configure.in (LOGINLIBS): Remove DECLARE_SYS_ERRLIST since it's no

	longer necessary.

krcp.c (verifydir, allocbuf, rsource, source, sink): Don't use
	sys_errlist[]; just call error_message() instead, since we depend on
	com_err anyway.

krshd.c (recvauth):
krlogind.c (recvauth): Don't actually check the checksum unless it is
	required.  Old (pre-beta 5) clients sent a checksum of random garbage
	(such as their pid) which is impossible to actually check on the
	server side.  (Grad student stupidity strikes again.)

	(fatalperror): Don't use sys_errlist[] to get the right error
	message; just depend on com_err instead, since we're using it anyway.

krshd.c (doit):
krlogind.c (do_krb_login): Fix logic so that if checksums are
	required, and the checksum is valid, don't syslog the stupid warning
	message about "Checksums are only required for v5 clients...."

krcp.c, krshd.c, krlogind.c: Miscellaneous -Wall cleanups

krlogind.c (getpty): Removed dead code.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@7823 dc483132-0cff-0310-8789-dd5450dbe970

5 files changed, 236 insertions, 299 deletions

diff --git a/src/appl/bsd/ChangeLog b/src/appl/bsd/ChangeLog
index d4be755276..ab342cd47e 100644
--- a/src/appl/bsd/ChangeLog
+++ b/src/appl/bsd/ChangeLog
@@ -1,6 +1,36 @@
+Wed Apr 17 13:46:57 1996  Theodore Y. Ts'o  <tytso@mit.edu>
+
+	* configure.in (LOGINLIBS): Remove DECLARE_SYS_ERRLIST since it's
+		no longer necessary.
+
+	* krcp.c (verifydir, allocbuf, rsource, source, sink): Don't use
+ 		sys_errlist[]; just call error_message() instead, since we
+ 		depend on com_err anyway.
+
+	* krshd.c (recvauth): 
+	* krlogind.c (recvauth): Don't actually check the checksum unless
+ 		it is required.  Old (pre-beta 5) clients sent a checksum
+ 		of random garbage (such as their pid) which is impossible to
+ 		actually check on the server side.  (Grad student stupidity
+		strikes again.)
+		(fatalperror): Don't use sys_errlist[] to get the right
+		error message; just depend on com_err instead, since we're
+		using it anyway.
+
+	* krshd.c (doit): 
+	* krlogind.c (do_krb_login): Fix logic so that if checksums are
+	 	required, and the checksum is valid, don't syslog the
+	 	stupid warning message about "Checksums are only required
+	 	for v5 clients...."
+  	
+	* krcp.c, krshd.c, krlogind.c: Miscellaneous -Wall cleanups
+
+	* krlogind.c (getpty): Removed dead code.
+
 Tue Apr 16 11:33:33 1996  Sam Hartman  <hartmans@mit.edu>
 
-	* krlogind.c kshd.c (main): Drop support for handling  options in rlogind's name.
+	* krlogind.c kshd.c (main): Drop support for handling options in
+	 	rlogind's name.
 
 Sun Apr 14 03:41:49 1996  Sam Hartman  <hartmans@zygorthian-space-raiders.MIT.EDU>
 
diff --git a/src/appl/bsd/configure.in b/src/appl/bsd/configure.in
index 6f53a8d129..1792fa404e 100644
--- a/src/appl/bsd/configure.in
+++ b/src/appl/bsd/configure.in
@@ -58,7 +58,6 @@ AC_CHECK_HEADERS(sys/label.h sys/tty.h ttyent.h lastlog.h sys/select.h )
 AC_CHECK_HEADERS(sys/ptyvar.h utmp.h utmpx.h sys/time.h)
 AC_HEADER_STDARG
 AC_REPLACE_FUNCS(getdtablesize)
-DECLARE_SYS_ERRLIST
 KRB5_SIGTYPE
 CHECK_SIGNALS
 CHECK_SETJMP
diff --git a/src/appl/bsd/krcp.c b/src/appl/bsd/krcp.c
index be7f072a26..32a6eb1a86 100644
--- a/src/appl/bsd/krcp.c
+++ b/src/appl/bsd/krcp.c
@@ -31,6 +31,9 @@ char copyright[] =
       * rcp
       */
 
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
 #ifdef HAVE_STDLIB_H
 #include <stdlib.h>
 #endif
@@ -97,7 +100,8 @@ char	**save_argv();
 char	*strsave();
 #endif
 int	des_write(), des_read();
-void answer_auth();
+void 	usage(), sink(), source(), rsource(), verifydir(), answer_auth();
+int	response(), hosteq(), okname(), susystem();
 int	encryptflag = 0;
 
 #ifndef UCB_RCP
@@ -113,9 +117,6 @@ int	rem;
 char	*colon();
 int	errs;
 krb5_sigtype	lostconn();
-#ifdef NEED_SYS_ERRLIST
-extern char	*sys_errlist[];
-#endif
 int	iamremote, targetshouldbedirectory;
 int	iamrecursive;
 int	pflag;
@@ -132,16 +133,15 @@ struct buffer {
 #define	NULLBUF	(struct buffer *) 0
   
 #ifdef HAVE_STDARG_H
-int 	error KRB5_STDARG_P((char *fmt, ...));
+void 	error KRB5_STDARG_P((char *fmt, ...));
 #else
 /*VARARGS*/
-int	error KRB5_STDARG_P((char *, va_list));
+void	error KRB5_STDARG_P((char *, va_list));
 #endif
 
 #define	ga()	 	(void) des_write(rem, "", 1)
 
