diff --git a/lib/gssapi/krb5/sequence.c b/lib/gssapi/krb5/sequence.c
new file mode 100644
index 000000000..e74fafe97
--- /dev/null
+++ b/lib/gssapi/krb5/sequence.c
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id$");
+
+#define DEFAULT_JITTER_WINDOW 20
+
+struct gss_msg_order {
+    OM_uint32 flags;
+    OM_uint32 start;
+    OM_uint32 length;
+    OM_uint32 jitter_window;
+    OM_uint32 first_seq;
+    OM_uint32 elem[1];
+};
+
+/*
+ *
+ */
+
+OM_uint32
+gssapi_msg_order_create(OM_uint32 *minor_status,
+			struct gss_msg_order **o, 
+			OM_uint32 flags, 
+			OM_uint32 seq_num, 
+			OM_uint32 jitter_window)
+{
+    size_t len;
+
+    if (jitter_window == 0)
+	jitter_window = DEFAULT_JITTER_WINDOW;
+
+    len = jitter_window * sizeof((*o)->elem[0]);
+    len += sizeof(**o);
+    len -= sizeof((*o)->elem[0]);
+    
+    *o = malloc(len);
+    if (*o == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }	
+    memset(*o, 0, len);
+    (*o)->flags = flags;
+    (*o)->length = 0;
+    (*o)->first_seq = seq_num;
+    (*o)->jitter_window = jitter_window;
+    (*o)->elem[0] = seq_num - 1;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32
+gssapi_msg_order_destroy(struct gss_msg_order **m)
+{
+    free(*m);
+    *m = NULL;
+    return GSS_S_COMPLETE;
+}
+
+static void
+elem_set(struct gss_msg_order *o, unsigned int slot, OM_uint32 val)
+{
+    o->elem[slot % o->jitter_window] = val;
+}
+
+#if 0
+static OM_uint32
+elem_get(struct gss_msg_order *o, unsigned int slot)
+{
+    return o->elem[slot % o->jitter_window];
+}
+#endif
+
+static void
+elem_insert(struct gss_msg_order *o, 
+	    unsigned int after_slot,
+	    OM_uint32 seq_num)
+{
+    assert(o->jitter_window > after_slot);
+
+    if (o->length > after_slot)
+	memmove(&o->elem[after_slot + 1], &o->elem[after_slot],
+		(o->length - after_slot) * sizeof(o->elem[0]));
+
+    elem_set(o, after_slot, seq_num);
+
+    if (o->length < o->jitter_window)
+	o->length++;
+}
+
+#if 0
+static int
+elem_samep(struct gss_msg_order *o,
+	   unsigned int slot,
+	   OM_uint32 value)
+{
+    return elem_get(o, slot) == value;
+}
+#endif
+
+/* rule 1: expected sequence number */
+/* rule 2: > expected sequence number */
+/* rule 3: seqnum < seqnum(first) */
+/* rule 4+5: seqnum in [seqnum(first),seqnum(last)]  */
+
+OM_uint32
+gssapi_msg_order_check(struct gss_msg_order *o, OM_uint32 seq_num)
+{
+    OM_uint32 r;
+    int i;
+
+    if (o == NULL)
+	return GSS_S_COMPLETE;
+
+    if ((o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) == 0)
+	return GSS_S_COMPLETE;
+
+    /* check if the packet is the next in order */
+    if (o->elem[0] == seq_num - 1) {
+	elem_insert(o, 0, seq_num);
+	return GSS_S_COMPLETE;
+    }
+
+    r = (o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG))==GSS_C_REPLAY_FLAG;
+
+    /* sequence number larger then largest sequence number 
+     * or smaller then the first sequence number */
+    if (seq_num > o->elem[0]
+	|| seq_num < o->first_seq
+	|| o->length == 0) 
+    {
+	elem_insert(o, 0, seq_num);
+	if (r) {
+	    return GSS_S_COMPLETE;
+	} else {
+	    return GSS_S_GAP_TOKEN;
+	}
+    }
+
+    assert(o->length > 0);
+
+    /* sequence number smaller the first sequence number */
+    if (seq_num < o->elem[o->length - 1]) {
+	if (r)
+	    return(GSS_S_OLD_TOKEN);
+	else
+	    return(GSS_S_UNSEQ_TOKEN);
+    }
+
+    if (seq_num == o->elem[o->length-1])
