_OID mech_type,
	     OM_uint32 req_flags,
	     OM_uint32 time_req,
	     const gss_channel_bindings_t input_chan_bindings,
	     const gss_buffer_t input_token,
	     gss_OID *actual_mech_type,
	     gss_buffer_t output_token,
	     OM_uint32 *ret_flags,
	     OM_uint32 *time_rec)
{
	OM_uint32 ret;
	NegTokenResp resp;
	unsigned char *buf;
	size_t buf_size;
	u_char oidbuf[17];
	size_t oidlen;
	gss_buffer_desc sub_token;
	ssize_t mech_len;
	const u_char *p;
	size_t len, taglen;

	(void)mech_type;

	output_token->length = 0;
	output_token->value  = NULL;

	/*
	 * SPNEGO doesn't include gss wrapping on SubsequentContextToken
	 * like the Kerberos 5 mech does. But lets check for it anyway.
	 */

	mech_len = gssapi_krb5_get_mech(input_token->value,
					input_token->length,
					&p);

	if (mech_len < 0) {
		buf = input_token->value;
		buf_size = input_token->length;
	} else if ((size_t)mech_len == GSS_KRB5_MECH->length &&
		   isc_safe_memequal(GSS_KRB5_MECH->elements, p, mech_len))
		return (gss_init_sec_context(minor_status,
					     initiator_cred_handle,
					     context_handle,
					     target_name,
					     GSS_KRB5_MECH,
					     req_flags,
					     time_req,
					     input_chan_bindings,
					     input_token,
					     actual_mech_type,
					     output_token,
					     ret_flags,
					     time_rec));
	else if ((size_t)mech_len == GSS_SPNEGO_MECH->length &&
		 isc_safe_memequal(GSS_SPNEGO_MECH->elements, p, mech_len)) {
		ret = gssapi_spnego_decapsulate(minor_status,
						input_token,
						&buf,
						&buf_size,
						GSS_SPNEGO_MECH);
		if (ret)
			return (ret);
	} else
		return (GSS_S_BAD_MECH);

	ret = der_match_tag_and_length(buf, buf_size,
				       ASN1_C_CONTEXT, CONS, 1, &len, &taglen);
	if (ret)
		return (ret);

	if(len > buf_size - taglen)
		return (ASN1_OVERRUN);

	ret = decode_NegTokenResp(buf + taglen, len, &resp, NULL);
	if (ret) {
		free_NegTokenResp(&resp);
		*minor_status = ENOMEM;
		return (GSS_S_FAILURE);
	}

	if (resp.negState == NULL ||
	    *(resp.negState) == reject ||
	    resp.supportedMech == NULL) {
		free_NegTokenResp(&resp);
		return (GSS_S_BAD_MECH);
	}

	ret = der_put_oid(oidbuf + sizeof(oidbuf) - 1,
			  sizeof(oidbuf),
			  resp.supportedMech,
			  &oidlen);
	if (ret || oidlen != GSS_KRB5_MECH->length ||
	    !isc_safe_memequal(oidbuf + sizeof(oidbuf) - oidlen,
			      GSS_KRB5_MECH->elements, oidlen))
	{
		free_NegTokenResp(&resp);
		return GSS_S_BAD_MECH;
	}

	if (resp.responseToken != NULL) {
		sub_token.length = resp.responseToken->length;
		sub_token.value  = resp.responseToken->data;
	} else {
		sub_token.length = 0;
		sub_token.value  = NULL;
	}

	ret = gss_init_sec_context(minor_status,
				   initiator_cred_handle,
				   context_handle,
				   target_name,
				   GSS_KRB5_MECH,
				   req_flags,
				   time_req,
				   input_chan_bindings,
				   &sub_token,
				   actual_mech_type,
				   output_token,
				   ret_flags,
				   time_rec);
	if (ret) {
		free_NegTokenResp(&resp);
		return (ret);
	}

	/*
	 * XXXSRA I don't think this limited implementation ever needs
	 * to check the MIC -- our preferred mechanism (Kerberos)
	 * authenticates its own messages and is the only mechanism
	 * we'll accept, so if the mechanism negotiation completes
	 * successfully, we don't need the MIC.  See RFC 4178.
	 */

	free_NegTokenResp(&resp);
	return (ret);
}



OM_uint32
gss_init_sec_context_spnego(OM_uint32 *minor_status,
			    const gss_cred_id_t initiator_cred_handle,
			    gss_ctx_id_t *context_handle,
			    const gss_name_t target_name,
			    const gss_OID mech_type,
			    OM_uint32 req_flags,
			    OM_uint32 time_req,
			    const gss_channel_bindings_t input_chan_bindings,
			    const gss_buffer_t input_token,
			    gss_OID *actual_mech_type,
			    gss_buffer_t output_token,
			    OM_uint32 *ret_flags,
			    OM_uint32 *time_rec)
{
	/* Dirty trick to suppress compiler warnings */

	/* Figure out whether we're starting over or processing a reply */

	if (input_token == GSS_C_NO_BUFFER || input_token->length == 0U)
		return (spnego_initial(minor_status,
				       initiator_cred_handle,
				       context_handle,
				       target_name,
				       mech_type,
				       req_flags,
				       time_req,
				       input_chan_bindings,
				       input_token,
				       actual_mech_type,
				       output_token,
				       ret_flags,
				       time_rec));
	else
		return (spnego_reply(minor_status,
				     initiator_cred_handle,
				     context_handle,
				     target_name,
				     mech_type,
				     req_flags,
				     time_req,
				     input_chan_bindings,
				     input_token,
				     actual_mech_type,
				     output_token,
				     ret_flags,
				     time_rec));
}

#endif /* GSSAPI */