mod for buster

2025-08-13 18:37:59 +02:00 · 2025-08-13 16:24:48 +02:00 · 2025-08-13 15:38:24 +02:00 · 2025-08-13 15:25:25 +02:00 · 2025-08-13 00:27:22 +02:00 · 2025-08-13 00:07:01 +02:00
3293 changed files with 2231419 additions and 515467 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,83 +0,0 @@
-# In-tree build files
-configure
-config.h
-config.h.in
-Makefile
-Makefile.in
-.deps/
-.libs/
-*.la
-*.lo
-*.log
-*.o
-*.trs
-version.m4
-aclocal.m4
-autom4te.cache/
-config.guess
-config.log
-config.status
-config.sub
-depcomp
-install-sh
-ltmain.sh
-missing
-stamp-h1
-libtool
-build/
-compile
-
-# Python compilation
-*.pyc
-py-compile
-
-# Developer documentation
-freeipa2-dev-doc
-~/doc/guide/Makefile
-
-# Root directory
-/freeipa.spec
-!/Makefile
-/dist/
-/RELEASE
-/rpmbuild/
-
-# Subdirectories
-/daemons/ipa-otpd/ipa-otpd
-/daemons/ipa-otpd/ipa-otpd.socket
-/daemons/ipa-otpd/ipa-otpd@.service
-/daemons/ipa-version.h
-/daemons/test-driver
-
-/install/po/test.po
-/install/po/test_locale/xh_ZA/LC_MESSAGES/ipa.mo
-!/install/ui/doc/Makefile.in
-/install/ui/release
-/install/ui/css/ipa.css
-/install/ui/src/dojo
-/install/ui/src/build
-/install/ui/src/libs/loader.js
-/install/ui/src/plugins
-!/install/ui/doc/Makefile
-
-/client/ipa-getkeytab
-/client/ipa-join
-/client/ipa-rmkeytab
-
-/ipatests/setup.py
-
-/ipaclient/setup.py
-
-/ipalib/setup.py
-!/ipalib/Makefile
-
-/ipapython/setup.py
-/ipapython/version.py
-!/ipapython/Makefile
-
-/ipaplatform/__init__.py
-/ipaplatform/setup.py
-/ipaplatform/tasks.py
-/ipaplatform/services.py
-/ipaplatform/paths.py
-/ipaplatform/constants.py
--- a/.mailmap
+++ b/.mailmap
@@ -1,8 +1,18 @@
 Ana Krivokapić  <akrivoka@redhat.com>  Ana Krivokapic <akrivoka@redhat.com>
 Adam Misnyovszki <amisnyov@redhat.com> <amisnyov@redhat.com>
+Alexander Bokovoy <abokovoy@redhat.com> <ab@vda.li>
+Amit Kumar <amitkuma@redhat.com>  <amitkuma@redhat.com> <amitkuma@redhat.com>
 Endi Sukma Dewata <edewata@redhat.com>   System Administrator <root@dhcp-100-3-211.bos.redhat.com>
 Endi Sukma Dewata <edewata@redhat.com>
+Felipe Volpone <felipevolpone@gmail.com> Felipe Barreto <fbarreto@redhat.com>
+Felipe Volpone <felipevolpone@gmail.com> felipe <fbarreto@localhost.localdomain>
+Felipe Volpone <felipevolpone@gmail.com> Felipe Volpone <fbarreto@redhat.com>
+Felipe Volpone <fbarreto@redhat.com>
+François Cami <fcami@redhat.com>
+François Cami <fcami@redhat.com> <fcami@fedoraproject.org>
+Fraser Tweedale <ftweedal@redhat.com> <frase@frase.id.au>
 Gabe Alford     <redhatrises@gmail.com>
+Ganna Kaihorodova <gkaihoro@redhat.com> <gkaihoro@example.com>
 Jan Zelený      <jzeleny@redhat.com>
 Jim Meyering    <meyering@redhat.com>  <jim@meyering.net>
 John Dennis     <jdennis@redhat.com>   <jdennis@VAIO>
@@ -23,6 +33,7 @@ Lubomír Rintel  <lubo.rintel@gooddata.com> Lubomir Rintel <lubo.rintel@gooddata
 Lukáš Slebodník <lslebodn@redhat.com>
 Martin Bašti    <mbasti@redhat.com>
 Martin Košek    <mkosek@redhat.com>
+Tomáš Křížek    <tkrizek@redhat.com>
 Milan Kubík     <mkubik@redhat.com>
 Martin Nagy     <mnagy@redhat.com>     <mnagy@notas.(none)>
 Nathaniel McCallum <npmccallum@redhat.com> <nathaniel@themccallums.org>
@@ -36,6 +47,8 @@ Pavel Zůna      <pzuna@redhat.com>     <root@testbox.winry>
 Pavel Zůna      <pzuna@redhat.com>     <root@webui.pzuna>
 Petr Špaček     <pspacek@redhat.com>
 Petr Voborník   <pvoborni@redhat.com>
+Pavel Vomáčka   <pvomacka@redhat.com>
+Pavel Vomáčka   <pvomacka@redhat.com>  tester <test@example.com>
 Rich Megginson  <rmeggins@redhat.com>  <rich@localhost.localdomain>
 Rob Crittenden  <rcritten@redhat.com>
 Rob Crittenden  <rcritten@redhat.com>  <rcrit@ike.greyoak.com>
@@ -45,12 +58,15 @@ Rob Crittenden  <rcritten@redhat.com>  <rcrit@rhel1.greyoak.com>
 Rob Crittenden  <rcritten@redhat.com>  rcritten <devnull@localhost>
 Rob Crittenden  <rcritten@redhat.com>  <rcrit@thor.greyoak.com>
 Rob Crittenden  <rcritten@redhat.com>  <rcrit@tove.greyoak.com>
+Serhii Tsymbaliuk <stsymbal@redhat.com> <stsymbal@localhost.localdomain>
 Simo Sorce      <ssorce@redhat.com>    <simo@redhat.com>
 Sumit Bose      <sbose@redhat.com>     <sbose@ipa17-devel.ipa17.devel>
 Sumit Bose      <sbose@redhat.com>     <sbose@ipa18-devel.ipa18.devel>
+Tibor Dudlák    <tdudlak@redhat.com>   <tibor.dudlak@gmail.com>
 Thierry Bordaz  <tbordaz@redhat.com>
 Thierry Bordaz  <tbordaz@redhat.com>   <root@vm-205.idm.lab.eng.brq.redhat.com>
 Thierry Bordaz  <tbordaz@redhat.com>   <root@vm-035.idm.lab.eng.brq.redhat.com>
+Thierry Bordaz  <tbordaz@redhat.com>   <root@vm-058-107.abc.idm.lab.eng.brq.redhat.com>
 Tomáš Babej     <tbabej@redhat.com>
 Tomáš Babej     <tbabej@redhat.com>    <tomasbabej@gmail.com>
 William Jon McCann <mccann@jhu.edu>    <mccann@jhu.edu>
--- a/.tx/config
+++ b/.tx/config
@@ -1,8 +0,0 @@
-[main]
-host = https://www.transifex.com
-
-[freeipa.ipa]
-file_filter = install/po/<lang>.po
-source_file = install/po/ipa.pot
-source_lang = en
-
--- a/.wheelconstraints.in
+++ b/.wheelconstraints.in
@@ -0,0 +1,14 @@
+# placeholder
+freeipa == @VERSION@
+ipa == @VERSION@
+# actual packages
+ipaclient == @VERSION@
+ipalib == @VERSION@
+ipaplatform == @VERSION@
+ipapython == @VERSION@
+ipaserver == @VERSION@
+ipatests == @VERSION@
+
+# keep pylint version in sync with current Fedora release
+# F39 has 3.0.25
+pylint ~= 3.0.2
--- a/1282
+++ b/1282
--- a/ACI.txt
+++ b/ACI.txt
@@ -22,6 +22,14 @@ dn: cn=automount,dc=ipa,dc=example
 aci: (targetattr = "automountmapname || description")(targetfilter = "(objectclass=automountmap)")(version 3.0;acl "permission:System: Modify Automount Maps";allow (write) groupdn = "ldap:///cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=automount,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=automountmap)")(version 3.0;acl "permission:System: Remove Automount Maps";allow (delete) groupdn = "ldap:///cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=cas,cn=ca,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Add CA";allow (add) groupdn = "ldap:///cn=System: Add CA,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=cas,cn=ca,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Delete CA";allow (delete) groupdn = "ldap:///cn=System: Delete CA,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=cas,cn=ca,dc=ipa,dc=example
+aci: (targetattr = "cn || description")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Modify CA";allow (write) groupdn = "ldap:///cn=System: Modify CA,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=cas,cn=ca,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || description || entryusn || ipacahsmconfiguration || ipacaid || ipacaissuerdn || ipacarandomserialnumberversion || ipacasubjectdn || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Read CAs";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=caacls,cn=ca,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Add CA ACL";allow (add) groupdn = "ldap:///cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=caacls,cn=ca,dc=ipa,dc=example
@@ -32,6 +40,18 @@ dn: cn=caacls,cn=ca,dc=ipa,dc=example
 aci: (targetattr = "cn || description || ipaenabledflag")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Modify CA ACL";allow (write) groupdn = "ldap:///cn=System: Modify CA ACL,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=caacls,cn=ca,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || description || entryusn || hostcategory || ipacacategory || ipacertprofilecategory || ipaenabledflag || ipamemberca || ipamembercertprofile || ipauniqueid || member || memberhost || memberservice || memberuser || modifytimestamp || objectclass || servicecategory || usercategory")(targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Read CA ACLs";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=certmap,dc=ipa,dc=example
+aci: (targetattr = "ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Modify Certmap Configuration";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=certmap,dc=ipa,dc=example
+aci: (targetattr = "cn || ipacertmappromptusername")(targetfilter = "(objectclass=ipacertmapconfigobject)")(version 3.0;acl "permission:System: Read Certmap Configuration";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=certmaprules,cn=certmap,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Add Certmap Rules";allow (add) groupdn = "ldap:///cn=System: Add Certmap Rules,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=certmaprules,cn=certmap,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Delete Certmap Rules";allow (delete) groupdn = "ldap:///cn=System: Delete Certmap Rules,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=certmaprules,cn=certmap,dc=ipa,dc=example
+aci: (targetattr = "associateddomain || cn || description || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Modify Certmap Rules";allow (write) groupdn = "ldap:///cn=System: Modify Certmap Rules,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=certmaprules,cn=certmap,dc=ipa,dc=example
+aci: (targetattr = "associateddomain || cn || createtimestamp || description || entryusn || ipacertmapmaprule || ipacertmapmatchrule || ipacertmappriority || ipaenabledflag || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertmaprule)")(version 3.0;acl "permission:System: Read Certmap Rules";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=certprofiles,cn=ca,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Delete Certificate Profile";allow (delete) groupdn = "ldap:///cn=System: Delete Certificate Profile,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=certprofiles,cn=ca,dc=ipa,dc=example
@@ -41,7 +61,7 @@ aci: (targetattr = "cn || description || ipacertprofilestoreissued")(targetfilte
 dn: cn=certprofiles,cn=ca,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || description || entryusn || ipacertprofilestoreissued || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipacertprofile)")(version 3.0;acl "permission:System: Read Certificate Profiles";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=ipaconfig,cn=etc,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version 3.0;acl "permission:System: Read Global Configuration";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=costemplates,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=costemplate)")(version 3.0;acl "permission:System: Add Group Password Policy costemplate";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=costemplates,cn=accounts,dc=ipa,dc=example
@@ -51,29 +71,37 @@ aci: (targetattr = "cospriority")(targetfilter = "(objectclass=costemplate)")(ve
 dn: cn=costemplates,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "cn || cospriority || createtimestamp || entryusn || krbpwdpolicyreference || modifytimestamp || objectclass")(targetfilter = "(objectclass=costemplate)")(version 3.0;acl "permission:System: Read Group Password Policy costemplate";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=ipa,dc=example")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "createtimestamp || entryusn || idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh || ipadnsversion || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=ipa,dc=example")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Read DNS Configuration";allow (read) groupdn = "ldap:///cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || idnspersistentsearch || idnszonerefresh")(target = "ldap:///cn=dns,dc=ipa,dc=example")(targetfilter = "(objectclass=idnsConfigObject)")(version 3.0;acl "permission:System: Write DNS Configuration";allow (write) groupdn = "ldap:///cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
+aci: (targetattr = "idnsforwarders || idnsforwardpolicy || idnssoamname || idnssubstitutionvariable")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Modify DNS Servers Configuration";allow (write) groupdn = "ldap:///cn=System: Modify DNS Servers Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || entryusn || idnsforwarders || idnsforwardpolicy || idnsserverid || idnssoamname || idnssubstitutionvariable || modifytimestamp || objectclass")(targetfilter = "(objectclass=idnsServerConfigObject)")(version 3.0;acl "permission:System: Read DNS Servers Configuration";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: dc=ipa,dc=example
 aci: (target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "ipaprivatekey || ipapublickey || ipasecretkey || ipasecretkeyref || ipawrappingkey || ipawrappingmech || ipk11allowedmechanisms || ipk11alwaysauthenticate || ipk11alwayssensitive || ipk11checkvalue || ipk11copyable || ipk11decrypt || ipk11derive || ipk11destroyable || ipk11distrusted || ipk11encrypt || ipk11enddate || ipk11extractable || ipk11id || ipk11keygenmechanism || ipk11keytype || ipk11label || ipk11local || ipk11modifiable || ipk11neverextractable || ipk11private || ipk11publickeyinfo || ipk11sensitive || ipk11sign || ipk11signrecover || ipk11startdate || ipk11subject || ipk11trusted || ipk11uniqueid || ipk11unwrap || ipk11unwraptemplate || ipk11verify || ipk11verifyrecover || ipk11wrap || ipk11wraptemplate || ipk11wrapwithtrusted || objectclass")(target = "ldap:///cn=keys,cn=sec,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Manage DNSSEC keys";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || objectclass")(target = "ldap:///cn=dns,dc=ipa,dc=example")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Manage DNSSEC metadata";allow (all) groupdn = "ldap:///cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
-aci: (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || createtimestamp || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || entryusn || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || modifytimestamp || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || idnssecalgorithm || idnsseckeyactivate || idnsseckeycreated || idnsseckeydelete || idnsseckeyinactive || idnsseckeypublish || idnsseckeyref || idnsseckeyrevoke || idnsseckeysep || idnsseckeyzone || modifytimestamp || objectclass")(target = "ldap:///cn=dns,dc=ipa,dc=example")(targetfilter = "(objectclass=idnsSecKey)")(version 3.0;acl "permission:System: Read DNSSEC metadata";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNSSEC metadata,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
-aci: (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "a6record || aaaarecord || afsdbrecord || aplrecord || arecord || certrecord || cn || cnamerecord || dhcidrecord || dlvrecord || dnamerecord || dnsclass || dnsdefaultttl || dnsttl || dsrecord || hinforecord || hiprecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnstemplateattribute || idnsupdatepolicy || idnszoneactive || ipseckeyrecord || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rprecord || rrsigrecord || sigrecord || spfrecord || srvrecord || sshfprecord || tlsarecord || txtrecord || unknownrecord || urirecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "ipaexternalmember")(targetfilter = "(objectclass=ipaexternalgroup)")(version 3.0;acl "permission:System: Modify External Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=groups,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "member")(targetfilter = "(&(!(cn=admins))(objectclass=ipausergroup))")(version 3.0;acl "permission:System: Modify Group Membership";allow (write) groupdn = "ldap:///cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "cn || description || gidnumber || ipauniqueid || mepmanagedby || objectclass")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "cn || description || gidnumber || ipauniqueid || membermanager || mepmanagedby || objectclass")(targetfilter = "(&(!(cn=admins))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Modify Groups";allow (write) groupdn = "ldap:///cn=System: Modify Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=groups,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "ipaexternalmember")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read External Group Membership";allow (compare,read,search) userdn = "ldap:///all";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Group Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
@@ -81,9 +109,9 @@ aci: (targetattr = "member || memberhost || memberof || memberuid || memberuser"
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || gidnumber || memberuid || modifytimestamp || objectclass")(target = "ldap:///cn=groups,cn=*,cn=views,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Group Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";)
+aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || gidnumber || ipaexternalmember || ipantsecurityidentifier || ipauniqueid || membermanager || mepmanagedby || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Read Groups";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
-aci: (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetfilter = "(&(!(|(cn=admins)(cn=trust admins)(cn=default smb group)))(|(objectclass=ipausergroup)(objectclass=posixgroup)))")(version 3.0;acl "permission:System: Remove Groups";allow (delete) groupdn = "ldap:///cn=System: Remove Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipahbacrule)")(version 3.0;acl "permission:System: Add HBAC Rule";allow (add) groupdn = "ldap:///cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hbac,dc=ipa,dc=example
@@ -113,25 +141,29 @@ aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "krbprincipalname")(targetfilter = "(&(!(krbprincipalname=*))(objectclass=ipahost))")(version 3.0;acl "permission:System: Add krbPrincipalName to a Host";allow (write) groupdn = "ldap:///cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "enrolledby || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "enrolledby || nshardwareplatform || nsosversion || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Enroll a Host";allow (write) groupdn = "ldap:///cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Certificates";allow (write) groupdn = "ldap:///cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "userpassword")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Enrollment Password";allow (write) groupdn = "ldap:///cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=ipa,dc=example))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "ipaprotectedoperation;write_keys || krblastpwdchange || krbprincipalkey")(targetfilter = "(&(!(memberOf=cn=ipaservers,cn=hostgroups,cn=accounts,dc=ipa,dc=example))(objectclass=ipahost))")(version 3.0;acl "permission:System: Manage Host Keytab";allow (write) groupdn = "ldap:///cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=computers,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Host Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "description || ipaassignedidview || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytimestamp || objectclass")(target = "ldap:///cn=computers,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Host Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || memberprincipal || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
@@ -139,25 +171,43 @@ aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:S
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "member")(targetfilter = "(&(!(cn=ipaservers))(objectclass=ipahostgroup))")(version 3.0;acl "permission:System: Modify Hostgroup Membership";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "cn || description")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "cn || description || membermanager")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Modify Hostgroups";allow (write) groupdn = "ldap:///cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "member || memberhost || memberof || memberuser")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroup Membership";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "businesscategory || cn || createtimestamp || description || entryusn || ipauniqueid || membermanager || modifytimestamp || o || objectclass || ou || owner || seealso")(targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Read Hostgroups";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:System: Remove Hostgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=views,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=views,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || memberof || modifytimestamp || objectclass || uid || uidnumber || usercertificate")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=idp,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Add External IdP server";allow (add) groupdn = "ldap:///cn=System: Add External IdP server,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=idp,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Delete External IdP server";allow (delete) groupdn = "ldap:///cn=System: Delete External IdP server,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=idp,dc=ipa,dc=example
+aci: (targetattr = "cn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Modify External IdP server";allow (write) groupdn = "ldap:///cn=System: Modify External IdP server,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=idp,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=idp,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || ipaidpauthendpoint || ipaidpclientid || ipaidpclientsecret || ipaidpdevauthendpoint || ipaidpissuerurl || ipaidpkeysendpoint || ipaidpscope || ipaidpsub || ipaidptokenendpoint || ipaidpuserinfoendpoint || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidp)")(version 3.0;acl "permission:System: Read External IdP server client secret";allow (compare,read,search) groupdn = "ldap:///cn=System: Read External IdP server client secret,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=ranges,cn=etc,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=views,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || description || entryusn || ipadomainresolutionorder || modifytimestamp || objectclass")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Read ID Views";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || entryusn || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "createtimestamp || entryusn || krbauthindmaxrenewableage || krbauthindmaxticketlife || krbdefaultencsalttypes || krbmaxrenewableage || krbmaxticketlife || krbsupportedencsalttypes || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read Default Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Default Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "krbauthindmaxrenewableage || krbauthindmaxticketlife || krbmaxrenewableage || krbmaxticketlife")(targetfilter = "(objectclass=krbticketpolicyaux)")(version 3.0;acl "permission:System: Read User Kerberos Ticket Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read User Kerberos Ticket Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=locations,cn=etc,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Add IPA Locations";allow (add) groupdn = "ldap:///cn=System: Add IPA Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=locations,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "description")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Modify IPA Locations";allow (write) groupdn = "ldap:///cn=System: Modify IPA Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=locations,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || description || entryusn || idnsname || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Read IPA Locations";allow (compare,read,search) groupdn = "ldap:///cn=System: Read IPA Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=locations,cn=etc,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipaLocationObject)")(version 3.0;acl "permission:System: Remove IPA Locations";allow (delete) groupdn = "ldap:///cn=System: Remove IPA Locations,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=ng,cn=alt,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Add Netgroups";allow (add) groupdn = "ldap:///cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=ng,cn=alt,dc=ipa,dc=example
@@ -174,6 +224,10 @@ dn: cn=ng,cn=alt,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=otp,cn=etc,dc=ipa,dc=example
 aci: (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokentotpauthwindow || ipatokentotpsyncwindow")(targetfilter = "(objectclass=ipatokenotpconfig)")(version 3.0;acl "permission:System: Read OTP Configuration";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=passkeyconfig,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "iparequireuserverification")(targetfilter = "(objectclass=ipapasskeyconfigobject)")(version 3.0;acl "permission:System: Modify Passkey Configuration";allow (write) groupdn = "ldap:///cn=System: Modify Passkey Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=passkeyconfig,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "cn || iparequireuserverification")(targetfilter = "(objectclass=ipapasskeyconfigobject)")(version 3.0;acl "permission:System: Read Passkey Configuration";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=permissions,cn=pbac,dc=ipa,dc=example
 aci: (targetattr = "member")(targetfilter = "(objectclass=ipapermission)")(version 3.0;acl "permission:System: Modify Privilege Membership";allow (write) groupdn = "ldap:///cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
@@ -189,13 +243,15 @@ aci: (targetattr = "businesscategory || cn || createtimestamp || description ||
 dn: cn=privileges,cn=pbac,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=groupofnames)")(version 3.0;acl "permission:System: Remove Privileges";allow (delete) groupdn = "ldap:///cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
-aci: (targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Add Group Password Policy";allow (add) groupdn = "ldap:///cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
-aci: (targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Delete Group Password Policy";allow (delete) groupdn = "ldap:///cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
-aci: (targetattr = "krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength")(targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Modify Group Password Policy";allow (write) groupdn = "ldap:///cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=IPA.EXAMPLE,cn=kerberos,dc=ipa,dc=example
-aci: (targetattr = "cn || cospriority || createtimestamp || entryusn || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || modifytimestamp || objectclass")(targetfilter = "(objectclass=krbpwdpolicy)")(version 3.0;acl "permission:System: Read Group Password Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "cn || cospriority || createtimestamp || entryusn || ipapwddictcheck || ipapwdmaxrepeat || ipapwdmaxsequence || ipapwdusercheck || krbmaxpwdlife || krbminpwdlife || krbpwdfailurecountinterval || krbpwdhistorylength || krbpwdlockoutduration || krbpwdmaxfailure || krbpwdmindiffchars || krbpwdminlength || modifytimestamp || objectclass || passwordgracelimit")(targetfilter = "(|(objectclass=ipapwdpolicy)(objectclass=krbpwdpolicy))")(version 3.0;acl "permission:System: Read Group Password Policy";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=radiusproxy,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || description || entryusn || ipatokenradiusretries || ipatokenradiusserver || ipatokenradiustimeout || ipatokenusermapattribute || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipatokenradiusconfiguration)")(version 3.0;acl "permission:System: Read Radius Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=Realm Domains,cn=ipa,cn=etc,dc=ipa,dc=example
 aci: (targetattr = "associateddomain")(targetfilter = "(objectclass=domainrelatedobject)")(version 3.0;acl "permission:System: Modify Realm Domains";allow (write) groupdn = "ldap:///cn=System: Modify Realm Domains,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=Realm Domains,cn=ipa,cn=etc,dc=ipa,dc=example
@@ -218,6 +274,10 @@ dn: cn=usermap,cn=selinux,dc=ipa,dc=example
 aci: (targetattr = "accesstime || cn || createtimestamp || description || entryusn || hostcategory || ipaenabledflag || ipaselinuxuser || ipauniqueid || member || memberhost || memberuser || modifytimestamp || objectclass || seealso || usercategory")(targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Read SELinux User Maps";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=usermap,cn=selinux,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipaselinuxusermap)")(version 3.0;acl "permission:System: Remove SELinux User Maps";allow (delete) groupdn = "ldap:///cn=System: Remove SELinux User Maps,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || ipalocation || ipaserviceweight || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Locations of IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Locations of IPA Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || ipaconfigstring || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaConfigObject)")(version 3.0;acl "permission:System: Read Status of Services on IPA Servers";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Status of Services on IPA Servers,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Add Services";allow (add) groupdn = "ldap:///cn=System: Add Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
@@ -225,9 +285,17 @@ aci: (targetattr = "krblastpwdchange || krbprincipalkey")(targetfilter = "(objec
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys || ipaallowedtoperform;write_keys || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Keytab Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;write_delegation || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || memberprincipal || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=s4u2proxy,cn=etc,dc=ipa,dc=example
@@ -270,6 +338,14 @@ dn: cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example
 aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Reset Preserved User password";allow (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (target_to = "ldap:///cn=users,cn=accounts,dc=ipa,dc=example")(target_from = "ldap:///cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example")(targetfilter = "(objectclass=nsContainer)")(version 3.0;acl "permission:System: Undelete User";allow (moddn) groupdn = "ldap:///cn=System: Undelete User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=subids,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "description || ipaowner")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Manage Subordinate Ids";allow (write) groupdn = "ldap:///cn=System: Manage Subordinate Ids,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=subids,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || description || entryusn || ipaowner || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Read Subordinate Id Attributes";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=subids,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "numsubordinates")(target = "ldap:///cn=subids,cn=accounts,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Subordinate Id Count";allow (compare,read,search) userdn = "ldap:///all";)
+dn: cn=subids,cn=accounts,dc=ipa,dc=example
+aci: (targetfilter = "(objectclass=ipasubordinateidentry)")(version 3.0;acl "permission:System: Remove Subordinate Ids";allow (delete) groupdn = "ldap:///cn=System: Remove Subordinate Ids,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=sudocmds,cn=sudo,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipasudocmd)")(version 3.0;acl "permission:System: Add Sudo Command";allow (add) groupdn = "ldap:///cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=sudocmds,cn=sudo,dc=ipa,dc=example
@@ -298,8 +374,16 @@ dn: cn=sudorules,cn=sudo,dc=ipa,dc=example
 aci: (targetattr = "cmdcategory || cn || createtimestamp || description || entryusn || externalhost || externaluser || hostcategory || hostmask || ipaenabledflag || ipasudoopt || ipasudorunas || ipasudorunasextgroup || ipasudorunasextuser || ipasudorunasextusergroup || ipasudorunasgroup || ipasudorunasgroupcategory || ipasudorunasusercategory || ipauniqueid || member || memberallowcmd || memberdenycmd || memberhost || memberuser || modifytimestamp || objectclass || sudonotafter || sudonotbefore || sudoorder || usercategory")(targetfilter = "(objectclass=ipasudorule)")(version 3.0;acl "permission:System: Read Sudo Rules";allow (compare,read,search) userdn = "ldap:///all";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || description || entryusn || modifytimestamp || objectclass || ou || sudocommand || sudohost || sudonotafter || sudonotbefore || sudooption || sudoorder || sudorunas || sudorunasgroup || sudorunasuser || sudouser")(target = "ldap:///ou=sudoers,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read Sudoers compat tree";allow (compare,read,search) userdn = "ldap:///anyone";)
+dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetfilter = "(|(objectclass=iparepltopoconf)(objectclass=iparepltoposegment))")(version 3.0;acl "permission:System: Add Topology Segments";allow (add) groupdn = "ldap:///cn=System: Add Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "iparepltoposegmentdirection || iparepltoposegmentleftnode || iparepltoposegmentrightnode || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal")(targetfilter = "(|(objectclass=iparepltopoconf)(objectclass=iparepltoposegment))")(version 3.0;acl "permission:System: Modify Topology Segments";allow (write) groupdn = "ldap:///cn=System: Modify Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetattr = "cn || createtimestamp || entryusn || iparepltopoconfroot || iparepltoposegmentdirection || iparepltoposegmentleftnode || iparepltoposegmentrightnode || iparepltoposegmentstatus || modifytimestamp || nsds5replicastripattrs || nsds5replicatedattributelist || nsds5replicatedattributelisttotal || objectclass")(targetfilter = "(|(objectclass=iparepltopoconf)(objectclass=iparepltoposegment))")(version 3.0;acl "permission:System: Read Topology Segments";allow (compare,read,search) groupdn = "ldap:///cn=System: Read Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=topology,cn=ipa,cn=etc,dc=ipa,dc=example
+aci: (targetfilter = "(|(objectclass=iparepltopoconf)(objectclass=iparepltoposegment))")(version 3.0;acl "permission:System: Remove Topology Segments";allow (delete) groupdn = "ldap:///cn=System: Remove Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=trusts,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || entryusn || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || entryusn || ipantadditionalsuffixes || ipantflatname || ipantsecurityidentifier || ipantsidblacklistincoming || ipantsidblacklistoutgoing || ipanttrustdirection || ipanttrusteddomainsid || ipanttrustpartner || modifytimestamp || objectclass")(version 3.0;acl "permission:System: Read Trust Information";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=trusts,dc=ipa,dc=example
 aci: (targetattr = "gidnumber || krbprincipalname || uidnumber")(version 3.0;acl "permission:System: Read system trust accounts";allow (compare,read,search) groupdn = "ldap:///cn=System: Read system trust accounts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=groups,cn=accounts,dc=ipa,dc=example
@@ -307,21 +391,29 @@ aci: (targetattr = "member")(target = "ldap:///cn=ipausers,cn=groups,cn=accounts
 dn: cn=users,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Add Users";allow (add) groupdn = "ldap:///cn=System: Add Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example)")(version 3.0;acl "permission:System: Change Admin User password";allow (write) groupdn = "ldap:///cn=System: Change Admin User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "usercertificate")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "ipapasskey || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage Passkey Mappings";allow (write) groupdn = "ldap:///cn=System: Manage Passkey Mappings,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "businesscategory || carlicense || cn || description || displayname || employeetype || facsimiletelephonenumber || gecos || givenname || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=users,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=users,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Principals";allow (write) groupdn = "ldap:///cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=users,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "ipasshpubkey")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=users,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "businesscategory || carlicense || cn || departmentnumber || description || displayname || employeenumber || employeetype || facsimiletelephonenumber || gecos || givenname || homedirectory || homephone || inetuserhttpurl || initials || l || labeleduri || loginshell || mail || manager || mepmanagedentry || mobile || objectclass || ou || pager || postalcode || preferredlanguage || roomnumber || secretary || seealso || sn || st || street || telephonenumber || title || userclass")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Modify Users";allow (write) groupdn = "ldap:///cn=System: Modify Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=ipa,dc=example
 aci: (targetattr = "*")(target = "ldap:///cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read UPG Definition";allow (compare,read,search) groupdn = "ldap:///cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "audio || businesscategory || carlicense || departmentnumber || destinationindicator || employeenumber || employeetype || facsimiletelephonenumber || homephone || homepostaladdress || inetuserhttpurl || inetuserstatus || internationalisdnnumber || ipacertmapdata || jpegphoto || l || labeleduri || mail || mobile || o || ou || pager || photo || physicaldeliveryofficename || postaladdress || postalcode || postofficebox || preferreddeliverymethod || preferredlanguage || registeredaddress || roomnumber || secretary || seealso || st || street || telephonenumber || teletexterminalidentifier || telexnumber || usercertificate || usersmimecertificate || x121address || x500uniqueidentifier")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Addressbook Attributes";allow (compare,read,search) userdn = "ldap:///all";)
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "ipapasskey || ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
@@ -335,9 +427,9 @@ aci: (targetattr = "cn || createtimestamp || description || displayname || entry
 dn: dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=*,cn=views,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read User Views Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Remove Users";allow (delete) groupdn = "ldap:///cn=System: Remove Users,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=users,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+aci: (targetattr = "krblastadminunlock || krbloginfailedcount || nsaccountlock")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Unlock User";allow (write) groupdn = "ldap:///cn=System: Unlock User,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
 aci: (target = "ldap:///cn=vaults,cn=kra,dc=ipa,dc=example")(targetfilter = "(objectclass=ipaVault)")(version 3.0;acl "permission:System: Add Vaults";allow (add) groupdn = "ldap:///cn=System: Add Vaults,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: dc=ipa,dc=example
--- a/API.txt
+++ b/API.txt
--- a/BUILD.txt
+++ b/BUILD.txt
@@ -1,4 +1,4 @@
-Here is a quickie guide to get you started in IPA development.
+Here is a quick guide to get you started in IPA development.

 Dependencies
 ------------
@@ -7,42 +7,47 @@ For more information, see http://www.freeipa.org/page/Build

 The quickest way to get the dependencies needed for building is:

-# dnf builddep -b --spec freeipa.spec.in
+# dnf builddep -D "with_wheels 1" -D "with_lint 1" -D "with_doc 1" --spec freeipa.spec.in --best --allowerasing --setopt=install_weak_deps=False

-or
+TIP: For building with latest dependencies for freeipa master enable copr repo:

-# yum install rpm-build `grep "^BuildRequires" freeipa.spec.in | awk '{ print $2 }' | grep -v "^/"`
+# dnf copr enable @freeipa/freeipa-master

-This is currently (2015-05-07):
+see: https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-master/

-yum install rpm-build 389-ds-base-devel svrcore-devel policycoreutils \
-systemd-units samba-devel samba-python libwbclient-devel libtalloc-devel \
-libtevent-devel nspr-devel nss-devel openssl-devel openldap-devel krb5-devel \
-krb5-workstation libuuid-devel libcurl-devel xmlrpc-c-devel popt-devel \
-autoconf automake m4 libtool gettext python-devel python-ldap \
-python-setuptools python-nss python-netaddr python-gssapi \
-python-rhsm pyOpenSSL pylint python-polib libipa_hbac-python python-memcached \
-sssd python-lxml python-pyasn1 python-qrcode-core python-dns m2crypto \
-check libsss_idmap-devel libsss_nss_idmap-devel java-headless rhino \
-libverto-devel systemd libunistring-devel python-lesscpy python-yubico \
-python-backports-ssl_match_hostname softhsm-devel openssl-devel \
-p11-kit-devel pki-base python-pytest-multihost python-pytest-sourceorder
+TIP: You might need to enable the "nodejs" module:
+
+# dnf module list nodejs
+# dnf module enable nodejs:<latest version> -y
+
+For more dependencies management tips, you can have a look at ./ipatests/azure/templates/prepare-build-fedora.yml

 Building
 --------

 From the root of the source tree run:
-$ make rpms
+$ ./makerpms.sh

 The resulting rpm packages are in dist/rpms:

 # yum --nogpgcheck localinstall dist/rpms/*
 # ipa-server-install

-It may be possible to do a simple make all install but this has not been
+You might tweak the build and run steps separatelly:
+$ autoreconf -i
+$ ./configure
+$ make
+$ make install
+
+It may be possible to do a simple make install but this has not been
 well-tested. Additional work is done in pre/post install scripts in the ipa
 spec file.

+To build only python2 packages on fedora following steps are required:
+$ autoreconf -i
+$ ./configure
+$ make rpms RPMBUILD_OPTS="--define 'with_python3 0'"
+
 Developing plugins
 ------------------

@@ -54,7 +59,7 @@ install the rpms and then configure IPA using ipa-server-install.
 Get a TGT for the admin user with: kinit admin

 Next you'll need 2 sessions in the source tree. In the first session run
-python lite-server.py. In the second session copy /etc/ipa/default.conf into
+```make lite-server```. In the second session copy /etc/ipa/default.conf into
 ~/.ipa/default.conf and replace xmlrpc_uri with http://127.0.0.1:8888/ipa/xml.
 Finally run the ./ipa tool and it will make requests to the lite-server
 listening on 127.0.0.1:8888.
@@ -68,9 +73,9 @@ changes are required.
 Testing
 -------

-For more information, see http://www.freeipa.org/page/Testing
+For more information, see https://www.freeipa.org/page/Testing

-We use python nosetests to test for regressions in the management framework
+We use python pytest to test for regressions in the management framework
 and plugins. All test dependencies are required by the freeipa-tests package.

 To run all of the tests you will need 2 sessions, one to run the lite-server
@@ -84,6 +89,14 @@ Some tests may be skipped. For example, all the XML-RPC tests will be skipped
 if you haven't started the lite-server. The DNS tests will be skipped if
 the underlying IPA installation doesn't configure DNS, etc.

+To just execute fast unittest and code linters, use the fastcheck target.
+Fast tests only execute a subset of the test suite that does not depend on
+an initialized API and server instance. Fast linting just verifies modified
+files / lines.
+
+% make fastcheck
+
+
 API.txt
 -------
 The purpose of the file API.txt is to prevent accidental API changes. The
--- a/Contributors.txt
+++ b/Contributors.txt
@@ -4,91 +4,233 @@ The following people have contributed to the FreeIPA project.
 (Listed in alphabetical order within category)

 Developers:
-	Timo Aaltonen
-	Gabe Alford
-	Jr Aquino
-	Tomáš Babej
-	Martin Babinsky
-	Kyle Baker
-	Martin Bašti
-	Sylvain Baubeau
-	Alexander Bokovoy
-	Thierry Bordaz
-	Sumit Bose
-	François Cami
-	Xiao-Long Chen
-	Jan Cholasta
-	Yuri Chornoivan
-	Brian Cook
-	Rob Crittenden
-	Frank Cusack
-	Nalin Dahyabhai
-	Don Davis
-	John Dennis
-	Jason Gerard DeRose
-	Günther Deschner
-	Endi Sukma Dewata
-	Lenka Doudova
-	Benjamin Drung
-	Drew Erny
-	Oleg Fayans
-	Stephen Gallagher
-	Ondřej Hamada
-	Nick Hatch
-	Christian Heimes
-	Jakub Hrozek
+	007hacky007
+	Abhijeet
 	Abhijeet Kasurde
-	Nathan Kinder
-	Krzysztof Klimonda
-	Nikolai Kondrashov
-	Martin Košek
-	Ludwig Krispenz
-	Ana Krivokapić
-	Milan Kubík
-	Ian Kumlien
-	David Kupka
-	Robert Kuska
-	Stanislav Laznicka
-	Ade Lee
-	Karl MacMillan
-	Niranjan Mallapadi
-	Ales 'alich' Marecek
-	Francesco Marella
-	Nathaniel McCallum
-	William Jon McCann
-	Kevin McCarthy
-	Mark McLoughlin
-	Rich Megginson
-	Jim Meyering
 	Adam Misnyovszki
-	Niranjan MR
-	Marko Myllynen
-	Martin Nagy
+	Adam Williamson
+	Adam Young
+	Ade Lee
+	Aleksei Slaikovskii
+	Ales 'alich' Marecek
+	Alex Zeleznikov
+	Alexander Bokovoy
+	Alexander Koksharov
+	Alexander Scheel
+	Alexandra Nikandrova
+	Alexandre Mulatinho
+	Alexey Slaykovsky
+	Alexey Tikhonov
+	Amit Kumar
+	Ana Krivokapić
+	Andika Triwidada
+	Andrew Wnuk
+	Antonio Torres
+	Antonio Torres Moríñigo
+	Anuja More
+	Ariel O. Barria
+	Armando Neto
+	Ben Lipton
+	Benjamin Drung
+	Brian Cook
+	Brian J. Murrell
+	Brian Turek
+	Carl George
+	Carla Martinez
+	Cédric Jeanneret
+	Changmin Teng
+	Chris Kelley
+	Christian Heimes
+	Christian Hermann
+	Daniel Lara Souza
+	David Kreitschmann
+	David Kupka
 	David O'Brien
-	Dmitri Pal
-	Jan Pazdziora
-	W. Michael Petullo
-	Gowrishankar Rajaiyan
-	Lubomír Rintel
-	Lynn Root
-	Pete Rowley
-	Lenka Ryznarova
-	Thorsten Scherf
-	Michael Simacek
-	Lars Sjostrom
-	Lukáš Slebodník
-	Simo Sorce
-	Petr Špaček
+	David Pascual
 	David Spångberg
 	Diane Trout
+	Dinesh Prasanth M K
+	Diogo Nunes
+	Dmitri Pal
+	Don Davis
+	Drew Erny
+	Emilio Herrera
+	Endi Sukma Dewata
+	Erik
+	Erik Belko
+	Fabiano Fidêncio
+	Felipe Volpone
+	Filip Dvorak
+	Filip Skola
+	Florence Blanc-Renaud
+	Francesco Marella
+	Francisco Trivino
+	François Cami
+	Frank Cusack
 	Fraser Tweedale
+	Gabe Alford
+	Ganna Kaihorodova
+	Gaurav Talreja
+	German Parente
+	Gowrishankar Rajaiyan
+	Günther Deschner
+	Hela Basa
+	Ian Kumlien
+	Ian Pilcher
+	Iker Pedrosa
+	Isaac Boukris
+	Jakub Hrozek
+	James Groffen
+	Jan Barta
+	Jan Cholasta
+	Jan Kuparinen
+	Jan Pazdziora
+	Jan Zelený
+	Jarl Gullberg
+	Jason Gerard DeRose
+	Jason Woods
+	Jayesh
+	Jayesh Garg
+	Jeremy Frasier
+	Jérôme Fenal
+	Jerry James
+	Jesse Sandberg
+	jh23453
+	Jim Meyering
+	Jochen Kellner
+	JoeDrane
+	John Dennis
+	John L
+	John Morris
+	Jr Aquino
+	Julian Gethmann
+	Julien Rische
+	Justin Stephenson
+	Kaleemullah Siddiqui
+	Karl MacMillan
+	Kevin McCarthy
+	Krzysztof Klimonda
+	Kyle Baker
+	Lars Sjostrom
+	Lenka Doudova
+	Lenka Ryznarova
+	Lenz Grimmer
+	Lewis Eason
+	Lubomír Rintel
+	Ludwig Krispenz
+	Lukáš Slebodník
+	Lynn Root
+	Marcin Stanclik
+	Mark McLoughlin
+	Mark Reynolds
+	Marko Myllynen
+	Martin Babinsky
+	Martin Bašti
+	Martin Košek
+	Martin Nagy
+	Masahiro Matsuya
+	Matt Rogers
+	Matthew Davis
+	mbhalodi
+	Michael Simacek
+	Michal Polovka
+	Michal Reznik
+	Michal Židek
+	Milan Kubík
+	Miro Hrončok
+	MIZUTA Takeshi
+	Mohammad Rizwan
+	Mohammad Rizwan Yusuf
+	Nalin Dahyabhai
+	Nathan Kinder
+	Nathaniel McCallum
+	ndehadra
+	Nick Hatch
+	Nikhil Dehadrai
+	Nikola Knazekova
+	Nikolai Kondrashov
+	Niranjan Mallapadi
+	Niranjan MR
+	Oğuz Ersen
+	Oleg Fayans
+	Oleg Kozlov
+	Oliver Gutierrez
+	Ondřej Hamada
+	Orion Poplawski
+	Patrice Duc-Jacquet
+	Pavel Březina
+	Pavel Picka
+	Pavel Vomáčka
+	Pavel Zůna
+	Pete Rowley
+	Peter Keresztes Schmidt
+	Peter Lacko
+	Petr Čech
+	Petr Špaček
 	Petr Viktorin
 	Petr Voborník
-	Andrew Wnuk
-	Jason Woods
-	Adam Young
-	Jan Zelený
-	Pavel Zůna
+	Piotr Drąg
+	Rafael Fontenelle
+	Rafael Guterres Jeffman
+	realsobek
+	René Genz
+	Rich Megginson
+	Ricky Tigg
+	Rishabh Dave
+	Rob Crittenden
+	Robbie Harwood
+	Robert Collins
+	Robert Kuska
+	s1341
+	Sam Bristow
+	Sam Morris
+	Scott Poore
+	Sergey Orlov
+	Sergio Oliveira Campos
+	Serhii Tsymbaliuk
+	shanyin
+	Simo Sorce
+	Simon Nussbaum
+	Slava Aseev
+	Spencer E. Olson
+	Stanislav Laznicka
+	Stanislav Levin
+	Stasiek Michalski
+	Stephen Gallagher
+	sudharsanomprakash
+	Sudhir Menon
+	Sumedh Sidhaye
+	sumenon
+	Sumit Bose
+	Sylvain Baubeau
+	Takeshi MIZUTA
+	Temuri Doghonadze
+	Theodor van Nahl
+	Thierry Bordaz
+	Thomas Woerner
+	Thorsten Scherf
+	Tibor Dudlák
+	Timo Aaltonen
+	Todd Zullinger
+	Tomáš Babej
+	Tomas Halman
+	Tomáš Křížek
+	Troy Dawson
+	Varun Mylaraiah
+	Viacheslav Sychov
+	Viktor Ashirov
+	Vit Mojzis
+	W. Michael Petullo
+	Weblate
+	Weblate Translation Memory
+	William Brown
+	William Jon McCann
+	Xiao-Long Chen
+	Yuri Chornoivan
+	Zdenek Pytela
+	zdover
+	zoedong
+	김인수

 Documentation:
 	Gabe Alford
@@ -112,15 +254,39 @@ Testing:
 	Yi Zhang

 Translators:
-	Héctor Daniel Cabrera
-	Yuri Chornoivan
-	Teguh DC
-	Piotr Drąg
-	Jérôme Fenal
-	Gundachandru
-	Jake Li
+	A S Alam
+	Abhijeet Kasurde
+	Alex
+	Alexander Bokovoy
+	Andi Chandler
 	Andrew Martynov
+	Brian Curtich
+	David Kreitschmann
+	dominique
+	Emilio Herrera
+	Gundachandru
+	Héctor Daniel Cabrera
+	Jake Li
+	Jérôme Fenal
+	Josef Hruška
+	Manuela Silva
+	Marco Aurélio Krause
+	Martin Bašti
+	Martin Kosek
+	Martin Liu
+	Olesya Gerasimenko
+	Omar Berroterán S.
+	Paul Ritter
+	Pavel Borecki
+	Pavel Vomacka
+	Piotr Drąg
+	Robert Antoni Buj Gelonch
 	Sankarshan Mukhopadhyay
+	Teguh DC
+	Tomas Babej
+	Yuri Chornoivan
+	Zdenek
+	zhenglei