-
-main(argc, argv)
+int main(argc, argv)
      int argc;
      char **argv;
 {
@@ -437,8 +437,7 @@ krb5_creds *cred;
 			session_key = &cred->keyblock;
 				   
     krb5_use_enctype(bsd_context, &eblock, session_key->enctype);
-    if ( status = krb5_process_key(bsd_context, &eblock, 
-				   session_key)){
+    if ((status = krb5_process_key(bsd_context, &eblock, session_key))) {
 	fprintf(stderr, "rcp: send_auth failed krb5_process_key: %s\n",
 		error_message(status));
 	exit(1);
@@ -534,8 +533,7 @@ krb5_creds *cred;
 			session_key = &cred->keyblock;
 				   
     krb5_use_enctype(bsd_context, &eblock, session_key->enctype);
-    if ( status = krb5_process_key(bsd_context, &eblock, 
-				   session_key)){
+    if ((status = krb5_process_key(bsd_context, &eblock, session_key))) {
 	fprintf(stderr, "rcp: send_auth failed krb5_process_key: %s\n",
 		error_message(status));
 	exit(1);
@@ -593,7 +591,7 @@ krb5_creds *cred;
 
 
 
-verifydir(cp)
+void verifydir(cp)
      char *cp;
 {
     struct stat stb;
@@ -603,7 +601,7 @@ verifydir(cp)
 	  return;
 	errno = ENOTDIR;
     }
-    error("rcp: %s: %s.\n", cp, sys_errlist[errno]);
+    error("rcp: %s: %s.\n", cp, error_message(errno));
     exit(1);
 }
 
@@ -625,7 +623,7 @@ char *colon(cp)
 
 
 
-okname(cp0)
+int okname(cp0)
      char *cp0;
 {
     register char *cp = cp0;
@@ -647,7 +645,7 @@ okname(cp0)
 
 
 
-susystem(s)
+int susystem(s)
      char *s;
 {
     int status;
@@ -693,9 +691,7 @@ susystem(s)
     return (status);
 }
 
-
-
-source(argc, argv)
+void source(argc, argv)
      int argc;
      char **argv;
 {
@@ -710,7 +706,7 @@ source(argc, argv)
     for (x = 0; x < argc; x++) {
 	name = argv[x];
 	if ((f = open(name, 0)) < 0) {
-	    error("rcp: %s: %s\n", name, sys_errlist[errno]);
+	    error("rcp: %s: %s\n", name, error_message(errno));
 	    continue;
 	}
 	if (fstat(f, &stb) < 0)
@@ -775,7 +771,7 @@ source(argc, argv)
 	if (readerr == 0)
 	  ga();
 	else
-	  error("rcp: %s: %s\n", name, sys_errlist[readerr]);
+	  error("rcp: %s: %s\n", name, error_message(readerr));
 	(void) response();
     }
 }
@@ -788,7 +784,7 @@ source(argc, argv)
 #include <dirent.h>
 #endif
 
-rsource(name, statp)
+void rsource(name, statp)
      char *name;
      struct stat *statp;
 {
@@ -803,7 +799,7 @@ rsource(name, statp)
     char *bufv[1];
     
     if (d == 0) {
-	error("rcp: %s: %s\n", name, sys_errlist[errno]);
+	error("rcp: %s: %s\n", name, error_message(errno));
 	return;
     }
     last = strrchr(name, '/');
@@ -846,7 +842,7 @@ rsource(name, statp)
 
 
 
-response()
+int response()
 {
     char resp, c, rbuf[RCP_BUFSIZ], *cp = rbuf;
     if (des_read(rem, &resp, 1) != 1)
@@ -897,7 +893,7 @@ krb5_sigtype
  * set the microsecond values; we don't want to take away
  * functionality unnecessarily.
  */
-utimes(file, tvp)
+int utimes(file, tvp)
 const char *file;
 struct timeval *tvp;
 {
@@ -910,7 +906,7 @@ struct timeval *tvp;
 #endif
 
 
-sink(argc, argv)
+void sink(argc, argv)
      int argc;
      char **argv;
 {
@@ -1038,13 +1034,13 @@ sink(argc, argv)
 		setimes = 0;
 		if (utimes(nambuf, tv) < 0)
 		  error("rcp: can't set times on %s: %s\n",
-			nambuf, sys_errlist[errno]);
+			nambuf, error_message(errno));
 	    }
 	    continue;
 	}
 	if ((of = open(nambuf, O_WRONLY|O_CREAT, mode)) < 0) {
 	  bad:
-	    error("rcp: %s: %s\n", nambuf, sys_errlist[errno]);
+	    error("rcp: %s: %s\n", nambuf, error_message(errno));
 	    continue;
 	}
 	if (exists && pflag) {
@@ -1073,8 +1069,7 @@ sink(argc, argv)
 		    if (j == 0)
 		      error("rcp: dropped connection");
 		    else
-		      error("rcp: %s\n",
-			    sys_errlist[errno]);
+		      error("rcp: %s\n", error_message(errno));
 		    exit(1);
 		}
 		amt -= j;
@@ -1092,18 +1087,17 @@ sink(argc, argv)
 	    write(of, bp->buf, count) != count)
 	  wrerr++;
 	if (ftruncate(of, size))
-	  error("rcp: can't truncate %s: %s\n",
-		nambuf, sys_errlist[errno]);
+	  error("rcp: can't truncate %s: %s\n", nambuf, error_message(errno));
 	(void) close(of);
 	(void) response();
 	if (setimes) {
 	    setimes = 0;
 	    if (utimes(nambuf, tv) < 0)
 	      error("rcp: can't set times on %s: %s\n",
-		    nambuf, sys_errlist[errno]);
+		    nambuf, error_message(errno));
 	}				   
 	if (wrerr)
-	  error("rcp: %s: %s\n", nambuf, sys_errlist[errno]);
+	  error("rcp: %s: %s\n", nambuf, error_message(errno));
 	else
 	  ga();
     }
@@ -1122,7 +1116,7 @@ struct buffer *allocbuf(bp, fd, blksize)
     int size;
     
     if (fstat(fd, &stb) < 0) {
-	error("rcp: fstat: %s\n", sys_errlist[errno]);
+	error("rcp: fstat: %s\n", error_message(errno));
 	return (NULLBUF);
     }
 #ifdef NOROUNDUP
@@ -1147,7 +1141,7 @@ struct buffer *allocbuf(bp, fd, blksize)
 
