Merge mskrb-integ onto trunk

The mskrb-integ branch includes support for the following projects:
Projects/Aliases
* Projects/PAC and principal APIs
* Projects/AEAD encryption API
* Projects/GSSAPI DCE
* Projects/RFC 3244

In addition, it includes support for enctype negotiation, and a variety of GSS-API extensions.
In the KDC it includes support for protocol transition, constrained delegation
and a new authorization data interface.
The old authorization data interface is also supported.

This commit merges the mskrb-integ branch on to the trunk.
Additional review and testing is required.

Merge commit 'mskrb-integ' into trunk

ticket: new
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21690 dc483132-0cff-0310-8789-dd5450dbe970

11 files changed, 1048 insertions, 34 deletions

diff --git a/src/lib/gssapi/generic/Makefile.in b/src/lib/gssapi/generic/Makefile.in
index 4a4a005..9ed3b13 100644
--- a/src/lib/gssapi/generic/Makefile.in
+++ b/src/lib/gssapi/generic/Makefile.in
@@ -18,7 +18,8 @@ ETHDRS= gssapi_err_generic.h
 EHDRDIR= $(BUILDTOP)$(S)include$(S)gssapi
 
 HDRS=	$(EHDRDIR)$(S)gssapi.h \
-	$(EHDRDIR)$(S)gssapi_generic.h
+	$(EHDRDIR)$(S)gssapi_generic.h \
+	$(EHDRDIR)$(S)gssapi_ext.h
 
 MK_EHDRDIR=if test -d $(EHDRDIR); then :; else (set -x; mkdir $(EHDRDIR)); fi
 ##DOS##MK_EHDRDIR=rem
@@ -29,6 +30,8 @@ $(EHDRDIR)$(S)gssapi.h: $(EHDRDIR)$(S)timestamp gssapi.h
 	$(CP) gssapi.h $@
 $(EHDRDIR)$(S)gssapi_generic.h: $(EHDRDIR)$(S)timestamp $(srcdir)$(S)gssapi_generic.h
 	$(CP) $(srcdir)$(S)gssapi_generic.h $@
+$(EHDRDIR)$(S)gssapi_ext.h: $(EHDRDIR)$(S)timestamp $(srcdir)$(S)gssapi_ext.h
+	$(CP) $(srcdir)$(S)gssapi_ext.h $@
 
 $(EHDRDIR)$(S)timestamp:
 	$(MK_EHDRDIR)
@@ -67,9 +70,11 @@ SRCS = \
 	$(srcdir)/disp_com_err_status.c \
 	$(srcdir)/disp_major_status.c \
 	$(srcdir)/gssapi_generic.c \
+	$(srcdir)/oid_ops.c \
 	$(srcdir)/rel_buffer.c \
 	$(srcdir)/rel_oid_set.c \
 	$(srcdir)/util_buffer.c \
+	$(srcdir)/util_buffer_set.c \
 	$(srcdir)/util_errmap.c \
 	$(srcdir)/util_ordering.c \
 	$(srcdir)/util_set.c \
@@ -81,9 +86,11 @@ OBJS = \
 	$(OUTPRE)disp_com_err_status.$(OBJEXT) \
 	$(OUTPRE)disp_major_status.$(OBJEXT) \
 	$(OUTPRE)gssapi_generic.$(OBJEXT) \
+	$(OUTPRE)oid_ops.$(OBJEXT) \
 	$(OUTPRE)rel_buffer.$(OBJEXT) \
 	$(OUTPRE)rel_oid_set.$(OBJEXT) \
 	$(OUTPRE)util_buffer.$(OBJEXT) \
+	$(OUTPRE)util_buffer_set.$(OBJEXT) \
 	$(OUTPRE)util_errmap.$(OBJEXT) \
 	$(OUTPRE)util_ordering.$(OBJEXT) \
 	$(OUTPRE)util_set.$(OBJEXT) \
@@ -95,9 +102,11 @@ STLIBOBJS = \
 	disp_com_err_status.o \
 	disp_major_status.o \
 	gssapi_generic.o \
+	oid_ops.o \
 	rel_buffer.o \
 	rel_oid_set.o \
 	util_buffer.o \
+	util_buffer_set.o \
 	util_errmap.o \
 	util_ordering.o \
 	util_set.o \
@@ -105,7 +114,7 @@ STLIBOBJS = \
 	util_validate.o \
 	gssapi_err_generic.o
 
-EXPORTED_HEADERS= gssapi_generic.h
+EXPORTED_HEADERS= gssapi_generic.h gssapi_ext.h
 EXPORTED_BUILT_HEADERS= gssapi.h
 
