Changes 1.4:

New features
* Support for reading MIT database file directly
* KCM is polished up and now used in production
* NTLM first class citizen, credentials stored in KCM
* Table driven ASN.1 compiler, smaller!, not enabled by default
* Native Windows client support
Notes
* Disabled write support NDBM hdb backend (read still in there) since
  it can't handle large records, please migrate to a diffrent backend
  (like BDB4)

Changes 1.3.3:
Bug fixes
* Check the GSS-API checksum exists before trying to use it [CVE-2010-1321]
* Check NULL pointers before dereference them [kdc]

Changes 1.3.2:
Bug fixes
* Don't mix length when clearing hmac (could memset too much)
* More paranoid underrun checking when decrypting packets
* Check the password change requests and refuse to answer empty packets
* Build on OpenSolaris
* Renumber AD-SIGNED-TICKET since it was stolen from US
* Don't cache /dev/*random file descriptor, it doesn't get unloaded
* Make C++ safe
* Misc warnings

15 files changed, 463 insertions, 333 deletions

diff --git a/security/heimdal/Makefile b/security/heimdal/Makefile
index 7da62635db0..dc7fb33c424 100644
--- a/security/heimdal/Makefile
+++ b/security/heimdal/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.79 2010/03/23 15:37:56 wiz Exp $
+# $NetBSD: Makefile,v 1.80 2011/07/08 09:49:21 adam Exp $
 
-DISTNAME=	heimdal-1.1
-PKGREVISION=	5
+DISTNAME=	heimdal-1.4
 CATEGORIES=	security
 MASTER_SITES=	http://www.h5l.org/dist/src/
 
@@ -30,27 +29,28 @@ MAKE_ENV+=		INSTALL_CATPAGES=no
 HEIMDAL_HDB_DIR=	${VARBASE}/heimdal
 
 GNU_CONFIGURE=		yes
-CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR:Q}
-CONFIGURE_ARGS+=	--includedir=${PREFIX}/include/krb5
-CONFIGURE_ARGS+=	--with-hdbdir=${HEIMDAL_HDB_DIR:H:Q}
-CONFIGURE_ARGS+=	--without-x
-CONFIGURE_ARGS+=	--without-krb4
 CONFIGURE_ARGS+=	--enable-kcm
+CONFIGURE_ARGS+=	--enable-pthread-support
+CONFIGURE_ARGS+=	--includedir=${PREFIX}/include/krb5
+CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR}
+CONFIGURE_ARGS+=	--with-hdbdir=${HEIMDAL_HDB_DIR:H}
 CONFIGURE_ARGS+=	--with-openssl=${SSLBASE:Q}
+CONFIGURE_ARGS+=	--with-sqlite3=${BUILDLINK_PREFIX.sqlite3}
+CONFIGURE_ARGS+=	--without-x
 CONFIGURE_ARGS+=	${ABI:D--with-mips-abi=${ABI}}
 CONFIGURE_ENV+=		COMPILE_ET=no	# build Heimdal's compile_et(1)
+# XXX Grand Central Dispatch is broken in 1.4
+CONFIGURE_ENV+=		ac_cv_funclib_dispatch_async_f=no
 
 CFLAGS.Darwin+=		-DBIND_8_COMPAT
 
 # Though Solaris has a <vis.h> header, it does something very unrelated
 # to the BSD <vis.h> header.
-#
 OPSYSVARS+=		CONFIGURE_ENV
 CONFIGURE_ENV.SunOS+=	ac_cv_header_vis_h=no
 
 # Heimdal's configure script expects to find the readline.h header as
 # <readline.h>.
-#
 CONFIGURE_ARGS+=	--with-readline=${BUILDLINK_PREFIX.readline}
 CPPFLAGS+=		-I${BUILDLINK_PREFIX.readline}/include/readline
 
@@ -70,12 +70,19 @@ INFO_FILES=		yes
 
 # Dynamically determine the "replacement" headers for bits needed by
 # Heimdal but are missing in the base system and add them to the PLIST.
-#
 GENERATE_PLIST+=	\
 	( cd ${WRKSRC}/lib/roken && ${BUILD_MAKE_CMD} print-xheaders |	\
 	  ${XARGS} -n 1 | ${SED} -e "s,^,include/krb5/roken/," );
 
