diff -Nacr openssl-0.9.5a.orig/apps/Makefile.ssl openssl-0.9.5a/apps/Makefile.ssl
*** openssl-0.9.5a.orig/apps/Makefile.ssl	Mon Mar 20 02:27:34 2000
--- openssl-0.9.5a/apps/Makefile.ssl	Tue Jul 11 15:42:18 2000
***************
*** 5,11 ****
  DIR=		apps
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include
  CFLAG=		-g -static
  INSTALL_PREFIX=
  INSTALLTOP=	/usr/local/ssl
--- 5,11 ----
  DIR=		apps
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include -I /usr/local/krb5/include
  CFLAG=		-g -static
  INSTALL_PREFIX=
  INSTALLTOP=	/usr/local/ssl
***************
*** 25,32 ****
  
  DLIBCRYPTO=../libcrypto.a
  DLIBSSL=../libssl.a
! LIBCRYPTO=-L.. -lcrypto
! LIBSSL=-L.. -lssl
  
  PROGRAM= openssl
  
--- 25,37 ----
  
  DLIBCRYPTO=../libcrypto.a
  DLIBSSL=../libssl.a
! # LIBCRYPTO=-L.. -lcrypto
! # LIBSSL=-L.. -lssl
! LIBCRYPTO=../libcrypto.a
! LIBSSL=../libssl.a
! LIBKRB5=-L /usr/local/krb5/lib -lgssapi_krb5 -lkrb5 -lcom_err /usr/local/krb5/lib/libcrypto.a  -lresolv
! # MALLOC_LIBS= ./libefence.a
! MALLOC_LIBS=
  
  PROGRAM= openssl
  
***************
*** 134,140 ****
  
  $(PROGRAM): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL)
  	$(RM) $(PROGRAM)
! 	$(CC) -o $(PROGRAM) $(CFLAGS) $(PROGRAM).o $(E_OBJ) $(PEX_LIBS) $(LIBSSL) $(LIBCRYPTO) $(EX_LIBS)
  	@(cd ..; OPENSSL="`pwd`/apps/openssl"; export OPENSSL; sh tools/c_rehash certs)
  
  progs.h: progs.pl
--- 139,145 ----
  
  $(PROGRAM): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL)
  	$(RM) $(PROGRAM)
! 	$(CC) -o $(PROGRAM) $(CFLAGS) $(PROGRAM).o $(E_OBJ) $(MALLOC_LIBS) $(PEX_LIBS) $(LIBSSL) $(LIBKRB5) $(LIBCRYPTO) $(EX_LIBS)
  	@(cd ..; OPENSSL="`pwd`/apps/openssl"; export OPENSSL; sh tools/c_rehash certs)
  
  progs.h: progs.pl
diff -Nacr openssl-0.9.5a.orig/apps/s_client.c openssl-0.9.5a/apps/s_client.c
*** openssl-0.9.5a.orig/apps/s_client.c	Mon Mar 13 18:54:07 2000
--- openssl-0.9.5a/apps/s_client.c	Tue Jul 11 15:42:18 2000
***************
*** 387,392 ****
--- 387,397 ----
  
  
  	con=SSL_new(ctx);
+ #ifndef NO_KRB5
+ 	if (con  &&  (con->kssl_ctx = kssl_ctx_new()) != NULL)  {
+ 		kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVER, host);
+ 		}
+ #endif	/* NO_KRB5  */
  /*	SSL_set_cipher_list(con,"RC4-MD5"); */
  
  re_start:
diff -Nacr openssl-0.9.5a.orig/apps/s_server.c openssl-0.9.5a/apps/s_server.c
*** openssl-0.9.5a.orig/apps/s_server.c	Mon Feb 21 12:09:52 2000
--- openssl-0.9.5a/apps/s_server.c	Tue Jul 11 15:42:18 2000
***************
*** 785,790 ****
--- 785,796 ----
  
  	if (con == NULL) {
  		con=SSL_new(ctx);
+ #ifndef NO_KRB5
+ 		if ((con->kssl_ctx = kssl_ctx_new()) != NULL)  {
+ 			kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, KRB5SVC);
+ 			kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, KRB5KEYTAB);
+ 			}
+ #endif	/* NO_KRB5 */
  		if(context)
  		      SSL_set_session_id_context(con, context,
  						 strlen((char *)context));
***************
*** 1167,1172 ****
--- 1173,1184 ----
  	if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
  
  	if ((con=SSL_new(ctx)) == NULL) goto err;
+ #ifndef NO_KRB5
+ 	if ((con->kssl_ctx = kssl_ctx_new()) != NULL)  {
+ 		kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, KRB5SVC);
+ 		kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, KRB5KEYTAB);
+ 		}
+ #endif  /* NO_KRB5 */
  	if(context) SSL_set_session_id_context(con, context,
  					       strlen((char *)context));
  
diff -Nacr openssl-0.9.5a.orig/config openssl-0.9.5a/config
*** openssl-0.9.5a.orig/config	Mon Mar 13 18:52:44 2000
--- openssl-0.9.5a/config	Tue Jul 11 15:42:18 2000
***************
*** 314,327 ****
  # figure out if gcc is available and if so we use it otherwise
  # we fallback to whatever cc does on the system
  GCCVER=`(gcc --version) 2>/dev/null`
! if [ "$GCCVER" != "" ]; then
!   CC=gcc
!   # then strip off whatever prefix Cygnus prepends the number with...
!   GCCVER=`echo $GCCVER | sed 's/^[a-z]*\-//'`
!   # peak single digit before and after first dot, e.g. 2.95.1 gives 29
!   GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
! else
!   CC=cc
  fi
  
  if [ "$SYSTEM" = "SunOS" ]; then
--- 314,329 ----
  # figure out if gcc is available and if so we use it otherwise
  # we fallback to whatever cc does on the system
  GCCVER=`(gcc --version) 2>/dev/null`
! if [ "$CC" = "" ]; then
! 	if [ "$GCCVER" != "" ]; then
! 	  CC=gcc
! 	  # then strip off whatever prefix Cygnus prepends the number with...
! 	  GCCVER=`echo $GCCVER | sed 's/^[a-z]*\-//'`
! 	  # peak single digit before and after first dot, e.g. 2.95.1 gives 29
! 	  GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
! 	else
! 	  CC=cc
! 	fi
  fi
  
  if [ "$SYSTEM" = "SunOS" ]; then
diff -Nacr openssl-0.9.5a.orig/crypto/evp/e_cbc_3d.c openssl-0.9.5a/crypto/evp/e_cbc_3d.c
*** openssl-0.9.5a.orig/crypto/evp/e_cbc_3d.c	Fri Dec  3 15:24:03 1999
--- openssl-0.9.5a/crypto/evp/e_cbc_3d.c	Tue Jul 11 15:42:18 2000
***************
*** 127,132 ****
--- 127,138 ----
  	     unsigned char *iv, int enc)
  	{
  	des_cblock *deskey = (des_cblock *)key;
+ #ifdef KSSL_DEBUG
+ 	{ int i;  printf("des_cbc_ede3_init_key(ctx=%lx)\n", ctx);
+ 	printf("\tKEY= "); for(i=0;i<24;i++) printf("%02X",key[i]); printf("\n");
+ 	printf("\t IV= "); for(i=0;i<8;i++) printf("%02X",iv[i]); printf("\n");
+ 	}
+ #endif    /* KSSL_DEBUG */
  
  	if (iv != NULL)
  		memcpy(&(ctx->oiv[0]),iv,8);
***************
*** 143,148 ****
--- 149,163 ----
  static void des_cbc_ede_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  	     unsigned char *in, unsigned int inl)
  	{
+ #ifdef KSSL_DEBUG
+ 	{ int i; char *cp;
+ 	printf("des_cbc_ede_cipher(ctx=%lx, buflen=%d)\n",
+ 	ctx, ctx->buf_len);
+ 	printf("\t iv= "); for(i=0;i<8;i++) printf("%02X",ctx->iv[i]);
+ 	printf("\n");
+ 	}
+ #endif    /* KSSL_DEBUG */
+ 
  	des_ede3_cbc_encrypt(in,out,inl, ctx->c.des_ede.ks1,
  		ctx->c.des_ede.ks2,ctx->c.des_ede.ks3,
  		(des_cblock *) &(ctx->iv[0]),
diff -Nacr openssl-0.9.5a.orig/include/openssl/ssl.h openssl-0.9.5a/include/openssl/ssl.h
*** openssl-0.9.5a.orig/include/openssl/ssl.h	Thu Mar 16 14:47:31 2000
--- openssl-0.9.5a/include/openssl/ssl.h	Tue Jul 11 15:42:18 2000
***************
*** 65,70 ****
--- 65,74 ----
  
  #include <openssl/safestack.h>
  
+ #ifndef NO_KRB5
+ #include "kssl.h"
+ #endif	/* NO_KRB5 */
+ 
  /* SSLeay version number for ASN.1 encoding of the session information */
  /* Version 0 - initial version
   * Version 1 - added the optional peer certificate
***************
*** 83,88 ****
--- 87,101 ----
  #define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5	
  #define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA	
  
+ /*    VRS Additional Kerberos5 entries
+ */
+ #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA
+ #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5
+ #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA
+ #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5
+ #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA
+ #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5
+ 
  #define SSL_MAX_SSL_SESSION_ID_LENGTH		32
  #define SSL_MAX_SID_CTX_LENGTH			32
  
***************
*** 103,108 ****
--- 116,125 ----
  #define	SSL_TXT_eNULL		"eNULL"
  #define	SSL_TXT_NULL		"NULL"
  
+ #define SSL_TXT_kKRB5     	"kKRB5"
+ #define SSL_TXT_aKRB5     	"aKRB5"
+ #define SSL_TXT_KRB5      	"KRB5"
+ 
  #define SSL_TXT_kRSA		"kRSA"
  #define SSL_TXT_kDHr		"kDHr"
  #define SSL_TXT_kDHd		"kDHd"
***************
*** 635,640 ****
--- 652,661 ----
  	int error;		/* error bytes to be written */
  	int error_code;		/* actual code */
  
+ #ifndef NO_KRB5
+ 	KSSL_CTX *kssl_ctx;
+ #endif	/* NO_KRB5 */
+ 
  	SSL_CTX *ctx;
  	/* set this flag to 1 and a sleep(1) is put into all SSL_read()
  	 * and SSL_write() calls, good for nbio debuging :-) */
***************
*** 1383,1388 ****
--- 1404,1417 ----
  #define SSL_R_INTERNAL_ERROR				 157
  #define SSL_R_INVALID_CHALLENGE_LENGTH			 158
  #define SSL_R_INVALID_COMMAND				 280
+ #define SSL_R_KRB5_C_INIT              		281
+ #define SSL_R_KRB5_C_MK_REQ                	282
+ #define SSL_R_KRB5_S_INIT              		283
+ #define SSL_R_KRB5_S_RD_REQ                	284
+ #define SSL_R_KRB5_S_BAD_TICKET             285
+ #define SSL_R_BAD_KMODE					 	286
+ #define SSL_R_KRB5_C_GET_CRED              	287
+ #define SSL_R_KRB5_C_CC_PRINC              	288
  #define SSL_R_INVALID_PURPOSE				 278
  #define SSL_R_INVALID_TRUST				 279
  #define SSL_R_LENGTH_MISMATCH				 159
diff -Nacr openssl-0.9.5a.orig/include/openssl/ssl3.h openssl-0.9.5a/include/openssl/ssl3.h
*** openssl-0.9.5a.orig/include/openssl/ssl3.h	Fri Feb 25 09:27:31 2000
--- openssl-0.9.5a/include/openssl/ssl3.h	Tue Jul 11 15:42:18 2000
***************
*** 102,107 ****
--- 102,123 ----
  #define SSL3_CK_FZA_DMS_FZA_SHA			0x0300001D
  #define SSL3_CK_FZA_DMS_RC4_SHA			0x0300001E
  