 $(OBJS): $(EXPORTED_HEADERS) $(ETHDRS)
@@ -169,61 +178,71 @@ depend:: $(ETSRCS)
 #
 disp_com_err_status.so disp_com_err_status.po $(OUTPRE)disp_com_err_status.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/gssapi.h $(SRCTOP)/include/k5-buf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(srcdir)/../gss_libinit.h disp_com_err_status.c gssapiP_generic.h \
-  gssapi_err_generic.h gssapi_generic.h
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h disp_com_err_status.c \
+  gssapiP_generic.h gssapi_err_generic.h gssapi_ext.h \
+  gssapi_generic.h
 disp_major_status.so disp_major_status.po $(OUTPRE)disp_major_status.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h disp_major_status.c gssapiP_generic.h \
-  gssapi_err_generic.h gssapi_generic.h
+  gssapi_err_generic.h gssapi_ext.h gssapi_generic.h
 gssapi_generic.so gssapi_generic.po $(OUTPRE)gssapi_generic.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.c gssapi_generic.h
+  gssapi_ext.h gssapi_generic.c gssapi_generic.h
+oid_ops.so oid_ops.po $(OUTPRE)oid_ops.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
+  gssapi_ext.h gssapi_generic.h oid_ops.c
 rel_buffer.so rel_buffer.po $(OUTPRE)rel_buffer.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h rel_buffer.c
+  gssapi_ext.h gssapi_generic.h rel_buffer.c
 rel_oid_set.so rel_oid_set.po $(OUTPRE)rel_oid_set.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h rel_oid_set.c
+  gssapi_ext.h gssapi_generic.h rel_oid_set.c
 util_buffer.so util_buffer.po $(OUTPRE)util_buffer.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h util_buffer.c
+  gssapi_ext.h gssapi_generic.h util_buffer.c
+util_buffer_set.so util_buffer_set.po $(OUTPRE)util_buffer_set.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
+  gssapi_ext.h gssapi_generic.h util_buffer_set.c
 util_errmap.so util_errmap.po $(OUTPRE)util_errmap.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
   $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
   $(SRCTOP)/include/krb5.h errmap.h gssapiP_generic.h \
-  gssapi_err_generic.h gssapi_generic.h util_errmap.c
+  gssapi_err_generic.h gssapi_ext.h gssapi_generic.h \
+  util_errmap.c
 util_ordering.so util_ordering.po $(OUTPRE)util_ordering.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h util_ordering.c
+  gssapi_ext.h gssapi_generic.h util_ordering.c
 util_set.so util_set.po $(OUTPRE)util_set.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h util_set.c
+  gssapi_ext.h gssapi_generic.h util_set.c
 util_token.so util_token.po $(OUTPRE)util_token.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
   $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
   $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h util_token.c
+  gssapi_ext.h gssapi_generic.h util_token.c
 util_validate.so util_validate.po $(OUTPRE)util_validate.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/gssapi.h $(SRCTOP)/include/k5-buf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(srcdir)/../gss_libinit.h gssapiP_generic.h gssapi_err_generic.h \
-  gssapi_generic.h util_validate.c
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h gssapiP_generic.h gssapi_err_generic.h \
+  gssapi_ext.h gssapi_generic.h util_validate.c
 gssapi_err_generic.so gssapi_err_generic.po $(OUTPRE)gssapi_err_generic.$(OBJEXT): \
   $(COM_ERR_DEPS) gssapi_err_generic.c
diff --git a/src/lib/gssapi/generic/disp_com_err_status.c b/src/lib/gssapi/generic/disp_com_err_status.c
index baf7e70..d7a2e1d 100644
--- a/src/lib/gssapi/generic/disp_com_err_status.c
+++ b/src/lib/gssapi/generic/disp_com_err_status.c
@@ -26,7 +26,6 @@
  */
 
 #include "gssapiP_generic.h"
-#include "gss_libinit.h"
 #include "com_err.h"
 
 /* XXXX internationalization!! */
@@ -54,8 +53,6 @@ g_display_com_err_status(minor_status, status_value, status_string)
     status_string->length = 0;
     status_string->value = NULL;
 
-    (void) gssint_initialize_library();
-
     if (! g_make_string_buffer(((status_value == 0)?no_error:
                                 error_message(status_value)),
                                status_string)) {
diff --git a/src/lib/gssapi/generic/gssapi.hin b/src/lib/gssapi/generic/gssapi.hin
index 4dc3313..d33a0b5 100644
--- a/src/lib/gssapi/generic/gssapi.hin
+++ b/src/lib/gssapi/generic/gssapi.hin
@@ -178,6 +178,7 @@ typedef int             gss_cred_usage_t;
 #define GSS_C_AF_BSC        17
 #define GSS_C_AF_DSS        18
 #define GSS_C_AF_OSI        19
+#define GSS_C_AF_NETBIOS    20
 #define GSS_C_AF_X25        21
 
 #define GSS_C_AF_NULLADDR   255
diff --git a/src/lib/gssapi/generic/gssapiP_generic.h b/src/lib/gssapi/generic/gssapiP_generic.h
index 03f4a13..894899b 100644
--- a/src/lib/gssapi/generic/gssapiP_generic.h
+++ b/src/lib/gssapi/generic/gssapiP_generic.h
@@ -40,7 +40,7 @@
 #include "k5-thread.h"
 
 #include "gssapi_generic.h"
-
+#include "gssapi_ext.h"
 #include "gssapi_err_generic.h"
 #include <errno.h>
 
@@ -174,11 +174,15 @@ unsigned int g_token_size (const gss_OID_desc * mech, unsigned int body_size);
 void g_make_token_header (const gss_OID_desc * mech, unsigned int body_size,
                           unsigned char **buf, int tok_type);
 
+/* flags for g_verify_token_header() */
+#define	G_VFY_TOKEN_HDR_WRAPPER_REQUIRED	0x01
+#define G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZE		0x02
+
 gss_int32 g_verify_token_header (const gss_OID_desc * mech,
                                  unsigned int *body_size,
                                  unsigned char **buf, int tok_type,
                                  unsigned int toksize_in,
-                                 int wrapper_required);
+                                 int flags);
 
 OM_uint32 g_display_major_status (OM_uint32 *minor_status,
                                   OM_uint32 status_value,
@@ -257,6 +261,22 @@ generic_gss_str_to_oid(
     gss_buffer_t,       /* oid_str */
     gss_OID *);         /* oid */
 
+OM_uint32
+generic_gss_oid_compose(
+    OM_uint32 *,	/* minor_status */
+    const char *,	/* prefix */
+    size_t,		/* prefix_len */
+    int,		/* suffix */
+    gss_OID_desc *);	/* oid */
+
+OM_uint32
+generic_gss_oid_decompose(
+    OM_uint32 *,	/* minor_status */
+    const char *,	/*prefix */
+    size_t,		/* prefix_len */
+    gss_OID_desc *,	/* oid */
+    int *);		/* suffix */
+
 int gssint_mecherrmap_init(void);
 void gssint_mecherrmap_destroy(void);
 OM_uint32 gssint_mecherrmap_map(OM_uint32 minor, const gss_OID_desc *oid);
@@ -264,4 +284,22 @@ int gssint_mecherrmap_get(OM_uint32 minor, gss_OID mech_oid,
                           OM_uint32 *mech_minor);
 OM_uint32 gssint_mecherrmap_map_errcode(OM_uint32 errcode);
 
