third_party/heimdal: import lorikeet-heimdal-202203010107 (commit 0e7a12404c388e831fe6933fcc3c86e7eb334825)

NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

19 files changed, 420 insertions, 196 deletions

diff --git a/third_party/heimdal/lib/base/array.c b/third_party/heimdal/lib/base/array.c
index b34f9de4880..994fa7d38e4 100644
--- a/third_party/heimdal/lib/base/array.c
+++ b/third_party/heimdal/lib/base/array.c
@@ -46,7 +46,7 @@ struct heim_array_data {
     heim_object_t *allocated;
 };
 
-static void
+static void HEIM_CALLCONV
 array_dealloc(heim_object_t ptr)
 {
     heim_array_t array = ptr;
@@ -58,7 +58,7 @@ array_dealloc(heim_object_t ptr)
 
 struct heim_type_data array_object = {
     HEIM_TID_ARRAY,
-    "dict-object",
+    "array-object",
     NULL,
     array_dealloc,
     NULL,
diff --git a/third_party/heimdal/lib/base/bsearch.c b/third_party/heimdal/lib/base/bsearch.c
index 27896217268..268cc018df6 100644
--- a/third_party/heimdal/lib/base/bsearch.c
+++ b/third_party/heimdal/lib/base/bsearch.c
@@ -275,11 +275,12 @@ bsearch_common(const char *buf, size_t sz, const char *key,
 	    ret = 0;
 	    if (val_len && value) {
 		/* Avoid strndup() so we don't need libroken here yet */
-		*value = malloc(val_len + 1);
-		if (!*value)
-		    ret = errno;
-		(void) memcpy(*value, &buf[val_start], val_len);
-		(*value)[val_len] = '\0';
+		if ((*value = malloc(val_len + 1))) {
+                    (void) memcpy(*value, &buf[val_start], val_len);
+                    (*value)[val_len] = '\0';
+                } else {
+                    ret = errno;
+                }
 	    }
 	    break;
 	}
@@ -708,6 +709,10 @@ _bsearch_file(bsearch_file_handle bfh, const char *key,
 
     if (reads)
 	*reads = 0;
+    if (value)
+	*value = NULL;
+    if (loops)
+	*loops = 0;
 
     /* If whole file is in memory then search that and we're done */
     if (bfh->file_sz == bfh->cache_sz)
@@ -715,11 +720,6 @@ _bsearch_file(bsearch_file_handle bfh, const char *key,
 
     /* Else block-wise binary search */
 
-    if (value)
-	*value = NULL;
-    if (loops)
-	*loops = 0;
-
     l = 0;
     r = (bfh->file_sz / bfh->page_sz) + 1;
     for (level = 0, page = r >> 1; page >= l && page < r ; level++) {
@@ -851,7 +851,7 @@ stdb_copy_value(void *db, heim_string_t table, heim_data_t key,
 {
     bsearch_file_handle bfh = db;
     const char *k;
-    char *v;
+    char *v = NULL;
     heim_data_t value;
     int ret;
 
@@ -869,6 +869,8 @@ stdb_copy_value(void *db, heim_string_t table, heim_data_t key,
     else
 	k = (const char *)heim_data_get_ptr(key);
     ret = _bsearch_file(bfh, k, &v, NULL, NULL, NULL);
+    if (ret == 0 && v == NULL)
+        ret = -1; /* Quiet lint */
     if (ret != 0) {
 	if (ret > 0 && error)
 	    *error = heim_error_create(ret, "%s", strerror(ret));
diff --git a/third_party/heimdal/lib/base/data.c b/third_party/heimdal/lib/base/data.c
index 4aa6efc6677..cefdde0c1bb 100644
--- a/third_party/heimdal/lib/base/data.c
+++ b/third_party/heimdal/lib/base/data.c
@@ -34,7 +34,7 @@
 #include "baselocl.h"
 #include <string.h>
 
-static void
+static void HEIM_CALLCONV
 data_dealloc(void *ptr)
 {
     heim_data_t d = ptr;
@@ -61,7 +61,7 @@ data_cmp(void *a, void *b)
     return memcmp(osa->data, osb->data, osa->length);
 }
 
-static unsigned long
+static uintptr_t
 data_hash(void *ptr)
 {
     heim_octet_string *os = ptr;
@@ -69,8 +69,9 @@ data_hash(void *ptr)
 
     if (os->length < 4)
 	return os->length;
-    return s[0] | (s[1] << 8) |
-	(s[os->length - 2] << 16) | (s[os->length - 1] << 24);
+
+    return ((unsigned long)s[os->length - 1] << 24)
+	| (s[os->length - 2] << 16) | (s[1] << 8) | s[0];
 }
 
 struct heim_type_data _heim_data_object = {
diff --git a/third_party/heimdal/lib/base/db.c b/third_party/heimdal/lib/base/db.c
index cd750386acc..b206ff6d766 100644
--- a/third_party/heimdal/lib/base/db.c
+++ b/third_party/heimdal/lib/base/db.c
@@ -84,7 +84,7 @@ static int open_file(const char *, int , int, int *, heim_error_t *);
 static int read_json(const char *, heim_object_t *, heim_error_t *);
 static struct heim_db_type json_dbt;
 
-static void db_dealloc(void *ptr);
+static void HEIM_CALLCONV db_dealloc(void *ptr);
 
 struct heim_type_data db_object = {
     HEIM_TID_DB,
@@ -150,7 +150,7 @@ db_init_plugins_once(void *arg)
     db_plugins = heim_retain(arg);
 }
 
-static void
+static void HEIM_CALLCONV
 plugin_dealloc(void *arg)
 {
     db_plugin plug = arg;
@@ -242,7 +242,7 @@ heim_db_register(const char *dbtype,
     return ret;
 }
 
-static void
+static void HEIM_CALLCONV
 db_dealloc(void *arg)
 {
     heim_db_t db = arg;
@@ -577,7 +577,7 @@ heim_db_commit(heim_db_t db, heim_error_t *error)
 	goto done;
     }
 