+ /*    VRS Additional Kerberos5 entries
+ */
+ #define SSL3_CK_KRB5_DES_40_CBC_SHA       	0x03000021
+ #define SSL3_CK_KRB5_DES_40_CBC_MD5       	0x03000022
+ #define SSL3_CK_KRB5_DES_64_CBC_SHA       	0x03000023
+ #define SSL3_CK_KRB5_DES_64_CBC_MD5       	0x03000024
+ #define SSL3_CK_KRB5_DES_192_CBC3_SHA 		0x03000025
+ #define SSL3_CK_KRB5_DES_192_CBC3_MD5 		0x03000026
+ 
+ #define SSL3_TXT_KRB5_DES_40_CBC_SHA  		"EXP-KRB5-DES-CBC-SHA"
+ #define SSL3_TXT_KRB5_DES_40_CBC_MD5  		"EXP-KRB5-DES-CBC-MD5"
+ #define SSL3_TXT_KRB5_DES_64_CBC_SHA  		"KRB5-DES-CBC-SHA"
+ #define SSL3_TXT_KRB5_DES_64_CBC_MD5  		"KRB5-DES-CBC-MD5"
+ #define SSL3_TXT_KRB5_DES_192_CBC3_SHA    	"KRB5-DES-CBC3-SHA"
+ #define SSL3_TXT_KRB5_DES_192_CBC3_MD5    	"KRB5-DES-CBC3-MD5"
+ 
  #define SSL3_TXT_RSA_NULL_MD5			"NULL-MD5"
  #define SSL3_TXT_RSA_NULL_SHA			"NULL-SHA"
  #define SSL3_TXT_RSA_RC4_40_MD5 		"EXP-RC4-MD5"
diff -Nacr openssl-0.9.5a.orig/ssl/Makefile.ssl openssl-0.9.5a/ssl/Makefile.ssl
*** openssl-0.9.5a.orig/ssl/Makefile.ssl	Mon Mar 20 02:27:29 2000
--- openssl-0.9.5a/ssl/Makefile.ssl	Tue Jul 11 15:42:19 2000
***************
*** 5,11 ****
  DIR=	ssl
  TOP=	..
  CC=	cc
! INCLUDES= -I../crypto -I../include
  CFLAG=-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
--- 5,11 ----
  DIR=	ssl
  TOP=	..
  CC=	cc
! INCLUDES= -I../crypto -I../include  -I. -I/usr/local/krb5/include
  CFLAG=-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
***************
*** 30,36 ****
  	ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \
  	ssl_ciph.c ssl_stat.c ssl_rsa.c \
  	ssl_asn1.c ssl_txt.c ssl_algs.c \
! 	bio_ssl.c ssl_err.c
  LIBOBJ= \
  	s2_meth.o  s2_srvr.o  s2_clnt.o  s2_lib.o  s2_enc.o s2_pkt.o \
  	s3_meth.o  s3_srvr.o  s3_clnt.o  s3_lib.o  s3_enc.o s3_pkt.o s3_both.o \
--- 30,36 ----
  	ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \
  	ssl_ciph.c ssl_stat.c ssl_rsa.c \
  	ssl_asn1.c ssl_txt.c ssl_algs.c \
! 	bio_ssl.c ssl_err.c  kssl.c yaapp_rand.c
  LIBOBJ= \
  	s2_meth.o  s2_srvr.o  s2_clnt.o  s2_lib.o  s2_enc.o s2_pkt.o \
  	s3_meth.o  s3_srvr.o  s3_clnt.o  s3_lib.o  s3_enc.o s3_pkt.o s3_both.o \
***************
*** 39,49 ****
  	ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \
  	ssl_ciph.o ssl_stat.o ssl_rsa.o \
  	ssl_asn1.o ssl_txt.o ssl_algs.o \
! 	bio_ssl.o ssl_err.o
  
  SRC= $(LIBSRC)
  
! EXHEADER= ssl.h ssl2.h ssl3.h ssl23.h tls1.h
  HEADER=	$(EXHEADER) ssl_locl.h
  
  ALL=    $(GENERAL) $(SRC) $(HEADER)
--- 39,49 ----
  	ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \
  	ssl_ciph.o ssl_stat.o ssl_rsa.o \
  	ssl_asn1.o ssl_txt.o ssl_algs.o \
! 	bio_ssl.o ssl_err.o  kssl.o yaapp_rand.o
  
  SRC= $(LIBSRC)
  
! EXHEADER= ssl.h ssl2.h ssl3.h ssl23.h tls1.h  kssl.h
  HEADER=	$(EXHEADER) ssl_locl.h
  