+	return GSS_S_DUPLICATE_TOKEN;
+
+    for (i = 0; i < o->length - 1; i++) {
+	if (o->elem[i] == seq_num)
+	    return GSS_S_DUPLICATE_TOKEN;
+	if (o->elem[i + 1] < seq_num && o->elem[i] < seq_num) {
+	    elem_insert(o, i, seq_num);
+	    if (r)
+		return GSS_S_COMPLETE;
+	    else
+		return GSS_S_UNSEQ_TOKEN;
+	}
+    }
+
+    return GSS_S_FAILURE;
+}
diff --git a/lib/gssapi/krb5/test_sequence.c b/lib/gssapi/krb5/test_sequence.c
new file mode 100644
index 000000000..348166041
--- /dev/null
+++ b/lib/gssapi/krb5/test_sequence.c
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id$");
+
+/* correct ordering */
+OM_uint32 pattern1[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
+};
+
+/* gap 10 */
+OM_uint32 pattern2[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13
+};
+
+/* dup 9 */
+OM_uint32 pattern3[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 9, 10, 11, 12, 13
+};
+
+/* gaps */
+OM_uint32 pattern4[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 13, 14, 15, 16, 18, 100
+};
+
+/* 11 before 10 */
+OM_uint32 pattern5[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 10, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21
+};
+
+/* long */
+OM_uint32 pattern6[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
+    10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+    20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
+    30, 31, 32, 33, 34, 35, 36, 37, 38, 39,
+    40, 41, 42, 43, 44, 45, 46, 47, 48, 49,
+    50, 51, 52, 53, 54, 55, 56, 57, 58, 59
+};
+
+/* dont start at 0 */
+OM_uint32 pattern7[] = {
+    11, 12, 13
+};
+
+static int
+test_seq(int t, OM_uint32 flags, OM_uint32 *pattern, int pattern_len)
+{
+    struct gss_msg_order *o;
+    OM_uint32 maj_stat, min_stat;
+    int i;
+
+    maj_stat = gssapi_msg_order_create(&min_stat, &o, flags, 0, 20);
+    if (maj_stat)
+	err(1, "create: %d %d", maj_stat, min_stat);
+
+    for (i = 0; i < pattern_len; i++) {
+	maj_stat = gssapi_msg_order_check(o, pattern[i]);
+	if (maj_stat)
+	    return maj_stat;
+    }
+    gssapi_msg_order_destroy(&o);
+
+    return 0;
+}
+
+struct {
+    OM_uint32 flags;
+    OM_uint32 *pattern;
+    int pattern_len;
+    OM_uint32 error_code;
+} pl[] = {
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	0
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	0,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	0
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	0
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_GAP_TOKEN
+    },
+};
+
+int
+main(int argc, char **argv)
+{
+    OM_uint32 maj_stat;
+    int i, failed = 0;
+
+    for (i = 0; i < sizeof(pl)/sizeof(pl[0]); i++) {
+	maj_stat = test_seq(i,
+			    pl[i].flags,
+			    pl[i].pattern,
+			    pl[i].pattern_len);
+	if (maj_stat != pl[i].error_code) {
+	    printf("test pattern %d failed with %d (should have been %d)\n",
+		   i, maj_stat, pl[i].error_code);
+	    failed = 1;
+	} else
+	    printf("test %d success\n", i);
+    }
+    return failed;
+}
diff --git a/lib/gssapi/sequence.c b/lib/gssapi/sequence.c
new file mode 100644
index 000000000..e74fafe97
--- /dev/null
+++ b/lib/gssapi/sequence.c
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id$");
+
+#define DEFAULT_JITTER_WINDOW 20
+
+struct gss_msg_order {
+    OM_uint32 flags;
+    OM_uint32 start;
+    OM_uint32 length;
+    OM_uint32 jitter_window;