+OM_uint32 generic_gss_create_empty_buffer_set
+(OM_uint32 * /*minor_status*/,
+            gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 generic_gss_add_buffer_set_member
+(OM_uint32 * /*minor_status*/,
+            const gss_buffer_t /*member_buffer*/,
+            gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 generic_gss_release_buffer_set
+(OM_uint32 * /*minor_status*/,
+            gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 generic_gss_copy_oid_set
+(OM_uint32 *, /* minor_status */
+	    const gss_OID_set_desc *, /* const oidset*/
+	    gss_OID_set * /*new_oidset*/);
+
 #endif /* _GSSAPIP_GENERIC_H_ */
diff --git a/src/lib/gssapi/generic/gssapi_ext.h b/src/lib/gssapi/generic/gssapi_ext.h
new file mode 100644
index 0000000..40f5ab8
--- /dev/null
+++ b/src/lib/gssapi/generic/gssapi_ext.h
@@ -0,0 +1,261 @@
+/*
+ * Copyright 2008 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+#ifndef GSSAPI_EXT_H_
+#define GSSAPI_EXT_H_
+
+#include <gssapi/gssapi.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#if 0
+/*
+ * Solaris extensions
+ */
+int KRB5_CALLCONV gssd_pname_to_uid
+	(char *,
+	 gss_OID,
+	 gss_OID,
+	 uid_t *);
+
+int KRB5_CALLCONV __gss_userok
+	(const gss_name_t /*name*/,
+	 const char * /*username*/);
+#endif
+
+/*
+ * GGF extensions
+ */
+typedef struct gss_buffer_set_desc_struct {
+    size_t count;
+    gss_buffer_desc *elements;
+} gss_buffer_set_desc, *gss_buffer_set_t;
+
+#define GSS_C_NO_BUFFER_SET ((gss_buffer_set_t) 0)
+
+OM_uint32 KRB5_CALLCONV gss_create_empty_buffer_set
+	(OM_uint32 * /*minor_status*/,
+	 gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 KRB5_CALLCONV gss_add_buffer_set_member
+	(OM_uint32 * /*minor_status*/,
+	 const gss_buffer_t /*member_buffer*/,
+	 gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 KRB5_CALLCONV gss_release_buffer_set
+	(OM_uint32 * /*minor_status*/,
+	 gss_buffer_set_t * /*buffer_set*/);
+
+OM_uint32 KRB5_CALLCONV gss_inquire_sec_context_by_oid
+	(OM_uint32 * /*minor_status*/,
+	 const gss_ctx_id_t /*context_handle*/,
+	 const gss_OID /*desired_object*/,
+	 gss_buffer_set_t * /*data_set*/);
+
+OM_uint32 KRB5_CALLCONV gss_inquire_cred_by_oid
+	(OM_uint32 * /*minor_status*/,
+	 const gss_cred_id_t /*cred_handle*/,
+	 const gss_OID /*desired_object*/,
+	 gss_buffer_set_t * /*data_set*/);
+
+OM_uint32 KRB5_CALLCONV gss_set_sec_context_option
+	(OM_uint32 * /*minor_status*/,
+	 gss_ctx_id_t * /*cred_handle*/,
+	 const gss_OID /*desired_object*/,
+	 const gss_buffer_t /*value*/);
+
+/* XXX do these really belong in this header? */
+OM_uint32 KRB5_CALLCONV gssspi_set_cred_option
+	(OM_uint32 * /*minor_status*/,
+	 gss_cred_id_t /*cred*/,
+	 const gss_OID /*desired_object*/,
+	 const gss_buffer_t /*value*/);
+
+OM_uint32 KRB5_CALLCONV gssspi_mech_invoke
+	(OM_uint32 * /*minor_status*/,
+	 const gss_OID /*desired_mech*/,
+	 const gss_OID /*desired_object*/,
+	 gss_buffer_t /*value*/);
+
+/*
+ * AEAD extensions
+ */
+
+OM_uint32 KRB5_CALLCONV gss_wrap_aead
+	(OM_uint32 * /*minor_status*/,
+	 gss_ctx_id_t /*context_handle*/,
+	 int /*conf_req_flag*/,
+	 gss_qop_t /*qop_req*/,
+	 gss_buffer_t /*input_assoc_buffer*/,
+	 gss_buffer_t /*input_payload_buffer*/,
+	 int * /*conf_state*/,
+	 gss_buffer_t /*output_message_buffer*/);
+
+OM_uint32 KRB5_CALLCONV gss_unwrap_aead
+	(OM_uint32 * /*minor_status*/,
+	 gss_ctx_id_t /*context_handle*/,
+	 gss_buffer_t /*input_message_buffer*/,
+	 gss_buffer_t /*input_assoc_buffer*/,
+	 gss_buffer_t /*output_payload_buffer*/,
+	 int * /*conf_state*/,
+	 gss_qop_t * /*qop_state*/);
+
+/*
+ * SSPI extensions
+ */
+#define GSS_C_DCE_STYLE			0x1000
+#define GSS_C_IDENTIFY_FLAG		0x2000
+#define GSS_C_EXTENDED_ERROR_FLAG	0x4000
+
+/*
+ * Returns a buffer set with the first member containing the
+ * session key for SSPI compatibility. The optional second
+ * member contains an OID identifying the session key type.
+ */
+GSS_DLLIMP extern gss_OID GSS_C_INQ_SSPI_SESSION_KEY;
+
+OM_uint32 KRB5_CALLCONV gss_complete_auth_token
+	(OM_uint32 *minor_status,
+	 const gss_ctx_id_t context_handle,
+	 gss_buffer_t input_message_buffer);
+
+typedef struct gss_iov_buffer_desc_struct {
+    OM_uint32 type;
+    gss_buffer_desc buffer;
+} gss_iov_buffer_desc, *gss_iov_buffer_t;
+
+#define GSS_C_NO_IOV_BUFFER		    ((gss_iov_buffer_t)0)
+
+#define GSS_IOV_BUFFER_TYPE_EMPTY	    0
+#define GSS_IOV_BUFFER_TYPE_DATA	    1	/* Packet data */