  ALL=    $(GENERAL) $(SRC) $(HEADER)
diff -Nacr openssl-0.9.5a.orig/ssl/kssl.c openssl-0.9.5a/ssl/kssl.c
*** openssl-0.9.5a.orig/ssl/kssl.c	Wed Dec 31 19:00:00 1969
--- openssl-0.9.5a/ssl/kssl.c	Tue Jul 11 15:42:19 2000
***************
*** 0 ****
--- 1,474 ----
+ /*	ssl/kssl.c  --  Routines to support (& debug) Kerberos5 auth for openssl
+ **
+ **	19990701	VRS 	Started.
+ */
+ 
+ #ifndef NO_KRB5
+ 
+ #include <string.h>
+ #include "ssl.h"
+ 
+ 
+ char 	*kstring(char *string)
+ {
+ 	static char	*null = "[NULL]";
+ 
+ 	return ((string == NULL)? null: string);
+ }
+ 
+ #define	MAXKNUM	255
+ char 	*knumber(int len, krb5_octet *contents)
+ {
+ 	static char	buf[MAXKNUM+1];
+ 	int 		i;
+ 
+ 	snprintf(buf, MAXKNUM, "[%d] ", len);
+ 
+ 	for (i=0; i < len  &&  MAXKNUM > strlen(buf)+3; i++)  {
+ 		snprintf(&buf[strlen(buf)], 3, "%02x", contents[i]);
+ 		}
+ 	
+ 	return (buf);
+ }
+ 
+ 
+ /*	Set kssl_err error info when reason text is a simple string
+ **		kssl_err = struct { int reason; char text[KSSL_ERR_MAX+1]; }
+ */
+ void 	kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text)
+ {
+ 	if (kssl_err == NULL)  return;
+ 
+ 	kssl_err->reason = reason;
+ 	snprintf(kssl_err->text, KSSL_ERR_MAX, text);
+ 	return;
+ }
+ 
+ 
+ /*	Display contents of krb5_data struct, for debugging
+ */
+ void	print_krb5_data(char *label, krb5_data *kdata)
+ {
+ 	int 	i;
+ 
+ 	printf("%s[%d] ", label, kdata->length);
+ 	for (i=0; i < kdata->length; i++)  {
+ 		if (isprint((int) kdata->data[i])) 
+ 				printf(	"%c ",  kdata->data[i]);
+ 		else	printf(	"%02x", kdata->data[i]);
+ 		}
+ 	printf("\n");
+ }
+ 
+ 
+ /*	Display contents of krb5_authdata struct, for debugging
+ */
+ void	print_krb5_authdata(char *label, krb5_authdata **adata)
+ {
+ 	if (adata == NULL)  {
+ 		printf("%s, authdata==0\n", label);
+ 		return;
+ 		}
+ 	printf("%s [%p]\n", label, adata);
+ 	/*
+ 	{ int 	i;
+ 	printf("%s[at%d:%d] ", label, adata->ad_type, adata->length);
+ 	for (i=0; i < adata->length; i++)  {
+ 		printf((isprint(adata->contents[i]))? "%c ": "%02x",adata->contents[i]);
+ 		}
+ 	printf("\n");
+ 	}
+ 	*/
+ }
+ 
+ 
+ /*	Display contents of krb5_keyblock struct, for debugging
+ */
+ void	print_krb5_keyblock(char *label, krb5_keyblock *keyblk)
+ {
+ 	int 	i;
+ 
+ 	if (keyblk == NULL)  {
+ 		printf("%s, keyblk==0\n", label);
+ 		return;
+ 		}
+ 	printf("%s\n\t[et%d:%d]: ", label, keyblk->enctype, keyblk->length);
+ 	for (i=0; i < keyblk->length; i++)  {
+ 		printf("%02x",keyblk->contents[i]);
+ 		}
+ 	printf("\n");
+ }
+ 
+ 
+ /*	Given krb5 service (typically "kssl") and hostname in kssl_ctx,
+ **	Create Kerberos AP_REQ message for SSL Client.
+ **
+ **	19990628	VRS 	Started.
+ */
+ krb5_error_code
+ kssl_cget_tkt(	/* UPDATE */	KSSL_CTX *kssl_ctx,
+ 				/* OUT    */	krb5_data *krb5_app_req, KSSL_ERR *kssl_err)
+ {
+ 	krb5_error_code		krb5rc = KRB5KRB_ERR_GENERIC;
+ 	krb5_context		krb5context = NULL;
+ 	krb5_auth_context	krb5auth_context = NULL;
+ 	krb5_ccache 		krb5ccdef = NULL;
+ 	krb5_creds			krb5creds, *krb5credsp = NULL;
+ 	krb5_data			krb5in_data;
+ 
+ 	kssl_err_set(kssl_err, 0, "");
+ 	memset((char *)&krb5creds, 0, sizeof(krb5creds));
+ 
+ 	if (!kssl_ctx)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, "No kssl_ctx defined.\n");
+ 		goto err;
+ 		}
+ 	else if (!kssl_ctx->service_host)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ 				"kssl_ctx service_host undefined.\n");
+ 		goto err;
+ 		}
+ 
+ 	if ((krb5rc = krb5_init_context(&krb5context)) != 0)  {
+ 		snprintf(kssl_err->text,KSSL_ERR_MAX,
+ 				"krb5_init_context() fails: %d\n", krb5rc);
+ 		kssl_err->reason = SSL_R_KRB5_C_INIT;
+ 		goto err;
+ 		}
+ 
+ 	if ((krb5rc = krb5_sname_to_principal(krb5context, kssl_ctx->service_host,
+ 					(kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
+ 					KRB5_NT_SRV_HST, &krb5creds.server)) != 0)  {
+ 		snprintf(kssl_err->text,KSSL_ERR_MAX,
+ 					"krb5_sname_to_principal() fails for %s/%s\n",
+ 					kssl_ctx->service_host,
+ 					(kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC);
+ 		kssl_err->reason = SSL_R_KRB5_C_INIT;
+ 		goto err;
+ 		}
+ 	
+ 	if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
+ 					"krb5_cc_default fails.\n");
+ 		goto err;
+ 		}
+ 	
+ 	if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef,
+ 										&krb5creds.client)) != 0)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
+ 					"krb5_cc_get_principal() fails.\n");
+ 		goto err;
+ 		}
+ 
+ 	if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef,
+ 										&krb5creds, &krb5credsp)) != 0)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_C_GET_CRED,
+ 					"krb5_get_credentials() fails.\n");
+ 		goto err;
+ 		}
+ 
+ 	krb5in_data.data = NULL;
+ 	krb5in_data.length = 0;
+ 
+ 	krb5rc = KRB5KRB_ERR_GENERIC;
+ 	/*	caller should free data of krb5_app_req  */
+     if ((krb5rc = krb5_mk_req_extended(krb5context, &krb5auth_context,
+ 						0, &krb5in_data, krb5credsp, krb5_app_req)) != 0)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_C_MK_REQ,
+ 					"krb5_mk_req_extended() fails.\n");
+ 		goto err;
+ 		}
+ 	else if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->keyblock))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT, "kssl_ctx_setkey() fails.\n");
+ 		}
+ 	else	krb5rc = 0;
+ 
+ err:
+ #ifdef KSSL_DEBUG
+ 	kssl_ctx_show(kssl_ctx);
+ #endif	/* KSSL_DEBUG */
+ 
+ 	if (krb5creds.client)	krb5_free_principal(krb5context, krb5creds.client);
+ 	if (krb5creds.server)	krb5_free_principal(krb5context, krb5creds.server);
+ 	if (krb5auth_context)	krb5_auth_con_free(krb5context, krb5auth_context);
+ 	if (krb5context)	 	krb5_free_context(krb5context);
+ 	return (krb5rc);
+ }
+ 
+ 
+ /*	Given krb5 service name in KSSL_CTX *kssl_ctx (typically "kssl"),
+ **		and krb5 AP_REQ message & message length,
+ **	Return Kerberos session key and client principle 
+ **		to SSL Server in KSSL_CTX *kssl_ctx.
+ **
+ **	19990702	VRS 	Started.
+ */
+ krb5_error_code
+ kssl_sget_tkt(	/* UPDATE */	KSSL_CTX *kssl_ctx,
+ 				/* IN     */	char *msg, int msglen,
+ 				/* OUT    */	KSSL_ERR *kssl_err  )
+ {
+ 	krb5_error_code				krb5rc = KRB5KRB_ERR_GENERIC;
+ 	static krb5_context			krb5context = NULL;
+ 	static krb5_auth_context	krb5auth_context = NULL;
+ 	krb5_ticket 				*krb5ticket = NULL;
+ 	krb5_keytab 				krb5keytab = NULL;
+ 	krb5_principal				krb5server;
+ 	krb5_data					krb5in_data;
+ 	krb5_flags					ap_option;
+ 
+ 	kssl_err_set(kssl_err, 0, "");
+ 
+ 	if (!kssl_ctx)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, "No kssl_ctx defined.\n");
+ 		goto err;
+ 		}
+ 
+ #ifdef KSSL_DEBUG
+ 	printf("in kssl_sget_tkt(%s)\n", kstring(kssl_ctx->service_name));
+ #endif	/* KSSL_DEBUG */
+ 
+ 	if (!krb5context  &&  (krb5rc = krb5_init_context(&krb5context)))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ 					"krb5_init_context() fails.\n");
+ 		goto err;
+ 		}
+ 	if (krb5auth_context  &&
+ 		(krb5rc = krb5_auth_con_free(krb5context, krb5auth_context)))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ 					"krb5_auth_con_free() fails.\n");
+ 		goto err;
+ 		}
+ 	else  krb5auth_context = NULL;
+ 	if (!krb5auth_context  &&
+ 		(krb5rc = krb5_auth_con_init(krb5context, &krb5auth_context)))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ 					"krb5_auth_con_init() fails.\n");
+ 		goto err;
+ 		}
+ 
+ 	if ((krb5rc = krb5_sname_to_principal(krb5context, NULL, 
+ 					(kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
+ 					KRB5_NT_SRV_HST, &krb5server)) != 0)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ 					"krb5_sname_to_principal() fails.\n");
+ 		goto err;
+ 		}
+ 	
+ 	if (kssl_ctx->keytab_file  &&
+ 		((krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file,
+ 														&krb5keytab))))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, "krb5_kt_resolve() fails.\n");
+ 		goto err;
+ 		}
+ 	/*	kssl_ctx->keytab_file == NULL ==> use Kerberos default /etc/krb5.keytab
+ 	*/
+ 
+ 	/*	Actual Kerberos5 krb5_recvauth() has initial conversation here
+ 	**	o	check KRB5_SENDAUTH_BADAUTHVERS unless KRB5_RECVAUTH_SKIP_VERSION
+ 	**	o	check KRB5_SENDAUTH_BADAPPLVERS
+ 	**	o	send "0" msg if all OK
+ 	*/
+ 
+ 	krb5in_data.data = msg;
+ 	krb5in_data.length = msglen;
+ 	if ((krb5rc = krb5_rd_req(krb5context, &krb5auth_context, &krb5in_data,
+ 							  krb5server, krb5keytab, &ap_option, &krb5ticket))
+ 							  != 0)  {
+ 		snprintf(kssl_err->text, KSSL_ERR_MAX,
+ 								"krb5_rd_req() fails with %x.\n", krb5rc);
+ 		kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
+ 		goto err;
+ 		}
+ 
+ 	krb5rc = KRB5_NO_TKT_SUPPLIED;
+ 	if (!krb5ticket  ||	!krb5ticket->enc_part2  ||
+ 						!krb5ticket->enc_part2->client  || 
+ 						!krb5ticket->enc_part2->client->data  || 
+ 						!krb5ticket->enc_part2->session)  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
+ 								"bad ticket from krb5_rd_req.\n");
+ 		}
+ 	else if (kssl_ctx_setprinc(kssl_ctx, KSSL_CLIENT,
+ 								&krb5ticket->enc_part2->client->realm,
+ 								krb5ticket->enc_part2->client->data))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
+ 								"kssl_ctx_setprinc() fails.\n");
+ 		}
+ 	else if (kssl_ctx_setkey(kssl_ctx, krb5ticket->enc_part2->session))  {
+ 		kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
+ 								"kssl_ctx_setkey() fails.\n");
+ 		}
+ 	else	krb5rc = 0;
+ 
+ err:
+ #ifdef KSSL_DEBUG
+ 	kssl_ctx_show(kssl_ctx);
+ #endif	/* KSSL_DEBUG */
+ 
+ 	if (krb5ticket) 		krb5_free_ticket(krb5context, krb5ticket);
+ 	if (krb5server) 		krb5_free_principal(krb5context, krb5server);
+ 	return (krb5rc);
+ }
+ 
+ 
+ /*	Allocate & return a new kssl_ctx struct.
+ */
+ KSSL_CTX	*kssl_ctx_new(void)
+ {
+ 	return ((KSSL_CTX *) calloc(1, sizeof(KSSL_CTX)));
+ }
+ 
+ 
+ /*	Frees a kssl_ctx struct and any allocated memory it holds.
+ **	Returns NULL.
+ */
+ KSSL_CTX	*kssl_ctx_free(KSSL_CTX *kssl_ctx)
+ {
+ 	if (kssl_ctx == NULL)  return kssl_ctx;
+ 
+ 	if (kssl_ctx->key)  			memset(kssl_ctx->key, 0, kssl_ctx->length);
+ 	if (kssl_ctx->key)  			free(kssl_ctx->key);
+ 	if (kssl_ctx->client_princ) 	free(kssl_ctx->client_princ);
+ 	if (kssl_ctx->service_host) 	free(kssl_ctx->service_host);
+ 	if (kssl_ctx->service_name) 	free(kssl_ctx->service_name);
+ 	if (kssl_ctx->keytab_file) 		free(kssl_ctx->keytab_file);
+ 
+ 	free(kssl_ctx);
+ 	return (KSSL_CTX *) NULL;
+ }
+ 
+ 
+ /*	Given a (krb5_data *) entity (and optional realm),
+ **	set the plain (char *) client_princ or service_host member
+ **	of the kssl_ctx struct.
+ */
+ krb5_error_code
+ kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,	krb5_data *realm,
+ 													krb5_data *entity)
+ {
+ 	char	**princ;
+ 	int 	length;
+ 
+ 	if (kssl_ctx == NULL  ||  entity == NULL)  return KSSL_CTX_ERR;
+ 
+ 	switch (which)  {
+ 		case KSSL_CLIENT:	princ = &kssl_ctx->client_princ;	break;
+ 		case KSSL_SERVER:	princ = &kssl_ctx->service_host;	break;
+ 		default:			return KSSL_CTX_ERR;				break;
+ 		}
+ 	if (*princ)  free(*princ);
+ 
+ 	length = entity->length + ((realm)? realm->length + 2: 1);
+ 	if ((*princ = calloc(1, length)) == NULL)	return KSSL_CTX_ERR;
+ 	else  {
+ 		strncpy(*princ, entity->data, entity->length);
+ 		if (realm)  {
+ 			strcat (*princ, "@");
+ 			(void) strncat(*princ, realm->data, realm->length);
+ 			}
+ 		}
+ 
+ 	return KSSL_CTX_OK;
+ }
+ 
+ 
+ /*	Set one of the plain (char *) string members of the kssl_ctx struct.
+ **	Default values should be:
+ **		which == KSSL_SERVICE	=>	"kssl" (KRB5SVC)
+ **		which == KSSL_KEYTAB	=>	"/etc/krb5.keytab.kssl" (KRB5KEYTAB)
+ */
+ krb5_error_code
+ kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text)
+ {
+ 	char	**string;
+ 
+ 	if (!kssl_ctx)  return KSSL_CTX_ERR;
+ 
+ 	switch (which)  {
+ 		case KSSL_SERVICE:	string = &kssl_ctx->service_name;	break;
+ 		case KSSL_SERVER:	string = &kssl_ctx->service_host;	break;
+ 		case KSSL_CLIENT:	string = &kssl_ctx->client_princ;	break;
+ 		case KSSL_KEYTAB:	string = &kssl_ctx->keytab_file;	break;
+ 		default:			return KSSL_CTX_ERR;				break;
+ 		}
+ 	if (*string)  free(*string);
+ 
+ 	if (!text)  {
+ 		*string = '\0';
+ 		return KSSL_CTX_OK;
+ 		}
+ 
+ 	if ((*string = calloc(1, strlen(text) + 1)) == NULL)  return KSSL_CTX_ERR;
+ 	else	strcpy(*string, text);
+ 
+ 	return KSSL_CTX_OK;
+ }
+ 
+ 
+ /*	Copy the Kerberos session key from a (krb5_keyblock *) to a kssl_ctx
+ **	struct.  Clear kssl_ctx->key if Kerberos session key is NULL.
+ */
+ krb5_error_code
+ kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session)
+ {
+ 	if (!kssl_ctx)  return KSSL_CTX_ERR;
+ 
+ 	if (kssl_ctx->key)  {
+ 		memset(kssl_ctx->key, 0, kssl_ctx->length);
+ 		free(kssl_ctx->key);
+ 		}
+ 
+ 	if (session)  {
+ 		kssl_ctx->enctype = session->enctype;
+ 		kssl_ctx->length  = session->length;
+ 		}
+ 	else  {
+ 		kssl_ctx->enctype = ENCTYPE_UNKNOWN;
+ 		kssl_ctx->length  = 0;
+ 		return KSSL_CTX_OK;
+ 		}
+ 
+ 	if ((kssl_ctx->key =
+ 			(krb5_octet FAR *) calloc(1, kssl_ctx->length)) == NULL)  {
+ 		kssl_ctx->length  = 0;
+ 		return KSSL_CTX_ERR;
+ 		}
+ 	else	memcpy(kssl_ctx->key, session->contents, session->length);
+ 	
+ 	return KSSL_CTX_OK;
+ }
+ 
+ 
+ /*	Display contents of kssl_ctx struct
+ */
+ void 	kssl_ctx_show(KSSL_CTX *kssl_ctx)
+ {
+ 	int 	i;
+ 
+ 	printf("kssl_ctx: ");
+ 	if (kssl_ctx == NULL)  {
+ 		printf("NULL\n");
+ 		return;
+ 		}
+ 	else	printf("%p\n", kssl_ctx);
+ 
+ 	printf("\tservice:\t%s\n", (kssl_ctx->service_name)? kssl_ctx->service_name:
+ 														"NULL");
+ 	printf("\tclient:\t%s\n", (kssl_ctx->client_princ)? kssl_ctx->client_princ:
+ 														"NULL");
+ 	printf("\tserver:\t%s\n", (kssl_ctx->service_host)? kssl_ctx->service_host:
+ 														"NULL");
+ 	printf("\tkeytab:\t%s\n", (kssl_ctx->keytab_file)? kssl_ctx->keytab_file:
+ 														"NULL");
+ 	printf("\tkey [%d:%d]:\t", kssl_ctx->enctype, kssl_ctx->length);
+ 
+ 	for (i=0; i < kssl_ctx->length  &&  kssl_ctx->key; i++)  {
+ 		printf("%02x", kssl_ctx->key[i]);
+ 		}
+ 	printf("\n");
+ 	return;
+ }
+ 
+ #endif	/* NO_KRB5	*/
+ 
diff -Nacr openssl-0.9.5a.orig/ssl/kssl.h openssl-0.9.5a/ssl/kssl.h
*** openssl-0.9.5a.orig/ssl/kssl.h	Wed Dec 31 19:00:00 1969
--- openssl-0.9.5a/ssl/kssl.h	Tue Jul 11 15:42:19 2000
***************
*** 0 ****
--- 1,87 ----
+ /*	ssl/kssl.h
+ **	19990701	VRS 	Started.
+ */
+ 
+ #ifndef NO_KRB5
+ 
+ #ifndef	KSSL_H
+ #define	KSSL_H
+ 
+ #include <stdio.h>
+ #include <ctype.h>
+ #include <strings.h>
+ #include "krb5.h"
+ 
+ /*	Uncomment this to debug kssl problems or
+ **	to trace usage of the Kerberos session key
+ **
+ **	#define		KSSL_DEBUG
+ */
+ 
+ #ifndef	KRB5SVC
+ #define KRB5SVC	"kssl"
+ #endif
+ 
+ #ifndef	KRB5KEYTAB
+ #define KRB5KEYTAB	"/etc/krb5.keytab.kssl"
+ #endif
+ 
+ 
+ #define	KSSL_ERR_MAX	255
+ typedef struct kssl_err_st  {
+ 	int 	reason;
+ 	char	text[KSSL_ERR_MAX+1];
+ 	}	KSSL_ERR;
+ 
+ 
+ /*	Context for passing
+ **		(1) Kerberos session key to SSL, and 
+ **		(2)	Config data between application and SSL lib
+ */
+ typedef struct kssl_ctx_st	{		/*	used by:	disposition:			*/
+ 	char			*service_name;	/*	C,S 		default ok (kssl)		*/
+ 	char			*service_host;	/*	C			input, REQUIRED   		*/
+ 	char			*client_princ;	/*	  S			output from krb5 ticket	*/
+ 	char			*keytab_file;	/*    S 		NULL (/etc/krb5.keytab)	*/
+ 	krb5_enctype	enctype;
+ 	int 			length;
+ 	krb5_octet FAR	*key;
+ 	}	KSSL_CTX;
+ 
+ #define	KSSL_CLIENT 	1
+ #define KSSL_SERVER 	2
+ #define	KSSL_SERVICE	3
+ #define	KSSL_KEYTAB 	4
+ 
+ #define KSSL_CTX_OK 	0
+ #define KSSL_CTX_ERR	1
+ #define KSSL_NOMEM		2
+ 
+ 
+ void			print_krb5_data(char *label, krb5_data *kdata);
+ void			print_krb5_authdata(char *label, krb5_authdata **adata);
+ void			print_krb5_keyblock(char *label, krb5_keyblock *keyblk);
+ 
+ char			*kstring(char *string);
+ char			*knumber(int len, krb5_octet *contents);
+ 
+ 
+ void			kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text);
+ 
+ KSSL_CTX		*kssl_ctx_new(void);
+ KSSL_CTX		*kssl_ctx_free(KSSL_CTX *kssl_ctx);
+ void			kssl_ctx_show(KSSL_CTX *kssl_ctx);
+ krb5_error_code kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session);
+ krb5_error_code kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text);
+ krb5_error_code kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
+ 									krb5_data *realm, krb5_data *entity);
+ 
+ krb5_error_code	kssl_cget_tkt(KSSL_CTX *kssl_ctx,  krb5_data *ap_req,
+ 								KSSL_ERR *kssl_err);
+ krb5_error_code	kssl_sget_tkt(KSSL_CTX *kssl_ctx,  char *msg, int msglen,
+ 								KSSL_ERR *kssl_err);
+ 
+ 
+ #endif	/* KSSL_H 	*/
+ #endif	/* NO_KRB5	*/
+ 
diff -Nacr openssl-0.9.5a.orig/ssl/s3_clnt.c openssl-0.9.5a/ssl/s3_clnt.c
*** openssl-0.9.5a.orig/ssl/s3_clnt.c	Mon Mar 27 16:28:27 2000
--- openssl-0.9.5a/ssl/s3_clnt.c	Tue Jul 11 15:42:19 2000
***************
*** 65,70 ****
--- 65,74 ----
  #include <openssl/evp.h>
  #include "ssl_locl.h"
  