 
 
-int
+void
 #ifdef HAVE_STDARG_H
 error(char *fmt, ...)
 #else
@@ -1178,7 +1172,7 @@ error(fmt, va_alist)
 
 
 
-usage()
+void usage()
 {
 #ifdef KERBEROS
     fprintf(stderr,
@@ -1191,7 +1185,7 @@ usage()
 
 
 
-hosteq(h1, h2)
+int hosteq(h1, h2)
      char *h1, *h2;
 {
     struct hostent *h_ptr;
@@ -1278,45 +1272,47 @@ void
     	const char * filenames[2];
     	filenames[1] = NULL;
     	filenames[0] = config_file;
-    	if (status = krb5_set_config_files(bsd_context, filenames))
+    	if ((status = krb5_set_config_files(bsd_context, filenames)))
 	    exit(1);
     }
     
     memset ((char*)&creds, 0, sizeof(creds));
 
-    if (status = krb5_read_message(bsd_context, (krb5_pointer)&rem,
-				   &pname_data)) 
+    if ((status = krb5_read_message(bsd_context, (krb5_pointer)&rem,
+				    &pname_data)))
 	exit(1);
     
-    if (status = krb5_read_message(bsd_context, (krb5_pointer) &rem,
-				   &creds.second_ticket)) 
+    if ((status = krb5_read_message(bsd_context, (krb5_pointer) &rem,
+				    &creds.second_ticket)))
 	exit(1);
     
     if (ccache_file == NULL) {
-    	if (status = krb5_cc_default(bsd_context, &cc))
+    	if ((status = krb5_cc_default(bsd_context, &cc)))
 	    exit(1);
     } else {
-	if (status = krb5_cc_resolve(bsd_context, ccache_file, &cc))
+	if ((status = krb5_cc_resolve(bsd_context, ccache_file, &cc)))
 	    exit(1);
     }
 
-    if (status = krb5_cc_get_principal(bsd_context, cc, &creds.client)) 
+    if ((status = krb5_cc_get_principal(bsd_context, cc, &creds.client)))
 	exit(1);
 
-    if (status = krb5_parse_name(bsd_context, pname_data.data, &creds.server)) 
+    if ((status = krb5_parse_name(bsd_context, pname_data.data,
+				  &creds.server)) )
 	exit(1);
 
     krb5_xfree(pname_data.data);
-    if (status = krb5_get_credentials(bsd_context, KRB5_GC_USER_USER, cc, 
-				      &creds, &new_creds))
+    if ((status = krb5_get_credentials(bsd_context, KRB5_GC_USER_USER, cc, 
+				       &creds, &new_creds)))
 	exit(1);
 
-    if (status = krb5_mk_req_extended(bsd_context, &auth_context,
-			  	      AP_OPTS_USE_SESSION_KEY,
-				      NULL, new_creds, &msg))
+    if ((status = krb5_mk_req_extended(bsd_context, &auth_context,
+				       AP_OPTS_USE_SESSION_KEY,
+				       NULL, new_creds, &msg)))
 	exit(1);
     
-    if (status = krb5_write_message(bsd_context, (krb5_pointer) &rem, &msg)) {
+    if ((status = krb5_write_message(bsd_context, (krb5_pointer) &rem,
+				     &msg))) {
     	krb5_xfree(msg.data);
 	exit(1);
     }
@@ -1331,7 +1327,7 @@ void
     
     /* OK process key */
     krb5_use_enctype(bsd_context, &eblock, session_key->enctype);
-    if (status = krb5_process_key(bsd_context, &eblock, session_key)) 
+    if ((status = krb5_process_key(bsd_context, &eblock, session_key)))
 	exit(1);
 
     return;
@@ -1436,7 +1432,7 @@ int des_write(fd, buf, len)
       return(krb5_net_write(bsd_context, fd, buf, len));
     
     desoutbuf.length = krb5_encrypt_size(len,eblock.crypto_entry);
-    if (desoutbuf.length > sizeof(des_outbuf)){
+    if (desoutbuf.length > (int) sizeof(des_outbuf)){
 	return(-1);
     }
     if (( krb5_encrypt(bsd_context, (krb5_pointer)buf,
diff --git a/src/appl/bsd/krlogind.c b/src/appl/bsd/krlogind.c
index f57aaa0c4b..2b7b0b99cc 100644
--- a/src/appl/bsd/krlogind.c
+++ b/src/appl/bsd/krlogind.c
@@ -287,9 +287,11 @@ static	int Pfd;
 #define VHANG_LAST		/* vhangup must occur on close, not open */
 #endif
 
-void	fatal(), fatalperror(), doit(), usage(), do_krb_login();
+void	fatal(), fatalperror(), doit(), usage(), do_krb_login(), getstr();
+void	protocol();
 int	princ_maps_to_lname(), default_realm();
 krb5_sigtype	cleanup();
+krb5_error_code recvauth();
 
 /* There are two authentication related masks:
    * auth_ok and auth_sent.
@@ -306,7 +308,7 @@ int auth_ok = 0, auth_sent = 0;
 int do_encrypt = 0, passwd_if_fail = 0, passwd_req = 0;
 int checksum_required = 0;
 
-main(argc, argv)
+int main(argc, argv)
      int argc;
      char **argv;
 {
@@ -318,7 +320,6 @@ main(argc, argv)
     int debug_port = 0;
     int fd;
 #ifdef KERBEROS
-int valid_checksum;
     krb5_error_code status;
 #endif
     