+#define GSS_IOV_BUFFER_TYPE_HEADER	    2	/* Mechanism header */
+#define GSS_IOV_BUFFER_TYPE_MECH_PARAMS	    3	/* Mechanism specific parameters */
+#define GSS_IOV_BUFFER_TYPE_TRAILER	    7	/* Mechanism trailer */
+#define GSS_IOV_BUFFER_TYPE_PADDING	    9	/* Padding */
+#define GSS_IOV_BUFFER_TYPE_STREAM	    10	/* Complete wrap token */
+#define GSS_IOV_BUFFER_TYPE_SIGN_ONLY	    11	/* Sign only packet data */
+
+#define GSS_IOV_BUFFER_FLAG_MASK	    0xFFFF0000
+#define GSS_IOV_BUFFER_FLAG_ALLOCATE	    0x00010000	/* indicates GSS should allocate */
+#define GSS_IOV_BUFFER_FLAG_ALLOCATED	    0x00020000	/* indicates caller should free */
+
+#define GSS_IOV_BUFFER_TYPE(_type)	    ((_type) & ~(GSS_IOV_BUFFER_FLAG_MASK))
+#define GSS_IOV_BUFFER_FLAGS(_type)	    ((_type) & GSS_IOV_BUFFER_FLAG_MASK)
+
+/*
+ * Sign and optionally encrypt a sequence of buffers. The buffers
+ * shall be ordered HEADER | DATA | PADDING | TRAILER. Suitable
+ * space for the header, padding and trailer should be provided
+ * by calling gss_wrap_iov_length(), or the ALLOCATE flag should
+ * be set on those buffers.
+ *
+ * Encryption is in-place. SIGN_ONLY buffers are untouched. Only
+ * a single PADDING buffer should be provided. The order of the
+ * buffers in memory does not matter. Buffers in the IOV should
+ * be arranged in the order above, and in the case of multiple
+ * DATA buffers the sender and receiver should agree on the
+ * order.
+ *
+ * With GSS_C_DCE_STYLE it is acceptable to not provide PADDING
+ * and TRAILER, but the caller must guarantee the plaintext data
+ * being encrypted is correctly padded, otherwise an error will
+ * be returned.
+ *
+ * While applications that have knowledge of the underlying
+ * cryptosystem may request a specific configuration of data
+ * buffers, the only generally supported configurations are:
+ *
+ *  HEADER | DATA | PADDING | TRAILER
+ *
+ * which will emit GSS_Wrap() compatible tokens, and:
+ *
+ *  HEADER | SIGN_ONLY | DATA | PADDING | TRAILER
+ *
+ * for AEAD.
+ *
+ * The typical (special cased) usage for DCE is as follows:
+ *
+ *  SIGN_ONLY_1 | DATA | SIGN_ONLY_2 | HEADER
+ */
+OM_uint32 KRB5_CALLCONV gss_wrap_iov
+(
+    OM_uint32 *,	/* minor_status */
+    gss_ctx_id_t,       /* context_handle */
+    int,		/* conf_req_flag */
+    gss_qop_t,		/* qop_req */
+    int *,		/* conf_state */
+    gss_iov_buffer_desc *,    /* iov */
+    int);		/* iov_count */
+
+/*
+ * Verify and optionally decrypt a sequence of buffers. To process
+ * a GSS-API message without separate buffer, pass STREAM | DATA.
+ * Upon return DATA will contain the decrypted or integrity
+ * protected message. Only a single DATA buffer may be provided
+ * with this usage. DATA by default will point into STREAM, but if
+ * the ALLOCATE flag is set a copy will be returned.
+ *
+ * Otherwise, decryption is in-place. SIGN_ONLY buffers are
+ * untouched.
+ */
+OM_uint32 KRB5_CALLCONV gss_unwrap_iov
+(
+    OM_uint32 *,	/* minor_status */
+    gss_ctx_id_t,       /* context_handle */
+    int *,		/* conf_state */
+    gss_qop_t *,	/* qop_state */
+    gss_iov_buffer_desc *,    /* iov */
+    int);		/* iov_count */
+
+/*
+ * Query HEADER, PADDING and TRAILER buffer lengths. DATA buffers
+ * should be provided so the correct padding length can be determined.
+ */
+OM_uint32 KRB5_CALLCONV gss_wrap_iov_length
+(
+    OM_uint32 *,	/* minor_status */
+    gss_ctx_id_t,	/* context_handle */
+    int,		/* conf_req_flag */
+    gss_qop_t,		/* qop_req */
+    int *,		/* conf_state */
+    gss_iov_buffer_desc *, /* iov */
+    int);		/* iov_count */
+
+/*
+ * Release buffers that have the ALLOCATED flag set.
+ */
+OM_uint32 KRB5_CALLCONV gss_release_iov_buffer
+(
+    OM_uint32 *,	/* minor_status */
+    gss_iov_buffer_desc *, /* iov */
+    int);		/* iov_count */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* GSSAPI_EXT_H_ */
diff --git a/src/lib/gssapi/generic/gssapi_generic.c b/src/lib/gssapi/generic/gssapi_generic.c
index b5314ed..9497c3d 100644
--- a/src/lib/gssapi/generic/gssapi_generic.c
+++ b/src/lib/gssapi/generic/gssapi_generic.c
@@ -119,6 +119,9 @@ static const gss_OID_desc const_oids[] = {
      * GSS_C_NT_EXPORT_NAME should be initialized to point
      * to that gss_OID_desc.
      */
+
+    /* GSS_C_INQ_SSPI_SESSION_KEY 1.2.840.113554.1.2.2.5.5 */
+    {11, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"},
 };
 
