From 716121bc609ea22898151aae084c28cd289ec60d Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Tue, 2 Mar 2010 03:21:07 -0500
Subject: [PATCH 01/16] Don't break build if cleanup fails

---
 include/NTMakefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/NTMakefile b/include/NTMakefile
index 01b805a8c..c4aa663e7 100644
--- a/include/NTMakefile
+++ b/include/NTMakefile
@@ -111,5 +111,5 @@ const char *heimdal_version = "$(VER_PACKAGE_NAME) $(VER_PACKAGE_VERSION)";
 all:: $(INCFILES)
 
 clean::
-	$(RM) $(INCFILES)
+	-$(RM) $(INCFILES)
 

From f54630328bc68b504aede05bd03a87bff06c3a90 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Tue, 2 Mar 2010 03:21:53 -0500
Subject: [PATCH 02/16] strlen() returns a size_t

---
 include/bits.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/bits.c b/include/bits.c
index f2ee2b9fa..8a64102e9 100644
--- a/include/bits.c
+++ b/include/bits.c
@@ -49,7 +49,7 @@ RCSID("$Id$");
     char tmp[128], tmp2[128];					\
     while(x){ x <<= 1; b++; if(x < zero) pre=""; }		\
     if(b >= len){						\
-        int tabs;						\
+        size_t tabs;						\
 	sprintf(tmp, "%sint%d_t" , pre, len);			\
 	sprintf(tmp2, "typedef %s %s;", #TYPE, tmp);		\
 	tabs = 5 - strlen(tmp2) / 8;				\

From 154de6b3a33ee85dfe30bd25af08cc73c21e1636 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Tue, 2 Mar 2010 03:25:05 -0500
Subject: [PATCH 03/16] krb5_kuserok() only does the local principal test on
 Windows

Remove the other tests for now.  The file and directory access checks must be
made against the respective DACLs.
---
 lib/krb5/kuserok.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/krb5/kuserok.c b/lib/krb5/kuserok.c
index 4cc9be203..2129100b9 100644
--- a/lib/krb5/kuserok.c
+++ b/lib/krb5/kuserok.c
@@ -34,6 +34,8 @@
 #include "krb5_locl.h"
 #include <dirent.h>
 
+#ifndef _WIN32
+
 /* see if principal is mentioned in the filename access file, return
    TRUE (in result) if so, FALSE otherwise */
 
@@ -65,7 +67,6 @@ check_one_file(krb5_context context,
 	fclose (f);
 	return EISDIR;
     }
-#ifndef _WIN32
     if (st.st_uid != pwd->pw_uid && st.st_uid != 0) {
 	fclose (f);
 	return EACCES;
@@ -74,7 +75,6 @@ check_one_file(krb5_context context,
 	fclose (f);
 	return EACCES;
     }
-#endif
 
     while (fgets (buf, sizeof(buf), f) != NULL) {
 	krb5_principal tmp;
@@ -126,12 +126,10 @@ check_directory(krb5_context context,
     if (!S_ISDIR(st.st_mode))
 	return ENOTDIR;
 
-#ifndef _WIN32
     if (st.st_uid != pwd->pw_uid && st.st_uid != 0)
 	return EACCES;
     if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0)
 	return EACCES;
-#endif
 
     if((d = opendir(dirname)) == NULL)
 	return errno;
@@ -167,6 +165,8 @@ check_directory(krb5_context context,
     return ret;
 }
 
+#endif  /* !_WIN32 */
+
 static krb5_boolean
 match_local_principals(krb5_context context,
 		       krb5_principal principal,

From e7337145ee6f634198eee69d6eff1a7e07bf7294 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 09:56:49 -0400
Subject: [PATCH 04/16] Define HAVE_WINDNS and NO_LIMIT_FD_SETSIZE

HAVE_WINDNS is defined when we want to use DNSAPI on Windows which
handles most of the resolver work for us.

NO_LIMIT_FD_SETSIZE is defined if the value of a socket FD does not
imply anything about the number of sockets so far assigned.
I.e. checking if the socket is larger than FD_SETSIZE is incorrect.
---
 include/config.h.w32 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/config.h.w32 b/include/config.h.w32
index b89859415..8fa5b45ad 100644
--- a/include/config.h.w32
+++ b/include/config.h.w32
@@ -1224,6 +1224,9 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Defined if we have WinSock */
 #define HAVE_WINSOCK 1
 
+/* Defined if we have WinDNS */
+#define HAVE_WINDNS 1
+
 /* define if struct winsize has ws_xpixel */
 /* #define HAVE_WS_XPIXEL 1 */
 
@@ -1404,6 +1407,9 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if a socket is not a file descriptor */
 #define SOCKET_IS_NOT_AN_FD 1
 
+/* Define if FD_SETSIZE check does not apply to this platform */
+#define NO_LIMIT_FD_SETSIZE 1
+
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 