-    if (db->options == NULL)
+    if (db->options)
 	journal_fname = heim_dict_get_value(db->options, HSTR("journal-filename"));
 
     if (journal_fname != NULL) {
@@ -1144,21 +1144,15 @@ enomem:
 static
 heim_data_t from_base64(heim_string_t s, heim_error_t *error)
 {
+    ssize_t len = -1;
     void *buf;
-    size_t len;
     heim_data_t d;
 
     buf = malloc(strlen(heim_string_get_utf8(s)));
-    if (buf == NULL)
-	goto enomem;
-
-    len = rk_base64_decode(heim_string_get_utf8(s), buf);
-    d = heim_data_ref_create(buf, len, free);
-    if (d == NULL)
-	goto enomem;
-    return d;
-
-enomem:
+    if (buf)
+        len = rk_base64_decode(heim_string_get_utf8(s), buf);
+    if (len > -1 && (d = heim_data_ref_create(buf, len, free)))
+        return d;
     free(buf);
     if (error)
 	*error = heim_error_create_enomem();
diff --git a/third_party/heimdal/lib/base/dict.c b/third_party/heimdal/lib/base/dict.c
index 8d73846b2bb..86be109ffc5 100644
--- a/third_party/heimdal/lib/base/dict.c
+++ b/third_party/heimdal/lib/base/dict.c
@@ -47,7 +47,7 @@ struct heim_dict_data {
     struct hashentry **tab;
 };
 
-static void
+static void HEIM_CALLCONV
 dict_dealloc(void *ptr)
 {
     heim_dict_t dict = ptr;
@@ -115,6 +115,8 @@ heim_dict_create(size_t size)
     heim_dict_t dict;
 
     dict = _heim_alloc_object(&dict_object, sizeof(*dict));
+    if (dict == NULL)
+        return NULL;
 
     dict->size = findprime(size);
     if (dict->size == 0) {
@@ -149,7 +151,7 @@ heim_dict_get_type_id(void)
 static struct hashentry *
 _search(heim_dict_t dict, heim_object_t ptr)
 {
-    unsigned long v = heim_get_hash(ptr);
+    uintptr_t v = heim_get_hash(ptr);
     struct hashentry *p;
 
     for (p = dict->tab[v % dict->size]; p != NULL; p = p->next)
@@ -219,7 +221,7 @@ heim_dict_set_value(heim_dict_t dict, heim_object_t key, heim_object_t value)
 	heim_release(h->value);
 	h->value = heim_retain(value);
     } else {
-	unsigned long v;
+	uintptr_t v;
 
 	h = malloc(sizeof(*h));
 	if (h == NULL)
diff --git a/third_party/heimdal/lib/base/dll.c b/third_party/heimdal/lib/base/dll.c
index 31017a01191..59c39137b72 100644
--- a/third_party/heimdal/lib/base/dll.c
+++ b/third_party/heimdal/lib/base/dll.c
@@ -83,7 +83,8 @@ struct tls_values {
 
 static HEIMDAL_THREAD_LOCAL struct tls_values values;
 
-#define DEAD_KEY ((void *)8)
+static char dead_key;
+#define DEAD_KEY ((void *)&dead_key)
 
 void
 heim_w32_service_thread_detach(void *unused)
diff --git a/third_party/heimdal/lib/base/error.c b/third_party/heimdal/lib/base/error.c
index 8ae65de4981..6ba3bea412d 100644
--- a/third_party/heimdal/lib/base/error.c
+++ b/third_party/heimdal/lib/base/error.c
@@ -41,7 +41,7 @@ struct heim_error {
     struct heim_error *next;
 };
 
-static void
+static void HEIM_CALLCONV
 error_dealloc(void *ptr)
 {
     struct heim_error *p = ptr;
@@ -58,7 +58,7 @@ error_cmp(void *a, void *b)
     return heim_cmp(ap->msg, bp->msg);
 }
 
-static unsigned long
+static uintptr_t
 error_hash(void *ptr)
 {
     struct heim_error *p = ptr;
diff --git a/third_party/heimdal/lib/base/error_string.c b/third_party/heimdal/lib/base/error_string.c
index 5c787ba2ce5..a562833a91a 100644
--- a/third_party/heimdal/lib/base/error_string.c
+++ b/third_party/heimdal/lib/base/error_string.c
@@ -39,6 +39,8 @@
 void
 heim_clear_error_message(heim_context context)
 {
+    if (!context)
+        return;
     if (context->error_string)
         free(context->error_string);
     context->error_code = 0;
@@ -53,7 +55,8 @@ heim_set_error_message(heim_context context, heim_error_code ret,
     va_list ap;
 
     va_start(ap, fmt);
-    heim_vset_error_message(context, ret, fmt, ap);
+    if (context)
+        heim_vset_error_message(context, ret, fmt, ap);
     va_end(ap);
 }
 
@@ -164,7 +167,7 @@ heim_get_error_string(heim_context context)
 int
 heim_have_error_string(heim_context context)
 {
-    return context->error_string != NULL;
+    return context && context->error_string != NULL;
 }
 
 void
diff --git a/third_party/heimdal/lib/base/expand_path.c b/third_party/heimdal/lib/base/expand_path.c
index df382b99887..cf249917e8f 100644
--- a/third_party/heimdal/lib/base/expand_path.c
+++ b/third_party/heimdal/lib/base/expand_path.c
@@ -59,10 +59,9 @@ expand_temp_folder(heim_context context, PTYPE param, const char *postfix,
     size_t len;
 
     if (!GetTempPath(sizeof(tpath)/sizeof(tpath[0]), tpath)) {
-        if (context)
-            heim_set_error_message(context, EINVAL,
-                                   "Failed to get temporary path (GLE=%d)",
-                                   GetLastError());
+        heim_set_error_message(context, EINVAL,
+                               "Failed to get temporary path (GLE=%d)",
+                               GetLastError());
         return EINVAL;
     }
 