+# remove manpages conficting with OpenSSL keeping only the important ones
+pre-configure:
+	cd ${WRKSRC}/doc/doxyout/hcrypto && \
+	${GREP} -e /hcrypto_ -e /page_ manpages > manpages.new && \
+	mv manpages.new manpages
+
+.include "../../databases/sqlite3/buildlink3.mk"
 .include "../../devel/readline/buildlink3.mk"
 .include "../../security/openssl/buildlink3.mk"
 .include "../../mk/bdb.buildlink3.mk"
+.include "../../mk/pthread.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/heimdal/PLIST b/security/heimdal/PLIST
index 299926b7435..11b45b19011 100644
--- a/security/heimdal/PLIST
+++ b/security/heimdal/PLIST
@@ -1,8 +1,9 @@
-@comment $NetBSD: PLIST,v 1.18 2009/06/14 18:13:29 joerg Exp $
+@comment $NetBSD: PLIST,v 1.19 2011/07/08 09:49:21 adam Exp $
 bin/afslog
 bin/compile_et
 bin/gss
 bin/hxtool
+bin/idn-lookup
 bin/kauth
 bin/kdestroy
 bin/kf
@@ -13,7 +14,7 @@ bin/klist
 bin/kpasswd
 bin/krb5-config
 bin/${KRB5_PREFIX}login
-bin/mk_cmds
+bin/kswitch
 bin/otp
 bin/otpprint
 bin/pagsh
@@ -24,25 +25,29 @@ bin/string2key
 bin/${KRB5_PREFIX}su
 bin/${KRB5_PREFIX}telnet
 bin/verify_krb5_conf
+include/krb5/asn1-common.h
 include/krb5/asn1_err.h
 include/krb5/base64.h
 include/krb5/cms_asn1.h
 include/krb5/com_err.h
 include/krb5/com_right.h
+include/krb5/crmf_asn1.h
+include/krb5/der-private.h
 include/krb5/der-protos.h
 include/krb5/der.h
 include/krb5/digest_asn1.h
-include/krb5/editline.h
 include/krb5/getarg.h
 include/krb5/gssapi.h
 include/krb5/gssapi/gkrb5_err.h
 include/krb5/gssapi/gssapi.h
 include/krb5/gssapi/gssapi_krb5.h
+include/krb5/gssapi/gssapi_ntlm.h
 include/krb5/gssapi/gssapi_spnego.h
 include/krb5/hdb-protos.h
 include/krb5/hdb.h
 include/krb5/hdb_asn1.h
 include/krb5/hdb_err.h
+include/krb5/heim-ipc.h
 include/krb5/heim_asn1.h
 include/krb5/heim_err.h
 include/krb5/heimntlm-protos.h
@@ -55,6 +60,7 @@ include/krb5/k524_err.h
 include/krb5/kadm5/admin.h
 include/krb5/kadm5/kadm5-private.h
 include/krb5/kadm5/kadm5-protos.h
+include/krb5/kadm5/kadm5-pwcheck.h
 include/krb5/kadm5/kadm5_err.h
 include/krb5/kadm5/private.h
 include/krb5/kafs.h
@@ -65,15 +71,18 @@ include/krb5/krb5-protos.h
 include/krb5/krb5-types.h
 include/krb5/krb5.h
 include/krb5/krb5/locate_plugin.h
+include/krb5/krb5/send_to_kdc_plugin.h
 include/krb5/krb5/windc_plugin.h
 include/krb5/krb5_asn1.h
 include/krb5/krb5_ccapi.h
 include/krb5/krb5_err.h
 include/krb5/kx509_asn1.h
+include/krb5/ocsp_asn1.h
 include/krb5/otp.h
 include/krb5/parse_bytes.h
 include/krb5/parse_time.h
 include/krb5/parse_units.h
+include/krb5/pkcs10_asn1.h
 include/krb5/pkcs12_asn1.h
 include/krb5/pkcs8_asn1.h
 include/krb5/pkcs9_asn1.h
@@ -84,14 +93,14 @@ include/krb5/roken-common.h
 include/krb5/roken.h
 include/krb5/rtbl.h
 include/krb5/sl.h
-include/krb5/ss/ss.h
+include/krb5/wind.h
+include/krb5/wind_err.h
 include/krb5/xdbm.h
 info/heimdal.info
 info/hx509.info
 ${PLIST.afskauth}lib/afskauthlib.so
 lib/libasn1.la
 lib/libcom_err.la
-lib/libeditline.la
 lib/libgssapi.la
 ${PLIST.hcrypto}lib/libhcrypto.la
 lib/libhdb.la
@@ -105,9 +114,13 @@ lib/libkrb5.la
 lib/libotp.la
 lib/libroken.la
 lib/libsl.la
-lib/libss.la
+lib/libwind.la
 lib/pkgconfig/heimdal-gssapi.pc
 lib/windc.la
+libexec/digest-service
+libexec/heimdal/asn1_compile
+libexec/heimdal/asn1_print
+libexec/heimdal/slc
 libexec/hprop
 libexec/hpropd
 libexec/ipropd-master
@@ -125,16 +138,15 @@ libexec/push
 libexec/${KRB5_PREFIX}rshd
 libexec/${KRB5_PREFIX}telnetd
 man/man1/afslog.1
-man/man1/kauth.1
 man/man1/kdestroy.1
 man/man1/kf.1
 man/man1/kftp.1
 man/man1/kgetcred.1
-man/man1/kimpersonate.1
 man/man1/kinit.1
 man/man1/klist.1
 man/man1/kpasswd.1
 man/man1/krb5-config.1
+man/man1/kswitch.1
 man/man1/kx.1
 man/man1/${KRB5_PREFIX}login.1
 man/man1/otp.1
@@ -149,15 +161,24 @@ man/man1/${KRB5_PREFIX}su.1
 man/man1/${KRB5_PREFIX}telnet.1
 man/man1/tenletxr.1
 man/man1/xnlock.1
+man/man3/HDB.3
+man/man3/__gss_c_attr_stream_sizes_oid_desc.3
 man/man3/arg_printusage.3
+man/man3/challange.3
+man/man3/context.3
+man/man3/data.3
+man/man3/dnsdomainname.3
+man/man3/dnsservername.3
+man/man3/domain.3
+man/man3/domainname.3
 man/man3/ecalloc.3
-man/man3/editline.3
 man/man3/emalloc.3
 man/man3/eread.3
 man/man3/erealloc.3
 man/man3/esetenv.3
 man/man3/estrdup.3
 man/man3/ewrite.3
+man/man3/flags.3
 man/man3/getarg.3
 man/man3/gss_accept_sec_context.3
 man/man3/gss_acquire_cred.3
@@ -189,9 +210,11 @@ man/man3/gss_krb5_copy_ccache.3
 man/man3/gss_krb5_get_tkt_flags.3
 man/man3/gss_krb5_import_ccache.3
 man/man3/gss_krb5_import_cred.3
+man/man3/gss_oid_equal.3
 man/man3/gss_process_context_token.3
 man/man3/gss_release_buffer.3
 man/man3/gss_release_cred.3
+man/man3/gss_release_iov_buffer.3
 man/man3/gss_release_name.3
 man/man3/gss_release_oid_set.3
 man/man3/gss_seal.3
@@ -199,13 +222,225 @@ man/man3/gss_sign.3
 man/man3/gss_test_oid_set_member.3
 man/man3/gss_unseal.3
 man/man3/gss_unwrap.3
+man/man3/gss_unwrap_iov.3
 man/man3/gss_verify.3
 man/man3/gss_verify_mic.3
 man/man3/gss_wrap.3
+man/man3/gss_wrap_iov.3
+man/man3/gss_wrap_iov_length.3
 man/man3/gss_wrap_size_limit.3
 man/man3/gssapi.3
+man/man3/gssapi_mechs_intro.3
+man/man3/gssapi_services_intro.3
 man/man3/gsskrb5_extract_authz_data_from_sec_context.3
 man/man3/gsskrb5_register_acceptor_identity.3
+man/man3/hcrypto_core.3
+man/man3/hcrypto_des.3
+man/man3/hcrypto_dh.3
+man/man3/hcrypto_evp.3
+man/man3/hcrypto_misc.3
+man/man3/hcrypto_rand.3
+man/man3/hcrypto_rsa.3
+man/man3/hdb__del.3
+man/man3/hdb__get.3
+man/man3/hdb__put.3
+man/man3/hdb_auth_status.3
+man/man3/hdb_check_constrained_delegation.3
+man/man3/hdb_check_pkinit_ms_upn_match.3
+man/man3/hdb_close.3
+man/man3/hdb_destroy.3
+man/man3/hdb_fetch.3
+man/man3/hdb_firstkey.3
+man/man3/hdb_free.3
+man/man3/hdb_get_realms.3
+man/man3/hdb_lock.3
+man/man3/hdb_name.3
+man/man3/hdb_nextkey.3
+man/man3/hdb_open.3
+man/man3/hdb_password.3
+man/man3/hdb_remove.3
+man/man3/hdb_rename.3
+man/man3/hdb_store.3
+man/man3/hdb_unlock.3
+man/man3/heim_ntlm_build_ntlm1_master.3
+man/man3/heim_ntlm_calculate_ntlm1.3
+man/man3/heim_ntlm_calculate_ntlm2.3
+man/man3/heim_ntlm_decode_targetinfo.3
+man/man3/heim_ntlm_encode_targetinfo.3
+man/man3/heim_ntlm_encode_type1.3
+man/man3/heim_ntlm_encode_type2.3
+man/man3/heim_ntlm_encode_type3.3
+man/man3/heim_ntlm_free_buf.3
+man/man3/heim_ntlm_free_targetinfo.3
+man/man3/heim_ntlm_free_type1.3
+man/man3/heim_ntlm_free_type2.3
+man/man3/heim_ntlm_free_type3.3
+man/man3/heim_ntlm_nt_key.3
+man/man3/heim_ntlm_ntlmv2_key.3
+man/man3/heim_ntlm_verify_ntlm2.3
+man/man3/hostname.3
+man/man3/hx509.3
+man/man3/hx509_bitstring_print.3
+man/man3/hx509_ca.3
+man/man3/hx509_ca_sign.3
+man/man3/hx509_ca_sign_self.3
+man/man3/hx509_ca_tbs_add_crl_dp_uri.3
+man/man3/hx509_ca_tbs_add_eku.3
+man/man3/hx509_ca_tbs_add_san_hostname.3
+man/man3/hx509_ca_tbs_add_san_jid.3
+man/man3/hx509_ca_tbs_add_san_ms_upn.3
+man/man3/hx509_ca_tbs_add_san_otherName.3
+man/man3/hx509_ca_tbs_add_san_pkinit.3
+man/man3/hx509_ca_tbs_add_san_rfc822name.3
+man/man3/hx509_ca_tbs_free.3
+man/man3/hx509_ca_tbs_init.3
+man/man3/hx509_ca_tbs_set_ca.3
+man/man3/hx509_ca_tbs_set_domaincontroller.3
+man/man3/hx509_ca_tbs_set_notAfter.3
+man/man3/hx509_ca_tbs_set_notAfter_lifetime.3
+man/man3/hx509_ca_tbs_set_notBefore.3
+man/man3/hx509_ca_tbs_set_proxy.3
+man/man3/hx509_ca_tbs_set_serialnumber.3
+man/man3/hx509_ca_tbs_set_spki.3
+man/man3/hx509_ca_tbs_set_subject.3
+man/man3/hx509_ca_tbs_set_template.3
+man/man3/hx509_ca_tbs_set_unique.3
+man/man3/hx509_ca_tbs_subject_expand.3
+man/man3/hx509_ca_tbs_template_units.3
+man/man3/hx509_cert.3
+man/man3/hx509_cert_binary.3
+man/man3/hx509_cert_check_eku.3
+man/man3/hx509_cert_cmp.3
+man/man3/hx509_cert_find_subjectAltName_otherName.3
+man/man3/hx509_cert_free.3
+man/man3/hx509_cert_get_SPKI.3
+man/man3/hx509_cert_get_SPKI_AlgorithmIdentifier.3
+man/man3/hx509_cert_get_attribute.3
+man/man3/hx509_cert_get_base_subject.3
+man/man3/hx509_cert_get_friendly_name.3
+man/man3/hx509_cert_get_issuer.3
+man/man3/hx509_cert_get_issuer_unique_id.3
+man/man3/hx509_cert_get_notAfter.3
+man/man3/hx509_cert_get_notBefore.3
+man/man3/hx509_cert_get_serialnumber.3
+man/man3/hx509_cert_get_subject.3
+man/man3/hx509_cert_get_subject_unique_id.3
+man/man3/hx509_cert_init.3
+man/man3/hx509_cert_init_data.3
+man/man3/hx509_cert_keyusage_print.3
+man/man3/hx509_cert_ref.3
+man/man3/hx509_cert_set_friendly_name.3
+man/man3/hx509_certs_add.3
+man/man3/hx509_certs_append.3
+man/man3/hx509_certs_end_seq.3
+man/man3/hx509_certs_filter.3
+man/man3/hx509_certs_find.3
+man/man3/hx509_certs_free.3
+man/man3/hx509_certs_info.3
+man/man3/hx509_certs_init.3
+man/man3/hx509_certs_iter_f.3
+man/man3/hx509_certs_merge.3
+man/man3/hx509_certs_next_cert.3
+man/man3/hx509_certs_start_seq.3
+man/man3/hx509_certs_store.3
+man/man3/hx509_ci_print_names.3
+man/man3/hx509_clear_error_string.3
+man/man3/hx509_cms.3
+man/man3/hx509_cms_create_signed_1.3
+man/man3/hx509_cms_envelope_1.3
+man/man3/hx509_cms_unenvelope.3
+man/man3/hx509_cms_unwrap_ContentInfo.3
+man/man3/hx509_cms_verify_signed.3
+man/man3/hx509_cms_wrap_ContentInfo.3
+man/man3/hx509_context_free.3
+man/man3/hx509_context_init.3
+man/man3/hx509_context_set_missing_revoke.3
+man/man3/hx509_crl_add_revoked_certs.3
+man/man3/hx509_crl_alloc.3
+man/man3/hx509_crl_free.3
+man/man3/hx509_crl_lifetime.3
+man/man3/hx509_crl_sign.3
+man/man3/hx509_crypto.3
+man/man3/hx509_env.3
+man/man3/hx509_env_add.3
+man/man3/hx509_env_add_binding.3
+man/man3/hx509_env_find.3
+man/man3/hx509_env_find_binding.3
+man/man3/hx509_env_free.3
+man/man3/hx509_env_lfind.3
+man/man3/hx509_err.3
+man/man3/hx509_error.3
+man/man3/hx509_free_error_string.3
+man/man3/hx509_free_octet_string_list.3
+man/man3/hx509_general_name_unparse.3
+man/man3/hx509_get_error_string.3
+man/man3/hx509_get_one_cert.3
+man/man3/hx509_keyset.3
+man/man3/hx509_lock.3
+man/man3/hx509_misc.3
+man/man3/hx509_name.3
+man/man3/hx509_name_binary.3
+man/man3/hx509_name_cmp.3
+man/man3/hx509_name_copy.3
+man/man3/hx509_name_expand.3
+man/man3/hx509_name_free.3
+man/man3/hx509_name_is_null_p.3
+man/man3/hx509_name_to_Name.3
+man/man3/hx509_name_to_string.3