@@ -378,7 +379,7 @@ pty_init();
 	  break;
 #endif
 	case 'S':
-	  if (status = krb5_kt_resolve(bsd_context, optarg, &keytab)) {
+	  if ((status = krb5_kt_resolve(bsd_context, optarg, &keytab))) {
 		  com_err(progname, status, "while resolving srvtab file %s",
 			  optarg);
 		  exit(2);
@@ -468,6 +469,7 @@ pty_init();
     }
     
     doit(fd, &from);
+    return 0;
 }
 
 
@@ -491,7 +493,7 @@ void doit(f, fromp)
      int f;
      struct sockaddr_in *fromp;
 {
-    int i, p, t, vfd, on = 1;
+    int p, t, on = 1;
     register struct hostent *hp;
     char c;
     char buferror[255];
@@ -568,7 +570,7 @@ int syncpipe[2];
 #endif
     
     write(f, "", 1);
-    if (retval = pty_getpty(&p,line, sizeof(line))) {
+    if ((retval = pty_getpty(&p,line, sizeof(line)))) {
 	com_err(progname, retval, "while getting master pty");
 	exit(2);
     }
@@ -578,10 +580,6 @@ int syncpipe[2];
     (void) ioctl(p, TIOCSWINSZ, &win);
 #endif
     
-
-
-
-
 #ifdef POSIX_SIGNALS
     sa.sa_handler = cleanup;
     (void) sigaction(SIGCHLD, &sa, (struct sigaction *)0);
@@ -599,7 +597,7 @@ int syncpipe[2];
 #else
 	struct sgttyb b;
 #endif /* POSIX_TERMIOS */
-	if ( retval = pty_open_slave(line, &t)) {
+	if ((retval = pty_open_slave(line, &t))) {
 	    fatal(f, error_message(retval));
 	    exit(1);
 	}
@@ -639,7 +637,6 @@ int syncpipe[2];
 	dup2(t, 0), dup2(t, 1), dup2(t, 2);
 	if (t > 2)
 	  close(t);
-
 	
 #if defined(sysvimp)
 	setcompat (COMPAT_CLRPGROUP | (getcompat() & ~COMPAT_BSDTTY));
@@ -763,7 +760,7 @@ int syncpipe[2];
     (void) write(p, lusername, strlen(lusername) +1);
 #endif
     /* stuff term info down to login */
-    if( write(p, term, strlen(term)+1) != strlen(term)+1 ){
+    if ((write(p, term, strlen(term)+1) != (int) strlen(term)+1)) {
 	/*
 	 * Problems write failed ...
 	 */
@@ -790,7 +787,7 @@ char    oobdata[] = {0};
  * in the data stream.  For now, we are only willing to handle
  * window size changes.
  */
-control(pty, cp, n)
+int control(pty, cp, n)
      int pty;
      unsigned char *cp;
      int n;
@@ -798,7 +795,7 @@ control(pty, cp, n)
     struct winsize w;
     int pgrp;
     
-    if (n < 4+sizeof (w) || cp[2] != 's' || cp[3] != 's')
+    if (n < (int) 4+sizeof (w) || cp[2] != 's' || cp[3] != 's')
       return (0);
 #ifdef TIOCSWINSZ
     oobdata[0] &= ~TIOCPKT_WINDOW;	/* we know he heard */
@@ -819,7 +816,7 @@ control(pty, cp, n)
 /*
  * rlogin "protocol" machine.
  */
-protocol(f, p)
+void protocol(f, p)
      int f, p;
 {
     unsigned char pibuf[1024], fibuf[1024], *pbp, *fbp;
@@ -1008,14 +1005,8 @@ void fatalperror(f, msg)
      char *msg;
 {
     char buf[512];
-#ifdef NEED_SYS_ERRLIST
-    extern int sys_nerr;
-    extern char *sys_errlist[];
-#endif    
-    if ((unsigned)errno < sys_nerr)
-      (void) sprintf(buf, "%s: %s", msg, sys_errlist[errno]);
-    else
-      (void) sprintf(buf, "%s: Error %d", msg, errno);
+    
+    (void) sprintf(buf, "%s: %s", msg, error_message(errno));
     fatal(f, buf);
 }
 
@@ -1028,9 +1019,7 @@ do_krb_login(host)
     krb5_error_code status;
     struct passwd *pwd;
     char *msg_fail = NULL;
-int valid_checksum;
-
-
+    int valid_checksum;
 
     if (getuid()) {
 	exit(1);
@@ -1038,7 +1027,7 @@ int valid_checksum;
 
     /* Check authentication. This can be either Kerberos V5, */
     /* Kerberos V4, or host-based. */
-    if (status = recvauth(&valid_checksum)) {
+    if ((status = recvauth(&valid_checksum))) {
 	if (ticket)
 	  krb5_free_ticket(bsd_context, ticket);
 	if (status != 255)
@@ -1087,13 +1076,12 @@ int valid_checksum;
 	}
     }
 
-    if (checksum_required) {
-	if ((auth_sent&AUTH_KRB5)&&(!valid_checksum)) {
+    if (checksum_required && !valid_checksum) {
+	if (auth_sent & AUTH_KRB5) {
 	    syslog(LOG_WARNING, "Client did not supply required checksum.");
 	
 	    fatal(netf, "You are using an old Kerberos5 without initial connection support; only newer clients are authorized.");
-	}
-	else {
+	} else {
 	    syslog(LOG_WARNING, "Checksums are only required for v5 clients; other clients cannot produce initial authenticator checksums.");
 	}
     }
@@ -1120,7 +1108,7 @@ int valid_checksum;
 
 
 