@@ -170,55 +169,52 @@ expand_userid(heim_context context, PTYPE param, const char *postfix,
         }
 
         if (le != 0) {
-            if (context)
-                heim_set_error_message(context, rv,
-                                       "Can't open thread token (GLE=%d)", le);
+            heim_set_error_message(context, rv,
+                                   "Can't open thread token (GLE=%d)", le);
             goto _exit;
         }
     }
 
     if (!GetTokenInformation(hToken, TokenOwner, NULL, 0, &len)) {
         if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
-            if (context)
-                heim_set_error_message(context, rv,
-                                       "Unexpected error reading token information (GLE=%d)",
-                                       GetLastError());
+            heim_set_error_message(context, rv,
+                                   "Unexpected error reading token information (GLE=%d)",
+                                   GetLastError());
             goto _exit;
         }
 
         if (len == 0) {
-            if (context)
-                heim_set_error_message(context, rv,
-                                      "GetTokenInformation() returned truncated buffer");
+            heim_set_error_message(context, rv,
+                                   "GetTokenInformation() returned truncated buffer");
             goto _exit;
         }
 
         pOwner = malloc(len);
         if (pOwner == NULL) {
-            if (context)
-                heim_set_error_message(context, rv, "Out of memory");
+            heim_set_error_message(context, rv, "Out of memory");
             goto _exit;
         }
     } else {
-        if (context)
-            heim_set_error_message(context, rv, "GetTokenInformation() returned truncated buffer");
+        heim_set_error_message(context, rv, "GetTokenInformation() returned truncated buffer");
         goto _exit;
     }
 
     if (!GetTokenInformation(hToken, TokenOwner, pOwner, len, &len)) {
-        if (context)
-            heim_set_error_message(context, rv, "GetTokenInformation() failed. GLE=%d", GetLastError());
+        heim_set_error_message(context, rv,
+                               "GetTokenInformation() failed. GLE=%d",
+                               GetLastError());
         goto _exit;
     }
 
     if (!ConvertSidToStringSid(pOwner->Owner, &strSid)) {
-        if (context)
-            heim_set_error_message(context, rv, "Can't convert SID to string. GLE=%d", GetLastError());
+        heim_set_error_message(context, rv,
+                               "Can't convert SID to string. GLE=%d",
+                               GetLastError());
         goto _exit;
     }
 
     *ret = strdup(strSid);
-    if (*ret == NULL && context)
+    if (*ret == NULL)
         heim_set_error_message(context, rv, "Out of memory");
 
     rv = 0;
@@ -248,8 +244,7 @@ expand_csidl(heim_context context, PTYPE folder, const char *postfix,
     size_t len;
 
     if (SHGetFolderPath(NULL, folder, NULL, SHGFP_TYPE_CURRENT, path) != S_OK) {
-        if (context)
-            heim_set_error_message(context, EINVAL, "Unable to determine folder path");
+        heim_set_error_message(context, EINVAL, "Unable to determine folder path");
         return EINVAL;
     }
 
@@ -387,7 +382,7 @@ expand_strftime(heim_context context, PTYPE param, const char *postfix,
     t = time(NULL);
     len = strftime(buf, sizeof(buf), arg, localtime(&t));
     if (len == 0 || len >= sizeof(buf))
-        return ENOMEM;
+        return heim_enomem(context);
     *ret = strdup(buf);
     return 0;
 }
@@ -488,8 +483,7 @@ expand_token(heim_context context,
 
     if (token[0] != '%' || token[1] != '{' || token_end[0] != '}' ||
         token_end - token <= 2) {
-        if (context)
-            heim_set_error_message(context, EINVAL,"Invalid token.");
+        heim_set_error_message(context, EINVAL,"Invalid token.");
         return EINVAL;
     }
 
@@ -521,8 +515,7 @@ expand_token(heim_context context,
             return errcode;
         }
 
-    if (context)
-        heim_set_error_message(context, EINVAL, "Invalid token.");
+    heim_set_error_message(context, EINVAL, "Invalid token.");
     return EINVAL;
 }
 
@@ -630,7 +623,6 @@ heim_expand_path_tokensv(heim_context context,
                 break;
             extra_tokens[i] = strdup(s);
             if (extra_tokens[i++] == NULL) {
-                va_end(ap);
                 free_extra_tokens(extra_tokens);
                 return heim_enomem(context);
             }
@@ -639,7 +631,6 @@ heim_expand_path_tokensv(heim_context context,
                 s = "";
             extra_tokens[i] = strdup(s);
             if (extra_tokens[i] == NULL) {
-                va_end(ap);
                 free_extra_tokens(extra_tokens);
                 return heim_enomem(context);
             }
@@ -667,8 +658,7 @@ heim_expand_path_tokensv(heim_context context,
                 if (*ppath_out)
                     free(*ppath_out);
                 *ppath_out = NULL;
-                if (context)
-                    heim_set_error_message(context, EINVAL, "variable missing }");
+                heim_set_error_message(context, EINVAL, "variable missing }");
                 return EINVAL;
             }
 
diff --git a/third_party/heimdal/lib/base/heimbase-svc.h b/third_party/heimdal/lib/base/heimbase-svc.h
index 1f0abd622e5..083917fb806 100644
--- a/third_party/heimdal/lib/base/heimbase-svc.h
+++ b/third_party/heimdal/lib/base/heimbase-svc.h
@@ -36,6 +36,8 @@
 #ifndef HEIMBASE_SVC_H
 #define HEIMBASE_SVC_H 1
 
+#include <heimbase.h>
+
 /*
  * This file is meant to be included in services, which can
  *
@@ -68,7 +70,9 @@
     const char *e_text;                                         \
     char *e_text_buf;                                           \
     heim_string_t reason;                                       \
-    heim_array_t kv;                                            \
-    int32_t ret
+    /* auditing key/value store */                              \
+    heim_dict_t kv;                                             \
+    heim_dict_t attributes;                                     \
+    int32_t error_code
 
 #endif /* HEIMBASE_SVC_H */
diff --git a/third_party/heimdal/lib/base/heimbase.c b/third_party/heimdal/lib/base/heimbase.c
index 8aacdb9187d..1e6805a25e7 100644
--- a/third_party/heimdal/lib/base/heimbase.c
+++ b/third_party/heimdal/lib/base/heimbase.c
@@ -53,7 +53,7 @@ struct heim_base_mem {
     HEIM_TAILQ_ENTRY(heim_base) autorel;
     heim_auto_release_t autorelpool;
     const char *name;
-    void (*dealloc)(void *);
+    void (HEIM_CALLCONV *dealloc)(void *);
     uintptr_t isaextra[1];
 };
 
@@ -83,10 +83,10 @@ struct heim_auto_release {
  * @return the same object as passed in
  */
 
-void *
-heim_retain(void *ptr)
+heim_object_t
+heim_retain(heim_object_t ptr)
 {
-    struct heim_base *p = NULL;
+    struct heim_base *p;
 
     if (ptr == NULL || heim_base_is_tagged(ptr))
 	return ptr;
@@ -111,7 +111,7 @@ void
 heim_release(void *ptr)
 {
     heim_base_atomic_integer_type old;
-    struct heim_base *p = NULL;
+    struct heim_base *p;
 
     if (ptr == NULL || heim_base_is_tagged(ptr))
 	return;
@@ -214,13 +214,13 @@ heim_get_tid(heim_object_t ptr)
  * @return a hash value
  */
 