+man/man3/hx509_ocsp_request.3
+man/man3/hx509_ocsp_verify.3
+man/man3/hx509_oid_print.3
+man/man3/hx509_oid_sprint.3
+man/man3/hx509_parse_name.3
+man/man3/hx509_peer.3
+man/man3/hx509_peer_info_add_cms_alg.3
+man/man3/hx509_peer_info_alloc.3
+man/man3/hx509_peer_info_free.3
+man/man3/hx509_peer_info_set_cert.3
+man/man3/hx509_peer_info_set_cms_algs.3
+man/man3/hx509_print.3
+man/man3/hx509_print_cert.3
+man/man3/hx509_print_stdout.3
+man/man3/hx509_query.3
+man/man3/hx509_query_alloc.3
+man/man3/hx509_query_free.3
+man/man3/hx509_query_match_cmp_func.3
+man/man3/hx509_query_match_eku.3
+man/man3/hx509_query_match_friendly_name.3
+man/man3/hx509_query_match_issuer_serial.3
+man/man3/hx509_query_match_option.3
+man/man3/hx509_query_statistic_file.3
+man/man3/hx509_query_unparse_stats.3
+man/man3/hx509_revoke.3
+man/man3/hx509_revoke_add_crl.3
+man/man3/hx509_revoke_add_ocsp.3
+man/man3/hx509_revoke_free.3
+man/man3/hx509_revoke_init.3
+man/man3/hx509_revoke_ocsp_print.3
+man/man3/hx509_revoke_verify.3
+man/man3/hx509_set_error_string.3
+man/man3/hx509_set_error_stringv.3
+man/man3/hx509_unparse_der_name.3
+man/man3/hx509_validate_cert.3
+man/man3/hx509_validate_ctx_add_flags.3
+man/man3/hx509_validate_ctx_free.3
+man/man3/hx509_validate_ctx_init.3
+man/man3/hx509_validate_ctx_set_print.3
+man/man3/hx509_verify.3
+man/man3/hx509_verify_attach_anchors.3
+man/man3/hx509_verify_attach_revoke.3
+man/man3/hx509_verify_ctx_f_allow_default_trustanchors.3
+man/man3/hx509_verify_destroy_ctx.3
+man/man3/hx509_verify_hostname.3
+man/man3/hx509_verify_init_ctx.3
+man/man3/hx509_verify_path.3
+man/man3/hx509_verify_set_max_depth.3
+man/man3/hx509_verify_set_proxy_certificate.3
+man/man3/hx509_verify_set_strict_rfc3280_verification.3
+man/man3/hx509_verify_set_time.3
+man/man3/hx509_verify_signature.3
+man/man3/hx509_xfree.3
+man/man3/internalvsmechname.3
 man/man3/k_afs_cell_of_file.3
 man/man3/k_hasafs.3
 man/man3/k_hasafs_recheck.3
@@ -227,8 +462,7 @@ man/man3/krb524_convert_creds_kdc_ccache.3
 man/man3/krb5_425_conv_principal.3
 man/man3/krb5_425_conv_principal_ext.3
 man/man3/krb5_524_conv_principal.3
-man/man3/krb5_abort.3
-man/man3/krb5_abortx.3
+man/man3/krb5_acc_ops.3
 man/man3/krb5_acl_match_file.3
 man/man3/krb5_acl_match_string.3
 man/man3/krb5_add_et_list.3
@@ -240,10 +474,11 @@ man/man3/krb5_addr2sockaddr.3
 man/man3/krb5_address.3
 man/man3/krb5_address_compare.3
 man/man3/krb5_address_order.3
+man/man3/krb5_address_prefixlen_boundary.3
 man/man3/krb5_address_search.3
-man/man3/krb5_addresses.3
 man/man3/krb5_afslog.3
 man/man3/krb5_afslog_uid.3
+man/man3/krb5_allow_weak_crypto.3
 man/man3/krb5_aname_to_localname.3
 man/man3/krb5_anyaddr.3
 man/man3/krb5_appdefault.3
@@ -251,6 +486,7 @@ man/man3/krb5_appdefault_boolean.3
 man/man3/krb5_appdefault_string.3
 man/man3/krb5_appdefault_time.3
 man/man3/krb5_append_addresses.3
+man/man3/krb5_auth.3
 man/man3/krb5_auth_con_addflags.3
 man/man3/krb5_auth_con_free.3
 man/man3/krb5_auth_con_genaddrs.3
@@ -305,16 +541,26 @@ man/man3/krb5_c_set_checksum.3
 man/man3/krb5_c_valid_cksumtype.3
 man/man3/krb5_c_valid_enctype.3
 man/man3/krb5_c_verify_checksum.3
+man/man3/krb5_cc_cache_end_seq_get.3
+man/man3/krb5_cc_cache_get_first.3
+man/man3/krb5_cc_cache_match.3
+man/man3/krb5_cc_cache_next.3
 man/man3/krb5_cc_clear_mcred.3
 man/man3/krb5_cc_close.3
 man/man3/krb5_cc_copy_cache.3
-man/man3/krb5_cc_cursor.3
+man/man3/krb5_cc_copy_creds.3
+man/man3/krb5_cc_copy_match_f.3
 man/man3/krb5_cc_default.3
 man/man3/krb5_cc_default_name.3
 man/man3/krb5_cc_destroy.3
 man/man3/krb5_cc_end_seq_get.3
 man/man3/krb5_cc_gen_new.3
+man/man3/krb5_cc_get_config.3
+man/man3/krb5_cc_get_flags.3
+man/man3/krb5_cc_get_friendly_name.3
 man/man3/krb5_cc_get_full_name.3
+man/man3/krb5_cc_get_kdc_offset.3
+man/man3/krb5_cc_get_lifetime.3
 man/man3/krb5_cc_get_name.3
 man/man3/krb5_cc_get_ops.3
 man/man3/krb5_cc_get_prefix_ops.3
@@ -322,19 +568,29 @@ man/man3/krb5_cc_get_principal.3
 man/man3/krb5_cc_get_type.3
 man/man3/krb5_cc_get_version.3
 man/man3/krb5_cc_initialize.3
+man/man3/krb5_cc_last_change_time.3
+man/man3/krb5_cc_move.3
 man/man3/krb5_cc_new_unique.3
 man/man3/krb5_cc_next_cred.3
-man/man3/krb5_cc_next_cred_match.3
-man/man3/krb5_cc_ops.3
 man/man3/krb5_cc_register.3
 man/man3/krb5_cc_remove_cred.3
 man/man3/krb5_cc_resolve.3
 man/man3/krb5_cc_retrieve_cred.3
+man/man3/krb5_cc_set_config.3
 man/man3/krb5_cc_set_default_name.3
 man/man3/krb5_cc_set_flags.3
+man/man3/krb5_cc_set_friendly_name.3
+man/man3/krb5_cc_set_kdc_offset.3
 man/man3/krb5_cc_start_seq_get.3
 man/man3/krb5_cc_store_cred.3
+man/man3/krb5_cc_support_switch.3
+man/man3/krb5_cc_switch.3
 man/man3/krb5_ccache.3
+man/man3/krb5_ccache_intro.3
+man/man3/krb5_cccol_cursor_free.3
+man/man3/krb5_cccol_cursor_new.3
+man/man3/krb5_cccol_cursor_next.3
+man/man3/krb5_cccol_last_change_time.3
 man/man3/krb5_change_password.3
 man/man3/krb5_check_transited.3
 man/man3/krb5_check_transited_realms.3
@@ -343,34 +599,26 @@ man/man3/krb5_checksum_disable.3
 man/man3/krb5_checksum_is_collision_proof.3
 man/man3/krb5_checksum_is_keyed.3
 man/man3/krb5_checksumsize.3
+man/man3/krb5_cksumtype_to_enctype.3
 man/man3/krb5_cksumtype_valid.3
-man/man3/krb5_clear_error_string.3
+man/man3/krb5_clear_error_message.3
 man/man3/krb5_closelog.3
 man/man3/krb5_compare_creds.3
-man/man3/krb5_config.3
 man/man3/krb5_config_file_free.3
 man/man3/krb5_config_free_strings.3
-man/man3/krb5_config_get.3
 man/man3/krb5_config_get_bool.3
 man/man3/krb5_config_get_bool_default.3
-man/man3/krb5_config_get_int.3
-man/man3/krb5_config_get_int_default.3
 man/man3/krb5_config_get_list.3
-man/man3/krb5_config_get_next.3
 man/man3/krb5_config_get_string.3
 man/man3/krb5_config_get_string_default.3
 man/man3/krb5_config_get_strings.3
 man/man3/krb5_config_get_time.3
 man/man3/krb5_config_get_time_default.3
-man/man3/krb5_config_parse_file.3
 man/man3/krb5_config_parse_file_multi.3
-man/man3/krb5_config_vget.3
+man/man3/krb5_config_parse_string_multi.3
 man/man3/krb5_config_vget_bool.3
 man/man3/krb5_config_vget_bool_default.3
-man/man3/krb5_config_vget_int.3
-man/man3/krb5_config_vget_int_default.3
 man/man3/krb5_config_vget_list.3
-man/man3/krb5_config_vget_next.3
 man/man3/krb5_config_vget_string.3
 man/man3/krb5_config_vget_string_default.3
 man/man3/krb5_config_vget_strings.3
@@ -380,6 +628,7 @@ man/man3/krb5_context.3
 man/man3/krb5_copy_address.3
 man/man3/krb5_copy_addresses.3
 man/man3/krb5_copy_checksum.3
+man/man3/krb5_copy_context.3
 man/man3/krb5_copy_creds.3
 man/man3/krb5_copy_creds_contents.3
 man/man3/krb5_copy_data.3
@@ -389,16 +638,21 @@ man/man3/krb5_copy_keyblock_contents.3
 man/man3/krb5_copy_principal.3
 man/man3/krb5_copy_ticket.3
 man/man3/krb5_create_checksum.3
+man/man3/krb5_create_checksum_iov.3
+man/man3/krb5_credential.3
 man/man3/krb5_creds.3
+man/man3/krb5_creds_get_ticket_flags.3
+man/man3/krb5_crypto.3
 man/man3/krb5_crypto_destroy.3
+man/man3/krb5_crypto_fx_cf2.3
 man/man3/krb5_crypto_get_checksum_type.3
 man/man3/krb5_crypto_getblocksize.3
 man/man3/krb5_crypto_getconfoundersize.3
 man/man3/krb5_crypto_getenctype.3
 man/man3/krb5_crypto_getpadsize.3
 man/man3/krb5_crypto_init.3
+man/man3/krb5_crypto_iov.3
 man/man3/krb5_crypto_overhead.3
-man/man3/krb5_data.3
 man/man3/krb5_data_alloc.3
 man/man3/krb5_data_cmp.3
 man/man3/krb5_data_copy.3
@@ -407,8 +661,10 @@ man/man3/krb5_data_realloc.3
 man/man3/krb5_data_zero.3
 man/man3/krb5_decrypt.3
 man/man3/krb5_decrypt_EncryptedData.3
+man/man3/krb5_decrypt_iov_ivec.3
 man/man3/krb5_decrypt_ivec.3
 man/man3/krb5_decrypt_ticket.3
+man/man3/krb5_deprecated.3
 man/man3/krb5_digest.3
 man/man3/krb5_digest_alloc.3
 man/man3/krb5_digest_free.3
@@ -421,6 +677,7 @@ man/man3/krb5_digest_get_rsp.3
 man/man3/krb5_digest_get_server_nonce.3
 man/man3/krb5_digest_get_tickets.3
 man/man3/krb5_digest_init_request.3
+man/man3/krb5_digest_probe.3
 man/man3/krb5_digest_request.3
 man/man3/krb5_digest_set_authentication_user.3
 man/man3/krb5_digest_set_authid.3
@@ -443,17 +700,20 @@ man/man3/krb5_domain_x500_encode.3
 man/man3/krb5_eai_to_heim_errno.3
 man/man3/krb5_encrypt.3
 man/man3/krb5_encrypt_EncryptedData.3
+man/man3/krb5_encrypt_iov_ivec.3
 man/man3/krb5_encrypt_ivec.3
 man/man3/krb5_enctype_disable.3
+man/man3/krb5_enctype_enable.3
 man/man3/krb5_enctype_keysize.3
 man/man3/krb5_enctype_to_string.3
 man/man3/krb5_enctype_valid.3
-man/man3/krb5_err.3
+man/man3/krb5_enctypes_compatible_keys.3
+man/man3/krb5_error.3
 man/man3/krb5_error_from_rd_error.3
-man/man3/krb5_errx.3
 man/man3/krb5_expand_hostname.3
 man/man3/krb5_expand_hostname_realms.3
 man/man3/krb5_fcc_ops.3
+man/man3/krb5_fileformats.3
 man/man3/krb5_find_padata.3
 man/man3/krb5_format_time.3
 man/man3/krb5_free_address.3
@@ -465,6 +725,7 @@ man/man3/krb5_free_config_files.3
 man/man3/krb5_free_context.3
 man/man3/krb5_free_cred_contents.3
 man/man3/krb5_free_creds.3
+man/man3/krb5_free_creds_contents.3
 man/man3/krb5_free_data.3
 man/man3/krb5_free_data_contents.3
 man/man3/krb5_free_error.3
@@ -480,13 +741,9 @@ man/man3/krb5_free_salt.3
 man/man3/krb5_free_ticket.3
 man/man3/krb5_fwd_tgt_creds.3
 man/man3/krb5_generate_random_block.3
-man/man3/krb5_generate_random_keyblock.3
-man/man3/krb5_generate_subkey.3
 man/man3/krb5_generate_subkey_extended.3
 man/man3/krb5_get_all_client_addrs.3
 man/man3/krb5_get_all_server_addrs.3
-man/man3/krb5_get_cred_from_kdc.3
-man/man3/krb5_get_cred_from_kdc_opt.3
 man/man3/krb5_get_credentials.3
 man/man3/krb5_get_credentials_with_flags.3
 man/man3/krb5_get_creds.3
@@ -498,13 +755,12 @@ man/man3/krb5_get_creds_opt_set_impersonate.3
 man/man3/krb5_get_creds_opt_set_options.3
 man/man3/krb5_get_creds_opt_set_ticket.3
 man/man3/krb5_get_default_config_files.3
+man/man3/krb5_get_default_in_tkt_etypes.3
 man/man3/krb5_get_default_principal.3
 man/man3/krb5_get_default_realm.3
 man/man3/krb5_get_default_realms.3
+man/man3/krb5_get_dns_canonicalize_hostname.3
 man/man3/krb5_get_dns_canonize_hostname.3
-man/man3/krb5_get_err_text.3
-man/man3/krb5_get_error_message.3
-man/man3/krb5_get_error_string.3
 man/man3/krb5_get_extra_addresses.3