+ #ifndef NO_KRB5
+ #include "kssl.h"
+ #endif
+ 
  static SSL_METHOD *ssl3_get_client_method(int ver);
  static int ssl3_client_hello(SSL *s);
  static int ssl3_get_server_hello(SSL *s);
***************
*** 682,687 ****
--- 686,692 ----
  	STACK_OF(X509) *sk=NULL;
  	SESS_CERT *sc;
  	EVP_PKEY *pkey=NULL;
+ 	int 	need_cert = 1;	/* VRS: 0=> will allow null cert if auth == KRB5 */
  
  	n=ssl3_get_message(s,
  		SSL3_ST_CR_CERT_A,
***************
*** 776,785 ****
  	 * certificate, which we don't include in s3_srvr.c */
  	x=sk_X509_value(sk,0);
  	sk=NULL;
  
  	pkey=X509_get_pubkey(x);
  
! 	if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey))
  		{
  		x=NULL;
  		al=SSL3_AL_FATAL;
--- 781,803 ----
  	 * certificate, which we don't include in s3_srvr.c */
  	x=sk_X509_value(sk,0);
  	sk=NULL;
+ 	/* VRS 19990621: possible memory leak; sk=null ==> !sk_pop_free() @end */
  
  	pkey=X509_get_pubkey(x);
  
!     /* VRS: allow null cert if auth == KRB5 */
!     need_cert =
!         ((s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
!         == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
! 
! #ifdef KSSL_DEBUG
! 	printf("pkey,x = %p, %p\n", pkey,x);
! 	printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
! 	printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
! 			s->s3->tmp.new_cipher->algorithms, need_cert);
! #endif    /* KSSL_DEBUG */
! 
! 	if (need_cert  &&  ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
  		{
  		x=NULL;
  		al=SSL3_AL_FATAL;
***************
*** 788,794 ****
  		}
  
  	i=ssl_cert_type(x,pkey);
! 	if (i < 0)
  		{
  		x=NULL;
  		al=SSL3_AL_FATAL;
--- 806,812 ----
  		}
  
  	i=ssl_cert_type(x,pkey);
! 	if (need_cert  &&  i < 0)
  		{
  		x=NULL;
  		al=SSL3_AL_FATAL;
***************
*** 796,814 ****
  		goto f_err;
  		}
  
! 	sc->peer_cert_type=i;
! 	CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
! 	if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen?
! 										 * We just created sc a couple of
! 										 * lines ago. */
! 		X509_free(sc->peer_pkeys[i].x509);
! 	sc->peer_pkeys[i].x509=x;
! 	sc->peer_key= &(sc->peer_pkeys[i]);
! 
! 	if (s->session->peer != NULL)
! 		X509_free(s->session->peer);
! 	CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
! 	s->session->peer=x;
  
  	x=NULL;
  	ret=1;
--- 814,844 ----
  		goto f_err;
  		}
  
! 	if (need_cert)
! 		{
! 		sc->peer_cert_type=i;
! 		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
! 		if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen?
! 											 * We just created sc a couple of
! 											 * lines ago. */
! 			X509_free(sc->peer_pkeys[i].x509);
! 		sc->peer_pkeys[i].x509=x;
! 		sc->peer_key= &(sc->peer_pkeys[i]);
! 
! 		if (s->session->peer != NULL)
! 			X509_free(s->session->peer);
! 		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
! 		s->session->peer=x;
! 		}
! 	else
! 		{
! 		sc->peer_cert_type=i;
! 		sc->peer_key= NULL;
! 
! 		if (s->session->peer != NULL)
! 			X509_free(s->session->peer);
! 		s->session->peer=NULL;
! 		}
  
  	x=NULL;
  	ret=1;
***************
*** 1311,1316 ****
--- 1341,1349 ----
  	unsigned char *q;
  	EVP_PKEY *pkey=NULL;
  #endif
+ #ifndef NO_KRB5
+ 	KSSL_ERR kssl_err;
+ #endif
  