-unsigned long
+uintptr_t
 heim_get_hash(heim_object_t ptr)
 {
     heim_type_t isa = _heim_get_isa(ptr);
     if (isa->hash)
 	return isa->hash(ptr);
-    return (unsigned long)ptr;
+    return (uintptr_t)ptr;
 }
 
 /**
@@ -257,7 +257,7 @@ heim_cmp(heim_object_t a, heim_object_t b)
  * Private - allocates an memory object
  */
 
-static void
+static void HEIM_CALLCONV
 memory_dealloc(void *ptr)
 {
     struct heim_base_mem *p = (struct heim_base_mem *)PTR2BASE(ptr);
@@ -346,7 +346,7 @@ _heim_alloc_object(heim_type_t type, size_t size)
 void *
 _heim_get_isaextra(heim_object_t ptr, size_t idx)
 {
-    struct heim_base *p = NULL;
+    struct heim_base *p;
 
     heim_assert(ptr != NULL, "internal error");
     p = (struct heim_base *)PTR2BASE(ptr);
@@ -585,7 +585,7 @@ autorel_tls(void)
 
 }
 
-static void
+static void HEIM_CALLCONV
 autorel_dealloc(void *ptr)
 {
     heim_auto_release_t ar = ptr;
@@ -614,10 +614,10 @@ autorel_cmp(void *a, void *b)
     return (a == b);
 }
 
-static unsigned long
+static uintptr_t
 autorel_hash(void *ptr)
 {
-    return (unsigned long)ptr;
+    return (uintptr_t)ptr;
 }
 
 
@@ -671,7 +671,7 @@ heim_auto_release_create(void)
 heim_object_t
 heim_auto_release(heim_object_t ptr)
 {
-    struct heim_base *p = NULL;
+    struct heim_base *p;
     struct ar_tls *tls = autorel_tls();
     heim_auto_release_t ar;
 
@@ -763,9 +763,10 @@ heim_path_vget2(heim_object_t ptr, heim_object_t *parent, heim_object_t *key,
 	    next_node = heim_dict_get_value(node, path_element);
 	} else if (node_type == HEIM_TID_DB) {
 	    next_node = _heim_db_get_value(node, NULL, path_element, NULL);
-	} else if (node_type == HEIM_TID_ARRAY) {
+	} else {
 	    int idx = -1;
 
+            /* node_type == HEIM_TID_ARRAY */
 	    if (heim_get_tid(path_element) == HEIM_TID_NUMBER)
 		idx = heim_number_get_int(path_element);
 	    if (idx < 0) {
@@ -777,12 +778,6 @@ heim_path_vget2(heim_object_t ptr, heim_object_t *parent, heim_object_t *key,
 		return NULL;
 	    }
 	    next_node = heim_array_get_value(node, idx);
-	} else {
-	    if (error)
-		*error = heim_error_create(EINVAL,
-					   "heim_path_get() node in path "
-					   "not a container type");
-	    return NULL;
 	}
 	node = next_node;
     }
diff --git a/third_party/heimdal/lib/base/heimbase.h b/third_party/heimdal/lib/base/heimbase.h
index c0c94e2649b..3706fc8710d 100644
--- a/third_party/heimdal/lib/base/heimbase.h
+++ b/third_party/heimdal/lib/base/heimbase.h
@@ -168,12 +168,12 @@ typedef long heim_base_once_t; /* XXX arch dependant */
 #endif
 
 
-void *	heim_retain(heim_object_t);
+heim_object_t	heim_retain(heim_object_t);
 void	heim_release(heim_object_t);
 
 void	heim_show(heim_object_t);
 
-typedef void (*heim_type_dealloc)(void *);
+typedef void (HEIM_CALLCONV *heim_type_dealloc)(void *);
 
 void *
 heim_alloc(size_t size, const char *name, heim_type_dealloc dealloc);
@@ -184,7 +184,7 @@ heim_get_tid(heim_object_t object);
 int
 heim_cmp(heim_object_t a, heim_object_t b);
 
-unsigned long
+uintptr_t
 heim_get_hash(heim_object_t ptr);
 
 void
@@ -436,9 +436,10 @@ void    heim_db_iterate(heim_db_t, heim_string_t,
 
 typedef struct heim_number_data *heim_number_t;
 
-heim_number_t heim_number_create(int);
+heim_number_t heim_number_create(int64_t);
 heim_tid_t heim_number_get_type_id(void);
 int heim_number_get_int(heim_number_t);
+int64_t heim_number_get_long(heim_number_t);
 
 /*
  *
diff --git a/third_party/heimdal/lib/base/heimbasepriv.h b/third_party/heimdal/lib/base/heimbasepriv.h
index 8f8fad0fc8c..b9f63e56b6a 100644
--- a/third_party/heimdal/lib/base/heimbasepriv.h
+++ b/third_party/heimdal/lib/base/heimbasepriv.h
@@ -42,7 +42,7 @@
 typedef void (*heim_type_init)(void *);
 typedef heim_object_t (*heim_type_copy)(void *);
 typedef int (*heim_type_cmp)(void *, void *);
-typedef unsigned long (*heim_type_hash)(void *);
+typedef uintptr_t (*heim_type_hash)(void *);
 typedef heim_string_t (*heim_type_description)(void *);
 
 typedef struct heim_type_data *heim_type_t;
@@ -65,6 +65,7 @@ enum {
     HEIM_TID_DATA = 134,
     HEIM_TID_DB = 135,
     HEIM_TID_PA_AUTH_MECH = 136,
+    HEIM_TID_PAC = 137,
     HEIM_TID_USER = 255
 
 };
diff --git a/third_party/heimdal/lib/base/log.c b/third_party/heimdal/lib/base/log.c
index 904d0c3ba12..818ac8398d5 100644
--- a/third_party/heimdal/lib/base/log.c
+++ b/third_party/heimdal/lib/base/log.c
@@ -40,6 +40,7 @@
 #include <assert.h>
 #include <stdarg.h>
 #include <vis.h>
+#include <base64.h>
 
 struct heim_log_facility_internal {
     int min;
@@ -204,10 +205,13 @@ open_syslog(heim_context context,
             heim_log_facility *facility, int min, int max,
             const char *sev, const char *fac)
 {
-    struct _heimdal_syslog_data *sd = malloc(sizeof(*sd));
+    struct _heimdal_syslog_data *sd;
+    heim_error_code ret;
     int i;
 