 /* Here are the constants which point to the static structure above.
@@ -147,3 +150,6 @@ GSS_DLLIMP gss_OID GSS_C_NT_ANONYMOUS           = oids+5;
 
 GSS_DLLIMP gss_OID GSS_C_NT_EXPORT_NAME         = oids+6;
 gss_OID gss_nt_exported_name                    = oids+6;
+
+GSS_DLLIMP gss_OID GSS_C_INQ_SSPI_SESSION_KEY	= oids+7;
+
diff --git a/src/lib/gssapi/generic/gssapi_generic.h b/src/lib/gssapi/generic/gssapi_generic.h
index eee7965..cd872e6 100644
--- a/src/lib/gssapi/generic/gssapi_generic.h
+++ b/src/lib/gssapi/generic/gssapi_generic.h
@@ -38,6 +38,9 @@
 #define GSSAPIGENERIC_END_DECLS
 #endif
 
+#define	GSS_EMPTY_BUFFER(buf)	((buf) == NULL ||\
+	(buf)->value == NULL || (buf)->length == 0)
+
 GSSAPIGENERIC_BEGIN_DECLS
 
 /* Deprecated MIT krb5 oid names provided for compatibility.
diff --git a/src/lib/gssapi/generic/oid_ops.c b/src/lib/gssapi/generic/oid_ops.c
new file mode 100644
index 0000000..bd78e26
--- /dev/null
+++ b/src/lib/gssapi/generic/oid_ops.c
@@ -0,0 +1,569 @@
+/* #pragma ident	"@(#)oid_ops.c	1.19	04/02/23 SMI" */
+/*
+ * lib/gssapi/generic/oid_ops.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * oid_ops.c - GSS-API V2 interfaces to manipulate OIDs
+ */
+
+#include "gssapiP_generic.h"
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <gssapi/gssapi_generic.h>
+#include <errno.h>
+#include <ctype.h>
+
+OM_uint32
+generic_gss_release_oid(minor_status, oid)
+    OM_uint32	*minor_status;
+    gss_OID	*oid;
+{
+    if (minor_status)
+	*minor_status = 0;
+
+    if (oid == NULL || *oid == GSS_C_NO_OID)
+	return(GSS_S_COMPLETE);
+
+    /*
+     * The V2 API says the following!
+     *
+     * gss_release_oid[()] will recognize any of the GSSAPI's own OID values,
+     * and will silently ignore attempts to free these OIDs; for other OIDs
+     * it will call the C free() routine for both the OID data and the
+     * descriptor.  This allows applications to freely mix their own heap-
+     * allocated OID values with OIDs returned by GSS-API.
+     */
+
+    /*
+     * We use the official OID definitions instead of the unofficial OID
+     * defintions. But we continue to support the unofficial OID
+     * gss_nt_service_name just in case if some gss applications use
+     * the old OID.
+     */
+
+    if ((*oid != GSS_C_NT_USER_NAME) &&
+	(*oid != GSS_C_NT_MACHINE_UID_NAME) &&
+	(*oid != GSS_C_NT_STRING_UID_NAME) &&
+	(*oid != GSS_C_NT_HOSTBASED_SERVICE) &&
+	(*oid != GSS_C_NT_ANONYMOUS) &&
+	(*oid != GSS_C_NT_EXPORT_NAME) &&
+	(*oid != gss_nt_service_name)) {
+	free((*oid)->elements);
+	free(*oid);
+    }
+    *oid = GSS_C_NO_OID;
+    return(GSS_S_COMPLETE);
+}
+
+OM_uint32
+generic_gss_copy_oid(minor_status, oid, new_oid)
+	OM_uint32	*minor_status;
+	const gss_OID_desc * const oid;
+	gss_OID		*new_oid;
+{
+	gss_OID		p;
+
+	*minor_status = 0;
+
+	p = (gss_OID) malloc(sizeof(gss_OID_desc));
+	if (!p) {
+	    *minor_status = ENOMEM;
+	    return GSS_S_FAILURE;
+	}
+	p->length = oid->length;
+	p->elements = malloc(p->length);
+	if (!p->elements) {
+		free(p);
+		return GSS_S_FAILURE;
+	}
+	memcpy(p->elements, oid->elements, p->length);
+	*new_oid = p;
+	return(GSS_S_COMPLETE);
+}
+
+
+OM_uint32
+generic_gss_create_empty_oid_set(minor_status, oid_set)
+    OM_uint32	*minor_status;
+    gss_OID_set	*oid_set;
+{
+    *minor_status = 0;
+
+    if ((*oid_set = (gss_OID_set) malloc(sizeof(gss_OID_set_desc)))) {
+	memset(*oid_set, 0, sizeof(gss_OID_set_desc));
+	return(GSS_S_COMPLETE);
+    }
+    else {
+	*minor_status = ENOMEM;
+	return(GSS_S_FAILURE);
+    }
+}
+
+OM_uint32
+generic_gss_add_oid_set_member(minor_status, member_oid, oid_set)
+    OM_uint32	*minor_status;
+    const gss_OID_desc * const member_oid;
+    gss_OID_set	*oid_set;
+{
+    gss_OID	elist;
+    gss_OID	lastel;
+
+    *minor_status = 0;
+
+    if (member_oid == NULL || member_oid->length == 0 ||
+	member_oid->elements == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_READ);
+
+    elist = (*oid_set)->elements;
+    /* Get an enlarged copy of the array */
+    if (((*oid_set)->elements = (gss_OID) malloc(((*oid_set)->count+1) *
+						  sizeof(gss_OID_desc)))) {
+	/* Copy in the old junk */
+	if (elist)
+	    memcpy((*oid_set)->elements,
+		   elist,
+		   ((*oid_set)->count * sizeof(gss_OID_desc)));
+
+	/* Duplicate the input element */
+	lastel = &(*oid_set)->elements[(*oid_set)->count];
+	if ((lastel->elements =
+	     (void *) malloc((size_t) member_oid->length))) {
+	    /* Success - copy elements */
+	    memcpy(lastel->elements, member_oid->elements,
+		   (size_t) member_oid->length);
+	    /* Set length */
+	    lastel->length = member_oid->length;
+