From 7b8ebf0efe0f162406cb30f9bc5234736ed3d36a Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:03:03 -0400
Subject: [PATCH 05/16] Fix return value of w32crypto_bytes() and use correct
 data types

---
 lib/hcrypto/rand-w32.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/hcrypto/rand-w32.c b/lib/hcrypto/rand-w32.c
index a5792d95c..e4d8442f8 100644
--- a/lib/hcrypto/rand-w32.c
+++ b/lib/hcrypto/rand-w32.c
@@ -48,25 +48,25 @@ volatile static HCRYPTPROV g_cryptprovider = 0;
 static HCRYPTPROV
 _hc_CryptProvider(void)
 {
-    BOOL res;
+    BOOL rv;
     HCRYPTPROV cryptprovider = 0;
 
     if (g_cryptprovider != 0)
 	return g_cryptprovider;
 
-    res = CryptAcquireContext(&cryptprovider, NULL,
+    rv = CryptAcquireContext(&cryptprovider, NULL,
 			      MS_ENHANCED_PROV, PROV_RSA_FULL,
 			      0);
 
     if (GetLastError() == NTE_BAD_KEYSET) {
-        if(!res)
-            res = CryptAcquireContext(&cryptprovider, NULL,
+        if(!rv)
+            rv = CryptAcquireContext(&cryptprovider, NULL,
                                       MS_ENHANCED_PROV, PROV_RSA_FULL,
                                       CRYPT_NEWKEYSET);
     }
 
-    if (res &&
-        InterlockedCompareExchange(&g_cryptprovider, cryptprovider, 0) != 0) {
+    if (rv &&
+        InterlockedCompareExchangePointer(&g_cryptprovider, cryptprovider, 0) != 0) {
 
         CryptReleaseContext(cryptprovider, 0);
         cryptprovider = g_cryptprovider;
@@ -90,8 +90,8 @@ static int
 w32crypto_bytes(unsigned char *outdata, int size)
 {
     if (CryptGenRandom(_hc_CryptProvider(), size, outdata))
-	return 0;
-    return 1;
+	return 1;
+    return 0;
 }
 
 static void

From a750f29cda1f2349e6a9b2bf98b6898960f618b6 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:16:36 -0400
Subject: [PATCH 06/16] _getch() can return '\r' on Windows

---
 lib/hcrypto/ui.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/hcrypto/ui.c b/lib/hcrypto/ui.c
index f6f8a1ffe..e32bb9a0b 100644
--- a/lib/hcrypto/ui.c
+++ b/lib/hcrypto/ui.c
@@ -77,7 +77,7 @@ read_string(const char *preprompt, const char *prompt,
     p = buf;
     while(intr_flag == 0){
 	c = ((echo)? _getche(): _getch());
-	if(c == '\n')
+	if(c == '\n' || c == '\r')
 	    break;
 	if(of == 0)
 	    *p++ = c;

From 884f5ac6274c58a5c58fd4792aea6c79d528f704 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:17:28 -0400
Subject: [PATCH 07/16] Use WinDNS on Windows for DNS

---
 lib/roken/resolve.c | 216 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 215 insertions(+), 1 deletion(-)

diff --git a/lib/roken/resolve.c b/lib/roken/resolve.c
index e112274a6..a8be75af1 100644
--- a/lib/roken/resolve.c
+++ b/lib/roken/resolve.c
@@ -98,7 +98,7 @@ rk_dns_type_to_string(int type)
     return NULL;
 }
 
-#if (defined(HAVE_RES_SEARCH) || defined(HAVE_RES_NSEARCH)) && defined(HAVE_DN_EXPAND)
+#if ((defined(HAVE_RES_SEARCH) || defined(HAVE_RES_NSEARCH)) && defined(HAVE_DN_EXPAND)) || defined(HAVE_WINDNS)
 
 static void
 dns_free_rr(struct rk_resource_record *rr)
@@ -124,6 +124,8 @@ rk_dns_free_data(struct rk_dns_reply *r)
     free (r);
 }
 
+#ifndef HAVE_WINDNS
+
 static int
 parse_record(const unsigned char *data, const unsigned char *end_data,
 	     const unsigned char **pp, struct rk_resource_record **ret_rr)
@@ -605,6 +607,8 @@ rk_dns_lookup(const char *domain, const char *type_name)
     return dns_lookup_int(domain, rk_ns_c_in, type);
 }
 
+#endif	/* !HAVE_WINDNS */
+
 static int
 compare_srv(const void *a, const void *b)
 {
@@ -708,6 +712,216 @@ rk_dns_srv_order(struct rk_dns_reply *r)
     return;
 }
 