 Wiki, Solution and Idea Contributors:
 	James Hogarth
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,2 +0,0 @@
-include COPYING TODO lite-server.py
-include tests/*/*.py
--- a/306
+++ b/306
@@ -1,306 +0,0 @@
-# IPA build system cannot cope with parallel build; disable parallel build
-.NOTPARALLEL:
-
-include VERSION
-
-SUBDIRS=asn1 daemons install ipapython ipalib
-CLIENTDIRS=ipapython client asn1
-CLIENTPYDIRS=ipaclient ipaplatform
-
-PRJ_PREFIX=freeipa
-
-RPMBUILD ?= $(PWD)/rpmbuild
-TARGET ?= master
-
-SUPPORTED_PLATFORM ?= fedora
-
-IPA_NUM_VERSION ?= $(shell printf %d%02d%02d $(IPA_VERSION_MAJOR) $(IPA_VERSION_MINOR) $(IPA_VERSION_RELEASE))
-
-# After updating the version in VERSION you should run the version-update
-# target.
-
-ifeq ($(IPA_VERSION_IS_GIT_SNAPSHOT),"yes")
-DATESTR:=$(shell date -u +'%Y%m%d%H%M')
-GIT_VERSION:=$(shell git show --pretty=format:"%h" --stat HEAD 2>/dev/null|head -1)
-ifneq ($(GIT_VERSION),)
-IPA_VERSION=$(IPA_VERSION_MAJOR).$(IPA_VERSION_MINOR).$(IPA_VERSION_RELEASE).$(DATESTR)GIT$(GIT_VERSION)
-endif # in a git tree and git returned a version
-endif # git
-
-ifndef IPA_VERSION
-ifdef IPA_VERSION_ALPHA_RELEASE
-IPA_VERSION=$(IPA_VERSION_MAJOR).$(IPA_VERSION_MINOR).$(IPA_VERSION_RELEASE).alpha$(IPA_VERSION_ALPHA_RELEASE)
-else
-ifdef IPA_VERSION_BETA_RELEASE
-IPA_VERSION=$(IPA_VERSION_MAJOR).$(IPA_VERSION_MINOR).$(IPA_VERSION_RELEASE).beta$(IPA_VERSION_BETA_RELEASE)
-else
-ifdef IPA_VERSION_RC_RELEASE
-IPA_VERSION=$(IPA_VERSION_MAJOR).$(IPA_VERSION_MINOR).$(IPA_VERSION_RELEASE).rc$(IPA_VERSION_RC_RELEASE)
-else
-IPA_VERSION=$(IPA_VERSION_MAJOR).$(IPA_VERSION_MINOR).$(IPA_VERSION_RELEASE)
-endif # rc
-endif # beta
-endif # alpha
-endif # ipa_version
-
-IPA_VENDOR_VERSION=$(IPA_VERSION)$(IPA_VENDOR_VERSION_SUFFIX)
-
-TARBALL_PREFIX=freeipa-$(IPA_VERSION)
-TARBALL=$(TARBALL_PREFIX).tar.gz
-
-IPA_RPM_RELEASE=$(shell cat RELEASE)
-
-LIBDIR ?= /usr/lib
-
-DEVELOPER_MODE ?= 0
-ifneq ($(DEVELOPER_MODE),0)
-LINT_IGNORE_FAIL=true
-else
-LINT_IGNORE_FAIL=false
-endif
-
-PYTHON ?= $(shell rpm -E %__python || echo /usr/bin/python2)
-
-CFLAGS := -g -O2 -Wall -Wextra -Wformat-security -Wno-unused-parameter -Wno-sign-compare -Wno-missing-field-initializers $(CFLAGS)
-export CFLAGS
-
-# Uncomment to increase Java stack size for Web UI build in case it fails
-# because of stack overflow exception. Default should be OK for most platforms.
-#JAVA_STACK_SIZE ?= 8m
-#export JAVA_STACK_SIZE
-
-all: bootstrap-autogen server tests
-	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) $@) || exit 1; \
-	done
-
-client: client-autogen
-	@for subdir in $(CLIENTDIRS); do \
-		(cd $$subdir && $(MAKE) all) || exit 1; \
-	done
-	@for subdir in $(CLIENTPYDIRS); do \
-		(cd $$subdir && $(PYTHON) setup.py build); \
-	done
-
-check: bootstrap-autogen server tests
-	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) check) || exit 1; \
-	done
-
-bootstrap-autogen: version-update client-autogen
-	@echo "Building IPA $(IPA_VERSION)"
-	cd asn1; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-	cd daemons; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR) --with-openldap; fi
-	cd install; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-
-client-autogen: version-update
-	cd asn1; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-	cd client; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-	cd install; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-
-tests-man-autogen: version-update
-	cd ipatests/man; if [ ! -e Makefile ]; then ../../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
-
-install: all server-install tests-install client-install
-	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) $@) || exit 1; \
-	done
-
-client-install: client client-dirs
-	@for subdir in $(CLIENTDIRS); do \
-		(cd $$subdir && $(MAKE) install) || exit 1; \
-	done
-	cd install/po && $(MAKE) install || exit 1;
-	@for subdir in $(CLIENTPYDIRS); do \
-		if [ "$(DESTDIR)" = "" ]; then \
-			(cd $$subdir && $(PYTHON) setup.py install); \
-		else \
-			(cd $$subdir && $(PYTHON) setup.py install --root $(DESTDIR)); \
-		fi \
-	done
-
-client-dirs:
-	@if [ "$(DESTDIR)" != "" ] ; then \
-		mkdir -p $(DESTDIR)/etc/ipa ; \
-		mkdir -p $(DESTDIR)/var/lib/ipa-client/sysrestore ; \
-	else \
-		echo "DESTDIR was not set, please create /etc/ipa and /var/lib/ipa-client/sysrestore" ; \
-		echo "Without those directories ipa-client-install will fail" ; \
-	fi
-
-lint: bootstrap-autogen
-	# find all python modules and executable python files outside modules for pylint check
-	FILES=`find . \
-		-type d -exec test -e '{}/__init__.py' \; -print -prune -o \
-		-name \*.py -print -o \
-		-type f \! -path '*/.*' \! -name '*~' -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
-	echo "Pylint is running, please wait ..."; \
-	PYTHONPATH=. pylint --rcfile=pylintrc $(PYLINTFLAGS) $$FILES || $(LINT_IGNORE_FAIL)
-	$(MAKE) -C install/po validate-src-strings || $(LINT_IGNORE_FAIL)
-
-
-test:
-	./make-test
-
-release-update:
-	if [ ! -e RELEASE ]; then echo 0 > RELEASE; fi
-
-version-update: release-update
-	sed -e s/__VERSION__/$(IPA_VERSION)/ -e s/__RELEASE__/$(IPA_RPM_RELEASE)/ \
-		freeipa.spec.in > freeipa.spec
-	sed -e s/__VERSION__/$(IPA_VERSION)/ version.m4.in \
-		> version.m4
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipapython/setup.py.in \
-		> ipapython/setup.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipaplatform/setup.py.in \
-		> ipaplatform/setup.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipalib/setup.py.in \
-		> ipalib/setup.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipapython/version.py.in \
-		> ipapython/version.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipatests/setup.py.in \
-		> ipatests/setup.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ ipaclient/setup.py.in \
-		> ipaclient/setup.py
-	sed -e s/__NUM_VERSION__/$(IPA_NUM_VERSION)/ install/ui/src/libs/loader.js.in \
-		> install/ui/src/libs/loader.js
-	perl -pi -e "s:__API_VERSION__:$(IPA_API_VERSION_MAJOR).$(IPA_API_VERSION_MINOR):" install/ui/src/libs/loader.js
-	perl -pi -e "s:__NUM_VERSION__:$(IPA_NUM_VERSION):" ipapython/version.py
-	perl -pi -e "s:__VENDOR_VERSION__:$(IPA_VENDOR_VERSION):" ipapython/version.py
-	perl -pi -e "s:__API_VERSION__:$(IPA_API_VERSION_MAJOR).$(IPA_API_VERSION_MINOR):" ipapython/version.py
-	touch -r ipapython/version.py.in ipapython/version.py
-	sed -e s/__VERSION__/$(IPA_VERSION)/ daemons/ipa-version.h.in \
-		> daemons/ipa-version.h
-	perl -pi -e "s:__NUM_VERSION__:$(IPA_NUM_VERSION):" daemons/ipa-version.h
-	perl -pi -e "s:__DATA_VERSION__:$(IPA_DATA_VERSION):" daemons/ipa-version.h
-
-	sed -e s/__VERSION__/$(IPA_VERSION)/ client/version.m4.in \
-		> client/version.m4
-
-	if [ "$(SUPPORTED_PLATFORM)" != "" ]; then \
-		sed -e s/__PLATFORM__/$(SUPPORTED_PLATFORM)/ \
-			ipaplatform/__init__.py.in > ipaplatform/__init__.py; \
-		rm -f ipaplatform/paths.py ipaplatform/services.py ipaplatform/tasks.py ipaplatform/constants.py; \
-		ln -s $(SUPPORTED_PLATFORM)/paths.py ipaplatform/paths.py; \
-		ln -s $(SUPPORTED_PLATFORM)/services.py ipaplatform/services.py; \
-		ln -s $(SUPPORTED_PLATFORM)/tasks.py ipaplatform/tasks.py; \
-		ln -s $(SUPPORTED_PLATFORM)/constants.py ipaplatform/constants.py; \
-	fi
-
-	if [ "$(SKIP_API_VERSION_CHECK)" != "yes" ]; then \
-		./makeapi --validate; \
-		./makeaci --validate; \
-	fi
-
-server: version-update
-	$(PYTHON) setup.py build
-	cd ipaplatform && $(PYTHON) setup.py build
-
-server-install: server
-	if [ "$(DESTDIR)" = "" ]; then \
-		$(PYTHON) setup.py install; \
-		(cd ipaplatform && $(PYTHON) setup.py install); \
-	else \
-		$(PYTHON) setup.py install --root $(DESTDIR); \
-		(cd ipaplatform && $(PYTHON) setup.py install --root $(DESTDIR)); \
-	fi
-
-tests: version-update tests-man-autogen
-	cd ipatests; $(PYTHON) setup.py build
-	cd ipatests/man && $(MAKE) all
-
-tests-install: tests
-	if [ "$(DESTDIR)" = "" ]; then \
-		cd ipatests; $(PYTHON) setup.py install; \
-	else \
-		cd ipatests; $(PYTHON) setup.py install --root $(DESTDIR); \
-	fi
-	cd ipatests/man && $(MAKE) install
-
-archive:
-	-mkdir -p dist
-	git archive --format=tar --prefix=ipa/ $(TARGET) | (cd dist && tar xf -)
-
-local-archive:
-	-mkdir -p dist/$(TARBALL_PREFIX)
-	rsync -a --exclude=dist --exclude=.git --exclude=/build --exclude=rpmbuild . dist/$(TARBALL_PREFIX)
-
-archive-cleanup:
-	rm -fr dist/freeipa
-
-tarballs: local-archive
-	-mkdir -p dist/sources
-	# tar up clean sources
-	cd dist/$(TARBALL_PREFIX)/client; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
-	cd dist/$(TARBALL_PREFIX)/daemons; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
-	cd dist/$(TARBALL_PREFIX)/install; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
-	cd dist; tar cfz sources/$(TARBALL) $(TARBALL_PREFIX)
-	rm -rf dist/$(TARBALL_PREFIX)
-
-rpmroot:
-	rm -rf $(RPMBUILD)
-	mkdir -p $(RPMBUILD)/BUILD
-	mkdir -p $(RPMBUILD)/RPMS
-	mkdir -p $(RPMBUILD)/SOURCES
-	mkdir -p $(RPMBUILD)/SPECS
-	mkdir -p $(RPMBUILD)/SRPMS
-
-rpmdistdir:
-	mkdir -p dist/rpms
-	mkdir -p dist/srpms
-
-rpms: rpmroot rpmdistdir version-update lint tarballs
-	cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/.
-	rpmbuild --define "_topdir $(RPMBUILD)" -ba freeipa.spec
-	cp $(RPMBUILD)/RPMS/*/$(PRJ_PREFIX)-*-$(IPA_VERSION)-*.rpm dist/rpms/
-	cp $(RPMBUILD)/RPMS/*/python?-ipa*-$(IPA_VERSION)-*.rpm dist/rpms/
-	cp $(RPMBUILD)/SRPMS/$(PRJ_PREFIX)-$(IPA_VERSION)-*.src.rpm dist/srpms/
-	rm -rf $(RPMBUILD)
-
-client-rpms: rpmroot rpmdistdir version-update lint tarballs
-	cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/.
-	rpmbuild --define "_topdir $(RPMBUILD)" --define "ONLY_CLIENT 1" -ba freeipa.spec
-	cp $(RPMBUILD)/RPMS/*/$(PRJ_PREFIX)-*-$(IPA_VERSION)-*.rpm dist/rpms/
-	cp $(RPMBUILD)/RPMS/*/python?-ipa*-$(IPA_VERSION)-*.rpm dist/rpms/
-	cp $(RPMBUILD)/SRPMS/$(PRJ_PREFIX)-$(IPA_VERSION)-*.src.rpm dist/srpms/
-	rm -rf $(RPMBUILD)
-
-srpms: rpmroot rpmdistdir version-update lint tarballs
-	cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/.
-	rpmbuild --define "_topdir $(RPMBUILD)" -bs freeipa.spec
-	cp $(RPMBUILD)/SRPMS/$(PRJ_PREFIX)-$(IPA_VERSION)-*.src.rpm dist/srpms/
-	rm -rf $(RPMBUILD)
-
-
-repodata:
-	-createrepo -p dist
-
-dist: version-update archive tarballs archive-cleanup rpms repodata
-
-local-dist: bootstrap-autogen clean local-archive tarballs archive-cleanup rpms
-
-
-clean: version-update
-	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) $@) || exit 1; \
-	done
-	rm -f *~
-
-distclean: version-update
-	touch daemons/NEWS daemons/README daemons/AUTHORS daemons/ChangeLog
-	touch install/NEWS install/README install/AUTHORS install/ChangeLog
-	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) $@) || exit 1; \
-	done
-	rm -fr $(RPMBUILD) dist build
-	rm -f daemons/NEWS daemons/README daemons/AUTHORS daemons/ChangeLog
-	rm -f install/NEWS install/README install/AUTHORS install/ChangeLog
-
-maintainer-clean: clean
-	rm -fr $(RPMBUILD) dist build
-	cd daemons && $(MAKE) maintainer-clean
-	cd install && $(MAKE) maintainer-clean
-	cd client && $(MAKE) maintainer-clean
-	cd ipapython && $(MAKE) maintainer-clean
-	rm -f version.m4
-	rm -f freeipa.spec
--- a/Makefile.am
+++ b/Makefile.am
@@ -0,0 +1,540 @@
+NULL =
+
+ACLOCAL_AMFLAGS = -I m4
+
+if ENABLE_SERVER
+    IPASERVER_SUBDIRS = ipaserver ipasphinx
+    SERVER_SUBDIRS = daemons init install
+endif
+
+if WITH_IPATESTS
+    IPATESTS_SUBDIRS = ipatests
+endif
+
+IPACLIENT_SUBDIRS = ipaclient ipalib ipaplatform ipapython
+PYTHON_SUBDIRS = $(IPACLIENT_SUBDIRS) $(IPATESTS_SUBDIRS) $(IPASERVER_SUBDIRS)
+PYTHON_SCRIPT_SUBDIRS = \
+        $(top_builddir) \
+        $(top_builddir)/client \
+        $(top_builddir)/daemons/dnssec \
+        $(top_builddir)/install/certmonger \
+        $(top_builddir)/install/oddjob \
+        $(top_builddir)/install/restart_scripts \
+        $(top_builddir)/install/tools \
+        $(NULL)
+
+PRCI_DEFINITIONS_DIR = $(top_srcdir)/ipatests/prci_definitions
+
+AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure
+
+IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests
+SUBDIRS = \
+        asn1 \
+        util \
+        client \
+        contrib \
+        po \
+        pypi \
+        selinux \
+        selinux/nfast \
+        selinux/luna \
+        $(PYTHON_SUBDIRS) \
+        $(SERVER_SUBDIRS) \
+        $(NULL)
+
+GENERATED_PYTHON_FILES = \
+	$(top_builddir)/ipaplatform/override.py \
+	$(top_builddir)/ipapython/version.py \
+	$(top_builddir)/makeaci \
+	$(top_builddir)/makeapi \
+	$(NULL)
+
+MOSTLYCLEANFILES = ipasetup.pyc ipasetup.pyo \
+		   pylint_plugins.pyc pylint_plugins.pyo
+
+# user-facing scripts
+nodist_bin_SCRIPTS = ipa
+
+# files required for build but not installed
+nodist_noinst_SCRIPTS = \
+	makeapi \
+	makeaci \
+	$(NULL)
+
+dist_noinst_SCRIPTS = \
+	make-doc \
+	make-test \
+	pylint_plugins.py \
+	$(NULL)
+
+# templates
+dist_noinst_DATA = \
+	ipa.in		\
+	makeaci.in	\
+	makeapi.in	\
+	$(NULL)
+
+ipasetup.py: ipasetup.py.in $(CONFIG_STATUS)
+	$(AM_V_GEN)sed						\
+		-e 's|@VERSION[@]|$(VERSION)|g'			\
+		$< > $@
+
+.wheelconstraints: .wheelconstraints.in $(CONFIG_STATUS)
+	$(AM_V_GEN)sed						\
+		-e 's|@VERSION[@]|$(VERSION)|g'			\
+		$< > $@
+
+EXTRA_DIST = .mailmap \
+	     ACI.txt \
+	     API.txt \
+	     BUILD.txt \
+	     config.rpath \
+	     README.md \
+	     Contributors.txt \
+	     COPYING.openssl \
+	     contrib \
+	     doc \
+	     freeipa.spec.in \
+	     ipasetup.py.in \
+	     pylintrc \
+	     .wheelconstraints.in
+
+clean-local:
+	rm -rf "$(RPMBUILD)"
+	rm -rf "$(top_builddir)/dist"
+	rm -rf "$(top_builddir)/.tox"
+	rm -rf "$(top_srcdir)/__pycache__"
+	rm -f "$(top_builddir)"/$(PACKAGE)-*.tar.gz
+	rm -rf "$(top_srcdir)/cov-int"
+	rm -f "$(top_srcdir)/freeipa.tgz"
+	$(MAKE) -C "$(top_srcdir)/doc" distclean
+
+# convenience targets for RPM build
+.PHONY: rpmroot rpmdistdir version-update _dist-version-bakein _rpms-prep \
+	rpms _rpms-body srpms _srpms-body
+RPMBUILD ?= $(abs_builddir)/rpmbuild
+TARBALL = $(PACKAGE)-$(VERSION).tar.gz
+
+freeipa.spec: freeipa.spec.in $(top_builddir)/$(CONFIG_STATUS)
+	$(AM_V_GEN)sed						\
+		-e 's|@VERSION[@]|$(VERSION)|g'			\
+		-e 's|@VENDOR_SUFFIX[@]|$(VENDOR_SUFFIX)|g'	\
+		$< > $@
+
+rpmroot:
+	mkdir -p $(RPMBUILD)/BUILD
+	mkdir -p $(RPMBUILD)/RPMS
+	mkdir -p $(RPMBUILD)/SOURCES
+	mkdir -p $(RPMBUILD)/SPECS
+	mkdir -p $(RPMBUILD)/SRPMS
+
+rpmdistdir:
+	mkdir -p $(top_builddir)/dist/rpms
+	mkdir -p $(top_builddir)/dist/srpms
+
+# force IPA version re-generation (useful for build from Git)
+version-update:
+	touch $(srcdir)/VERSION.m4
+
+# convert Git snapshot version to static value usable from inside of tarball
+_dist-version-bakein:
+if !IS_GIT_SNAPSHOT
+	@echo "version-bakein target requires IPA_VERSION_IS_GIT_SNAPSHOT=yes"
+	exit 1
+endif !IS_GIT_SNAPSHOT
+	chmod u+w $(top_distdir)/VERSION.m4
+	$(SED) -e 's/^define(IPA_VERSION_IS_GIT_SNAPSHOT,.*)/define(IPA_VERSION_IS_GIT_SNAPSHOT, no)/' -i $(top_distdir)/VERSION.m4
+	$(SED) -e 's/^define(IPA_VERSION_PRE_RELEASE,\(.*\))/define(IPA_VERSION_PRE_RELEASE,\1.$(GIT_VERSION))/' -i $(top_distdir)/VERSION.m4
+	cd $(top_distdir) && autoconf  # re-generate configure from VERSION.m4
+
+if IS_GIT_SNAPSHOT
+VERSION_UPDATE_TARGET = version-update
+VERSION_BAKEIN_TARGET = _dist-version-bakein
+endif IS_GIT_SNAPSHOT
+
+# HACK to support IPA_VERSION_IS_GIT_SNAPSHOT:
+# touch VERSION.m4 will reexecute configure and change $(VERSION) used by dist
+# but it will not change $(VERSION) in already running target rpms.
+# We need to record new $(TARBALL) value used by dist for furher use
+# in rpms target.
+dist-hook: $(VERSION_BAKEIN_TARGET)
+	echo "$(TARBALL)" > $(top_builddir)/.tarball_name
+	echo "$(VERSION)" > $(top_builddir)/.version
+
+_rpms-prep: dist-gzip rpmroot rpmdistdir freeipa.spec
+	cp $(top_builddir)/$$(cat $(top_builddir)/.tarball_name) $(RPMBUILD)/SOURCES/
+	rm -f $(top_builddir)/.tarball_name
+
+rpms: $(VERSION_UPDATE_TARGET)
+	$(MAKE) _rpms-body
+
+_rpms-body: _rpms-prep
+	rpmbuild --define "_topdir $(RPMBUILD)" -ba $(top_builddir)/$(PACKAGE).spec  $(RPMBUILD_OPTS)
+	cp $(RPMBUILD)/RPMS/*/*$$(cat $(top_builddir)/.version)*.rpm $(top_builddir)/dist/rpms/
+	cp $(RPMBUILD)/SRPMS/*$$(cat $(top_builddir)/.version)*.src.rpm $(top_builddir)/dist/srpms/
+	rm -f rm -f $(top_builddir)/.version
+
+srpms: $(VERSION_UPDATE_TARGET)
+	$(MAKE) _srpms-body
+
+_srpms-body: _rpms-prep
+	rpmbuild --define "_topdir $(RPMBUILD)" -bs $(top_builddir)/$(PACKAGE).spec $(RPMBUILD_OPTS)
+	cp $(RPMBUILD)/SRPMS/*$$(cat $(top_builddir)/.version)*.src.rpm $(top_builddir)/dist/srpms/
+	rm -f rm -f $(top_builddir)/.version
+
+.PHONY: lite-server
+lite-server: $(GENERATED_PYTHON_FILES)
+	+$(MAKE) -C $(top_builddir)/install/ui
+	PYTHONPATH=$(top_srcdir) $(PYTHON) -bb \
+	    contrib/lite-server.py $(LITESERVER_ARGS)
+
+.PHONY: lint
+if WITH_POLINT
+POLINT_TARGET = polint
+endif WITH_POLINT
+if WITH_PYLINT
+PYLINT_TARGET = pylint
+endif WITH_PYLINT
+if WITH_JSLINT
+JSLINT_TARGET = jslint
+endif WITH_JSLINT
+if WITH_RPMLINT
+RPMLINT_TARGET = rpmlint
+endif  # WITH_RPMLINT
+lint: acilint apilint $(POLINT_TARGET) $(PYLINT_TARGET) $(JSLINT_TARGET) $(RPMLINT_TARGET) yamllint
+
+.PHONY: devcheck
+devcheck: all
+if ! WITH_POLINT
+	@echo "ERROR: polint not available"; exit 1
+endif
+if ! WITH_PYLINT
+	@echo "ERROR: pylint not available"; exit 1
+endif
+if ! WITH_JSLINT
+	@echo "ERROR: jslint not available"; exit 1
+endif
+	@ # just tests, aci, api and pylint on Python 3
+	PATH=$(abspath ipatests):$$PATH PYTHONPATH=$(abspath $(top_srcdir)) \
+	    $(PYTHON) ipatests/ipa-run-tests --ipaclient-unittests
+	$(MAKE) $(AM_MAKEFLAGS) acilint apilint polint pylint jslint $(RPMLINT_TARGET) yamllint check
+	@echo "All tests passed."
+
+.PHONY: fastcheck fasttest fastlint fastcodestyle
+fastcheck:
+	@$(MAKE) -j1 $(AM_MAKEFLAGS) fastlint $(RPMLINT_TARGET) yamllint fasttest apilint acilint
+
+fasttest: $(GENERATED_PYTHON_FILES) ipasetup.py
+	@ # --ignore doubles speed of total test run compared to pytest.skip()
+	@ # on module.
+	PATH=$(abspath ipatests):$$PATH PYTHONPATH=$(abspath $(top_srcdir)) \
+	    $(PYTHON) ipatests/ipa-run-tests \
+	    --skip-ipaapi \
+	    --ignore $(abspath $(top_srcdir))/ipatests/test_integration \
+	    --ignore $(abspath $(top_srcdir))/ipatests/test_xmlrpc
+
+fastcodestyle: $(GENERATED_PYTHON_FILES) ipasetup.py
+	@ # keep Python files in sync to pycodestyle configuration in
+	@ # tox.ini(filename=)
+	@echo "Fast code style checking with $(PYTHON) from branch '$(GIT_BRANCH)'"
+
+	@MERGEBASE=$$(git merge-base --fork-point $(GIT_BRANCH)); \
+	PYFILES=$$(git diff --name-only --diff-filter=d $${MERGEBASE} \
+	    | grep -E '\.py$$' ); \
+	INFILES=$$(git diff --name-only --diff-filter=d $${MERGEBASE} \
+	    | grep -E '\.in$$' \
+	    | xargs -n1 file 2>/dev/null | grep Python \
+	    | cut -d':' -f1; ); \
+	if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
+	    FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
+	elif [ -n "$${PYFILES}" ]; then \
+	    FILES="$${PYFILES}" ; \
+	else \
+	    FILES="$${INFILES}" ; \
+	fi ; \
+	if [ -n "$${FILES}" ]; then \
+	    echo -e "Fast code style checking for files:\n$${FILES}\n"; \
+	    echo "pycodestyle"; \
+	    echo "-----------"; \
+	    git diff -U0 $${MERGEBASE} -- $${FILES} | \
+	        $(PYTHON) -m pycodestyle -v --diff || exit $$?; \
+	else \
+	    echo "No modified Python files found"; \
+	fi
+
+fastlint: $(GENERATED_PYTHON_FILES) ipasetup.py fastcodestyle acilint apilint
+if ! WITH_PYLINT
+	@echo "ERROR: pylint not available"; exit 1
+endif
+	@echo "Fast linting with $(PYTHON) from branch '$(GIT_BRANCH)'"
+
+	@MERGEBASE=$$(git merge-base --fork-point $(GIT_BRANCH)); \
+	PYFILES=$$(git diff --name-only --diff-filter=d $${MERGEBASE} \
+	    | grep -E '\.py$$' ); \
+	INFILES=$$(git diff --name-only --diff-filter=d $${MERGEBASE} \
+	    | grep -E '\.in$$' \
+	    | xargs -n1 file 2>/dev/null | grep Python \
+	    | cut -d':' -f1; ); \
+	if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
+	    FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
+	elif [ -n "$${PYFILES}" ]; then \
+	    FILES="$${PYFILES}" ; \
+	else \
+	    FILES="$${INFILES}" ; \
+	fi ; \
+	if [ -n "$${FILES}" ]; then \
+	    echo -e "Fast linting files:\n$${FILES}\n"; \
+	    echo -e "\npylint"; \
+	    echo "------"; \
+	    $(PYTHON) -m pylint --version; \
+	    PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON) -m pylint \
+	        --rcfile=$(top_srcdir)/pylintrc \
+	        --load-plugins pylint_plugins \
+	        $${FILES} || exit $$?; \
+	else \
+	    echo "No modified Python files found"; \
+	fi
+
+
+.PHONY: $(top_builddir)/ipaplatform/override.py
+$(top_builddir)/ipaplatform/override.py:
+	(cd $(top_builddir)/ipaplatform && make override.py)
+
+.PHONY: $(top_builddir)/ipapython/version.py
+$(top_builddir)/ipapython/version.py:
+	(cd $(top_builddir)/ipapython && make version.py)
+
+.PHONY: acilint
+acilint: $(GENERATED_PYTHON_FILES)
+	cd $(srcdir); \
+	PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON) ./makeaci --validate
+
+.PHONY: aci
+aci: $(GENERATED_PYTHON_FILES)
+	cd $(srcdir); \
+	PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON) ./makeaci
+
+.PHONY: apilint
+apilint: $(GENERATED_PYTHON_FILES)
+	cd $(srcdir); \
+	PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON) ./makeapi --validate
+
+.PHONY: api
+api: $(GENERATED_PYTHON_FILES)
+	cd $(srcdir); \
+	PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON) ./makeapi
+
+.PHONY: polint
+polint:
+	$(MAKE) -C $(srcdir)/po PYTHON=$(PYTHON) \
+	    validate-src-strings validate-po test-gettext
+
+.PHONY: rpmlint
+if WITH_RPMLINT
+rpmlint: freeipa.spec
+	@RPMLINT@ ./$<
+endif  # WITH_RPMLINT
+
+# Try to load yml/yaml files via safe_load, which recognizes only standard
+# YAML tags and cannot construct an arbitrary Python object.
+# There are Jinja yaml templates, which differ from reqular ones. These
+# files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise
+# safe_load fails.
+# Also check PRCI definitions yaml files jobs format and content with
+# prci_checker script
+.PHONY: yamllint
+yamllint:
+	YAML_TEMPLATE_FILES="\
+		$(top_srcdir)/ipatests/azure/templates/ipa-test-config-template.yaml \
+	"; \
+	echo "jinja template files:"; \
+	for YAML in $${YAML_TEMPLATE_FILES}; do \
+		echo $${YAML}; \
+		$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" >/dev/null 2>&1 \
+		&& { echo Unexpected PASS of parsing yaml: $${YAML}. This file is a regular yaml.; exit 1; }; \
+	done; \
+	YAML_FILES=`find $(top_srcdir) \
+		\( -name '*.yaml' -o \
+		-name '*.yml' \) \
+		$$(printf '! -path %s ' $${YAML_TEMPLATE_FILES})`; \
+	echo -e "\nlint yaml files"; \
+	echo "-----------"; \
+	for YAML in $${YAML_FILES}; do \
+		echo $${YAML}; \
+		$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \
+	done; \
+	echo -e "\nCheck PRCI definitions";
+	@echo "-----------"
+	$(PYTHON) $(PRCI_DEFINITIONS_DIR)/prci_checker.py -d $(PRCI_DEFINITIONS_DIR) -s $(PRCI_DEFINITIONS_DIR)/prci_jobs_spec.yaml;
+	@echo "-----------"
+
+# Build & lint documentation.
+#
+.PHONY: doclint
+doclint:
+	@echo -e "\nBuild and lint documentation"
+	@echo "-----------"
+	$(MAKE) -C $(top_srcdir)/doc/ lint
+	@echo "-----------"
+
+# Run pylint for all python files. Finds all python files/packages, skips
+# folders rpmbuild, freeipa-* and dist. Skip (match, but don't print) .*,
+# *.in, *~. Finally print all python files, including scripts that do not
+# have python extension.
+
+.PHONY: pylint
+
+if WITH_PYLINT
+pylint: $(GENERATED_PYTHON_FILES) ipasetup.py python_scripts
+	FILES=`find $(top_srcdir) \
+		-type d -exec test -e '{}/__init__.py' \; -print -prune -o \
+		-path './rpmbuild' -prune -o \
+		-path './freeipa-*' -prune -o \
+		-path './dist' -prune -o \
+		-path './pypi' -prune -o \
+		-path './.tox' -prune -o \
+		-name '.*' -o \
+		-name '*.in' -o \
+		-name '*~' -o \
+		-name '*.py' -print -o \
+		-type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
+	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)\n$(PRCI_DEFINITIONS_DIR)"`; \
+	echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \
+	$(PYTHON) -m pylint --version; \
+	PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \
+		--rcfile=$(top_srcdir)/pylintrc \
+		--load-plugins pylint_plugins \
+		$${FILES}
+endif  # WITH_PYLINT
+
+.PHONY: jslint jslint-ui jslint-ui-test jslint-html \
+	$(top_builddir)/install/ui/src/libs/loader.js
+
+if WITH_JSLINT
+jslint: jslint-ui jslint-ui-test jslint-html
+
+$(top_builddir)/install/ui/src/libs/loader.js:
+	(cd $(top_builddir)/install/ui/src/libs && make loader.js)
+
+# create temporary symlinks to allow jslint to find libs/loader.js
+jslint-ui: $(top_builddir)/install/ui/src/libs/loader.js
+	cd $(top_srcdir)/install/ui;				\
+	jsl -nologo -nosummary -nofilelisting -conf jsl.conf;
+
+jslint-ui-test:
+	cd $(top_srcdir)/install/ui/test;			\
+	jsl -nologo -nosummary -nofilelisting -conf jsl.conf
+
+jslint-html:
+	cd $(top_srcdir)/install/html; 				\
+	jsl -nologo -nosummary -nofilelisting -conf jsl.conf
+endif  # WITH_JSLINT
+
+.PHONY: bdist_wheel wheel_bundle wheel_placeholder pypi_packages
+WHEELDISTDIR = $(top_builddir)/dist/wheels
+WHEELPYPIDIR = $(top_builddir)/dist/pypi
+WHEELBUNDLEDIR = $(top_builddir)/dist/bundle
+
+@MK_IFEQ@ ($(IPA_SERVER_WHEELS),1)
+    IPA_WHEEL_PACKAGES @MK_ASSIGN@ $(IPACLIENT_SUBDIRS) ipaplatform ipaserver
+    IPA_OMIT_INSTALL @MK_ASSIGN@ 0
+@MK_ELSE@
+    IPA_WHEEL_PACKAGES @MK_ASSIGN@ $(IPACLIENT_SUBDIRS)
+    IPA_OMIT_INSTALL @MK_ASSIGN@ 1
+@MK_ENDIF@
+
+# additional wheels for bundle, e.g. IPA_EXTRA_WHEELS="ipatests[webui] pylint"
+IPA_EXTRA_WHEELS=
+
+$(WHEELDISTDIR):
+	mkdir -p $(WHEELDISTDIR)
+
+$(WHEELBUNDLEDIR):
+	mkdir -p $(WHEELBUNDLEDIR)
+
+$(WHEELPYPIDIR):
+	mkdir -p $(WHEELPYPIDIR)
+
+bdist_wheel: $(WHEELDISTDIR)
+	rm -f $(foreach item,$(IPA_WHEEL_PACKAGES) ipatests,$(WHEELDISTDIR)/$(item)-*.whl)
+	export IPA_OMIT_INSTALL=$(IPA_OMIT_INSTALL); \
+	for dir in $(IPA_WHEEL_PACKAGES) ipatests; do \
+	    $(MAKE) $(AM_MAKEFLAGS) -C $${dir} $@ || exit 1; \
+	done
+
+wheel_bundle: $(WHEELBUNDLEDIR) bdist_wheel .wheelconstraints
+	rm -f $(foreach item,$(IPA_WHEEL_PACKAGES) ipatests,$(WHEELBUNDLEDIR)/$(item)-*.whl)
+	@# dbus-python sometimes fails when MAKEFLAGS is set to -j2 or higher
+	MAKEFLAGS= $(PYTHON) -m pip wheel \
+	    --disable-pip-version-check \
+	    --constraint .wheelconstraints \
+	    --find-links $(WHEELDISTDIR) \
+	    --find-links $(WHEELBUNDLEDIR) \
+	    --wheel-dir $(WHEELBUNDLEDIR) \
+	    $(IPA_EXTRA_WHEELS) $(IPA_WHEEL_PACKAGES)
+
+pypi_packages: $(WHEELPYPIDIR) .wheelconstraints
+	rm -f $(WHEELPYPIDIR)/*
+	for dir in $(IPACLIENT_SUBDIRS); do \
+	    $(MAKE) $(AM_MAKEFLAGS) \
+	        IPA_OMIT_INSTALL=1 WHEELDISTDIR="$(abspath $(WHEELPYPIDIR))" \
+	        -C $${dir} bdist_wheel || exit 1; \
+	done
+	for dir in $(IPA_PLACEHOLDERS); do \
+	    $(MAKE) $(AM_MAKEFLAGS) \
+	        IPA_OMIT_INSTALL=1 WHEELDISTDIR="$(abspath $(WHEELPYPIDIR))" \
+	        -C $(top_srcdir)/pypi/$${dir} bdist_wheel || exit 1; \
+	done
+	@echo -e "\n\nTo upload packages to PyPI, run:\n"
+	@echo -e "    twine upload $(WHEELPYPIDIR)/*-$(VERSION)-py2.py3-none-any.whl\n"
+
+.PHONY: python_install
+python_install:
+	for dir in $(PYTHON_SUBDIRS); do \
+	    $(MAKE) $(AM_MAKEFLAGS) -C $${dir} install || exit 1; \
+	done
+
+.PHONY: python_scripts
+python_scripts:
+	for dir in $(PYTHON_SCRIPT_SUBDIRS); do \
+	    $(MAKE) $(AM_MAKEFLAGS) -C $${dir} python_scripts_sub || exit 1; \
+	done
+
+.PHONY:
+strip-po:
+	$(MAKE) -C po strip-po
+
+.PHONY: cov-scan
+cov-scan:
+	$(MAKE) clean
+	@# analyse C code with workaround for missing _Float types
+	@# https://stackoverflow.com/questions/50434236/coverity-scan-fails-to-build-stdlib-h-with-gnu-source-defined
+	cov-build --dir cov-int $(MAKE) all \
+	    CFLAGS="-D_Float32=float -D_Float32x=double -D_Float64=double -D_Float64x='long double' -D_Float128='long double'"
+	@# remove build directories and analyse Python
+	rm -rf ipa*/build
+	cov-build --dir cov-int --no-command \
+		$(foreach d,$(PYTHON_SUBDIRS),--fs-capture-search $(d))
+	@# analyze JS files
+	cov-build --dir cov-int --no-command --fs-capture-search install/ui
+	@# compress and upload
+	tar czvf freeipa.tgz cov-int
+	if [ -n "$${COVERITY_SCAN_TOKEN}" ]; then \
+	    curl --progress-bar --output /dev/null \
+	        --form token=$${COVERITY_SCAN_TOKEN} \
+	        --form email=scan@mg.freeipa.org \
+	        --form file=@freeipa.tgz \
+	        --form version="$(VERSION)" \
+	        --form description="FreeIPA" \
+	        "https://scan.coverity.com/builds?project=freeipa%2Ffreeipa"; \
+	fi
+
+PYTHON_SHEBANG = 					\
+	ipa	\
+	makeaci	\
+	makeapi	\
+	$(NULL)
+
+CLEANFILES = $(PYTHON_SHEBANG)
+
+include $(top_srcdir)/Makefile.pythonscripts.am
--- a/Makefile.in
+++ b/Makefile.in
--- a/Makefile.python.am
+++ b/Makefile.python.am
@@ -0,0 +1,71 @@
+pkgname = $(shell basename "$(abs_srcdir)")
+pkgpythondir = $(pythondir)/$(pkgname)
+
+if VERBOSE_MAKE
+VERBOSITY="--verbose"
+else
+VERBOSITY="--quiet"
+endif !VERBOSE_MAKE
+
+# hack to handle back-in-the-hierarchy depedency on ipasetup.py
+.PHONY: $(top_builddir)/ipasetup.py
+$(top_builddir)/ipasetup.py:
+	(cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) ipasetup.py)
+
+all-local: $(top_builddir)/ipasetup.py
+	cd $(srcdir); $(PYTHON) setup.py \
+		$(VERBOSITY) \
+		build \
+		    --build-base "$(abs_builddir)/build"
+
+install-exec-local: $(top_builddir)/ipasetup.py
+	if [ "x$(pkginstall)" != "xfalse" ]; then \
+	    $(PYTHON) $(srcdir)/setup.py \
+		    $(VERBOSITY) \
+		    build \
+		        --build-base "$(abs_builddir)/build" \
+		    install \
+		        --prefix "$(DESTDIR)$(prefix)" \
+		        --single-version-externally-managed \
+		        --record "$(DESTDIR)$(pkgpythondir)/install_files.txt" \
+		        --optimize 1 \
+		        $(PYTHON_INSTALL_EXTRA_OPTIONS); \
+	fi
+
+uninstall-local:
+	if [ -f "$(DESTDIR)$(pkgpythondir)/install_files.txt" ]; then \
+	    cat "$(DESTDIR)$(pkgpythondir)/install_files.txt" | xargs rm -rf ; \
+	fi
+	rm -rf "$(DESTDIR)$(pkgpythondir)"
+
+clean-local: $(top_builddir)/ipasetup.py
+	$(PYTHON) "$(srcdir)/setup.py" \
+	    clean \
+	        --all
+	        --build-base "$(abs_builddir)/build"
+	rm -rf "$(srcdir)/build" "$(srcdir)/dist" "$(srcdir)/MANIFEST"
+	find "$(srcdir)" \
+		-name "*.py[co]" -delete -o	\
+		-name "__pycache__" -delete -o	\
+		-name "*.egg-info" -exec rm -rf {} +
+
+# take list of all Python source files and copy them into distdir
+# SOURCES.txt does not contain directories so we need to create those
+dist-hook: $(top_builddir)/ipasetup.py
+	$(PYTHON) "$(srcdir)/setup.py" egg_info
+	PYTHON_SOURCES=$$(cat "$(srcdir)/$(pkgname).egg-info/SOURCES.txt") || exit $$?;	\
+	for FILEN in $${PYTHON_SOURCES}; 						\
+	do										\
+		if test -x "$(srcdir)/$${FILEN}"; then MODE=755; else MODE=644; fi;	\
+		$(INSTALL) -D -m $${MODE} "$(srcdir)/$${FILEN}" "$(distdir)/$${FILEN}" || exit $$?;	\
+	done
+
+WHEELDISTDIR = $(top_builddir)/dist/wheels
+.PHONY: bdist_wheel
+bdist_wheel: $(top_builddir)/ipasetup.py
+	rm -rf $(WHEELDISTDIR)/$(pkgname)-*.whl
+	$(PYTHON) "$(srcdir)/setup.py" \
+	    build \
+	        --build-base "$(abs_builddir)/build" \
+	    bdist_wheel \
+	        --dist-dir=$(WHEELDISTDIR)
--- a/Makefile.pythonscripts.am
+++ b/Makefile.pythonscripts.am
@@ -0,0 +1,7 @@
+# special handling of Python scripts with auto-generated shebang line
+$(PYTHON_SHEBANG):%: %.in Makefile
+	$(AM_V_GEN)sed -e 's|^#!/usr/bin/python3.*|#!$(PYTHON) -I|g' $< > $@
+	$(AM_V_GEN)chmod +x $@
+
+.PHONY: python_scripts_sub
+python_scripts_sub: $(PYTHON_SHEBANG)
--- a/92
+++ b/92
@@ -1,92 +0,0 @@
-
-                               IPA Server
-
-  Overview
-  --------
-
-  FreeIPA allows Linux administrators to centrally manage identity,
-  authentication and access control aspects of Linux and UNIX systems
-  by providing simple to install and use command line and web based
-  managment tools.
-  FreeIPA is built on top of well known Open Source components and standard
-  protocols with a very strong focus on ease of management and automation
-  of installation and configuration tasks.
-  FreeIPA can seamlessly integrate into an Active Directory environment via
-  cross-realm Kerberos trust or user synchronization.
-
-  Benefits
-  --------
-
-  FreeIPA:
-  * Allows all your users to access all the machines with the same credentials
-    and security settings
-  * Allows users to access personal files transparently from any machine in
-    an authenticated and secure way
-  * Uses an advanced grouping mechanism to restrict network access to services
-    and files only to specific users
-  * Allows central management of security mechanisms like passwords,
-    SSH Public Keys, SUDO rules, Keytabs, Access Control Rules
-  * Enables delegation of selected administrative tasks to other power users
-  * Integrates into Active Directory environments
-
-  Components
-  ----------
-
-  The FreeIPA project provides unified installation and management
-  tools for the following components:
-
-  * LDAP Server - based on the 389 project (LDAP)
-    http://directory.fedoraproject.org/wiki/Main_Page
-
-  * KDC - based on MIT Kerberos implementation
-    http://k5wiki.kerberos.org/wiki/Main_Page
-
-  * PKI based on Dogtag project
-    http://pki.fedoraproject.org/wiki/PKI_Main_Page
-
-  * Samba libraries for Active Directory integration
-    http://www.samba.org/
-
-  * DNS Server based on BIND and the Bind-DynDB-LDAP plugin
-    https://www.isc.org/software/bind
-    https://fedorahosted.org/bind-dyndb-ldap
-
-
-  Project Website
-  ---------------
-
-  Releases, announcements and other information can be found on the IPA
-  server project page at <http://www.freeipa.org/>.
-
-  Documentation
-  -------------
-
-  The most up-to-date documentation can be found at
-  <http://freeipa.org/page/Documentation>.
-
-  Quick Start
-  -----------
-
-  To get started quickly, start here:
-  <http://www.freeipa.org/page/Quick_Start_Guide>
-
-  Licensing
-  ---------
-
-  Please see the file called COPYING.
-
-  Contacts
-  --------
-
-     * If you want to be informed about new code releases, bug fixes,
-       security fixes, general news and information about the IPA server
-       subscribe to the freeipa-announce mailing list at
-       <https://www.redhat.com/mailman/listinfo/freeipa-interest/>.
-
-     * If you have a bug report please submit it at:
-       <https://bugzilla.redhat.com>
-
-     * If you want to participate in actively developing IPA please
-       subscribe to the freeipa-devel mailing list at
-       <https://www.redhat.com/mailman/listinfo/freeipa-devel/> or join
-       us in IRC at irc://irc.freenode.net/freeipa
--- a/README.md
+++ b/README.md
@@ -0,0 +1,79 @@
+# FreeIPA Server
+
+FreeIPA allows Linux administrators to centrally manage identity,
+authentication and access control aspects of Linux and UNIX systems
+by providing simple to install and use command line and web based
+management tools.
+
+FreeIPA is built on top of well known Open Source components and standard
+protocols with a very strong focus on ease of management and automation
+of installation and configuration tasks.
+
+FreeIPA can seamlessly integrate into an Active Directory environment via
+cross-realm Kerberos trust or user synchronization.
+
+## Benefits
+
+FreeIPA:
+
+* Allows all your users to access all the machines with the same credentials
+  and security settings
+* Allows users to access personal files transparently from any machine in
+  an authenticated and secure way
+* Uses an advanced grouping mechanism to restrict network access to services
+  and files only to specific users
+* Allows central management of security mechanisms like passwords,
+  SSH Public Keys, SUDO rules, Keytabs, Access Control Rules
+* Enables delegation of selected administrative tasks to other power users
+* Integrates into Active Directory environments
+
+## Components
+
+The FreeIPA project provides unified installation and management
+tools for the following components:
+
+* LDAP Server - based on the [389 project](http://www.port389.org/)
+* KDC - based on [MIT Kerberos](http://k5wiki.kerberos.org/wiki/Main_Page)
+  implementation
+* PKI based on [Dogtag project](http://pki.fedoraproject.org/wiki/PKI_Main_Page)
+* [Samba](http://www.samba.org/) libraries for Active Directory integration
+* DNS Server based on [BIND](https://www.isc.org/software/bind) and the
+  [Bind-DynDB-LDAP plugin](https://pagure.io/bind-dyndb-ldap)
+
+## Project Website
+
+Releases, announcements and other information can be found on the IPA
+server project page at http://www.freeipa.org/ .
+
+## Documentation
+
+The most up-to-date documentation can be found at
+http://freeipa.org/page/Documentation .
+
+## Quick Start
+
+To get started quickly, start here:
+http://www.freeipa.org/page/Quick_Start_Guide
+
+## For developers
+
+* Building FreeIPA from source
+    * http://www.freeipa.org/page/Build
+    * See the BUILD.txt file in the source root directory
+
+## Licensing
+
+Please see the file called COPYING.
+
+## Contacts
+
+* If you want to be informed about new code releases, bug fixes,
+  security fixes, general news and information about the IPA server
+  subscribe to the freeipa-announce mailing list at
+  https://www.redhat.com/mailman/listinfo/freeipa-interest/ .
+* If you have a bug report please submit it at:
+  https://pagure.io/freeipa/issues
+* If you want to participate in actively developing IPA please
+  subscribe to the freeipa-devel mailing list at
+  https://lists.fedoraproject.org/archives/list/freeipa-devel@lists.fedorahosted.org/ or join
+  us in IRC at <irc://irc.libera.chat/freeipa>
--- a/1
+++ b/1
@@ -1 +0,0 @@
-0
--- a/94
+++ b/94
@@ -1,94 +0,0 @@
-########################################################
-# freeIPA Version                                      #
-#                                                      #
-# freeIPA versions are as follows                      #
-# 1.0.x                  New production series         #
-# 1.0.x{alpha,beta,rc}y  Alpha/Preview/Testing, Beta,  #
-#                           Release Candidate          #
-# 1.0.0GITabcdefg        Build from GIT                #
-#                                                      #
-########################################################
-
-########################################################
-# This are the main version numbers                    #
-#                                                      #
-# <MAJOR>.<MINOR>.<RELEASE>                            #
-#                                                      #
-# e.g. IPA_VERSION_MAJOR=1                             #
-#      IPA_VERSION_MINOR=0                             #
-#      IPA_VERSION_RELEASE=0                           #
-#  ->  "1.0.0"                                         #
-########################################################
-IPA_VERSION_MAJOR=4
-IPA_VERSION_MINOR=3
-IPA_VERSION_RELEASE=1
-
-########################################################
-# For 'alpha' releases the version will be             #
-#                                                      #
-# <MAJOR>.<MINOR>.<RELEASE>alpha<ALPHA_RELEASE>        #
-#                                                      #
-# e.g. IPA_VERSION_ALPHA_RELEASE=1                     #
-#  ->  "1.0.0alpha1"                                   #
-########################################################
-IPA_VERSION_ALPHA_RELEASE=
-
-########################################################
-# For 'beta' releases the version will be              #
-#                                                      #
-# <MAJOR>.<MINOR>.<RELEASE>beta<BETA_RELEASE>          #
-#                                                      #
-# e.g. IPA_VERSION_BETA_RELEASE=1                      #
-#  ->  "1.0.0beta1"                                    #
-########################################################
-IPA_VERSION_BETA_RELEASE=
-
-########################################################
-# For 'rc' releases the version will be                #
-#                                                      #
-# <MAJOR>.<MINOR>.<RELEASE>rc<RC_RELEASE>              #
-#                                                      #
-# e.g. IPA_VERSION_RC_RELEASE=1                        #
-#  ->  "1.0.0rc1"                                      #
-########################################################
-IPA_VERSION_RC_RELEASE=
-
-########################################################
-# To mark GIT snapshots this should be set to 'yes'    #
-# in the development BRANCH, and set to 'no' only in   #
-# the IPA_X_X_RELEASE BRANCH                           #
-#                                                      #
-# <MAJOR>.<MINOR>.<RELEASE>GITxxx                      #
-#                                                      #
-# e.g. IPA_VERSION_IS_SVN_SNAPSHOT=yes                 #
-#  ->  "1.0.0GITabcdefg"                               #
-########################################################
-IPA_VERSION_IS_GIT_SNAPSHOT="yes"
-
-########################################################
-# The version of IPA data. This is used to identify    #
-# incompatibilities in data that could cause issues    #
-# with replication. If the built-in versions don't     #
-# match exactly then replication will fail.            #
-#                                                      #
-# The format is %Y%m%d%H%M%S                           #
-#                                                      #
-# e.g. IPA_DATA_VERSION=`date +%Y%m%d%H%M%S`           #
-#  ->  "20100614120000"                                #
-########################################################
-IPA_DATA_VERSION=20100614120000
-
-########################################################
-# The version of the IPA API. This controls which      #
-# client versions can use the XML-RPC and json APIs    #
-#                                                      #
-# A change to existing API requires a MAJOR version    #
-# update.  The addition of new API bumps the MINOR     #
-# version.                                             #
-#                                                      #
-# The format is a whole number                         #
-#                                                      #
-########################################################
-IPA_API_VERSION_MAJOR=2
-IPA_API_VERSION_MINOR=164
-# Last change: simo - add optional string to disable preauth for SPNs
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -0,0 +1,152 @@
+########################################################
+# FreeIPA Version                                      #
+#                                                      #
+# FreeIPA versions are as follows                      #
+# 1.0.x                  New production series         #
+# 1.0.x{alpha,beta,rc}y  Alpha/Preview/Testing, Beta,  #
+#                           Release Candidate          #
+# 1.0.0.dev20170102030405+gitabcdefg  Build from GIT   #
+#                                                      #
+########################################################
+
+########################################################
+# This are the main version numbers                    #
+#                                                      #
+# <MAJOR>.<MINOR>.<RELEASE>                            #
+#                                                      #
+# e.g. define(IPA_VERSION_MAJOR, 1)                    #
+#      define(IPA_VERSION_MINOR, 0)                    #
+#      define(IPA_VERSION_RELEASE, 0)                  #
+#  ->  "1.0.0"                                         #
+########################################################
+define(IPA_VERSION_MAJOR, 4)
+define(IPA_VERSION_MINOR, 12)
+define(IPA_VERSION_RELEASE, 4)
+
+########################################################
+# For 'pre' releases the version will be               #
+#                                                      #
+# <MAJOR>.<MINOR>.<RELEASE><PRE_RELEASE>               #
+#                                                      #
+# pre releases start with RELEASE 90. After pre1 has   #
+# been released, RELEASE is bumpled to 91, and so on   #
+#                                                      #
+# e.g. define(IPA_VERSION_PRE_RELEASE, rc1)            #
+#  ->  "1.0.0rc1"                                      #
+########################################################
+define(IPA_VERSION_PRE_RELEASE, )
+
+########################################################
+# To mark GIT snapshots this should be set to 'yes'    #
+# in the development BRANCH, and set to 'no' only in   #
+# the IPA_X_X_RELEASE BRANCH                           #
+#                                                      #
+# <MAJOR>.<MINOR>.<RELEASE>.dev<TIMESTAMP>+git<hash>   #
+#                                                      #
+# e.g. define(IPA_VERSION_IS_GIT_SNAPSHOT, yes)        #
+#  ->  "1.0.0.dev20170102030405+gitabcdefg"            #
+#                                                      #
+# This option works only with GNU m4:                  #
+# it requires esyscmd m4 macro.                        #
+########################################################
+define(IPA_VERSION_IS_GIT_SNAPSHOT, no)
+
+########################################################
+# git development branch:                              #
+#                                                      #
+# - master: define(IPA_GIT_BRANCH, master)             #
+# - ipa-X-X: define(IPA_GIT_BRANCH,                    #
+#       ipa-IPA_VERSION_MAJOR-IPA_VERSION_MINOR)       #
+########################################################
+define(IPA_GIT_BRANCH, master)
+dnl define(IPA_GIT_BRANCH, ipa-IPA_VERSION_MAJOR-IPA_VERSION_MINOR)
+
+########################################################
+# The version of IPA data. This is used to identify    #
+# incompatibilities in data that could cause issues    #
+# with replication. If the built-in versions don't     #
+# match exactly then replication will fail.            #
+#                                                      #
+# The format is %Y%m%d%H%M%S                           #
+#                                                      #
+# e.g. define(IPA_DATA_VERSION, 20100614120000)        #
+#  ->  "20100614120000"                                #
+########################################################
+define(IPA_DATA_VERSION, 20100614120000)
+
+########################################################
+# The version of the IPA API. This controls which      #
+# client versions can use the XML-RPC and json APIs    #
+#                                                      #
+# A change to existing API requires a MAJOR version    #
+# update.  The addition of new API bumps the MINOR     #
+# version.                                             #
+#                                                      #
+# The format is a whole number                         #
+#                                                      #
+########################################################
+define(IPA_API_VERSION_MAJOR, 2)
+# Last change: add keeponly option to batch command
+define(IPA_API_VERSION_MINOR, 254)
+
+########################################################
+# Following values are auto-generated from values above
+# That way m4 madness lies
+########################################################
+
+########################################################
+# IPA_NUM_VERSION is auto-generated
+# format suitable for aritmetical comparison.
+########################################################
+dnl for some reason AC_SUBST([NUM_VERSION], [IPA_NUM_VERSION])
+dnl does not work when we use macro "format" instead of "esyscmd"
+define(IPA_NUM_VERSION, esyscmd(printf "%d%02d%02d" IPA_VERSION_MAJOR IPA_VERSION_MINOR IPA_VERSION_RELEASE))
+
+
+########################################################
+# IPA_API_VERSION: format is APImajor.APIminor
+########################################################
+define(IPA_API_VERSION, IPA_API_VERSION_MAJOR.IPA_API_VERSION_MINOR)
+
+
+########################################################
+# IPA_VERSION is one string formated according to rules
+# described on top of this file
+########################################################
+dnl helper for translit in IPA_VERSION
+define(NEWLINE,`
+')
+
+dnl Git snapshot: dev20170102030405+gitabcdefg
+define(IPA_GIT_VERSION, translit(dnl remove new lines from version (from esyscmd)
+ifelse(IPA_VERSION_IS_GIT_SNAPSHOT, yes,dnl
+dev
+esyscmd(date -u +'%Y%m%d%H%M')dnl 20170102030405
+git
+esyscmd(git log -1 --format="%h" HEAD),dnl abcdefg
+), NEWLINE))
+dnl IPA_GIT_VERSION end
+
+define(IPA_VERSION, translit(dnl remove new lines from version (from esyscmd)
+dnl 1.0.0
+IPA_VERSION_MAJOR.IPA_VERSION_MINOR.IPA_VERSION_RELEASE
+IPA_VERSION_PRE_RELEASE
+dnl version with Git snapshot: 1.0.0.dev20170102030405+gitabcdefg
+ifelse(IPA_VERSION_IS_GIT_SNAPSHOT, yes,
+.
+IPA_GIT_VERSION),
+NEWLINE)) dnl IPA_VERSION end
+
+########################################################
+# Version of MIT krb5 used to build IPA
+########################################################
+define(IPA_KRB5_BUILD_VERSION, translit(esyscmd(krb5-config --version | awk '{ print $NF }'), NEWLINE))
+
+dnl DEBUG: uncomment following lines and run command m4 VERSION.m4
+dnl `IPA_VERSION: ''IPA_VERSION'
+dnl `IPA_GIT_VERSION: ''IPA_GIT_VERSION'
+dnl `IPA_GIT_BRANCH: ''IPA_GIT_BRANCH'
+dnl `IPA_API_VERSION: ''IPA_API_VERSION'
+dnl `IPA_DATA_VERSION: ''IPA_DATA_VERSION'
+dnl `IPA_NUM_VERSION: ''IPA_NUM_VERSION'
+dnl `IPA_KRB5_BUILD_VERSION: ''IPA_KRB5_BUILD_VERSION'
--- a/aclocal.m4
+++ b/aclocal.m4
--- a/asn1/.deps/ipa_asn1.Plo
+++ b/asn1/.deps/ipa_asn1.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/Makefile
+++ b/asn1/Makefile
@@ -1,762 +0,0 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
-# Makefile.  Generated from Makefile.in by configure.
-
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
-
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-
-
-
-
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
-am__make_running_with_option = \
-  case $${target_option-} in \
-      ?) ;; \
-      *) echo "am__make_running_with_option: internal error: invalid" \
-              "target option '$${target_option-}' specified" >&2; \
-         exit 1;; \
-  esac; \
-  has_opt=no; \
-  sane_makeflags=$$MAKEFLAGS; \
-  if $(am__is_gnu_make); then \
-    sane_makeflags=$$MFLAGS; \
-  else \
-    case $$MAKEFLAGS in \
-      *\\[\ \	]*) \
-        bs=\\; \
-        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
-          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
-    esac; \
-  fi; \
-  skip_next=no; \
-  strip_trailopt () \
-  { \
-    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
-  }; \
-  for flg in $$sane_makeflags; do \
-    test $$skip_next = yes && { skip_next=no; continue; }; \
-    case $$flg in \
-      *=*|--*) continue;; \
-        -*I) strip_trailopt 'I'; skip_next=yes;; \
-      -*I?*) strip_trailopt 'I';; \
-        -*O) strip_trailopt 'O'; skip_next=yes;; \
-      -*O?*) strip_trailopt 'O';; \
-        -*l) strip_trailopt 'l'; skip_next=yes;; \
-      -*l?*) strip_trailopt 'l';; \
-      -[dEDm]) skip_next=yes;; \
-      -[JT]) skip_next=yes;; \
-    esac; \
-    case $$flg in \
-      *$$target_option*) has_opt=yes; break;; \
-    esac; \
-  done; \
-  test $$has_opt = yes
-am__make_dryrun = (target_option=n; $(am__make_running_with_option))
-am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
-pkgdatadir = $(datadir)/ipa-server
-pkgincludedir = $(includedir)/ipa-server
-pkglibdir = $(libdir)/ipa-server
-pkglibexecdir = $(libexecdir)/ipa-server
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = x86_64-unknown-linux-gnu
-host_triplet = x86_64-unknown-linux-gnu
-subdir = ../asn1
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
-	$(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \
-	$(am__DIST_COMMON)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_FILES =
-CONFIG_CLEAN_VPATH_FILES =
-LTLIBRARIES = $(noinst_LTLIBRARIES)
-libipaasn1_la_DEPENDENCIES = asn1c/libasn1c.la
-am_libipaasn1_la_OBJECTS = ipa_asn1.lo
-libipaasn1_la_OBJECTS = $(am_libipaasn1_la_OBJECTS)
-AM_V_lt = $(am__v_lt_$(V))
-am__v_lt_ = $(am__v_lt_$(AM_DEFAULT_VERBOSITY))
-am__v_lt_0 = --silent
-am__v_lt_1 = 
-AM_V_P = $(am__v_P_$(V))
-am__v_P_ = $(am__v_P_$(AM_DEFAULT_VERBOSITY))
-am__v_P_0 = false
-am__v_P_1 = :
-AM_V_GEN = $(am__v_GEN_$(V))
-am__v_GEN_ = $(am__v_GEN_$(AM_DEFAULT_VERBOSITY))
-am__v_GEN_0 = @echo "  GEN     " $@;
-am__v_GEN_1 = 
-AM_V_at = $(am__v_at_$(V))
-am__v_at_ = $(am__v_at_$(AM_DEFAULT_VERBOSITY))
-am__v_at_0 = @
-am__v_at_1 = 
-DEFAULT_INCLUDES = -I. -I$(top_builddir)
-depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
-am__mv = mv -f
-COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
-	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
-	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
-	$(AM_CFLAGS) $(CFLAGS)
-AM_V_CC = $(am__v_CC_$(V))
-am__v_CC_ = $(am__v_CC_$(AM_DEFAULT_VERBOSITY))
-am__v_CC_0 = @echo "  CC      " $@;
-am__v_CC_1 = 
-CCLD = $(CC)
-LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
-	$(AM_LDFLAGS) $(LDFLAGS) -o $@
-AM_V_CCLD = $(am__v_CCLD_$(V))
-am__v_CCLD_ = $(am__v_CCLD_$(AM_DEFAULT_VERBOSITY))
-am__v_CCLD_0 = @echo "  CCLD    " $@;
-am__v_CCLD_1 = 
-SOURCES = $(libipaasn1_la_SOURCES)
-DIST_SOURCES = $(libipaasn1_la_SOURCES)
-RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
-	ctags-recursive dvi-recursive html-recursive info-recursive \
-	install-data-recursive install-dvi-recursive \
-	install-exec-recursive install-html-recursive \
-	install-info-recursive install-pdf-recursive \
-	install-ps-recursive install-recursive installcheck-recursive \
-	installdirs-recursive pdf-recursive ps-recursive \
-	tags-recursive uninstall-recursive
-am__can_run_installinfo = \
-  case $$AM_UPDATE_INFO_DIR in \
-    n|no|NO) false;; \
-    *) (install-info --version) >/dev/null 2>&1;; \
-  esac
-HEADERS = $(noinst_HEADERS)
-RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive	\
-  distclean-recursive maintainer-clean-recursive
-am__recursive_targets = \
-  $(RECURSIVE_TARGETS) \
-  $(RECURSIVE_CLEAN_TARGETS) \
-  $(am__extra_recursive_targets)
-AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	distdir
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-# Read a list of newline-separated strings from the standard input,
-# and print each of them once, without duplicates.  Input order is
-# *not* preserved.
-am__uniquify_input = $(AWK) '\
-  BEGIN { nonempty = 0; } \
-  { items[$$0] = 1; nonempty = 1; } \
-  END { if (nonempty) { for (i in items) print i; }; } \
-'
-# Make sure the list of sources is unique.  This is necessary because,
-# e.g., the same source file might be shared among _SOURCES variables
-# for different programs/libraries.
-am__define_uniq_tagged_files = \
-  list='$(am__tagged_files)'; \
-  unique=`for i in $$list; do \
-    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-  done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
-DIST_SUBDIRS = $(SUBDIRS)
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README \
-	compile config.guess config.sub depcomp install-sh ltmain.sh \
-	missing
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-am__relativize = \
-  dir0=`pwd`; \
-  sed_first='s,^\([^/]*\)/.*$$,\1,'; \
-  sed_rest='s,^[^/]*/*,,'; \
-  sed_last='s,^.*/\([^/]*\)$$,\1,'; \
-  sed_butlast='s,/*[^/]*$$,,'; \
-  while test -n "$$dir1"; do \
-    first=`echo "$$dir1" | sed -e "$$sed_first"`; \
-    if test "$$first" != "."; then \
-      if test "$$first" = ".."; then \
-        dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
-        dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
-      else \
-        first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
-        if test "$$first2" = "$$first"; then \
-          dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
-        else \
-          dir2="../$$dir2"; \
-        fi; \
-        dir0="$$dir0"/"$$first"; \
-      fi; \
-    fi; \
-    dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
-  done; \
-  reldir="$$dir2"
-ACLOCAL = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing aclocal-1.15
-AMTAR = $${TAR-tar}
-AM_DEFAULT_VERBOSITY = 1
-AR = ar
-AUTOCONF = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing autoconf
-AUTOHEADER = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing autoheader
-AUTOMAKE = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing automake-1.15
-AWK = gawk
-CC = gcc
-CCDEPMODE = depmode=gcc3
-CFLAGS = -g -O2 -Wall -Wextra -Wformat-security -Wno-unused-parameter -Wno-sign-compare -Wno-missing-field-initializers 
-CHECK_CFLAGS = @CHECK_CFLAGS@
-CHECK_LIBS = @CHECK_LIBS@
-CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
-CMOCKA_LIBS = @CMOCKA_LIBS@
-CPP = gcc -E
-CPPFLAGS = 
-CYGPATH_W = echo
-DEFS = -DHAVE_CONFIG_H
-DEPDIR = .deps
-DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
-DIRSRV_LIBS = @DIRSRV_LIBS@
-DLLTOOL = false
-DSYMUTIL = 
-DUMPBIN = 
-ECHO_C = 
-ECHO_N = -n
-ECHO_T = 
-EGREP = /usr/bin/grep -E
-EXEEXT = 
-FGREP = /usr/bin/grep -F
-GREP = /usr/bin/grep
-INSTALL = /usr/bin/install -c
-INSTALL_DATA = ${INSTALL} -m 644
-INSTALL_PROGRAM = ${INSTALL}
-INSTALL_SCRIPT = ${INSTALL}
-INSTALL_STRIP_PROGRAM = $(install_sh) -c -s
-IPA_DATA_DIR = @IPA_DATA_DIR@
-KRAD_LIBS = @KRAD_LIBS@
-KRB5_LIBS = @KRB5_LIBS@
-LD = /usr/bin/ld -m elf_x86_64
-LDAP_CFLAGS = @LDAP_CFLAGS@
-LDAP_LIBS = @LDAP_LIBS@
-LDFLAGS = 
-LIBOBJS = 
-LIBPDB_NAME = @LIBPDB_NAME@
-LIBS = 
-LIBTOOL = $(SHELL) $(top_builddir)/libtool
-LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
-LIBVERTO_LIBS = @LIBVERTO_LIBS@
-LIPO = 
-LN_S = ln -s
-LTLIBOBJS = 
-LT_SYS_LIBRARY_PATH = 
-MAINT = #
-MAKEINFO = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing makeinfo
-MANIFEST_TOOL = :
-MKDIR_P = /usr/bin/mkdir -p
-NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
-NDRNBT_LIBS = @NDRNBT_LIBS@
-NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
-NDRPAC_LIBS = @NDRPAC_LIBS@
-NDR_CFLAGS = @NDR_CFLAGS@
-NDR_LIBS = @NDR_LIBS@
-NM = /usr/bin/nm -B
-NMEDIT = 
-NSPR_CFLAGS = @NSPR_CFLAGS@
-NSPR_LIBS = @NSPR_LIBS@
-NSS_CFLAGS = @NSS_CFLAGS@
-NSS_LIBS = @NSS_LIBS@
-OBJDUMP = objdump
-OBJEXT = o
-OPENLDAP_CFLAGS = @OPENLDAP_CFLAGS@
-OPENLDAP_LIBS = @OPENLDAP_LIBS@
-OTOOL = 
-OTOOL64 = 
-PACKAGE = ipa-server
-PACKAGE_BUGREPORT = https://hosted.fedoraproject.org/projects/freeipa/newticket
-PACKAGE_NAME = ipa-server
-PACKAGE_STRING = ipa-server 4.3.1
-PACKAGE_TARNAME = ipa-server
-PACKAGE_URL = 
-PACKAGE_VERSION = 4.3.1
-PATH_SEPARATOR = :
-PKG_CONFIG = @PKG_CONFIG@
-PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
-PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PYTHON = @PYTHON@
-PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
-PYTHON_PLATFORM = @PYTHON_PLATFORM@
-PYTHON_PREFIX = @PYTHON_PREFIX@
-PYTHON_VERSION = @PYTHON_VERSION@
-RANLIB = ranlib
-SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
-SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
-SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
-SED = /usr/bin/sed
-SET_MAKE = 
-SHELL = /bin/sh
-SSL_LIBS = @SSL_LIBS@
-SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
-SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
-SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
-SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
-STRIP = strip
-TALLOC_CFLAGS = @TALLOC_CFLAGS@
-TALLOC_LIBS = @TALLOC_LIBS@
-TEVENT_CFLAGS = @TEVENT_CFLAGS@
-TEVENT_LIBS = @TEVENT_LIBS@
-UNISTRING_LIBS = @UNISTRING_LIBS@
-UNLINK = @UNLINK@
-UUID_LIBS = @UUID_LIBS@
-VERSION = 4.3.1
-abs_builddir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-abs_srcdir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-abs_top_builddir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-abs_top_srcdir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-ac_ct_AR = ar
-ac_ct_CC = gcc
-ac_ct_DUMPBIN = 
-am__include = include
-am__leading_dot = .
-am__quote = 
-am__tar = $${TAR-tar} chof - "$$tardir"
-am__untar = $${TAR-tar} xf -
-bindir = ${exec_prefix}/bin
-build = x86_64-unknown-linux-gnu
-build_alias = 
-build_cpu = x86_64
-build_os = linux-gnu
-build_vendor = unknown
-builddir = .
-datadir = ${datarootdir}
-datarootdir = ${prefix}/share
-docdir = ${datarootdir}/doc/${PACKAGE_TARNAME}
-dvidir = ${docdir}
-exec_prefix = ${prefix}
-host = x86_64-unknown-linux-gnu
-host_alias = 
-host_cpu = x86_64
-host_os = linux-gnu
-host_vendor = unknown
-htmldir = ${docdir}
-includedir = ${prefix}/include
-infodir = ${datarootdir}/info
-install_sh = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/install-sh
-krb5rundir = @krb5rundir@
-libdir = /usr/lib
-libexecdir = ${exec_prefix}/libexec
-localedir = ${datarootdir}/locale
-localstatedir = /var
-mandir = ${datarootdir}/man
-mkdir_p = $(MKDIR_P)
-oldincludedir = /usr/include
-pdfdir = ${docdir}
-pkgpyexecdir = @pkgpyexecdir@
-pkgpythondir = @pkgpythondir@
-prefix = /usr
-program_transform_name = s,x,x,
-psdir = ${docdir}
-pyexecdir = @pyexecdir@
-pythondir = @pythondir@
-sbindir = ${exec_prefix}/sbin
-sharedstatedir = /var
-srcdir = .
-subdirs = @subdirs@
-sysconfdir = /etc
-systemdsystemunitdir = @systemdsystemunitdir@
-target_alias = 
-top_build_prefix = 
-top_builddir = .
-top_srcdir = .
-SUBDIRS = asn1c
-AM_CPPFLAGS = -I../util -Iasn1c
-noinst_LTLIBRARIES = libipaasn1.la
-noinst_HEADERS = ipa_asn1.h
-libipaasn1_la_SOURCES = ipa_asn1.c
-libipaasn1_la_LIBADD = asn1c/libasn1c.la
-all: all-recursive
-
-.SUFFIXES:
-.SUFFIXES: .c .lo .o .obj
-$(srcdir)/Makefile.in: # $(srcdir)/Makefile.am  $(am__configure_deps)
-	@for dep in $?; do \
-	  case '$(am__configure_deps)' in \
-	    *$$dep*) \
-	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
-	        && { if test -f $@; then exit 0; else break; fi; }; \
-	      exit 1;; \
-	  esac; \
-	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign ../asn1/Makefile'; \
-	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign ../asn1/Makefile
-Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
-	@case '$?' in \
-	  *config.status*) \
-	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
-	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
-	esac;
-
-$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-$(top_srcdir)/configure: # $(am__configure_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4): # $(am__aclocal_m4_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(am__aclocal_m4_deps):
-
-clean-noinstLTLIBRARIES:
-	-test -z "$(noinst_LTLIBRARIES)" || rm -f $(noinst_LTLIBRARIES)
-	@list='$(noinst_LTLIBRARIES)'; \
-	locs=`for p in $$list; do echo $$p; done | \
-	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
-	      sort -u`; \
-	test -z "$$locs" || { \
-	  echo rm -f $${locs}; \
-	  rm -f $${locs}; \
-	}
-
-libipaasn1.la: $(libipaasn1_la_OBJECTS) $(libipaasn1_la_DEPENDENCIES) $(EXTRA_libipaasn1_la_DEPENDENCIES) 
-	$(AM_V_CCLD)$(LINK)  $(libipaasn1_la_OBJECTS) $(libipaasn1_la_LIBADD) $(LIBS)
-
-mostlyclean-compile:
-	-rm -f *.$(OBJEXT)
-
-distclean-compile:
-	-rm -f *.tab.c
-
-include ./$(DEPDIR)/ipa_asn1.Plo
-
-.c.o:
-	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-#	$(AM_V_CC)source='$<' object='$@' libtool=no \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(COMPILE) -c -o $@ $<
-
-.c.obj:
-	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-#	$(AM_V_CC)source='$<' object='$@' libtool=no \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
-
-.c.lo:
-	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
-#	$(AM_V_CC)source='$<' object='$@' libtool=yes \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(LTCOMPILE) -c -o $@ $<
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
-
-# This directory's subdirectories are mostly independent; you can cd
-# into them and run 'make' without going through this Makefile.
-# To change the values of 'make' variables: instead of editing Makefiles,
-# (1) if the variable is set in 'config.status', edit 'config.status'
-#     (which will cause the Makefiles to be regenerated when you run 'make');
-# (2) otherwise, pass the desired values on the 'make' command line.
-$(am__recursive_targets):
-	@fail=; \
-	if $(am__make_keepgoing); then \
-	  failcom='fail=yes'; \
-	else \
-	  failcom='exit 1'; \
-	fi; \
-	dot_seen=no; \
-	target=`echo $@ | sed s/-recursive//`; \
-	case "$@" in \
-	  distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
-	  *) list='$(SUBDIRS)' ;; \
-	esac; \
-	for subdir in $$list; do \
-	  echo "Making $$target in $$subdir"; \
-	  if test "$$subdir" = "."; then \
-	    dot_seen=yes; \
-	    local_target="$$target-am"; \
-	  else \
-	    local_target="$$target"; \
-	  fi; \
-	  ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
-	  || eval $$failcom; \
-	done; \
-	if test "$$dot_seen" = "no"; then \
-	  $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
-	fi; test -z "$$fail"
-
-ID: $(am__tagged_files)
-	$(am__define_uniq_tagged_files); mkid -fID $$unique
-tags: tags-recursive
-TAGS: tags
-
-tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
-	set x; \
-	here=`pwd`; \
-	if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
-	  include_option=--etags-include; \
-	  empty_fix=.; \
-	else \
-	  include_option=--include; \
-	  empty_fix=; \
-	fi; \
-	list='$(SUBDIRS)'; for subdir in $$list; do \
-	  if test "$$subdir" = .; then :; else \
-	    test ! -f $$subdir/TAGS || \
-	      set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
-	  fi; \
-	done; \
-	$(am__define_uniq_tagged_files); \
-	shift; \
-	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
-	  test -n "$$unique" || unique=$$empty_fix; \
-	  if test $$# -gt 0; then \
-	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	      "$$@" $$unique; \
-	  else \
-	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	      $$unique; \
-	  fi; \
-	fi
-ctags: ctags-recursive
-
-CTAGS: ctags
-ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
-	$(am__define_uniq_tagged_files); \
-	test -z "$(CTAGS_ARGS)$$unique" \
-	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$unique
-
-GTAGS:
-	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && $(am__cd) $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) "$$here"
-cscopelist: cscopelist-recursive
-
-cscopelist-am: $(am__tagged_files)
-	list='$(am__tagged_files)'; \
-	case "$(srcdir)" in \
-	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
-	  *) sdir=$(subdir)/$(srcdir) ;; \
-	esac; \
-	for i in $$list; do \
-	  if test -f "$$i"; then \
-	    echo "$(subdir)/$$i"; \
-	  else \
-	    echo "$$sdir/$$i"; \
-	  fi; \
-	done >> $(top_builddir)/cscope.files
-
-distclean-tags:
-	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
-
-distdir: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	list='$(DISTFILES)'; \
-	  dist_files=`for file in $$list; do echo $$file; done | \
-	  sed -e "s|^$$srcdirstrip/||;t" \
-	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
-	case $$dist_files in \
-	  */*) $(MKDIR_P) `echo "$$dist_files" | \
-			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
-			   sort -u` ;; \
-	esac; \
-	for file in $$dist_files; do \
-	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  if test -d $$d/$$file; then \
-	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d "$(distdir)/$$file"; then \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
-	  else \
-	    test -f "$(distdir)/$$file" \
-	    || cp -p $$d/$$file "$(distdir)/$$file" \
-	    || exit 1; \
-	  fi; \
-	done
-	@list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
-	  if test "$$subdir" = .; then :; else \
-	    $(am__make_dryrun) \
-	      || test -d "$(distdir)/$$subdir" \
-	      || $(MKDIR_P) "$(distdir)/$$subdir" \
-	      || exit 1; \
-	    dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
-	    $(am__relativize); \
-	    new_distdir=$$reldir; \
-	    dir1=$$subdir; dir2="$(top_distdir)"; \
-	    $(am__relativize); \
-	    new_top_distdir=$$reldir; \
-	    echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
-	    echo "     am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
-	    ($(am__cd) $$subdir && \
-	      $(MAKE) $(AM_MAKEFLAGS) \
-	        top_distdir="$$new_top_distdir" \
-	        distdir="$$new_distdir" \
-		am__remove_distdir=: \
-		am__skip_length_check=: \
-		am__skip_mode_fix=: \
-	        distdir) \
-	      || exit 1; \
-	  fi; \
-	done
-check-am: all-am
-check: check-recursive
-all-am: Makefile $(LTLIBRARIES) $(HEADERS)
-installdirs: installdirs-recursive
-installdirs-am:
-install: install-recursive
-install-exec: install-exec-recursive
-install-data: install-data-recursive
-uninstall: uninstall-recursive
-
-install-am: all-am
-	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
-
-installcheck: installcheck-recursive
-install-strip:
-	if test -z '$(STRIP)'; then \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	      install; \
-	else \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
-	fi
-mostlyclean-generic:
-
-clean-generic:
-
-distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
-
-maintainer-clean-generic:
-	@echo "This command is intended for maintainers to use"
-	@echo "it deletes files that may require special tools to rebuild."
-clean: clean-recursive
-
-clean-am: clean-generic clean-libtool clean-noinstLTLIBRARIES \
-	mostlyclean-am
-
-distclean: distclean-recursive
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-distclean-am: clean-am distclean-compile distclean-generic \
-	distclean-tags
-
-dvi: dvi-recursive
-
-dvi-am:
-
-html: html-recursive
-
-html-am:
-
-info: info-recursive
-
-info-am:
-
-install-data-am:
-
-install-dvi: install-dvi-recursive
-
-install-dvi-am:
-
-install-exec-am:
-
-install-html: install-html-recursive
-
-install-html-am:
-
-install-info: install-info-recursive
-
-install-info-am:
-
-install-man:
-
-install-pdf: install-pdf-recursive
-
-install-pdf-am:
-
-install-ps: install-ps-recursive
-
-install-ps-am:
-
-installcheck-am:
-
-maintainer-clean: maintainer-clean-recursive
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-maintainer-clean-am: distclean-am maintainer-clean-generic
-
-mostlyclean: mostlyclean-recursive
-
-mostlyclean-am: mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool
-
-pdf: pdf-recursive
-
-pdf-am:
-
-ps: ps-recursive
-
-ps-am:
-
-uninstall-am:
-
-.MAKE: $(am__recursive_targets) install-am install-strip
-
-.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
-	check-am clean clean-generic clean-libtool \
-	clean-noinstLTLIBRARIES cscopelist-am ctags ctags-am distclean \
-	distclean-compile distclean-generic distclean-libtool \
-	distclean-tags distdir dvi dvi-am html html-am info info-am \
-	install install-am install-data install-data-am install-dvi \
-	install-dvi-am install-exec install-exec-am install-html \
-	install-html-am install-info install-info-am install-man \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-strip installcheck installcheck-am installdirs \
-	installdirs-am maintainer-clean maintainer-clean-generic \
-	mostlyclean mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
-	uninstall-am
-
-.PRECIOUS: Makefile
-
-
-# Tell versions [3.59,3.63) of GNU make to not export all variables.
-# Otherwise a system limit (for SysV at least) may be exceeded.
-.NOEXPORT:
--- a/asn1/Makefile.am
+++ b/asn1/Makefile.am
@@ -1,6 +1,6 @@
 SUBDIRS = asn1c