-    if (sd == NULL)
+    if (facility == NULL)
+        return EINVAL;
+    if ((sd = calloc(1, sizeof(*sd))) == NULL)
         return heim_enomem(context);
     i = find_value(sev, syslogvals);
     if (i == -1)
@@ -218,8 +222,11 @@ open_syslog(heim_context context,
         i = LOG_AUTH;
     sd->priority |= i;
     roken_openlog(facility->program, LOG_PID | LOG_NDELAY, i);
-    return heim_addlog_func(context, facility, min, max,
-                            log_syslog, close_syslog, sd);
+    ret = heim_addlog_func(context, facility, min, max, log_syslog,
+                           close_syslog, sd);
+    if (ret)
+        free(sd);
+    return ret;
 }
 
 struct file_data {
@@ -247,7 +254,7 @@ log_file(heim_context context, const char *timestr, const char *msg, void *data)
     size_t i = 0;
     size_t j;
 
-    if (logf == NULL || (f->disp & FILEDISP_REOPEN)) {
+    if (f->filename && (logf == NULL || (f->disp & FILEDISP_REOPEN))) {
         int flags = O_WRONLY|O_APPEND;
         int fd;
 
@@ -338,9 +345,9 @@ open_file(heim_context context, heim_log_facility *fac, int min, int max,
     if (ret) {
         free(fd->filename);
         free(fd);
-    }
-    if (disp & FILEDISP_KEEPOPEN)
+    } else if (disp & FILEDISP_KEEPOPEN) {
         log_file(context, NULL, NULL, fd);
+    }
     return ret;
 }
 
@@ -384,7 +391,7 @@ heim_addlog_dest(heim_context context, heim_log_facility *f, const char *orig)
         p++;
     }
     if (strcmp(p, "STDERR") == 0) {
-        ret = open_file(context, f, min, max, NULL, NULL, stderr,
+        ret = open_file(context, f, min, max, NULL, "a", stderr,
                         FILEDISP_KEEPOPEN, 0);
     } else if (strcmp(p, "CONSOLE") == 0) {
         /* XXX WIN32 */
@@ -608,10 +615,7 @@ __attribute__ ((__format__ (__printf__, 3, 0)))
 heim_error_code
 heim_have_debug(heim_context context, int level)
 {
-    heim_log_facility *fac;
-
-    return (context != NULL &&
-        (fac = heim_get_debug_dest(context)) != NULL);
+    return (context != NULL && heim_get_debug_dest(context) != NULL);
 }
 
 heim_error_code
@@ -655,32 +659,34 @@ heim_add_debug_dest(heim_context context, const char *program,
     return 0;
 }
 
-static heim_string_t
+struct heim_audit_kv_tuple {
+    heim_string_t key;
+    heim_object_t value;
+};
+
+static struct heim_audit_kv_tuple zero_tuple;
+
+static struct heim_audit_kv_tuple
 fmtkv(int flags, const char *k, const char *fmt, va_list ap)
         __attribute__ ((__format__ (__printf__, 3, 0)))
 {
-    heim_string_t str;
     size_t i;
     ssize_t j;
-    char *buf1;
-    char *buf2;
-    char *buf3;
-    int ret = vasprintf(&buf1, fmt, ap);
-    if (ret < 0 || !buf1)
-	return NULL;;
-
-    j = asprintf(&buf2, "%s=%s", k, buf1);
-    free(buf1);
-    if (j < 0 || !buf2)
-	return NULL;;
+    struct heim_audit_kv_tuple kv;
+    char *value;
+    char *value_vis;
+
+    j = vasprintf(&value, fmt, ap);
+    if (j < 0 || value == NULL)
+	return zero_tuple;
 
     /* We optionally eat the whitespace. */
 
     if (flags & HEIM_SVC_AUDIT_EATWHITE) {
-	for (i=0, j=0; buf2[i]; i++)
-	    if (buf2[i] != ' ' && buf2[i] != '\t')
-		buf2[j++] = buf2[i];
-	buf2[j] = '\0';
+	for (i=0, j=0; value[i]; i++)
+	    if (value[i] != ' ' && value[i] != '\t')
+		value[j++] = value[i];
+	value[j] = '\0';
     }
 
     if (flags & (HEIM_SVC_AUDIT_VIS | HEIM_SVC_AUDIT_VISLAST)) {
@@ -688,48 +694,52 @@ fmtkv(int flags, const char *k, const char *fmt, va_list ap)
 
         if (flags & HEIM_SVC_AUDIT_VIS)
             vis_flags |= VIS_WHITE;
-	buf3 = malloc((j + 1) * 4 + 1);
-        if (buf3)
-            strvisx(buf3, buf2, j, vis_flags);
-	free(buf2);
-        if (buf3 == NULL)
-            return NULL;
+	value_vis = malloc((j + 1) * 4 + 1);
+        if (value_vis)
+            strvisx(value_vis, value, j, vis_flags);
+	free(value);
+        if (value_vis == NULL)
+            return zero_tuple;
     } else
-	buf3 = buf2;
+	value_vis = value;
 
-    str = heim_string_create(buf3);
-    free(buf3);
-    return str;
+    if (k)
+	kv.key = heim_string_create(k);
+    else
+	kv.key = NULL;
+    kv.value = heim_string_ref_create(value_vis, free);
+
+    return kv;
 }
 
 void
 heim_audit_vaddreason(heim_svc_req_desc r, const char *fmt, va_list ap)
 	__attribute__ ((__format__ (__printf__, 2, 0)))
 {
-    heim_string_t str;
+    struct heim_audit_kv_tuple kv;
 