+#ifdef HAVE_WINDNS
+
+#include <WinDNS.h>
+
+static struct rk_resource_record *
+parse_dns_record(PDNS_RECORD pRec)
+{
+    struct rk_resource_record * rr;
+
+    if (pRec == NULL)
+	return NULL;
+
+    rr = calloc(1, sizeof(*rr));
+
+    rr->domain = strdup(pRec->pName);
+    rr->type = pRec->wType;
+    rr->class = 0;
+    rr->ttl = pRec->dwTtl;
+    rr->size = 0;
+
+    switch (rr->type) {
+    case rk_ns_t_ns:
+    case rk_ns_t_cname:
+    case rk_ns_t_ptr:
+	rr->u.txt = strdup(pRec->Data.NS.pNameHost);
+	if(rr->u.txt == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+	break;
+
+    case rk_ns_t_mx:
+    case rk_ns_t_afsdb:{
+	size_t hostlen = strnlen(pRec->Data.MX.pNameExchange, DNS_MAX_NAME_LENGTH);
+
+	rr->u.mx = (struct mx_record *)malloc(sizeof(struct mx_record) +
+					      hostlen);
+	if (rr->u.mx == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	strcpy_s(rr->u.mx->domain, hostlen + 1, pRec->Data.MX.pNameExchange);
+	rr->u.mx->preference = pRec->Data.MX.wPreference;
+	break;
+    }
+
+    case rk_ns_t_srv:{
+	size_t hostlen = strnlen(pRec->Data.SRV.pNameTarget, DNS_MAX_NAME_LENGTH);
+
+	rr->u.srv =
+	    (struct srv_record*)malloc(sizeof(struct srv_record) +
+				       hostlen);
+	if(rr->u.srv == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.srv->priority = pRec->Data.SRV.wPriority;
+	rr->u.srv->weight = pRec->Data.SRV.wWeight;
+	rr->u.srv->port = pRec->Data.SRV.wPort;
+	strcpy_s(rr->u.srv->target, hostlen + 1, pRec->Data.SRV.pNameTarget);
+
+	break;
+    }
+
+    case rk_ns_t_txt:{
+	size_t len;
+
+	if (pRec->Data.TXT.dwStringCount == 0) {
+	    rr->u.txt = strdup("");
+	    break;
+	}
+
+	len = strnlen(pRec->Data.TXT.pStringArray[0], DNS_MAX_TEXT_STRING_LENGTH);
+
+	rr->u.txt = (char *)malloc(len + 1);
+	strcpy_s(rr->u.txt, len + 1, pRec->Data.TXT.pStringArray[0]);
+
+	break;
+    }
+
+    case rk_ns_t_key : {
+	size_t key_len;
+
+	if (pRec->wDataLength < 4) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	key_len = pRec->wDataLength - 4;
+	rr->u.key = malloc (sizeof(*rr->u.key) + key_len - 1);
+	if (rr->u.key == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.key->flags     = pRec->Data.KEY.wFlags;
+	rr->u.key->protocol  = pRec->Data.KEY.chProtocol;
+	rr->u.key->algorithm = pRec->Data.KEY.chAlgorithm;
+	rr->u.key->key_len   = key_len;
+	memcpy_s (rr->u.key->key_data, key_len,
+		  pRec->Data.KEY.Key, key_len);
+	break;
+    }
+
+    case rk_ns_t_sig : {
+	size_t sig_len, hostlen;
+
+	if(pRec->wDataLength <= 18) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	sig_len = pRec->wDataLength;
+
+	hostlen = strnlen(pRec->Data.SIG.pNameSigner, DNS_MAX_NAME_LENGTH);
+
+	rr->u.sig = malloc(sizeof(*rr->u.sig)
+			      + hostlen + sig_len);
+	if (rr->u.sig == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+	rr->u.sig->type           = pRec->Data.SIG.wTypeCovered;
+	rr->u.sig->algorithm      = pRec->Data.SIG.chAlgorithm;
+	rr->u.sig->labels         = pRec->Data.SIG.chLabelCount;
+	rr->u.sig->orig_ttl       = pRec->Data.SIG.dwOriginalTtl;
+	rr->u.sig->sig_expiration = pRec->Data.SIG.dwExpiration;
+	rr->u.sig->sig_inception  = pRec->Data.SIG.dwTimeSigned;
+	rr->u.sig->key_tag        = pRec->Data.SIG.wKeyTag;
+	rr->u.sig->sig_len        = sig_len;
+	memcpy_s (rr->u.sig->sig_data, sig_len,
+		  pRec->Data.SIG.Signature, sig_len);
+	rr->u.sig->signer         = &rr->u.sig->sig_data[sig_len];
+	strcpy_s(rr->u.sig->signer, hostlen + 1, pRec->Data.SIG.pNameSigner);
+	break;
+    }
+
+    case rk_ns_t_ds: {
+	rr->u.ds = malloc (sizeof(*rr->u.ds) + pRec->Data.DS.wDigestLength - 1);
+	if (rr->u.ds == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.ds->key_tag     = pRec->Data.DS.wKeyTag;
+	rr->u.ds->algorithm   = pRec->Data.DS.chAlgorithm;
+	rr->u.ds->digest_type = pRec->Data.DS.chDigestType;
+	rr->u.ds->digest_len  = pRec->Data.DS.wDigestLength;
+	memcpy_s (rr->u.ds->digest_data, pRec->Data.DS.wDigestLength,
+		  pRec->Data.DS.Digest, pRec->Data.DS.wDigestLength);
+	break;
+    }
+
+    default:
+	dns_free_rr(rr);
+	return NULL;
+    }
+
+    rr->next = parse_dns_record(pRec->pNext);
+    return rr;
+}
+
+ROKEN_LIB_FUNCTION struct rk_dns_reply * ROKEN_LIB_CALL
+rk_dns_lookup(const char *domain, const char *type_name)
+{
+    DNS_STATUS status;
+    int type;
+    PDNS_RECORD pRec = NULL;
+    struct rk_dns_reply * r = NULL;
+
+    __try {
+
+	type = rk_dns_string_to_type(type_name);
+	if(type == -1) {
+	    if(_resolve_debug)
+		fprintf(stderr, "dns_lookup: unknown resource type: `%s'\n",
+			type_name);
+	    return NULL;
+	}
+
+	status = DnsQuery_UTF8(domain, type, DNS_QUERY_STANDARD, NULL,
+			       &pRec, NULL);
+	if (status != ERROR_SUCCESS)
+	    return NULL;
+
+	r = calloc(1, sizeof(*r));
+	r->q.domain = strdup(domain);
+	r->q.type = type;
+	r->q.class = 0;
+
+	r->head = parse_dns_record(pRec);
+
+	if (r->head == NULL) {
+	    rk_dns_free_data(r);
+	    return NULL;
+	} else {
+	    return r;
+	}
+
+    } __finally {
+
+	if (pRec)
+	    DnsRecordListFree(pRec, DnsFreeRecordList);
+
+    }
+}
+#endif	/* HAVE_WINDNS */
+
 #else /* NOT defined(HAVE_RES_SEARCH) && defined(HAVE_DN_EXPAND) */
 