  	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
  		{
***************
*** 1379,1384 ****
--- 1412,1481 ----
  			}
  		else
  #endif
+ #ifndef NO_KRB5
+ 		if (l & SSL_kKRB5)
+ 			{
+ 			krb5_error_code	krb5rc;
+ 			KSSL_CTX		*kssl_ctx = s->kssl_ctx;
+ 			krb5_data		krb5_ap_req;
+ 			
+ #ifdef KSSL_DEBUG
+ 			printf("ssl3_send_client_key_exchange(%lx & %lx)\n", l, SSL_kKRB5);
+ #endif	/* KSSL_DEBUG */
+ 
+ 			/*
+ 			**	Tried to send random tmp_buf[] as PMS in Kerberos ticket
+ 			**	by passing  krb5_mk_req_extended(ctx,authctx,opts, tmp_buf, ...)
+ 			**	but: I can't retrieve the PMS on the other side!  There is
+ 			**	some indication in the krb5 source that this is only used
+ 			**	to generate a checksum.  OTOH, the Tung book shows data
+ 			**	("GET widget01.txt") being passed in krb5_mk_req_extended()
+ 			**	by way of krb5_sendauth().  I don't get it.
+ 			**	Until Kerberos goes 3DES, the big PMS secret would only be
+ 			**	encrypted in 1-DES anyway.  So losing the PMS shouldn't be
+ 			**	a big deal.
+ 			*/
+ 			krb5rc = kssl_cget_tkt(kssl_ctx, &krb5_ap_req, &kssl_err);
+ #ifdef KSSL_DEBUG
+ 			{
+ 			printf("kssl_cget_tkt rtn %d\n", krb5rc);
+ 			kssl_ctx_show(kssl_ctx);
+ 			if (krb5rc && kssl_err.text)
+ 					printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
+ 
+ 			}
+ #endif	/* KSSL_DEBUG */
+ 
+ 			if (krb5rc)  {
+ 				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ 				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, kssl_err.reason);
+ 				goto err;
+ 				}
+ 
+ 			/*	Send ticket (copy to *p, set n = length)
+ 			*/
+ 			n = krb5_ap_req.length;
+ 			memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
+ 			if (krb5_ap_req.data)  krb5_xfree(krb5_ap_req.data);
+ 
+ 			/*	19991013 VRS -	3DES is kind of bogus here,
+ 			**	at least until Kerberos supports 3DES.  The only
+ 			**	real secret is the 8-byte Kerberos session key;
+ 			**	the other key material ((s->) client_random, server_random)
+ 			**	could be sniffed.  Mixing in these nonces should help 
+ 			**	protect against replay attacks, however.
+ 			**
+ 			**	Alternate code for Kerberos Purists:
+ 			**	
+ 			**	memcpy(s->session->master_key, kssl_ctx->key, kssl_ctx->length);
+ 			**	s->session->master_key_length = kssl_ctx->length;
+ 			*/
+ 			s->session->master_key_length=
+ 				s->method->ssl3_enc->generate_master_secret(s,
+ 					s->session->master_key,	kssl_ctx->key,kssl_ctx->length);
+ 			}
+ 		else
+ #endif
  #ifndef NO_DH
  		if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
  			{
***************
*** 1630,1636 ****
  	algs=s->s3->tmp.new_cipher->algorithms;
  
  	/* we don't have a certificate */
! 	if (algs & (SSL_aDH|SSL_aNULL))
  		return(1);
  
  #ifndef NO_RSA
--- 1727,1733 ----
  	algs=s->s3->tmp.new_cipher->algorithms;
  
  	/* we don't have a certificate */
! 	if (algs & (SSL_aDH|SSL_aNULL  | SSL_aKRB5))    /* VRS */
  		return(1);
  
  #ifndef NO_RSA
diff -Nacr openssl-0.9.5a.orig/ssl/s3_lib.c openssl-0.9.5a/ssl/s3_lib.c
*** openssl-0.9.5a.orig/ssl/s3_lib.c	Thu Mar 16 14:47:31 2000
--- openssl-0.9.5a/ssl/s3_lib.c	Tue Jul 11 15:46:04 2000
***************
*** 69,74 ****
--- 69,165 ----
  static long ssl3_default_timeout(void );
  
  OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+ 
+ #ifndef NO_KRB5
+ /* The Kerberos ciphers
+ ** 20000107 VRS: And the first shall be last,
+ ** in hopes of avoiding the lynx ssl renegotiation problem.
+ */
+ /* Cipher 21 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_40_CBC_SHA,
+ 	SSL3_CK_KRB5_DES_40_CBC_SHA,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
+ 	SSL_EXPORT|SSL_EXP40,
+ 	0,
+ 	40,
+ 	56,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ 
+ /* Cipher 22 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_40_CBC_MD5,
+ 	SSL3_CK_KRB5_DES_40_CBC_MD5,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
+ 	SSL_EXPORT|SSL_EXP40,
+ 	0,
+ 	40,
+ 	56,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ 
+ /* Cipher 23 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_64_CBC_SHA,
+ 	SSL3_CK_KRB5_DES_64_CBC_SHA,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
+ 	SSL_NOT_EXP|SSL_LOW,
+ 	0,
+ 	56,
+ 	56,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ 
+ /* Cipher 24 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_64_CBC_MD5,
+ 	SSL3_CK_KRB5_DES_64_CBC_MD5,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
+ 	SSL_NOT_EXP|SSL_LOW,
+ 	0,
+ 	56,
+ 	56,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ 
+ /* Cipher 25 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_192_CBC3_SHA,
+ 	SSL3_CK_KRB5_DES_192_CBC3_SHA,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
+ 	SSL_NOT_EXP|SSL_HIGH,
+ 	0,
+ 	112,
+ 	168,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ 
+ /* Cipher 26 VRS */
+ 	{
+ 	1,
+ 	SSL3_TXT_KRB5_DES_192_CBC3_MD5,
+ 	SSL3_CK_KRB5_DES_192_CBC3_MD5,
+ 	SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
+ 	SSL_NOT_EXP|SSL_HIGH,
+ 	0,
+ 	112,
+ 	168,
+ 	SSL_ALL_CIPHERS,
+ 	SSL_ALL_STRENGTHS,
+ 	},
+ #endif	/* NO_KRB5 */
+ 
  /* The RSA ciphers */
  /* Cipher 01 */
  	{
***************
*** 1076,1085 ****
  	sk_SSL_CIPHER_set_cmp_func(pref,ssl_cipher_ptr_id_cmp);
  
  #ifdef CIPHER_DEBUG
! 	printf("Have:\n");
! 	for(i=0 ; i < sk_num(pref) ; ++i)
  	    {
! 	    c=(SSL_CIPHER *)sk_value(pref,i);
  	    printf("%p:%s\n",c,c->name);
  	    }
  #endif
--- 1167,1176 ----
  	sk_SSL_CIPHER_set_cmp_func(pref,ssl_cipher_ptr_id_cmp);
  
  #ifdef CIPHER_DEBUG
! 	printf("Have %d from %p:\n", sk_num((STACK *) pref), pref);
! 	for(i=0 ; i < sk_num((STACK *) pref) ; ++i)
  	    {
! 	    c=(SSL_CIPHER *)sk_value((STACK *) pref, i);
  	    printf("%p:%s\n",c,c->name);
  	    }
  #endif
***************
*** 1091,1096 ****
--- 1182,1191 ----
  		ssl_set_cert_masks(cert,c);
  		mask=cert->mask;
  		emask=cert->export_mask;
+ 
+ #ifdef KSSL_DEBUG
+ 		printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);
+ #endif    /* KSSL_DEBUG */
  			
  		alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK);
  		if (SSL_C_IS_EXPORT(c))
diff -Nacr openssl-0.9.5a.orig/ssl/s3_srvr.c openssl-0.9.5a/ssl/s3_srvr.c
*** openssl-0.9.5a.orig/ssl/s3_srvr.c	Mon Mar 27 16:28:28 2000
--- openssl-0.9.5a/ssl/s3_srvr.c	Tue Jul 11 15:42:19 2000
***************
*** 70,75 ****
--- 70,79 ----
  #include <openssl/x509.h>
  #include "ssl_locl.h"
  
+ #ifndef NO_KRB5
+ #include "kssl.h"
+ #endif
+ 
  static SSL_METHOD *ssl3_get_server_method(int ver);
  static int ssl3_get_client_hello(SSL *s);
  static int ssl3_check_client_hello(SSL *s);
***************
*** 1254,1259 ****
--- 1258,1266 ----
  	BIGNUM *pub=NULL;
  	DH *dh_srvr;
  #endif
+ #ifndef NO_KRB5
+ 	KSSL_ERR kssl_err;
+ #endif
  
  	n=ssl3_get_message(s,
  		SSL3_ST_SR_KEY_EXCH_A,
***************
*** 1403,1408 ****
--- 1410,1458 ----
  		}
  	else
  #endif
+ #ifndef NO_KRB5
+ 		if (l & SSL_kKRB5)
+ 		{
+ 		krb5_error_code	krb5rc;
+ 		KSSL_CTX		*kssl_ctx = s->kssl_ctx;
+ 
+ 		if (!kssl_ctx)  kssl_ctx = kssl_ctx_new();
+ 		if ((krb5rc = kssl_sget_tkt(kssl_ctx,
+ 									s->init_buf->data, s->init_buf->length,
+ 									&kssl_err)) != 0)  {
+ #ifdef KSSL_DEBUG
+ 			printf("kssl_sget_tkt rtn %d [%d]\n", krb5rc, kssl_err.reason);
+ 			if (kssl_err.text)  printf("kssl_err text= %s\n", kssl_err.text);
+ #endif	/* KSSL_DEBUG */
+ 			SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, kssl_err.reason);
+ 			goto err;
+ 			}
+ 
+ #ifdef KSSL_DEBUG
+ 		kssl_ctx_show(kssl_ctx);
+ #endif	/* KSSL_DEBUG */
+ 
+ 		/*	19991013 VRS -	3DES is kind of bogus here,
+ 		**	at least until Kerberos supports 3DES.  The only
+ 		**	real secret is the 8-byte Kerberos session key;
+ 		**	the other key material (client_random, server_random)
+ 		**	could be sniffed.  Nonces may help against replays though.
+ 		**
+ 		**	Alternate code for Kerberos Purists:
+ 		**
+ 		**	memcpy(s->session->master_key,	kssl_ctx->key, kssl_ctx->length);
+ 		**	s->session->master_key_length = kssl_ctx->length;
+ 		*/
+ 		s->session->master_key_length=
+ 			s->method->ssl3_enc->generate_master_secret(s,
+ 				s->session->master_key, kssl_ctx->key, kssl_ctx->length);
+ 		/*	Was doing kssl_ctx_free() here, but it caused problems for apache.
+ 		**	kssl_ctx = kssl_ctx_free(kssl_ctx);
+ 		**	if (s->kssl_ctx)  s->kssl_ctx = NULL;
+ 		*/
+ 		}
+ 	else
+ #endif	/* NO_KRB5 */
  		{
  		al=SSL_AD_HANDSHAKE_FAILURE;
  		SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNKNOWN_CIPHER_TYPE);
***************
*** 1723,1729 ****
  	if (s->state == SSL3_ST_SW_CERT_A)
  		{
  		x=ssl_get_server_send_cert(s);
! 		if (x == NULL)
  			{
  			SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,SSL_R_INTERNAL_ERROR);
  			return(0);
--- 1773,1782 ----
  	if (s->state == SSL3_ST_SW_CERT_A)
  		{
  		x=ssl_get_server_send_cert(s);
! 		if (x == NULL  &&
! 			/* VRS: allow null cert if auth == KRB5 */
! 			(s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
! 			!= (SSL_aKRB5|SSL_kKRB5))
  			{
  			SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,SSL_R_INTERNAL_ERROR);
  			return(0);
diff -Nacr openssl-0.9.5a.orig/ssl/ssl.h openssl-0.9.5a/ssl/ssl.h
*** openssl-0.9.5a.orig/ssl/ssl.h	Thu Mar 16 14:47:31 2000
--- openssl-0.9.5a/ssl/ssl.h	Tue Jul 11 15:42:19 2000
***************
*** 65,70 ****
--- 65,74 ----
  