-AM_CPPFLAGS = -I../util -Iasn1c
+AM_CPPFLAGS = -I$(top_srcdir)/util -I$(srcdir)/asn1c

 noinst_LTLIBRARIES=libipaasn1.la
 noinst_HEADERS=ipa_asn1.h
--- a/asn1/Makefile.in
+++ b/asn1/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.17 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2024 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -71,6 +71,8 @@ am__make_running_with_option = \
  test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+am__rm_f = rm -f $(am__rm_f_notfound)
+am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -89,10 +91,17 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-subdir = ../asn1
+subdir = asn1
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
-	$(top_srcdir)/configure.ac
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \
@@ -123,7 +132,8 @@ am__v_at_0 = @
 am__v_at_1 = 
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/ipa_asn1.Plo
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -166,7 +176,7 @@ am__recursive_targets = \
  $(RECURSIVE_CLEAN_TARGETS) \
  $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	distdir
+	distdir distdir-am
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
@@ -184,12 +194,8 @@ am__define_uniq_tagged_files = \
  unique=`for i in $$list; do \
    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
  done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
 DIST_SUBDIRS = $(SUBDIRS)
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README \
-	compile config.guess config.sub depcomp install-sh ltmain.sh \
-	missing
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 am__relativize = \
  dir0=`pwd`; \
@@ -219,6 +225,7 @@ am__relativize = \
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
 AR = @AR@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
@@ -227,13 +234,17 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
-CHECK_CFLAGS = @CHECK_CFLAGS@
-CHECK_LIBS = @CHECK_LIBS@
 CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
 CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
@@ -245,21 +256,49 @@ ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
 GREP = @GREP@
+HTTPD_GROUP = @HTTPD_GROUP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
 IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JANSSON_CFLAGS = @JANSSON_CFLAGS@
+JANSSON_LIBS = @JANSSON_LIBS@
+JSLINT = @JSLINT@
 KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_BUILD_VERSION = @KRB5_BUILD_VERSION@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_GSSAPI_CFLAGS = @KRB5_GSSAPI_CFLAGS@
+KRB5_GSSAPI_LIBS = @KRB5_GSSAPI_LIBS@
 KRB5_LIBS = @KRB5_LIBS@
 LD = @LD@
 LDAP_CFLAGS = @LDAP_CFLAGS@
 LDAP_LIBS = @LDAP_LIBS@
 LDFLAGS = @LDFLAGS@
+LIBCURL_CFLAGS = @LIBCURL_CFLAGS@
+LIBCURL_LIBS = @LIBCURL_LIBS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
 LIBOBJS = @LIBOBJS@
 LIBPDB_NAME = @LIBPDB_NAME@
 LIBS = @LIBS@
@@ -268,12 +307,22 @@ LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
 LIBVERTO_LIBS = @LIBVERTO_LIBS@
 LIPO = @LIPO@
 LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
 LTLIBOBJS = @LTLIBOBJS@
 LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
-MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
 NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
 NDRNBT_LIBS = @NDRNBT_LIBS@
 NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
@@ -284,12 +333,11 @@ NM = @NM@
 NMEDIT = @NMEDIT@
 NSPR_CFLAGS = @NSPR_CFLAGS@
 NSPR_LIBS = @NSPR_LIBS@
-NSS_CFLAGS = @NSS_CFLAGS@
-NSS_LIBS = @NSS_LIBS@
+NUM_VERSION = @NUM_VERSION@
 OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
-OPENLDAP_CFLAGS = @OPENLDAP_CFLAGS@
-OPENLDAP_LIBS = @OPENLDAP_LIBS@
+ODS_GROUP = @ODS_GROUP@
+ODS_USER = @ODS_USER@
 OTOOL = @OTOOL@
 OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
@@ -303,19 +351,33 @@ PATH_SEPARATOR = @PATH_SEPARATOR@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+PLATFORM_PYTHON = @PLATFORM_PYTHON@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PWQUALITY_CFLAGS = @PWQUALITY_CFLAGS@
+PWQUALITY_LIBS = @PWQUALITY_LIBS@
+PYLINT = @PYLINT@
 PYTHON = @PYTHON@
 PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
 PYTHON_PLATFORM = @PYTHON_PLATFORM@
 PYTHON_PREFIX = @PYTHON_PREFIX@
 PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
+RESOLV_LIBS = @RESOLV_LIBS@
+RPMLINT = @RPMLINT@
 SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
 SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
 SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SAMBA_SECURITY_LIBS = @SAMBA_SECURITY_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
-SSL_LIBS = @SSL_LIBS@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
 SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
 SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
 SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
@@ -327,8 +389,16 @@ TEVENT_CFLAGS = @TEVENT_CFLAGS@
 TEVENT_LIBS = @TEVENT_LIBS@
 UNISTRING_LIBS = @UNISTRING_LIBS@
 UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
 UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
 VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
@@ -339,8 +409,10 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
+am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -359,6 +431,7 @@ host_cpu = @host_cpu@
 host_os = @host_os@
 host_vendor = @host_vendor@
 htmldir = @htmldir@
+i18ntests = @i18ntests@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
@@ -378,18 +451,22 @@ program_transform_name = @program_transform_name@
 psdir = @psdir@
 pyexecdir = @pyexecdir@
 pythondir = @pythondir@
+runstatedir = @runstatedir@
 sbindir = @sbindir@
+selinux_makefile = @selinux_makefile@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
-subdirs = @subdirs@
 sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdcatalogdir = @systemdcatalogdir@
 systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 SUBDIRS = asn1c
-AM_CPPFLAGS = -I../util -Iasn1c
+AM_CPPFLAGS = -I$(top_srcdir)/util -I$(srcdir)/asn1c
 noinst_LTLIBRARIES = libipaasn1.la
 noinst_HEADERS = ipa_asn1.h
 libipaasn1_la_SOURCES = ipa_asn1.c
@@ -398,7 +475,7 @@ all: all-recursive

 .SUFFIXES:
 .SUFFIXES: .c .lo .o .obj
-$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
@@ -407,37 +484,35 @@ $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__confi
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign ../asn1/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign asn1/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign ../asn1/Makefile
+	  $(AUTOMAKE) --foreign asn1/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh

-$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+$(top_srcdir)/configure:  $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(am__aclocal_m4_deps):

 clean-noinstLTLIBRARIES:
-	-test -z "$(noinst_LTLIBRARIES)" || rm -f $(noinst_LTLIBRARIES)
+	-$(am__rm_f) $(noinst_LTLIBRARIES)
 	@list='$(noinst_LTLIBRARIES)'; \
 	locs=`for p in $$list; do echo $$p; done | \
 	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
 	      sort -u`; \
-	test -z "$$locs" || { \
-	  echo rm -f $${locs}; \
-	  rm -f $${locs}; \
-	}
+	echo rm -f $${locs}; \
+	$(am__rm_f) $${locs}

 libipaasn1.la: $(libipaasn1_la_OBJECTS) $(libipaasn1_la_DEPENDENCIES) $(EXTRA_libipaasn1_la_DEPENDENCIES) 
 	$(AM_V_CCLD)$(LINK)  $(libipaasn1_la_OBJECTS) $(libipaasn1_la_LIBADD) $(LIBS)
@@ -448,7 +523,13 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c

-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_asn1.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipa_asn1.Plo@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@: >>$@
+
+am--depfiles: $(am__depfiles_remade)

 .c.o:
@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -575,8 +656,10 @@ cscopelist-am: $(am__tagged_files)

 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am

-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -660,8 +743,8 @@ mostlyclean-generic:
 clean-generic:

 distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -672,7 +755,7 @@ clean-am: clean-generic clean-libtool clean-noinstLTLIBRARIES \
 	mostlyclean-am

 distclean: distclean-recursive
-	-rm -rf ./$(DEPDIR)
+	-rm -f ./$(DEPDIR)/ipa_asn1.Plo
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-tags
@@ -718,7 +801,7 @@ install-ps-am:
 installcheck-am:

 maintainer-clean: maintainer-clean-recursive
-	-rm -rf ./$(DEPDIR)
+	-rm -f ./$(DEPDIR)/ipa_asn1.Plo
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic

@@ -739,8 +822,8 @@ uninstall-am:

 .MAKE: $(am__recursive_targets) install-am install-strip

-.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
-	check-am clean clean-generic clean-libtool \
+.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \
+	am--depfiles check check-am clean clean-generic clean-libtool \
 	clean-noinstLTLIBRARIES cscopelist-am ctags ctags-am distclean \
 	distclean-compile distclean-generic distclean-libtool \
 	distclean-tags distdir dvi dvi-am html html-am info info-am \
@@ -760,3 +843,10 @@ uninstall-am:
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
+
+# Tell GNU make to disable its built-in pattern rules.
+%:: %,v
+%:: RCS/%,v
+%:: RCS/%
+%:: s.%
+%:: SCCS/s.%
--- a/asn1/aclocal.m4
+++ b/asn1/aclocal.m4
--- a/asn1/asn1c/.deps/BIT_STRING.Plo
+++ b/asn1/asn1c/.deps/BIT_STRING.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/GKCurrentKeys.Plo
+++ b/asn1/asn1c/.deps/GKCurrentKeys.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/GKNewKeys.Plo
+++ b/asn1/asn1c/.deps/GKNewKeys.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/GKReply.Plo
+++ b/asn1/asn1c/.deps/GKReply.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/GetKeytabControl.Plo
+++ b/asn1/asn1c/.deps/GetKeytabControl.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/INTEGER.Plo
+++ b/asn1/asn1c/.deps/INTEGER.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/Int32.Plo
+++ b/asn1/asn1c/.deps/Int32.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/KrbKey.Plo
+++ b/asn1/asn1c/.deps/KrbKey.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/NativeEnumerated.Plo
+++ b/asn1/asn1c/.deps/NativeEnumerated.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/NativeInteger.Plo
+++ b/asn1/asn1c/.deps/NativeInteger.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/OCTET_STRING.Plo
+++ b/asn1/asn1c/.deps/OCTET_STRING.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/TypeValuePair.Plo
+++ b/asn1/asn1c/.deps/TypeValuePair.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/asn_SEQUENCE_OF.Plo
+++ b/asn1/asn1c/.deps/asn_SEQUENCE_OF.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/asn_SET_OF.Plo
+++ b/asn1/asn1c/.deps/asn_SET_OF.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/asn_codecs_prim.Plo
+++ b/asn1/asn1c/.deps/asn_codecs_prim.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/ber_decoder.Plo
+++ b/asn1/asn1c/.deps/ber_decoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/ber_tlv_length.Plo
+++ b/asn1/asn1c/.deps/ber_tlv_length.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/ber_tlv_tag.Plo
+++ b/asn1/asn1c/.deps/ber_tlv_tag.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constr_CHOICE.Plo
+++ b/asn1/asn1c/.deps/constr_CHOICE.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constr_SEQUENCE.Plo
+++ b/asn1/asn1c/.deps/constr_SEQUENCE.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constr_SEQUENCE_OF.Plo
+++ b/asn1/asn1c/.deps/constr_SEQUENCE_OF.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constr_SET_OF.Plo
+++ b/asn1/asn1c/.deps/constr_SET_OF.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constr_TYPE.Plo
+++ b/asn1/asn1c/.deps/constr_TYPE.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/constraints.Plo
+++ b/asn1/asn1c/.deps/constraints.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/der_encoder.Plo
+++ b/asn1/asn1c/.deps/der_encoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/per_decoder.Plo
+++ b/asn1/asn1c/.deps/per_decoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/per_encoder.Plo
+++ b/asn1/asn1c/.deps/per_encoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/per_support.Plo
+++ b/asn1/asn1c/.deps/per_support.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/xer_decoder.Plo
+++ b/asn1/asn1c/.deps/xer_decoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/xer_encoder.Plo
+++ b/asn1/asn1c/.deps/xer_encoder.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/.deps/xer_support.Plo
+++ b/asn1/asn1c/.deps/xer_support.Plo
@@ -1 +0,0 @@
-# dummy
--- a/asn1/asn1c/BIT_STRING.c
+++ b/asn1/asn1c/BIT_STRING.c
@@ -9,13 +9,13 @@
 /*
 * BIT STRING basic type description.
 */
-static ber_tlv_tag_t asn_DEF_BIT_STRING_tags[] = {
+static const ber_tlv_tag_t asn_DEF_BIT_STRING_tags[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (3 << 2))
 };
 static asn_OCTET_STRING_specifics_t asn_DEF_BIT_STRING_specs = {
 	sizeof(BIT_STRING_t),
 	offsetof(BIT_STRING_t, _asn_ctx),
-	1,	/* Special indicator that this is a BIT STRING type */
+	ASN_OSUBV_BIT
 };
 asn_TYPE_descriptor_t asn_DEF_BIT_STRING = {
 	"BIT STRING",
@@ -50,14 +50,15 @@ BIT_STRING_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	const BIT_STRING_t *st = (const BIT_STRING_t *)sptr;

 	if(st && st->buf) {
-		if(st->size == 1 && st->bits_unused) {
-			_ASN_CTFAIL(app_key, td,
+		if((st->size == 0 && st->bits_unused)
+		|| st->bits_unused < 0 || st->bits_unused > 7) {
+			ASN__CTFAIL(app_key, td, sptr,
 				"%s: invalid padding byte (%s:%d)",
 				td->name, __FILE__, __LINE__);
 			return -1;
 		}
 	} else {
-		_ASN_CTFAIL(app_key, td,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: value not given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -85,7 +86,7 @@ BIT_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	uint8_t *end;

 	if(!st || !st->buf)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	er.encoded = 0;

@@ -100,9 +101,9 @@ BIT_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		int nline = xcan?0:(((buf - st->buf) % 8) == 0);
 		if(p >= scend || nline) {
 			er.encoded += p - scratch;
-			_ASN_CALLBACK(scratch, p - scratch);
+			ASN__CALLBACK(scratch, p - scratch);
 			p = scratch;
-			if(nline) _i_ASN_TEXT_INDENT(1, ilevel);
+			if(nline) ASN__TEXT_INDENT(1, ilevel);
 		}
 		memcpy(p + 0, _bit_pattern[v >> 4], 4);
 		memcpy(p + 4, _bit_pattern[v & 0x0f], 4);
@@ -110,9 +111,9 @@ BIT_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	}

 	if(!xcan && ((buf - st->buf) % 8) == 0)
-		_i_ASN_TEXT_INDENT(1, ilevel);
+		ASN__TEXT_INDENT(1, ilevel);
 	er.encoded += p - scratch;
-	_ASN_CALLBACK(scratch, p - scratch);
+	ASN__CALLBACK(scratch, p - scratch);
 	p = scratch;

 	if(buf == end) {
@@ -122,14 +123,14 @@ BIT_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		for(i = 7; i >= ubits; i--)
 			*p++ = (v & (1 << i)) ? 0x31 : 0x30;
 		er.encoded += p - scratch;
-		_ASN_CALLBACK(scratch, p - scratch);
+		ASN__CALLBACK(scratch, p - scratch);
 	}

-	if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel - 1);
+	if(!xcan) ASN__TEXT_INDENT(1, ilevel - 1);

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }


@@ -139,7 +140,7 @@ cb_failed:
 int
 BIT_STRING_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 		asn_app_consume_bytes_f *cb, void *app_key) {
-	static const char *h2c = "0123456789ABCDEF";
+	const char * const h2c = "0123456789ABCDEF";
 	char scratch[64];
 	const BIT_STRING_t *st = (const BIT_STRING_t *)sptr;
 	uint8_t *buf;
--- a/asn1/asn1c/GKCurrentKeys.c
+++ b/asn1/asn1c/GKCurrentKeys.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "GKCurrentKeys.h"

 static asn_TYPE_member_t asn_MBR_GKCurrentKeys_1[] = {
@@ -20,11 +18,11 @@ static asn_TYPE_member_t asn_MBR_GKCurrentKeys_1[] = {
 		"serviceIdentity"
 		},
 };
-static ber_tlv_tag_t asn_DEF_GKCurrentKeys_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_GKCurrentKeys_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
-static asn_TYPE_tag2member_t asn_MAP_GKCurrentKeys_tag2el_1[] = {
-    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 } /* serviceIdentity at 19 */
+static const asn_TYPE_tag2member_t asn_MAP_GKCurrentKeys_tag2el_1[] = {
+    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 } /* serviceIdentity */
 };
 static asn_SEQUENCE_specifics_t asn_SPC_GKCurrentKeys_specs_1 = {
 	sizeof(struct GKCurrentKeys),
--- a/asn1/asn1c/GKCurrentKeys.h
+++ b/asn1/asn1c/GKCurrentKeys.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_GKCurrentKeys_H_
@@ -35,3 +35,4 @@ extern asn_TYPE_descriptor_t asn_DEF_GKCurrentKeys;
 #endif