 ROKEN_LIB_FUNCTION struct rk_dns_reply * ROKEN_LIB_CALL

From 500603506f3d47892c46a680d7b4323524b8a2b0 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:19:40 -0400
Subject: [PATCH 08/16] Link libkrb5 against DNSAPI.lib on Windows

---
 lib/krb5/NTMakefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/krb5/NTMakefile b/lib/krb5/NTMakefile
index 613029421..8059e7f96 100644
--- a/lib/krb5/NTMakefile
+++ b/lib/krb5/NTMakefile
@@ -317,7 +317,8 @@ DLLDEPS= \
 DLLSDKDEPS= \
 	$(PTHREAD_LIB)	\
 	secur32.lib	\
-	shell32.lib
+	shell32.lib	\
+	dnsapi.lib
 
 $(LIBKRB5): $(BINDIR)\libkrb5.dll
 

From 6d132f1d7d94d2acd14a1ba9e8ea4d2b1da2e406 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:21:54 -0400
Subject: [PATCH 09/16] Remove spurious slash when expanding path tokens

Path tokens that expand to directories are expected to end in a slash.
---
 lib/krb5/config_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/krb5/config_file.c b/lib/krb5/config_file.c
index 4eb4e12fa..f6f157063 100644
--- a/lib/krb5/config_file.c
+++ b/lib/krb5/config_file.c
@@ -447,7 +447,7 @@ krb5_config_parse_file_multi (krb5_context context,
 	    fname = newfname;
 	}
 #else  /* KRB5_USE_PATH_TOKENS */
-	asprintf(&newfname, "%%{USERCONFIG}/%s", &fname[1]);
+	asprintf(&newfname, "%%{USERCONFIG}%s", &fname[1]);
 	if (newfname == NULL) {
 	    krb5_set_error_message(context, ENOMEM,
 				   N_("malloc: out of memory", ""));

From b9dc82e09e74918a91b4420e6f9034181aaf3050 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:23:03 -0400
Subject: [PATCH 10/16] Fix slashes while expanding path tokens

On Windows, some (external) APIs get confused if we mix both back and
forward slashes.  When expanding path tokens we use back-slashes for
token expansions because they come from the OS.  For consistency, fix
the path so that the remaining path separators are also backslashes.
---
 lib/krb5/expand_path_w32.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/krb5/expand_path_w32.c b/lib/krb5/expand_path_w32.c
index 784ce64fe..0c4287c32 100644
--- a/lib/krb5/expand_path_w32.c
+++ b/lib/krb5/expand_path_w32.c
@@ -479,6 +479,14 @@ _krb5_expand_path_tokens(krb5_context context,
 	}
     }
 