-getstr(fd, buf, cnt, err)
+void getstr(fd, buf, cnt, err)
      int fd;
      char *buf;
      int cnt;
@@ -1156,7 +1144,9 @@ v5_des_read(fd, buf, len)
     int nreturned = 0;
     krb5_ui_4 net_len,rd_len;
     int cc,retry;
+#if 0
     unsigned char len_buf[4];
+#endif
     
     if (!do_encrypt)
       return(read(fd, buf, len));
@@ -1211,7 +1201,8 @@ v5_des_read(fd, buf, len)
 	}
 #endif
     net_len = krb5_encrypt_size(rd_len,eblock.crypto_entry);
-    if (net_len < 0 || net_len > sizeof(des_inbuf)) {
+    /* note net_len is unsigned */
+    if (net_len > sizeof(des_inbuf)) {
 	/* XXX preposterous length, probably out of sync.
 	   act as if pipe closed */
 	syslog(LOG_ERR,"Read size problem.");
@@ -1300,82 +1291,6 @@ v5_des_write(fd, buf, len)
 }
 #endif /* KERBEROS */
 
-
-
-getpty(fd,slave)
-     int *fd;
-     char *slave;
-{
-    char c;
-    char *p;
-    int i,ptynum;
-    struct stat stb;
-
-#ifdef HAVE_OPENPTY
-    int slavefd;
-
-    if(openpty(fd, &slavefd, slave, (struct termios *) 0,
-         (struct winsize *) 0)) return 1;
-    return 0;
-#else
-
-    *fd = open("/dev/ptmx", O_RDWR|O_NDELAY);	/* Solaris, IRIX */
-    if (*fd < 0) *fd = open("/dev/ptc", O_RDWR|O_NDELAY); /* AIX */
-    if (*fd < 0) *fd = open("/dev/pty", O_RDWR|O_NDELAY); /* sysvimp */
-
-    if (*fd >= 0) {
-
-#ifdef HAVE_GRANTPT
-	if (grantpt(*fd) || unlockpt(*fd)) return 1;
-#endif
-    
-#ifdef HAVE_PTSNAME
-	p = ptsname(*fd);
-#else
-#ifdef	HAVE_TTYNAME
-	p = ttyname(*fd);
-#else
-	/* XXX If we don't have either what do we do */
-#endif
-#endif
-	if (p) {
-	    strcpy(slave, p);
-	    return 0;
-	}
-
-	if (fstat(*fd, &stb) < 0) {
-	    close(*fd);
-	    return 1;
-	}
-	ptynum = (int)(stb.st_rdev&0xFF);
-	sprintf(slave, "/dev/ttyp%x", ptynum);
-	return 0;
-
-    } else {
-    
-	for (c = 'p'; c <= 's'; c++) {
-	    sprintf(slave,"/dev/ptyXX");
-	    slave[strlen("/dev/pty")] = c;
-	    slave[strlen("/dev/ptyp")] = '0';
-	    if (stat(slave, &stb) < 0)
-		break;
-	    for (i = 0; i < 16; i++) {
-		slave[sizeof("/dev/ptyp") - 1] = "0123456789abcdef"[i];
-		*fd = open(slave, O_RDWR);
-		if (*fd < 0) continue;
-
-		/* got pty */
-		slave[strlen("/dev/")] = 't';
-		return 0;
-	    }
-	}
-	return 1;
-    }
-#endif /* HAVE_OPENPTY */
-}
-
-
-
 void usage()
 {
 #ifdef KERBEROS
@@ -1412,7 +1327,7 @@ int default_realm(principal)
     
     realm_length = krb5_princ_realm(bsd_context, principal)->length;
     
-    if (retval = krb5_get_default_realm(bsd_context, &def_realm)) {
+    if ((retval = krb5_get_default_realm(bsd_context, &def_realm))) {
 	return 0;
     }
     
@@ -1440,13 +1355,13 @@ recvauth(valid_checksum)
     krb5_auth_context auth_context = NULL;
     krb5_error_code status;
     struct sockaddr_in peersin, laddr;
-    char krb_vers[KRB_SENDAUTH_VLEN + 1];
     int len;
     krb5_data inbuf;
     char v4_instance[INST_SZ];	/* V4 Instance */
     char v4_version[9];
     krb5_authenticator *authenticator;
-*valid_checksum = 0;
+
+    *valid_checksum = 0;
     len = sizeof(laddr);
     if (getsockname(netf, (struct sockaddr *)&laddr, &len)) {
 	    exit(1);
@@ -1460,15 +1375,15 @@ recvauth(valid_checksum)
 
     strcpy(v4_instance, "*");
 
-    if (status = krb5_auth_con_init(bsd_context, &auth_context))
+    if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
         return status;
  
     /* Only need remote address for rd_cred() to verify client */
-    if (status = krb5_auth_con_genaddrs(bsd_context, auth_context, netf,
-			KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR))
+    if ((status = krb5_auth_con_genaddrs(bsd_context, auth_context, netf,
+		 KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR)))
 	return status;
 
-    if (status = krb5_compat_recvauth(bsd_context, &auth_context, &netf,
+    if ((status = krb5_compat_recvauth(bsd_context, &auth_context, &netf,
 				  "KCMDV0.1",
 				  NULL, 	/* Specify daemon principal */
 				  0, 		/* no flags */
@@ -1483,7 +1398,7 @@ recvauth(valid_checksum)
 
 				  &ticket, 	/* return ticket */
 				  &auth_sys, 	/* which authentication system*/
-				  &v4_kdata, v4_schedule, v4_version)) {
+				  &v4_kdata, v4_schedule, v4_version))) {
 
       if (auth_sys == KRB5_RECVAUTH_V5) {
 	    /*
@@ -1498,9 +1413,10 @@ recvauth(valid_checksum)
 
     getstr(netf, lusername, sizeof (lusername), "locuser");
     getstr(netf, term, sizeof(term), "Terminal type");
-    if (auth_sys == KRB5_RECVAUTH_V5) {
+    if ((auth_sys == KRB5_RECVAUTH_V5) && checksum_required) {
       