 man/man3/krb5_get_fcache_version.3
 man/man3/krb5_get_forwarded_creds.3
@@ -516,10 +772,12 @@ man/man3/krb5_get_in_tkt_with_keytab.3
 man/man3/krb5_get_in_tkt_with_password.3
 man/man3/krb5_get_in_tkt_with_skey.3
 man/man3/krb5_get_init_creds.3
+man/man3/krb5_get_init_creds_keyblock.3
 man/man3/krb5_get_init_creds_keytab.3
 man/man3/krb5_get_init_creds_opt.3
 man/man3/krb5_get_init_creds_opt_alloc.3
 man/man3/krb5_get_init_creds_opt_free.3
+man/man3/krb5_get_init_creds_opt_get_error.3
 man/man3/krb5_get_init_creds_opt_init.3
 man/man3/krb5_get_init_creds_opt_set_address_list.3
 man/man3/krb5_get_init_creds_opt_set_addressless.3
@@ -548,24 +806,39 @@ man/man3/krb5_get_pw_salt.3
 man/man3/krb5_get_renewed_creds.3
 man/man3/krb5_get_server_rcache.3
 man/man3/krb5_get_use_admin_kdc.3
-man/man3/krb5_get_warn_dest.3
+man/man3/krb5_get_validated_creds.3
 man/man3/krb5_get_wrapped_length.3
 man/man3/krb5_getportbyname.3
 man/man3/krb5_h_addr2addr.3
 man/man3/krb5_h_addr2sockaddr.3
 man/man3/krb5_h_errno_to_heim_errno.3
-man/man3/krb5_have_error_string.3
 man/man3/krb5_hmac.3
 man/man3/krb5_init_context.3
+man/man3/krb5_init_creds_free.3
+man/man3/krb5_init_creds_get.3
+man/man3/krb5_init_creds_get_error.3
+man/man3/krb5_init_creds_init.3
+man/man3/krb5_init_creds_intro.3
+man/man3/krb5_init_creds_set_keytab.3
+man/man3/krb5_init_creds_set_password.3
+man/man3/krb5_init_creds_set_service.3
+man/man3/krb5_init_creds_step.3
 man/man3/krb5_init_ets.3
+man/man3/krb5_init_etype.3
 man/man3/krb5_initlog.3
+man/man3/krb5_introduction.3
+man/man3/krb5_is_config_principal.3
 man/man3/krb5_is_thread_safe.3
-man/man3/krb5_keyblock.3
+man/man3/krb5_kerberos_enctypes.3
 man/man3/krb5_keyblock_get_enctype.3
 man/man3/krb5_keyblock_init.3
 man/man3/krb5_keyblock_zero.3
 man/man3/krb5_keytab.3
-man/man3/krb5_keytab_entry.3
+man/man3/krb5_keytab_intro.3
+man/man3/krb5_keytab_key_proc.3
+man/man3/krb5_keytype_to_enctypes.3
+man/man3/krb5_keytype_to_enctypes_default.3
+man/man3/krb5_keytype_to_string.3
 man/man3/krb5_krbhst_format_string.3
 man/man3/krb5_krbhst_free.3
 man/man3/krb5_krbhst_get_addrinfo.3
@@ -578,17 +851,17 @@ man/man3/krb5_kt_add_entry.3
 man/man3/krb5_kt_close.3
 man/man3/krb5_kt_compare.3
 man/man3/krb5_kt_copy_entry_contents.3
-man/man3/krb5_kt_cursor.3
 man/man3/krb5_kt_default.3
 man/man3/krb5_kt_default_modify_name.3
 man/man3/krb5_kt_default_name.3
+man/man3/krb5_kt_destroy.3
 man/man3/krb5_kt_end_seq_get.3
 man/man3/krb5_kt_free_entry.3
 man/man3/krb5_kt_get_entry.3
+man/man3/krb5_kt_get_full_name.3
 man/man3/krb5_kt_get_name.3
 man/man3/krb5_kt_get_type.3
 man/man3/krb5_kt_next_entry.3
-man/man3/krb5_kt_ops.3
 man/man3/krb5_kt_read_service_key.3
 man/man3/krb5_kt_register.3
 man/man3/krb5_kt_remove_entry.3
@@ -610,6 +883,9 @@ man/man3/krb5_mk_req_exact.3
 man/man3/krb5_mk_req_extended.3
 man/man3/krb5_mk_safe.3
 man/man3/krb5_openlog.3
+man/man3/krb5_pac.3
+man/man3/krb5_pac_get_buffer.3
+man/man3/krb5_pac_verify.3
 man/man3/krb5_padata_add.3
 man/man3/krb5_parse_address.3
 man/man3/krb5_parse_name.3
@@ -617,6 +893,7 @@ man/man3/krb5_parse_name_flags.3
 man/man3/krb5_parse_nametype.3
 man/man3/krb5_passwd_result_to_string.3
 man/man3/krb5_password_key_proc.3
+man/man3/krb5_plugin_register.3
 man/man3/krb5_prepend_config_files.3
 man/man3/krb5_prepend_config_files_default.3
 man/man3/krb5_princ_realm.3
@@ -625,9 +902,13 @@ man/man3/krb5_principal.3
 man/man3/krb5_principal_compare.3
 man/man3/krb5_principal_compare_any_realm.3
 man/man3/krb5_principal_get_comp_string.3
+man/man3/krb5_principal_get_num_comp.3
 man/man3/krb5_principal_get_realm.3
 man/man3/krb5_principal_get_type.3
+man/man3/krb5_principal_intro.3
+man/man3/krb5_principal_is_krbtgt.3
 man/man3/krb5_principal_match.3
+man/man3/krb5_principal_set_realm.3
 man/man3/krb5_principal_set_type.3
 man/man3/krb5_print_address.3
 man/man3/krb5_prompt.3
@@ -654,6 +935,12 @@ man/man3/krb5_rd_error.3
 man/man3/krb5_rd_priv.3
 man/man3/krb5_rd_rep.3
 man/man3/krb5_rd_req.3
+man/man3/krb5_rd_req_ctx.3
+man/man3/krb5_rd_req_in_ctx_alloc.3
+man/man3/krb5_rd_req_in_set_keytab.3
+man/man3/krb5_rd_req_in_set_pac_check.3
+man/man3/krb5_rd_req_out_ctx_free.3
+man/man3/krb5_rd_req_out_get_server.3
 man/man3/krb5_rd_req_with_keyblock.3
 man/man3/krb5_rd_safe.3
 man/man3/krb5_realm_compare.3
@@ -661,6 +948,7 @@ man/man3/krb5_ret_address.3
 man/man3/krb5_ret_addrs.3
 man/man3/krb5_ret_authdata.3
 man/man3/krb5_ret_creds.3
+man/man3/krb5_ret_creds_tag.3
 man/man3/krb5_ret_data.3
 man/man3/krb5_ret_int16.3
 man/man3/krb5_ret_int32.3
@@ -668,25 +956,28 @@ man/man3/krb5_ret_int8.3
 man/man3/krb5_ret_keyblock.3
 man/man3/krb5_ret_principal.3
 man/man3/krb5_ret_string.3
-man/man3/krb5_ret_stringnl.3
 man/man3/krb5_ret_stringz.3
 man/man3/krb5_ret_times.3
 man/man3/krb5_ret_uint16.3
 man/man3/krb5_ret_uint32.3
 man/man3/krb5_ret_uint8.3
 man/man3/krb5_set_config_files.3
+man/man3/krb5_set_default_in_tkt_etypes.3
 man/man3/krb5_set_default_realm.3
+man/man3/krb5_set_dns_canonicalize_hostname.3
 man/man3/krb5_set_dns_canonize_hostname.3
+man/man3/krb5_set_error_message.3
 man/man3/krb5_set_error_string.3
 man/man3/krb5_set_extra_addresses.3
 man/man3/krb5_set_fcache_version.3
+man/man3/krb5_set_home_dir_access.3
 man/man3/krb5_set_ignore_addresses.3
+man/man3/krb5_set_kdc_sec_offset.3
 man/man3/krb5_set_max_time_skew.3
 man/man3/krb5_set_password.3
 man/man3/krb5_set_password_using_ccache.3
 man/man3/krb5_set_real_time.3
 man/man3/krb5_set_use_admin_kdc.3
-man/man3/krb5_set_warn_dest.3
 man/man3/krb5_sname_to_principal.3
 man/man3/krb5_sock_to_principal.3
 man/man3/krb5_sockaddr2address.3
@@ -699,7 +990,9 @@ man/man3/krb5_storage_free.3
 man/man3/krb5_storage_from_data.3
 man/man3/krb5_storage_from_fd.3
 man/man3/krb5_storage_from_mem.3
+man/man3/krb5_storage_from_readonly_mem.3
 man/man3/krb5_storage_get_byteorder.3
+man/man3/krb5_storage_get_eof_code.3
 man/man3/krb5_storage_is_flags.3
 man/man3/krb5_storage_read.3
 man/man3/krb5_storage_seek.3
@@ -707,11 +1000,13 @@ man/man3/krb5_storage_set_byteorder.3
 man/man3/krb5_storage_set_eof_code.3
 man/man3/krb5_storage_set_flags.3
 man/man3/krb5_storage_to_data.3
+man/man3/krb5_storage_truncate.3
 man/man3/krb5_storage_write.3
 man/man3/krb5_store_address.3
 man/man3/krb5_store_addrs.3
 man/man3/krb5_store_authdata.3
 man/man3/krb5_store_creds.3
+man/man3/krb5_store_creds_tag.3
 man/man3/krb5_store_data.3
 man/man3/krb5_store_int16.3
 man/man3/krb5_store_int32.3
@@ -719,7 +1014,6 @@ man/man3/krb5_store_int8.3
 man/man3/krb5_store_keyblock.3
 man/man3/krb5_store_principal.3
 man/man3/krb5_store_string.3
-man/man3/krb5_store_stringnl.3
 man/man3/krb5_store_stringz.3
 man/man3/krb5_store_times.3
 man/man3/krb5_store_uint16.3
@@ -733,10 +1027,13 @@ man/man3/krb5_string_to_key_data_salt.3
 man/man3/krb5_string_to_key_data_salt_opaque.3
 man/man3/krb5_string_to_key_salt.3
 man/man3/krb5_string_to_key_salt_opaque.3
+man/man3/krb5_string_to_keytype.3
+man/man3/krb5_support.3
 man/man3/krb5_ticket.3
 man/man3/krb5_ticket_get_authorization_data_type.3
 man/man3/krb5_ticket_get_client.3
 man/man3/krb5_ticket_get_endtime.3
+man/man3/krb5_ticket_get_flags.3
 man/man3/krb5_ticket_get_server.3
 man/man3/krb5_timeofday.3
 man/man3/krb5_unparse_name.3
@@ -746,10 +1043,10 @@ man/man3/krb5_unparse_name_fixed_short.3
 man/man3/krb5_unparse_name_flags.3
 man/man3/krb5_unparse_name_short.3
 man/man3/krb5_us_timeofday.3
-man/man3/krb5_vabort.3
-man/man3/krb5_vabortx.3
+man/man3/krb5_v4compat.3
 man/man3/krb5_verify_ap_req.3
 man/man3/krb5_verify_checksum.3
+man/man3/krb5_verify_checksum_iov.3
 man/man3/krb5_verify_init_creds.3
 man/man3/krb5_verify_init_creds_opt_init.3
 man/man3/krb5_verify_init_creds_opt_set_ap_req_nofail.3
@@ -764,17 +1061,37 @@ man/man3/krb5_verify_opt_set_service.3
 man/man3/krb5_verify_user.3
 man/man3/krb5_verify_user_lrealm.3
 man/man3/krb5_verify_user_opt.3
-man/man3/krb5_verr.3
-man/man3/krb5_verrx.3
 man/man3/krb5_vlog.3
 man/man3/krb5_vlog_msg.3
-man/man3/krb5_vset_error_string.3
 man/man3/krb5_vwarn.3
-man/man3/krb5_vwarnx.3
-man/man3/krb5_warn.3
-man/man3/krb5_warnx.3
 man/man3/krb_afslog.3
 man/man3/krb_afslog_uid.3
+man/man3/length.3
+man/man3/lm.3
+man/man3/ntlm.3
+man/man3/ntlm_buf.3
+man/man3/ntlm_core.3
+man/man3/ntlm_targetinfo.3
+man/man3/ntlm_type1.3
+man/man3/ntlm_type2.3
+man/man3/ntlm_type3.3
+man/man3/os.3
+man/man3/page_ca.3
+man/man3/page_cert.3
+man/man3/page_cms.3
+man/man3/page_des.3
+man/man3/page_dh.3
+man/man3/page_env.3
+man/man3/page_error.3
+man/man3/page_evp.3
+man/man3/page_keyset.3
+man/man3/page_lock.3
+man/man3/page_name.3
+man/man3/page_peer.3
+man/man3/page_print.3
+man/man3/page_rand.3
+man/man3/page_revoke.3
+man/man3/page_rsa.3
 man/man3/parse_time.3
 man/man3/print_time_table.3
 man/man3/rtbl.3
@@ -792,8 +1109,28 @@ man/man3/rtbl_set_column_prefix.3
 man/man3/rtbl_set_flags.3
 man/man3/rtbl_set_prefix.3
 man/man3/rtbl_set_separator.3
+man/man3/servername.3
+man/man3/sessionkey.3
+man/man3/targetinfo.3
+man/man3/targetname.3
 man/man3/unparse_time.3
 man/man3/unparse_time_approx.3
+man/man3/username.3
+man/man3/wind.3
+man/man3/wind_profile.3
+man/man3/wind_punycode_label_toascii.3
+man/man3/wind_stringprep.3
+man/man3/wind_ucs2read.3
+man/man3/wind_ucs2utf8.3
+man/man3/wind_ucs2utf8_length.3
+man/man3/wind_ucs2write.3
+man/man3/wind_ucs4utf8.3
+man/man3/wind_ucs4utf8_length.3
+man/man3/wind_utf8ucs2.3
+man/man3/wind_utf8ucs2_length.3
+man/man3/wind_utf8ucs4.3
+man/man3/wind_utf8ucs4_length.3
+man/man3/ws.3
 man/man5/kftpusers.5
 man/man5/krb5.conf.5
 man/man5/login.access.5
@@ -809,9 +1146,11 @@ man/man8/kadmin.8
 man/man8/kadmind.8
 man/man8/kcm.8
 man/man8/kdc.8
+man/man8/kdigest.8
 man/man8/kerberos.8
 man/man8/kfd.8
 man/man8/kftpd.8
+man/man8/kimpersonate.8
 man/man8/kpasswdd.8
 man/man8/kstash.8
 man/man8/ktutil.8
diff --git a/security/heimdal/buildlink3.mk b/security/heimdal/buildlink3.mk
index 8aa1c1af95f..41dc576b144 100644
--- a/security/heimdal/buildlink3.mk
+++ b/security/heimdal/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.38 2010/07/02 13:40:22 joerg Exp $
+# $NetBSD: buildlink3.mk,v 1.39 2011/07/08 09:49:21 adam Exp $
 