+    /* Also deal with slashes */
+    if (*ppath_out) {
+	char * c;
+	for (c = *ppath_out; *c; c++)
+	    if (*c == '/')
+		*c = '\\';
+    }
+
     return 0;
 }
 

From b9567cb15825f0d7fb7d75eb6fbc005358cf5b92 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:28:39 -0400
Subject: [PATCH 11/16] Don't attempt to release unallocated resource in
 fcc_move()

---
 lib/krb5/fcache.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/krb5/fcache.c b/lib/krb5/fcache.c
index 67c4c7444..854ee35ac 100644
--- a/lib/krb5/fcache.c
+++ b/lib/krb5/fcache.c
@@ -990,11 +990,12 @@ fcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
     {
 	krb5_storage *sp;
 	int fd;
-	ret = init_fcc (context, to, &sp, &fd, NULL);
-	if (sp)
-	    krb5_storage_free(sp);
-	fcc_unlock(context, fd);
-	close(fd);
+	if ((ret = init_fcc (context, to, &sp, &fd, NULL)) == 0) {
+	    if (sp)
+		krb5_storage_free(sp);
+	    fcc_unlock(context, fd);
+	    close(fd);
+	}
     }
 
     fcc_close(context, from);
@@ -1041,7 +1042,7 @@ static krb5_error_code
 fcc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset)
 {
     krb5_error_code ret;
-    krb5_storage *sp;
+    krb5_storage *sp = NULL;
     int fd;
     ret = init_fcc(context, id, &sp, &fd, kdc_offset);
     if (sp)

From 5c0f3f99c6a062278dd4b4ce9aa52edfb2151e59 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:32:00 -0400
Subject: [PATCH 12/16] Use path tokens when locating plug-in .dlls

---
 lib/krb5/acache.c | 13 +++++++++++++
 lib/krb5/plugin.c | 13 ++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/lib/krb5/acache.c b/lib/krb5/acache.c
index 19a599745..1be8fd93b 100644
--- a/lib/krb5/acache.c
+++ b/lib/krb5/acache.c
@@ -106,6 +106,8 @@ init_ccapi(krb5_context context)
     if (lib == NULL) {
 #ifdef __APPLE__
 	lib = "/System/Library/Frameworks/Kerberos.framework/Kerberos";
+#elif defined(KRB5_USE_PATH_TOKENS) && defined(_WIN32)
+	lib = "%{LIBDIR}/libkrb5_cc.dll";
 #else
 	lib = "/usr/lib/libkrb5_cc.so";
 #endif
@@ -120,7 +122,18 @@ init_ccapi(krb5_context context)
 #define RTLD_LOCAL 0
 #endif
 
+#ifdef KRB5_USE_PATH_TOKENS
+    {
+      char * explib = NULL;
+      if (_krb5_expand_path_tokens(context, lib, &explib) == 0) {
+	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL);
+	free(explib);
+      }
+    }
+#else
     cc_handle = dlopen(lib, RTLD_LAZY|RTLD_LOCAL);
+#endif
+
     if (cc_handle == NULL) {
 	HEIMDAL_MUTEX_unlock(&acc_mutex);
 	if (context)
diff --git a/lib/krb5/plugin.c b/lib/krb5/plugin.c
index aa71e29b3..8db3c5a70 100644
--- a/lib/krb5/plugin.c
+++ b/lib/krb5/plugin.c
@@ -201,8 +201,19 @@ load_plugins(krb5_context context)
 	dirs = rk_UNCONST(sysplugin_dirs);
 
     for (di = dirs; *di != NULL; di++) {
+#ifdef KRB5_USE_PATH_TOKENS
+	{
+	    char * dir = NULL;
 
-	d = opendir(*di);
+	    if (_krb5_expand_path_tokens(context, *di, &dir))
+		continue;
+	    d = opendir(dir);
+
+	    free(dir);
+	}
+#else
+	d = opendir(*id);
+#endif
 	if (d == NULL)
 	    continue;
 	rk_cloexec_dir(d);

From 3e2b8405658c9fa521c8bc6457cefaf7cce6cbe6 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 10:33:50 -0400
Subject: [PATCH 13/16] Try both fd and socket ops for net_read() and
 net_write()

When using WinSock, a socket is not a file descriptor and does not
interoperate with read()/write().  File descriptors do not work with
send()/recv().  However, for net_read() and net_write(), we don't know
whether we are dealing with a socket or a file descriptor.  So try
one, and if it fails, try the other.