-    str = fmtkv(HEIM_SVC_AUDIT_VISLAST, "reason", fmt, ap);
-    if (!str) {
+    kv = fmtkv(HEIM_SVC_AUDIT_VISLAST, NULL, fmt, ap);
+    if (kv.value == NULL) {
         heim_log(r->hcontext, r->logf, 1, "heim_audit_vaddreason: "
                  "failed to add reason (out of memory)");
         return;
     }
 
     heim_log(r->hcontext, r->logf, 7, "heim_audit_vaddreason(): "
-             "adding reason %s", heim_string_get_utf8(str));
+             "adding reason %s", heim_string_get_utf8(kv.value));
     if (r->reason) {
         heim_string_t str2;
 
         str2 = heim_string_create_with_format("%s: %s",
-                                              heim_string_get_utf8(str),
+                                              heim_string_get_utf8(kv.value),
                                               heim_string_get_utf8(r->reason));
         if (str2) {
-            heim_release(str);
-            str = str2;
+            heim_release(kv.value);
+            kv.value = str2;
         }
     }
     heim_release(r->reason);
-    r->reason = str;
+    r->reason = kv.value;
 }
 
 void
@@ -743,10 +753,37 @@ heim_audit_addreason(heim_svc_req_desc r, const char *fmt, ...)
     va_end(ap);
 }
 
+size_t
+addkv(heim_svc_req_desc r, heim_object_t key, heim_object_t value)
+{
+    size_t index;
+    heim_object_t obj;
+
+    obj = heim_dict_get_value(r->kv, key);
+    if (obj) {
+	if (heim_get_tid(obj) == HEIM_TID_ARRAY) {
+	    index = heim_array_get_length(obj);
+	    heim_array_append_value(obj, value);
+	} else {
+	    heim_array_t array = heim_array_create();
+
+	    index = 1;
+	    heim_array_append_value(array, obj);
+	    heim_array_append_value(array, value);
+	    heim_dict_set_value(r->kv, key, array);
+	    heim_release(array); /* retained by r->kv */
+	}
+    } else {
+	index = 0;
+	heim_dict_set_value(r->kv, key, value);
+    }
+
+    return index;
+}
+
 /*
- * append_token adds a token which is optionally a kv-pair and it
- * also optionally eats the whitespace.  If k == NULL, then it's
- * not a kv-pair.
+ * add a key-value token. if the key already exists, the value is
+ * promoted to an array of values.
  */
 
 void
@@ -754,19 +791,26 @@ heim_audit_vaddkv(heim_svc_req_desc r, int flags, const char *k,
 		  const char *fmt, va_list ap)
 	__attribute__ ((__format__ (__printf__, 4, 0)))
 {
-    heim_string_t str;
+    struct heim_audit_kv_tuple kv;
+    size_t index;
 
-    str = fmtkv(flags, k, fmt, ap);
-    if (!str) {
+    kv = fmtkv(flags, k, fmt, ap);
+    if (kv.key == NULL || kv.value == NULL) {
         heim_log(r->hcontext, r->logf, 1, "heim_audit_vaddkv: "
                  "failed to add kv pair (out of memory)");
+	heim_release(kv.key);
+	heim_release(kv.value);
         return;
     }
 
+    index = addkv(r, kv.key, kv.value);
+
     heim_log(r->hcontext, r->logf, 7, "heim_audit_vaddkv(): "
-             "adding kv pair %s", heim_string_get_utf8(str));
-    heim_array_append_value(r->kv, str);
-    heim_release(str);
+             "kv pair[%zu] %s=%s", index,
+	     heim_string_get_utf8(kv.key), heim_string_get_utf8(kv.value));
+
+    heim_release(kv.key);
+    heim_release(kv.value);
 }
 
 void
@@ -809,18 +853,196 @@ heim_audit_addkv_timediff(heim_svc_req_desc r, const char *k,
 }
 
 void
+heim_audit_setkv_bool(heim_svc_req_desc r, const char *k, int v)
+{
+    heim_string_t key = heim_string_create(k);
+    heim_number_t value;
+
+    if (key == NULL)
+	return;
+
+    heim_log(r->hcontext, r->logf, 7, "heim_audit_setkv_bool(): "
+	     "setting kv pair %s=%s", k, v ? "true" : "false");
+
+    value = heim_bool_create(v);
+    heim_dict_set_value(r->kv, key, value);
+    heim_release(key);
+    heim_release(value);
+}
+
+void
+heim_audit_addkv_number(heim_svc_req_desc r, const char *k, int64_t v)
+{
+    heim_string_t key = heim_string_create(k);
+    heim_number_t value;
+
+    if (key == NULL)
+	return;
+
+    heim_log(r->hcontext, r->logf, 7, "heim_audit_addkv_number(): "
+	     "adding kv pair %s=%lld", k, (long long)v);
+
+    value = heim_number_create(v);
+    addkv(r, key, value);
+    heim_release(key);
+    heim_release(value);
+}
+
+void
+heim_audit_setkv_number(heim_svc_req_desc r, const char *k, int64_t v)
+{
+    heim_string_t key = heim_string_create(k);
+    heim_number_t value;
+
+    if (key == NULL)
+	return;
+
+    heim_log(r->hcontext, r->logf, 7, "heim_audit_setkv_number(): "
+	     "setting kv pair %s=%lld", k, (long long)v);
+
+    value = heim_number_create(v);
+    heim_dict_set_value(r->kv, key, value);
+    heim_release(key);
+    heim_release(value);
+}
+
+void
+heim_audit_addkv_object(heim_svc_req_desc r, const char *k, heim_object_t value)
+{
+    heim_string_t key = heim_string_create(k);
+    heim_string_t descr;
+
+    if (key == NULL)
+	return;
+
+    descr = heim_json_copy_serialize(value, HEIM_JSON_F_NO_DATA_DICT, NULL);
+    heim_log(r->hcontext, r->logf, 7, "heim_audit_addkv_object(): "
+	     "adding kv pair %s=%s",
+	     k, descr ? heim_string_get_utf8(descr) : "<unprintable>");
+    addkv(r, key, value);
+    heim_release(key);
+    heim_release(descr);
+}
+
+void
+heim_audit_setkv_object(heim_svc_req_desc r, const char *k, heim_object_t value)
+{
+    heim_string_t key = heim_string_create(k);
+    heim_string_t descr;
+
+    if (key == NULL)
+	return;
+
+    descr = heim_json_copy_serialize(value, HEIM_JSON_F_NO_DATA_DICT, NULL);
+    heim_log(r->hcontext, r->logf, 7, "heim_audit_setkv_object(): "
+	     "setting kv pair %s=%s",
+	     k, descr ? heim_string_get_utf8(descr) : "<unprintable>");
+    heim_dict_set_value(r->kv, key, value);
+    heim_release(key);
+    heim_release(descr);
+}
+
+heim_object_t
+heim_audit_getkv(heim_svc_req_desc r, const char *k)
+{
+    heim_string_t key;
+    heim_object_t value;
+
+    key = heim_string_create(k);
+    if (key == NULL)
+	return NULL;
+
+    value = heim_dict_get_value(r->kv, key);
+    heim_release(key);
+    return value;
+}
+
+struct heim_audit_kv_buf {
+    char buf[1024];
+    size_t pos;
+    heim_object_t iter;
+};
+
+static void
+audit_trail_iterator(heim_object_t key, heim_object_t value, void *arg);
+
+static void
+audit_trail_iterator_array(heim_object_t value, void *arg, int *stop)
+{
+    struct heim_audit_kv_buf *kvb = arg;
+
+    audit_trail_iterator(kvb->iter, value, kvb);
+}
+
+static void
+audit_trail_iterator(heim_object_t key, heim_object_t value, void *arg)
+{
+    struct heim_audit_kv_buf *kvb = arg;
+    char num[32];
+    const char *k = heim_string_get_utf8(key), *v = NULL;
+    char *b64 = NULL;
+
+    if (k == NULL || *k == '#') /* # keys are hidden */
+	return;
+
+    switch (heim_get_tid(value)) {
+    case HEIM_TID_STRING:
+	v = heim_string_get_utf8(value);
+	break;
+    case HEIM_TID_NUMBER:
+	snprintf(num, sizeof(num), "%lld", (long long)heim_number_get_long(value));
+	v = num;
+	break;
+    case HEIM_TID_NULL:
+	v = "null";
+	break;
+    case HEIM_TID_BOOL:
+	v = heim_bool_val(value) ? "true" : "false";
+	break;
+    case HEIM_TID_ARRAY:
+	if (kvb->iter)
+	    break; /* arrays cannot be nested */
+
+	kvb->iter = key;
+	heim_array_iterate_f(value, kvb, audit_trail_iterator_array);
+	kvb->iter = NULL;
+	break;
+    case HEIM_TID_DATA: {
+	const heim_octet_string *data = heim_data_get_data(value);
+	if (rk_base64_encode(data->data, data->length, &b64) >= 0)
+	    v = b64;
+	break;
+    }
+    default:
+	break;
+    }
+
+    if (v == NULL)
+	return;
+
+    if (kvb->pos < sizeof(kvb->buf) - 1)
+	kvb->buf[kvb->pos++] = ' ';
+    for (; *k && kvb->pos < sizeof(kvb->buf) - 1; kvb->pos++)
+	kvb->buf[kvb->pos] = *k++;
+    if (kvb->pos < sizeof(kvb->buf) - 1)
+	kvb->buf[kvb->pos++] = '=';
+    for (; *v && kvb->pos < sizeof(kvb->buf) - 1; kvb->pos++)
+	kvb->buf[kvb->pos] = *v++;
+
+    free(b64);
+}
+
+void
 heim_audit_trail(heim_svc_req_desc r, heim_error_code ret, const char *retname)
 {
     const char *retval;
-    char kvbuf[1024];
+    struct heim_audit_kv_buf kvb;
     char retvalbuf[30]; /* Enough for UNKNOWN-%d */
-    size_t nelem;
-    size_t i, j;
 