+	    /* Update count */
+	    (*oid_set)->count++;
+	    if (elist)
+		free(elist);
+	    *minor_status = 0;
+	    return(GSS_S_COMPLETE);
+	}
+	else
+	    free((*oid_set)->elements);
+    }
+    /* Failure - restore old contents of list */
+    (*oid_set)->elements = elist;
+    *minor_status = ENOMEM;
+    return(GSS_S_FAILURE);
+}
+
+OM_uint32
+generic_gss_test_oid_set_member(minor_status, member, set, present)
+    OM_uint32	*minor_status;
+    const gss_OID_desc * const member;
+    gss_OID_set	set;
+    int		*present;
+{
+    OM_uint32	i;
+    int		result;
+
+    *minor_status = 0;
+
+    if (member == NULL || set == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_READ);
+
+    if (present == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_WRITE);
+
+    result = 0;
+    for (i=0; i<set->count; i++) {
+	if ((set->elements[i].length == member->length) &&
+	    !memcmp(set->elements[i].elements,
+		    member->elements,
+		    (size_t) member->length)) {
+	    result = 1;
+	    break;
+	}
+    }
+    *present = result;
+    return(GSS_S_COMPLETE);
+}
+
+/*
+ * OID<->string routines.  These are uuuuugly.
+ */
+OM_uint32
+generic_gss_oid_to_str(minor_status, oid, oid_str)
+    OM_uint32		*minor_status;
+    const gss_OID_desc * const oid;
+    gss_buffer_t	oid_str;
+{
+    OM_uint32		number;
+    OM_uint32 i;
+    unsigned char	*cp;
+    char		*bp;
+    struct k5buf	buf;
+
+    if (minor_status != NULL)
+	*minor_status = 0;
+
+    if (oid_str != GSS_C_NO_BUFFER) {
+	oid_str->length = 0;
+	oid_str->value = NULL;
+    }
+
+    if (oid == NULL || oid->length == 0 || oid->elements == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_READ);
+
+    if (oid_str == GSS_C_NO_BUFFER)
+	return (GSS_S_CALL_INACCESSIBLE_WRITE);
+
+    /* Decoded according to krb5/gssapi_krb5.c */
+
+    cp = (unsigned char *) oid->elements;
+    number = (unsigned long) cp[0];
+    krb5int_buf_init_dynamic(&buf);
+    krb5int_buf_add_fmt(&buf, "{ %lu %lu ", (unsigned long)number/40,
+			(unsigned long)number%40);
+    number = 0;
+    cp = (unsigned char *) oid->elements;
+    for (i=1; i<oid->length; i++) {
+	number = (number << 7) | (cp[i] & 0x7f);
+	if ((cp[i] & 0x80) == 0) {
+	    krb5int_buf_add_fmt(&buf, "%lu ", (unsigned long)number);
+	    number = 0;
+	}
+    }
+    krb5int_buf_add(&buf, "}");
+    bp = krb5int_buf_data(&buf);
+    if (bp == NULL) {
+	*minor_status = ENOMEM;
+	return(GSS_S_FAILURE);
+    }
+    oid_str->length = krb5int_buf_len(&buf)+1;
+    oid_str->value = (void *) bp;
+    return(GSS_S_COMPLETE);
+}
+
+OM_uint32
+generic_gss_str_to_oid(minor_status, oid_str, oid)
+    OM_uint32		*minor_status;
+    gss_buffer_t	oid_str;
+    gss_OID		*oid;
+{
+    unsigned char	*cp, *bp, *startp;
+    int		brace;
+    long	numbuf;
+    long	onumbuf;
+    OM_uint32	nbytes;
+    int		i;
+    unsigned char *op;
+
+    if (minor_status != NULL)
+	*minor_status = 0;
+
+    if (oid != NULL)
+	*oid = GSS_C_NO_OID;
+
+    if (GSS_EMPTY_BUFFER(oid_str))
+	return (GSS_S_CALL_INACCESSIBLE_READ);
+
+    if (oid == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_WRITE);
+
+    brace = 0;
+    bp = oid_str->value;
+    cp = bp;
+    /* Skip over leading space */
+    while ((bp < &cp[oid_str->length]) && isspace(*bp))
+	bp++;
+    if (*bp == '{') {
+	brace = 1;
+	bp++;
+    }
+    while ((bp < &cp[oid_str->length]) && isspace(*bp))
+	bp++;
+    startp = bp;
+    nbytes = 0;
+
+    /*
+     * The first two numbers are chewed up by the first octet.
+     */
+    if (sscanf((char *)bp, "%ld", &numbuf) != 1) {
+	*minor_status = EINVAL;
+	return(GSS_S_FAILURE);
+    }
+    while ((bp < &cp[oid_str->length]) && isdigit(*bp))
+	bp++;
+    while ((bp < &cp[oid_str->length]) &&
+	   (isspace(*bp) || *bp == '.'))
+	bp++;
+    if (sscanf((char *)bp, "%ld", &numbuf) != 1) {
+	*minor_status = EINVAL;
+	return(GSS_S_FAILURE);
+    }
+    while ((bp < &cp[oid_str->length]) && isdigit(*bp))
+	bp++;
+    while ((bp < &cp[oid_str->length]) &&
+	   (isspace(*bp) || *bp == '.'))
+	bp++;
+    nbytes++;
+    while (isdigit(*bp)) {
+	if (sscanf((char *)bp, "%ld", &numbuf) != 1) {
+	    return(GSS_S_FAILURE);
+	}
+	while (numbuf) {
+	    nbytes++;
+	    numbuf >>= 7;
+	}
+	while ((bp < &cp[oid_str->length]) && isdigit(*bp))
+	    bp++;
+	while ((bp < &cp[oid_str->length]) &&
+	       (isspace(*bp) || *bp == '.'))
+	    bp++;
+    }
+    if (brace && (*bp != '}')) {
+	return(GSS_S_FAILURE);
+    }
+
+    /*
+     * Phew!  We've come this far, so the syntax is good.
+     */
+    if ((*oid = (gss_OID) malloc(sizeof(gss_OID_desc)))) {
+	if (((*oid)->elements = (void *) malloc(nbytes))) {
+	    (*oid)->length = nbytes;