This is an ugly hack until we clean up the users of this API so it
doesn't use sockets and fds interchangably.
---
 lib/roken/net_read.c  | 19 +++++++++++++++++++
 lib/roken/net_write.c | 18 ++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/lib/roken/net_read.c b/lib/roken/net_read.c
index b57dda3dd..1f959db95 100644
--- a/lib/roken/net_read.c
+++ b/lib/roken/net_read.c
@@ -73,8 +73,27 @@ net_read(rk_socket_t sock, void *buf, size_t nbytes)
     ssize_t count;
     size_t rem = nbytes;
 
+#ifdef SOCKET_IS_NOT_AN_FD
+    int use_read = 0;
+#endif
+
     while (rem > 0) {
+#ifdef SOCKET_IS_NOT_AN_FD
+	if (use_read)
+	    count = _read (sock, cbuf, rem);
+	else
+	    count = recv (sock, cbuf, rem, 0);
+
+	if (use_read == 0 &&
+	    rk_IS_SOCKET_ERROR(count) &&
+	    rk_SOCK_ERRNO == WSAENOTSOCK) {
+	    use_read = 1;
+
+	    count = _read (sock, cbuf, rem);
+	}
+#else
 	count = recv (sock, cbuf, rem, 0);
+#endif
 	if (count < 0) {
 
 	    /* With WinSock, the error EINTR (WSAEINTR), is used to
diff --git a/lib/roken/net_write.c b/lib/roken/net_write.c
index 94c9df1c3..402e20915 100644
--- a/lib/roken/net_write.c
+++ b/lib/roken/net_write.c
@@ -70,9 +70,27 @@ net_write(rk_socket_t sock, const void *buf, size_t nbytes)
     const char *cbuf = (const char *)buf;
     ssize_t count;
     size_t rem = nbytes;
+#ifdef SOCKET_IS_NOT_AN_FD
+    int use_write = 0;
+#endif
 
     while (rem > 0) {
+#ifdef SOCKET_IS_NOT_AN_FD
+	if (use_write)
+	    count = _write (sock, cbuf, rem);
+	else
+	    count = send (sock, cbuf, rem, 0);
+
+	if (use_write == 0 &&
+	    rk_IS_SOCKET_ERROR(count) &&
+	    rk_SOCK_ERRNO == WSAENOTSOCK) {
+	    use_write = 1;
+
+	    count = _write (sock, cbuf, rem);
+	}
+#else
 	count = send (sock, cbuf, rem, 0);
+#endif
 	if (count < 0) {
 	    if (errno == EINTR)
 		continue;

From 0d17cbefee4c0adeb55e02764f077f21f84766d8 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 12:16:14 -0400
Subject: [PATCH 14/16] Update Windows build environment

We are building both 32-bit and 64-bit binaries.  The output directory
is no longer called out32.  Instead it's just called 'out'.  Also
support deeper directories.
---
 windows/NTMakefile.w32 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index 3da293f7f..cab7e805a 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -53,6 +53,8 @@ SRC=$(MAKEDIR)
 SRC=$(MAKEDIR)\..
 !elseif exist($(MAKEDIR)\..\..\windows\NTMakefile.w32)
 SRC=$(MAKEDIR)\..\..
+!elseif exist($(MAKEDIR)\..\..\..\windows\NTMakefile.w32)
+SRC=$(MAKEDIR)\..\..\..
 !else
 !  error Cant determine source directory
 !endif
@@ -62,8 +64,8 @@ SRC=$(MAKEDIR)\..\..
 #----------------------------------------------------------------
 # Directory macros
 
-DESTDIR=$(SRC)\out32\dest_$(OUTDIR)
-OBJDIR =$(SRC)\out32\obj_$(OUTDIR)
+DESTDIR=$(SRC)\out\dest_$(OUTDIR)
+OBJDIR =$(SRC)\out\obj_$(OUTDIR)
 
 INCDIR =$(DESTDIR)\inc
 LIBDIR =$(DESTDIR)\lib
@@ -146,7 +148,7 @@ pthreadinc= -I$(PTHREAD_INC)
 
 cincdirs=$(cincdirs) -I$(INCDIR) -I$(INCDIR)\krb5 $(pthreadinc)
 cdefines=$(cdefines) -DHAVE_CONFIG_H
-cwarn=$(cwarn) -D_CRT_SECURE_NO_WARNINGS -wd4996
+cwarn=$(cwarn) -D_CRT_SECURE_NO_WARNINGS -wd4996 -wd4127 -wd4244 -wd4100
 
 !if "$(CPU)"=="i386"
 libmach=/machine:X86

From 85f6e6d6703eee90e02bfa6a4ca27188f49fe8e3 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 12:17:30 -0400
Subject: [PATCH 15/16] Build Tom's fast math library on Windows

---
 lib/hcrypto/NTMakefile              |  14 ++-
 lib/hcrypto/tomsfastmath/NTMakefile | 162 ++++++++++++++++++++++++++++
 windows/NTMakefile.w32              |   1 +
 3 files changed, 176 insertions(+), 1 deletion(-)
 create mode 100644 lib/hcrypto/tomsfastmath/NTMakefile

diff --git a/lib/hcrypto/NTMakefile b/lib/hcrypto/NTMakefile
index 7f1a6fc72..89b002cf0 100644
--- a/lib/hcrypto/NTMakefile
+++ b/lib/hcrypto/NTMakefile
@@ -29,12 +29,22 @@
 # POSSIBILITY OF SUCH DAMAGE.
 # 
 