 #endif	/* _GKCurrentKeys_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/GKNewKeys.c
+++ b/asn1/asn1c/GKNewKeys.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "GKNewKeys.h"

 static asn_TYPE_member_t asn_MBR_enctypes_3[] = {
@@ -20,7 +18,7 @@ static asn_TYPE_member_t asn_MBR_enctypes_3[] = {
 		""
 		},
 };
-static ber_tlv_tag_t asn_DEF_enctypes_tags_3[] = {
+static const ber_tlv_tag_t asn_DEF_enctypes_tags_3[] = {
 	(ASN_TAG_CLASS_CONTEXT | (1 << 2)),
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
@@ -66,7 +64,7 @@ static asn_TYPE_member_t asn_MBR_GKNewKeys_1[] = {
 		},
 	{ ATF_NOFLAGS, 0, offsetof(struct GKNewKeys, enctypes),
 		(ASN_TAG_CLASS_CONTEXT | (1 << 2)),
-		+1,	/* EXPLICIT tag at current level */
+		0,
 		&asn_DEF_enctypes_3,
 		0,	/* Defer constraints checking to the member type */
 		0,	/* PER is not compiled, use -gen-PER */
@@ -83,13 +81,13 @@ static asn_TYPE_member_t asn_MBR_GKNewKeys_1[] = {
 		"password"
 		},
 };
-static ber_tlv_tag_t asn_DEF_GKNewKeys_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_GKNewKeys_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
-static asn_TYPE_tag2member_t asn_MAP_GKNewKeys_tag2el_1[] = {
-    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* serviceIdentity at 13 */
-    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* enctypes at 14 */
-    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* password at 15 */
+static const asn_TYPE_tag2member_t asn_MAP_GKNewKeys_tag2el_1[] = {
+    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* serviceIdentity */
+    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* enctypes */
+    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* password */
 };
 static asn_SEQUENCE_specifics_t asn_SPC_GKNewKeys_specs_1 = {
 	sizeof(struct GKNewKeys),
--- a/asn1/asn1c/GKNewKeys.h
+++ b/asn1/asn1c/GKNewKeys.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_GKNewKeys_H_
@@ -45,3 +45,4 @@ extern asn_TYPE_descriptor_t asn_DEF_GKNewKeys;
 #endif

 #endif	/* _GKNewKeys_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/GKReply.c
+++ b/asn1/asn1c/GKReply.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "GKReply.h"

 static asn_TYPE_member_t asn_MBR_keys_3[] = {
@@ -20,7 +18,7 @@ static asn_TYPE_member_t asn_MBR_keys_3[] = {
 		""
 		},
 };
-static ber_tlv_tag_t asn_DEF_keys_tags_3[] = {
+static const ber_tlv_tag_t asn_DEF_keys_tags_3[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
 static asn_SET_OF_specifics_t asn_SPC_keys_specs_3 = {
@@ -73,12 +71,12 @@ static asn_TYPE_member_t asn_MBR_GKReply_1[] = {
 		"keys"
 		},
 };
-static ber_tlv_tag_t asn_DEF_GKReply_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_GKReply_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
-static asn_TYPE_tag2member_t asn_MAP_GKReply_tag2el_1[] = {
-    { (ASN_TAG_CLASS_UNIVERSAL | (2 << 2)), 0, 0, 0 }, /* newkvno at 23 */
-    { (ASN_TAG_CLASS_UNIVERSAL | (16 << 2)), 1, 0, 0 } /* keys at 25 */
+static const asn_TYPE_tag2member_t asn_MAP_GKReply_tag2el_1[] = {
+    { (ASN_TAG_CLASS_UNIVERSAL | (2 << 2)), 0, 0, 0 }, /* newkvno */
+    { (ASN_TAG_CLASS_UNIVERSAL | (16 << 2)), 1, 0, 0 } /* keys */
 };
 static asn_SEQUENCE_specifics_t asn_SPC_GKReply_specs_1 = {
 	sizeof(struct GKReply),
--- a/asn1/asn1c/GKReply.h
+++ b/asn1/asn1c/GKReply.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_GKReply_H_
@@ -49,3 +49,4 @@ extern asn_TYPE_descriptor_t asn_DEF_GKReply;
 #include "KrbKey.h"

 #endif	/* _GKReply_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/GetKeytabControl.c
+++ b/asn1/asn1c/GetKeytabControl.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "GetKeytabControl.h"

 static asn_TYPE_member_t asn_MBR_GetKeytabControl_1[] = {
@@ -38,10 +36,10 @@ static asn_TYPE_member_t asn_MBR_GetKeytabControl_1[] = {
 		"reply"
 		},
 };
-static asn_TYPE_tag2member_t asn_MAP_GetKeytabControl_tag2el_1[] = {
-    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* newkeys at 7 */
-    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* curkeys at 8 */
-    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* reply at 10 */
+static const asn_TYPE_tag2member_t asn_MAP_GetKeytabControl_tag2el_1[] = {
+    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* newkeys */
+    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* curkeys */
+    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* reply */
 };
 static asn_CHOICE_specifics_t asn_SPC_GetKeytabControl_specs_1 = {
 	sizeof(struct GetKeytabControl),
--- a/asn1/asn1c/GetKeytabControl.h
+++ b/asn1/asn1c/GetKeytabControl.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_GetKeytabControl_H_
@@ -50,3 +50,4 @@ extern asn_TYPE_descriptor_t asn_DEF_GetKeytabControl;
 #endif

 #endif	/* _GetKeytabControl_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/INTEGER.c
+++ b/asn1/asn1c/INTEGER.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2003, 2004, 2005, 2006 Lev Walkin <vlm@lionet.info>.
+ * Copyright (c) 2003-2014 Lev Walkin <vlm@lionet.info>.
 * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
@@ -11,7 +11,7 @@
 /*
 * INTEGER basic type description.
 */
-static ber_tlv_tag_t asn_DEF_INTEGER_tags[] = {
+static const ber_tlv_tag_t asn_DEF_INTEGER_tags[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (2 << 2))
 };
 asn_TYPE_descriptor_t asn_DEF_INTEGER = {
@@ -24,8 +24,13 @@ asn_TYPE_descriptor_t asn_DEF_INTEGER = {
 	INTEGER_encode_der,
 	INTEGER_decode_xer,
 	INTEGER_encode_xer,
+#ifdef	ASN_DISABLE_PER_SUPPORT
+	0,
+	0,
+#else
 	INTEGER_decode_uper,	/* Unaligned PER decoder */
 	INTEGER_encode_uper,	/* Unaligned PER encoder */
+#endif	/* ASN_DISABLE_PER_SUPPORT */
 	0, /* Use generic outmost tag fetcher */
 	asn_DEF_INTEGER_tags,
 	sizeof(asn_DEF_INTEGER_tags) / sizeof(asn_DEF_INTEGER_tags[0]),
@@ -101,52 +106,35 @@ static const asn_INTEGER_enum_map_t *INTEGER_map_enum2value(asn_INTEGER_specific
 * INTEGER specific human-readable output.
 */
 static ssize_t
-INTEGER__dump(asn_TYPE_descriptor_t *td, const INTEGER_t *st, asn_app_consume_bytes_f *cb, void *app_key, int plainOrXER) {
+INTEGER__dump(const asn_TYPE_descriptor_t *td, const INTEGER_t *st, asn_app_consume_bytes_f *cb, void *app_key, int plainOrXER) {
 	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	char scratch[32];	/* Enough for 64-bit integer */
 	uint8_t *buf = st->buf;
 	uint8_t *buf_end = st->buf + st->size;
-	signed long accum;
+	signed long value;
 	ssize_t wrote = 0;
 	char *p;
 	int ret;

-	/*
-	 * Advance buf pointer until the start of the value's body.
-	 * This will make us able to process large integers using simple case,
-	 * when the actual value is small
-	 * (0x0000000000abcdef would yield a fine 0x00abcdef)
-	 */
-	/* Skip the insignificant leading bytes */
-	for(; buf < buf_end-1; buf++) {
-		switch(*buf) {
-		case 0x00: if((buf[1] & 0x80) == 0) continue; break;
-		case 0xff: if((buf[1] & 0x80) != 0) continue; break;
-		}
-		break;
-	}
+	if(specs && specs->field_unsigned)
+		ret = asn_INTEGER2ulong(st, (unsigned long *)&value);
+	else
+		ret = asn_INTEGER2long(st, &value);

 	/* Simple case: the integer size is small */
-	if((size_t)(buf_end - buf) <= sizeof(accum)) {
+	if(ret == 0) {
 		const asn_INTEGER_enum_map_t *el;
 		size_t scrsize;
 		char *scr;

-		if(buf == buf_end) {
-			accum = 0;
-		} else {
-			accum = (*buf & 0x80) ? -1 : 0;
-			for(; buf < buf_end; buf++)
-				accum = (accum << 8) | *buf;
-		}
-
-		el = INTEGER_map_value2enum(specs, accum);
+		el = (value >= 0 || !specs || !specs->field_unsigned)
+			? INTEGER_map_value2enum(specs, value) : 0;
 		if(el) {
 			scrsize = el->enum_len + 32;
 			scr = (char *)alloca(scrsize);
 			if(plainOrXER == 0)
 				ret = snprintf(scr, scrsize,
-					"%ld (%s)", accum, el->enum_name);
+					"%ld (%s)", value, el->enum_name);
 			else
 				ret = snprintf(scr, scrsize,
 					"<%s/>", el->enum_name);
@@ -158,7 +146,9 @@ INTEGER__dump(asn_TYPE_descriptor_t *td, const INTEGER_t *st, asn_app_consume_by
 		} else {
 			scrsize = sizeof(scratch);
 			scr = scratch;
-			ret = snprintf(scr, scrsize, "%ld", accum);
+			ret = snprintf(scr, scrsize,
+				(specs && specs->field_unsigned)
+				?"%lu":"%ld", value);
 		}
 		assert(ret > 0 && (size_t)ret < scrsize);
 		return (cb(scr, ret, app_key) < 0) ? -1 : ret;
@@ -176,7 +166,7 @@ INTEGER__dump(asn_TYPE_descriptor_t *td, const INTEGER_t *st, asn_app_consume_by
 	/* Output in the long xx:yy:zz... format */
 	/* TODO: replace with generic algorithm (Knuth TAOCP Vol 2, 4.3.1) */
 	for(p = scratch; buf < buf_end; buf++) {
-		static const char *h2c = "0123456789ABCDEF";
+		const char * const h2c = "0123456789ABCDEF";
 		if((p - scratch) >= (ssize_t)(sizeof(scratch) - 4)) {
 			/* Flush buffer */
 			if(cb(scratch, p - scratch, app_key) < 0)
@@ -218,8 +208,8 @@ INTEGER_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 struct e2v_key {
 	const char *start;
 	const char *stop;
-	asn_INTEGER_enum_map_t *vemap;
-	unsigned int *evmap;
+	const asn_INTEGER_enum_map_t *vemap;
+	const unsigned int *evmap;
 };
 static int
 INTEGER__compar_enum2value(const void *kp, const void *am) {
@@ -242,7 +232,7 @@ INTEGER__compar_enum2value(const void *kp, const void *am) {

 static const asn_INTEGER_enum_map_t *
 INTEGER_map_enum2value(asn_INTEGER_specifics_t *specs, const char *lstart, const char *lstop) {
-	asn_INTEGER_enum_map_t *el_found;
+	const asn_INTEGER_enum_map_t *el_found;
 	int count = specs ? specs->map_count : 0;
 	struct e2v_key key;
 	const char *lp;
@@ -317,57 +307,71 @@ INTEGER_st_prealloc(INTEGER_t *st, int min_size) {
 static enum xer_pbd_rval
 INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chunk_buf, size_t chunk_size) {
 	INTEGER_t *st = (INTEGER_t *)sptr;
-	long sign = 1;
-	long value;
+	long dec_value;
+	long hex_value = 0;
 	const char *lp;
 	const char *lstart = (const char *)chunk_buf;
 	const char *lstop = lstart + chunk_size;
 	enum {
-		ST_SKIPSPACE,
+		ST_LEADSPACE,
 		ST_SKIPSPHEX,
 		ST_WAITDIGITS,
 		ST_DIGITS,
+		ST_DIGITS_TRAILSPACE,
 		ST_HEXDIGIT1,
 		ST_HEXDIGIT2,
+		ST_HEXDIGITS_TRAILSPACE,
 		ST_HEXCOLON,
-		ST_EXTRASTUFF
-	} state = ST_SKIPSPACE;
+		ST_END_ENUM,
+		ST_UNEXPECTED
+	} state = ST_LEADSPACE;
+	const char *dec_value_start = 0; /* INVARIANT: always !0 in ST_DIGITS */
+	const char *dec_value_end = 0;

 	if(chunk_size)
-		ASN_DEBUG("INTEGER body %d 0x%2x..0x%2x",
-			chunk_size, *lstart, lstop[-1]);
+		ASN_DEBUG("INTEGER body %ld 0x%2x..0x%2x",
+			(long)chunk_size, *lstart, lstop[-1]);
+
+	if(INTEGER_st_prealloc(st, (chunk_size/3) + 1))
+		return XPBD_SYSTEM_FAILURE;

 	/*
 	 * We may have received a tag here. It will be processed inline.
 	 * Use strtoul()-like code and serialize the result.
 	 */
-	for(value = 0, lp = lstart; lp < lstop; lp++) {
+	for(lp = lstart; lp < lstop; lp++) {
 		int lv = *lp;
 		switch(lv) {
 		case 0x09: case 0x0a: case 0x0d: case 0x20:
 			switch(state) {
-			case ST_SKIPSPACE:
+			case ST_LEADSPACE:
+			case ST_DIGITS_TRAILSPACE:
+			case ST_HEXDIGITS_TRAILSPACE:
 			case ST_SKIPSPHEX:
 				continue;
+			case ST_DIGITS:
+				dec_value_end = lp;
+				state = ST_DIGITS_TRAILSPACE;
+				continue;
 			case ST_HEXCOLON:
-				if(xer_is_whitespace(lp, lstop - lp)) {
-					lp = lstop - 1;
-					continue;
-				}
-				break;
+				state = ST_HEXDIGITS_TRAILSPACE;
+				continue;
 			default:
 				break;
 			}
 			break;
 		case 0x2d:	/* '-' */
-			if(state == ST_SKIPSPACE) {
-				sign = -1;
+			if(state == ST_LEADSPACE) {
+				dec_value = 0;
+				dec_value_start = lp;
 				state = ST_WAITDIGITS;
 				continue;
 			}
 			break;
 		case 0x2b:	/* '+' */
-			if(state == ST_SKIPSPACE) {
+			if(state == ST_LEADSPACE) {
+				dec_value = 0;
+				dec_value_start = lp;
 				state = ST_WAITDIGITS;
 				continue;
 			}
@@ -375,48 +379,32 @@ INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chun
 		case 0x30: case 0x31: case 0x32: case 0x33: case 0x34:
 		case 0x35: case 0x36: case 0x37: case 0x38: case 0x39:
 			switch(state) {
-			case ST_DIGITS: break;
+			case ST_DIGITS: continue;
 			case ST_SKIPSPHEX:	/* Fall through */
 			case ST_HEXDIGIT1:
-				value = (lv - 0x30) << 4;
+				hex_value = (lv - 0x30) << 4;
 				state = ST_HEXDIGIT2;
 				continue;
 			case ST_HEXDIGIT2:
-				value += (lv - 0x30);
+				hex_value += (lv - 0x30);
 				state = ST_HEXCOLON;
-				st->buf[st->size++] = value;
+				st->buf[st->size++] = (uint8_t)hex_value;
 				continue;
 			case ST_HEXCOLON:
 				return XPBD_BROKEN_ENCODING;
-			default:
+			case ST_LEADSPACE:
+				dec_value = 0;
+				dec_value_start = lp;
+				/* FALL THROUGH */
+			case ST_WAITDIGITS:
 				state = ST_DIGITS;
+				continue;
+			default:
 				break;
 			}
-
-		    {
-			long new_value = value * 10;
-
-			if(new_value / 10 != value)
-				/* Overflow */
-				return XPBD_DECODER_LIMIT;
-
-			value = new_value + (lv - 0x30);
-			/* Check for two's complement overflow */
-			if(value < 0) {
-				/* Check whether it is a LONG_MIN */
-				if(sign == -1
-				&& (unsigned long)value
-						== ~((unsigned long)-1 >> 1)) {
-					sign = 1;
-				} else {
-					/* Overflow */
-					return XPBD_DECODER_LIMIT;
-				}
-			}
-		    }
-			continue;
-		case 0x3c:	/* '<' */
-			if(state == ST_SKIPSPACE) {
+			break;
+		case 0x3c:	/* '<', start of XML encoded enumeration */
+			if(state == ST_LEADSPACE) {
 				const asn_INTEGER_enum_map_t *el;
 				el = INTEGER_map_enum2value(
 					(asn_INTEGER_specifics_t *)
@@ -424,8 +412,8 @@ INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chun
 				if(el) {
 					ASN_DEBUG("Found \"%s\" => %ld",
 						el->enum_name, el->nat_value);
-					state = ST_DIGITS;
-					value = el->nat_value;
+					dec_value = el->nat_value;
+					state = ST_END_ENUM;
 					lp = lstop - 1;
 					continue;
 				}
@@ -443,13 +431,12 @@ INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chun
 				 * places as a decimal value.
 				 * Switch decoding mode. */
 				ASN_DEBUG("INTEGER re-evaluate as hex form");
-				if(INTEGER_st_prealloc(st, (chunk_size/3) + 1))
-					return XPBD_SYSTEM_FAILURE;
 				state = ST_SKIPSPHEX;
+				dec_value_start = 0;
 				lp = lstart - 1;
 				continue;
 			} else {
-				ASN_DEBUG("state %d at %d", state, lp - lstart);
+				ASN_DEBUG("state %d at %ld", state, (long)(lp - lstart));
 				break;
 			}
 		/* [A-Fa-f] */
@@ -457,24 +444,23 @@ INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chun
 		case 0x61:case 0x62:case 0x63:case 0x64:case 0x65:case 0x66:
 			switch(state) {
 			case ST_SKIPSPHEX:
-			case ST_SKIPSPACE: /* Fall through */
+			case ST_LEADSPACE: /* Fall through */
 			case ST_HEXDIGIT1:
-				value = lv - ((lv < 0x61) ? 0x41 : 0x61);
-				value += 10;
-				value <<= 4;
+				hex_value = lv - ((lv < 0x61) ? 0x41 : 0x61);
+				hex_value += 10;
+				hex_value <<= 4;
 				state = ST_HEXDIGIT2;
 				continue;
 			case ST_HEXDIGIT2:
-				value += lv - ((lv < 0x61) ? 0x41 : 0x61);
-				value += 10;
-				st->buf[st->size++] = value;
+				hex_value += lv - ((lv < 0x61) ? 0x41 : 0x61);
+				hex_value += 10;
+				st->buf[st->size++] = (uint8_t)hex_value;
 				state = ST_HEXCOLON;
 				continue;
 			case ST_DIGITS:
 				ASN_DEBUG("INTEGER re-evaluate as hex form");
-				if(INTEGER_st_prealloc(st, (chunk_size/3) + 1))
-					return XPBD_SYSTEM_FAILURE;
 				state = ST_SKIPSPHEX;
+				dec_value_start = 0;
 				lp = lstart - 1;
 				continue;
 			default:
@@ -484,39 +470,54 @@ INTEGER__xer_body_decode(asn_TYPE_descriptor_t *td, void *sptr, const void *chun
 		}

 		/* Found extra non-numeric stuff */
-		ASN_DEBUG("Found non-numeric 0x%2x at %d",
-			lv, lp - lstart);
-		state = ST_EXTRASTUFF;
+		ASN_DEBUG("INTEGER :: Found non-numeric 0x%2x at %ld",
+			lv, (long)(lp - lstart));
+		state = ST_UNEXPECTED;
 		break;
 	}

 	switch(state) {
+	case ST_END_ENUM:
+		/* Got a complete and valid enumeration encoded as a tag. */
+		break;
 	case ST_DIGITS:
-		/* Everything is cool */
+		dec_value_end = lstop;
+		/* FALL THROUGH */
+	case ST_DIGITS_TRAILSPACE:
+		/* The last symbol encountered was a digit. */
+		switch(asn_strtol_lim(dec_value_start, &dec_value_end, &dec_value)) {
+		case ASN_STRTOL_OK:
+			break;
+		case ASN_STRTOL_ERROR_RANGE:
+			return XPBD_DECODER_LIMIT;
+		case ASN_STRTOL_ERROR_INVAL:
+		case ASN_STRTOL_EXPECT_MORE:
+		case ASN_STRTOL_EXTRA_DATA:
+			return XPBD_BROKEN_ENCODING;
+		}
 		break;
 	case ST_HEXCOLON:
+	case ST_HEXDIGITS_TRAILSPACE:
 		st->buf[st->size] = 0;	/* Just in case termination */
 		return XPBD_BODY_CONSUMED;
 	case ST_HEXDIGIT1:
 	case ST_HEXDIGIT2:
 	case ST_SKIPSPHEX:
 		return XPBD_BROKEN_ENCODING;
-	default:
-		if(xer_is_whitespace(lp, lstop - lp)) {
-			if(state != ST_EXTRASTUFF)
-				return XPBD_NOT_BODY_IGNORE;
-			break;
-		} else {
-			ASN_DEBUG("INTEGER: No useful digits (state %d)",
-				state);
-			return XPBD_BROKEN_ENCODING;	/* No digits */
-		}
-		break;
+	case ST_LEADSPACE:
+		/* Content not found */
+		return XPBD_NOT_BODY_IGNORE;
+	case ST_WAITDIGITS:
+	case ST_UNEXPECTED:
+		ASN_DEBUG("INTEGER: No useful digits (state %d)", state);
+		return XPBD_BROKEN_ENCODING;	/* No digits */
 	}

-	value *= sign;	/* Change sign, if needed */
-
-	if(asn_long2INTEGER(st, value))
+	/*
+	 * Convert the result of parsing of enumeration or a straight
+	 * decimal value into a BER representation.
+	 */
+	if(asn_long2INTEGER(st, dec_value))
 		return XPBD_SYSTEM_FAILURE;

 	return XPBD_BODY_CONSUMED;
@@ -543,17 +544,20 @@ INTEGER_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	(void)flags;
 	
 	if(!st || !st->buf)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	er.encoded = INTEGER__dump(td, st, cb, app_key, 1);
-	if(er.encoded < 0) _ASN_ENCODE_FAILED;
+	if(er.encoded < 0) ASN__ENCODE_FAILED;

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

+#ifndef	ASN_DISABLE_PER_SUPPORT
+
 asn_dec_rval_t
 INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void **sptr, asn_per_data_t *pd) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	asn_dec_rval_t rval = { RC_OK, 0 };
 	INTEGER_t *st = (INTEGER_t *)*sptr;
 	asn_per_constraint_t *ct;
@@ -563,7 +567,7 @@ INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 	if(!st) {
 		st = (INTEGER_t *)(*sptr = CALLOC(1, sizeof(*st)));
-		if(!st) _ASN_DECODE_FAILED;
+		if(!st) ASN__DECODE_FAILED;
 	}

 	if(!constraints) constraints = td->per_constraints;
@@ -571,40 +575,55 @@ INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 	if(ct && ct->flags & APC_EXTENSIBLE) {
 		int inext = per_get_few_bits(pd, 1);
-		if(inext < 0) _ASN_DECODE_STARVED;
+		if(inext < 0) ASN__DECODE_STARVED;
 		if(inext) ct = 0;
 	}

 	FREEMEM(st->buf);
+	st->buf = 0;
+	st->size = 0;
 	if(ct) {
 		if(ct->flags & APC_SEMI_CONSTRAINED) {
 			st->buf = (uint8_t *)CALLOC(1, 2);
-			if(!st->buf) _ASN_DECODE_FAILED;
+			if(!st->buf) ASN__DECODE_FAILED;
 			st->size = 1;
 		} else if(ct->flags & APC_CONSTRAINED && ct->range_bits >= 0) {
 			size_t size = (ct->range_bits + 7) >> 3;
 			st->buf = (uint8_t *)MALLOC(1 + size + 1);
-			if(!st->buf) _ASN_DECODE_FAILED;
+			if(!st->buf) ASN__DECODE_FAILED;
 			st->size = size;
-		} else {
-			st->size = 0;
 		}
-	} else {
-		st->size = 0;
 	}

-	/* X.691, #12.2.2 */
+	/* X.691-2008/11, #13.2.2, constrained whole number */
 	if(ct && ct->flags != APC_UNCONSTRAINED) {
-		/* #10.5.6 */
+		/* #11.5.6 */
 		ASN_DEBUG("Integer with range %d bits", ct->range_bits);
 		if(ct->range_bits >= 0) {
-			long value = per_get_few_bits(pd, ct->range_bits);
-			if(value < 0) _ASN_DECODE_STARVED;
-			ASN_DEBUG("Got value %ld + low %ld",
-				value, ct->lower_bound);
-			value += ct->lower_bound;
-			if(asn_long2INTEGER(st, value))
-				_ASN_DECODE_FAILED;
+			if((size_t)ct->range_bits > 8 * sizeof(unsigned long))
+				ASN__DECODE_FAILED;
+
+			if(specs && specs->field_unsigned) {
+				unsigned long uvalue;
+				if(uper_get_constrained_whole_number(pd,
+					&uvalue, ct->range_bits))
+					ASN__DECODE_STARVED;
+				ASN_DEBUG("Got value %lu + low %ld",
+					uvalue, ct->lower_bound);
+				uvalue += ct->lower_bound;
+				if(asn_ulong2INTEGER(st, uvalue))
+					ASN__DECODE_FAILED;
+			} else {
+				unsigned long svalue;
+				if(uper_get_constrained_whole_number(pd,
+					&svalue, ct->range_bits))
+					ASN__DECODE_STARVED;
+				ASN_DEBUG("Got value %ld + low %ld",
+					svalue, ct->lower_bound);
+				svalue += ct->lower_bound;
+				if(asn_long2INTEGER(st, svalue))
+					ASN__DECODE_FAILED;
+			}
 			return rval;
 		}
 	} else {
@@ -619,14 +638,14 @@ INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 		/* Get the PER length */
 		len = uper_get_length(pd, -1, &repeat);
-		if(len < 0) _ASN_DECODE_STARVED;
+		if(len < 0) ASN__DECODE_STARVED;

 		p = REALLOC(st->buf, st->size + len + 1);
-		if(!p) _ASN_DECODE_FAILED;
+		if(!p) ASN__DECODE_FAILED;
 		st->buf = (uint8_t *)p;

 		ret = per_get_many_bits(pd, &st->buf[st->size], 0, 8 * len);
-		if(ret < 0) _ASN_DECODE_STARVED;
+		if(ret < 0) ASN__DECODE_STARVED;
 		st->size += len;
 	} while(repeat);
 	st->buf[st->size] = 0;	/* JIC */
@@ -638,9 +657,9 @@ INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		 */
 		long value;
 		if(asn_INTEGER2long(st, &value))
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 		if(asn_long2INTEGER(st, value + ct->lower_bound))
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 	}

 	return rval;
@@ -649,14 +668,16 @@ INTEGER_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 asn_enc_rval_t
 INTEGER_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void *sptr, asn_per_outp_t *po) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	asn_enc_rval_t er;
 	INTEGER_t *st = (INTEGER_t *)sptr;
 	const uint8_t *buf;
 	const uint8_t *end;
 	asn_per_constraint_t *ct;
 	long value = 0;
+	unsigned long v = 0;

-	if(!st || st->size == 0) _ASN_ENCODE_FAILED;
+	if(!st || st->size == 0) ASN__ENCODE_FAILED;

 	if(!constraints) constraints = td->per_constraints;
 	ct = constraints ? &constraints->value : 0;
@@ -665,60 +686,82 @@ INTEGER_encode_uper(asn_TYPE_descriptor_t *td,

 	if(ct) {
 		int inext = 0;
-		if(asn_INTEGER2long(st, &value))
-			_ASN_ENCODE_FAILED;
-		/* Check proper range */
-		if(ct->flags & APC_SEMI_CONSTRAINED) {
-			if(value < ct->lower_bound)
-				inext = 1;
-		} else if(ct->range_bits >= 0) {
-			if(value < ct->lower_bound
-			|| value > ct->upper_bound)
-				inext = 1;
+		if(specs && specs->field_unsigned) {
+			unsigned long uval;
+			if(asn_INTEGER2ulong(st, &uval))
+				ASN__ENCODE_FAILED;
+			/* Check proper range */
+			if(ct->flags & APC_SEMI_CONSTRAINED) {
+				if(uval < (unsigned long)ct->lower_bound)
+					inext = 1;
+			} else if(ct->range_bits >= 0) {
+				if(uval < (unsigned long)ct->lower_bound
+				|| uval > (unsigned long)ct->upper_bound)
+					inext = 1;
+			}
+			ASN_DEBUG("Value %lu (%02x/%d) lb %lu ub %lu %s",
+				uval, st->buf[0], st->size,
+				ct->lower_bound, ct->upper_bound,
+				inext ? "ext" : "fix");
+			value = uval;
+		} else {
+			if(asn_INTEGER2long(st, &value))
+				ASN__ENCODE_FAILED;
+			/* Check proper range */
+			if(ct->flags & APC_SEMI_CONSTRAINED) {
+				if(value < ct->lower_bound)
+					inext = 1;
+			} else if(ct->range_bits >= 0) {
+				if(value < ct->lower_bound
+				|| value > ct->upper_bound)
+					inext = 1;
+			}
+			ASN_DEBUG("Value %ld (%02x/%d) lb %ld ub %ld %s",
+				value, st->buf[0], st->size,
+				ct->lower_bound, ct->upper_bound,
+				inext ? "ext" : "fix");
 		}
-		ASN_DEBUG("Value %ld (%02x/%d) lb %ld ub %ld %s",
-			value, st->buf[0], st->size,
-			ct->lower_bound, ct->upper_bound,
-			inext ? "ext" : "fix");
 		if(ct->flags & APC_EXTENSIBLE) {
 			if(per_put_few_bits(po, inext, 1))
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			if(inext) ct = 0;
 		} else if(inext) {
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 		}
 	}


-	/* X.691, #12.2.2 */
+	/* X.691-11/2008, #13.2.2, test if constrained whole number */
 	if(ct && ct->range_bits >= 0) {
-		/* #10.5.6 */
-		ASN_DEBUG("Encoding integer with range %d bits",
-			ct->range_bits);
-		if(per_put_few_bits(po, value - ct->lower_bound,
-				ct->range_bits))
-			_ASN_ENCODE_FAILED;
-		_ASN_ENCODED_OK(er);
+		/* #11.5.6 -> #11.3 */
+		ASN_DEBUG("Encoding integer %ld (%lu) with range %d bits",
+			value, value - ct->lower_bound, ct->range_bits);
+		v = value - ct->lower_bound;
+		if(uper_put_constrained_whole_number_u(po, v, ct->range_bits))
+			ASN__ENCODE_FAILED;
+		ASN__ENCODED_OK(er);
 	}

 	if(ct && ct->lower_bound) {
 		ASN_DEBUG("Adjust lower bound to %ld", ct->lower_bound);
 		/* TODO: adjust lower bound */
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}

 	for(buf = st->buf, end = st->buf + st->size; buf < end;) {
 		ssize_t mayEncode = uper_put_length(po, end - buf);
 		if(mayEncode < 0)
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 		if(per_put_many_bits(po, buf, 8 * mayEncode))
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 		buf += mayEncode;
 	}

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

+#endif	/* ASN_DISABLE_PER_SUPPORT */
+
 int
 asn_INTEGER2long(const INTEGER_t *iptr, long *lptr) {
 	uint8_t *b, *end;
@@ -779,6 +822,63 @@ asn_INTEGER2long(const INTEGER_t *iptr, long *lptr) {
 	return 0;
 }

+int
+asn_INTEGER2ulong(const INTEGER_t *iptr, unsigned long *lptr) {
+	uint8_t *b, *end;
+	unsigned long l;
+	size_t size;
+
+	if(!iptr || !iptr->buf || !lptr) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	b = iptr->buf;
+	size = iptr->size;
+	end = b + size;
+
+	/* If all extra leading bytes are zeroes, ignore them */
+	for(; size > sizeof(unsigned long); b++, size--) {
+		if(*b) {
+			/* Value won't fit unsigned long */
+			errno = ERANGE;
+			return -1;
+		}
+	}
+
+	/* Conversion engine */
+	for(l = 0; b < end; b++)
+		l = (l << 8) | *b;
+
+	*lptr = l;
+	return 0;
+}
+
+int
+asn_ulong2INTEGER(INTEGER_t *st, unsigned long value) {
+	uint8_t *buf;
+	uint8_t *end;
+	uint8_t *b;
+	int shr;
+
+	if(value <= LONG_MAX)
+		return asn_long2INTEGER(st, value);
+
+	buf = (uint8_t *)MALLOC(1 + sizeof(value));
+	if(!buf) return -1;
+
+	end = buf + (sizeof(value) + 1);
+	buf[0] = 0;
+	for(b = buf + 1, shr = (sizeof(long)-1)*8; b < end; shr -= 8, b++)
+		*b = (uint8_t)(value >> shr);
+
+	if(st->buf) FREEMEM(st->buf);
+	st->buf = buf;
+	st->size = 1 + sizeof(value);
+
+	return 0;
+}
+
 int
 asn_long2INTEGER(INTEGER_t *st, long value) {
 	uint8_t *buf, *bp;
@@ -833,3 +933,93 @@ asn_long2INTEGER(INTEGER_t *st, long value) {

 	return 0;
 }
+
+/*
+ * This function is going to be DEPRECATED soon.
+ */
+enum asn_strtol_result_e
+asn_strtol(const char *str, const char *end, long *lp) {
+    const char *endp = end;
+
+    switch(asn_strtol_lim(str, &endp, lp)) {
+    case ASN_STRTOL_ERROR_RANGE:
+        return ASN_STRTOL_ERROR_RANGE;
+    case ASN_STRTOL_ERROR_INVAL:
+        return ASN_STRTOL_ERROR_INVAL;
+    case ASN_STRTOL_EXPECT_MORE:
+        return ASN_STRTOL_ERROR_INVAL;  /* Retain old behavior */
+    case ASN_STRTOL_OK:
+        return ASN_STRTOL_OK;
+    case ASN_STRTOL_EXTRA_DATA:
+        return ASN_STRTOL_ERROR_INVAL;  /* Retain old behavior */
+    }
+
+    return ASN_STRTOL_ERROR_INVAL;  /* Retain old behavior */
+}
+
+/*
+ * Parse the number in the given string until the given *end position,
+ * returning the position after the last parsed character back using the
+ * same (*end) pointer.
+ * WARNING: This behavior is different from the standard strtol(3).
+ */
+enum asn_strtol_result_e
+asn_strtol_lim(const char *str, const char **end, long *lp) {
+	int sign = 1;
+	long l;
+
+	const long upper_boundary = LONG_MAX / 10;
+	long last_digit_max = LONG_MAX % 10;
+
+	if(str >= *end) return ASN_STRTOL_ERROR_INVAL;
+
+	switch(*str) {
+	case '-':
+		last_digit_max++;
+		sign = -1;
+		/* FALL THROUGH */
+	case '+':
+		str++;
+		if(str >= *end) {
+			*end = str;
+			return ASN_STRTOL_EXPECT_MORE;
+		}
+	}
+
+	for(l = 0; str < (*end); str++) {
+		switch(*str) {
+		case 0x30: case 0x31: case 0x32: case 0x33: case 0x34:
+		case 0x35: case 0x36: case 0x37: case 0x38: case 0x39: {
+			int d = *str - '0';
+			if(l < upper_boundary) {
+				l = l * 10 + d;
+			} else if(l == upper_boundary) {
+				if(d <= last_digit_max) {
+					if(sign > 0) {
+						l = l * 10 + d;
+					} else {
+						sign = 1;
+						l = -l * 10 - d;
+					}
+				} else {
+					*end = str;
+					return ASN_STRTOL_ERROR_RANGE;
+				}
+			} else {
+				*end = str;
+				return ASN_STRTOL_ERROR_RANGE;
+			}
+		    }
+		    continue;
+		default:
+		    *end = str;
+		    *lp = sign * l;
+		    return ASN_STRTOL_EXTRA_DATA;
+		}
+	}
+
+	*end = str;
+	*lp = sign * l;
+	return ASN_STRTOL_OK;
+}
+
--- a/asn1/asn1c/INTEGER.h
+++ b/asn1/asn1c/INTEGER.h
@@ -24,12 +24,14 @@ typedef struct asn_INTEGER_enum_map_s {
 } asn_INTEGER_enum_map_t;

 /* This type describes an enumeration for INTEGER and ENUMERATED types */
-typedef struct asn_INTEGER_specifics_s {
-	asn_INTEGER_enum_map_t *value2enum;	/* N -> "tag"; sorted by N */
-	unsigned int *enum2value;		/* "tag" => N; sorted by tag */
+typedef const struct asn_INTEGER_specifics_s {
+	const asn_INTEGER_enum_map_t *value2enum;	/* N -> "tag"; sorted by N */
+	const unsigned int *enum2value;		/* "tag" => N; sorted by tag */
 	int map_count;				/* Elements in either map */
 	int extension;				/* This map is extensible */
 	int strict_enumeration;			/* Enumeration set is fixed */
+	int field_width;			/* Size of native integer */
+	int field_unsigned;			/* Signed=0, unsigned=1 */
 } asn_INTEGER_specifics_t;

 asn_struct_print_f INTEGER_print;
@@ -51,7 +53,22 @@ per_type_encoder_f INTEGER_encode_uper;
 * -1/ENOMEM: Memory allocation failed (in asn_long2INTEGER()).
 */
 int asn_INTEGER2long(const INTEGER_t *i, long *l);
+int asn_INTEGER2ulong(const INTEGER_t *i, unsigned long *l);
 int asn_long2INTEGER(INTEGER_t *i, long l);
+int asn_ulong2INTEGER(INTEGER_t *i, unsigned long l);
+
+/* A a reified version of strtol(3) with nicer error reporting. */
+enum asn_strtol_result_e {
+    ASN_STRTOL_ERROR_RANGE = -3,  /* Input outside of numeric range for long type */
+    ASN_STRTOL_ERROR_INVAL = -2,  /* Invalid data encountered (e.g., "+-") */
+    ASN_STRTOL_EXPECT_MORE = -1,  /* More data expected (e.g. "+") */
+    ASN_STRTOL_OK          =  0,  /* Conversion succeded, number ends at (*end) */
+    ASN_STRTOL_EXTRA_DATA  =  1   /* Conversion succeded, but the string has extra stuff */
+};
+enum asn_strtol_result_e asn_strtol_lim(const char *str, const char **end, long *l);
+
+/* The asn_strtol is going to be DEPRECATED soon */
+enum asn_strtol_result_e asn_strtol(const char *str, const char *end, long *l);

 /*
 * Convert the integer value into the corresponding enumeration map entry.
--- a/asn1/asn1c/Int32.c
+++ b/asn1/asn1c/Int32.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "Int32.h"

 int
@@ -15,7 +13,7 @@ Int32_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	long value;
 	
 	if(!sptr) {
-		_ASN_CTFAIL(app_key, td, sptr,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: value not given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -23,11 +21,11 @@ Int32_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	
 	value = *(const long *)sptr;
 	
-	if((value >= -2147483648 && value <= 2147483647)) {
+	if((value >= (-2147483647L - 1) && value <= 2147483647)) {
 		/* Constraint check succeeded */
 		return 0;
 	} else {
-		_ASN_CTFAIL(app_key, td, sptr,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: constraint failed (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -42,6 +40,7 @@ static void
 Int32_1_inherit_TYPE_descriptor(asn_TYPE_descriptor_t *td) {
 	td->free_struct    = asn_DEF_NativeInteger.free_struct;
 	td->print_struct   = asn_DEF_NativeInteger.print_struct;
+	td->check_constraints = asn_DEF_NativeInteger.check_constraints;
 	td->ber_decoder    = asn_DEF_NativeInteger.ber_decoder;
 	td->der_encoder    = asn_DEF_NativeInteger.der_encoder;
 	td->xer_decoder    = asn_DEF_NativeInteger.xer_decoder;
@@ -99,7 +98,7 @@ Int32_encode_xer(asn_TYPE_descriptor_t *td, void *structure,
 	return td->xer_encoder(td, structure, ilevel, flags, cb, app_key);
 }

-static ber_tlv_tag_t asn_DEF_Int32_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_Int32_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (2 << 2))
 };
 asn_TYPE_descriptor_t asn_DEF_Int32 = {
--- a/asn1/asn1c/Int32.h
+++ b/asn1/asn1c/Int32.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_Int32_H_
@@ -36,3 +36,4 @@ xer_type_encoder_f Int32_encode_xer;
 #endif

 #endif	/* _Int32_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/KrbKey.c
+++ b/asn1/asn1c/KrbKey.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "KrbKey.h"

 static asn_TYPE_member_t asn_MBR_KrbKey_1[] = {
@@ -38,13 +36,13 @@ static asn_TYPE_member_t asn_MBR_KrbKey_1[] = {
 		"s2kparams"
 		},
 };
-static ber_tlv_tag_t asn_DEF_KrbKey_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_KrbKey_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
-static asn_TYPE_tag2member_t asn_MAP_KrbKey_tag2el_1[] = {
-    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* key at 28 */
-    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* salt at 29 */
-    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* s2kparams at 30 */
+static const asn_TYPE_tag2member_t asn_MAP_KrbKey_tag2el_1[] = {
+    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* key */
+    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 }, /* salt */
+    { (ASN_TAG_CLASS_CONTEXT | (2 << 2)), 2, 0, 0 } /* s2kparams */
 };
 static asn_SEQUENCE_specifics_t asn_SPC_KrbKey_specs_1 = {
 	sizeof(struct KrbKey),
--- a/asn1/asn1c/KrbKey.h
+++ b/asn1/asn1c/KrbKey.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_KrbKey_H_
@@ -44,3 +44,4 @@ extern asn_TYPE_descriptor_t asn_DEF_KrbKey;
 #include "TypeValuePair.h"