+    OM_uint32 first_seq;
+    OM_uint32 elem[1];
+};
+
+/*
+ *
+ */
+
+OM_uint32
+gssapi_msg_order_create(OM_uint32 *minor_status,
+			struct gss_msg_order **o, 
+			OM_uint32 flags, 
+			OM_uint32 seq_num, 
+			OM_uint32 jitter_window)
+{
+    size_t len;
+
+    if (jitter_window == 0)
+	jitter_window = DEFAULT_JITTER_WINDOW;
+
+    len = jitter_window * sizeof((*o)->elem[0]);
+    len += sizeof(**o);
+    len -= sizeof((*o)->elem[0]);
+    
+    *o = malloc(len);
+    if (*o == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }	
+    memset(*o, 0, len);
+    (*o)->flags = flags;
+    (*o)->length = 0;
+    (*o)->first_seq = seq_num;
+    (*o)->jitter_window = jitter_window;
+    (*o)->elem[0] = seq_num - 1;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
+OM_uint32
+gssapi_msg_order_destroy(struct gss_msg_order **m)
+{
+    free(*m);
+    *m = NULL;
+    return GSS_S_COMPLETE;
+}
+
+static void
+elem_set(struct gss_msg_order *o, unsigned int slot, OM_uint32 val)
+{
+    o->elem[slot % o->jitter_window] = val;
+}
+
+#if 0
+static OM_uint32
+elem_get(struct gss_msg_order *o, unsigned int slot)
+{
+    return o->elem[slot % o->jitter_window];
+}
+#endif
+
+static void
+elem_insert(struct gss_msg_order *o, 
+	    unsigned int after_slot,
+	    OM_uint32 seq_num)
+{
+    assert(o->jitter_window > after_slot);
+
+    if (o->length > after_slot)
+	memmove(&o->elem[after_slot + 1], &o->elem[after_slot],
+		(o->length - after_slot) * sizeof(o->elem[0]));
+
+    elem_set(o, after_slot, seq_num);
+
+    if (o->length < o->jitter_window)
+	o->length++;
+}
+
+#if 0
+static int
+elem_samep(struct gss_msg_order *o,
+	   unsigned int slot,
+	   OM_uint32 value)
+{
+    return elem_get(o, slot) == value;
+}
+#endif
+
+/* rule 1: expected sequence number */
+/* rule 2: > expected sequence number */
+/* rule 3: seqnum < seqnum(first) */
+/* rule 4+5: seqnum in [seqnum(first),seqnum(last)]  */
+
+OM_uint32
+gssapi_msg_order_check(struct gss_msg_order *o, OM_uint32 seq_num)
+{
+    OM_uint32 r;
+    int i;
+
+    if (o == NULL)
+	return GSS_S_COMPLETE;
+
+    if ((o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) == 0)
+	return GSS_S_COMPLETE;
+
+    /* check if the packet is the next in order */
+    if (o->elem[0] == seq_num - 1) {
+	elem_insert(o, 0, seq_num);
+	return GSS_S_COMPLETE;
+    }
+
+    r = (o->flags & (GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG))==GSS_C_REPLAY_FLAG;
+
+    /* sequence number larger then largest sequence number 
+     * or smaller then the first sequence number */
+    if (seq_num > o->elem[0]
+	|| seq_num < o->first_seq
+	|| o->length == 0) 
+    {
+	elem_insert(o, 0, seq_num);
+	if (r) {
+	    return GSS_S_COMPLETE;
+	} else {
+	    return GSS_S_GAP_TOKEN;
+	}
+    }
+
+    assert(o->length > 0);
+
+    /* sequence number smaller the first sequence number */
+    if (seq_num < o->elem[o->length - 1]) {
+	if (r)
+	    return(GSS_S_OLD_TOKEN);
+	else
+	    return(GSS_S_UNSEQ_TOKEN);
+    }
+
+    if (seq_num == o->elem[o->length-1])
+	return GSS_S_DUPLICATE_TOKEN;
+
+    for (i = 0; i < o->length - 1; i++) {
+	if (o->elem[i] == seq_num)
+	    return GSS_S_DUPLICATE_TOKEN;
+	if (o->elem[i + 1] < seq_num && o->elem[i] < seq_num) {
+	    elem_insert(o, i, seq_num);
+	    if (r)
+		return GSS_S_COMPLETE;
+	    else
+		return GSS_S_UNSEQ_TOKEN;
+	}
+    }
+
+    return GSS_S_FAILURE;
+}