+SUBDIRS=tomsfastmath
+
 RELDIR=lib\hcrypto
 
 AUXCFLAGS=$(AUXCFLAGS) -DKRB5 -I$(HCRYPTOINCLUDEDIR)
 
 !include ../../windows/NTMakefile.w32
 
+# Do dependencies first
+
+all:: subdirs
+
+clean:: clean-subdirs
+
+test:: test-subdirs
+
 # Include files
 
 HCRYPTOINCLUDEDIR=$(INCDIR)\hcrypto
@@ -108,6 +118,7 @@ libhcrypto_OBJs = \
 	$(OBJ)\rsa.obj		\
 	$(OBJ)\rsa-gmp.obj	\
 	$(OBJ)\rsa-imath.obj	\
+	$(OBJ)\rsa-tfm.obj	\
 	$(OBJ)\sha.obj		\
 	$(OBJ)\sha256.obj	\
 	$(OBJ)\ui.obj
@@ -116,7 +127,7 @@ libhcrypto_OBJs = \
 
 $(LIBHCRYPTO): $(BINDIR)\libhcrypto.dll
 
-$(BINDIR)\libhcrypto.dll: $(libhcrypto_OBJs) $(LIBROKEN) $(LIBASN1)
+$(BINDIR)\libhcrypto.dll: $(libhcrypto_OBJs) $(LIBROKEN) $(LIBASN1) $(LIBTFM)
 	$(DLLGUILINK) -def:libhcrypto-exports.def -implib:$(LIBHCRYPTO)
 	$(DLLPREP)
 
@@ -258,3 +269,4 @@ test-run:
 	cd $(SRCDIR)
 