-      if(status = krb5_auth_con_getauthenticator(bsd_context, auth_context, &authenticator))
+      if ((status = krb5_auth_con_getauthenticator(bsd_context, auth_context,
+						   &authenticator)))
 	return status;
     
       if (authenticator->checksum) {
@@ -1508,24 +1424,23 @@ recvauth(valid_checksum)
 	int adr_length = sizeof(adr);
 	char * chksumbuf = (char *) malloc(strlen(term)+strlen(lusername)+32);
 	if (getsockname(netf, (struct sockaddr *) &adr, &adr_length) != 0)
-	  return errno;
+	    goto error_cleanup;
 	if (chksumbuf == 0)
-	  goto error_cleanup;
+	    goto error_cleanup;
 
 	sprintf(chksumbuf,"%u:", ntohs(adr.sin_port));
 	strcat(chksumbuf,term);
 	strcat(chksumbuf,lusername);
 
-	if ( status = krb5_verify_checksum(bsd_context,
-					   authenticator->checksum->checksum_type,
-					   authenticator->checksum,
-					   chksumbuf, strlen(chksumbuf),
-					   ticket->enc_part2->session->contents, 
-					   ticket->enc_part2->session->length))
-	  goto error_cleanup;
-
-      error_cleanup:
-	krb5_xfree(chksumbuf);
+	status = krb5_verify_checksum(bsd_context,
+				      authenticator->checksum->checksum_type,
+				      authenticator->checksum,
+				      chksumbuf, strlen(chksumbuf),
+				      ticket->enc_part2->session->contents, 
+				      ticket->enc_part2->session->length);
+    error_cleanup:
+	if (chksumbuf)
+	    krb5_xfree(chksumbuf);
 	if (status) {
 	  krb5_free_authenticator(bsd_context, authenticator);
 	  return status;
@@ -1561,8 +1476,8 @@ recvauth(valid_checksum)
 
     /* Must be V5  */
 	
-    if (status = krb5_copy_principal(bsd_context, ticket->enc_part2->client, 
-				     &client))
+    if ((status = krb5_copy_principal(bsd_context, ticket->enc_part2->client, 
+				      &client)))
 	return status;
 
     des_read  = v5_des_read;
@@ -1570,7 +1485,7 @@ recvauth(valid_checksum)
 
     getstr(netf, rusername, sizeof(rusername), "remuser");
 
-    if (status = krb5_unparse_name(bsd_context, client, &krusername))
+    if ((status = krb5_unparse_name(bsd_context, client, &krusername)))
 	return status;
     
     /* Setup up eblock if encrypted login session */
@@ -1578,12 +1493,12 @@ recvauth(valid_checksum)
     if (do_encrypt) {
 	krb5_use_enctype(bsd_context, &eblock,
 			 ticket->enc_part2->session->enctype);
-	if (status = krb5_process_key(bsd_context, &eblock,
-				      ticket->enc_part2->session))
+	if ((status = krb5_process_key(bsd_context, &eblock,
+				       ticket->enc_part2->session)))
 	    fatal(netf, "Permission denied");
     }      
 
-    if (status = krb5_read_message(bsd_context, (krb5_pointer)&netf, &inbuf))
+    if ((status = krb5_read_message(bsd_context, (krb5_pointer)&netf, &inbuf)))
 	fatal(netf, "Error reading message");
 
     if ((inbuf.length) && /* Forwarding being done, read creds */
@@ -1606,7 +1521,9 @@ int len;
 	int nreturned = 0;
 	krb5_ui_4 net_len, rd_len;
 	int cc;
+#if 0
 	unsigned char len_buf[4];
+#endif
 
 	if (!do_encrypt)
 		return(read(fd, buf, len));
@@ -1668,7 +1585,8 @@ int len;
 	}
 
 #endif
-	if (net_len < 0 || net_len > sizeof(des_inbuf)) {
+	/* Note: net_len is unsigned */
+	if (net_len > sizeof(des_inbuf)) {
 		/* XXX preposterous length, probably out of sync.
 		   act as if pipe closed */
 		return(0);
diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 6cae876c20..3acbedb491 100644
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -221,10 +221,10 @@ int     secflag;
 extern
 #endif /* CRAY */
 
-
 /*VARARGS1*/
-int	error();
+void	error();
 
+void usage(), getstr(), doit();
 
 #ifdef __SCO__
 /* sco has getgroups and setgroups but no initgroups */
@@ -239,7 +239,7 @@ int initgroups(char* name, gid_t basegid) {
 #endif
 
 
-main(argc, argv)
+int main(argc, argv)
      int argc;
      char **argv;
 {
@@ -313,10 +313,10 @@ main(argc, argv)
 	  break;
 
 	case 'S':
-	  if (status = krb5_kt_resolve(bsd_context, optarg, &keytab)) {
-		  com_err(progname, status, "while resolving srvtab file %s",
-			  optarg);
-		  exit(2);
+	  if ((status = krb5_kt_resolve(bsd_context, optarg, &keytab))) {
+	      com_err(progname, status, "while resolving srvtab file %s",
+		      optarg);
+	      exit(2);
 	  }
 	  break;
 
@@ -421,6 +421,7 @@ main(argc, argv)
       syslog(LOG_WARNING , "setsockopt (SO_LINGER): %m");
 #endif
     doit(dup(fd), &from);
+    return 0;
 }
 
 #ifdef CRAY
@@ -491,26 +492,20 @@ int auth_sys = 0;	/* Which version of Kerberos used to authenticate */
 #define KRB5_RECVAUTH_V4	4
 #define KRB5_RECVAUTH_V5	5
 
-doit(f, fromp)
+void doit(f, fromp)
      int f;
      struct sockaddr_in *fromp;
 {
     char *cp;
-    
 #ifdef KERBEROS
     krb5_error_code status;
 #endif
-
-int valid_checksum;
-    int tmpint;
-    
-    int ioctlval, cnt;
-    char *salt, *ttynm, *tty;
+    int valid_checksum;
+    int cnt;
     register char *p;
     char *crypt();
     struct passwd *pwd;
     char *path;
-    
 #ifdef CRAY
 #ifndef NO_UDB
     struct udb    *ue;
@@ -537,9 +532,7 @@ int valid_checksum;
     int pv[2], pw[2], px[2], cc;
     fd_set ready, readfrom;
     char buf[RSHD_BUFSIZ], sig;
-    int one = 1;
     krb5_sigtype     cleanup();
-    int fd;
     struct sockaddr_in fromaddr;
     int non_privileged = 0;
 #ifdef POSIX_SIGNALS
@@ -697,7 +690,7 @@ int valid_checksum;
     }
 