 #endif	/* _KrbKey_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/Makefile
+++ b/asn1/asn1c/Makefile
@@ -1,786 +0,0 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
-# asn1c/Makefile.  Generated from Makefile.in by configure.
-
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
-
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-
-
-
-
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
-am__make_running_with_option = \
-  case $${target_option-} in \
-      ?) ;; \
-      *) echo "am__make_running_with_option: internal error: invalid" \
-              "target option '$${target_option-}' specified" >&2; \
-         exit 1;; \
-  esac; \
-  has_opt=no; \
-  sane_makeflags=$$MAKEFLAGS; \
-  if $(am__is_gnu_make); then \
-    sane_makeflags=$$MFLAGS; \
-  else \
-    case $$MAKEFLAGS in \
-      *\\[\ \	]*) \
-        bs=\\; \
-        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
-          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
-    esac; \
-  fi; \
-  skip_next=no; \
-  strip_trailopt () \
-  { \
-    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
-  }; \
-  for flg in $$sane_makeflags; do \
-    test $$skip_next = yes && { skip_next=no; continue; }; \
-    case $$flg in \
-      *=*|--*) continue;; \
-        -*I) strip_trailopt 'I'; skip_next=yes;; \
-      -*I?*) strip_trailopt 'I';; \
-        -*O) strip_trailopt 'O'; skip_next=yes;; \
-      -*O?*) strip_trailopt 'O';; \
-        -*l) strip_trailopt 'l'; skip_next=yes;; \
-      -*l?*) strip_trailopt 'l';; \
-      -[dEDm]) skip_next=yes;; \
-      -[JT]) skip_next=yes;; \
-    esac; \
-    case $$flg in \
-      *$$target_option*) has_opt=yes; break;; \
-    esac; \
-  done; \
-  test $$has_opt = yes
-am__make_dryrun = (target_option=n; $(am__make_running_with_option))
-am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
-pkgdatadir = $(datadir)/ipa-server
-pkgincludedir = $(includedir)/ipa-server
-pkglibdir = $(libdir)/ipa-server
-pkglibexecdir = $(libexecdir)/ipa-server
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = x86_64-unknown-linux-gnu
-host_triplet = x86_64-unknown-linux-gnu
-subdir = asn1c
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
-	$(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(ASN1C_HEADERS) \
-	$(IPAASN1_HEADERS) $(noinst_HEADERS) $(am__DIST_COMMON)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_FILES =
-CONFIG_CLEAN_VPATH_FILES =
-LTLIBRARIES = $(noinst_LTLIBRARIES)
-libasn1c_la_LIBADD =
-am__objects_1 =
-am__objects_2 = INTEGER.lo NativeEnumerated.lo NativeInteger.lo \
-	asn_SEQUENCE_OF.lo asn_SET_OF.lo constr_CHOICE.lo \
-	constr_SEQUENCE.lo constr_SEQUENCE_OF.lo constr_SET_OF.lo \
-	OCTET_STRING.lo BIT_STRING.lo asn_codecs_prim.lo \
-	ber_tlv_length.lo ber_tlv_tag.lo ber_decoder.lo der_encoder.lo \
-	constr_TYPE.lo constraints.lo xer_support.lo xer_decoder.lo \
-	xer_encoder.lo per_support.lo per_decoder.lo per_encoder.lo \
-	$(am__objects_1)
-am__objects_3 = Int32.lo GetKeytabControl.lo GKNewKeys.lo \
-	GKCurrentKeys.lo GKReply.lo KrbKey.lo TypeValuePair.lo \
-	$(am__objects_1)
-am_libasn1c_la_OBJECTS = $(am__objects_2) $(am__objects_3)
-libasn1c_la_OBJECTS = $(am_libasn1c_la_OBJECTS)
-AM_V_lt = $(am__v_lt_$(V))
-am__v_lt_ = $(am__v_lt_$(AM_DEFAULT_VERBOSITY))
-am__v_lt_0 = --silent
-am__v_lt_1 = 
-AM_V_P = $(am__v_P_$(V))
-am__v_P_ = $(am__v_P_$(AM_DEFAULT_VERBOSITY))
-am__v_P_0 = false
-am__v_P_1 = :
-AM_V_GEN = $(am__v_GEN_$(V))
-am__v_GEN_ = $(am__v_GEN_$(AM_DEFAULT_VERBOSITY))
-am__v_GEN_0 = @echo "  GEN     " $@;
-am__v_GEN_1 = 
-AM_V_at = $(am__v_at_$(V))
-am__v_at_ = $(am__v_at_$(AM_DEFAULT_VERBOSITY))
-am__v_at_0 = @
-am__v_at_1 = 
-DEFAULT_INCLUDES = -I. -I$(top_builddir)
-depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
-am__mv = mv -f
-COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
-	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
-	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
-	$(AM_CFLAGS) $(CFLAGS)
-AM_V_CC = $(am__v_CC_$(V))
-am__v_CC_ = $(am__v_CC_$(AM_DEFAULT_VERBOSITY))
-am__v_CC_0 = @echo "  CC      " $@;
-am__v_CC_1 = 
-CCLD = $(CC)
-LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
-	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
-	$(AM_LDFLAGS) $(LDFLAGS) -o $@
-AM_V_CCLD = $(am__v_CCLD_$(V))
-am__v_CCLD_ = $(am__v_CCLD_$(AM_DEFAULT_VERBOSITY))
-am__v_CCLD_0 = @echo "  CCLD    " $@;
-am__v_CCLD_1 = 
-SOURCES = $(libasn1c_la_SOURCES)
-DIST_SOURCES = $(libasn1c_la_SOURCES)
-am__can_run_installinfo = \
-  case $$AM_UPDATE_INFO_DIR in \
-    n|no|NO) false;; \
-    *) (install-info --version) >/dev/null 2>&1;; \
-  esac
-am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
-am__vpath_adj = case $$p in \
-    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
-    *) f=$$p;; \
-  esac;
-am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
-am__install_max = 40
-am__nobase_strip_setup = \
-  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
-am__nobase_strip = \
-  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
-am__nobase_list = $(am__nobase_strip_setup); \
-  for p in $$list; do echo "$$p $$p"; done | \
-  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
-  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
-    if (++n[$$2] == $(am__install_max)) \
-      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
-    END { for (dir in files) print dir, files[dir] }'
-am__base_list = \
-  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
-  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
-am__uninstall_files_from_dir = { \
-  test -z "$$files" \
-    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
-    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
-         $(am__cd) "$$dir" && rm -f $$files; }; \
-  }
-am__installdirs = "$(DESTDIR)$(ASN1Cdir)" "$(DESTDIR)$(IPAASN1dir)"
-HEADERS = $(ASN1C_HEADERS) $(IPAASN1_HEADERS) $(noinst_HEADERS)
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-# Read a list of newline-separated strings from the standard input,
-# and print each of them once, without duplicates.  Input order is
-# *not* preserved.
-am__uniquify_input = $(AWK) '\
-  BEGIN { nonempty = 0; } \
-  { items[$$0] = 1; nonempty = 1; } \
-  END { if (nonempty) { for (i in items) print i; }; } \
-'
-# Make sure the list of sources is unique.  This is necessary because,
-# e.g., the same source file might be shared among _SOURCES variables
-# for different programs/libraries.
-am__define_uniq_tagged_files = \
-  list='$(am__tagged_files)'; \
-  unique=`for i in $$list; do \
-    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-  done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-ACLOCAL = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing aclocal-1.15
-AMTAR = $${TAR-tar}
-AM_DEFAULT_VERBOSITY = 1
-AR = ar
-AUTOCONF = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing autoconf
-AUTOHEADER = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing autoheader
-AUTOMAKE = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing automake-1.15
-AWK = gawk
-CC = gcc
-CCDEPMODE = depmode=gcc3
-CFLAGS = -g -O2 -Wall -Wextra -Wformat-security -Wno-unused-parameter -Wno-sign-compare -Wno-missing-field-initializers 
-CPP = gcc -E
-CPPFLAGS = 
-CYGPATH_W = echo
-DEFS = -DHAVE_CONFIG_H
-DEPDIR = .deps
-DLLTOOL = false
-DSYMUTIL = 
-DUMPBIN = 
-ECHO_C = 
-ECHO_N = -n
-ECHO_T = 
-EGREP = /usr/bin/grep -E
-EXEEXT = 
-FGREP = /usr/bin/grep -F
-GREP = /usr/bin/grep
-INSTALL = /usr/bin/install -c
-INSTALL_DATA = ${INSTALL} -m 644
-INSTALL_PROGRAM = ${INSTALL}
-INSTALL_SCRIPT = ${INSTALL}
-INSTALL_STRIP_PROGRAM = $(install_sh) -c -s
-LD = /usr/bin/ld -m elf_x86_64
-LDFLAGS = 
-LIBOBJS = 
-LIBS = 
-LIBTOOL = $(SHELL) $(top_builddir)/libtool
-LIPO = 
-LN_S = ln -s
-LTLIBOBJS = 
-LT_SYS_LIBRARY_PATH = 
-MAINT = #
-MAKEINFO = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/missing makeinfo
-MANIFEST_TOOL = :
-MKDIR_P = /usr/bin/mkdir -p
-NM = /usr/bin/nm -B
-NMEDIT = 
-OBJDUMP = objdump
-OBJEXT = o
-OTOOL = 
-OTOOL64 = 
-PACKAGE = ipa-server
-PACKAGE_BUGREPORT = https://hosted.fedoraproject.org/projects/freeipa/newticket
-PACKAGE_NAME = ipa-server
-PACKAGE_STRING = ipa-server 4.3.1
-PACKAGE_TARNAME = ipa-server
-PACKAGE_URL = 
-PACKAGE_VERSION = 4.3.1
-PATH_SEPARATOR = :
-RANLIB = ranlib
-SED = /usr/bin/sed
-SET_MAKE = 
-SHELL = /bin/sh
-STRIP = strip
-VERSION = 4.3.1
-abs_builddir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/asn1c
-abs_srcdir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/asn1c
-abs_top_builddir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-abs_top_srcdir = /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1
-ac_ct_AR = ar
-ac_ct_CC = gcc
-ac_ct_DUMPBIN = 
-am__include = include
-am__leading_dot = .
-am__quote = 
-am__tar = $${TAR-tar} chof - "$$tardir"
-am__untar = $${TAR-tar} xf -
-bindir = ${exec_prefix}/bin
-build = x86_64-unknown-linux-gnu
-build_alias = 
-build_cpu = x86_64
-build_os = linux-gnu
-build_vendor = unknown
-builddir = .
-datadir = ${datarootdir}
-datarootdir = ${prefix}/share
-docdir = ${datarootdir}/doc/${PACKAGE_TARNAME}
-dvidir = ${docdir}
-exec_prefix = ${prefix}
-host = x86_64-unknown-linux-gnu
-host_alias = 
-host_cpu = x86_64
-host_os = linux-gnu
-host_vendor = unknown
-htmldir = ${docdir}
-includedir = ${prefix}/include
-infodir = ${datarootdir}/info
-install_sh = ${SHELL} /home/pvoborni/dev/freeipa/freeipa/dist/freeipa-4.3.1/asn1/install-sh
-libdir = /usr/lib
-libexecdir = ${exec_prefix}/libexec
-localedir = ${datarootdir}/locale
-localstatedir = /var
-mandir = ${datarootdir}/man
-mkdir_p = $(MKDIR_P)
-oldincludedir = /usr/include
-pdfdir = ${docdir}
-prefix = /usr
-program_transform_name = s,x,x,
-psdir = ${docdir}
-sbindir = ${exec_prefix}/sbin
-sharedstatedir = /var
-srcdir = .
-sysconfdir = /etc
-target_alias = 
-top_build_prefix = ../
-top_builddir = ..
-top_srcdir = ..
-NULL = 
-ASN1C_SOURCES = \
-	INTEGER.c		\
-	NativeEnumerated.c	\
-	NativeInteger.c		\
-	asn_SEQUENCE_OF.c	\
-	asn_SET_OF.c		\
-	constr_CHOICE.c		\
-	constr_SEQUENCE.c	\
-	constr_SEQUENCE_OF.c	\
-	constr_SET_OF.c		\
-	OCTET_STRING.c		\
-	BIT_STRING.c		\
-	asn_codecs_prim.c	\
-	ber_tlv_length.c	\
-	ber_tlv_tag.c		\
-	ber_decoder.c		\
-	der_encoder.c		\
-	constr_TYPE.c		\
-	constraints.c		\
-	xer_support.c		\
-	xer_decoder.c		\
-	xer_encoder.c		\
-	per_support.c		\
-	per_decoder.c		\
-	per_encoder.c		\
-	$(NULL)
-
-ASN1C_HEADERS = 
-ASN1Cdir = .
-IPAASN1_SOURCES = \
-	Int32.c			\
-	GetKeytabControl.c	\
-	GKNewKeys.c		\
-	GKCurrentKeys.c		\
-	GKReply.c		\
-	KrbKey.c		\
-	TypeValuePair.c		\
-	$(NULL)
-
-IPAASN1_HEADERS = \
-	Int32.h			\
-	GetKeytabControl.h	\
-	GKNewKeys.h		\
-	GKCurrentKeys.h		\
-	GKReply.h		\
-	KrbKey.h		\
-	TypeValuePair.h		\
-	$(NULL)
-
-IPAASN1dir = .
-AM_CPPFLAGS = -I../../util
-noinst_LTLIBRARIES = libasn1c.la
-noinst_HEADERS = $(ASN1C_HEADERS) $(IPAASN1_HEADERS)
-libasn1c_la_SOURCES = $(ASN1C_SOURCES) $(IPAASN1_SOURCES)
-all: all-am
-
-.SUFFIXES:
-.SUFFIXES: .c .lo .o .obj
-$(srcdir)/Makefile.in: # $(srcdir)/Makefile.am  $(am__configure_deps)
-	@for dep in $?; do \
-	  case '$(am__configure_deps)' in \
-	    *$$dep*) \
-	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
-	        && { if test -f $@; then exit 0; else break; fi; }; \
-	      exit 1;; \
-	  esac; \
-	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign asn1c/Makefile'; \
-	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign asn1c/Makefile
-Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
-	@case '$?' in \
-	  *config.status*) \
-	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
-	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
-	esac;
-
-$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-$(top_srcdir)/configure: # $(am__configure_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4): # $(am__aclocal_m4_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(am__aclocal_m4_deps):
-
-clean-noinstLTLIBRARIES:
-	-test -z "$(noinst_LTLIBRARIES)" || rm -f $(noinst_LTLIBRARIES)
-	@list='$(noinst_LTLIBRARIES)'; \
-	locs=`for p in $$list; do echo $$p; done | \
-	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
-	      sort -u`; \
-	test -z "$$locs" || { \
-	  echo rm -f $${locs}; \
-	  rm -f $${locs}; \
-	}
-
-libasn1c.la: $(libasn1c_la_OBJECTS) $(libasn1c_la_DEPENDENCIES) $(EXTRA_libasn1c_la_DEPENDENCIES) 
-	$(AM_V_CCLD)$(LINK)  $(libasn1c_la_OBJECTS) $(libasn1c_la_LIBADD) $(LIBS)
-
-mostlyclean-compile:
-	-rm -f *.$(OBJEXT)
-
-distclean-compile:
-	-rm -f *.tab.c
-
-include ./$(DEPDIR)/BIT_STRING.Plo
-include ./$(DEPDIR)/GKCurrentKeys.Plo
-include ./$(DEPDIR)/GKNewKeys.Plo
-include ./$(DEPDIR)/GKReply.Plo
-include ./$(DEPDIR)/GetKeytabControl.Plo
-include ./$(DEPDIR)/INTEGER.Plo
-include ./$(DEPDIR)/Int32.Plo
-include ./$(DEPDIR)/KrbKey.Plo
-include ./$(DEPDIR)/NativeEnumerated.Plo
-include ./$(DEPDIR)/NativeInteger.Plo
-include ./$(DEPDIR)/OCTET_STRING.Plo
-include ./$(DEPDIR)/TypeValuePair.Plo
-include ./$(DEPDIR)/asn_SEQUENCE_OF.Plo
-include ./$(DEPDIR)/asn_SET_OF.Plo
-include ./$(DEPDIR)/asn_codecs_prim.Plo
-include ./$(DEPDIR)/ber_decoder.Plo
-include ./$(DEPDIR)/ber_tlv_length.Plo
-include ./$(DEPDIR)/ber_tlv_tag.Plo
-include ./$(DEPDIR)/constr_CHOICE.Plo
-include ./$(DEPDIR)/constr_SEQUENCE.Plo
-include ./$(DEPDIR)/constr_SEQUENCE_OF.Plo
-include ./$(DEPDIR)/constr_SET_OF.Plo
-include ./$(DEPDIR)/constr_TYPE.Plo
-include ./$(DEPDIR)/constraints.Plo
-include ./$(DEPDIR)/der_encoder.Plo
-include ./$(DEPDIR)/per_decoder.Plo
-include ./$(DEPDIR)/per_encoder.Plo
-include ./$(DEPDIR)/per_support.Plo
-include ./$(DEPDIR)/xer_decoder.Plo
-include ./$(DEPDIR)/xer_encoder.Plo
-include ./$(DEPDIR)/xer_support.Plo
-
-.c.o:
-	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-#	$(AM_V_CC)source='$<' object='$@' libtool=no \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(COMPILE) -c -o $@ $<
-
-.c.obj:
-	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-#	$(AM_V_CC)source='$<' object='$@' libtool=no \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
-
-.c.lo:
-	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
-#	$(AM_V_CC)source='$<' object='$@' libtool=yes \
-#	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) \
-#	$(AM_V_CC_no)$(LTCOMPILE) -c -o $@ $<
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
-install-ASN1CHEADERS: $(ASN1C_HEADERS)
-	@$(NORMAL_INSTALL)
-	@list='$(ASN1C_HEADERS)'; test -n "$(ASN1Cdir)" || list=; \
-	if test -n "$$list"; then \
-	  echo " $(MKDIR_P) '$(DESTDIR)$(ASN1Cdir)'"; \
-	  $(MKDIR_P) "$(DESTDIR)$(ASN1Cdir)" || exit 1; \
-	fi; \
-	for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  echo "$$d$$p"; \
-	done | $(am__base_list) | \
-	while read files; do \
-	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(ASN1Cdir)'"; \
-	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(ASN1Cdir)" || exit $$?; \
-	done
-
-uninstall-ASN1CHEADERS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(ASN1C_HEADERS)'; test -n "$(ASN1Cdir)" || list=; \
-	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
-	dir='$(DESTDIR)$(ASN1Cdir)'; $(am__uninstall_files_from_dir)
-install-IPAASN1HEADERS: $(IPAASN1_HEADERS)
-	@$(NORMAL_INSTALL)
-	@list='$(IPAASN1_HEADERS)'; test -n "$(IPAASN1dir)" || list=; \
-	if test -n "$$list"; then \
-	  echo " $(MKDIR_P) '$(DESTDIR)$(IPAASN1dir)'"; \
-	  $(MKDIR_P) "$(DESTDIR)$(IPAASN1dir)" || exit 1; \
-	fi; \
-	for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  echo "$$d$$p"; \
-	done | $(am__base_list) | \
-	while read files; do \
-	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(IPAASN1dir)'"; \
-	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(IPAASN1dir)" || exit $$?; \
-	done
-
-uninstall-IPAASN1HEADERS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(IPAASN1_HEADERS)'; test -n "$(IPAASN1dir)" || list=; \
-	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
-	dir='$(DESTDIR)$(IPAASN1dir)'; $(am__uninstall_files_from_dir)
-
-ID: $(am__tagged_files)
-	$(am__define_uniq_tagged_files); mkid -fID $$unique
-tags: tags-am
-TAGS: tags
-
-tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
-	set x; \
-	here=`pwd`; \
-	$(am__define_uniq_tagged_files); \
-	shift; \
-	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
-	  test -n "$$unique" || unique=$$empty_fix; \
-	  if test $$# -gt 0; then \
-	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	      "$$@" $$unique; \
-	  else \
-	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	      $$unique; \
-	  fi; \
-	fi
-ctags: ctags-am
-
-CTAGS: ctags
-ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
-	$(am__define_uniq_tagged_files); \
-	test -z "$(CTAGS_ARGS)$$unique" \
-	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$unique
-
-GTAGS:
-	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && $(am__cd) $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) "$$here"
-cscopelist: cscopelist-am
-
-cscopelist-am: $(am__tagged_files)
-	list='$(am__tagged_files)'; \
-	case "$(srcdir)" in \
-	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
-	  *) sdir=$(subdir)/$(srcdir) ;; \
-	esac; \
-	for i in $$list; do \
-	  if test -f "$$i"; then \
-	    echo "$(subdir)/$$i"; \
-	  else \
-	    echo "$$sdir/$$i"; \
-	  fi; \
-	done >> $(top_builddir)/cscope.files
-
-distclean-tags:
-	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
-
-distdir: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	list='$(DISTFILES)'; \
-	  dist_files=`for file in $$list; do echo $$file; done | \
-	  sed -e "s|^$$srcdirstrip/||;t" \
-	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
-	case $$dist_files in \
-	  */*) $(MKDIR_P) `echo "$$dist_files" | \
-			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
-			   sort -u` ;; \
-	esac; \
-	for file in $$dist_files; do \
-	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  if test -d $$d/$$file; then \
-	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d "$(distdir)/$$file"; then \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
-	  else \
-	    test -f "$(distdir)/$$file" \
-	    || cp -p $$d/$$file "$(distdir)/$$file" \
-	    || exit 1; \
-	  fi; \
-	done
-check-am: all-am
-check: check-am
-all-am: Makefile $(LTLIBRARIES) $(HEADERS)
-installdirs:
-	for dir in "$(DESTDIR)$(ASN1Cdir)" "$(DESTDIR)$(IPAASN1dir)"; do \
-	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
-	done
-install: install-am
-install-exec: install-exec-am
-install-data: install-data-am
-uninstall: uninstall-am
-
-install-am: all-am
-	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
-
-installcheck: installcheck-am
-install-strip:
-	if test -z '$(STRIP)'; then \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	      install; \
-	else \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
-	fi
-mostlyclean-generic:
-
-clean-generic:
-
-distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
-
-maintainer-clean-generic:
-	@echo "This command is intended for maintainers to use"
-	@echo "it deletes files that may require special tools to rebuild."
-clean: clean-am
-
-clean-am: clean-generic clean-libtool clean-noinstLTLIBRARIES \
-	mostlyclean-am
-
-distclean: distclean-am
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-distclean-am: clean-am distclean-compile distclean-generic \
-	distclean-tags
-
-dvi: dvi-am
-
-dvi-am:
-
-html: html-am
-
-html-am:
-
-info: info-am
-
-info-am:
-
-install-data-am: install-ASN1CHEADERS install-IPAASN1HEADERS
-
-install-dvi: install-dvi-am
-
-install-dvi-am:
-
-install-exec-am:
-
-install-html: install-html-am
-
-install-html-am:
-
-install-info: install-info-am
-
-install-info-am:
-
-install-man:
-
-install-pdf: install-pdf-am
-
-install-pdf-am:
-
-install-ps: install-ps-am
-
-install-ps-am:
-
-installcheck-am:
-
-maintainer-clean: maintainer-clean-am
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-maintainer-clean-am: distclean-am maintainer-clean-generic
-
-mostlyclean: mostlyclean-am
-
-mostlyclean-am: mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool
-
-pdf: pdf-am
-
-pdf-am:
-
-ps: ps-am
-
-ps-am:
-
-uninstall-am: uninstall-ASN1CHEADERS uninstall-IPAASN1HEADERS
-
-.MAKE: install-am install-strip
-
-.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
-	clean-libtool clean-noinstLTLIBRARIES cscopelist-am ctags \
-	ctags-am distclean distclean-compile distclean-generic \
-	distclean-libtool distclean-tags distdir dvi dvi-am html \
-	html-am info info-am install install-ASN1CHEADERS \
-	install-IPAASN1HEADERS install-am install-data install-data-am \
-	install-dvi install-dvi-am install-exec install-exec-am \
-	install-html install-html-am install-info install-info-am \
-	install-man install-pdf install-pdf-am install-ps \
-	install-ps-am install-strip installcheck installcheck-am \
-	installdirs maintainer-clean maintainer-clean-generic \
-	mostlyclean mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
-	uninstall-ASN1CHEADERS uninstall-IPAASN1HEADERS uninstall-am
-
-.PRECIOUS: Makefile
-
-	INTEGER.h		\
-	NativeEnumerated.h	\
-	NativeInteger.h		\
-	asn_SEQUENCE_OF.h	\
-	asn_SET_OF.h		\
-	constr_CHOICE.h		\
-	constr_SEQUENCE.h	\
-	constr_SEQUENCE_OF.h	\
-	constr_SET_OF.h		\
-	asn_application.h	\
-	asn_system.h		\
-	asn_codecs.h		\
-	asn_internal.h		\
-	OCTET_STRING.h		\
-	BIT_STRING.h		\
-	asn_codecs_prim.h	\
-	ber_tlv_length.h	\
-	ber_tlv_tag.h		\
-	ber_decoder.h		\
-	der_encoder.h		\
-	constr_TYPE.h		\
-	constraints.h		\
-	xer_support.h		\
-	xer_decoder.h		\
-	xer_encoder.h		\
-	per_support.h		\
-	per_decoder.h		\
-	per_encoder.h		\
-	$(NULL)
-
-regenerate:
-	asn1c -fskeletons-copy -fnative-types ipa.asn1
-	rm -f converter-sample.c Makefile.am.sample
-
-# Tell versions [3.59,3.63) of GNU make to not export all variables.
-# Otherwise a system limit (for SysV at least) may be exceeded.
-.NOEXPORT:
--- a/asn1/asn1c/Makefile.am
+++ b/asn1/asn1c/Makefile.am
@@ -1,93 +1,80 @@
-NULL =
-
-ASN1C_SOURCES =			\
-	INTEGER.c		\
-	NativeEnumerated.c	\
-	NativeInteger.c		\
-	asn_SEQUENCE_OF.c	\
-	asn_SET_OF.c		\
-	constr_CHOICE.c		\
-	constr_SEQUENCE.c	\
-	constr_SEQUENCE_OF.c	\
-	constr_SET_OF.c		\
-	OCTET_STRING.c		\
-	BIT_STRING.c		\
-	asn_codecs_prim.c	\
-	ber_tlv_length.c	\
-	ber_tlv_tag.c		\
-	ber_decoder.c		\
-	der_encoder.c		\
-	constr_TYPE.c		\
-	constraints.c		\
-	xer_support.c		\
-	xer_decoder.c		\
-	xer_encoder.c		\
-	per_support.c		\
-	per_decoder.c		\
-	per_encoder.c		\
-	$(NULL)
-
-ASN1C_HEADERS =
-	INTEGER.h		\
-	NativeEnumerated.h	\
-	NativeInteger.h		\
-	asn_SEQUENCE_OF.h	\
-	asn_SET_OF.h		\
-	constr_CHOICE.h		\
-	constr_SEQUENCE.h	\
-	constr_SEQUENCE_OF.h	\
-	constr_SET_OF.h		\
+libasn1c_la_SOURCES =		\
 	asn_application.h	\
-	asn_system.h		\
 	asn_codecs.h		\
-	asn_internal.h		\
-	OCTET_STRING.h		\
-	BIT_STRING.h		\
+	asn_codecs_prim.c	\
 	asn_codecs_prim.h	\
-	ber_tlv_length.h	\
-	ber_tlv_tag.h		\
+	asn_internal.h		\
+	asn_SEQUENCE_OF.c	\
+	asn_SEQUENCE_OF.h	\
+	asn_SET_OF.c		\
+	asn_SET_OF.h		\
+	asn_system.h		\
+	ber_decoder.c		\
 	ber_decoder.h		\
-	der_encoder.h		\
-	constr_TYPE.h		\
+	ber_tlv_length.c	\
+	ber_tlv_length.h	\
+	ber_tlv_tag.c		\
+	ber_tlv_tag.h		\
+	BIT_STRING.c		\
+	BIT_STRING.h		\
+	constraints.c		\
 	constraints.h		\
-	xer_support.h		\
-	xer_decoder.h		\
-	xer_encoder.h		\
-	per_support.h		\
-	per_decoder.h		\
-	per_encoder.h		\
-	$(NULL)
-
-ASN1Cdir = .
-
-IPAASN1_SOURCES=		\
-	Int32.c			\
+	constr_CHOICE.c		\
+	constr_CHOICE.h		\
+	constr_SEQUENCE.c	\
+	constr_SEQUENCE.h	\
+	constr_SEQUENCE_OF.c	\
+	constr_SEQUENCE_OF.h	\
+	constr_SET_OF.c		\
+	constr_SET_OF.h		\
+	constr_TYPE.c		\
+	constr_TYPE.h		\
+	der_encoder.c		\
+	der_encoder.h		\
 	GetKeytabControl.c	\
-	GKNewKeys.c		\
-	GKCurrentKeys.c		\
-	GKReply.c		\
-	KrbKey.c		\
-	TypeValuePair.c		\
-	$(NULL)
-
-IPAASN1_HEADERS=		\
-	Int32.h			\
 	GetKeytabControl.h	\
-	GKNewKeys.h		\
+	GKCurrentKeys.c		\
 	GKCurrentKeys.h		\
+	GKNewKeys.c		\
+	GKNewKeys.h		\
+	GKReply.c		\
 	GKReply.h		\
+	Int32.c			\
+	Int32.h			\
+	INTEGER.c		\
+	INTEGER.h		\
+	KrbKey.c		\
 	KrbKey.h		\
+	NativeEnumerated.c	\
+	NativeEnumerated.h	\
+	NativeInteger.c		\
+	NativeInteger.h		\
+	OCTET_STRING.c		\
+	OCTET_STRING.h		\
+	per_decoder.c		\
+	per_decoder.h		\
+	per_encoder.c		\
+	per_encoder.h		\
+	per_opentype.c		\
+	per_opentype.h		\
+	per_support.c		\
+	per_support.h		\
+	TypeValuePair.c		\
 	TypeValuePair.h		\
-	$(NULL)
+	xer_decoder.c		\
+	xer_decoder.h		\
+	xer_encoder.c		\
+	xer_encoder.h		\
+	xer_support.c		\
+	xer_support.h

-IPAASN1dir = .
+EXTRA_DIST = ipa.asn1

-AM_CPPFLAGS = -I../../util
+AM_CPPFLAGS = -I$(top_srcdir)/util

 noinst_LTLIBRARIES=libasn1c.la
-noinst_HEADERS=$(ASN1C_HEADERS) $(IPAASN1_HEADERS)
-libasn1c_la_SOURCES=$(ASN1C_SOURCES) $(IPAASN1_SOURCES)

 regenerate:
 	asn1c -fskeletons-copy -fnative-types ipa.asn1
+	$(SED) -i s/_BSD_SOURCE/_DEFAULT_SOURCE/g asn_system.h
 	rm -f converter-sample.c Makefile.am.sample
--- a/asn1/asn1c/Makefile.in
+++ b/asn1/asn1c/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.17 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2024 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,6 @@

@SET_MAKE@

-
 VPATH = @srcdir@
 am__is_gnu_make = { \
  if test -z '$(MAKELEVEL)'; then \
@@ -71,6 +70,8 @@ am__make_running_with_option = \
  test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+am__rm_f = rm -f $(am__rm_f_notfound)
+am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -89,33 +90,35 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-subdir = asn1c
+subdir = asn1/asn1c
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
-	$(top_srcdir)/configure.ac
+am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
+	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
+	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
+	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
+	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(ASN1C_HEADERS) \
-	$(IPAASN1_HEADERS) $(noinst_HEADERS) $(am__DIST_COMMON)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 LTLIBRARIES = $(noinst_LTLIBRARIES)
 libasn1c_la_LIBADD =
-am__objects_1 =
-am__objects_2 = INTEGER.lo NativeEnumerated.lo NativeInteger.lo \
-	asn_SEQUENCE_OF.lo asn_SET_OF.lo constr_CHOICE.lo \
+am_libasn1c_la_OBJECTS = asn_codecs_prim.lo asn_SEQUENCE_OF.lo \
+	asn_SET_OF.lo ber_decoder.lo ber_tlv_length.lo ber_tlv_tag.lo \
+	BIT_STRING.lo constraints.lo constr_CHOICE.lo \
 	constr_SEQUENCE.lo constr_SEQUENCE_OF.lo constr_SET_OF.lo \
-	OCTET_STRING.lo BIT_STRING.lo asn_codecs_prim.lo \
-	ber_tlv_length.lo ber_tlv_tag.lo ber_decoder.lo der_encoder.lo \
-	constr_TYPE.lo constraints.lo xer_support.lo xer_decoder.lo \
-	xer_encoder.lo per_support.lo per_decoder.lo per_encoder.lo \
-	$(am__objects_1)
-am__objects_3 = Int32.lo GetKeytabControl.lo GKNewKeys.lo \
-	GKCurrentKeys.lo GKReply.lo KrbKey.lo TypeValuePair.lo \
-	$(am__objects_1)
-am_libasn1c_la_OBJECTS = $(am__objects_2) $(am__objects_3)
+	constr_TYPE.lo der_encoder.lo GetKeytabControl.lo \
+	GKCurrentKeys.lo GKNewKeys.lo GKReply.lo Int32.lo INTEGER.lo \
+	KrbKey.lo NativeEnumerated.lo NativeInteger.lo OCTET_STRING.lo \
+	per_decoder.lo per_encoder.lo per_opentype.lo per_support.lo \
+	TypeValuePair.lo xer_decoder.lo xer_encoder.lo xer_support.lo
 libasn1c_la_OBJECTS = $(am_libasn1c_la_OBJECTS)
 AM_V_lt = $(am__v_lt_@AM_V@)
 am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
@@ -135,7 +138,25 @@ am__v_at_0 = @
 am__v_at_1 = 
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/BIT_STRING.Plo \
+	./$(DEPDIR)/GKCurrentKeys.Plo ./$(DEPDIR)/GKNewKeys.Plo \
+	./$(DEPDIR)/GKReply.Plo ./$(DEPDIR)/GetKeytabControl.Plo \
+	./$(DEPDIR)/INTEGER.Plo ./$(DEPDIR)/Int32.Plo \
+	./$(DEPDIR)/KrbKey.Plo ./$(DEPDIR)/NativeEnumerated.Plo \
+	./$(DEPDIR)/NativeInteger.Plo ./$(DEPDIR)/OCTET_STRING.Plo \
+	./$(DEPDIR)/TypeValuePair.Plo ./$(DEPDIR)/asn_SEQUENCE_OF.Plo \
+	./$(DEPDIR)/asn_SET_OF.Plo ./$(DEPDIR)/asn_codecs_prim.Plo \
+	./$(DEPDIR)/ber_decoder.Plo ./$(DEPDIR)/ber_tlv_length.Plo \
+	./$(DEPDIR)/ber_tlv_tag.Plo ./$(DEPDIR)/constr_CHOICE.Plo \
+	./$(DEPDIR)/constr_SEQUENCE.Plo \
+	./$(DEPDIR)/constr_SEQUENCE_OF.Plo \
+	./$(DEPDIR)/constr_SET_OF.Plo ./$(DEPDIR)/constr_TYPE.Plo \
+	./$(DEPDIR)/constraints.Plo ./$(DEPDIR)/der_encoder.Plo \
+	./$(DEPDIR)/per_decoder.Plo ./$(DEPDIR)/per_encoder.Plo \
+	./$(DEPDIR)/per_opentype.Plo ./$(DEPDIR)/per_support.Plo \
+	./$(DEPDIR)/xer_decoder.Plo ./$(DEPDIR)/xer_encoder.Plo \
+	./$(DEPDIR)/xer_support.Plo
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -162,35 +183,6 @@ am__can_run_installinfo = \
    n|no|NO) false;; \
    *) (install-info --version) >/dev/null 2>&1;; \
  esac
-am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
-am__vpath_adj = case $$p in \
-    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
-    *) f=$$p;; \
-  esac;
-am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
-am__install_max = 40
-am__nobase_strip_setup = \
-  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
-am__nobase_strip = \
-  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
-am__nobase_list = $(am__nobase_strip_setup); \
-  for p in $$list; do echo "$$p $$p"; done | \
-  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
-  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
-    if (++n[$$2] == $(am__install_max)) \
-      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
-    END { for (dir in files) print dir, files[dir] }'
-am__base_list = \
-  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
-  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
-am__uninstall_files_from_dir = { \
-  test -z "$$files" \
-    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
-    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
-         $(am__cd) "$$dir" && rm -f $$files; }; \
-  }
-am__installdirs = "$(DESTDIR)$(ASN1Cdir)" "$(DESTDIR)$(IPAASN1dir)"
-HEADERS = $(ASN1C_HEADERS) $(IPAASN1_HEADERS) $(noinst_HEADERS)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
@@ -208,13 +200,12 @@ am__define_uniq_tagged_files = \
  unique=`for i in $$list; do \
    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
  done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
 am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+API_VERSION = @API_VERSION@
 AR = @AR@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
@@ -223,11 +214,21 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
+CONFIG_STATUS = @CONFIG_STATUS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
+CRYPTO_LIBS = @CRYPTO_LIBS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
+DATA_VERSION = @DATA_VERSION@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
+DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
+DIRSRV_LIBS = @DIRSRV_LIBS@
 DLLTOOL = @DLLTOOL@
 DSYMUTIL = @DSYMUTIL@
 DUMPBIN = @DUMPBIN@
@@ -235,31 +236,88 @@ ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
+GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
+GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
+GIT_BRANCH = @GIT_BRANCH@
+GIT_VERSION = @GIT_VERSION@
+GMSGFMT = @GMSGFMT@
+GMSGFMT_015 = @GMSGFMT_015@
 GREP = @GREP@
+HTTPD_GROUP = @HTTPD_GROUP@
+INI_CFLAGS = @INI_CFLAGS@
+INI_LIBS = @INI_LIBS@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+INTLLIBS = @INTLLIBS@
+INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
+IPAPLATFORM = @IPAPLATFORM@
+IPA_DATA_DIR = @IPA_DATA_DIR@
+IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
+JANSSON_CFLAGS = @JANSSON_CFLAGS@
+JANSSON_LIBS = @JANSSON_LIBS@
+JSLINT = @JSLINT@
+KRAD_LIBS = @KRAD_LIBS@
+KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
+KRB5_BUILD_VERSION = @KRB5_BUILD_VERSION@
+KRB5_CFLAGS = @KRB5_CFLAGS@
+KRB5_GSSAPI_CFLAGS = @KRB5_GSSAPI_CFLAGS@
+KRB5_GSSAPI_LIBS = @KRB5_GSSAPI_LIBS@
+KRB5_LIBS = @KRB5_LIBS@
 LD = @LD@
+LDAP_CFLAGS = @LDAP_CFLAGS@
+LDAP_LIBS = @LDAP_LIBS@
 LDFLAGS = @LDFLAGS@
+LIBCURL_CFLAGS = @LIBCURL_CFLAGS@
+LIBCURL_LIBS = @LIBCURL_LIBS@
+LIBICONV = @LIBICONV@
+LIBINTL = @LIBINTL@
+LIBINTL_LIBS = @LIBINTL_LIBS@
 LIBOBJS = @LIBOBJS@
+LIBPDB_NAME = @LIBPDB_NAME@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
+LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
+LIBVERTO_LIBS = @LIBVERTO_LIBS@
 LIPO = @LIPO@
 LN_S = @LN_S@
+LTLIBICONV = @LTLIBICONV@
+LTLIBINTL = @LTLIBINTL@
 LTLIBOBJS = @LTLIBOBJS@
 LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
-MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
+MK_ASSIGN = @MK_ASSIGN@
+MK_ELSE = @MK_ELSE@
+MK_ENDIF = @MK_ENDIF@
+MK_IFEQ = @MK_IFEQ@
+MSGATTRIB = @MSGATTRIB@
+MSGFMT = @MSGFMT@
+MSGFMT_015 = @MSGFMT_015@
+MSGMERGE = @MSGMERGE@
+NAMED_GROUP = @NAMED_GROUP@
+NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
+NDRNBT_LIBS = @NDRNBT_LIBS@
+NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
+NDRPAC_LIBS = @NDRPAC_LIBS@
+NDR_CFLAGS = @NDR_CFLAGS@
+NDR_LIBS = @NDR_LIBS@
 NM = @NM@
 NMEDIT = @NMEDIT@
+NSPR_CFLAGS = @NSPR_CFLAGS@
+NSPR_LIBS = @NSPR_LIBS@
+NUM_VERSION = @NUM_VERSION@
 OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
+ODS_GROUP = @ODS_GROUP@
+ODS_USER = @ODS_USER@
 OTOOL = @OTOOL@
 OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
@@ -270,12 +328,57 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+PLATFORM_PYTHON = @PLATFORM_PYTHON@
+POPT_CFLAGS = @POPT_CFLAGS@
+POPT_LIBS = @POPT_LIBS@
+POSUB = @POSUB@
+PWQUALITY_CFLAGS = @PWQUALITY_CFLAGS@
+PWQUALITY_LIBS = @PWQUALITY_LIBS@
+PYLINT = @PYLINT@
+PYTHON = @PYTHON@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
+RESOLV_LIBS = @RESOLV_LIBS@
+RPMLINT = @RPMLINT@
+SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
+SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
+SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
+SAMBA_SECURITY_LIBS = @SAMBA_SECURITY_LIBS@
+SASL_CFLAGS = @SASL_CFLAGS@
+SASL_LIBS = @SASL_LIBS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
+SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
+SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
+SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
+SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
+SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
+SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
 STRIP = @STRIP@
+TALLOC_CFLAGS = @TALLOC_CFLAGS@
+TALLOC_LIBS = @TALLOC_LIBS@
+TEVENT_CFLAGS = @TEVENT_CFLAGS@
+TEVENT_LIBS = @TEVENT_LIBS@
+UNISTRING_LIBS = @UNISTRING_LIBS@
+UNLINK = @UNLINK@
+USE_NLS = @USE_NLS@
+UUID_CFLAGS = @UUID_CFLAGS@
+UUID_LIBS = @UUID_LIBS@
+VENDOR_SUFFIX = @VENDOR_SUFFIX@
 VERSION = @VERSION@
+XGETTEXT = @XGETTEXT@
+XGETTEXT_015 = @XGETTEXT_015@
+XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
+XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
+XMLRPC_LIBS = @XMLRPC_LIBS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
@@ -286,8 +389,10 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
+am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -306,9 +411,11 @@ host_cpu = @host_cpu@
 host_os = @host_os@
 host_vendor = @host_vendor@
 htmldir = @htmldir@
+i18ntests = @i18ntests@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+krb5rundir = @krb5rundir@
 libdir = @libdir@
 libexecdir = @libexecdir@
 localedir = @localedir@
@@ -317,77 +424,105 @@ mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
 pdfdir = @pdfdir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
 psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
+runstatedir = @runstatedir@
 sbindir = @sbindir@
+selinux_makefile = @selinux_makefile@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
+sysconfenvdir = @sysconfenvdir@
+systemdcatalogdir = @systemdcatalogdir@
+systemdsystemunitdir = @systemdsystemunitdir@
+systemdtmpfilesdir = @systemdtmpfilesdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-NULL = 
-ASN1C_SOURCES = \
-	INTEGER.c		\
-	NativeEnumerated.c	\
-	NativeInteger.c		\
-	asn_SEQUENCE_OF.c	\
-	asn_SET_OF.c		\
-	constr_CHOICE.c		\
-	constr_SEQUENCE.c	\
-	constr_SEQUENCE_OF.c	\
-	constr_SET_OF.c		\
-	OCTET_STRING.c		\
-	BIT_STRING.c		\
+libasn1c_la_SOURCES = \
+	asn_application.h	\
+	asn_codecs.h		\
 	asn_codecs_prim.c	\
-	ber_tlv_length.c	\
-	ber_tlv_tag.c		\
+	asn_codecs_prim.h	\
+	asn_internal.h		\
+	asn_SEQUENCE_OF.c	\
+	asn_SEQUENCE_OF.h	\
+	asn_SET_OF.c		\
+	asn_SET_OF.h		\
+	asn_system.h		\
 	ber_decoder.c		\
-	der_encoder.c		\
-	constr_TYPE.c		\
+	ber_decoder.h		\
+	ber_tlv_length.c	\
+	ber_tlv_length.h	\
+	ber_tlv_tag.c		\
+	ber_tlv_tag.h		\
+	BIT_STRING.c		\
+	BIT_STRING.h		\
 	constraints.c		\
-	xer_support.c		\
-	xer_decoder.c		\
-	xer_encoder.c		\
-	per_support.c		\
-	per_decoder.c		\
-	per_encoder.c		\
-	$(NULL)
-
-ASN1C_HEADERS = 
-ASN1Cdir = .
-IPAASN1_SOURCES = \
-	Int32.c			\
+	constraints.h		\
+	constr_CHOICE.c		\
+	constr_CHOICE.h		\
+	constr_SEQUENCE.c	\
+	constr_SEQUENCE.h	\
+	constr_SEQUENCE_OF.c	\
+	constr_SEQUENCE_OF.h	\
+	constr_SET_OF.c		\
+	constr_SET_OF.h		\
+	constr_TYPE.c		\
+	constr_TYPE.h		\
+	der_encoder.c		\
+	der_encoder.h		\
 	GetKeytabControl.c	\
-	GKNewKeys.c		\
-	GKCurrentKeys.c		\
-	GKReply.c		\
-	KrbKey.c		\
-	TypeValuePair.c		\
-	$(NULL)
-
-IPAASN1_HEADERS = \
-	Int32.h			\
 	GetKeytabControl.h	\
-	GKNewKeys.h		\
+	GKCurrentKeys.c		\
 	GKCurrentKeys.h		\
+	GKNewKeys.c		\
+	GKNewKeys.h		\
+	GKReply.c		\
 	GKReply.h		\
+	Int32.c			\
+	Int32.h			\
+	INTEGER.c		\
+	INTEGER.h		\
+	KrbKey.c		\
 	KrbKey.h		\
+	NativeEnumerated.c	\
+	NativeEnumerated.h	\
+	NativeInteger.c		\
+	NativeInteger.h		\
+	OCTET_STRING.c		\
+	OCTET_STRING.h		\
+	per_decoder.c		\
+	per_decoder.h		\
+	per_encoder.c		\
+	per_encoder.h		\
+	per_opentype.c		\
+	per_opentype.h		\
+	per_support.c		\
+	per_support.h		\
+	TypeValuePair.c		\
 	TypeValuePair.h		\
-	$(NULL)
+	xer_decoder.c		\
+	xer_decoder.h		\
+	xer_encoder.c		\
+	xer_encoder.h		\
+	xer_support.c		\
+	xer_support.h

-IPAASN1dir = .
-AM_CPPFLAGS = -I../../util
+EXTRA_DIST = ipa.asn1
+AM_CPPFLAGS = -I$(top_srcdir)/util
 noinst_LTLIBRARIES = libasn1c.la
-noinst_HEADERS = $(ASN1C_HEADERS) $(IPAASN1_HEADERS)
-libasn1c_la_SOURCES = $(ASN1C_SOURCES) $(IPAASN1_SOURCES)
 all: all-am

 .SUFFIXES:
 .SUFFIXES: .c .lo .o .obj
-$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
@@ -396,37 +531,35 @@ $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__confi
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign asn1c/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign asn1/asn1c/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign asn1c/Makefile
+	  $(AUTOMAKE) --foreign asn1/asn1c/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;

 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh

-$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+$(top_srcdir)/configure:  $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(am__aclocal_m4_deps):

 clean-noinstLTLIBRARIES:
-	-test -z "$(noinst_LTLIBRARIES)" || rm -f $(noinst_LTLIBRARIES)
+	-$(am__rm_f) $(noinst_LTLIBRARIES)
 	@list='$(noinst_LTLIBRARIES)'; \
 	locs=`for p in $$list; do echo $$p; done | \
 	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
 	      sort -u`; \
-	test -z "$$locs" || { \
-	  echo rm -f $${locs}; \
-	  rm -f $${locs}; \
-	}
+	echo rm -f $${locs}; \
+	$(am__rm_f) $${locs}

 libasn1c.la: $(libasn1c_la_OBJECTS) $(libasn1c_la_DEPENDENCIES) $(EXTRA_libasn1c_la_DEPENDENCIES) 
 	$(AM_V_CCLD)$(LINK)  $(libasn1c_la_OBJECTS) $(libasn1c_la_LIBADD) $(LIBS)
@@ -437,37 +570,44 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c

-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/BIT_STRING.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKCurrentKeys.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKNewKeys.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKReply.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GetKeytabControl.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/INTEGER.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/Int32.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/KrbKey.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/NativeEnumerated.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/NativeInteger.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/OCTET_STRING.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/TypeValuePair.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_SEQUENCE_OF.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_SET_OF.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_codecs_prim.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_decoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_tlv_length.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_tlv_tag.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_CHOICE.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SEQUENCE.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SEQUENCE_OF.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SET_OF.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_TYPE.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constraints.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/der_encoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_decoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_encoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_support.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_decoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_encoder.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_support.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/BIT_STRING.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKCurrentKeys.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKNewKeys.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GKReply.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/GetKeytabControl.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/INTEGER.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/Int32.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/KrbKey.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/NativeEnumerated.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/NativeInteger.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/OCTET_STRING.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/TypeValuePair.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_SEQUENCE_OF.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_SET_OF.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/asn_codecs_prim.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_decoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_tlv_length.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ber_tlv_tag.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_CHOICE.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SEQUENCE.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SEQUENCE_OF.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_SET_OF.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constr_TYPE.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/constraints.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/der_encoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_decoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_encoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_opentype.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/per_support.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_decoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_encoder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xer_support.Plo@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@: >>$@
+
+am--depfiles: $(am__depfiles_remade)

 .c.o:
@am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -495,48 +635,6 @@ mostlyclean-libtool:

 clean-libtool:
 	-rm -rf .libs _libs
-install-ASN1CHEADERS: $(ASN1C_HEADERS)
-	@$(NORMAL_INSTALL)
-	@list='$(ASN1C_HEADERS)'; test -n "$(ASN1Cdir)" || list=; \
-	if test -n "$$list"; then \
-	  echo " $(MKDIR_P) '$(DESTDIR)$(ASN1Cdir)'"; \
-	  $(MKDIR_P) "$(DESTDIR)$(ASN1Cdir)" || exit 1; \
-	fi; \
-	for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  echo "$$d$$p"; \
-	done | $(am__base_list) | \
-	while read files; do \
-	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(ASN1Cdir)'"; \
-	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(ASN1Cdir)" || exit $$?; \
-	done
-
-uninstall-ASN1CHEADERS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(ASN1C_HEADERS)'; test -n "$(ASN1Cdir)" || list=; \
-	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
-	dir='$(DESTDIR)$(ASN1Cdir)'; $(am__uninstall_files_from_dir)
-install-IPAASN1HEADERS: $(IPAASN1_HEADERS)
-	@$(NORMAL_INSTALL)
-	@list='$(IPAASN1_HEADERS)'; test -n "$(IPAASN1dir)" || list=; \
-	if test -n "$$list"; then \
-	  echo " $(MKDIR_P) '$(DESTDIR)$(IPAASN1dir)'"; \
-	  $(MKDIR_P) "$(DESTDIR)$(IPAASN1dir)" || exit 1; \
-	fi; \
-	for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  echo "$$d$$p"; \
-	done | $(am__base_list) | \
-	while read files; do \
-	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(IPAASN1dir)'"; \
-	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(IPAASN1dir)" || exit $$?; \
-	done
-
-uninstall-IPAASN1HEADERS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(IPAASN1_HEADERS)'; test -n "$(IPAASN1dir)" || list=; \
-	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
-	dir='$(DESTDIR)$(IPAASN1dir)'; $(am__uninstall_files_from_dir)

 ID: $(am__tagged_files)
 	$(am__define_uniq_tagged_files); mkid -fID $$unique
@@ -589,8 +687,10 @@ cscopelist-am: $(am__tagged_files)

 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am

-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -622,11 +722,8 @@ distdir: $(DISTFILES)
 	done
 check-am: all-am
 check: check-am
-all-am: Makefile $(LTLIBRARIES) $(HEADERS)
+all-am: Makefile $(LTLIBRARIES)
 installdirs:
-	for dir in "$(DESTDIR)$(ASN1Cdir)" "$(DESTDIR)$(IPAASN1dir)"; do \
-	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
-	done
 install: install-am
 install-exec: install-exec-am
 install-data: install-data-am
@@ -651,8 +748,8 @@ mostlyclean-generic:
 clean-generic:

 distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -663,7 +760,38 @@ clean-am: clean-generic clean-libtool clean-noinstLTLIBRARIES \
 	mostlyclean-am

 distclean: distclean-am
-	-rm -rf ./$(DEPDIR)
+	-rm -f ./$(DEPDIR)/BIT_STRING.Plo
+	-rm -f ./$(DEPDIR)/GKCurrentKeys.Plo
+	-rm -f ./$(DEPDIR)/GKNewKeys.Plo
+	-rm -f ./$(DEPDIR)/GKReply.Plo
+	-rm -f ./$(DEPDIR)/GetKeytabControl.Plo
+	-rm -f ./$(DEPDIR)/INTEGER.Plo
+	-rm -f ./$(DEPDIR)/Int32.Plo
+	-rm -f ./$(DEPDIR)/KrbKey.Plo
+	-rm -f ./$(DEPDIR)/NativeEnumerated.Plo
+	-rm -f ./$(DEPDIR)/NativeInteger.Plo
+	-rm -f ./$(DEPDIR)/OCTET_STRING.Plo
+	-rm -f ./$(DEPDIR)/TypeValuePair.Plo
+	-rm -f ./$(DEPDIR)/asn_SEQUENCE_OF.Plo
+	-rm -f ./$(DEPDIR)/asn_SET_OF.Plo
+	-rm -f ./$(DEPDIR)/asn_codecs_prim.Plo
+	-rm -f ./$(DEPDIR)/ber_decoder.Plo
+	-rm -f ./$(DEPDIR)/ber_tlv_length.Plo
+	-rm -f ./$(DEPDIR)/ber_tlv_tag.Plo
+	-rm -f ./$(DEPDIR)/constr_CHOICE.Plo
+	-rm -f ./$(DEPDIR)/constr_SEQUENCE.Plo
+	-rm -f ./$(DEPDIR)/constr_SEQUENCE_OF.Plo
+	-rm -f ./$(DEPDIR)/constr_SET_OF.Plo
+	-rm -f ./$(DEPDIR)/constr_TYPE.Plo
+	-rm -f ./$(DEPDIR)/constraints.Plo
+	-rm -f ./$(DEPDIR)/der_encoder.Plo
+	-rm -f ./$(DEPDIR)/per_decoder.Plo
+	-rm -f ./$(DEPDIR)/per_encoder.Plo
+	-rm -f ./$(DEPDIR)/per_opentype.Plo
+	-rm -f ./$(DEPDIR)/per_support.Plo
+	-rm -f ./$(DEPDIR)/xer_decoder.Plo
+	-rm -f ./$(DEPDIR)/xer_encoder.Plo
+	-rm -f ./$(DEPDIR)/xer_support.Plo
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-tags
@@ -680,7 +808,7 @@ info: info-am

 info-am:

-install-data-am: install-ASN1CHEADERS install-IPAASN1HEADERS
+install-data-am:

 install-dvi: install-dvi-am

@@ -709,7 +837,38 @@ install-ps-am:
 installcheck-am:

 maintainer-clean: maintainer-clean-am
-	-rm -rf ./$(DEPDIR)
+	-rm -f ./$(DEPDIR)/BIT_STRING.Plo
+	-rm -f ./$(DEPDIR)/GKCurrentKeys.Plo
+	-rm -f ./$(DEPDIR)/GKNewKeys.Plo
+	-rm -f ./$(DEPDIR)/GKReply.Plo
+	-rm -f ./$(DEPDIR)/GetKeytabControl.Plo
+	-rm -f ./$(DEPDIR)/INTEGER.Plo
+	-rm -f ./$(DEPDIR)/Int32.Plo
+	-rm -f ./$(DEPDIR)/KrbKey.Plo
+	-rm -f ./$(DEPDIR)/NativeEnumerated.Plo
+	-rm -f ./$(DEPDIR)/NativeInteger.Plo
+	-rm -f ./$(DEPDIR)/OCTET_STRING.Plo
+	-rm -f ./$(DEPDIR)/TypeValuePair.Plo
+	-rm -f ./$(DEPDIR)/asn_SEQUENCE_OF.Plo
+	-rm -f ./$(DEPDIR)/asn_SET_OF.Plo
+	-rm -f ./$(DEPDIR)/asn_codecs_prim.Plo
+	-rm -f ./$(DEPDIR)/ber_decoder.Plo
+	-rm -f ./$(DEPDIR)/ber_tlv_length.Plo
+	-rm -f ./$(DEPDIR)/ber_tlv_tag.Plo
+	-rm -f ./$(DEPDIR)/constr_CHOICE.Plo
+	-rm -f ./$(DEPDIR)/constr_SEQUENCE.Plo
+	-rm -f ./$(DEPDIR)/constr_SEQUENCE_OF.Plo
+	-rm -f ./$(DEPDIR)/constr_SET_OF.Plo
+	-rm -f ./$(DEPDIR)/constr_TYPE.Plo
+	-rm -f ./$(DEPDIR)/constraints.Plo
+	-rm -f ./$(DEPDIR)/der_encoder.Plo
+	-rm -f ./$(DEPDIR)/per_decoder.Plo
+	-rm -f ./$(DEPDIR)/per_encoder.Plo
+	-rm -f ./$(DEPDIR)/per_opentype.Plo
+	-rm -f ./$(DEPDIR)/per_support.Plo
+	-rm -f ./$(DEPDIR)/xer_decoder.Plo
+	-rm -f ./$(DEPDIR)/xer_encoder.Plo
+	-rm -f ./$(DEPDIR)/xer_support.Plo
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic

@@ -726,61 +885,39 @@ ps: ps-am

 ps-am:

-uninstall-am: uninstall-ASN1CHEADERS uninstall-IPAASN1HEADERS
+uninstall-am:

 .MAKE: install-am install-strip

-.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
-	clean-libtool clean-noinstLTLIBRARIES cscopelist-am ctags \
-	ctags-am distclean distclean-compile distclean-generic \
-	distclean-libtool distclean-tags distdir dvi dvi-am html \
-	html-am info info-am install install-ASN1CHEADERS \
-	install-IPAASN1HEADERS install-am install-data install-data-am \
-	install-dvi install-dvi-am install-exec install-exec-am \
-	install-html install-html-am install-info install-info-am \
-	install-man install-pdf install-pdf-am install-ps \
-	install-ps-am install-strip installcheck installcheck-am \
-	installdirs maintainer-clean maintainer-clean-generic \
-	mostlyclean mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
-	uninstall-ASN1CHEADERS uninstall-IPAASN1HEADERS uninstall-am
+.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
+	clean-generic clean-libtool clean-noinstLTLIBRARIES \
+	cscopelist-am ctags ctags-am distclean distclean-compile \
+	distclean-generic distclean-libtool distclean-tags distdir dvi \
+	dvi-am html html-am info info-am install install-am \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-ps install-ps-am install-strip \
+	installcheck installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-compile \
+	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+	tags tags-am uninstall uninstall-am

 .PRECIOUS: Makefile

-	INTEGER.h		\
-	NativeEnumerated.h	\
-	NativeInteger.h		\
-	asn_SEQUENCE_OF.h	\
-	asn_SET_OF.h		\
-	constr_CHOICE.h		\
-	constr_SEQUENCE.h	\
-	constr_SEQUENCE_OF.h	\
-	constr_SET_OF.h		\
-	asn_application.h	\
-	asn_system.h		\
-	asn_codecs.h		\
-	asn_internal.h		\
-	OCTET_STRING.h		\
-	BIT_STRING.h		\
-	asn_codecs_prim.h	\
-	ber_tlv_length.h	\
-	ber_tlv_tag.h		\
-	ber_decoder.h		\
-	der_encoder.h		\
-	constr_TYPE.h		\
-	constraints.h		\
-	xer_support.h		\
-	xer_decoder.h		\
-	xer_encoder.h		\
-	per_support.h		\
-	per_decoder.h		\
-	per_encoder.h		\
-	$(NULL)

 regenerate:
 	asn1c -fskeletons-copy -fnative-types ipa.asn1
+	$(SED) -i s/_BSD_SOURCE/_DEFAULT_SOURCE/g asn_system.h
 	rm -f converter-sample.c Makefile.am.sample

 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
+
+# Tell GNU make to disable its built-in pattern rules.
+%:: %,v
+%:: RCS/%,v
+%:: RCS/%
+%:: s.%
+%:: SCCS/s.%
--- a/asn1/asn1c/NativeEnumerated.c
+++ b/asn1/asn1c/NativeEnumerated.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2004 Lev Walkin <vlm@lionet.info>. All rights reserved.
+ * Copyright (c) 2004, 2007 Lev Walkin <vlm@lionet.info>. All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
 /*
@@ -15,7 +15,7 @@
 /*
 * NativeEnumerated basic type description.
 */
-static ber_tlv_tag_t asn_DEF_NativeEnumerated_tags[] = {
+static const ber_tlv_tag_t asn_DEF_NativeEnumerated_tags[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (10 << 2))
 };
 asn_TYPE_descriptor_t asn_DEF_NativeEnumerated = {
@@ -52,7 +52,7 @@ NativeEnumerated_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
        (void)ilevel;
        (void)flags;

-        if(!native) _ASN_ENCODE_FAILED;
+        if(!native) ASN__ENCODE_FAILED;

 	el = INTEGER_map_value2enum(specs, *native);
 	if(el) {
@@ -61,12 +61,12 @@ NativeEnumerated_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,

 		er.encoded = snprintf(src, srcsize, "<%s/>", el->enum_name);
 		assert(er.encoded > 0 && (size_t)er.encoded < srcsize);
-		if(cb(src, er.encoded, app_key) < 0) _ASN_ENCODE_FAILED;
-		_ASN_ENCODED_OK(er);
+		if(cb(src, er.encoded, app_key) < 0) ASN__ENCODE_FAILED;
+		ASN__ENCODED_OK(er);
 	} else {
 		ASN_DEBUG("ASN.1 forbids dealing with "
 			"unknown value of ENUMERATED type");
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}
 }

@@ -84,39 +84,39 @@ NativeEnumerated_decode_uper(asn_codec_ctx_t *opt_codec_ctx,

 	if(constraints) ct = &constraints->value;
 	else if(td->per_constraints) ct = &td->per_constraints->value;
-	else _ASN_DECODE_FAILED;	/* Mandatory! */
-	if(!specs) _ASN_DECODE_FAILED;
+	else ASN__DECODE_FAILED;	/* Mandatory! */
+	if(!specs) ASN__DECODE_FAILED;

 	if(!native) {
 		native = (long *)(*sptr = CALLOC(1, sizeof(*native)));
-		if(!native) _ASN_DECODE_FAILED;
+		if(!native) ASN__DECODE_FAILED;
 	}

 	ASN_DEBUG("Decoding %s as NativeEnumerated", td->name);

 	if(ct->flags & APC_EXTENSIBLE) {
 		int inext = per_get_few_bits(pd, 1);
-		if(inext < 0) _ASN_DECODE_STARVED;
+		if(inext < 0) ASN__DECODE_STARVED;
 		if(inext) ct = 0;
 	}

 	if(ct && ct->range_bits >= 0) {
 		value = per_get_few_bits(pd, ct->range_bits);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		if(value >= (specs->extension
 			? specs->extension - 1 : specs->map_count))
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 	} else {
 		if(!specs->extension)
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 		/*
 		 * X.691, #10.6: normally small non-negative whole number;
 		 */
 		value = uper_get_nsnnwn(pd);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		value += specs->extension - 1;
 		if(value >= specs->map_count)
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 	}

 	*native = specs->value2enum[value].nat_value;
@@ -145,28 +145,28 @@ NativeEnumerated_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_per_constraint_t *ct;
 	int inext = 0;
 	asn_INTEGER_enum_map_t key;
-	asn_INTEGER_enum_map_t *kf;
+	const asn_INTEGER_enum_map_t *kf;

-	if(!sptr) _ASN_ENCODE_FAILED;
-	if(!specs) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;
+	if(!specs) ASN__ENCODE_FAILED;

 	if(constraints) ct = &constraints->value;
 	else if(td->per_constraints) ct = &td->per_constraints->value;
-	else _ASN_ENCODE_FAILED;	/* Mandatory! */
+	else ASN__ENCODE_FAILED;	/* Mandatory! */

 	ASN_DEBUG("Encoding %s as NativeEnumerated", td->name);

 	er.encoded = 0;

 	native = *(long *)sptr;
-	if(native < 0) _ASN_ENCODE_FAILED;
+	if(native < 0) ASN__ENCODE_FAILED;

 	key.nat_value = native;
 	kf = bsearch(&key, specs->value2enum, specs->map_count,
 		sizeof(key), NativeEnumerated__compar_value2enum);
 	if(!kf) {
 		ASN_DEBUG("No element corresponds to %ld", native);
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}
 	value = kf - specs->value2enum;

@@ -177,28 +177,31 @@ NativeEnumerated_encode_uper(asn_TYPE_descriptor_t *td,
 			inext = 1;
 	}
 	if(ct->flags & APC_EXTENSIBLE) {
-		if(per_put_few_bits(po, inext, 0))
-			_ASN_ENCODE_FAILED;
-		ct = 0;
+		if(per_put_few_bits(po, inext, 1))
+			ASN__ENCODE_FAILED;
+		if(inext) ct = 0;
 	} else if(inext) {
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}

 	if(ct && ct->range_bits >= 0) {
 		if(per_put_few_bits(po, value, ct->range_bits))
-			_ASN_ENCODE_FAILED;
-		_ASN_ENCODED_OK(er);
+			ASN__ENCODE_FAILED;
+		ASN__ENCODED_OK(er);
 	}

 	if(!specs->extension)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	/*
 	 * X.691, #10.6: normally small non-negative whole number;
 	 */
-	if(uper_put_nsnnwn(po, value - (specs->extension - 1)))
-		_ASN_ENCODE_FAILED;
+	ASN_DEBUG("value = %ld, ext = %d, inext = %d, res = %ld",
+		value, specs->extension, inext,
+		value - (inext ? (specs->extension - 1) : 0));
+	if(uper_put_nsnnwn(po, value - (inext ? (specs->extension - 1) : 0)))
+		ASN__ENCODE_FAILED;

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

--- a/asn1/asn1c/NativeInteger.c
+++ b/asn1/asn1c/NativeInteger.c
@@ -16,7 +16,7 @@
 /*
 * NativeInteger basic type description.
 */
-static ber_tlv_tag_t asn_DEF_NativeInteger_tags[] = {
+static const ber_tlv_tag_t asn_DEF_NativeInteger_tags[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (2 << 2))
 };
 asn_TYPE_descriptor_t asn_DEF_NativeInteger = {
@@ -48,6 +48,7 @@ asn_dec_rval_t
 NativeInteger_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 	asn_TYPE_descriptor_t *td,
 	void **nint_ptr, const void *buf_ptr, size_t size, int tag_mode) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	long *native = (long *)*nint_ptr;
 	asn_dec_rval_t rval;
 	ber_tlv_len_t length;
@@ -105,7 +106,9 @@ NativeInteger_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 		tmp.buf = (uint8_t *)unconst_buf.nonconstbuf;
 		tmp.size = length;

-		if(asn_INTEGER2long(&tmp, &l)) {
+		if((specs&&specs->field_unsigned)
+			? asn_INTEGER2ulong(&tmp, (unsigned long *)&l) /* sic */
+			: asn_INTEGER2long(&tmp, &l)) {
 			rval.code = RC_FAIL;
 			rval.consumed = 0;
 			return rval;
@@ -145,7 +148,7 @@ NativeInteger_encode_der(asn_TYPE_descriptor_t *sd, void *ptr,

 	/* Prepare a fake INTEGER */
 	for(p = buf + sizeof(buf) - 1; p >= buf; p--, native >>= 8)
-		*p = native;
+		*p = (uint8_t)native;

 	tmp.buf = buf;
 	tmp.size = sizeof(buf);
@@ -167,6 +170,7 @@ asn_dec_rval_t
 NativeInteger_decode_xer(asn_codec_ctx_t *opt_codec_ctx,
 	asn_TYPE_descriptor_t *td, void **sptr, const char *opt_mname,
 		const void *buf_ptr, size_t size) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	asn_dec_rval_t rval;
 	INTEGER_t st;
 	void *st_ptr = (void *)&st;
@@ -174,7 +178,7 @@ NativeInteger_decode_xer(asn_codec_ctx_t *opt_codec_ctx,

 	if(!native) {
 		native = (long *)(*sptr = CALLOC(1, sizeof(*native)));
-		if(!native) _ASN_DECODE_FAILED;
+		if(!native) ASN__DECODE_FAILED;
 	}

 	memset(&st, 0, sizeof(st));
@@ -182,7 +186,9 @@ NativeInteger_decode_xer(asn_codec_ctx_t *opt_codec_ctx,
 		opt_mname, buf_ptr, size);
 	if(rval.code == RC_OK) {
 		long l;
-		if(asn_INTEGER2long(&st, &l)) {
+		if((specs&&specs->field_unsigned)
+			? asn_INTEGER2ulong(&st, (unsigned long *)&l) /* sic */
+			: asn_INTEGER2long(&st, &l)) {
 			rval.code = RC_FAIL;
 			rval.consumed = 0;
 		} else {
@@ -205,6 +211,7 @@ asn_enc_rval_t
 NativeInteger_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	int ilevel, enum xer_encoder_flags_e flags,
 		asn_app_consume_bytes_f *cb, void *app_key) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	char scratch[32];	/* Enough for 64-bit int */
 	asn_enc_rval_t er;
 	const long *native = (const long *)sptr;
@@ -212,14 +219,16 @@ NativeInteger_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	(void)ilevel;
 	(void)flags;

-	if(!native) _ASN_ENCODE_FAILED;
+	if(!native) ASN__ENCODE_FAILED;

-	er.encoded = snprintf(scratch, sizeof(scratch), "%ld", *native);
+	er.encoded = snprintf(scratch, sizeof(scratch),
+			(specs && specs->field_unsigned)
+			? "%lu" : "%ld", *native);
 	if(er.encoded <= 0 || (size_t)er.encoded >= sizeof(scratch)
 		|| cb(scratch, er.encoded, app_key) < 0)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

 asn_dec_rval_t
@@ -227,6 +236,7 @@ NativeInteger_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 	asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void **sptr, asn_per_data_t *pd) {

+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	asn_dec_rval_t rval;
 	long *native = (long *)*sptr;
 	INTEGER_t tmpint;
@@ -237,14 +247,16 @@ NativeInteger_decode_uper(asn_codec_ctx_t *opt_codec_ctx,

 	if(!native) {
 		native = (long *)(*sptr = CALLOC(1, sizeof(*native)));
-		if(!native) _ASN_DECODE_FAILED;
+		if(!native) ASN__DECODE_FAILED;
 	}

 	memset(&tmpint, 0, sizeof tmpint);
 	rval = INTEGER_decode_uper(opt_codec_ctx, td, constraints,
 				   &tmpintptr, pd);
 	if(rval.code == RC_OK) {
-		if(asn_INTEGER2long(&tmpint, native))
+		if((specs&&specs->field_unsigned)
+			? asn_INTEGER2ulong(&tmpint, (unsigned long *)native)
+			: asn_INTEGER2long(&tmpint, native))
 			rval.code = RC_FAIL;
 		else
 			ASN_DEBUG("NativeInteger %s got value %ld",
@@ -258,19 +270,22 @@ NativeInteger_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 asn_enc_rval_t
 NativeInteger_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void *sptr, asn_per_outp_t *po) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	asn_enc_rval_t er;
 	long native;
 	INTEGER_t tmpint;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;

 	native = *(long *)sptr;

 	ASN_DEBUG("Encoding NativeInteger %s %ld (UPER)", td->name, native);

 	memset(&tmpint, 0, sizeof(tmpint));
-	if(asn_long2INTEGER(&tmpint, native))
-		_ASN_ENCODE_FAILED;
+	if((specs&&specs->field_unsigned)
+		? asn_ulong2INTEGER(&tmpint, native)
+		: asn_long2INTEGER(&tmpint, native))
+		ASN__ENCODE_FAILED;
 	er = INTEGER_encode_uper(td, constraints, &tmpint, po);
 	ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_INTEGER, &tmpint);
 	return er;
@@ -282,6 +297,7 @@ NativeInteger_encode_uper(asn_TYPE_descriptor_t *td,
 int
 NativeInteger_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 	asn_app_consume_bytes_f *cb, void *app_key) {
+	asn_INTEGER_specifics_t *specs=(asn_INTEGER_specifics_t *)td->specifics;
 	const long *native = (const long *)sptr;
 	char scratch[32];	/* Enough for 64-bit int */
 	int ret;
@@ -290,7 +306,9 @@ NativeInteger_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 	(void)ilevel;	/* Unused argument */

 	if(native) {
-		ret = snprintf(scratch, sizeof(scratch), "%ld", *native);
+		ret = snprintf(scratch, sizeof(scratch),
+			(specs && specs->field_unsigned)
+			? "%lu" : "%ld", *native);
 		assert(ret > 0 && (size_t)ret < sizeof(scratch));
 		return (cb(scratch, ret, app_key) < 0) ? -1 : 0;
 	} else {
--- a/asn1/asn1c/OCTET_STRING.c
+++ b/asn1/asn1c/OCTET_STRING.c
@@ -11,16 +11,18 @@
 /*
 * OCTET STRING basic type description.
 */
-static ber_tlv_tag_t asn_DEF_OCTET_STRING_tags[] = {
+static const ber_tlv_tag_t asn_DEF_OCTET_STRING_tags[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (4 << 2))
 };
-static asn_OCTET_STRING_specifics_t asn_DEF_OCTET_STRING_specs = {
+static const asn_OCTET_STRING_specifics_t asn_DEF_OCTET_STRING_specs = {
 	sizeof(OCTET_STRING_t),
 	offsetof(OCTET_STRING_t, _asn_ctx),
-	0
+	ASN_OSUBV_STR
 };
-static asn_per_constraint_t asn_DEF_OCTET_STRING_constraint = {
-	APC_SEMI_CONSTRAINED, -1, -1, 0, 0
+static const asn_per_constraints_t asn_DEF_OCTET_STRING_constraints = {
+	{ APC_CONSTRAINED, 8, 8, 0, 255 },
+	{ APC_SEMI_CONSTRAINED, -1, -1, 0, 0 },
+	0, 0
 };
 asn_TYPE_descriptor_t asn_DEF_OCTET_STRING = {
 	"OCTET STRING",		/* Canonical name */
@@ -102,15 +104,6 @@ asn_TYPE_descriptor_t asn_DEF_OCTET_STRING = {
 		st->size = _es;						\
 	} while(0)

-/*
- * Internal variant of the OCTET STRING.
- */
-typedef enum OS_type {
-	_TT_GENERIC	= 0,	/* Just a random OCTET STRING */
-	_TT_BIT_STRING	= 1,	/* BIT STRING type, a special case */
-	_TT_ANY		= 2	/* ANY type, a special case too */
-} OS_type_e;
-
 /*
 * The main reason why ASN.1 is still alive is that too much time and effort
 * is necessary for learning it more or less adequately, thus creating a gut
@@ -185,11 +178,11 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 	struct _stack *stck;		/* Expectations stack structure */
 	struct _stack_el *sel = 0;	/* Stack element */
 	int tlv_constr;
-	OS_type_e type_variant = (OS_type_e)specs->subvariant;
+	enum asn_OS_Subvariant type_variant = specs->subvariant;

 	ASN_DEBUG("Decoding %s as %s (frame %ld)",
 		td->name,
-		(type_variant == _TT_GENERIC) ?
+		(type_variant == ASN_OSUBV_STR) ?
 			"OCTET STRING" : "OS-SpecialCase",
 		(long)size);

@@ -230,7 +223,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 			 * Jump into stackless primitive decoding.
 			 */
 			_CH_PHASE(ctx, 3);
-			if(type_variant == _TT_ANY && tag_mode != 1)
+			if(type_variant == ASN_OSUBV_ANY && tag_mode != 1)
 				APPEND(buf_ptr, rval.consumed);
 			ADVANCE(rval.consumed);
 			goto phase3;
@@ -309,7 +302,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,

 			ASN_DEBUG("Eat EOC; wn=%d--", sel->want_nulls);

-			if(type_variant == _TT_ANY
+			if(type_variant == ASN_OSUBV_ANY
 			&& (tag_mode != 1 || sel->cont_level))
 				APPEND("\0\0", 2);

@@ -334,10 +327,10 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 		 * depending on ASN.1 type being decoded.
 		 */
 		switch(type_variant) {
-		case _TT_BIT_STRING:
+		case ASN_OSUBV_BIT:
 			/* X.690: 8.6.4.1, NOTE 2 */
 			/* Fall through */
-		case _TT_GENERIC:
+		case ASN_OSUBV_STR:
 		default:
 			if(sel) {
 				int level = sel->cont_level;
@@ -352,7 +345,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 				/* else, Fall through */
 			}
 			/* Fall through */
-		case _TT_ANY:
+		case ASN_OSUBV_ANY:
 			expected_tag = tlv_tag;
 			break;
 		}
@@ -397,7 +390,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 		} else {
 			sel->left = tlv_len;
 		}
-		if(type_variant == _TT_ANY
+		if(type_variant == ASN_OSUBV_ANY
 		&& (tag_mode != 1 || sel->cont_level))
 			APPEND(buf_ptr, tlvl);
 		sel->got += tlvl;
@@ -431,7 +424,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 		len = ((ber_tlv_len_t)size < sel->left)
 				? (ber_tlv_len_t)size : sel->left;
 		if(len > 0) {
-			if(type_variant == _TT_BIT_STRING
+			if(type_variant == ASN_OSUBV_BIT
 			&& sel->bits_chopped == 0) {
 				/* Put the unused-bits-octet away */
 				st->bits_unused = *(const uint8_t *)buf_ptr;
@@ -464,7 +457,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,

 		if(size < (size_t)ctx->left) {
 			if(!size) RETURN(RC_WMORE);
-			if(type_variant == _TT_BIT_STRING && !ctx->context) {
+			if(type_variant == ASN_OSUBV_BIT && !ctx->context) {
 				st->bits_unused = *(const uint8_t *)buf_ptr;
 				ctx->left--;
 				ADVANCE(1);
@@ -475,7 +468,7 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 			ADVANCE(size);
 			RETURN(RC_WMORE);
 		} else {
-			if(type_variant == _TT_BIT_STRING
+			if(type_variant == ASN_OSUBV_BIT
 			&& !ctx->context && ctx->left) {
 				st->bits_unused = *(const uint8_t *)buf_ptr;
 				ctx->left--;
@@ -502,14 +495,14 @@ OCTET_STRING_decode_ber(asn_codec_ctx_t *opt_codec_ctx,
 	/*
 	 * BIT STRING-specific processing.
 	 */
-	if(type_variant == _TT_BIT_STRING && st->size) {
+	if(type_variant == ASN_OSUBV_BIT && st->size) {
 		/* Finalize BIT STRING: zero out unused bits. */
 		st->buf[st->size-1] &= 0xff << st->bits_unused;
 	}

 	ASN_DEBUG("Took %ld bytes to encode %s: [%s]:%ld",
 		(long)consumed_myself, td->name,
-		(type_variant == _TT_GENERIC) ? (char *)st->buf : "<data>",
+		(type_variant == ASN_OSUBV_STR) ? (char *)st->buf : "<data>",
 		(long)st->size);


@@ -528,7 +521,7 @@ OCTET_STRING_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 				? (asn_OCTET_STRING_specifics_t *)td->specifics
 				: &asn_DEF_OCTET_STRING_specs;
 	BIT_STRING_t *st = (BIT_STRING_t *)sptr;
-	OS_type_e type_variant = (OS_type_e)specs->subvariant;
+	enum asn_OS_Subvariant type_variant = specs->subvariant;
 	int fix_last_byte = 0;

 	ASN_DEBUG("%s %s as OCTET STRING",
@@ -537,10 +530,11 @@ OCTET_STRING_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 	/*
 	 * Write tags.
 	 */
-	if(type_variant != _TT_ANY || tag_mode == 1) {
+	if(type_variant != ASN_OSUBV_ANY || tag_mode == 1) {
 		er.encoded = der_write_tags(td,
-				(type_variant == _TT_BIT_STRING) + st->size,
-			tag_mode, type_variant == _TT_ANY, tag, cb, app_key);
+				(type_variant == ASN_OSUBV_BIT) + st->size,
+			tag_mode, type_variant == ASN_OSUBV_ANY, tag,
+			cb, app_key);
 		if(er.encoded == -1) {
 			er.failed_type = td;
 			er.structure_ptr = sptr;
@@ -548,45 +542,45 @@ OCTET_STRING_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 		}
 	} else {
 		/* Disallow: [<tag>] IMPLICIT ANY */
-		assert(type_variant != _TT_ANY || tag_mode != -1);
+		assert(type_variant != ASN_OSUBV_ANY || tag_mode != -1);
 		er.encoded = 0;
 	}

 	if(!cb) {
-		er.encoded += (type_variant == _TT_BIT_STRING) + st->size;
-		_ASN_ENCODED_OK(er);
+		er.encoded += (type_variant == ASN_OSUBV_BIT) + st->size;
+		ASN__ENCODED_OK(er);
 	}

 	/*
 	 * Prepare to deal with the last octet of BIT STRING.
 	 */
-	if(type_variant == _TT_BIT_STRING) {
+	if(type_variant == ASN_OSUBV_BIT) {
 		uint8_t b = st->bits_unused & 0x07;
 		if(b && st->size) fix_last_byte = 1;
-		_ASN_CALLBACK(&b, 1);
+		ASN__CALLBACK(&b, 1);
 		er.encoded++;
 	}

 	/* Invoke callback for the main part of the buffer */
-	_ASN_CALLBACK(st->buf, st->size - fix_last_byte);
+	ASN__CALLBACK(st->buf, st->size - fix_last_byte);

 	/* The last octet should be stripped off the unused bits */
 	if(fix_last_byte) {
 		uint8_t b = st->buf[st->size-1] & (0xff << st->bits_unused);
-		_ASN_CALLBACK(&b, 1);
+		ASN__CALLBACK(&b, 1);
 	}

 	er.encoded += st->size;
-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }

 asn_enc_rval_t
 OCTET_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	int ilevel, enum xer_encoder_flags_e flags,
 		asn_app_consume_bytes_f *cb, void *app_key) {
-	static const char *h2c = "0123456789ABCDEF";
+	const char * const h2c = "0123456789ABCDEF";
 	const OCTET_STRING_t *st = (const OCTET_STRING_t *)sptr;
 	asn_enc_rval_t er;
 	char scratch[16 * 3 + 4];
@@ -595,8 +589,8 @@ OCTET_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	uint8_t *end;
 	size_t i;

-	if(!st || !st->buf)
-		_ASN_ENCODE_FAILED;
+	if(!st || (!st->buf && st->size))
+		ASN__ENCODE_FAILED;

 	er.encoded = 0;

@@ -609,7 +603,7 @@ OCTET_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		char *scend = scratch + (sizeof(scratch) - 2);
 		for(; buf < end; buf++) {
 			if(p >= scend) {
-				_ASN_CALLBACK(scratch, p - scratch);
+				ASN__CALLBACK(scratch, p - scratch);
 				er.encoded += p - scratch;
 				p = scratch;
 			}
@@ -617,15 +611,15 @@ OCTET_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 			*p++ = h2c[*buf & 0x0F];
 		}

-		_ASN_CALLBACK(scratch, p-scratch);	/* Dump the rest */
+		ASN__CALLBACK(scratch, p-scratch);	/* Dump the rest */
 		er.encoded += p - scratch;
 	} else {
 		for(i = 0; buf < end; buf++, i++) {
 			if(!(i % 16) && (i || st->size > 16)) {
-				_ASN_CALLBACK(scratch, p-scratch);
+				ASN__CALLBACK(scratch, p-scratch);
 				er.encoded += (p-scratch);
 				p = scratch;
-				_i_ASN_TEXT_INDENT(1, ilevel);
+				ASN__TEXT_INDENT(1, ilevel);
 			}
 			*p++ = h2c[(*buf >> 4) & 0x0F];
 			*p++ = h2c[*buf & 0x0F];
@@ -633,20 +627,20 @@ OCTET_STRING_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		}
 		if(p - scratch) {
 			p--;	/* Remove the tail space */
-			_ASN_CALLBACK(scratch, p-scratch); /* Dump the rest */
+			ASN__CALLBACK(scratch, p-scratch); /* Dump the rest */
 			er.encoded += p - scratch;
 			if(st->size > 16)
-				_i_ASN_TEXT_INDENT(1, ilevel-1);
+				ASN__TEXT_INDENT(1, ilevel-1);
 		}
 	}

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }

-static struct OCTET_STRING__xer_escape_table_s {
-	char *string;
+static const struct OCTET_STRING__xer_escape_table_s {
+	const char *string;
 	int size;
 } OCTET_STRING__xer_escape_table[] = {
 #define	OSXET(s)	{ s, sizeof(s) - 1 }
@@ -708,7 +702,7 @@ OS__check_escaped_control_char(const void *buf, int size) {
 	 * nested table lookups).
 	 */
 	for(i = 0; i < 32 /* Don't spend time on the bottom half */; i++) {
-		struct OCTET_STRING__xer_escape_table_s *el;
+		const struct OCTET_STRING__xer_escape_table_s *el;
 		el = &OCTET_STRING__xer_escape_table[i];
 		if(el->size == size && memcmp(buf, el->string, size) == 0)
 			return i;
@@ -751,8 +745,8 @@ OCTET_STRING_encode_xer_utf8(asn_TYPE_descriptor_t *td, void *sptr,
 	(void)ilevel;	/* Unused argument */
 	(void)flags;	/* Unused argument */

-	if(!st || !st->buf)
-		_ASN_ENCODE_FAILED;
+	if(!st || (!st->buf && st->size))
+		ASN__ENCODE_FAILED;

 	buf = st->buf;
 	end = buf + st->size;
@@ -769,7 +763,7 @@ OCTET_STRING_encode_xer_utf8(asn_TYPE_descriptor_t *td, void *sptr,
 			if(((buf - ss) && cb(ss, buf - ss, app_key) < 0)
 			|| cb(OCTET_STRING__xer_escape_table[ch].string, s_len,
 					app_key) < 0)
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			encoded_len += (buf - ss) + s_len;
 			ss = buf + 1;
 		}
@@ -777,10 +771,10 @@ OCTET_STRING_encode_xer_utf8(asn_TYPE_descriptor_t *td, void *sptr,

 	encoded_len += (buf - ss);
 	if((buf - ss) && cb(ss, buf - ss, app_key) < 0)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	er.encoded = encoded_len;
-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

 /*
@@ -1197,6 +1191,135 @@ OCTET_STRING_decode_xer_utf8(asn_codec_ctx_t *opt_codec_ctx,
 		OCTET_STRING__convert_entrefs);
 }

+static int
+OCTET_STRING_per_get_characters(asn_per_data_t *po, uint8_t *buf,
+		size_t units, unsigned int bpc, unsigned int unit_bits,
+		long lb, long ub, asn_per_constraints_t *pc) {
+	uint8_t *end = buf + units * bpc;
+
+	ASN_DEBUG("Expanding %d characters into (%ld..%ld):%d",
+		(int)units, lb, ub, unit_bits);
+
+	/* X.691: 27.5.4 */
+	if((unsigned long)ub <= ((unsigned long)2 << (unit_bits - 1))) {
+		/* Decode without translation */
+		lb = 0;
+	} else if(pc && pc->code2value) {
+		if(unit_bits > 16)
+			return 1;	/* FATAL: can't have constrained
+					 * UniversalString with more than
+					 * 16 million code points */
+		for(; buf < end; buf += bpc) {
+			int value;
+			int code = per_get_few_bits(po, unit_bits);
+			if(code < 0) return -1;	/* WMORE */
+			value = pc->code2value(code);
+			if(value < 0) {
+				ASN_DEBUG("Code %d (0x%02x) is"
+					" not in map (%ld..%ld)",
+					code, code, lb, ub);
+				return 1;	/* FATAL */
+			}
+			switch(bpc) {
+			case 1: *buf = value; break;
+			case 2: buf[0] = value >> 8; buf[1] = value; break;
+			case 4: buf[0] = value >> 24; buf[1] = value >> 16;
+				buf[2] = value >> 8; buf[3] = value; break;
+			}
+		}
+		return 0;
+	}
+
+	/* Shortcut the no-op copying to the aligned structure */
+	if(lb == 0 && (unit_bits == 8 * bpc)) {
+		return per_get_many_bits(po, buf, 0, unit_bits * units);
+	}
+
+	for(; buf < end; buf += bpc) {
+		int code = per_get_few_bits(po, unit_bits);
+		int ch = code + lb;
+		if(code < 0) return -1;	/* WMORE */
+		if(ch > ub) {
+			ASN_DEBUG("Code %d is out of range (%ld..%ld)",
+				ch, lb, ub);
+			return 1;	/* FATAL */
+		}
+		switch(bpc) {
+		case 1: *buf = ch; break;
+		case 2: buf[0] = ch >> 8; buf[1] = ch; break;
+		case 4: buf[0] = ch >> 24; buf[1] = ch >> 16;
+			buf[2] = ch >> 8; buf[3] = ch; break;
+		}
+	}
+
+	return 0;
+}
+
+static int
+OCTET_STRING_per_put_characters(asn_per_outp_t *po, const uint8_t *buf,
+		size_t units, unsigned int bpc, unsigned int unit_bits,
+		long lb, long ub, asn_per_constraints_t *pc) {
+	const uint8_t *end = buf + units * bpc;
+
+	ASN_DEBUG("Squeezing %d characters into (%ld..%ld):%d (%d bpc)",
+		(int)units, lb, ub, unit_bits, bpc);
+
+	/* X.691: 27.5.4 */
+	if((unsigned long)ub <= ((unsigned long)2 << (unit_bits - 1))) {
+		/* Encode as is */
+		lb = 0;
+	} else if(pc && pc->value2code) {
+		for(; buf < end; buf += bpc) {
+			int code;
+			uint32_t value;
+			switch(bpc) {
+			case 1: value = *(const uint8_t *)buf; break;
+			case 2: value = (buf[0] << 8) | buf[1]; break;
+			case 4: value = (buf[0] << 24) | (buf[1] << 16)
+					| (buf[2] << 8) | buf[3]; break;
+			default: return -1;
+			}
+			code = pc->value2code(value);
+			if(code < 0) {
+				ASN_DEBUG("Character %d (0x%02x) is"
+					" not in map (%ld..%ld)",
+					*buf, *buf, lb, ub);
+				return -1;
+			}
+			if(per_put_few_bits(po, code, unit_bits))
+				return -1;
+		}
+	}
+
+	/* Shortcut the no-op copying to the aligned structure */
+	if(lb == 0 && (unit_bits == 8 * bpc)) {
+		return per_put_many_bits(po, buf, unit_bits * units);
+	}
+
+	for(ub -= lb; buf < end; buf += bpc) {
+		int ch;
+		uint32_t value;
+		switch(bpc) {
+		case 1: value = *(const uint8_t *)buf; break;
+		case 2: value = (buf[0] << 8) | buf[1]; break;
+		case 4: value = (buf[0] << 24) | (buf[1] << 16)
+				| (buf[2] << 8) | buf[3]; break;
+		default: return -1;
+		}
+		ch = value - lb;
+		if(ch < 0 || ch > ub) {
+			ASN_DEBUG("Character %d (0x%02x)"
+			" is out of range (%ld..%ld)",
+				*buf, *buf, lb, ub + lb);
+			return -1;
+		}
+		if(per_put_few_bits(po, ch, unit_bits))
+			return -1;
+	}
+
+	return 0;
+}
+
 asn_dec_rval_t
 OCTET_STRING_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 	asn_TYPE_descriptor_t *td, asn_per_constraints_t *constraints,
@@ -1205,18 +1328,62 @@ OCTET_STRING_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 	asn_OCTET_STRING_specifics_t *specs = td->specifics
 		? (asn_OCTET_STRING_specifics_t *)td->specifics
 		: &asn_DEF_OCTET_STRING_specs;
-	asn_per_constraint_t *ct = constraints ? &constraints->size
-				: (td->per_constraints
-					? &td->per_constraints->size
-					: &asn_DEF_OCTET_STRING_constraint);
+	asn_per_constraints_t *pc = constraints ? constraints
+				: td->per_constraints;
+	asn_per_constraint_t *cval;
+	asn_per_constraint_t *csiz;
 	asn_dec_rval_t rval = { RC_OK, 0 };
 	BIT_STRING_t *st = (BIT_STRING_t *)*sptr;
 	ssize_t consumed_myself = 0;
 	int repeat;
-	int unit_bits = (specs->subvariant != 1) * 7 + 1;
+	enum {
+		OS__BPC_BIT	= 0,
+		OS__BPC_CHAR	= 1,
+		OS__BPC_U16	= 2,
+		OS__BPC_U32	= 4
+	} bpc;	/* Bytes per character */
+	unsigned int unit_bits;
+	unsigned int canonical_unit_bits;

 	(void)opt_codec_ctx;

+	if(pc) {
+		cval = &pc->value;
+		csiz = &pc->size;
+	} else {
+		cval = &asn_DEF_OCTET_STRING_constraints.value;
+		csiz = &asn_DEF_OCTET_STRING_constraints.size;
+	}
+
+	switch(specs->subvariant) {
+	default:
+	case ASN_OSUBV_ANY:
+		ASN_DEBUG("Unrecognized subvariant %d", specs->subvariant);
+		RETURN(RC_FAIL);
+	case ASN_OSUBV_BIT:
+		canonical_unit_bits = unit_bits = 1;
+		bpc = OS__BPC_BIT;
+		break;
+	case ASN_OSUBV_STR:
+		canonical_unit_bits = unit_bits = 8;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_CHAR;
+		break;
+	case ASN_OSUBV_U16:
+		canonical_unit_bits = unit_bits = 16;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_U16;
+		break;
+	case ASN_OSUBV_U32:
+		canonical_unit_bits = unit_bits = 32;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_U32;
+		break;
+	}
+
 	/*
 	 * Allocate the string.
 	 */
@@ -1225,24 +1392,26 @@ OCTET_STRING_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 		if(!st) RETURN(RC_FAIL);
 	}

-	ASN_DEBUG("PER Decoding %s %ld .. %ld bits %d",
-		ct->flags & APC_EXTENSIBLE ? "extensible" : "fixed",
-		ct->lower_bound, ct->upper_bound, ct->effective_bits);
+	ASN_DEBUG("PER Decoding %s size %ld .. %ld bits %d",
+		csiz->flags & APC_EXTENSIBLE ? "extensible" : "non-extensible",
+		csiz->lower_bound, csiz->upper_bound, csiz->effective_bits);

-	if(ct->flags & APC_EXTENSIBLE) {
+	if(csiz->flags & APC_EXTENSIBLE) {
 		int inext = per_get_few_bits(pd, 1);
 		if(inext < 0) RETURN(RC_WMORE);
-		if(inext) ct = &asn_DEF_OCTET_STRING_constraint;
-		consumed_myself = 0;
+		if(inext) {
+			csiz = &asn_DEF_OCTET_STRING_constraints.size;
+			cval = &asn_DEF_OCTET_STRING_constraints.value;
+			unit_bits = canonical_unit_bits;
+		}
 	}

-	if(ct->effective_bits >= 0
-	&& (!st->buf || st->size < ct->upper_bound)) {
+	if(csiz->effective_bits >= 0) {
 		FREEMEM(st->buf);
-		if(unit_bits == 1) {
-			st->size = (ct->upper_bound + 7) >> 3;
+		if(bpc) {
+			st->size = csiz->upper_bound * bpc;
 		} else {
-			st->size = ct->upper_bound;
+			st->size = (csiz->upper_bound + 7) >> 3;
 		}
 		st->buf = (uint8_t *)MALLOC(st->size + 1);
 		if(!st->buf) { st->size = 0; RETURN(RC_FAIL); }
@@ -1251,46 +1420,70 @@ OCTET_STRING_decode_uper(asn_codec_ctx_t *opt_codec_ctx,
 	/* X.691, #16.5: zero-length encoding */
 	/* X.691, #16.6: short fixed length encoding (up to 2 octets) */
 	/* X.691, #16.7: long fixed length encoding (up to 64K octets) */
-	if(ct->effective_bits == 0) {
-		int ret = per_get_many_bits(pd, st->buf, 0,
-					    unit_bits * ct->upper_bound);
+	if(csiz->effective_bits == 0) {
+		int ret;
+		if(bpc) {
+			ASN_DEBUG("Encoding OCTET STRING size %ld",
+				csiz->upper_bound);
+			ret = OCTET_STRING_per_get_characters(pd, st->buf,
+				csiz->upper_bound, bpc, unit_bits,
+				cval->lower_bound, cval->upper_bound, pc);
+			if(ret > 0) RETURN(RC_FAIL);
+		} else {
+			ASN_DEBUG("Encoding BIT STRING size %ld",
+				csiz->upper_bound);
+			ret = per_get_many_bits(pd, st->buf, 0,
+					    unit_bits * csiz->upper_bound);
+		}
 		if(ret < 0) RETURN(RC_WMORE);
-		consumed_myself += unit_bits * ct->upper_bound;
+		consumed_myself += unit_bits * csiz->upper_bound;
 		st->buf[st->size] = 0;
-		if(unit_bits == 1 && (ct->upper_bound & 0x7))
-			st->bits_unused = 8 - (ct->upper_bound & 0x7);
+		if(bpc == 0) {
+			int ubs = (csiz->upper_bound & 0x7);
+			st->bits_unused = ubs ? 8 - ubs : 0;
+		}
 		RETURN(RC_OK);
 	}

 	st->size = 0;
 	do {
+		ssize_t raw_len;
 		ssize_t len_bytes;
 		ssize_t len_bits;
 		void *p;
 		int ret;

 		/* Get the PER length */
-		len_bits = uper_get_length(pd, ct->effective_bits, &repeat);
-		if(len_bits < 0) RETURN(RC_WMORE);
-		len_bits += ct->lower_bound;
+		raw_len = uper_get_length(pd, csiz->effective_bits, &repeat);
+		if(raw_len < 0) RETURN(RC_WMORE);
+		raw_len += csiz->lower_bound;

 		ASN_DEBUG("Got PER length eb %ld, len %ld, %s (%s)",
-			(long)ct->effective_bits, (long)len_bits,
+			(long)csiz->effective_bits, (long)raw_len,
 			repeat ? "repeat" : "once", td->name);
-		if(unit_bits == 1) {
+		if(bpc) {
+			len_bytes = raw_len * bpc;
+			len_bits = len_bytes * unit_bits;
+		} else {
+			len_bits = raw_len;
 			len_bytes = (len_bits + 7) >> 3;
 			if(len_bits & 0x7)
 				st->bits_unused = 8 - (len_bits & 0x7);
 			/* len_bits be multiple of 16K if repeat is set */
-		} else {
-			len_bytes = len_bits;
-			len_bits = len_bytes << 3;
 		}
 		p = REALLOC(st->buf, st->size + len_bytes + 1);
 		if(!p) RETURN(RC_FAIL);
 		st->buf = (uint8_t *)p;

-		ret = per_get_many_bits(pd, &st->buf[st->size], 0, len_bits);
+		if(bpc) {
+			ret = OCTET_STRING_per_get_characters(pd,
+				&st->buf[st->size], raw_len, bpc, unit_bits,
+				cval->lower_bound, cval->upper_bound, pc);
+			if(ret > 0) RETURN(RC_FAIL);
+		} else {
+			ret = per_get_many_bits(pd, &st->buf[st->size],
+				0, len_bits);
+		}
 		if(ret < 0) RETURN(RC_WMORE);
 		st->size += len_bytes;
 	} while(repeat);
@@ -1306,44 +1499,90 @@ OCTET_STRING_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_OCTET_STRING_specifics_t *specs = td->specifics
 		? (asn_OCTET_STRING_specifics_t *)td->specifics
 		: &asn_DEF_OCTET_STRING_specs;
-	asn_per_constraint_t *ct = constraints ? &constraints->size
-				: (td->per_constraints
-					? &td->per_constraints->size
-					: &asn_DEF_OCTET_STRING_constraint);
+	asn_per_constraints_t *pc = constraints ? constraints
+				: td->per_constraints;
+	asn_per_constraint_t *cval;
+	asn_per_constraint_t *csiz;
 	const BIT_STRING_t *st = (const BIT_STRING_t *)sptr;
-	int unit_bits = (specs->subvariant != 1) * 7 + 1;
-	asn_enc_rval_t er;
-	int ct_extensible = ct->flags & APC_EXTENSIBLE;
+	asn_enc_rval_t er = { 0, 0, 0 };
 	int inext = 0;		/* Lies not within extension root */
-	int sizeinunits = st->size;
+	unsigned int unit_bits;
+	unsigned int canonical_unit_bits;
+	unsigned int sizeinunits;
 	const uint8_t *buf;
 	int ret;
+	enum {
+		OS__BPC_BIT	= 0,
+		OS__BPC_CHAR	= 1,
+		OS__BPC_U16	= 2,
+		OS__BPC_U32	= 4
+	} bpc;	/* Bytes per character */
+	int ct_extensible;

-	if(!st || !st->buf)
-		_ASN_ENCODE_FAILED;
+	if(!st || (!st->buf && st->size))
+		ASN__ENCODE_FAILED;

-	if(unit_bits == 1) {
+	if(pc) {
+		cval = &pc->value;
+		csiz = &pc->size;
+	} else {
+		cval = &asn_DEF_OCTET_STRING_constraints.value;
+		csiz = &asn_DEF_OCTET_STRING_constraints.size;
+	}
+	ct_extensible = csiz->flags & APC_EXTENSIBLE;
+
+	switch(specs->subvariant) {
+	default:
+	case ASN_OSUBV_ANY:
+		ASN__ENCODE_FAILED;
+	case ASN_OSUBV_BIT:
+		canonical_unit_bits = unit_bits = 1;
+		bpc = OS__BPC_BIT;
+		sizeinunits = st->size * 8 - (st->bits_unused & 0x07);
 		ASN_DEBUG("BIT STRING of %d bytes, %d bits unused",
 				sizeinunits, st->bits_unused);
-		sizeinunits = sizeinunits * 8 - (st->bits_unused & 0x07);
+		break;
+	case ASN_OSUBV_STR:
+		canonical_unit_bits = unit_bits = 8;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_CHAR;
+		sizeinunits = st->size;
+		break;
+	case ASN_OSUBV_U16:
+		canonical_unit_bits = unit_bits = 16;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_U16;
+		sizeinunits = st->size / 2;
+		break;
+	case ASN_OSUBV_U32:
+		canonical_unit_bits = unit_bits = 32;
+		if(cval->flags & APC_CONSTRAINED)
+			unit_bits = cval->range_bits;
+		bpc = OS__BPC_U32;
+		sizeinunits = st->size / 4;
+		break;
 	}

 	ASN_DEBUG("Encoding %s into %d units of %d bits"
-		" (%d..%d, effective %d)%s",
+		" (%ld..%ld, effective %d)%s",
 		td->name, sizeinunits, unit_bits,
-		ct->lower_bound, ct->upper_bound,
-		ct->effective_bits, ct_extensible ? " EXT" : "");
+		csiz->lower_bound, csiz->upper_bound,
+		csiz->effective_bits, ct_extensible ? " EXT" : "");

-	/* Figure out wheter size lies within PER visible consrtaint */
+	/* Figure out whether size lies within PER visible constraint */