 .include "../../mk/bsd.fast.prefs.mk"
 
@@ -24,6 +24,7 @@ CHECK_BUILTIN.heimdal:=	yes
 .include "../../security/heimdal/builtin.mk"
 CHECK_BUILTIN.heimdal:=	no
 .if !empty(USE_BUILTIN.heimdal:M[nN][oO])
+.include "../../databases/sqlite3/buildlink3.mk"
 .include "../../mk/bdb.buildlink3.mk"
 .endif
 .endif # HEIMDAL_BUILDLINK3_MK
diff --git a/security/heimdal/distinfo b/security/heimdal/distinfo
index 0325ddc350f..e79458f2460 100644
--- a/security/heimdal/distinfo
+++ b/security/heimdal/distinfo
@@ -1,14 +1,9 @@
-$NetBSD: distinfo,v 1.26 2010/11/30 07:12:49 obache Exp $
+$NetBSD: distinfo,v 1.27 2011/07/08 09:49:21 adam Exp $
 
-SHA1 (heimdal-1.1.tar.gz) = 64ddb2a2c47f732b2d9bbf2621062eaffa32e10f
-RMD160 (heimdal-1.1.tar.gz) = fecda9ca4db5b11c680aa3cccd705d22f98f25b7
-Size (heimdal-1.1.tar.gz) = 3622005 bytes
-SHA1 (patch-aa) = f0c74f3711ce3b6092aa2476323f7715929e367f
-SHA1 (patch-ac) = d5df5fbd77d1750eef9359ceac907547175e11dd
-SHA1 (patch-ad) = 671f68d337029b1dc935d48ce3ae458355376c6b
-SHA1 (patch-ah) = c8ea19182402cb778ebe13447c85f935554b0dbf
-SHA1 (patch-al) = 2e92de5779abf7455d1bea79999949faa0417945
-SHA1 (patch-ar) = 05564ffaf170c13187c66e45f1f124352bfc092e
-SHA1 (patch-as) = dc314360d65b6acf1c23ffcbef23a4f750c62dab
-SHA1 (patch-at) = cdebcb4db12f336e8b2e99d73b2f797724ba3b2a
-SHA1 (patch-au) = fc90a6ee55f98170730cae404b78bc189de9d866
+SHA1 (heimdal-1.4.tar.gz) = b4c876df3637a11deea72f87a6e54f6caf501679
+RMD160 (heimdal-1.4.tar.gz) = 055288f1ab37781f1533299bdff9b0d1e264d470
+Size (heimdal-1.4.tar.gz) = 6095377 bytes
+SHA1 (patch-ad) = 37c2a7cdc4dba695a84057b40aae3c5a971cb546
+SHA1 (patch-al) = 022d5f3723bd1db7fe5e92eea5d0106851a5d424
+SHA1 (patch-ar) = 0a3e7bbd3cb04deb0f6772afd9a6b6b5353463d3
+SHA1 (patch-lib_otp_Makefile.in) = 16d02bd63e3ce23599b1a86760817ca8f0f4cbf3
diff --git a/security/heimdal/options.mk b/security/heimdal/options.mk
index 8e7559aa27a..9002a7efc01 100644
--- a/security/heimdal/options.mk
+++ b/security/heimdal/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.2 2008/04/12 22:43:10 jlam Exp $
+# $NetBSD: options.mk,v 1.3 2011/07/08 09:49:21 adam Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.heimdal
 PKG_SUPPORTED_OPTIONS=	inet6 kerberos-prefix-cmds ldap
@@ -23,10 +23,10 @@ PLIST_VARS+=		ldap
 .  include "../../databases/openldap-client/buildlink3.mk"
 CONFIGURE_ARGS+=	--with-openldap=${BUILDLINK_PREFIX.openldap-client}
 PLIST.ldap=		yes
+INSTALLATION_DIRS+=	share/examples/heimdal
 