 #ifdef KERBEROS
-    if (status = recvauth(f, fromaddr,&valid_checksum)) {
+    if ((status = recvauth(f, fromaddr,&valid_checksum))) {
 	error("Authentication failed: %s\n", error_message(status));
 	exit(1);
     }
@@ -928,20 +921,19 @@ int valid_checksum;
 	    if (ue->ue_minlvl > 0)
 	      nal_error++;
 	    /*
-	      /*
-	       *      Address not in NAL, if EXEMPT_NAL is not
-	       *      true, then even an unclassified user is
-	       *      not allowed.
-	       */
-	      if (!EXEMPT_NAL)
+	     *      Address not in NAL, if EXEMPT_NAL is not
+	     *      true, then even an unclassified user is
+	     *      not allowed.
+	     */
+	    if (!EXEMPT_NAL)
 		nal_error++;
-	      else {
-		  usrv.sv_minlvl = 0;
-		  usrv.sv_maxlvl = 0;
-		  usrv.sv_valcmp = 0;
-		  usrv.sv_actcmp = 0;
-		  usrv.sv_actlvl = 0;
-	      }
+	    else {
+		usrv.sv_minlvl = 0;
+		usrv.sv_maxlvl = 0;
+		usrv.sv_valcmp = 0;
+		usrv.sv_actcmp = 0;
+		usrv.sv_actlvl = 0;
+	    }
 	}
 	if (nal_error) {
 	    loglogin(hostname, SLG_LVERR, ue->ue_logfails,ue);
@@ -985,33 +977,30 @@ int valid_checksum;
 		       kremuser, remuser, hostname, locuser);
 		}
 	    else auth_sent |= AUTH_KRB4;
-	}else
+	} else
 #endif
-	    {
+	{
 	    /* krb5_kuserok returns 1 if OK */
 	    if (!krb5_kuserok(bsd_context, client, locuser)){
 		syslog(LOG_ERR ,
 		       "Principal %s (%s@%s) for local user %s failed krb5_kuserok.\n",
 		       kremuser, remuser, hostname, locuser);
 	    }
-else auth_sent |= AUTH_KRB5;
+	    else auth_sent |= AUTH_KRB5;
 	}
 
 	
     if (auth_ok&AUTH_RHOSTS) {
 	/* Cannot check .rhosts unless connection from privileged port */
 	if (!non_privileged) {
-	  	if (ruserok(hostname, pwd->pw_uid == 0,
-		    remuser, locuser) < 0) {
-	    syslog(LOG_ERR ,
-		   "Principal %s (%s@%s) for local user %s failed ruserok.\n",
-		   kremuser, remuser, hostname, locuser);
-
-	    
+	    if (ruserok(hostname, pwd->pw_uid == 0,
+			remuser, locuser) < 0) {
+		syslog(LOG_ERR ,
+		       "Principal %s (%s@%s) for local user %s failed ruserok.\n",
+		       kremuser, remuser, hostname, locuser);
+	    } else auth_sent |=AUTH_RHOSTS;
 	}
-	      else auth_sent |=AUTH_RHOSTS;
-	      }
-}
+    }
 #else
     if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' &&
 	ruserok(hostname, pwd->pw_uid == 0, remuser, locuser) < 0) {
@@ -1021,21 +1010,19 @@ else auth_sent |= AUTH_KRB5;
 #endif /* KERBEROS */
 
 
-if (checksum_required) {
-			 if ((auth_sent&AUTH_KRB5)&&(!valid_checksum)) {
-			   syslog(LOG_WARNING, "Client did not supply required checksum.");
-	
-			 error( "You are using an old Kerberos5 without initial connection support; only newer clients are authorized.");
-goto signout_please;
-		       }
-else {
-       syslog(LOG_WARNING, "Checksums are only required for v5 clients; other clients cannot produce initial authenticator checksums.");
-     }
-		       }
-if (require_encrypt&&(!do_encrypt)) {
-  error("You must use encryption.");
-  goto signout_please;
-}
+    if (checksum_required && !valid_checksum) {
+	if (auth_sent & AUTH_KRB5) {
+	    syslog(LOG_WARNING, "Client did not supply required checksum.");
+	    error( "You are using an old Kerberos5 without initial connection support; only newer clients are authorized.");
+	    goto signout_please;
+	} else {
+	    syslog(LOG_WARNING, "Checksums are only required for v5 clients; other clients cannot produce initial authenticator checksums.");
+	}
+    }
+    if (require_encrypt&&(!do_encrypt)) {
+	    error("You must use encryption.");
+	    goto signout_please;
+    }
     if (!(auth_ok&auth_sent)) {
       error("Permission denied.");
       goto signout_please;
@@ -1373,7 +1360,7 @@ if (ccache)
 
 
 /*VARARGS1*/
-error(fmt, a1, a2, a3)
+void error(fmt, a1, a2, a3)
      char *fmt;
      char *a1, *a2, *a3;
 {
@@ -1387,11 +1374,11 @@ error(fmt, a1, a2, a3)
 }
 
 
-
-getstr(fd, buf, cnt, err)
-     char *buf;
-     int cnt;
-     char *err;
+void getstr(fd, buf, cnt, err)
+    int fd;
+    char *buf;
+    int cnt;
+    char *err;
 {
     char c;
     
@@ -1607,7 +1594,7 @@ loglogin(host, flag, failures, ue)
 	