diff --git a/lib/gssapi/test_sequence.c b/lib/gssapi/test_sequence.c
new file mode 100644
index 000000000..348166041
--- /dev/null
+++ b/lib/gssapi/test_sequence.c
@@ -0,0 +1,294 @@
+/*
+ * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id$");
+
+/* correct ordering */
+OM_uint32 pattern1[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
+};
+
+/* gap 10 */
+OM_uint32 pattern2[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13
+};
+
+/* dup 9 */
+OM_uint32 pattern3[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 9, 10, 11, 12, 13
+};
+
+/* gaps */
+OM_uint32 pattern4[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 13, 14, 15, 16, 18, 100
+};
+
+/* 11 before 10 */
+OM_uint32 pattern5[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 10, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21
+};
+
+/* long */
+OM_uint32 pattern6[] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
+    10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+    20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
+    30, 31, 32, 33, 34, 35, 36, 37, 38, 39,
+    40, 41, 42, 43, 44, 45, 46, 47, 48, 49,
+    50, 51, 52, 53, 54, 55, 56, 57, 58, 59
+};
+
+/* dont start at 0 */
+OM_uint32 pattern7[] = {
+    11, 12, 13
+};
+
+static int
+test_seq(int t, OM_uint32 flags, OM_uint32 *pattern, int pattern_len)
+{
+    struct gss_msg_order *o;
+    OM_uint32 maj_stat, min_stat;
+    int i;
+
+    maj_stat = gssapi_msg_order_create(&min_stat, &o, flags, 0, 20);
+    if (maj_stat)
+	err(1, "create: %d %d", maj_stat, min_stat);
+
+    for (i = 0; i < pattern_len; i++) {
+	maj_stat = gssapi_msg_order_check(o, pattern[i]);
+	if (maj_stat)
+	    return maj_stat;
+    }
+    gssapi_msg_order_destroy(&o);
+
+    return 0;
+}
+
+struct {
+    OM_uint32 flags;
+    OM_uint32 *pattern;
+    int pattern_len;
+    OM_uint32 error_code;
+} pl[] = {
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	0
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	0,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	0,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	0
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_REPLAY_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern1,
+	sizeof(pattern1)/sizeof(pattern1[0]),
+	0
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern2,
+	sizeof(pattern2)/sizeof(pattern2[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern3,
+	sizeof(pattern3)/sizeof(pattern3[0]),
+	GSS_S_DUPLICATE_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern4,
+	sizeof(pattern4)/sizeof(pattern4[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern5,
+	sizeof(pattern5)/sizeof(pattern5[0]),
+	GSS_S_GAP_TOKEN
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern6,
+	sizeof(pattern6)/sizeof(pattern6[0]),
+	GSS_S_COMPLETE
+    },
+    {
+	GSS_C_SEQUENCE_FLAG,
+	pattern7,
+	sizeof(pattern7)/sizeof(pattern7[0]),
+	GSS_S_GAP_TOKEN
+    },
+};
+
+int
+main(int argc, char **argv)
+{
+    OM_uint32 maj_stat;
+    int i, failed = 0;
+
+    for (i = 0; i < sizeof(pl)/sizeof(pl[0]); i++) {
+	maj_stat = test_seq(i,
+			    pl[i].flags,
+			    pl[i].pattern,
+			    pl[i].pattern_len);
+	if (maj_stat != pl[i].error_code) {
+	    printf("test pattern %d failed with %d (should have been %d)\n",
+		   i, maj_stat, pl[i].error_code);
+	    failed = 1;
+	} else
+	    printf("test %d success\n", i);
+    }
+    return failed;
+}