 #define CASE(x)	case x : retval = #x; break
     if (retname) {
         retval = retname;
-    } else switch (ret ? ret : r->ret) {
+    } else switch (ret ? ret : r->error_code) {
     CASE(ENOMEM);
     CASE(ENOENT);
     CASE(EACCES);
@@ -838,26 +1060,15 @@ heim_audit_trail(heim_svc_req_desc r, heim_error_code ret, const char *retname)
     if (r->e_text && r->kv)
 	heim_audit_addkv(r, HEIM_SVC_AUDIT_VIS, "e-text", "%s", r->e_text);
 
-    nelem = r->kv ? heim_array_get_length(r->kv) : 0;
-    for (i=0, j=0; i < nelem; i++) {
-	heim_string_t s;
-	const char *kvpair;
-
-        /* We know these are strings... */
-	s = heim_array_get_value(r->kv, i);
-	kvpair = heim_string_get_utf8(s);
-
-	if (j < sizeof(kvbuf) - 1)
-	    kvbuf[j++] = ' ';
-	for (; *kvpair && j < sizeof(kvbuf) - 1; j++)
-	    kvbuf[j] = *kvpair++;
-    }
-    kvbuf[j] = '\0';
+    memset(&kvb, 0, sizeof(kvb));
+    if (r->kv)
+        heim_dict_iterate_f(r->kv, &kvb, audit_trail_iterator);
+    kvb.buf[kvb.pos] = '\0';
 
     heim_log(r->hcontext, r->logf, 3, "%s %s %s %s %s%s%s%s",
              r->reqtype, retval, r->from,
              r->cname ? r->cname : "<unknown>",
              r->sname ? r->sname : "<unknown>",
-             kvbuf, r->reason ? " " : "",
+             kvb.buf, r->reason ? " reason=" : "",
              r->reason ? heim_string_get_utf8(r->reason) : "");
 }
diff --git a/third_party/heimdal/lib/base/number.c b/third_party/heimdal/lib/base/number.c
index c259f69971d..8833c8b1523 100644
--- a/third_party/heimdal/lib/base/number.c
+++ b/third_party/heimdal/lib/base/number.c
@@ -35,7 +35,7 @@
 
 #include "baselocl.h"
 
-static void
+static void HEIM_CALLCONV
 number_dealloc(void *ptr)
 {
 }
@@ -58,12 +58,12 @@ number_cmp(void *a, void *b)
     return na - nb;
 }
 
-static unsigned long
+static uintptr_t
 number_hash(void *ptr)
 {
     if (heim_base_is_tagged_object(ptr))
 	return heim_base_tagged_object_value(ptr);
-    return (unsigned long)*(int *)ptr;
+    return (uintptr_t)*(int64_t *)ptr;
 }
 
 struct heim_type_data _heim_number_object = {
@@ -86,16 +86,16 @@ struct heim_type_data _heim_number_object = {
  */
 
 heim_number_t
-heim_number_create(int number)
+heim_number_create(int64_t number)
 {
     heim_number_t n;
 
     if (number < 0xffffff && number >= 0)
 	return heim_base_make_tagged_object(number, HEIM_TID_NUMBER);
 
-    n = _heim_alloc_object(&_heim_number_object, sizeof(int));
+    n = _heim_alloc_object(&_heim_number_object, sizeof(int64_t));
     if (n)
-	*((int *)n) = number;
+	*((int64_t *)n) = number;
     return n;
 }
 