 
 
-usage()
+void usage()
 {
 #ifdef KERBEROS
     syslog(LOG_ERR, "usage: kshd [-rRkK] or [r/R][k/K]shd");
@@ -1641,7 +1628,7 @@ int default_realm(principal)
     
     realm_length = krb5_princ_realm(bsd_context, principal)->length;
     
-    if (retval = krb5_get_default_realm(bsd_context, &def_realm)) {
+    if ((retval = krb5_get_default_realm(bsd_context, &def_realm))) {
 	return 0;
     }
     
@@ -1754,65 +1741,69 @@ krb5_authenticator *authenticator;
 	
     getstr(netf, remuser, sizeof(locuser), "remuser");
 
-    if (status = krb5_unparse_name(bsd_context, ticket->enc_part2->client, 
-				   &kremuser))
+    if ((status = krb5_unparse_name(bsd_context, ticket->enc_part2->client, 
+				    &kremuser)))
 	return status;
     
-    if (status = krb5_copy_principal(bsd_context, ticket->enc_part2->client, 
-				     &client))
+    if ((status = krb5_copy_principal(bsd_context, ticket->enc_part2->client, 
+				      &client)))
 	return status;
-    if (status = krb5_auth_con_getauthenticator(bsd_context, auth_context, &authenticator))
+    if ((status = krb5_auth_con_getauthenticator(bsd_context, auth_context,
+						 &authenticator)))
       return status;
     
-    if (authenticator->checksum) {
+    if (authenticator->checksum && checksum_required) {
 	struct sockaddr_in adr;
 	int adr_length = sizeof(adr);
-      char * chksumbuf = (char *) malloc(strlen(cmdbuf)+strlen(locuser)+32);
+	char * chksumbuf = (char *) malloc(strlen(cmdbuf)+strlen(locuser)+32);
+
+	if (chksumbuf == 0)
+	    goto error_cleanup;
 	if (getsockname(netf, (struct sockaddr *) &adr, &adr_length) != 0)
-    return errno;
-      if (chksumbuf == 0)
-    goto error_cleanup;
-
-      sprintf(chksumbuf,"%u:", ntohs(adr.sin_port));
-      strcat(chksumbuf,cmdbuf);
-      strcat(chksumbuf,locuser);
-
-      if ( status = krb5_verify_checksum(bsd_context,
-					 authenticator->checksum->checksum_type,
-					 authenticator->checksum,
-					 chksumbuf, strlen(chksumbuf),
-					 				       ticket->enc_part2->session->contents, 
-				       ticket->enc_part2->session->length))
-	goto error_cleanup;
-
- error_cleanup:
-krb5_xfree(chksumbuf);
-      if (status) {
-	krb5_free_authenticator(bsd_context, authenticator);
-	return status;
-      }
+	    goto error_cleanup;
+
+	sprintf(chksumbuf,"%u:", ntohs(adr.sin_port));
+	strcat(chksumbuf,cmdbuf);
+	strcat(chksumbuf,locuser);
+
+	status = krb5_verify_checksum(bsd_context,
+				      authenticator->checksum->checksum_type,
+				      authenticator->checksum,
+				      chksumbuf, strlen(chksumbuf),
+				      ticket->enc_part2->session->contents, 
+				      ticket->enc_part2->session->length);
+
+    error_cleanup:
+	if (chksumbuf)
+	    krb5_xfree(chksumbuf);
+	if (status) {
+	    krb5_free_authenticator(bsd_context, authenticator);
+	    return status;
+	}
 	*valid_checksum = 1;
-}
+    }
     krb5_free_authenticator(bsd_context, authenticator);
 
     
     /* Setup eblock for encrypted sessions. */
     krb5_use_enctype(bsd_context, &eblock, ticket->enc_part2->session->enctype);
-    if (status = krb5_process_key(bsd_context, &eblock, ticket->enc_part2->session))
+    if ((status = krb5_process_key(bsd_context, &eblock,
+				   ticket->enc_part2->session)))
 	fatal(netf, "Permission denied");
 
     /* Null out the "session" because eblock.key references the session
      * key here, and we do not want krb5_free_ticket() to destroy it. */
     ticket->enc_part2->session = 0;
 
-    if (status = krb5_read_message(bsd_context, (krb5_pointer)&netf, &inbuf)) {
+    if ((status = krb5_read_message(bsd_context, (krb5_pointer)&netf,
+				    &inbuf))) {
 	error("Error reading message: %s\n", error_message(status));
 	exit(1);
     }
 
     if (inbuf.length) { /* Forwarding being done, read creds */
-	if (status = rd_and_store_for_creds(bsd_context, auth_context, &inbuf,
-					    ticket, locuser, &ccache)) {
+	if ((status = rd_and_store_for_creds(bsd_context, auth_context, &inbuf,
+					     ticket, locuser, &ccache))) {
 	    error("Can't get forwarded credentials: %s\n",
 		  error_message(status));
 	    exit(1);
@@ -1866,7 +1857,8 @@ v5_des_read(fd, buf, len)
 	 (len_buf[2]<<8) |
 	 len_buf[3]);
     net_len = krb5_encrypt_size(rd_len, eblock.crypto_entry);
-    if (net_len < 0 || net_len > sizeof(des_inbuf)) {
+    /* note: net_len is unsigned */
+    if (net_len > sizeof(des_inbuf)) {
 	/* XXX preposterous length, probably out of sync.
 	   act as if pipe closed */
 	syslog(LOG_ERR,"Read size problem (rd_len=%d, net_len=%d)",
@@ -1957,7 +1949,9 @@ void fatal(f, msg)
      char *msg;
 {
     char buf[512];
+#ifndef POSIX_TERMIOS
     int out = 1 ;          /* Output queue of f */
+#endif
 
     buf[0] = '\01';             /* error indicator */
     (void) sprintf(buf + 1, "%s: %s.\r\n",progname, msg);