  #include <openssl/safestack.h>
  
+ #ifndef NO_KRB5
+ #include "kssl.h"
+ #endif	/* NO_KRB5 */
+ 
  /* SSLeay version number for ASN.1 encoding of the session information */
  /* Version 0 - initial version
   * Version 1 - added the optional peer certificate
***************
*** 83,88 ****
--- 87,101 ----
  #define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5	
  #define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA	
  
+ /*    VRS Additional Kerberos5 entries
+ */
+ #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA
+ #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5
+ #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA
+ #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5
+ #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA
+ #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5
+ 
  #define SSL_MAX_SSL_SESSION_ID_LENGTH		32
  #define SSL_MAX_SID_CTX_LENGTH			32
  
***************
*** 103,108 ****
--- 116,125 ----
  #define	SSL_TXT_eNULL		"eNULL"
  #define	SSL_TXT_NULL		"NULL"
  
+ #define SSL_TXT_kKRB5     	"kKRB5"
+ #define SSL_TXT_aKRB5     	"aKRB5"
+ #define SSL_TXT_KRB5      	"KRB5"
+ 
  #define SSL_TXT_kRSA		"kRSA"
  #define SSL_TXT_kDHr		"kDHr"
  #define SSL_TXT_kDHd		"kDHd"
***************
*** 635,640 ****
--- 652,661 ----
  	int error;		/* error bytes to be written */
  	int error_code;		/* actual code */
  
+ #ifndef NO_KRB5
+ 	KSSL_CTX *kssl_ctx;
+ #endif	/* NO_KRB5 */
+ 
  	SSL_CTX *ctx;
  	/* set this flag to 1 and a sleep(1) is put into all SSL_read()
  	 * and SSL_write() calls, good for nbio debuging :-) */
***************
*** 1383,1388 ****
--- 1404,1417 ----
  #define SSL_R_INTERNAL_ERROR				 157
  #define SSL_R_INVALID_CHALLENGE_LENGTH			 158
  #define SSL_R_INVALID_COMMAND				 280
+ #define SSL_R_KRB5_C_INIT              		281
+ #define SSL_R_KRB5_C_MK_REQ                	282
+ #define SSL_R_KRB5_S_INIT              		283
+ #define SSL_R_KRB5_S_RD_REQ                	284
+ #define SSL_R_KRB5_S_BAD_TICKET             285
+ #define SSL_R_BAD_KMODE					 	286
+ #define SSL_R_KRB5_C_GET_CRED              	287
+ #define SSL_R_KRB5_C_CC_PRINC              	288
  #define SSL_R_INVALID_PURPOSE				 278
  #define SSL_R_INVALID_TRUST				 279
  #define SSL_R_LENGTH_MISMATCH				 159
diff -Nacr openssl-0.9.5a.orig/ssl/ssl3.h openssl-0.9.5a/ssl/ssl3.h
*** openssl-0.9.5a.orig/ssl/ssl3.h	Fri Feb 25 09:27:31 2000
--- openssl-0.9.5a/ssl/ssl3.h	Tue Jul 11 15:42:19 2000
***************
*** 102,107 ****
--- 102,123 ----
  #define SSL3_CK_FZA_DMS_FZA_SHA			0x0300001D
  #define SSL3_CK_FZA_DMS_RC4_SHA			0x0300001E
  
+ /*    VRS Additional Kerberos5 entries
+ */
+ #define SSL3_CK_KRB5_DES_40_CBC_SHA       	0x03000021
+ #define SSL3_CK_KRB5_DES_40_CBC_MD5       	0x03000022
+ #define SSL3_CK_KRB5_DES_64_CBC_SHA       	0x03000023
+ #define SSL3_CK_KRB5_DES_64_CBC_MD5       	0x03000024
+ #define SSL3_CK_KRB5_DES_192_CBC3_SHA 		0x03000025
+ #define SSL3_CK_KRB5_DES_192_CBC3_MD5 		0x03000026
+ 
+ #define SSL3_TXT_KRB5_DES_40_CBC_SHA  		"EXP-KRB5-DES-CBC-SHA"
+ #define SSL3_TXT_KRB5_DES_40_CBC_MD5  		"EXP-KRB5-DES-CBC-MD5"
+ #define SSL3_TXT_KRB5_DES_64_CBC_SHA  		"KRB5-DES-CBC-SHA"
+ #define SSL3_TXT_KRB5_DES_64_CBC_MD5  		"KRB5-DES-CBC-MD5"
+ #define SSL3_TXT_KRB5_DES_192_CBC3_SHA    	"KRB5-DES-CBC3-SHA"
+ #define SSL3_TXT_KRB5_DES_192_CBC3_MD5    	"KRB5-DES-CBC3-MD5"
+ 
  #define SSL3_TXT_RSA_NULL_MD5			"NULL-MD5"
  #define SSL3_TXT_RSA_NULL_SHA			"NULL-SHA"
  #define SSL3_TXT_RSA_RC4_40_MD5 		"EXP-RC4-MD5"
diff -Nacr openssl-0.9.5a.orig/ssl/ssl_ciph.c openssl-0.9.5a/ssl/ssl_ciph.c
*** openssl-0.9.5a.orig/ssl/ssl_ciph.c	Mon Mar 13 18:54:56 2000
--- openssl-0.9.5a/ssl/ssl_ciph.c	Tue Jul 11 15:42:19 2000
***************
*** 100,105 ****
--- 100,106 ----
  static const SSL_CIPHER cipher_aliases[]={
  	/* Don't include eNULL unless specifically enabled */
  	{0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+ 	{0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
  	{0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
  	{0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
  	{0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
***************
*** 108,113 ****
--- 109,115 ----
  	{0,SSL_TXT_DH,	0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
  	{0,SSL_TXT_EDH,	0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
  
+ 	{0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0},  /* VRS Kerberos5 */
  	{0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
  	{0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
  	{0,SSL_TXT_aFZA,0,SSL_aFZA,  0,0,0,0,SSL_AUTH_MASK,0},
***************
*** 291,296 ****
--- 293,301 ----
  #ifdef NO_DH
  	mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
  #endif
+ #ifdef NO_KRB5
+ 	mask |= SSL_kKRB5|SSL_aKRB5;
+ #endif
  
  #ifdef SSL_FORBID_ENULL
  	mask |= SSL_eNULL;
***************
*** 336,341 ****
--- 341,349 ----
  			list[list_num].prev = NULL;
  			list[list_num].active = 0;
  			list_num++;
+ #ifdef KSSL_DEBUG
+ 			printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms);
+ #endif	/* KSSL_DEBUG */
  			/*
  			if (!sk_push(ca_list,(char *)c)) goto err;
  			*/
***************
*** 738,743 ****
--- 746,754 ----
  	 * it is used for allocation.
  	 */
  	num_of_ciphers = ssl_method->num_ciphers();
+ #ifdef KSSL_DEBUG
+ 	printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
+ #endif	/* KSSL_DEBUG */
  	list = (CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
  	if (list == NULL)
  		{
***************
*** 872,878 ****
--- 883,893 ----
  	char *ver,*exp;
  	char *kx,*au,*enc,*mac;
  	unsigned long alg,alg2,alg_s;
+ #ifdef KSSL_DEBUG
+ 	static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+ #else
  	static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
+ #endif	/* KSSL_DEBUG */
  	
  	alg=cipher->algorithms;
  	alg_s=cipher->algo_strength;
***************
*** 901,906 ****
--- 916,925 ----
  	case SSL_kDHd:
  		kx="DH/DSS";
  		break;
+ 	case SSL_kKRB5:         /* VRS */
+ 	case SSL_KRB5:          /* VRS */
+ 		kx="KRB5";
+ 		break;
  	case SSL_kFZA:
  		kx="Fortezza";
  		break;
***************
*** 922,927 ****
--- 941,950 ----
  	case SSL_aDH:
  		au="DH";
  		break;
+ 	case SSL_aKRB5:         /* VRS */
+ 	case SSL_KRB5:          /* VRS */
+ 		au="KRB5";
+ 		break;
  	case SSL_aFZA:
  	case SSL_aNULL:
  		au="None";
***************
*** 981,987 ****
--- 1004,1014 ----
  	else if (len < 128)
  		return("Buffer too small");
  
+ #ifdef KSSL_DEBUG
+ 	sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+ #else
  	sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
+ #endif    /* KSSL_DEBUG */
  	return(buf);
  	}
  
diff -Nacr openssl-0.9.5a.orig/ssl/ssl_err.c openssl-0.9.5a/ssl/ssl_err.c
*** openssl-0.9.5a.orig/ssl/ssl_err.c	Thu Mar 16 14:47:31 2000
--- openssl-0.9.5a/ssl/ssl_err.c	Tue Jul 11 15:42:19 2000
***************
*** 266,271 ****
--- 266,279 ----
  {SSL_R_HTTP_REQUEST                      ,"http request"},
  {SSL_R_INTERNAL_ERROR                    ,"internal error"},
  {SSL_R_INVALID_CHALLENGE_LENGTH          ,"invalid challenge length"},
+ {SSL_R_BAD_KMODE						 ,"bad kmode"},
+ {SSL_R_KRB5_C_CC_PRINC                   ,"krb5 c cc princ"},
+ {SSL_R_KRB5_C_GET_CRED                   ,"krb5 c get cred"},
+ {SSL_R_KRB5_C_INIT                       ,"krb5 c init"},
+ {SSL_R_KRB5_C_MK_REQ                     ,"krb5 c mk req"},
+ {SSL_R_KRB5_S_BAD_TICKET                 ,"krb5 s bad ticket"},
+ {SSL_R_KRB5_S_INIT                       ,"krb5 s init"},
+ {SSL_R_KRB5_S_RD_REQ                     ,"krb5 s rd req"},
  {SSL_R_INVALID_COMMAND                   ,"invalid command"},
  {SSL_R_INVALID_PURPOSE                   ,"invalid purpose"},
  {SSL_R_INVALID_TRUST                     ,"invalid trust"},
diff -Nacr openssl-0.9.5a.orig/ssl/ssl_lib.c openssl-0.9.5a/ssl/ssl_lib.c
*** openssl-0.9.5a.orig/ssl/ssl_lib.c	Mon Mar 27 16:28:28 2000
--- openssl-0.9.5a/ssl/ssl_lib.c	Tue Jul 11 15:42:19 2000
***************
*** 187,192 ****
--- 187,196 ----
  	if (s == NULL) goto err;
  	memset(s,0,sizeof(SSL));
  
+ #ifndef	NO_KRB5
+ 	s->kssl_ctx = kssl_ctx_new();
+ #endif	/* NO_KRB5 */
+ 
  	if (ctx->cert != NULL)
  		{
  		/* Earlier library versions used to copy the pointer to
***************
*** 1366,1371 ****
--- 1370,1380 ----
  	mask|=SSL_aNULL;
  	emask|=SSL_aNULL;
  