 post-install: heimdal-ldap-schema
 heimdal-ldap-schema:
-	${INSTALL_DATA_DIR} ${DESTDIR}${PREFIX}/share/examples/heimdal
 	${INSTALL_DATA} ${WRKSRC}/lib/hdb/hdb.schema			\
 		${DESTDIR}${PREFIX}/share/examples/heimdal
 .endif
@@ -57,11 +57,10 @@ CONFIGURE_ARGS+=	--program-transform-name=${HEIMDAL_TRANSFORM:Q}
 #
 SUBST_CLASSES+=		heimdal
 SUBST_STAGE.heimdal=	pre-configure
-SUBST_FILES.heimdal=	appl/rcp/rcp.c appl/rcp/rcp_locl.h		\
-			appl/rsh/rsh_locl.h				\
-			appl/telnet/telnetd/telnetd.h
-SUBST_SED.heimdal=	\
-	-e "/RSH_PROGRAM/s,rsh,${KRB5_PREFIX}rsh,g"			\
-	-e "/PATH_RSH/s,\"/usr/bin/rsh\",BINDIR \"${KRB5_PREFIX}rsh\",g" \
-	-e "/PATH_RSH/s,/rsh,/${KRB5_PREFIX}rsh,g"			\
-	-e "/PATH_LOGIN/s,/login,/${KRB5_PREFIX}login,g"
+SUBST_FILES.heimdal=	appl/rcp/rcp.c appl/rcp/rcp_locl.h
+SUBST_FILES.heimdal+=	appl/rsh/rsh_locl.h
+SUBST_FILES.heimdal+=	appl/telnet/telnetd/telnetd.h
+SUBST_SED.heimdal=	-e "/RSH_PROGRAM/s,rsh,${KRB5_PREFIX}rsh,g"
+SUBST_SED.heimdal+=	-e "/PATH_RSH/s,\"/usr/bin/rsh\",BINDIR \"${KRB5_PREFIX}rsh\",g"
+SUBST_SED.heimdal+=	-e "/PATH_RSH/s,/rsh,/${KRB5_PREFIX}rsh,g"
+SUBST_SED.heimdal+=	-e "/PATH_LOGIN/s,/login,/${KRB5_PREFIX}login,g"
diff --git a/security/heimdal/patches/patch-aa b/security/heimdal/patches/patch-aa
deleted file mode 100644
index 00f54654ea3..00000000000
--- a/security/heimdal/patches/patch-aa
+++ /dev/null
@@ -1,16 +0,0 @@
-$NetBSD: patch-aa,v 1.5 2008/11/19 13:27:33 hasso Exp $
-
---- cf/install-catman.sh.orig	2008-05-15 12:20:05 +0300
-+++ cf/install-catman.sh	2008-05-15 12:21:08 +0300
-@@ -13,8 +13,9 @@ suffix="$1"; shift
- catinstall="${INSTALL_CATPAGES-yes}"
- 
- for f in "$@"; do
--	base=`echo "$f" | sed 's/\(.*\)\.\([^.]*\)$/\1/'`
--	section=`echo "$f" | sed 's/\(.*\)\.\([^.]*\)$/\2/'`
-+	echo $f
-+	base=`echo "$f" | sed 's/\([^/]*\/\)*\(.*\)\.\([^.]*\)$/\2/'`
-+	section=`echo "$f" | sed 's/\([^/]*\/\)*\(.*\)\.\([^.]*\)$/\3/'`
- 	mandir="$manbase/man$section"
- 	catdir="$manbase/cat$section"
- 	c="$base.cat$section"
diff --git a/security/heimdal/patches/patch-ac b/security/heimdal/patches/patch-ac
deleted file mode 100644
index 56468576e11..00000000000
--- a/security/heimdal/patches/patch-ac
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-ac,v 1.3 2008/02/28 08:14:41 jlam Exp $
-
---- configure.in.orig	2008-01-24 08:13:51.000000000 -0500
-+++ configure.in
-@@ -16,9 +16,6 @@ AC_PROG_CPP
- 
- AC_PREFIX_DEFAULT(/usr/heimdal)
- 
--test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
--test "$localstatedir" = '${prefix}/var' && localstatedir='/var/heimdal'
--
- AC_CANONICAL_HOST
- CANONICAL_HOST=$host
- AC_SUBST(CANONICAL_HOST)
diff --git a/security/heimdal/patches/patch-ad b/security/heimdal/patches/patch-ad
index 9a5986b9d98..c94548a0db5 100644
--- a/security/heimdal/patches/patch-ad
+++ b/security/heimdal/patches/patch-ad
@@ -1,18 +1,8 @@
-$NetBSD: patch-ad,v 1.9 2008/02/28 08:14:41 jlam Exp $
+$NetBSD: patch-ad,v 1.10 2011/07/08 09:49:22 adam Exp $
 