+	    op = (unsigned char *) (*oid)->elements;
+	    bp = startp;
+	    (void) sscanf((char *)bp, "%ld", &numbuf);
+	    while (isdigit(*bp))
+		bp++;
+	    while (isspace(*bp) || *bp == '.')
+		bp++;
+	    onumbuf = 40*numbuf;
+	    (void) sscanf((char *)bp, "%ld", &numbuf);
+	    onumbuf += numbuf;
+	    *op = (unsigned char) onumbuf;
+	    op++;
+	    while (isdigit(*bp))
+		bp++;
+	    while (isspace(*bp) || *bp == '.')
+		bp++;
+	    while (isdigit(*bp)) {
+		(void) sscanf((char *)bp, "%ld", &numbuf);
+		nbytes = 0;
+		/* Have to fill in the bytes msb-first */
+		onumbuf = numbuf;
+		while (numbuf) {
+		    nbytes++;
+		    numbuf >>= 7;
+		}
+		numbuf = onumbuf;
+		op += nbytes;
+		i = -1;
+		while (numbuf) {
+		    op[i] = (unsigned char) numbuf & 0x7f;
+		    if (i != -1)
+			op[i] |= 0x80;
+		    i--;
+		    numbuf >>= 7;
+		}
+		while (isdigit(*bp))
+		    bp++;
+		while (isspace(*bp) || *bp == '.')
+		    bp++;
+	    }
+	    return(GSS_S_COMPLETE);
+	}
+	else {
+	    free(*oid);
+	    *oid = GSS_C_NO_OID;
+	}
+    }
+    return(GSS_S_FAILURE);
+}
+
+/* Compose an OID of a prefix and an integer suffix */
+OM_uint32
+generic_gss_oid_compose(
+    OM_uint32 *minor_status,
+    const char *prefix,
+    size_t prefix_len,
+    int suffix,
+    gss_OID_desc *oid)
+{
+    int osuffix, i;
+    size_t nbytes;
+    unsigned char *op;
+
+    if (oid == GSS_C_NO_OID) {
+	*minor_status = EINVAL;
+	return GSS_S_FAILURE;
+    }
+    if (oid->length < prefix_len) {
+	*minor_status = ERANGE;
+	return GSS_S_FAILURE;
+    }
+
+    memcpy(oid->elements, prefix, prefix_len);
+
+    nbytes = 0;
+    osuffix = suffix;
+    while (suffix) {
+	nbytes++;
+	suffix >>= 7;
+    }
+    suffix = osuffix;
+
+    if (oid->length < prefix_len + nbytes) {
+	*minor_status = ERANGE;
+	return GSS_S_FAILURE;
+    }
+
+    op = oid->elements + prefix_len + nbytes;
+    i = -1;
+    while (suffix) {
+	op[i] = (unsigned char)suffix & 0x7f;
+	if (i != -1) 
+	    op[i] |= 0x80;
+	i--;
+	suffix >>= 7;
+    }
+
+    oid->length = prefix_len + nbytes;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32
+generic_gss_oid_decompose(
+    OM_uint32 *minor_status,
+    const char *prefix,
+    size_t prefix_len,
+    gss_OID_desc *oid,
+    int *suffix)
+{
+    size_t i, slen;
+    unsigned char *op;
+
+    if (oid->length < prefix_len ||
+	memcmp(oid->elements, prefix, prefix_len) != 0) {
+	return GSS_S_BAD_MECH;
+    }
+
+    op = oid->elements + prefix_len;
+
+    *suffix = 0;
+
+    slen = oid->length - prefix_len;
+
+    for (i = 0; i < slen; i++) {
+	*suffix = (*suffix << 7) | (op[i] & 0x7f);
+	if (i + 1 != slen && (op[i] & 0x80) == 0) {
+	    *minor_status = EINVAL;
+	    return GSS_S_FAILURE;
+	}
+    }
+
+    return GSS_S_COMPLETE;
+}
+
+/*
+ * Copyright 1993 by OpenVision Technologies, Inc.
+ *
+ * Permission to use, copy, modify, distribute, and sell this software
+ * and its documentation for any purpose is hereby granted without fee,
+ * provided that the above copyright notice appears in all copies and
+ * that both that copyright notice and this permission notice appear in
+ * supporting documentation, and that the name of OpenVision not be used
+ * in advertising or publicity pertaining to distribution of the software
+ * without specific, written prior permission. OpenVision makes no
+ * representations about the suitability of this software for any
+ * purpose.  It is provided "as is" without express or implied warranty.
+ *
+ * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+ * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
+ * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+OM_uint32
+generic_gss_copy_oid_set(
+    OM_uint32 *minor_status,
+    const gss_OID_set_desc * const oidset,
+    gss_OID_set *new_oidset
+    )
+{
+    gss_OID_set_desc *copy;
+    OM_uint32 minor = 0;
+    OM_uint32 major = GSS_S_COMPLETE;
+    OM_uint32 i;
+
+    if (minor_status != NULL)
+	*minor_status = 0;
+
+    if (new_oidset != NULL)
+	*new_oidset = GSS_C_NO_OID_SET;
+
+    if (oidset == GSS_C_NO_OID_SET)
+	return (GSS_S_CALL_INACCESSIBLE_READ);
+
+    if (new_oidset == NULL)
+	return (GSS_S_CALL_INACCESSIBLE_WRITE);
+
+    if ((copy = (gss_OID_set_desc *) calloc(1, sizeof (*copy))) == NULL) {
+	major = GSS_S_FAILURE;
+	goto done;
+    }
+
+    if ((copy->elements = (gss_OID_desc *)
+	 calloc(oidset->count, sizeof (*copy->elements))) == NULL) {
+	major = GSS_S_FAILURE;
+	goto done;
+    }
+    copy->count = oidset->count;
+
+    for (i = 0; i < copy->count; i++) {
+	gss_OID_desc *out = &copy->elements[i];
+	gss_OID_desc *in = &oidset->elements[i];
+