-	if(ct->effective_bits >= 0) {
-		if(sizeinunits < ct->lower_bound
-		|| sizeinunits > ct->upper_bound) {
+	if(csiz->effective_bits >= 0) {
+		if((int)sizeinunits < csiz->lower_bound
+		|| (int)sizeinunits > csiz->upper_bound) {
 			if(ct_extensible) {
-				ct = &asn_DEF_OCTET_STRING_constraint;
+				cval = &asn_DEF_OCTET_STRING_constraints.value;
+				csiz = &asn_DEF_OCTET_STRING_constraints.size;
+				unit_bits = canonical_unit_bits;
 				inext = 1;
 			} else
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 		}
 	} else {
 		inext = 0;
@@ -1352,57 +1591,71 @@ OCTET_STRING_encode_uper(asn_TYPE_descriptor_t *td,
 	if(ct_extensible) {
 		/* Declare whether length is [not] within extension root */
 		if(per_put_few_bits(po, inext, 1))
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 	}

 	/* X.691, #16.5: zero-length encoding */
 	/* X.691, #16.6: short fixed length encoding (up to 2 octets) */
 	/* X.691, #16.7: long fixed length encoding (up to 64K octets) */
-	if(ct->effective_bits >= 0) {
+	if(csiz->effective_bits >= 0) {
 		ASN_DEBUG("Encoding %d bytes (%ld), length in %d bits",
-				st->size, sizeinunits - ct->lower_bound,
-				ct->effective_bits);
-		ret = per_put_few_bits(po, sizeinunits - ct->lower_bound,
-				ct->effective_bits);
-		if(ret) _ASN_ENCODE_FAILED;
-		ret = per_put_many_bits(po, st->buf, sizeinunits * unit_bits);
-		if(ret) _ASN_ENCODE_FAILED;
-		_ASN_ENCODED_OK(er);
+				st->size, sizeinunits - csiz->lower_bound,
+				csiz->effective_bits);
+		ret = per_put_few_bits(po, sizeinunits - csiz->lower_bound,
+				csiz->effective_bits);
+		if(ret) ASN__ENCODE_FAILED;
+		if(bpc) {
+			ret = OCTET_STRING_per_put_characters(po, st->buf,
+				sizeinunits, bpc, unit_bits,
+				cval->lower_bound, cval->upper_bound, pc);
+		} else {
+			ret = per_put_many_bits(po, st->buf,
+				sizeinunits * unit_bits);
+		}
+		if(ret) ASN__ENCODE_FAILED;
+		ASN__ENCODED_OK(er);
 	}

 	ASN_DEBUG("Encoding %d bytes", st->size);

 	if(sizeinunits == 0) {
 		if(uper_put_length(po, 0))
-			_ASN_ENCODE_FAILED;
-		_ASN_ENCODED_OK(er);
+			ASN__ENCODE_FAILED;
+		ASN__ENCODED_OK(er);
 	}

 	buf = st->buf;
 	while(sizeinunits) {
 		ssize_t maySave = uper_put_length(po, sizeinunits);
-		if(maySave < 0) _ASN_ENCODE_FAILED;
+		if(maySave < 0) ASN__ENCODE_FAILED;

-		ASN_DEBUG("Encoding %d of %d", maySave, sizeinunits);
+		ASN_DEBUG("Encoding %ld of %ld",
+			(long)maySave, (long)sizeinunits);

-		ret = per_put_many_bits(po, buf, maySave * unit_bits);
-		if(ret) _ASN_ENCODE_FAILED;
+		if(bpc) {
+			ret = OCTET_STRING_per_put_characters(po, buf,
+				maySave, bpc, unit_bits,
+				cval->lower_bound, cval->upper_bound, pc);
+		} else {
+			ret = per_put_many_bits(po, buf, maySave * unit_bits);
+		}
+		if(ret) ASN__ENCODE_FAILED;

-		if(unit_bits == 1)
-			buf += maySave >> 3;
+		if(bpc)
+			buf += maySave * bpc;
 		else
-			buf += maySave;
+			buf += maySave >> 3;
 		sizeinunits -= maySave;
 		assert(!(maySave & 0x07) || !sizeinunits);
 	}

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

 int
 OCTET_STRING_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 	asn_app_consume_bytes_f *cb, void *app_key) {
-	static const char *h2c = "0123456789ABCDEF";
+	const char * const h2c = "0123456789ABCDEF";
 	const OCTET_STRING_t *st = (const OCTET_STRING_t *)sptr;
 	char scratch[16 * 3 + 4];
 	char *p = scratch;
@@ -1412,7 +1665,8 @@ OCTET_STRING_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,

 	(void)td;	/* Unused argument */

-	if(!st || !st->buf) return (cb("<absent>", 8, app_key) < 0) ? -1 : 0;
+	if(!st || (!st->buf && st->size))
+		return (cb("<absent>", 8, app_key) < 0) ? -1 : 0;

 	/*
 	 * Dump the contents of the buffer in hexadecimal.
@@ -1448,7 +1702,7 @@ OCTET_STRING_print_utf8(asn_TYPE_descriptor_t *td, const void *sptr,
 	(void)td;	/* Unused argument */
 	(void)ilevel;	/* Unused argument */

-	if(st && st->buf) {
+	if(st && (st->buf || !st->size)) {
 		return (cb(st->buf, st->size, app_key) < 0) ? -1 : 0;
 	} else {
 		return (cb("<absent>", 8, app_key) < 0) ? -1 : 0;
@@ -1458,20 +1712,23 @@ OCTET_STRING_print_utf8(asn_TYPE_descriptor_t *td, const void *sptr,
 void
 OCTET_STRING_free(asn_TYPE_descriptor_t *td, void *sptr, int contents_only) {
 	OCTET_STRING_t *st = (OCTET_STRING_t *)sptr;
-	asn_OCTET_STRING_specifics_t *specs = td->specifics
-				? (asn_OCTET_STRING_specifics_t *)td->specifics
-				: &asn_DEF_OCTET_STRING_specs;
-	asn_struct_ctx_t *ctx = (asn_struct_ctx_t *)
-					((char *)st + specs->ctx_offset);
+	asn_OCTET_STRING_specifics_t *specs;
+	asn_struct_ctx_t *ctx;
 	struct _stack *stck;

 	if(!td || !st)
 		return;

+	specs = td->specifics
+		    ? (asn_OCTET_STRING_specifics_t *)td->specifics
+		    : &asn_DEF_OCTET_STRING_specs;
+	ctx = (asn_struct_ctx_t *)((char *)st + specs->ctx_offset);
+
 	ASN_DEBUG("Freeing %s as OCTET STRING", td->name);

 	if(st->buf) {
 		FREEMEM(st->buf);
+		st->buf = 0;
 	}

 	/*
--- a/asn1/asn1c/OCTET_STRING.h
+++ b/asn1/asn1c/OCTET_STRING.h
@@ -63,14 +63,20 @@ OCTET_STRING_t *OCTET_STRING_new_fromBuf(asn_TYPE_descriptor_t *td,
 * Internally useful stuff. *
 ****************************/

-typedef struct asn_OCTET_STRING_specifics_s {
+typedef const struct asn_OCTET_STRING_specifics_s {
 	/*
 	 * Target structure description.
 	 */
 	int struct_size;	/* Size of the structure */
 	int ctx_offset;		/* Offset of the asn_struct_ctx_t member */

-	int subvariant;		/* {0,1,2} for O-S, BIT STRING or ANY */
+	enum asn_OS_Subvariant {
+		ASN_OSUBV_ANY,	/* The open type (ANY) */
+		ASN_OSUBV_BIT,	/* BIT STRING */
+		ASN_OSUBV_STR,	/* String types, not {BMP,Universal}String  */
+		ASN_OSUBV_U16,	/* 16-bit character (BMPString) */
+		ASN_OSUBV_U32	/* 32-bit character (UniversalString) */
+	} subvariant;
 } asn_OCTET_STRING_specifics_t;

 #ifdef __cplusplus
--- a/asn1/asn1c/TypeValuePair.c
+++ b/asn1/asn1c/TypeValuePair.c
@@ -1,12 +1,10 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

-#include <asn_internal.h>
-
 #include "TypeValuePair.h"

 static asn_TYPE_member_t asn_MBR_TypeValuePair_1[] = {
@@ -29,12 +27,12 @@ static asn_TYPE_member_t asn_MBR_TypeValuePair_1[] = {
 		"value"
 		},
 };
-static ber_tlv_tag_t asn_DEF_TypeValuePair_tags_1[] = {
+static const ber_tlv_tag_t asn_DEF_TypeValuePair_tags_1[] = {
 	(ASN_TAG_CLASS_UNIVERSAL | (16 << 2))
 };
-static asn_TYPE_tag2member_t asn_MAP_TypeValuePair_tag2el_1[] = {
-    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* type at 34 */
-    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 } /* value at 35 */
+static const asn_TYPE_tag2member_t asn_MAP_TypeValuePair_tag2el_1[] = {
+    { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), 0, 0, 0 }, /* type */
+    { (ASN_TAG_CLASS_CONTEXT | (1 << 2)), 1, 0, 0 } /* value */
 };
 static asn_SEQUENCE_specifics_t asn_SPC_TypeValuePair_specs_1 = {
 	sizeof(struct TypeValuePair),
--- a/asn1/asn1c/TypeValuePair.h
+++ b/asn1/asn1c/TypeValuePair.h
@@ -1,8 +1,8 @@
 /*
- * Generated by asn1c-0.9.21 (http://lionet.info/asn1c)
+ * Generated by asn1c-0.9.28 (http://lionet.info/asn1c)
 * From ASN.1 module "KeytabModule"
 * 	found in "ipa.asn1"
- * 	`asn1c -fskeletons-copy`
+ * 	`asn1c -fskeletons-copy -fnative-types`
 */

 #ifndef	_TypeValuePair_H_
@@ -37,3 +37,4 @@ extern asn_TYPE_descriptor_t asn_DEF_TypeValuePair;
 #endif

 #endif	/* _TypeValuePair_H_ */
+#include <asn_internal.h>
--- a/asn1/asn1c/asn_application.h
+++ b/asn1/asn1c/asn_application.h
@@ -5,8 +5,8 @@
 /*
 * Application-level ASN.1 callbacks.
 */
-#ifndef	_ASN_APPLICATION_H_
-#define	_ASN_APPLICATION_H_
+#ifndef	ASN_APPLICATION_H
+#define	ASN_APPLICATION_H

 #include "asn_system.h"		/* for platform-dependent types */
 #include "asn_codecs.h"		/* for ASN.1 codecs specifics */
@@ -44,4 +44,4 @@ typedef void (asn_app_constraint_failed_f)(void *application_specific_key,

 #include "constr_TYPE.h"	/* for asn_TYPE_descriptor_t */

-#endif	/* _ASN_APPLICATION_H_ */
+#endif	/* ASN_APPLICATION_H */
--- a/asn1/asn1c/asn_codecs.h
+++ b/asn1/asn1c/asn_codecs.h
@@ -3,8 +3,8 @@
 * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
-#ifndef	_ASN_CODECS_H_
-#define	_ASN_CODECS_H_
+#ifndef	ASN_CODECS_H
+#define	ASN_CODECS_H

 #ifdef __cplusplus
 extern "C" {
@@ -57,15 +57,15 @@ typedef struct asn_enc_rval_s {
 	/* Pointer to the structure of that type */
 	void *structure_ptr;
 } asn_enc_rval_t;
-#define	_ASN_ENCODE_FAILED do {					\
+#define	ASN__ENCODE_FAILED do {					\
 	asn_enc_rval_t tmp_error;				\
 	tmp_error.encoded = -1;					\
 	tmp_error.failed_type = td;				\
 	tmp_error.structure_ptr = sptr;				\
-	ASN_DEBUG("Failed to encode element %s", td->name);	\
+	ASN_DEBUG("Failed to encode element %s", td ? td->name : "");	\
 	return tmp_error;					\
 } while(0)
-#define	_ASN_ENCODED_OK(rval) do {				\
+#define	ASN__ENCODED_OK(rval) do {				\
 	rval.structure_ptr = 0;					\
 	rval.failed_type = 0;					\
 	return rval;						\
@@ -88,14 +88,14 @@ typedef struct asn_dec_rval_s {
 	enum asn_dec_rval_code_e code;	/* Result code */
 	size_t consumed;		/* Number of bytes consumed */
 } asn_dec_rval_t;
-#define	_ASN_DECODE_FAILED do {					\
+#define	ASN__DECODE_FAILED do {					\
 	asn_dec_rval_t tmp_error;				\
 	tmp_error.code = RC_FAIL;				\
 	tmp_error.consumed = 0;					\
-	ASN_DEBUG("Failed to decode element %s", td->name);	\
+	ASN_DEBUG("Failed to decode element %s", td ? td->name : "");	\
 	return tmp_error;					\
 } while(0)
-#define	_ASN_DECODE_STARVED do {				\
+#define	ASN__DECODE_STARVED do {				\
 	asn_dec_rval_t tmp_error;				\
 	tmp_error.code = RC_WMORE;				\
 	tmp_error.consumed = 0;					\
@@ -106,4 +106,4 @@ typedef struct asn_dec_rval_s {
 }
 #endif

-#endif	/* _ASN_CODECS_H_ */
+#endif	/* ASN_CODECS_H */
--- a/asn1/asn1c/asn_codecs_prim.c
+++ b/asn1/asn1c/asn_codecs_prim.c
@@ -15,14 +15,14 @@ ber_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,
 	void **sptr, const void *buf_ptr, size_t size, int tag_mode) {
 	ASN__PRIMITIVE_TYPE_t *st = (ASN__PRIMITIVE_TYPE_t *)*sptr;
 	asn_dec_rval_t rval;
-	ber_tlv_len_t length;
+	ber_tlv_len_t length = 0; /* =0 to avoid [incorrect] warning. */

 	/*
 	 * If the structure is not there, allocate it.
 	 */
 	if(st == NULL) {
 		st = (ASN__PRIMITIVE_TYPE_t *)CALLOC(1, sizeof(*st));
-		if(st == NULL) _ASN_DECODE_FAILED;
+		if(st == NULL) ASN__DECODE_FAILED;
 		*sptr = (void *)st;
 	}

@@ -55,13 +55,13 @@ ber_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,
 	if(sizeof(st->size) != sizeof(length)
 			&& (ber_tlv_len_t)st->size != length) {
 		st->size = 0;
-		_ASN_DECODE_FAILED;
+		ASN__DECODE_FAILED;
 	}

 	st->buf = (uint8_t *)MALLOC(length + 1);
 	if(!st->buf) {
 		st->size = 0;
-		_ASN_DECODE_FAILED;
+		ASN__DECODE_FAILED;
 	}

 	memcpy(st->buf, buf_ptr, length);
@@ -111,7 +111,7 @@ der_encode_primitive(asn_TYPE_descriptor_t *td, void *sptr,
 	}

 	erval.encoded += st->size;
-	_ASN_ENCODED_OK(erval);
+	ASN__ENCODED_OK(erval);
 }

 void
@@ -143,20 +143,26 @@ struct xdp_arg_s {
 	int want_more;
 };

-
+/*
+ * Since some kinds of primitive values can be encoded using value-specific
+ * tags (<MINUS-INFINITY>, <enum-element>, etc), the primitive decoder must
+ * be supplied with such tags to parse them as needed.
+ */
 static int
 xer_decode__unexpected_tag(void *key, const void *chunk_buf, size_t chunk_size) {
 	struct xdp_arg_s *arg = (struct xdp_arg_s *)key;
 	enum xer_pbd_rval bret;

-	if(arg->decoded_something) {
-		if(xer_is_whitespace(chunk_buf, chunk_size))
-			return 0;	/* Skip it. */
-		/*
-		 * Decoding was done once already. Prohibit doing it again.
-		 */
+	/*
+	 * The chunk_buf is guaranteed to start at '<'.
+	 */
+	assert(chunk_size && ((const char *)chunk_buf)[0] == 0x3c);
+
+	/*
+	 * Decoding was performed once already. Prohibit doing it again.
+	 */
+	if(arg->decoded_something)
 		return -1;
-	}

 	bret = arg->prim_body_decoder(arg->type_descriptor,
 		arg->struct_key, chunk_buf, chunk_size);
@@ -177,13 +183,20 @@ xer_decode__unexpected_tag(void *key, const void *chunk_buf, size_t chunk_size)
 }

 static ssize_t
-xer_decode__body(void *key, const void *chunk_buf, size_t chunk_size, int have_more) {
+xer_decode__primitive_body(void *key, const void *chunk_buf, size_t chunk_size, int have_more) {
 	struct xdp_arg_s *arg = (struct xdp_arg_s *)key;
 	enum xer_pbd_rval bret;
+	size_t lead_wsp_size;

 	if(arg->decoded_something) {
-		if(xer_is_whitespace(chunk_buf, chunk_size))
+		if(xer_whitespace_span(chunk_buf, chunk_size) == chunk_size) {
+			/*
+			 * Example:
+			 * "<INTEGER>123<!--/--> </INTEGER>"
+			 *                      ^- chunk_buf position.
+			 */
 			return chunk_size;
+		}
 		/*
 		 * Decoding was done once already. Prohibit doing it again.
 		 */
@@ -203,6 +216,10 @@ xer_decode__body(void *key, const void *chunk_buf, size_t chunk_size, int have_m
 		return -1;
 	}

+	lead_wsp_size = xer_whitespace_span(chunk_buf, chunk_size);
+	chunk_buf = (const char *)chunk_buf + lead_wsp_size;
+	chunk_size -= lead_wsp_size;
+
 	bret = arg->prim_body_decoder(arg->type_descriptor,
 		arg->struct_key, chunk_buf, chunk_size);
 	switch(bret) {
@@ -215,7 +232,7 @@ xer_decode__body(void *key, const void *chunk_buf, size_t chunk_size, int have_m
 		arg->decoded_something = 1;
 		/* Fall through */
 	case XPBD_NOT_BODY_IGNORE:	/* Safe to proceed further */
-		return chunk_size;
+		return lead_wsp_size + chunk_size;
 	}

 	return -1;
@@ -241,7 +258,7 @@ xer_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,
 	 */
 	if(!*sptr) {
 		*sptr = CALLOC(1, struct_size);
-		if(!*sptr) _ASN_DECODE_FAILED;
+		if(!*sptr) ASN__DECODE_FAILED;
 	}

 	memset(&s_ctx, 0, sizeof(s_ctx));
@@ -253,7 +270,7 @@ xer_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,

 	rc = xer_decode_general(opt_codec_ctx, &s_ctx, &s_arg,
 		xml_tag, buf_ptr, size,
-		xer_decode__unexpected_tag, xer_decode__body);
+		xer_decode__unexpected_tag, xer_decode__primitive_body);
 	switch(rc.code) {
 	case RC_OK:
 		if(!s_arg.decoded_something) {
@@ -271,7 +288,7 @@ xer_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,
 				/*
 				 * This decoder does not like empty stuff.
 				 */
-				_ASN_DECODE_FAILED;
+				ASN__DECODE_FAILED;
 			}
 		}
 		break;
@@ -287,7 +304,7 @@ xer_decode_primitive(asn_codec_ctx_t *opt_codec_ctx,
 		if(s_arg.want_more)
 			rc.code = RC_WMORE;
 		else
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 		break;
 	}
 	return rc;
--- a/asn1/asn1c/asn_internal.h
+++ b/asn1/asn1c/asn_internal.h
@@ -1,13 +1,13 @@
 /*-
- * Copyright (c) 2003, 2004, 2005 Lev Walkin <vlm@lionet.info>.
+ * Copyright (c) 2003, 2004, 2005, 2007 Lev Walkin <vlm@lionet.info>.
 * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
 /*
 * Declarations internally useful for the ASN.1 support code.
 */
-#ifndef	_ASN_INTERNAL_H_
-#define	_ASN_INTERNAL_H_
+#ifndef	ASN_INTERNAL_H
+#define	ASN_INTERNAL_H

 #include "asn_application.h"	/* Application-visible API */

@@ -20,7 +20,7 @@ extern "C" {
 #endif

 /* Environment version might be used to avoid running with the old library */
-#define	ASN1C_ENVIRONMENT_VERSION	920	/* Compile-time version */
+#define	ASN1C_ENVIRONMENT_VERSION	923	/* Compile-time version */
 int get_asn1c_environment_version(void);	/* Run-time version */

 #define	CALLOC(nmemb, size)	calloc(nmemb, size)
@@ -28,6 +28,9 @@ int get_asn1c_environment_version(void);	/* Run-time version */
 #define	REALLOC(oldptr, size)	realloc(oldptr, size)
 #define	FREEMEM(ptr)		free(ptr)

+#define	asn_debug_indent	0
+#define ASN_DEBUG_INDENT_ADD(i) do{}while(0)
+
 /*
 * A macro for debugging the ASN.1 internals.
 * You may enable or override it.
@@ -35,59 +38,73 @@ int get_asn1c_environment_version(void);	/* Run-time version */
 #ifndef	ASN_DEBUG	/* If debugging code is not defined elsewhere... */
 #if	EMIT_ASN_DEBUG == 1	/* And it was asked to emit this code... */
 #ifdef	__GNUC__
-#define	ASN_DEBUG(fmt, args...)	do {		\
-		fprintf(stderr, fmt, ##args);	\
-		fprintf(stderr, " (%s:%d)\n",	\
-			__FILE__, __LINE__);	\
+#ifdef	ASN_THREAD_SAFE
+/* Thread safety requires sacrifice in output indentation:
+ * Retain empty definition of ASN_DEBUG_INDENT_ADD. */
+#else	/* !ASN_THREAD_SAFE */
+#undef  ASN_DEBUG_INDENT_ADD
+#undef  asn_debug_indent
+int asn_debug_indent;
+#define ASN_DEBUG_INDENT_ADD(i) do { asn_debug_indent += i; } while(0)
+#endif	/* ASN_THREAD_SAFE */
+#define	ASN_DEBUG(fmt, args...)	do {			\
+		int adi = asn_debug_indent;		\
+		while(adi--) fprintf(stderr, " ");	\
+		fprintf(stderr, fmt, ##args);		\
+		fprintf(stderr, " (%s:%d)\n",		\
+			__FILE__, __LINE__);		\
 	} while(0)
 #else	/* !__GNUC__ */
 void ASN_DEBUG_f(const char *fmt, ...);
 #define	ASN_DEBUG	ASN_DEBUG_f
 #endif	/* __GNUC__ */
 #else	/* EMIT_ASN_DEBUG != 1 */
-static inline void ASN_DEBUG(const char *fmt, ...) { (void)fmt; }
+static void ASN_DEBUG(const char *fmt, ...) { (void)fmt; }
 #endif	/* EMIT_ASN_DEBUG */
 #endif	/* ASN_DEBUG */

 /*
 * Invoke the application-supplied callback and fail, if something is wrong.
 */
-#define	__ASN_E_cbc(buf, size)	(cb((buf), (size), app_key) < 0)
-#define	_ASN_E_CALLBACK(foo)	do {					\
+#define	ASN__E_cbc(buf, size)	(cb((buf), (size), app_key) < 0)
+#define	ASN__E_CALLBACK(foo)	do {					\
 		if(foo)	goto cb_failed;					\
 	} while(0)
-#define	_ASN_CALLBACK(buf, size)					\
-	_ASN_E_CALLBACK(__ASN_E_cbc(buf, size))
-#define	_ASN_CALLBACK2(buf1, size1, buf2, size2)			\
-	_ASN_E_CALLBACK(__ASN_E_cbc(buf1, size1) || __ASN_E_cbc(buf2, size2))
-#define	_ASN_CALLBACK3(buf1, size1, buf2, size2, buf3, size3)		\
-	_ASN_E_CALLBACK(__ASN_E_cbc(buf1, size1)			\
-		|| __ASN_E_cbc(buf2, size2)				\
-		|| __ASN_E_cbc(buf3, size3))
+#define	ASN__CALLBACK(buf, size)					\
+	ASN__E_CALLBACK(ASN__E_cbc(buf, size))
+#define	ASN__CALLBACK2(buf1, size1, buf2, size2)			\
+	ASN__E_CALLBACK(ASN__E_cbc(buf1, size1) || ASN__E_cbc(buf2, size2))
+#define	ASN__CALLBACK3(buf1, size1, buf2, size2, buf3, size3)		\
+	ASN__E_CALLBACK(ASN__E_cbc(buf1, size1)			\
+		|| ASN__E_cbc(buf2, size2)				\
+		|| ASN__E_cbc(buf3, size3))

-#define	_i_ASN_TEXT_INDENT(nl, level) do {				\
-	int __level = (level);						\
-	int __nl = ((nl) != 0);						\
-	int __i;							\
-	if(__nl) _ASN_CALLBACK("\n", 1);				\
-	for(__i = 0; __i < __level; __i++)				\
-		_ASN_CALLBACK("    ", 4);				\
-	er.encoded += __nl + 4 * __level;				\
-} while(0)
+#define	ASN__TEXT_INDENT(nl, level) do {            \
+        int tmp_level = (level);                    \
+        int tmp_nl = ((nl) != 0);                   \
+        int tmp_i;                                  \
+        if(tmp_nl) ASN__CALLBACK("\n", 1);          \
+        if(tmp_level < 0) tmp_level = 0;            \
+        for(tmp_i = 0; tmp_i < tmp_level; tmp_i++)  \
+            ASN__CALLBACK("    ", 4);               \
+        er.encoded += tmp_nl + 4 * tmp_level;       \
+    } while(0)

-#define	_i_INDENT(nl)	do {						\
-	int __i;							\
-	if((nl) && cb("\n", 1, app_key) < 0) return -1;			\
-	for(__i = 0; __i < ilevel; __i++)				\
-		if(cb("    ", 4, app_key) < 0) return -1;		\
-} while(0)
+#define	_i_INDENT(nl)	do {                        \
+        int tmp_i;                                  \
+        if((nl) && cb("\n", 1, app_key) < 0)        \
+            return -1;                              \
+        for(tmp_i = 0; tmp_i < ilevel; tmp_i++)     \
+            if(cb("    ", 4, app_key) < 0)          \
+                return -1;                          \
+    } while(0)

 /*
 * Check stack against overflow, if limit is set.
 */
-#define	_ASN_DEFAULT_STACK_MAX	(30000)
-static inline int
-_ASN_STACK_OVERFLOW_CHECK(asn_codec_ctx_t *ctx) {
+#define	ASN__DEFAULT_STACK_MAX	(30000)
+static int __attribute__((unused))
+ASN__STACK_OVERFLOW_CHECK(asn_codec_ctx_t *ctx) {
 	if(ctx && ctx->max_stack_size) {

 		/* ctx MUST be allocated on the stack */
@@ -108,4 +125,4 @@ _ASN_STACK_OVERFLOW_CHECK(asn_codec_ctx_t *ctx) {
 }
 #endif

-#endif	/* _ASN_INTERNAL_H_ */
+#endif	/* ASN_INTERNAL_H */
--- a/asn1/asn1c/asn_system.h
+++ b/asn1/asn1c/asn_system.h
@@ -1,35 +1,51 @@
 /*-
- * Copyright (c) 2003, 2004 Lev Walkin <vlm@lionet.info>. All rights reserved.
+ * Copyright (c) 2003, 2004, 2007 Lev Walkin <vlm@lionet.info>.
+ * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
 /*
 * Miscellaneous system-dependent types.
 */
-#ifndef	_ASN_SYSTEM_H_
-#define	_ASN_SYSTEM_H_
+#ifndef	ASN_SYSTEM_H
+#define	ASN_SYSTEM_H

 #ifdef	HAVE_CONFIG_H
 #include "config.h"
 #endif

+#ifndef _DEFAULT_SOURCE
+#define _DEFAULT_SOURCE /* for snprintf() on some linux systems  */
+#endif
+
 #include <stdio.h>	/* For snprintf(3) */
 #include <stdlib.h>	/* For *alloc(3) */
 #include <string.h>	/* For memcpy(3) */
 #include <sys/types.h>	/* For size_t */
+#include <limits.h>	/* For LONG_MAX */
 #include <stdarg.h>	/* For va_start */
 #include <stddef.h>	/* for offsetof and ptrdiff_t */

-#ifdef	WIN32
+#ifdef	HAVE_ALLOCA_H
+#include <alloca.h>	/* For alloca(3) */
+#endif
+
+#ifdef	_WIN32

 #include <malloc.h>
-#include <stdint.h>
 #define	 snprintf	_snprintf
 #define	 vsnprintf	_vsnprintf

+/* To avoid linking with ws2_32.lib, here's the definition of ntohl() */
+#define sys_ntohl(l)	((((l) << 24)  & 0xff000000)	\
+			| (((l) << 8) & 0xff0000)	\
+			| (((l) >> 8)  & 0xff00)	\
+			| ((l >> 24) & 0xff))
+
 #ifdef _MSC_VER			/* MSVS.Net */
 #ifndef __cplusplus
 #define inline __inline
 #endif
+#ifndef	ASSUMESTDTYPES	/* Standard types have been defined elsewhere */
 #define	ssize_t		SSIZE_T
 typedef	char		int8_t;
 typedef	short		int16_t;
@@ -37,6 +53,7 @@ typedef	int		int32_t;
 typedef	unsigned char	uint8_t;
 typedef	unsigned short	uint16_t;
 typedef	unsigned int	uint32_t;
+#endif	/* ASSUMESTDTYPES */
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #include <float.h>
@@ -44,9 +61,11 @@ typedef	unsigned int	uint32_t;
 #define finite _finite
 #define copysign _copysign
 #define	ilogb	_logb
+#else	/* !_MSC_VER */
+#include <stdint.h>
 #endif	/* _MSC_VER */

-#else	/* !WIN32 */
+#else	/* !_WIN32 */

 #if defined(__vxworks)
 #include <types/vxTypes.h>
@@ -74,19 +93,33 @@ typedef	unsigned int	uint32_t;
 #endif	/* defined(sun) */
 #endif

+#include <netinet/in.h> /* for ntohl() */
+#define	sys_ntohl(foo)	ntohl(foo)
+
 #endif	/* defined(__vxworks) */

-#endif	/* WIN32 */
+#endif	/* _WIN32 */

 #if	__GNUC__ >= 3
 #ifndef	GCC_PRINTFLIKE
 #define	GCC_PRINTFLIKE(fmt,var)	__attribute__((format(printf,fmt,var)))
 #endif
+#ifndef	GCC_NOTUSED
+#define	GCC_NOTUSED		__attribute__((unused))
+#endif
 #else
 #ifndef	GCC_PRINTFLIKE
 #define	GCC_PRINTFLIKE(fmt,var)	/* nothing */
 #endif
+#ifndef	GCC_NOTUSED
+#define	GCC_NOTUSED
 #endif
+#endif
+
+/* Figure out if thread safety is requested */
+#if !defined(ASN_THREAD_SAFE) && (defined(THREAD_SAFE) || defined(_REENTRANT))
+#define	ASN_THREAD_SAFE
+#endif	/* Thread safety */

 #ifndef	offsetof	/* If not defined by <stddef.h> */
 #define	offsetof(s, m)	((ptrdiff_t)&(((s *)0)->m) - (ptrdiff_t)((s *)0))
@@ -101,4 +134,4 @@ typedef	unsigned int	uint32_t;
 #endif /* __GNUC__ */
 #endif	/* MIN */

-#endif	/* _ASN_SYSTEM_H_ */
+#endif	/* ASN_SYSTEM_H */
--- a/asn1/asn1c/ber_decoder.c
+++ b/asn1/asn1c/ber_decoder.c
@@ -44,7 +44,7 @@ ber_decode(asn_codec_ctx_t *opt_codec_ctx,
 	} else {
 		/* If context is not given, be security-conscious anyway */
 		memset(&s_codec_ctx, 0, sizeof(s_codec_ctx));
-		s_codec_ctx.max_stack_size = _ASN_DEFAULT_STACK_MAX;
+		s_codec_ctx.max_stack_size = ASN__DEFAULT_STACK_MAX;
 		opt_codec_ctx = &s_codec_ctx;
 	}

@@ -80,7 +80,7 @@ ber_check_tags(asn_codec_ctx_t *opt_codec_ctx,
 	/*
 	 * Make sure we didn't exceed the maximum stack size.
 	 */
-	if(_ASN_STACK_OVERFLOW_CHECK(opt_codec_ctx))
+	if(ASN__STACK_OVERFLOW_CHECK(opt_codec_ctx))
 		RETURN(RC_FAIL);

 	/*
@@ -206,7 +206,7 @@ ber_check_tags(asn_codec_ctx_t *opt_codec_ctx,
 		 */
 		len_len = ber_fetch_length(tlv_constr,
 			(const char *)ptr + tag_len, size - tag_len, &tlv_len);
-		ASN_DEBUG("Fetchinig len = %ld", (long)len_len);
+		ASN_DEBUG("Fetching len = %ld", (long)len_len);
 		switch(len_len) {
 		case -1: RETURN(RC_FAIL);
 		case 0: RETURN(RC_WMORE);
--- a/asn1/asn1c/ber_decoder.h
+++ b/asn1/asn1c/ber_decoder.h
@@ -17,6 +17,7 @@ struct asn_codec_ctx_s;		/* Forward declaration */
 /*
 * The BER decoder of any type.
 * This function may be invoked directly from the application.
+ * The der_encode() function (der_encoder.h) is an opposite to ber_decode().
 */
 asn_dec_rval_t ber_decode(struct asn_codec_ctx_s *opt_codec_ctx,
 	struct asn_TYPE_descriptor_s *type_descriptor,
--- a/asn1/asn1c/ber_tlv_length.c
+++ b/asn1/asn1c/ber_tlv_length.c
@@ -85,7 +85,7 @@ ber_skip_length(asn_codec_ctx_t *opt_codec_ctx,
 	/*
 	 * Make sure we didn't exceed the maximum stack size.
 	 */
-	if(_ASN_STACK_OVERFLOW_CHECK(opt_codec_ctx))
+	if(ASN__STACK_OVERFLOW_CHECK(opt_codec_ctx))
 		return -1;

 	/*
--- a/asn1/asn1c/constr_CHOICE.c
+++ b/asn1/asn1c/constr_CHOICE.c
@@ -1,10 +1,11 @@
 /*
- * Copyright (c) 2003, 2004, 2005, 2006 Lev Walkin <vlm@lionet.info>.
+ * Copyright (c) 2003, 2004, 2005, 2006, 2007 Lev Walkin <vlm@lionet.info>.
 * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
 #include <asn_internal.h>
 #include <constr_CHOICE.h>
+#include <per_opentype.h>

 /*
 * Number of bytes left for this structure.
@@ -182,11 +183,11 @@ CHOICE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		}

 		do {
-			asn_TYPE_tag2member_t *t2m;
+			const asn_TYPE_tag2member_t *t2m;
 			asn_TYPE_tag2member_t key;

 			key.el_tag = tlv_tag;
-			t2m = (asn_TYPE_tag2member_t *)bsearch(&key,
+			t2m = (const asn_TYPE_tag2member_t *)bsearch(&key,
 					specs->tag2el, specs->tag2el_count,
 					sizeof(specs->tag2el[0]), _search4tag);
 			if(t2m) {
@@ -363,7 +364,7 @@ CHOICE_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 	size_t computed_size = 0;
 	int present;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;

 	ASN_DEBUG("%s %s as CHOICE",
 		cb?"Encoding":"Estimating", td->name);
@@ -379,9 +380,9 @@ CHOICE_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 		if(present == 0 && td->elements_count == 0) {
 			/* The CHOICE is empty?! */
 			erval.encoded = 0;
-			_ASN_ENCODED_OK(erval);
+			ASN__ENCODED_OK(erval);
 		}
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}

 	/*
@@ -393,10 +394,10 @@ CHOICE_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 		if(memb_ptr == 0) {
 			if(elm->optional) {
 				erval.encoded = 0;
-				_ASN_ENCODED_OK(erval);
+				ASN__ENCODED_OK(erval);
 			}
 			/* Mandatory element absent */
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 		}
 	} else {
 		memb_ptr = (void *)((char *)sptr + elm->memb_offset);
@@ -423,7 +424,7 @@ CHOICE_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 		ret = der_write_tags(td, erval.encoded, tag_mode, 1, tag,
 			cb, app_key);
 		if(ret == -1)
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 		computed_size += ret;
 	}

@@ -444,7 +445,7 @@ CHOICE_encode_der(asn_TYPE_descriptor_t *td, void *sptr,
 }

 ber_tlv_tag_t
-CHOICE_outmost_tag(asn_TYPE_descriptor_t *td, const void *ptr, int tag_mode, ber_tlv_tag_t tag) {
+CHOICE_outmost_tag(const asn_TYPE_descriptor_t *td, const void *ptr, int tag_mode, ber_tlv_tag_t tag) {
 	asn_CHOICE_specifics_t *specs = (asn_CHOICE_specifics_t *)td->specifics;
 	int present;

@@ -457,7 +458,7 @@ CHOICE_outmost_tag(asn_TYPE_descriptor_t *td, const void *ptr, int tag_mode, ber
 	present = _fetch_present_idx(ptr, specs->pres_offset, specs->pres_size);

 	if(present > 0 || present <= td->elements_count) {
-		asn_TYPE_member_t *elm = &td->elements[present-1];
+		const asn_TYPE_member_t *elm = &td->elements[present-1];
 		const void *memb_ptr;

 		if(elm->flags & ATF_POINTER) {
@@ -482,7 +483,7 @@ CHOICE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	int present;

 	if(!sptr) {
-		_ASN_CTFAIL(app_key, td,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: value not given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -501,7 +502,7 @@ CHOICE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 			if(!memb_ptr) {
 				if(elm->optional)
 					return 0;
-				_ASN_CTFAIL(app_key, td,
+				ASN__CTFAIL(app_key, td, sptr,
 					"%s: mandatory CHOICE element %s absent (%s:%d)",
 					td->name, elm->name, __FILE__, __LINE__);
 				return -1;
@@ -517,14 +518,14 @@ CHOICE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 			int ret = elm->type->check_constraints(elm->type,
 					memb_ptr, ctfailcb, app_key);
 			/*
-			 * Cannot inherit it eralier:
+			 * Cannot inherit it earlier:
 			 * need to make sure we get the updated version.
 			 */
 			elm->memb_constraints = elm->type->check_constraints;
 			return ret;
 		}
 	} else {
-		_ASN_CTFAIL(app_key, td,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: no CHOICE element given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -534,7 +535,7 @@ CHOICE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 #undef	XER_ADVANCE
 #define	XER_ADVANCE(num_bytes)	do {			\
 		size_t num = num_bytes;			\
-		buf_ptr = ((const char *)buf_ptr) + num;\
+		buf_ptr = (const void *)(((const char *)buf_ptr) + num); \
 		size -= num;				\
 		consumed_myself += num;			\
 	} while(0)
@@ -639,11 +640,12 @@ CHOICE_decode_xer(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		 * Get the next part of the XML stream.
 		 */
 		ch_size = xer_next_token(&ctx->context, buf_ptr, size, &ch_type);
-		switch(ch_size) {
-		case -1: RETURN(RC_FAIL);
-		case 0:  RETURN(RC_WMORE);
-		default:
+		if(ch_size == -1) {
+            RETURN(RC_FAIL);
+        } else {
 			switch(ch_type) {
+			case PXER_WMORE:
+                RETURN(RC_WMORE);
 			case PXER_COMMENT:	/* Got XML comment */
 			case PXER_TEXT:		/* Ignore free-standing text */
 				XER_ADVANCE(ch_size);	/* Skip silently */
@@ -779,7 +781,7 @@ CHOICE_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	int present;

 	if(!sptr)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	/*
 	 * Figure out which CHOICE element is encoded.
@@ -787,7 +789,7 @@ CHOICE_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	present = _fetch_present_idx(sptr, specs->pres_offset,specs->pres_size);

 	if(present <= 0 || present > td->elements_count) {
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	}  else {
 		asn_enc_rval_t tmper;
 		asn_TYPE_member_t *elm = &td->elements[present-1];
@@ -797,30 +799,30 @@ CHOICE_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,

 		if(elm->flags & ATF_POINTER) {
 			memb_ptr = *(void **)((char *)sptr + elm->memb_offset);
-			if(!memb_ptr) _ASN_ENCODE_FAILED;
+			if(!memb_ptr) ASN__ENCODE_FAILED;
 		} else {
 			memb_ptr = (void *)((char *)sptr + elm->memb_offset);
 		}

 		er.encoded = 0;

-                if(!(flags & XER_F_CANONICAL)) _i_ASN_TEXT_INDENT(1, ilevel);
-		_ASN_CALLBACK3("<", 1, mname, mlen, ">", 1);
+                if(!(flags & XER_F_CANONICAL)) ASN__TEXT_INDENT(1, ilevel);
+		ASN__CALLBACK3("<", 1, mname, mlen, ">", 1);

 		tmper = elm->type->xer_encoder(elm->type, memb_ptr,
 				ilevel + 1, flags, cb, app_key);
 		if(tmper.encoded == -1) return tmper;

-		_ASN_CALLBACK3("</", 2, mname, mlen, ">", 1);
+		ASN__CALLBACK3("</", 2, mname, mlen, ">", 1);

 		er.encoded += 5 + (2 * mlen) + tmper.encoded;
 	}

-	if(!(flags & XER_F_CANONICAL)) _i_ASN_TEXT_INDENT(1, ilevel - 1);
+	if(!(flags & XER_F_CANONICAL)) ASN__TEXT_INDENT(1, ilevel - 1);

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }

 asn_dec_rval_t
@@ -835,15 +837,15 @@ CHOICE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	void *st = *sptr;
 	int value;

-	if(_ASN_STACK_OVERFLOW_CHECK(opt_codec_ctx))
-		_ASN_DECODE_FAILED;
+	if(ASN__STACK_OVERFLOW_CHECK(opt_codec_ctx))
+		ASN__DECODE_FAILED;

 	/*
 	 * Create the target structure if it is not present already.
 	 */
 	if(!st) {
 		st = *sptr = CALLOC(1, specs->struct_size);
-		if(!st) _ASN_DECODE_FAILED;
+		if(!st) ASN__DECODE_FAILED;
 	}

 	if(constraints) ct = &constraints->value;
@@ -852,27 +854,25 @@ CHOICE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 	if(ct && ct->flags & APC_EXTENSIBLE) {
 		value = per_get_few_bits(pd, 1);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		if(value) ct = 0;	/* Not restricted */
 	}

 	if(ct && ct->range_bits >= 0) {
 		value = per_get_few_bits(pd, ct->range_bits);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		ASN_DEBUG("CHOICE %s got index %d in range %d",
 			td->name, value, ct->range_bits);
 		if(value > ct->upper_bound)
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 	} else {
 		if(specs->ext_start == -1)
-			_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 		value = uper_get_nsnnwn(pd);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		value += specs->ext_start;
 		if(value >= td->elements_count)
-			_ASN_DECODE_FAILED;
-		ASN_DEBUG("NOT IMPLEMENTED YET");
-		_ASN_DECODE_FAILED;
+			ASN__DECODE_FAILED;
 	}

 	/* Adjust if canonical order is different from natural order */
@@ -892,11 +892,17 @@ CHOICE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	}
 	ASN_DEBUG("Discovered CHOICE %s encodes %s", td->name, elm->name);

-	rv = elm->type->uper_decoder(opt_codec_ctx, elm->type,
+	if(ct && ct->range_bits >= 0) {
+		rv = elm->type->uper_decoder(opt_codec_ctx, elm->type,
 			elm->per_constraints, memb_ptr2, pd);
+	} else {
+		rv = uper_open_type_get(opt_codec_ctx, elm->type,
+			elm->per_constraints, memb_ptr2, pd);
+	}
+
 	if(rv.code != RC_OK)
-		ASN_DEBUG("Failed to decode %s in %s (CHOICE)",
-			elm->name, td->name);
+		ASN_DEBUG("Failed to decode %s in %s (CHOICE) %d",
+			elm->name, td->name, rv.code);
 	return rv;
 }
   
@@ -908,8 +914,9 @@ CHOICE_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_per_constraint_t *ct;
 	void *memb_ptr;
 	int present;
+	int present_enc;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;

 	ASN_DEBUG("Encoding %s as CHOICE", td->name);

@@ -925,55 +932,61 @@ CHOICE_encode_uper(asn_TYPE_descriptor_t *td,
 	 * can't deduce what to encode in the choice type.
 	 */
 	if(present <= 0 || present > td->elements_count)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	else
 		present--;

-	/* Adjust if canonical order is different from natural order */
-	if(specs->canonical_order)
-		present = specs->canonical_order[present];
-
 	ASN_DEBUG("Encoding %s CHOICE element %d", td->name, present);

+	/* Adjust if canonical order is different from natural order */
+	if(specs->canonical_order)
+		present_enc = specs->canonical_order[present];
+	else
+		present_enc = present;
+
 	if(ct && ct->range_bits >= 0) {
-		if(present < ct->lower_bound
-		|| present > ct->upper_bound) {
+		if(present_enc < ct->lower_bound
+		|| present_enc > ct->upper_bound) {
 			if(ct->flags & APC_EXTENSIBLE) {
 				if(per_put_few_bits(po, 1, 1))
-					_ASN_ENCODE_FAILED;
+					ASN__ENCODE_FAILED;
 			} else {
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			}
 			ct = 0;
 		}
 	}
 	if(ct && ct->flags & APC_EXTENSIBLE)
 		if(per_put_few_bits(po, 0, 1))
-			_ASN_ENCODE_FAILED;
-
-	if(ct && ct->range_bits >= 0) {
-		if(per_put_few_bits(po, present, ct->range_bits))
-			_ASN_ENCODE_FAILED;
-	} else {
-		if(specs->ext_start == -1)
-			_ASN_ENCODE_FAILED;
-		if(uper_put_nsnnwn(po, present - specs->ext_start))
-			_ASN_ENCODE_FAILED;
-		ASN_DEBUG("NOT IMPLEMENTED YET");
-		_ASN_ENCODE_FAILED;
-	}
+			ASN__ENCODE_FAILED;

 	elm = &td->elements[present];
 	if(elm->flags & ATF_POINTER) {
 		/* Member is a pointer to another structure */
 		memb_ptr = *(void **)((char *)sptr + elm->memb_offset);
-		if(!memb_ptr) _ASN_ENCODE_FAILED;
+		if(!memb_ptr) ASN__ENCODE_FAILED;
 	} else {
 		memb_ptr = (char *)sptr + elm->memb_offset;
 	}

-	return elm->type->uper_encoder(elm->type, elm->per_constraints,
+	if(ct && ct->range_bits >= 0) {
+		if(per_put_few_bits(po, present_enc, ct->range_bits))
+			ASN__ENCODE_FAILED;
+
+		return elm->type->uper_encoder(elm->type, elm->per_constraints,
 			memb_ptr, po);
+	} else {
+		asn_enc_rval_t rval;
+		if(specs->ext_start == -1)
+			ASN__ENCODE_FAILED;
+		if(uper_put_nsnnwn(po, present_enc - specs->ext_start))
+			ASN__ENCODE_FAILED;
+		if(uper_open_type_put(elm->type, elm->per_constraints,
+			memb_ptr, po))
+			ASN__ENCODE_FAILED;
+		rval.encoded = 0;
+		ASN__ENCODED_OK(rval);
+	}
 }
   

--- a/asn1/asn1c/constr_CHOICE.h
+++ b/asn1/asn1c/constr_CHOICE.h
@@ -12,7 +12,7 @@
 extern "C" {
 #endif

-typedef struct asn_CHOICE_specifics_s {
+typedef const struct asn_CHOICE_specifics_s {
 	/*
 	 * Target structure description.
 	 */
@@ -24,7 +24,7 @@ typedef struct asn_CHOICE_specifics_s {
 	/*
 	 * Tags to members mapping table.
 	 */
-	asn_TYPE_tag2member_t *tag2el;
+	const asn_TYPE_tag2member_t *tag2el;
 	int tag2el_count;

 	/* Canonical ordering of CHOICE elements, for PER */
--- a/asn1/asn1c/constr_SEQUENCE.c
+++ b/asn1/asn1c/constr_SEQUENCE.c
@@ -1,10 +1,11 @@
 /*-
- * Copyright (c) 2003, 2004, 2005, 2006 Lev Walkin <vlm@lionet.info>.
+ * Copyright (c) 2003, 2004, 2005, 2006, 2007 Lev Walkin <vlm@lionet.info>.
 * All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
 #include <asn_internal.h>
 #include <constr_SEQUENCE.h>
+#include <per_opentype.h>