@@ -124,5 +124,13 @@ heim_number_get_int(heim_number_t number)
 {
     if (heim_base_is_tagged_object(number))
 	return heim_base_tagged_object_value(number);
-    return *(int *)number;
+    return (int)(*(int64_t *)number);
+}
+
+int64_t
+heim_number_get_long(heim_number_t number)
+{
+    if (heim_base_is_tagged_object(number))
+	return heim_base_tagged_object_value(number);
+    return *(int64_t *)number;
 }
diff --git a/third_party/heimdal/lib/base/plugin.c b/third_party/heimdal/lib/base/plugin.c
index df225a939c2..631a3386c83 100644
--- a/third_party/heimdal/lib/base/plugin.c
+++ b/third_party/heimdal/lib/base/plugin.c
@@ -112,7 +112,7 @@ struct heim_dso {
     void *dsohandle;
 };
 
-static void
+static void HEIM_CALLCONV
 dso_dealloc(void *ptr)
 {
     struct heim_dso *p = ptr;
@@ -156,7 +156,7 @@ struct heim_plugin {
     void *ctx;
 };
 
-static void
+static void HEIM_CALLCONV
 plugin_free(void *ptr)
 {
     struct heim_plugin *pl = ptr;
@@ -590,34 +590,37 @@ add_dso_plugins_load_fn(heim_context context,
     heim_error_code ret;
     heim_array_t plugins;
     heim_plugin_load_t load_fn;
-    char *sym;
+    char *sym = NULL;
     size_t i;
     heim_get_instance_func_t get_instance;
     size_t n_ftables;
     heim_plugin_common_ftable_cp *ftables;
 
-    if (asprintf(&sym, "%s_plugin_load", caller->name) == -1)
+    if (asprintf(&sym, "%s_plugin_load", caller->name) == -1 || sym == NULL)
         return NULL;
 
     /* suppress error here because we may be looking for a different plugin type */
     load_fn = (heim_plugin_load_t)dlsym(dsohandle, sym);
-    free(sym);
     if (load_fn == NULL) {
         heim_debug(context, 15, "Symbol %s not found in %s", sym, dsopath);
+        free(sym);
         return NULL;
     }
 
     ret = load_fn(pcontext, &get_instance, &n_ftables, &ftables);
     if (ret) {
         heim_warn(context, ret, "plugin %s failed to load", dsopath);
+        free(sym);
 
         /* fallback to loading structure directly */
         return add_dso_plugin_struct(context, pcontext, dsopath,
                                      dsohandle, caller->name);
     }
 
-    if (!validate_plugin_deps(context, caller, dsopath, get_instance))
+    if (!validate_plugin_deps(context, caller, dsopath, get_instance)) {
+        free(sym);
         return NULL;
+    }
 
     plugins = heim_array_create();
 
@@ -639,6 +642,7 @@ add_dso_plugins_load_fn(heim_context context,
     }
 
     heim_debug(context, 15, "DSO %s loaded (%s)", dsopath, sym);
+    free(sym);
     return plugins;
 }
 #endif /* HAVE_DLOPEN */
diff --git a/third_party/heimdal/lib/base/string.c b/third_party/heimdal/lib/base/string.c
index 5384998080a..f942447163d 100644
--- a/third_party/heimdal/lib/base/string.c
+++ b/third_party/heimdal/lib/base/string.c
@@ -36,7 +36,7 @@
 #include "baselocl.h"
 #include <string.h>
 
-static void
+static void HEIM_CALLCONV
 string_dealloc(void *ptr)
 {
     heim_string_t s = ptr;
@@ -73,11 +73,11 @@ string_cmp(void *a, void *b)
     return strcmp(a, b);
 }
 
-static unsigned long
+static uintptr_t
 string_hash(void *ptr)
 {
     const char *s = ptr;
-    unsigned long n;
+    uintptr_t n;
 
     for (n = 0; *s; ++s)
 	n += *s;
diff --git a/third_party/heimdal/lib/base/test_base.c b/third_party/heimdal/lib/base/test_base.c
index fba675cf488..be6c860e26b 100644
--- a/third_party/heimdal/lib/base/test_base.c
+++ b/third_party/heimdal/lib/base/test_base.c
@@ -64,7 +64,7 @@
 
 #include "baselocl.h"
 
-static void
+static void HEIM_CALLCONV
 memory_free(heim_object_t obj)
 {
 }
@@ -238,8 +238,8 @@ test_json(void)
 	"{ \"k1\" : \"s1\", \"k2\" : \"s2\" }",
 	"{ \"k1\" : [\"s1\", \"s2\", \"s3\"], \"k2\" : \"s3\" }",
 	"{ \"k1\" : {\"k2\":\"s1\",\"k3\":\"s2\",\"k4\":\"s3\"}, \"k5\" : \"s4\" }",
-	"[ \"v1\", \"v2\", [\"v3\",\"v4\",[\"v 5\",\" v 7 \"]], -123456789, "
-	    "null, true, false, 123456789, \"\"]",
+	("[ \"v1\", \"v2\", [\"v3\",\"v4\",[\"v 5\",\" v 7 \"]], -123456789, "
+	    "null, true, false, 123456789, \"\"]"),
 	" -1"
     };
     char *s;
diff --git a/third_party/heimdal/lib/base/version-script.map b/third_party/heimdal/lib/base/version-script.map
index 0cd0c8444cb..928e8619995 100644
--- a/third_party/heimdal/lib/base/version-script.map
+++ b/third_party/heimdal/lib/base/version-script.map
@@ -29,8 +29,14 @@ HEIMDAL_BASE_1.0 {
 		heim_array_iterate_reverse_f;
 		heim_array_set_value;
 		heim_audit_addkv;
+		heim_audit_addkv_number;
+		heim_audit_addkv_object;
 		heim_audit_addkv_timediff;
+		heim_audit_setkv_bool;
+		heim_audit_setkv_number;
+		heim_audit_setkv_object;
 		heim_audit_addreason;
+		heim_audit_getkv;
 		heim_audit_trail;
 		heim_audit_vaddkv;
 		heim_audit_vaddreason;
@@ -147,6 +153,7 @@ HEIMDAL_BASE_1.0 {
 		heim_null_create;
 		heim_number_create;
 		heim_number_get_int;
+		heim_number_get_long;
 		heim_number_get_type_id;
 		heim_openlog;
 		heim_path_copy;