 test:: $(TESTLIB) test-binaries test-run
+
diff --git a/lib/hcrypto/tomsfastmath/NTMakefile b/lib/hcrypto/tomsfastmath/NTMakefile
new file mode 100644
index 000000000..fc75b6c23
--- /dev/null
+++ b/lib/hcrypto/tomsfastmath/NTMakefile
@@ -0,0 +1,162 @@
+########################################################################
+#
+# Copyright (c) 2009, Secure Endpoints Inc.
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 
+# - Redistributions of source code must retain the above copyright
+#   notice, this list of conditions and the following disclaimer.
+# 
+# - Redistributions in binary form must reproduce the above copyright
+#   notice, this list of conditions and the following disclaimer in
+#   the documentation and/or other materials provided with the
+#   distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+# 
+
+RELDIR=lib\hcrypto\tomsfastmath
+
+!include ../../../windows/NTMakefile.w32
+
+INCFILES=$(INCDIR)\tfm.h
+
+libtfm_OBJs=	\
+	$(OBJ)\fp_add.obj	\
+	$(OBJ)\fp_add_d.obj	\
+	$(OBJ)\fp_addmod.obj	\
+	$(OBJ)\fp_cmp.obj	\
+	$(OBJ)\fp_cmp_d.obj	\
+	$(OBJ)\fp_cmp_mag.obj	\
+	$(OBJ)\fp_sub.obj	\
+	$(OBJ)\fp_sub_d.obj	\
+	$(OBJ)\fp_submod.obj	\
+	$(OBJ)\s_fp_add.obj	\
+	$(OBJ)\s_fp_sub.obj	\
+	$(OBJ)\fp_radix_size.obj	\
+	$(OBJ)\fp_read_radix.obj	\
+	$(OBJ)\fp_read_signed_bin.obj	\
+	$(OBJ)\fp_read_unsigned_bin.obj	\
+	$(OBJ)\fp_reverse.obj	\
+	$(OBJ)\fp_s_rmap.obj	\
+	$(OBJ)\fp_signed_bin_size.obj	\
+	$(OBJ)\fp_to_signed_bin.obj	\
+	$(OBJ)\fp_to_unsigned_bin.obj	\
+	$(OBJ)\fp_toradix.obj	\
+	$(OBJ)\fp_unsigned_bin_size.obj	\
+	$(OBJ)\fp_cnt_lsb.obj	\
+	$(OBJ)\fp_count_bits.obj	\
+	$(OBJ)\fp_div_2.obj	\
+	$(OBJ)\fp_div_2d.obj	\
+	$(OBJ)\fp_lshd.obj	\
+	$(OBJ)\fp_mod_2d.obj	\
+	$(OBJ)\fp_rshd.obj	\
+	$(OBJ)\fp_div.obj	\
+	$(OBJ)\fp_div_d.obj	\
+	$(OBJ)\fp_mod.obj	\
+	$(OBJ)\fp_mod_d.obj	\
+	$(OBJ)\fp_2expt.obj	\
+	$(OBJ)\fp_exptmod.obj	\
+	$(OBJ)\fp_ident.obj	\
+	$(OBJ)\fp_set.obj	\
+	$(OBJ)\fp_montgomery_calc_normalization.obj	\
+	$(OBJ)\fp_montgomery_reduce.obj	\
+	$(OBJ)\fp_montgomery_setup.obj	\
+	$(OBJ)\fp_mul.obj	\
+	$(OBJ)\fp_mul_2.obj	\
+	$(OBJ)\fp_mul_2d.obj	\
+	$(OBJ)\fp_mul_comba.obj	\
+	$(OBJ)\fp_mul_comba_12.obj	\
+	$(OBJ)\fp_mul_comba_17.obj	\
+	$(OBJ)\fp_mul_comba_20.obj	\
+	$(OBJ)\fp_mul_comba_24.obj	\
+	$(OBJ)\fp_mul_comba_28.obj	\
+	$(OBJ)\fp_mul_comba_3.obj	\
+	$(OBJ)\fp_mul_comba_32.obj	\
+	$(OBJ)\fp_mul_comba_4.obj	\
+	$(OBJ)\fp_mul_comba_48.obj	\
+	$(OBJ)\fp_mul_comba_6.obj	\
+	$(OBJ)\fp_mul_comba_64.obj	\
+	$(OBJ)\fp_mul_comba_7.obj	\
+	$(OBJ)\fp_mul_comba_8.obj	\
+	$(OBJ)\fp_mul_comba_9.obj	\
+	$(OBJ)\fp_mul_comba_small_set.obj	\
+	$(OBJ)\fp_mul_d.obj	\
+	$(OBJ)\fp_mulmod.obj	\
+	$(OBJ)\fp_gcd.obj	\
+	$(OBJ)\fp_invmod.obj	\
+	$(OBJ)\fp_isprime.obj	\
+	$(OBJ)\fp_lcm.obj	\
+	$(OBJ)\fp_prime_miller_rabin.obj	\
+	$(OBJ)\fp_prime_random_ex.obj	\
+	$(OBJ)\fp_sqr.obj	\
+	$(OBJ)\fp_sqr_comba.obj	\
+	$(OBJ)\fp_sqr_comba_12.obj	\
+	$(OBJ)\fp_sqr_comba_17.obj	\
+	$(OBJ)\fp_sqr_comba_20.obj	\
+	$(OBJ)\fp_sqr_comba_24.obj	\
+	$(OBJ)\fp_sqr_comba_28.obj	\
+	$(OBJ)\fp_sqr_comba_3.obj	\
+	$(OBJ)\fp_sqr_comba_32.obj	\
+	$(OBJ)\fp_sqr_comba_4.obj	\
+	$(OBJ)\fp_sqr_comba_48.obj	\
+	$(OBJ)\fp_sqr_comba_6.obj	\
+	$(OBJ)\fp_sqr_comba_64.obj	\
+	$(OBJ)\fp_sqr_comba_7.obj	\
+	$(OBJ)\fp_sqr_comba_8.obj	\
+	$(OBJ)\fp_sqr_comba_9.obj	\
+	$(OBJ)\fp_sqr_comba_generic.obj	\
+	$(OBJ)\fp_sqr_comba_small_set.obj	\
+	$(OBJ)\fp_sqrmod.obj
+
+{src\addsub}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\bin}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\bit}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\divide}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\exptmod}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\misc}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\mont}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\mul}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\numtheory}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\sqr}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\headers}.h{$(INCDIR)}.h:
+	$(CP) $** $@
+
+$(LIBTFM): $(libtfm_OBJs)
+	$(LIBCON)
+
+all:: $(INCFILES) $(LIBTFM)
diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index cab7e805a..8391afae6 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -456,3 +456,4 @@ LIBHDB	    =$(LIBDIR)\libhdb.lib
 LIBKADM5SRV =$(LIBDIR)\libkadm5srv.lib
 LIBKADM5CLNT=$(LIBDIR)\libkadm5clnt.lib
 LIBKDC	    =$(LIBDIR)\libkdc.lib
+LIBTFM	    =$(LIBDIR)\libtfm.lib

From b252f38c4c193f11db7b05153ea48b980faca061 Mon Sep 17 00:00:00 2001
From: Asanka Herath <asanka@secure-endpoints.com>
Date: Wed, 26 May 2010 12:19:29 -0400
Subject: [PATCH 16/16] .gitgnore Windows artifacts

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 166fed8d4..4b52ce5c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,7 @@ asn1_*.[cx]
 /libtool
 /ltmain.sh
 /missing
+/setupbuild.cmd
 /ylwrap
 
 # Files in subdirectories.
@@ -255,6 +256,7 @@ asn1_*.[cx]
 /lib/wind/normalize_table.h
 /lib/wind/punycode_examples.c
 /lib/wind/punycode_examples.h
+/out
 /po/gen-po.sh
 /scripts
 /tests/bin/setup-env