 /*
 * Number of bytes left for this structure.
@@ -33,7 +34,7 @@
 #undef	ADVANCE
 #define	ADVANCE(num_bytes)	do {		\
 		size_t num = num_bytes;		\
-		ptr = ((const char *)ptr) + num;\
+		ptr = ((const char *)ptr) + num; \
 		size -= num;			\
 		if(ctx->left >= 0)		\
 			ctx->left -= num;	\
@@ -309,16 +310,16 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 			 * Resort to a binary search over
 			 * sorted array of tags.
 			 */
-			asn_TYPE_tag2member_t *t2m;
+			const asn_TYPE_tag2member_t *t2m;
 			asn_TYPE_tag2member_t key;
 			key.el_tag = tlv_tag;
 			key.el_no = edx;
-			t2m = (asn_TYPE_tag2member_t *)bsearch(&key,
+			t2m = (const asn_TYPE_tag2member_t *)bsearch(&key,
 				specs->tag2el, specs->tag2el_count,
 				sizeof(specs->tag2el[0]), _t2e_cmp);
 			if(t2m) {
-				asn_TYPE_tag2member_t *best = 0;
-				asn_TYPE_tag2member_t *t2m_f, *t2m_l;
+				const asn_TYPE_tag2member_t *best = 0;
+				const asn_TYPE_tag2member_t *t2m_f, *t2m_l;
 				int edx_max = edx + elements[edx].optional;
 				/*
 				 * Rewind to the first element with that tag,
@@ -346,7 +347,8 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 			 * or an extension (...),
 			 * or an end of the indefinite-length structure.
 			 */
-			if(!IN_EXTENSION_GROUP(specs, edx)) {
+			if(!IN_EXTENSION_GROUP(specs,
+				edx + elements[edx].optional)) {
 				ASN_DEBUG("Unexpected tag %s (at %d)",
 					ber_tlv_tag_string(tlv_tag), edx);
 				ASN_DEBUG("Expected tag %s (%s)%s",
@@ -358,7 +360,10 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 			} else {
 				/* Skip this tag */
 				ssize_t skip;
+				edx += elements[edx].optional;

+				ASN_DEBUG("Skipping unexpected %s (at %d)",
+					ber_tlv_tag_string(tlv_tag), edx);
 				skip = ber_skip_length(opt_codec_ctx,
 					BER_TLV_CONSTRUCTED(ptr),
 					(const char *)ptr + tag_len,
@@ -527,7 +532,7 @@ SEQUENCE_encode_der(asn_TYPE_descriptor_t *td,
 			if(!memb_ptr) {
 				if(elm->optional) continue;
 				/* Mandatory element is missing */
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			}
 		} else {
 			memb_ptr = (void *)((char *)sptr + elm->memb_offset);
@@ -548,10 +553,10 @@ SEQUENCE_encode_der(asn_TYPE_descriptor_t *td,
 	ret = der_write_tags(td, computed_size, tag_mode, 1, tag, cb, app_key);
 	ASN_DEBUG("Wrote tags: %ld (+%ld)", (long)ret, (long)computed_size);
 	if(ret == -1)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;
 	erval.encoded = computed_size + ret;

-	if(!cb) _ASN_ENCODED_OK(erval);
+	if(!cb) ASN__ENCODED_OK(erval);

 	/*
 	 * Encode all members.
@@ -581,9 +586,9 @@ SEQUENCE_encode_der(asn_TYPE_descriptor_t *td,
 		/*
 		 * Encoded size is not equal to the computed size.
 		 */
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

-	_ASN_ENCODED_OK(erval);
+	ASN__ENCODED_OK(erval);
 }


@@ -662,8 +667,7 @@ SEQUENCE_decode_xer(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 			if(elm->flags & ATF_POINTER) {
 				/* Member is a pointer to another structure */
-				memb_ptr2 = (void **)((char *)st
-					+ elm->memb_offset);
+				memb_ptr2 = (void **)((char *)st + elm->memb_offset);
 			} else {
 				memb_ptr = (char *)st + elm->memb_offset;
 				memb_ptr2 = &memb_ptr;
@@ -688,11 +692,12 @@ SEQUENCE_decode_xer(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		 */
 		ch_size = xer_next_token(&ctx->context, buf_ptr, size,
 			&ch_type);
-		switch(ch_size) {
-		case -1: RETURN(RC_FAIL);
-		case 0:  RETURN(RC_WMORE);
-		default:
+		if(ch_size == -1) {
+		    RETURN(RC_FAIL);
+        } else {
 			switch(ch_type) {
+            case PXER_WMORE:
+                RETURN(RC_WMORE);
 			case PXER_COMMENT:	/* Got XML comment */
 			case PXER_TEXT:		/* Ignore free-standing text */
 				XER_ADVANCE(ch_size);	/* Skip silently */
@@ -853,7 +858,7 @@ SEQUENCE_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	int edx;

 	if(!sptr)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	er.encoded = 0;

@@ -870,29 +875,29 @@ SEQUENCE_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 				if(elm->optional)
 					continue;
 				/* Mandatory element is missing */
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			}
 		} else {
 			memb_ptr = (void *)((char *)sptr + elm->memb_offset);
 		}

-		if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel);
-		_ASN_CALLBACK3("<", 1, mname, mlen, ">", 1);
+		if(!xcan) ASN__TEXT_INDENT(1, ilevel);
+		ASN__CALLBACK3("<", 1, mname, mlen, ">", 1);

 		/* Print the member itself */
 		tmper = elm->type->xer_encoder(elm->type, memb_ptr,
 			ilevel + 1, flags, cb, app_key);
 		if(tmper.encoded == -1) return tmper;

-		_ASN_CALLBACK3("</", 2, mname, mlen, ">", 1);
+		ASN__CALLBACK3("</", 2, mname, mlen, ">", 1);
 		er.encoded += 5 + (2 * mlen) + tmper.encoded;
 	}

-	if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel - 1);
+	if(!xcan) ASN__TEXT_INDENT(1, ilevel - 1);

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }

 int
@@ -976,7 +981,7 @@ SEQUENCE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	int edx;

 	if(!sptr) {
-		_ASN_CTFAIL(app_key, td,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: value not given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -994,7 +999,7 @@ SEQUENCE_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 			if(!memb_ptr) {
 				if(elm->optional)
 					continue;
-				_ASN_CTFAIL(app_key, td,
+				ASN__CTFAIL(app_key, td, sptr,
 				"%s: mandatory element %s absent (%s:%d)",
 				td->name, elm->name, __FILE__, __LINE__);
 				return -1;
@@ -1027,7 +1032,7 @@ SEQUENCE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void **sptr, asn_per_data_t *pd) {
 	asn_SEQUENCE_specifics_t *specs = (asn_SEQUENCE_specifics_t *)td->specifics;
 	void *st = *sptr;	/* Target structure. */
-	int extpresent = 0;	/* Extension additions are present */
+	int extpresent;		/* Extension additions are present */
 	uint8_t *opres;		/* Presence of optional root members */
 	asn_per_data_t opmd;
 	asn_dec_rval_t rv;
@@ -1035,12 +1040,12 @@ SEQUENCE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 	(void)constraints;

-	if(_ASN_STACK_OVERFLOW_CHECK(opt_codec_ctx))
-		_ASN_DECODE_FAILED;
+	if(ASN__STACK_OVERFLOW_CHECK(opt_codec_ctx))
+		ASN__DECODE_FAILED;

 	if(!st) {
 		st = *sptr = CALLOC(1, specs->struct_size);
-		if(!st) _ASN_DECODE_FAILED;
+		if(!st) ASN__DECODE_FAILED;
 	}

 	ASN_DEBUG("Decoding %s as SEQUENCE (UPER)", td->name);
@@ -1048,37 +1053,40 @@ SEQUENCE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	/* Handle extensions */
 	if(specs->ext_before >= 0) {
 		extpresent = per_get_few_bits(pd, 1);
-		if(extpresent < 0) _ASN_DECODE_STARVED;
+		if(extpresent < 0) ASN__DECODE_STARVED;
+	} else {
+		extpresent = 0;
 	}

 	/* Prepare a place and read-in the presence bitmap */
+	memset(&opmd, 0, sizeof(opmd));
 	if(specs->roms_count) {
 		opres = (uint8_t *)MALLOC(((specs->roms_count + 7) >> 3) + 1);
-		if(!opres) _ASN_DECODE_FAILED;
+		if(!opres) ASN__DECODE_FAILED;
 		/* Get the presence map */
 		if(per_get_many_bits(pd, opres, 0, specs->roms_count)) {
 			FREEMEM(opres);
-			_ASN_DECODE_STARVED;
+			ASN__DECODE_STARVED;
 		}
 		opmd.buffer = opres;
-		opmd.nboff = 0;
 		opmd.nbits = specs->roms_count;
 		ASN_DEBUG("Read in presence bitmap for %s of %d bits (%x..)",
 			td->name, specs->roms_count, *opres);
 	} else {
 		opres = 0;
-		memset(&opmd, 0, sizeof opmd);
 	}

 	/*
 	 * Get the sequence ROOT elements.
 	 */
-	for(edx = 0; edx < ((specs->ext_before < 0)
-			? td->elements_count : specs->ext_before + 1); edx++) {
+	for(edx = 0; edx < td->elements_count; edx++) {
 		asn_TYPE_member_t *elm = &td->elements[edx];
 		void *memb_ptr;		/* Pointer to the member */
 		void **memb_ptr2;	/* Pointer to that pointer */

+		if(IN_EXTENSION_GROUP(specs, edx))
+			continue;
+
 		/* Fetch the pointer to this member */
 		if(elm->flags & ATF_POINTER) {
 			memb_ptr2 = (void **)((char *)st + elm->memb_offset);
@@ -1099,8 +1107,9 @@ SEQUENCE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 					/* Fill-in DEFAULT */
 					if(elm->default_value(1, memb_ptr2)) {
 						FREEMEM(opres);
-						_ASN_DECODE_FAILED;
+						ASN__DECODE_FAILED;
 					}
+					ASN_DEBUG("Filled-in default");
 				}
 				/* The member is just not present */
 				continue;
@@ -1120,63 +1129,201 @@ SEQUENCE_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		}
 	}

+	/* Optionality map is not needed anymore */
+	FREEMEM(opres);
+
 	/*
 	 * Deal with extensions.
 	 */
 	if(extpresent) {
-		ASN_DEBUG("Extensibility for %s: NOT IMPLEMENTED", td->name);
-		_ASN_DECODE_FAILED;
-	} else {
-		for(edx = specs->roms_count; edx < specs->roms_count
-				+ specs->aoms_count; edx++) {
-			asn_TYPE_member_t *elm = &td->elements[edx];
-			void *memb_ptr;		/* Pointer to the member */
-			void **memb_ptr2;	/* Pointer to that pointer */
+		ssize_t bmlength;
+		uint8_t *epres;		/* Presence of extension members */
+		asn_per_data_t epmd;

-			if(!elm->default_value) continue;
+		bmlength = uper_get_nslength(pd);
+		if(bmlength < 0) ASN__DECODE_STARVED;

-			/* Fetch the pointer to this member */
-			if(elm->flags & ATF_POINTER) {
-				memb_ptr2 = (void **)((char *)st
-						+ elm->memb_offset);
-			} else {
-				memb_ptr = (char *)st + elm->memb_offset;
-				memb_ptr2 = &memb_ptr;
+		ASN_DEBUG("Extensions %ld present in %s", (long)bmlength, td->name);
+
+		epres = (uint8_t *)MALLOC((bmlength + 15) >> 3);
+		if(!epres) ASN__DECODE_STARVED;
+
+		/* Get the extensions map */
+		if(per_get_many_bits(pd, epres, 0, bmlength)) {
+			FREEMEM(epres);
+			ASN__DECODE_STARVED;
+		}
+
+		memset(&epmd, 0, sizeof(epmd));
+		epmd.buffer = epres;
+		epmd.nbits = bmlength;
+		ASN_DEBUG("Read in extensions bitmap for %s of %ld bits (%x..)",
+			td->name, (long)bmlength, *epres);
+
+	    /* Go over extensions and read them in */
+	    for(edx = specs->ext_after + 1; edx < td->elements_count; edx++) {
+		asn_TYPE_member_t *elm = &td->elements[edx];
+		void *memb_ptr;		/* Pointer to the member */
+		void **memb_ptr2;	/* Pointer to that pointer */
+		int present;
+
+		if(!IN_EXTENSION_GROUP(specs, edx)) {
+			ASN_DEBUG("%d is not extension", edx);
+			continue;
+		}
+
+		/* Fetch the pointer to this member */
+		if(elm->flags & ATF_POINTER) {
+			memb_ptr2 = (void **)((char *)st + elm->memb_offset);
+		} else {
+			memb_ptr = (void *)((char *)st + elm->memb_offset);
+			memb_ptr2 = &memb_ptr;
+		}
+
+		present = per_get_few_bits(&epmd, 1);
+		if(present <= 0) {
+			if(present < 0) break;	/* No more extensions */
+			continue;
+		}
+
+		ASN_DEBUG("Decoding member %s in %s %p", elm->name, td->name, *memb_ptr2);
+		rv = uper_open_type_get(opt_codec_ctx, elm->type,
+			elm->per_constraints, memb_ptr2, pd);
+		if(rv.code != RC_OK) {
+			FREEMEM(epres);
+			return rv;
+		}
+	    }
+
+		/* Skip over overflow extensions which aren't present
+		 * in this system's version of the protocol */
+		for(;;) {
+			ASN_DEBUG("Getting overflow extensions");
+			switch(per_get_few_bits(&epmd, 1)) {
+			case -1: break;
+			case 0: continue;
+			default:
+				if(uper_open_type_skip(opt_codec_ctx, pd)) {
+					FREEMEM(epres);
+					ASN__DECODE_STARVED;
+				}
 			}
+			break;
+		}

-			/* Set default value */
-			if(elm->default_value(1, memb_ptr2)) {
-				FREEMEM(opres);
-				_ASN_DECODE_FAILED;
-			}
+		FREEMEM(epres);
+	}
+
+	/* Fill DEFAULT members in extensions */
+	for(edx = specs->roms_count; edx < specs->roms_count
+			+ specs->aoms_count; edx++) {
+		asn_TYPE_member_t *elm = &td->elements[edx];
+		void **memb_ptr2;	/* Pointer to member pointer */
+
+		if(!elm->default_value) continue;
+
+		/* Fetch the pointer to this member */
+		if(elm->flags & ATF_POINTER) {
+			memb_ptr2 = (void **)((char *)st
+					+ elm->memb_offset);
+			if(*memb_ptr2) continue;
+		} else {
+			continue;	/* Extensions are all optionals */
+		}
+
+		/* Set default value */
+		if(elm->default_value(1, memb_ptr2)) {
+			ASN__DECODE_FAILED;
 		}
 	}

 	rv.consumed = 0;
 	rv.code = RC_OK;
-	FREEMEM(opres);
 	return rv;
 }

+static int
+SEQUENCE_handle_extensions(asn_TYPE_descriptor_t *td, void *sptr,
+		asn_per_outp_t *po1, asn_per_outp_t *po2) {
+	asn_SEQUENCE_specifics_t *specs
+		= (asn_SEQUENCE_specifics_t *)td->specifics;
+	int exts_present = 0;
+	int exts_count = 0;
+	int edx;
+
+	if(specs->ext_before < 0)
+		return 0;
+
+	/* Find out which extensions are present */
+	for(edx = specs->ext_after + 1; edx < td->elements_count; edx++) {
+		asn_TYPE_member_t *elm = &td->elements[edx];
+		void *memb_ptr;		/* Pointer to the member */
+		void **memb_ptr2;	/* Pointer to that pointer */
+		int present;
+
+		if(!IN_EXTENSION_GROUP(specs, edx)) {
+			ASN_DEBUG("%s (@%d) is not extension", elm->type->name, edx);
+			continue;
+		}
+
+		/* Fetch the pointer to this member */
+		if(elm->flags & ATF_POINTER) {
+			memb_ptr2 = (void **)((char *)sptr + elm->memb_offset);
+			present = (*memb_ptr2 != 0);
+		} else {
+			memb_ptr = (void *)((char *)sptr + elm->memb_offset);
+			memb_ptr2 = &memb_ptr;
+			present = 1;
+		}
+
+		ASN_DEBUG("checking %s (@%d) present => %d",
+			elm->type->name, edx, present);
+		exts_count++;
+		exts_present += present;
+
+		/* Encode as presence marker */
+		if(po1 && per_put_few_bits(po1, present, 1))
+			return -1;
+		/* Encode as open type field */
+		if(po2 && present && uper_open_type_put(elm->type,
+				elm->per_constraints, *memb_ptr2, po2))
+			return -1;
+
+	}
+
+	return exts_present ? exts_count : 0;
+}
+
 asn_enc_rval_t
 SEQUENCE_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_per_constraints_t *constraints, void *sptr, asn_per_outp_t *po) {
 	asn_SEQUENCE_specifics_t *specs
 		= (asn_SEQUENCE_specifics_t *)td->specifics;
 	asn_enc_rval_t er;
+	int n_extensions;
 	int edx;
 	int i;

 	(void)constraints;

 	if(!sptr)
-		_ASN_ENCODE_FAILED;
+		ASN__ENCODE_FAILED;

 	er.encoded = 0;

 	ASN_DEBUG("Encoding %s as SEQUENCE (UPER)", td->name);
-	if(specs->ext_before >= 0)
-		_ASN_ENCODE_FAILED;	/* We don't encode extensions yet */
+
+
+	/*
+	 * X.691#18.1 Whether structure is extensible
+	 * and whether to encode extensions
+	 */
+	if(specs->ext_before >= 0) {
+		n_extensions = SEQUENCE_handle_extensions(td, sptr, 0, 0);
+		per_put_few_bits(po, n_extensions ? 1 : 0, 1);
+	} else {
+		n_extensions = 0;	/* There are no extensions to encode */
+	}

 	/* Encode a presence bitmap */
 	for(i = 0; i < specs->roms_count; i++) {
@@ -1208,18 +1355,25 @@ SEQUENCE_encode_uper(asn_TYPE_descriptor_t *td,
 			elm->default_value ? "def" : "wtv",
 			td->name, elm->name, present ? "present" : "absent");
 		if(per_put_few_bits(po, present, 1))
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 	}

 	/*
-	 * Get the sequence ROOT elements.
+	 * Encode the sequence ROOT elements.
 	 */
-	for(edx = 0; edx < ((specs->ext_before < 0)
-			? td->elements_count : specs->ext_before + 1); edx++) {
+	ASN_DEBUG("ext_after = %d, ec = %d, eb = %d", specs->ext_after, td->elements_count, specs->ext_before);
+	for(edx = 0; edx < ((specs->ext_after < 0)
+		? td->elements_count : specs->ext_before - 1); edx++) {
+
 		asn_TYPE_member_t *elm = &td->elements[edx];
 		void *memb_ptr;		/* Pointer to the member */
 		void **memb_ptr2;	/* Pointer to that pointer */

+		if(IN_EXTENSION_GROUP(specs, edx))
+			continue;
+
+		ASN_DEBUG("About to encode %s", elm->type->name);
+
 		/* Fetch the pointer to this member */
 		if(elm->flags & ATF_POINTER) {
 			memb_ptr2 = (void **)((char *)sptr + elm->memb_offset);
@@ -1229,7 +1383,7 @@ SEQUENCE_encode_uper(asn_TYPE_descriptor_t *td,
 				if(elm->optional)
 					continue;
 				/* Mandatory element is missing */
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			}
 		} else {
 			memb_ptr = (void *)((char *)sptr + elm->memb_offset);
@@ -1240,12 +1394,32 @@ SEQUENCE_encode_uper(asn_TYPE_descriptor_t *td,
 		if(elm->default_value && elm->default_value(0, memb_ptr2) == 1)
 			continue;

+		ASN_DEBUG("Encoding %s->%s", td->name, elm->name);
 		er = elm->type->uper_encoder(elm->type, elm->per_constraints,
 			*memb_ptr2, po);
 		if(er.encoded == -1)
 			return er;
 	}

-	_ASN_ENCODED_OK(er);
+	/* No extensions to encode */
+	if(!n_extensions) ASN__ENCODED_OK(er);
+
+	ASN_DEBUG("Length of %d bit-map", n_extensions);
+	/* #18.8. Write down the presence bit-map length. */
+	if(uper_put_nslength(po, n_extensions))
+		ASN__ENCODE_FAILED;
+
+	ASN_DEBUG("Bit-map of %d elements", n_extensions);
+	/* #18.7. Encoding the extensions presence bit-map. */
+	/* TODO: act upon NOTE in #18.7 for canonical PER */
+	if(SEQUENCE_handle_extensions(td, sptr, po, 0) != n_extensions)
+		ASN__ENCODE_FAILED;
+
+	ASN_DEBUG("Writing %d extensions", n_extensions);
+	/* #18.9. Encode extensions as open type fields. */
+	if(SEQUENCE_handle_extensions(td, sptr, 0, po) != n_extensions)
+		ASN__ENCODE_FAILED;
+
+	ASN__ENCODED_OK(er);
 }

--- a/asn1/asn1c/constr_SEQUENCE.h
+++ b/asn1/asn1c/constr_SEQUENCE.h
@@ -11,7 +11,7 @@
 extern "C" {
 #endif

-typedef struct asn_SEQUENCE_specifics_s {
+typedef const struct asn_SEQUENCE_specifics_s {
 	/*
 	 * Target structure description.
 	 */
@@ -21,14 +21,14 @@ typedef struct asn_SEQUENCE_specifics_s {
 	/*
 	 * Tags to members mapping table (sorted).
 	 */
-	asn_TYPE_tag2member_t *tag2el;
+	const asn_TYPE_tag2member_t *tag2el;
 	int tag2el_count;

 	/*
 	 * Optional members of the extensions root (roms) or additions (aoms).
 	 * Meaningful for PER.
 	 */
-	int *oms;		/* Optional MemberS */
+	const int *oms;		/* Optional MemberS */
 	int  roms_count;	/* Root optional members count */
 	int  aoms_count;	/* Additions optional members count */

--- a/asn1/asn1c/constr_SEQUENCE_OF.c
+++ b/asn1/asn1c/constr_SEQUENCE_OF.c
@@ -52,7 +52,7 @@ SEQUENCE_OF_encode_der(asn_TYPE_descriptor_t *td, void *ptr,
 	computed_size += encoding_size;
 	if(!cb) {
 		erval.encoded = computed_size;
-		_ASN_ENCODED_OK(erval);
+		ASN__ENCODED_OK(erval);
 	}

 	ASN_DEBUG("Encoding members of SEQUENCE OF %s", td->name);
@@ -101,7 +101,7 @@ SEQUENCE_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	int xcan = (flags & XER_F_CANONICAL);
 	int i;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;

 	er.encoded = 0;

@@ -111,8 +111,8 @@ SEQUENCE_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		if(!memb_ptr) continue;

 		if(mname) {
-			if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel);
-			_ASN_CALLBACK3("<", 1, mname, mlen, ">", 1);
+			if(!xcan) ASN__TEXT_INDENT(1, ilevel);
+			ASN__CALLBACK3("<", 1, mname, mlen, ">", 1);
 		}

 		tmper = elm->type->xer_encoder(elm->type, memb_ptr,
@@ -121,23 +121,23 @@ SEQUENCE_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
                if(tmper.encoded == 0 && specs->as_XMLValueList) {
                        const char *name = elm->type->xml_tag;
 			size_t len = strlen(name);
-			if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel + 1);
-			_ASN_CALLBACK3("<", 1, name, len, "/>", 2);
+			if(!xcan) ASN__TEXT_INDENT(1, ilevel + 1);
+			ASN__CALLBACK3("<", 1, name, len, "/>", 2);
                }

 		if(mname) {
-			_ASN_CALLBACK3("</", 2, mname, mlen, ">", 1);
+			ASN__CALLBACK3("</", 2, mname, mlen, ">", 1);
 			er.encoded += 5;
 		}

 		er.encoded += (2 * mlen) + tmper.encoded;
 	}

-	if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel - 1);
+	if(!xcan) ASN__TEXT_INDENT(1, ilevel - 1);

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 cb_failed:
-	_ASN_ENCODE_FAILED;
+	ASN__ENCODE_FAILED;
 }

 asn_enc_rval_t
@@ -149,7 +149,7 @@ SEQUENCE_OF_encode_uper(asn_TYPE_descriptor_t *td,
 	asn_TYPE_member_t *elm = td->elements;
 	int seq;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;
 	list = _A_SEQUENCE_FROM_VOID(sptr);

 	er.encoded = 0;
@@ -170,17 +170,17 @@ SEQUENCE_OF_encode_uper(asn_TYPE_descriptor_t *td,
 		if(ct->flags & APC_EXTENSIBLE) {
 			/* Declare whether size is in extension root */
 			if(per_put_few_bits(po, not_in_root, 1))
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 			if(not_in_root) ct = 0;
 		} else if(not_in_root && ct->effective_bits >= 0)
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 	}

 	if(ct && ct->effective_bits >= 0) {
 		/* X.691, #19.5: No length determinant */
 		if(per_put_few_bits(po, list->count - ct->lower_bound,
 				ct->effective_bits))
-			_ASN_ENCODE_FAILED;
+			ASN__ENCODE_FAILED;
 	}

 	for(seq = -1; seq < list->count;) {
@@ -190,19 +190,19 @@ SEQUENCE_OF_encode_uper(asn_TYPE_descriptor_t *td,
 			mayEncode = list->count;
 		} else {
 			mayEncode = uper_put_length(po, list->count - seq);
-			if(mayEncode < 0) _ASN_ENCODE_FAILED;
+			if(mayEncode < 0) ASN__ENCODE_FAILED;
 		}

 		while(mayEncode--) {
 			void *memb_ptr = list->array[seq++];
-			if(!memb_ptr) _ASN_ENCODE_FAILED;
+			if(!memb_ptr) ASN__ENCODE_FAILED;
 			er = elm->type->uper_encoder(elm->type,
 				elm->per_constraints, memb_ptr, po);
 			if(er.encoded == -1)
-				_ASN_ENCODE_FAILED;
+				ASN__ENCODE_FAILED;
 		}
 	}

-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

--- a/asn1/asn1c/constr_SET_OF.c
+++ b/asn1/asn1c/constr_SET_OF.c
@@ -227,6 +227,8 @@ SET_OF_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 			}
 			/* Fall through */
 		case RC_FAIL: /* Fatal error */
+			ASN_STRUCT_FREE(*elm->type, ctx->ptr);
+			ctx->ptr = 0;
 			RETURN(RC_FAIL);
 		} /* switch(rval) */
 		
@@ -357,7 +359,7 @@ SET_OF_encode_der(asn_TYPE_descriptor_t *td, void *ptr,

 	if(!cb || list->count == 0) {
 		erval.encoded = computed_size;
-		_ASN_ENCODED_OK(erval);
+		ASN__ENCODED_OK(erval);
 	}

 	/*
@@ -449,7 +451,7 @@ SET_OF_encode_der(asn_TYPE_descriptor_t *td, void *ptr,
 		erval.encoded = computed_size;
 	}

-	_ASN_ENCODED_OK(erval);
+	ASN__ENCODED_OK(erval);
 }

 #undef	XER_ADVANCE
@@ -547,11 +549,12 @@ SET_OF_decode_xer(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		 */
 		ch_size = xer_next_token(&ctx->context,
 			buf_ptr, size, &ch_type);
-		switch(ch_size) {
-		case -1: RETURN(RC_FAIL);
-		case 0:  RETURN(RC_WMORE);
-		default:
+		if(ch_size == -1) {
+            RETURN(RC_FAIL);
+        } else {
 			switch(ch_type) {
+            case PXER_WMORE:
+                RETURN(RC_WMORE);
 			case PXER_COMMENT:	/* Got XML comment */
 			case PXER_TEXT:		/* Ignore free-standing text */
 				XER_ADVANCE(ch_size);	/* Skip silently */
@@ -665,11 +668,11 @@ SET_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 	asn_app_consume_bytes_f *original_cb = cb;
 	int i;

-	if(!sptr) _ASN_ENCODE_FAILED;
+	if(!sptr) ASN__ENCODE_FAILED;

 	if(xcan) {
 		encs = (xer_tmp_enc_t *)MALLOC(list->count * sizeof(encs[0]));
-		if(!encs) _ASN_ENCODE_FAILED;
+		if(!encs) ASN__ENCODE_FAILED;
 		cb = SET_OF_encode_xer_callback;
 	}

@@ -688,12 +691,12 @@ SET_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		}

 		if(mname) {
-			if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel);
-			_ASN_CALLBACK3("<", 1, mname, mlen, ">", 1);
+			if(!xcan) ASN__TEXT_INDENT(1, ilevel);
+			ASN__CALLBACK3("<", 1, mname, mlen, ">", 1);
 		}

 		if(!xcan && specs->as_XMLValueList == 1)
-			_i_ASN_TEXT_INDENT(1, ilevel + 1);
+			ASN__TEXT_INDENT(1, ilevel + 1);
 		tmper = elm->type->xer_encoder(elm->type, memb_ptr,
 				ilevel + (specs->as_XMLValueList != 2),
 				flags, cb, app_key);
@@ -705,18 +708,18 @@ SET_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		if(tmper.encoded == 0 && specs->as_XMLValueList) {
 			const char *name = elm->type->xml_tag;
 			size_t len = strlen(name);
-			_ASN_CALLBACK3("<", 1, name, len, "/>", 2);
+			ASN__CALLBACK3("<", 1, name, len, "/>", 2);
 		}

 		if(mname) {
-			_ASN_CALLBACK3("</", 2, mname, mlen, ">", 1);
+			ASN__CALLBACK3("</", 2, mname, mlen, ">", 1);
 			er.encoded += 5;
 		}

 		er.encoded += (2 * mlen) + tmper.encoded;
 	}

-	if(!xcan) _i_ASN_TEXT_INDENT(1, ilevel - 1);
+	if(!xcan) ASN__TEXT_INDENT(1, ilevel - 1);

 	if(encs) {
 		xer_tmp_enc_t *enc = encs;
@@ -728,7 +731,7 @@ SET_OF_encode_xer(asn_TYPE_descriptor_t *td, void *sptr,
 		qsort(encs, encs_count, sizeof(encs[0]), SET_OF_xer_order);

 		for(; enc < end; enc++) {
-			_ASN_CALLBACK(enc->buffer, enc->offset);
+			ASN__CALLBACK(enc->buffer, enc->offset);
 			FREEMEM(enc->buffer);
 			enc->buffer = 0;
 			control_size += enc->offset;
@@ -749,7 +752,7 @@ cleanup:
 		}
 		FREEMEM(encs);
 	}
-	_ASN_ENCODED_OK(er);
+	ASN__ENCODED_OK(er);
 }

 int
@@ -787,8 +790,10 @@ SET_OF_print(asn_TYPE_descriptor_t *td, const void *sptr, int ilevel,
 void
 SET_OF_free(asn_TYPE_descriptor_t *td, void *ptr, int contents_only) {
 	if(td && ptr) {
+		asn_SET_OF_specifics_t *specs;
 		asn_TYPE_member_t *elm = td->elements;
 		asn_anonymous_set_ *list = _A_SET_FROM_VOID(ptr);
+		asn_struct_ctx_t *ctx;	/* Decoder context */
 		int i;

 		/*
@@ -804,6 +809,13 @@ SET_OF_free(asn_TYPE_descriptor_t *td, void *ptr, int contents_only) {

 		asn_set_empty(list);	/* Remove (list->array) */

+		specs = (asn_SET_OF_specifics_t *)td->specifics;
+		ctx = (asn_struct_ctx_t *)((char *)ptr + specs->ctx_offset);
+		if(ctx->ptr) {
+			ASN_STRUCT_FREE(*elm->type, ctx->ptr);
+			ctx->ptr = 0;
+		}
+
 		if(!contents_only) {
 			FREEMEM(ptr);
 		}
@@ -819,7 +831,7 @@ SET_OF_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	int i;

 	if(!sptr) {
-		_ASN_CTFAIL(app_key, td,
+		ASN__CTFAIL(app_key, td, sptr,
 			"%s: value not given (%s:%d)",
 			td->name, __FILE__, __LINE__);
 		return -1;
@@ -843,7 +855,7 @@ SET_OF_constraint(asn_TYPE_descriptor_t *td, const void *sptr,
 	}

 	/*
-	 * Cannot inherit it eralier:
+	 * Cannot inherit it earlier:
 	 * need to make sure we get the updated version.
 	 */
 	if(!elm->memb_constraints)
@@ -864,15 +876,15 @@ SET_OF_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 	int repeat = 0;
 	ssize_t nelems;

-	if(_ASN_STACK_OVERFLOW_CHECK(opt_codec_ctx))
-		_ASN_DECODE_FAILED;
+	if(ASN__STACK_OVERFLOW_CHECK(opt_codec_ctx))
+		ASN__DECODE_FAILED;

 	/*
 	 * Create the target structure if it is not present already.
 	 */
 	if(!st) {
 		st = *sptr = CALLOC(1, specs->struct_size);
-		if(!st) _ASN_DECODE_FAILED;
+		if(!st) ASN__DECODE_FAILED;
 	}                                                                       
 	list = _A_SET_FROM_VOID(st);

@@ -883,7 +895,7 @@ SET_OF_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,

 	if(ct && ct->flags & APC_EXTENSIBLE) {
 		int value = per_get_few_bits(pd, 1);
-		if(value < 0) _ASN_DECODE_STARVED;
+		if(value < 0) ASN__DECODE_STARVED;
 		if(value) ct = 0;	/* Not restricted! */
 	}

@@ -892,7 +904,7 @@ SET_OF_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 		nelems = per_get_few_bits(pd, ct->effective_bits);
 		ASN_DEBUG("Preparing to fetch %ld+%ld elements from %s",
 			(long)nelems, ct->lower_bound, td->name);
-		if(nelems < 0)  _ASN_DECODE_STARVED;
+		if(nelems < 0)  ASN__DECODE_STARVED;
 		nelems += ct->lower_bound;
 	} else {
 		nelems = -1;
@@ -904,8 +916,8 @@ SET_OF_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 			nelems = uper_get_length(pd,
 				ct ? ct->effective_bits : -1, &repeat);
 			ASN_DEBUG("Got to decode %d elements (eff %d)",
-				(int)nelems, (int)ct ? ct->effective_bits : -1);
-			if(nelems < 0) _ASN_DECODE_STARVED;
+				(int)nelems, (int)(ct ? ct->effective_bits : -1));
+			if(nelems < 0) ASN__DECODE_STARVED;
 		}

 		for(i = 0; i < nelems; i++) {
@@ -921,7 +933,7 @@ SET_OF_decode_uper(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
 				ASN_DEBUG("Failed to add element into %s",
 					td->name);
 				/* Fall through */
-				rv.code == RC_FAIL;
+				rv.code = RC_FAIL;
 			} else {
 				ASN_DEBUG("Failed decoding %s of %s (SET OF)",
 					elm->type->name, td->name);
--- a/asn1/asn1c/constr_SET_OF.h
+++ b/asn1/asn1c/constr_SET_OF.h
@@ -11,7 +11,7 @@
 extern "C" {
 #endif

-typedef struct asn_SET_OF_specifics_s {
+typedef const struct asn_SET_OF_specifics_s {
 	/*
 	 * Target structure description.
 	 */
--- a/asn1/asn1c/constr_TYPE.c
+++ b/asn1/asn1c/constr_TYPE.c
@@ -17,7 +17,7 @@ static asn_app_consume_bytes_f _print2fp;
 * Return the outmost tag of the type.
 */
 ber_tlv_tag_t
-asn_TYPE_outmost_tag(asn_TYPE_descriptor_t *type_descriptor,
+asn_TYPE_outmost_tag(const asn_TYPE_descriptor_t *type_descriptor,
 		const void *struct_ptr, int tag_mode, ber_tlv_tag_t tag) {

 	if(tag_mode)
--- a/asn1/asn1c/constr_TYPE.h
+++ b/asn1/asn1c/constr_TYPE.h
@@ -73,7 +73,7 @@ typedef int (asn_struct_print_f)(
 * Do not use it in your application.
 */
 typedef ber_tlv_tag_t (asn_outmost_tag_f)(
-		struct asn_TYPE_descriptor_s *type_descriptor,
+		const struct asn_TYPE_descriptor_s *type_descriptor,
 		const void *struct_ptr, int tag_mode, ber_tlv_tag_t tag);
 /* The instance of the above function type; used internally. */
 asn_outmost_tag_f asn_TYPE_outmost_tag;
@@ -83,8 +83,8 @@ asn_outmost_tag_f asn_TYPE_outmost_tag;
 * The definitive description of the destination language's structure.
 */
 typedef struct asn_TYPE_descriptor_s {
-	char *name;	/* A name of the ASN.1 type. "" in some cases. */
-	char *xml_tag;	/* Name used in XML tag */
+	const char *name;	/* A name of the ASN.1 type. "" in some cases. */
+	const char *xml_tag;	/* Name used in XML tag */

 	/*
 	 * Generalized functions for dealing with the specific type.
@@ -108,10 +108,10 @@ typedef struct asn_TYPE_descriptor_s {
 	 * Tags that are expected to occur.
 	 */
 	asn_outmost_tag_f  *outmost_tag;	/* <optional, internal> */
-	ber_tlv_tag_t *tags;	/* Effective tags sequence for this type */
-	int tags_count;		/* Number of tags which are expected */
-	ber_tlv_tag_t *all_tags;/* Every tag for BER/containment */
-	int all_tags_count;	/* Number of tags */
+	const ber_tlv_tag_t *tags;	/* Effective tags sequence for this type */
+	int tags_count;			/* Number of tags which are expected */
+	const ber_tlv_tag_t *all_tags;	/* Every tag for BER/containment */
+	int all_tags_count;		/* Number of tags */

 	asn_per_constraints_t *per_constraints;	/* PER compiled constraints */

@@ -125,7 +125,7 @@ typedef struct asn_TYPE_descriptor_s {
 	 * Additional information describing the type, used by appropriate
 	 * functions above.
 	 */
-	void *specifics;
+	const void *specifics;
 } asn_TYPE_descriptor_t;

 /*
@@ -147,7 +147,7 @@ typedef struct asn_TYPE_member_s {
 	asn_constr_check_f *memb_constraints;	/* Constraints validator */
 	asn_per_constraints_t *per_constraints;	/* PER compiled constraints */
 	int (*default_value)(int setval, void **sptr);	/* DEFAULT <value> */
-	char *name;			/* ASN.1 identifier of the element */
+	const char *name;			/* ASN.1 identifier of the element */
 } asn_TYPE_member_t;

 /*
--- a/asn1/asn1c/constraints.h
+++ b/asn1/asn1c/constraints.h
@@ -2,8 +2,8 @@
 * Copyright (c) 2004, 2006 Lev Walkin <vlm@lionet.info>. All rights reserved.
 * Redistribution and modifications are permitted subject to BSD license.
 */
-#ifndef	_ASN1_CONSTRAINTS_VALIDATOR_H_
-#define	_ASN1_CONSTRAINTS_VALIDATOR_H_
+#ifndef	ASN1_CONSTRAINTS_VALIDATOR_H
+#define	ASN1_CONSTRAINTS_VALIDATOR_H

 #include <asn_system.h>		/* Platform-dependent types */

@@ -54,10 +54,10 @@ asn_constr_check_f asn_generic_unknown_constraint; /* Not fully supported */
 /*
 * Invoke the callback with a complete error message.
 */
-#define	_ASN_CTFAIL	if(ctfailcb) ctfailcb
+#define	ASN__CTFAIL	if(ctfailcb) ctfailcb

 #ifdef __cplusplus
 }
 #endif

-#endif	/* _ASN1_CONSTRAINTS_VALIDATOR_H_ */
+#endif	/* ASN1_CONSTRAINTS_VALIDATOR_H */
--- a/asn1/asn1c/der_encoder.c
+++ b/asn1/asn1c/der_encoder.c
@@ -80,8 +80,8 @@ der_write_tags(asn_TYPE_descriptor_t *sd,
 		ber_tlv_tag_t tag,	/* EXPLICIT or IMPLICIT tag */
 		asn_app_consume_bytes_f *cb,
 		void *app_key) {
-	ber_tlv_tag_t *tags;	/* Copy of tags stream */
-	int tags_count;		/* Number of tags */
+	const ber_tlv_tag_t *tags;	/* Copy of tags stream */
+	int tags_count;			/* Number of tags */
 	size_t overall_length;
 	ssize_t *lens;
 	int i;
@@ -102,8 +102,9 @@ der_write_tags(asn_TYPE_descriptor_t *sd,
 		 * and initialize it appropriately.
 		 */
 		int stag_offset;
-		tags = (ber_tlv_tag_t *)alloca((sd->tags_count + 1) * sizeof(ber_tlv_tag_t));
-		if(!tags) {	/* Can fail on !x86 */
+		ber_tlv_tag_t *tags_buf;
+		tags_buf = (ber_tlv_tag_t *)alloca((sd->tags_count + 1) * sizeof(ber_tlv_tag_t));
+		if(!tags_buf) {	/* Can fail on !x86 */
 			errno = ENOMEM;
 			return -1;
 		}
@@ -111,10 +112,11 @@ der_write_tags(asn_TYPE_descriptor_t *sd,
 			+ 1	/* EXPLICIT or IMPLICIT tag is given */
 			- ((tag_mode == -1) && sd->tags_count);
 		/* Copy tags over */
-		tags[0] = tag;
+		tags_buf[0] = tag;
 		stag_offset = -1 + ((tag_mode == -1) && sd->tags_count);
 		for(i = 1; i < tags_count; i++)
-			tags[i] = sd->tags[i + stag_offset];
+			tags_buf[i] = sd->tags[i + stag_offset];
+		tags = tags_buf;
 	} else {
 		tags = sd->tags;
 		tags_count = sd->tags_count;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
geos_one	021b5face2	mod for buster	2025-08-13 18:37:59 +02:00
geos_one	17f6617532	mod for buster	2025-08-13 16:24:48 +02:00
geos_one	48c90058e6	mod for buster	2025-08-13 15:38:24 +02:00
geos_one	1034631025	mod for buster	2025-08-13 15:25:25 +02:00
geos_one	026320aeb4	Buster compat	2025-08-13 00:27:22 +02:00
geos_one	3f868be5f3	Buster compat	2025-08-13 00:07:01 +02:00
geos_one	6b1464dede	Buster compat	2025-08-12 23:24:28 +02:00
geos_one	9e46aba382	Bump	2025-08-12 23:03:44 +02:00
geos_one	8b56c8dd81	Bump	2025-08-12 22:31:02 +02:00
Timo Aaltonen	7a3070709b	Import Debian changes 4.12.4-1 freeipa (4.12.4-1) unstable; urgency=medium . * New upstream release. - CVE-2024-11029 (Closes: #1093383) - CVE-2025-4404 (Closes: #1108050) * control: Demote libnss-myhostname to Suggests. (ref. #1006829) * patches: Fix samba lock directory location. (Closes: #1012593) * patches: Map nobody group to nogroup on Debian. (Closes: #1012592) . freeipa (4.12.2-3) unstable; urgency=medium . * control: Add libnss-myhostname to client depends. (Closes: #1006829) * control: Add python3-ifaddr to ipalib depends. (Closes: #1089716) * control: Add python3-sphinx to build-depends. (Closes: #1003179, #1044642, #1049799) . freeipa (4.12.2-2) unstable; urgency=medium . * control: Migrate to bind9-dnsutils. (Closes: #1094939) . freeipa (4.12.2-1) unstable; urgency=medium . * New upstream release. - CVE-2024-2698 (Closes: #1077682) - CVE-2024-3183 (Closes: #1077683) * control: Drop conflicts on systemd-timesyncd as upstream recognizes it now. (Closes: #1072168) * use-raw-strings.diff: Dropped, upstream. * rules: Fix installing bash-completions. (Closes: #1089329) * control: Drop python3-nose from build-depends, unused. (Closes: #1018359) . freeipa (4.11.1-2.1) unstable; urgency=medium . * Non-maintainer upload. * Replace systemd Build-Depends with systemd-dev for systemd.pc. (Closes: #1060469) . freeipa (4.11.1-2) unstable; urgency=medium . * use-raw-strings.diff: Import patch from upstream to fix noise when installing. (LP: #2060298) * map-ssh-service.diff: Map sshd service to use ssh.service. (LP: #2061055) . freeipa (4.11.1-1) unstable; urgency=medium . * New upstream release. * control: Add sssd-passkey to freeipa-client Recommends. * control.server: Drop python3-paste from python3-ipatests depends, obsolete. * control, rules: Replace hardcoded librpm9 depends. (Closes: #1067570) . freeipa (4.10.2-2) unstable; urgency=medium . [ Timo Aaltonen ] * control: Bump certmonger dependency. . [ Helmut Grohne ] * Fix FTBFS when systemd.pc changes systemdsystemunitdir. (Closes: #1052641) . freeipa (4.10.2-1) unstable; urgency=medium . * New upstream release. * control: Bump sssd, bind9 depends. * source: Update extend-diff-ignore. * copyright, source: Fix some lintian issues/overrides. * server-trust-ad: Add a lintian override for the samba plugin rpath. * source: Add a lintian override for client-only build; empty-debian- tests-control. . freeipa (4.9.11-1) unstable; urgency=medium . * New upstream release. (Closes: #1029070) * control: Add systemd-timesyncd to freeipa-client Conflicts. (Closes: #1008195) * patches: Drop upstreamed patches. * source: Extend diff-ignore. * server.install: Updated. . freeipa (4.9.8-1) unstable; urgency=medium . * New upstream release. * patches: Drop upstreamed patch. * server.install: Updated. * Build only the client in order to be able to backport to bullseye. (Closes: #996946) * control: Depend on librpm9 instead of librpm8. * tests: Disabled for a client-only build. . freeipa (4.9.7-3) unstable; urgency=medium . * tests: Set KRB5_TRACE to use stderr. * patches: Fix apache group properly. * client: Move .tmpfile -> .tmpfiles. * control: Bump debhelper to 13, gain dh_installtmpfiles being run. * control, rules: Add --without-ipa-join-xml and drop libxmlrpc from depends. * server.postinst: Drop creating old ccaches for mod_auth_gssapi, obsolete. * server.postinst: Drop old upgrade rules. * patches: Fix named keytab name. . freeipa (4.9.7-2) unstable; urgency=medium . * lintian: Drop override on python-script-but-no-python-dep, which doesn't exist anymore. * rules: Add fortify flag to CFLAGS, as CPPFLAGS isn't used by the project. * ci: Drop allowed failure for blhc, it passes now. * control: Build-depend on libcurl4-openssl-dev. * fix-paths.diff: Fix some paths in ipaplatform/base. * fix-apache-group.diff: Fix apache group name in ipa.conf tmpfile. * control: Depend on gpg instead of gnupg. * control: Drop libwbclient-sssd from freeipa-client-samba Depends. * patches: Import a patch to fix ipa cert-find. (Closes: #997952) . freeipa (4.9.7-1) unstable; urgency=medium . * New upstream release. * control: Drop obsolete depends on python3-nss. * pkcs11-openssl-for-bind.diff, migrate-to-gpg.diff, use-bind9.16.diff, fix-chrony-service-name.diff: - Dropped, upstream. * watch: Fixed to find upstream rc's. * source: Update extend-diff-ignore. * control: Add libcurl-dev, libjansson-dev and libpwquality-dev to build-depends. * install: Added new files. * rules: Drop ipasphinx files for now. * control: Drop dependency on custodia, not needed. * control: Bump 389-ds-base depends. * control: Drop python3-coverage depends, it's not used. * control: Bump dogtag depends.	2025-08-12 22:28:57 +02:00
geos_one	9181ee2487	Import Upstream version 4.12.4	2025-08-12 22:28:56 +02:00
Mario Fetka	0d0dcf1c8a	rpm9	2021-12-15 13:37:56 +01:00
Mario Fetka	df687e7c3e	Drop Freeipa-server	2021-10-03 13:48:16 +02:00
Mario Fetka	d8bec8df26	Drop Freeipa-server	2021-10-03 13:41:53 +02:00
Mario Fetka	181b29cdec	Drop Freeipa-server	2021-10-03 13:19:23 +02:00
Mario Fetka	185d7ca3de	Roleback	2021-10-03 13:11:31 +02:00
Mario Fetka	dee0290211	Roleback	2021-10-03 13:01:08 +02:00
Timo Aaltonen	358acdd85f	Imported Debian patch 4.8.10-2	2021-10-03 12:58:58 +02:00
Timo Aaltonen	8bc559c5a1	Imported Debian patch 4.7.2-3	2021-10-03 12:04:33 +02:00
Mario Fetka	27edeba051	Ipa for bullseye	2021-10-03 12:04:10 +02:00
Mario Fetka	7215534981	Ipa for bullseye	2021-10-03 11:42:34 +02:00
Mario Fetka	5d0157dc43	Ipa for bullseye	2021-10-03 11:07:59 +02:00
Timo Aaltonen	598845c89b	Imported Debian patch 4.8.10-2	2021-10-03 11:06:41 +02:00
Mario Fetka	03a8170b15	Imported Upstream version 4.8.10	2021-10-03 11:06:28 +02:00
Alexandre Ellert	10dfc9587b	Imported Debian patch 4.0.5-6~numeezy	2021-08-10 03:59:16 +02:00