---- configure.orig	2008-01-24 08:14:11.000000000 -0500
+--- configure.orig	2010-09-13 07:24:11.000000000 +0000
 +++ configure
-@@ -3928,9 +3928,6 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
- 
- 
- 
--test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
--test "$localstatedir" = '${prefix}/var' && localstatedir='/var/heimdal'
--
- # Make sure we can run config.sub.
- $SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 ||
-   { { echo "$as_me:$LINENO: error: cannot run $SHELL $ac_aux_dir/config.sub" >&5
-@@ -4902,7 +4899,11 @@ fi #if test -n "$GCC"; then
+@@ -11779,7 +11779,11 @@ fi #if test -n "$GCC"; then
  esac
  
  CC="$CC $abi"
@@ -24,24 +14,4 @@ $NetBSD: patch-ad,v 1.9 2008/02/28 08:14:41 jlam Exp $
 +#libdir="$libdir$abilibdirext"
  
  
- { echo "$as_me:$LINENO: checking for __attribute__" >&5
-@@ -29714,6 +29715,9 @@ _ACEOF
- cat confdefs.h >>conftest.$ac_ext
- cat >>conftest.$ac_ext <<_ACEOF
- /* end confdefs.h.  */
-+#ifdef HAVE_SYS_TYPES_H
-+#include <sys/types.h>
-+#endif
- #ifdef HAVE_SYS_BSWAP_H
- #include <sys/bswap.h>
- #endif
-@@ -29925,6 +29929,9 @@ _ACEOF
- cat confdefs.h >>conftest.$ac_ext
- cat >>conftest.$ac_ext <<_ACEOF
- /* end confdefs.h.  */
-+#ifdef HAVE_SYS_TYPES_H
-+#include <sys/types.h>
-+#endif
- #ifdef HAVE_SYS_BSWAP_H
- #include <sys/bswap.h>
- #endif
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for __attribute__" >&5
diff --git a/security/heimdal/patches/patch-ah b/security/heimdal/patches/patch-ah
deleted file mode 100644
index b8753a8e8fd..00000000000
--- a/security/heimdal/patches/patch-ah
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-ah,v 1.5 2010/11/30 07:12:49 obache Exp $
-
---- include/make_crypto.c.orig	2008-01-24 13:13:41.000000000 +0000
-+++ include/make_crypto.c
-@@ -71,7 +71,9 @@ main(int argc, char **argv)
-     fputs("#include <openssl/des.h>\n", f);
-     fputs("#include <openssl/rc4.h>\n", f);
-     fputs("#include <openssl/rc2.h>\n", f);
-+    fputs("#ifndef OPENSSL_NO_MD2\n", f);
-     fputs("#include <openssl/md2.h>\n", f);
-+    fputs("#endif /* OPENSSL_NO_MD2 */\n", f);
-     fputs("#include <openssl/md4.h>\n", f);
-     fputs("#include <openssl/md5.h>\n", f);
-     fputs("#include <openssl/sha.h>\n", f);
diff --git a/security/heimdal/patches/patch-al b/security/heimdal/patches/patch-al
index 8a73a278690..90bbf0d5f23 100644
--- a/security/heimdal/patches/patch-al
+++ b/security/heimdal/patches/patch-al
@@ -1,12 +1,11 @@
-$NetBSD: patch-al,v 1.2 2008/02/28 08:14:41 jlam Exp $
+$NetBSD: patch-al,v 1.3 2011/07/08 09:49:22 adam Exp $
 
---- lib/roken/Makefile.in.orig	2008-01-24 08:14:23.000000000 -0500
+--- lib/roken/Makefile.in.orig	2010-09-13 07:24:23.000000000 +0000
 +++ lib/roken/Makefile.in
-@@ -1421,6 +1421,9 @@ roken.h: make-roken$(EXEEXT)
+@@ -1990,6 +1990,8 @@ $(LTLIBOBJS) $(libroken_la_OBJECTS): rok
+ @CROSS_COMPILE_TRUE@	-c $(top_builddir)/include/config.h  \
+ @CROSS_COMPILE_TRUE@	-p $(srcdir)/roken.h.in -o roken.h
  
- make-roken.c: roken.h.in roken.awk
- 	$(AWK) -f $(srcdir)/roken.awk $(srcdir)/roken.h.in > make-roken.c
-+
 +print-xheaders:
 +	@echo $(XHEADERS)
  # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/security/heimdal/patches/patch-ar b/security/heimdal/patches/patch-ar
index 7bd16c282e7..22a22514305 100644
--- a/security/heimdal/patches/patch-ar
+++ b/security/heimdal/patches/patch-ar
@@ -1,11 +1,11 @@
-$NetBSD: patch-ar,v 1.2 2008/02/28 08:14:41 jlam Exp $
+$NetBSD: patch-ar,v 1.3 2011/07/08 09:49:22 adam Exp $
 
 Why should anyone want to install the libtool wrapper for a library, but
 not the library itself?
 