+ #ifndef NO_KRB5
+ 	mask|=SSL_kKRB5|SSL_aKRB5;
+ 	emask|=SSL_kKRB5|SSL_aKRB5;
+ #endif
+ 
  	c->mask=mask;
  	c->export_mask=emask;
  	c->valid=1;
***************
*** 1397,1402 ****
--- 1406,1416 ----
  			i=SSL_PKEY_RSA_SIGN;
  		else
  			i=SSL_PKEY_RSA_ENC;
+ 		}
+ 	else if (kalg & SSL_aKRB5)
+ 		{
+ 		/* VRS something else here? */
+ 		return(NULL);
  		}
  	else /* if (kalg & SSL_aNULL) */
  		{
diff -Nacr openssl-0.9.5a.orig/ssl/ssl_locl.h openssl-0.9.5a/ssl/ssl_locl.h
*** openssl-0.9.5a.orig/ssl/ssl_locl.h	Mon Feb 21 12:09:54 2000
--- openssl-0.9.5a/ssl/ssl_locl.h	Tue Jul 11 15:42:19 2000
***************
*** 168,215 ****
   * that the different entities within are mutually exclusive:
   * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
   */
! #define SSL_MKEY_MASK		0x0000001FL
  #define SSL_kRSA		0x00000001L /* RSA key exchange */
  #define SSL_kDHr		0x00000002L /* DH cert RSA CA cert */
  #define SSL_kDHd		0x00000004L /* DH cert DSA CA cert */
  #define SSL_kFZA		0x00000008L
  #define SSL_kEDH		0x00000010L /* tmp DH key no DH cert */
  #define SSL_EDH			(SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL))
  
! #define SSL_AUTH_MASK		0x000003e0L
! #define SSL_aRSA		0x00000020L /* Authenticate with RSA */
! #define SSL_aDSS 		0x00000040L /* Authenticate with DSS */
  #define SSL_DSS 		SSL_aDSS
! #define SSL_aFZA 		0x00000080L
! #define SSL_aNULL 		0x00000100L /* no Authenticate, ADH */
! #define SSL_aDH 		0x00000200L /* no Authenticate, ADH */
  
  #define SSL_NULL		(SSL_eNULL)
  #define SSL_ADH			(SSL_kEDH|SSL_aNULL)
  #define SSL_RSA			(SSL_kRSA|SSL_aRSA)
  #define SSL_DH			(SSL_kDHr|SSL_kDHd|SSL_kEDH)
  #define SSL_FZA			(SSL_aFZA|SSL_kFZA|SSL_eFZA)
  
! #define SSL_ENC_MASK		0x0001Fc00L
! #define SSL_DES			0x00000400L
! #define SSL_3DES		0x00000800L
! #define SSL_RC4			0x00001000L
! #define SSL_RC2			0x00002000L
! #define SSL_IDEA		0x00004000L
! #define SSL_eFZA		0x00008000L
! #define SSL_eNULL		0x00010000L
! 
! #define SSL_MAC_MASK		0x00060000L
! #define SSL_MD5			0x00020000L
! #define SSL_SHA1		0x00040000L
  #define SSL_SHA			(SSL_SHA1)
  
! #define SSL_SSL_MASK		0x00180000L
! #define SSL_SSLV2		0x00080000L
! #define SSL_SSLV3		0x00100000L
  #define SSL_TLSV1		SSL_SSLV3	/* for now */
  
! /* we have used 001fffff - 11 bits left to go */
  
  /*
   * Export and cipher strength information. For each cipher we have to decide
--- 168,218 ----
   * that the different entities within are mutually exclusive:
   * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
   */
! #define SSL_MKEY_MASK		0x0000003FL
  #define SSL_kRSA		0x00000001L /* RSA key exchange */
  #define SSL_kDHr		0x00000002L /* DH cert RSA CA cert */
  #define SSL_kDHd		0x00000004L /* DH cert DSA CA cert */
  #define SSL_kFZA		0x00000008L
  #define SSL_kEDH		0x00000010L /* tmp DH key no DH cert */
  #define SSL_EDH			(SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL))
+ #define SSL_kKRB5		0x00000020L /* Kerberos5 key exchange */
  
! #define SSL_AUTH_MASK		0x00000fc0L
! #define SSL_aRSA		0x00000040L /* Authenticate with RSA */
! #define SSL_aDSS 		0x00000080L /* Authenticate with DSS */
  #define SSL_DSS 		SSL_aDSS
! #define SSL_aFZA 		0x00000100L
! #define SSL_aNULL 		0x00000200L /* no Authenticate, ADH */
! #define SSL_aDH 		0x00000400L /* no Authenticate, ADH */
! #define SSL_aKRB5 		0x00000800L /* Authenticate with Kerberos5 */
  
  #define SSL_NULL		(SSL_eNULL)
  #define SSL_ADH			(SSL_kEDH|SSL_aNULL)
  #define SSL_RSA			(SSL_kRSA|SSL_aRSA)
  #define SSL_DH			(SSL_kDHr|SSL_kDHd|SSL_kEDH)
  #define SSL_FZA			(SSL_aFZA|SSL_kFZA|SSL_eFZA)
+ #define SSL_KRB5		(SSL_kKRB5|SSL_aKRB5)
  
! #define SSL_ENC_MASK		0x0007F000L
! #define SSL_DES			0x00001000L
! #define SSL_3DES		0x00002000L
! #define SSL_RC4			0x00004000L
! #define SSL_RC2			0x00008000L
! #define SSL_IDEA		0x00010000L
! #define SSL_eFZA		0x00020000L
! #define SSL_eNULL		0x00040000L
! 
! #define SSL_MAC_MASK		0x00180000L
! #define SSL_MD5			0x00080000L
! #define SSL_SHA1		0x00100000L
  #define SSL_SHA			(SSL_SHA1)
  
! #define SSL_SSL_MASK		0x00600000L
! #define SSL_SSLV2		0x00200000L
! #define SSL_SSLV3		0x00400000L
  #define SSL_TLSV1		SSL_SSLV3	/* for now */
  
! /* we have used 006fffff - 09 bits left to go */
  
  /*
   * Export and cipher strength information. For each cipher we have to decide
diff -Nacr openssl-0.9.5a.orig/ssl/ssltest.c openssl-0.9.5a/ssl/ssltest.c
*** openssl-0.9.5a.orig/ssl/ssltest.c	Mon Mar 27 16:28:28 2000
--- openssl-0.9.5a/ssl/ssltest.c	Tue Jul 11 15:42:19 2000
***************
*** 482,487 ****
--- 482,497 ----
  	c_ssl=SSL_new(c_ctx);
  	s_ssl=SSL_new(s_ctx);
  
+ #ifndef NO_KRB5
+ 	if (c_ssl  &&  c_ssl->kssl_ctx)  {
+ 		char	localhost[257];
+ 
+ 		if (gethostname(localhost, 256) == 0)  {
+ 			kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, localhost);
+ 			}
+ 		}
+ #endif    /* NO_KRB5  */
+ 
  	for (i=0; i<number; i++)
  		{
  		if (!reuse) SSL_set_session(c_ssl,NULL);
diff -Nacr openssl-0.9.5a.orig/ssl/t1_enc.c openssl-0.9.5a/ssl/t1_enc.c
*** openssl-0.9.5a.orig/ssl/t1_enc.c	Thu Feb  3 18:23:24 2000
--- openssl-0.9.5a/ssl/t1_enc.c	Tue Jul 11 15:42:20 2000
***************
*** 148,153 ****
--- 148,159 ----
  	tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),
  		 s->session->master_key,s->session->master_key_length,
  		 km,tmp,num);
+ #ifdef KSSL_DEBUG
+ 	printf("tls1_generate_key_block() ==> %d byte master_key =\n\t",
+ 			s->session->master_key_length);
+ 	{ int i; for (i=0; i < s->session->master_key_length; i++)  {
+ 	printf("%02X", s->session->master_key[i]);  }  printf("\n");  }
+ #endif    /* KSSL_DEBUG */
  	}
  
  int tls1_change_cipher_state(SSL *s, int which)
***************
*** 174,179 ****
--- 180,196 ----
  	comp=s->s3->tmp.new_compression;
  	key_block=s->s3->tmp.key_block;
  
+ #ifdef KSSL_DEBUG
+ 	printf("tls1_change_cipher_state(which= %d) w/\n", which);
+ 	printf("\talg= %ld, comp= %p\n", s->s3->tmp.new_cipher->algorithms,comp);
+ 	printf("\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c);
+ 	printf("\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n",
+ 			c->nid,c->block_size,c->key_len,c->iv_len);
+ 	printf("\tkey_block: len= %d, data= ", s->s3->tmp.key_block_length);
+ 	{ int i; for (i=0; i<s->s3->tmp.key_block_length; i++)
+ 		printf("%02x", key_block[i]);  printf("\n");  }
+ #endif	/* KSSL_DEBUG */
+ 
  	if (which & SSL3_CC_READ)
  		{
  		if ((s->enc_read_ctx == NULL) &&
***************
*** 309,314 ****
--- 326,340 ----
  		}
  
  	s->session->key_arg_length=0;
+ #ifdef KSSL_DEBUG
+ 	{ int i;
+ 	printf("EVP_CipherInit(dd,c,key=,iv=,which)\n");
+ 	printf("\tkey= "); for (i=0; i<c->key_len; i++)  printf("%02x", key[i]);
+ 	printf("\n");
+ 	printf("\t iv= "); for (i=0; i<c->iv_len; i++)  printf("%02x", iv[i]);
+ 	printf("\n");
+ 	}
+ #endif	/* KSSL_DEBUG */
  
  	EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));
  #ifdef TLS_DEBUG
***************
*** 338,343 ****
--- 364,373 ----
  	int num;
  	SSL_COMP *comp;
  
+ #ifdef KSSL_DEBUG
+ 	printf ("tls1_setup_key_block()\n");
+ #endif	/* KSSL_DEBUG */
+ 
  	if (s->s3->tmp.key_block_length != 0)
  		return(1);
  
***************
*** 417,422 ****
--- 447,456 ----
  			enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
  		}
  
+ #ifdef KSSL_DEBUG
+ 	printf("tls1_enc(%d)\n", send);
+ #endif    /* KSSL_DEBUG */
+ 
  	if ((s->session == NULL) || (ds == NULL) ||
  		(enc == NULL))
  		{
***************
*** 447,454 ****
--- 481,509 ----
  			rec->length+=i;
  			}
  
+ #ifdef KSSL_DEBUG
+ 		{  unsigned long i;
+ 		printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
+ 				ds,rec->data,rec->input,l);
+ 		printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
+ 				ds->buf_len, ds->cipher->key_len, DES_KEY_SZ, DES_SCHEDULE_SZ,
+ 				ds->cipher->iv_len);
+ 		printf("\t\tIV: ");
+ 		for (i=0; i<ds->cipher->iv_len; i++)  printf("%02X", ds->iv[i]);
+ 		printf("\n");
+ 		printf("\trec->input=");
+ 		for (i=0; i<l; i++)  printf(" %02x", rec->input[i]);
+ 		printf("\n");
+ 		}
+ #endif	/* KSSL_DEBUG */
+ 
  		EVP_Cipher(ds,rec->data,rec->input,l);
  
+ #ifdef KSSL_DEBUG
+ 		{  unsigned long i;  printf("\trec->data=");
+ 		for (i=0; i<l; i++)  printf(" %02x", rec->data[i]);  printf("\n");  }
+ #endif	/* KSSL_DEBUG */
+ 
  		if ((bs != 1) && !send)
  			{
  			ii=i=rec->data[l-1];
***************
*** 586,591 ****
--- 641,650 ----
  	unsigned char buf[SSL3_RANDOM_SIZE*2+TLS_MD_MASTER_SECRET_CONST_SIZE];
  	unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
  