+	if ((out->elements = (void *) malloc(in->length)) == NULL) {
+	    major = GSS_S_FAILURE;
+	    goto done;
+	}
+	(void) memcpy(out->elements, in->elements, in->length);
+	out->length = in->length;
+    }
+
+    *new_oidset = copy;
+done:
+    if (major != GSS_S_COMPLETE) {
+	(void) gss_release_oid_set(&minor, &copy);
+    }
+
+    return (major);
+}
+
diff --git a/src/lib/gssapi/generic/util_buffer_set.c b/src/lib/gssapi/generic/util_buffer_set.c
new file mode 100644
index 0000000..edb61b8
--- /dev/null
+++ b/src/lib/gssapi/generic/util_buffer_set.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2008 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+#include "gssapiP_generic.h"
+#include <stdio.h>
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+#include <string.h>
+#include <errno.h>
+
+OM_uint32 generic_gss_create_empty_buffer_set
+	   (OM_uint32 * minor_status,
+	    gss_buffer_set_t *buffer_set)
+{
+    gss_buffer_set_t set;
+
+    set = (gss_buffer_set_desc *) malloc(sizeof(*set));
+    if (set == GSS_C_NO_BUFFER_SET) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    set->count = 0;
+    set->elements = NULL;
+
+    *buffer_set = set;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32 generic_gss_add_buffer_set_member
+	   (OM_uint32 * minor_status,
+	    const gss_buffer_t member_buffer,
+	    gss_buffer_set_t *buffer_set)
+{
+    gss_buffer_set_t set;
+    gss_buffer_t p;
+    OM_uint32 ret;
+
+    if (*buffer_set == GSS_C_NO_BUFFER_SET) {
+	ret = generic_gss_create_empty_buffer_set(minor_status,
+						  buffer_set);
+	if (ret) {
+	    return ret;
+	}
+    }
+
+    set = *buffer_set;
+    set->elements = (gss_buffer_desc *)realloc(set->elements,
+					       (set->count + 1) *
+						sizeof(gss_buffer_desc));
+    if (set->elements == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    p = &set->elements[set->count];
+
+    p->value = malloc(member_buffer->length);
+    if (p->value == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+    memcpy(p->value, member_buffer->value, member_buffer->length);
+    p->length = member_buffer->length;
+
+    set->count++;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32 generic_gss_release_buffer_set
+	   (OM_uint32 * minor_status,
+	    gss_buffer_set_t *buffer_set)
+{
+    int i;
+    OM_uint32 minor;
+
+    *minor_status = 0;
+
+    if (*buffer_set == GSS_C_NO_BUFFER_SET) {
+	return GSS_S_COMPLETE;
+    }
+
+    for (i = 0; i < (*buffer_set)->count; i++) {
+	generic_gss_release_buffer(&minor, &((*buffer_set)->elements[i]));
+    }
+
+    if ((*buffer_set)->elements != NULL) {
+	free((*buffer_set)->elements);
+	(*buffer_set)->elements = NULL;
+    }
+
+    (*buffer_set)->count = 0;
+
+    free(*buffer_set);
+    *buffer_set = GSS_C_NO_BUFFER_SET;
+
+    return GSS_S_COMPLETE;
+}
+
diff --git a/src/lib/gssapi/generic/util_token.c b/src/lib/gssapi/generic/util_token.c
index b37d906..24d5325 100644
--- a/src/lib/gssapi/generic/util_token.c
+++ b/src/lib/gssapi/generic/util_token.c
@@ -174,7 +174,7 @@ g_verify_token_header(
     unsigned char **buf_in,
     int tok_type,
     unsigned int toksize_in,
-    int wrapper_required)
+    int flags)
 {
     unsigned char *buf = *buf_in;
     int seqsize;
@@ -184,7 +184,7 @@ g_verify_token_header(
     if ((toksize-=1) < 0)
         return(G_BAD_TOK_HEADER);
     if (*buf++ != 0x60) {
-        if (wrapper_required)
+        if (flags & G_VFY_TOKEN_HDR_WRAPPER_REQUIRED)
             return(G_BAD_TOK_HEADER);
         buf--;
         toksize++;
@@ -194,7 +194,8 @@ g_verify_token_header(
     if ((seqsize = der_read_length(&buf, &toksize)) < 0)
         return(G_BAD_TOK_HEADER);
 
-    if (seqsize != toksize)
+    if ((flags & G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZE) == 0 &&
+	seqsize != toksize)
         return(G_BAD_TOK_HEADER);
 
     if ((toksize-=1) < 0)
diff --git a/src/lib/gssapi/generic/util_validate.c b/src/lib/gssapi/generic/util_validate.c
index 24a1bc5..00dac32 100644
--- a/src/lib/gssapi/generic/util_validate.c
+++ b/src/lib/gssapi/generic/util_validate.c
@@ -30,7 +30,6 @@
  */
 
 #include "gssapiP_generic.h"
-#include "gss_libinit.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@@ -73,9 +72,6 @@ static int g_save(db, type, ptr)
     vkey vk;
     DBT key;
 
-    ret = gssint_initialize_library();
-    if (ret)
-        return 0;
     ret = k5_mutex_lock(&db->mutex);
     if (ret)
         return 0;
@@ -97,9 +93,6 @@ static int g_save(db, type, ptr)
 #else
     g_set_elt *gs;
 
-    ret = gssint_initialize_library();
-    if (ret)
-        return 0;
     ret = k5_mutex_lock(&db->mutex);
     if (ret)
         return 0;