 --- lib/auth/afskauthlib/Makefile.in.orig	2008-01-24 08:14:21.000000000 -0500
 +++ lib/auth/afskauthlib/Makefile.in
-@@ -317,7 +317,7 @@ LIB_kafs = $(top_builddir)/lib/kafs/libk
+@@ -361,7 +361,7 @@ LIB_kafs = $(top_builddir)/lib/kafs/libk
  @KRB5_TRUE@LIB_tsasl = $(top_builddir)/lib/tsasl/libtsasl.la
  @DCE_TRUE@LIB_kdfs = $(top_builddir)/lib/kdfs/libkdfs.la
  foodir = $(libdir)
diff --git a/security/heimdal/patches/patch-as b/security/heimdal/patches/patch-as
deleted file mode 100644
index 0f5c3a3ec67..00000000000
--- a/security/heimdal/patches/patch-as
+++ /dev/null
@@ -1,25 +0,0 @@
-$NetBSD: patch-as,v 1.1 2008/02/28 08:14:41 jlam Exp $
-
---- cf/roken-frag.m4.orig	2008-01-24 08:13:43.000000000 -0500
-+++ cf/roken-frag.m4
-@@ -243,12 +243,18 @@ AC_FOREACH([rk_func], [asprintf vasprint
- 	rk_func)])
- 
- AC_FIND_FUNC_NO_LIBS(bswap16,,
--[#ifdef HAVE_SYS_BSWAP_H
-+[#ifdef HAVE_SYS_TYPES_H
-+#include <sys/types.h>
-+#endif
-+#ifdef HAVE_SYS_BSWAP_H
- #include <sys/bswap.h>
- #endif],0)
- 
- AC_FIND_FUNC_NO_LIBS(bswap32,,
--[#ifdef HAVE_SYS_BSWAP_H
-+[#ifdef HAVE_SYS_TYPES_H
-+#include <sys/types.h>
-+#endif
-+#ifdef HAVE_SYS_BSWAP_H
- #include <sys/bswap.h>
- #endif],0)
- 
diff --git a/security/heimdal/patches/patch-at b/security/heimdal/patches/patch-at
deleted file mode 100644
index ccdc1de2ee3..00000000000
--- a/security/heimdal/patches/patch-at
+++ /dev/null
@@ -1,120 +0,0 @@
-$NetBSD: patch-at,v 1.1 2010/11/30 07:12:49 obache Exp $
-
---- lib/hx509/crypto.c.orig	2008-01-24 13:13:22.000000000 +0000
-+++ lib/hx509/crypto.c
-@@ -841,6 +841,7 @@ md5_verify_signature(hx509_context conte
-     return 0;
- }
- 
-+#ifndef OPENSSL_NO_MD2
- static int
- md2_verify_signature(hx509_context context,
- 		     const struct signature_alg *sig_alg,
-@@ -870,6 +871,7 @@ md2_verify_signature(hx509_context conte
- 
-     return 0;
- }
-+#endif
- 
- static const struct signature_alg heim_rsa_pkcs1_x509 = {
-     "rsa-pkcs1-x509",
-@@ -926,6 +928,7 @@ static const struct signature_alg rsa_wi
-     rsa_create_signature
- };
- 
-+#ifndef OPENSSL_NO_MD2
- static const struct signature_alg rsa_with_md2_alg = {
-     "rsa-with-md2",
-     oid_id_pkcs1_md2WithRSAEncryption,
-@@ -936,6 +939,7 @@ static const struct signature_alg rsa_wi
-     rsa_verify_signature,
-     rsa_create_signature
- };
-+#endif
- 
- static const struct signature_alg dsa_sha1_alg = {
-     "dsa-with-sha1",
-@@ -980,6 +984,7 @@ static const struct signature_alg md5_al
-     md5_verify_signature
- };
- 
-+#ifndef OPENSSL_NO_MD2
- static const struct signature_alg md2_alg = {
-     "rsa-md2",
-     oid_id_rsa_digest_md2,
-@@ -989,6 +994,7 @@ static const struct signature_alg md2_al
-     SIG_DIGEST,
-     md2_verify_signature
- };
-+#endif
- 
- /* 
-  * Order matter in this structure, "best" first for each "key
-@@ -1000,13 +1006,17 @@ static const struct signature_alg *sig_a
-     &rsa_with_sha1_alg,
-     &pkcs1_rsa_sha1_alg,
-     &rsa_with_md5_alg,
-+#ifndef OPENSSL_NO_MD2
-     &rsa_with_md2_alg,
-+#endif
-     &heim_rsa_pkcs1_x509,
-     &dsa_sha1_alg,
-     &sha256_alg,
-     &sha1_alg,
-     &md5_alg,
-+#ifndef OPENSSL_NO_MD2
-     &md2_alg,
-+#endif
-     NULL
- };
- 
-@@ -1432,10 +1442,12 @@ const AlgorithmIdentifier _hx509_signatu
-     { 6, rk_UNCONST(md5_oid_tree) }, rk_UNCONST(&null_entry_oid)
- };
- 
-+#ifndef OPENSSL_NO_MD2
- static const unsigned md2_oid_tree[] = { 1, 2, 840, 113549, 2, 2 };
- const AlgorithmIdentifier _hx509_signature_md2_data = { 
-     { 6, rk_UNCONST(md2_oid_tree) }, rk_UNCONST(&null_entry_oid)
- };
-+#endif
- 
- static const unsigned rsa_with_sha512_oid[] ={ 1, 2, 840, 113549, 1, 1, 13 };
- const AlgorithmIdentifier _hx509_signature_rsa_with_sha512_data = { 
-@@ -1462,10 +1474,12 @@ const AlgorithmIdentifier _hx509_signatu
-     { 7, rk_UNCONST(rsa_with_md5_oid) }, NULL
- };
- 
-+#ifndef OPENSSL_NO_MD2
- static const unsigned rsa_with_md2_oid[] ={ 1, 2, 840, 113549, 1, 1, 2 };
- const AlgorithmIdentifier _hx509_signature_rsa_with_md2_data = { 
-     { 7, rk_UNCONST(rsa_with_md2_oid) }, NULL
- };
-+#endif
- 
- static const unsigned rsa_oid[] ={ 1, 2, 840, 113549, 1, 1, 1 };
- const AlgorithmIdentifier _hx509_signature_rsa_data = { 
-@@ -1512,9 +1526,11 @@ const AlgorithmIdentifier *
- hx509_signature_md5(void)
- { return &_hx509_signature_md5_data; }
- 
-+#ifndef OPENSSL_NO_MD2
- const AlgorithmIdentifier *
- hx509_signature_md2(void)
- { return &_hx509_signature_md2_data; }
-+#endif
- 
- const AlgorithmIdentifier *
- hx509_signature_rsa_with_sha512(void)
-@@ -1536,9 +1552,11 @@ const AlgorithmIdentifier *
- hx509_signature_rsa_with_md5(void)
- { return &_hx509_signature_rsa_with_md5_data; }
- 
-+#ifndef OPENSSL_NO_MD2
- const AlgorithmIdentifier *
- hx509_signature_rsa_with_md2(void)
- { return &_hx509_signature_rsa_with_md2_data; }
-+#endif
- 
- const AlgorithmIdentifier *
- hx509_signature_rsa(void)
diff --git a/security/heimdal/patches/patch-au b/security/heimdal/patches/patch-au
deleted file mode 100644
index 7608841e1ee..00000000000
--- a/security/heimdal/patches/patch-au
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-au,v 1.1 2010/11/30 07:12:49 obache Exp $
-
---- lib/hx509/ks_p11.c.orig	2008-01-24 13:13:22.000000000 +0000
-+++ lib/hx509/ks_p11.c
-@@ -1142,7 +1142,9 @@ p11_printinfo(hx509_context context, 
- 		MECHNAME(CKM_SHA256, "sha256");
- 		MECHNAME(CKM_SHA_1, "sha1");
- 		MECHNAME(CKM_MD5, "md5");
-+#ifndef OPENSSL_NO_MD2
- 		MECHNAME(CKM_MD2, "md2");
-+#endif
- 		MECHNAME(CKM_RIPEMD160, "ripemd-160");
- 		MECHNAME(CKM_DES_ECB, "des-ecb");
- 		MECHNAME(CKM_DES_CBC, "des-cbc");
diff --git a/security/heimdal/patches/patch-lib_otp_Makefile.in b/security/heimdal/patches/patch-lib_otp_Makefile.in
new file mode 100644
index 00000000000..4adbb09ebdb
--- /dev/null
+++ b/security/heimdal/patches/patch-lib_otp_Makefile.in
@@ -0,0 +1,23 @@
+$NetBSD: patch-lib_otp_Makefile.in,v 1.1 2011/07/08 09:49:22 adam Exp $
+
+Fix linking.
+
+--- lib/otp/Makefile.in.orig	2011-06-25 11:48:35.000000000 +0000
++++ lib/otp/Makefile.in
+@@ -47,7 +47,6 @@ DIST_COMMON = $(include_HEADERS) $(srcdi
+ 	$(top_srcdir)/cf/Makefile.am.common ChangeLog
+ noinst_PROGRAMS = otptest$(EXEEXT)
+ check_PROGRAMS = otptest$(EXEEXT)
+-@versionscript_TRUE@am__append_1 = $(LDFLAGS_VERSION_SCRIPT)$(srcdir)/version-script.map
+ subdir = lib/otp
+ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+ am__aclocal_m4_deps = $(top_srcdir)/cf/aix.m4 \
+@@ -404,7 +403,7 @@ otptest_LDADD = libotp.la
+ include_HEADERS = otp.h
+ lib_LTLIBRARIES = libotp.la
+ libotp_la_LDFLAGS = -version-info 1:5:1 $(am__append_1)
+-libotp_la_LIBADD = $(LIB_hcrypto) $(LIB_roken) $(LIB_NDBM)
++libotp_la_LIBADD = $(LIB_hcrypto) $(LIB_roken) $(LIB_NDBM) $(DBLIB)
+ @HAVE_DB3_FALSE@ndbm_wrap = 
+ @HAVE_DB3_TRUE@ndbm_wrap = ndbm_wrap.c ndbm_wrap.h
+ dist_libotp_la_SOURCES = \