+ #ifdef KSSL_DEBUG
+ 	printf ("tls1_generate_master_secret(%p,%p, %p, %d)\n", s,out, p,len);
+ #endif	/* KSSL_DEBUG */
+ 
  	/* Setup the stuff to munge */
  	memcpy(buf,TLS_MD_MASTER_SECRET_CONST,
  		TLS_MD_MASTER_SECRET_CONST_SIZE);
***************
*** 596,601 ****
--- 655,663 ----
  	tls1_PRF(s->ctx->md5,s->ctx->sha1,
  		buf,TLS_MD_MASTER_SECRET_CONST_SIZE+SSL3_RANDOM_SIZE*2,p,len,
  		s->session->master_key,buff,SSL3_MASTER_SECRET_SIZE);
+ #ifdef KSSL_DEBUG
+ 	printf ("tls1_generate_master_secret() complete\n");
+ #endif	/* KSSL_DEBUG */
  	return(SSL3_MASTER_SECRET_SIZE);
  	}
  
diff -Nacr openssl-0.9.5a.orig/ssl/yaapp_rand.c openssl-0.9.5a/ssl/yaapp_rand.c
*** openssl-0.9.5a.orig/ssl/yaapp_rand.c	Wed Dec 31 19:00:00 1969
--- openssl-0.9.5a/ssl/yaapp_rand.c	Tue Jul 11 15:42:20 2000
***************
*** 0 ****
--- 1,181 ----
+ /* ssl/yaapp_rand.c */
+ /*	20000711 VRS
+ **		Brought app_RAND_load_file() into libssl as yaapp_RAND_load_file().
+ **		This is a convenience function for ssl clients which haven't caught
+ **		up with the new randomness requirements of openssl-0.9.5.
+ **		Note:  "enough random data" == 16 bytes.
+ */
+ /* apps/app_rand.c */
+ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+  * All rights reserved.
+  *
+  * This package is an SSL implementation written
+  * by Eric Young (eay@cryptsoft.com).
+  * The implementation was written so as to conform with Netscapes SSL.
+  * 
+  * This library is free for commercial and non-commercial use as long as
+  * the following conditions are aheared to.  The following conditions
+  * apply to all code found in this distribution, be it the RC4, RSA,
+  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+  * included with this distribution is covered by the same copyright terms
+  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+  * 
+  * Copyright remains Eric Young's, and as such any Copyright notices in
+  * the code are not to be removed.
+  * If this package is used in a product, Eric Young should be given attribution
+  * as the author of the parts of the library used.
+  * This can be in the form of a textual message at program startup or
+  * in documentation (online or textual) provided with the package.
+  * 
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+  * are met:
+  * 1. Redistributions of source code must retain the copyright
+  *    notice, this list of conditions and the following disclaimer.
+  * 2. Redistributions in binary form must reproduce the above copyright
+  *    notice, this list of conditions and the following disclaimer in the
+  *    documentation and/or other materials provided with the distribution.
+  * 3. All advertising materials mentioning features or use of this software
+  *    must display the following acknowledgement:
+  *    "This product includes cryptographic software written by
+  *     Eric Young (eay@cryptsoft.com)"
+  *    The word 'cryptographic' can be left out if the rouines from the library
+  *    being used are not cryptographic related :-).
+  * 4. If you include any Windows specific code (or a derivative thereof) from 
+  *    the apps directory (application code) you must include an acknowledgement:
+  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+  * 
+  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+  * SUCH DAMAGE.
+  * 
+  * The licence and distribution terms for any publically available version or
+  * derivative of this code cannot be changed.  i.e. this code cannot simply be
+  * copied and put under another distribution licence
+  * [including the GNU Public Licence.]
+  */
+ /* ====================================================================
+  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+  * are met:
+  *
+  * 1. Redistributions of source code must retain the above copyright
+  *    notice, this list of conditions and the following disclaimer. 
+  *
+  * 2. Redistributions in binary form must reproduce the above copyright
+  *    notice, this list of conditions and the following disclaimer in
+  *    the documentation and/or other materials provided with the
+  *    distribution.
+  *
+  * 3. All advertising materials mentioning features or use of this
+  *    software must display the following acknowledgment:
+  *    "This product includes software developed by the OpenSSL Project
+  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+  *
+  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+  *    endorse or promote products derived from this software without
+  *    prior written permission. For written permission, please contact
+  *    openssl-core@openssl.org.
+  *
+  * 5. Products derived from this software may not be called "OpenSSL"
+  *    nor may "OpenSSL" appear in their names without prior written
+  *    permission of the OpenSSL Project.
+  *
+  * 6. Redistributions of any form whatsoever must retain the following
+  *    acknowledgment:
+  *    "This product includes software developed by the OpenSSL Project
+  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+  *
+  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+  * OF THE POSSIBILITY OF SUCH DAMAGE.
+  * ====================================================================
+  *
+  * This product includes cryptographic software written by Eric Young
+  * (eay@cryptsoft.com).  This product includes software written by Tim
+  * Hudson (tjh@cryptsoft.com).
+  *
+  */
+ 
+ #include <openssl/bio.h>
+ #include <openssl/rand.h>
+ 
+ 
+ static int seeded = 0;
+ static int egdsocket = 0;
+ static BIO *bio_fallback = NULL;
+ 
+ int yaapp_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
+ 	{
+ 	int consider_randfile = (file == NULL);
+ 	char buffer[200];
+ 
+ 	if (bio_e == NULL)  {
+ 		if (bio_fallback == NULL  && 
+ 			(bio_fallback = BIO_new_fp(stderr,BIO_NOCLOSE)) == NULL)  {
+ 			fprintf(stderr, "yaapp_RAND_load_file: unable to create new BIO\n");
+ 			return 0;
+ 			}
+ 		bio_e = bio_fallback;
+ 		}
+ 	
+ #ifdef WINDOWS
+ 	BIO_printf(bio_e,"Loading 'screen' into random state -");
+ 	BIO_flush(bio_e);
+ 	RAND_screen();
+ 	BIO_printf(bio_e," done\n");
+ #endif
+ 
+ 	if (file == NULL)
+ 		file = RAND_file_name(buffer, sizeof buffer);
+ 	else if (RAND_egd(file) > 0)
+ 		{
+ 		/* we try if the given filename is an EGD socket.
+ 		   if it is, we don't write anything back to the file. */
+ 		egdsocket = 1;
+ 		return 1;
+ 		}
+ 	if (file == NULL || !RAND_load_file(file, -1))
+ 		{
+ 		if (RAND_status() == 0 && !dont_warn)
+ 			{
+ 			BIO_printf(bio_e,
+ 				"unable to load 'random state'\n"
+ 				"This means that the random number generator "
+ 				"has not been seeded with much random data.\n"
+ 				);
+ 			if (consider_randfile)
+ 				/* explanation does not apply when a file is explicitly named */
+ 				{
+ 				BIO_printf(bio_e,
+ 					"Consider setting the RANDFILE environment variable\n"
+ 					"to point at a file that 'random' data can be kept in\n"
+ 					"(the file will be overwritten).\n"
+ 					);
+ 				}
+ 			}
+ 		return 0;
+ 		}
+ 	seeded = 1;
+ 	return 1;
+ 	}
+ 
diff -Nacr openssl-0.9.5a.orig/test/Makefile openssl-0.9.5a/test/Makefile
*** openssl-0.9.5a.orig/test/Makefile	Mon Mar 20 02:27:35 2000
--- openssl-0.9.5a/test/Makefile	Tue Jul 11 15:42:20 2000
***************
*** 5,11 ****
  DIR=		test
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include
  CFLAG=		-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
--- 5,11 ----
  DIR=		test
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include -I /usr/local/krb5/include
  CFLAG=		-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
***************
*** 17,22 ****
--- 17,23 ----
  
  PEX_LIBS=
  EX_LIBS= #-lnsl -lsocket
+ LIBKRB5=-L /usr/local/krb5/lib -lgssapi_krb5 -lkrb5 -lcom_err /usr/local/krb5/lib/libcrypto.a  -lresolv
  
  CFLAGS= $(INCLUDES) $(CFLAG)
  
***************
*** 305,311 ****
  	$(CC) -o $(METHTEST) $(CFLAGS) $(METHTEST).o $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
  
  $(SSLTEST): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
! 	$(CC) -o $(SSLTEST) $(CFLAGS) $(SSLTEST).o $(PEX_LIBS) $(LIBSSL) $(LIBCRYPTO) $(EX_LIBS)
  
  # DO NOT DELETE THIS LINE -- make depend depends on it.
  
--- 306,312 ----
  	$(CC) -o $(METHTEST) $(CFLAGS) $(METHTEST).o $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
  
  $(SSLTEST): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
! 	$(CC) -o $(SSLTEST) $(CFLAGS) $(SSLTEST).o $(PEX_LIBS) $(LIBSSL) $(LIBKRB5) $(LIBCRYPTO) $(EX_LIBS)
  
  # DO NOT DELETE THIS LINE -- make depend depends on it.
  
diff -Nacr openssl-0.9.5a.orig/test/Makefile.ssl openssl-0.9.5a/test/Makefile.ssl
*** openssl-0.9.5a.orig/test/Makefile.ssl	Mon Mar 20 02:27:35 2000
--- openssl-0.9.5a/test/Makefile.ssl	Tue Jul 11 15:42:20 2000
***************
*** 5,11 ****
  DIR=		test
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include
  CFLAG=		-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
--- 5,11 ----
  DIR=		test
  TOP=		..
  CC=		cc
! INCLUDES=	-I../include -I /usr/local/krb5/include
  CFLAG=		-g
  INSTALL_PREFIX=
  OPENSSLDIR=     /usr/local/ssl
***************
*** 17,22 ****
--- 17,23 ----
  
  PEX_LIBS=
  EX_LIBS= #-lnsl -lsocket
+ LIBKRB5=-L /usr/local/krb5/lib -lgssapi_krb5 -lkrb5 -lcom_err /usr/local/krb5/lib/libcrypto.a  -lresolv
  
  CFLAGS= $(INCLUDES) $(CFLAG)
  
***************
*** 305,311 ****
  	$(CC) -o $(METHTEST) $(CFLAGS) $(METHTEST).o $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
  
  $(SSLTEST): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
! 	$(CC) -o $(SSLTEST) $(CFLAGS) $(SSLTEST).o $(PEX_LIBS) $(LIBSSL) $(LIBCRYPTO) $(EX_LIBS)
  
  # DO NOT DELETE THIS LINE -- make depend depends on it.
  
--- 306,312 ----
  	$(CC) -o $(METHTEST) $(CFLAGS) $(METHTEST).o $(PEX_LIBS) $(LIBCRYPTO) $(EX_LIBS)
  
  $(SSLTEST): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
! 	$(CC) -o $(SSLTEST) $(CFLAGS) $(SSLTEST).o $(PEX_LIBS) $(LIBSSL) $(LIBKRB5) $(LIBCRYPTO) $(EX_LIBS)
  
  # DO NOT DELETE THIS LINE -- make depend depends on it.
  
