From 41ff7485d2775407c85fb2b90b26c3170b2ad4b5 Mon Sep 17 00:00:00 2001
From: Ken Raeburn <raeburn@mit.edu>
Date: Sat, 22 Jan 2000 03:49:56 +0000
Subject: [PATCH] Various changes to:  * make most non-changing data const  *
 silence "gcc -Wall -Werror" complaints on sparc-solaris2.6  ** delete unused
 functions and variables  ** change if(a=b) ... to if((a=b)) or if((a=b)!=0)
 [yeah, kinda gratuitous]  ** insert extra braces for 2-D arrays  * some basic
 thread safety checks

Not changing afsstring2key.c until I make sure I've got some tests for it.
Currently, prng.c and afsstring2key.c, at least, still aren't thread-safe.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@11959 dc483132-0cff-0310-8789-dd5450dbe970
---
 src/lib/crypto/ChangeLog                      | 24 ++++++++++++
 src/lib/crypto/cksumtypes.c                   |  5 +--
 src/lib/crypto/cksumtypes.h                   |  5 +--
 src/lib/crypto/dk/ChangeLog                   |  9 +++++
 src/lib/crypto/dk/checksum.c                  | 10 ++---
 src/lib/crypto/dk/dk_decrypt.c                | 16 ++++----
 src/lib/crypto/dk/dk_encrypt.c                | 20 +++++-----
 src/lib/crypto/dk/stringtokey.c               |  4 +-
 src/lib/crypto/enc_provider/ChangeLog         |  8 ++++
 src/lib/crypto/enc_provider/des.c             |  4 +-
 src/lib/crypto/enc_provider/des3.c            |  4 +-
 src/lib/crypto/enc_provider/enc_provider.h    |  6 +--
 src/lib/crypto/etypes.c                       |  4 +-
 src/lib/crypto/etypes.h                       |  4 +-
 src/lib/crypto/hash_provider/ChangeLog        |  8 ++++
 src/lib/crypto/hash_provider/hash_crc32.c     |  2 +-
 src/lib/crypto/hash_provider/hash_md4.c       |  2 +-
 src/lib/crypto/hash_provider/hash_md5.c       |  2 +-
 src/lib/crypto/hash_provider/hash_provider.h  |  8 ++--
 src/lib/crypto/hash_provider/hash_sha1.c      |  2 +-
 src/lib/crypto/hmac.c                         |  4 +-
 src/lib/crypto/keyhash_provider/ChangeLog     | 19 ++++++++++
 src/lib/crypto/keyhash_provider/descbc.c      |  4 +-
 src/lib/crypto/keyhash_provider/k5_md4des.c   |  7 ++--
 src/lib/crypto/keyhash_provider/k5_md5des.c   |  7 ++--
 .../keyhash_provider/keyhash_provider.h       |  6 +--
 src/lib/crypto/make_checksum.c                |  1 +
 src/lib/crypto/make_random_key.c              |  4 +-
 src/lib/crypto/md4/ChangeLog                  |  7 ++++
 src/lib/crypto/md4/md4.c                      |  6 +--
 src/lib/crypto/md4/rsa-md4.h                  |  2 +-
 src/lib/crypto/md5/ChangeLog                  |  7 ++++
 src/lib/crypto/md5/md5.c                      |  6 +--
 src/lib/crypto/md5/rsa-md5.h                  |  2 +-
 src/lib/crypto/nfold.c                        |  3 +-
 src/lib/crypto/old/ChangeLog                  |  8 ++++
 src/lib/crypto/old/des_stringtokey.c          |  6 +++
 src/lib/crypto/old/old_decrypt.c              |  7 ++--
 src/lib/crypto/old/old_encrypt.c              |  6 +--
 src/lib/crypto/old_api_glue.c                 | 28 +++++++-------
 src/lib/crypto/prng.c                         |  4 +-
 src/lib/crypto/sha1/ChangeLog                 |  7 ++++
 src/lib/crypto/sha1/shs.c                     | 38 +------------------
 src/lib/crypto/string_to_key.c                |  4 +-
 src/lib/crypto/verify_checksum.c              |  6 +--
 45 files changed, 203 insertions(+), 143 deletions(-)

diff --git a/src/lib/crypto/ChangeLog b/src/lib/crypto/ChangeLog
index 7b9ad2abf..0c4236842 100644
--- a/src/lib/crypto/ChangeLog
+++ b/src/lib/crypto/ChangeLog
@@ -1,6 +1,30 @@
 2000-01-21  Ken Raeburn  <raeburn@mit.edu>
 
+	* cksumtypes.c (krb5_cksumtypes_list, krb5_cksumtypes_length): Now
+	const.
+	* cksumtypes.h (krb5_cksumtypes_list, krb5_cksumtypes_length):
+	Updated decls.
+	* etypes.c (krb5_enctypes_list, krb5_enctypes_length): Now const.
+	* etypes.h (krb5_enctypes_list, krb5_enctypes_length): Updated
+	decls.
+	* make_random_key.c (krb5_c_make_random_key): Pointers to
+	enc_provider table now point to const.
 	* prng.c (enc): Now static and const, and points to const.
+	* string_to_key.c (krb5_c_string_to_key): Ditto.
+
+	* hmac.c (krb5_hmac): Put extra parens around if(a=b) constructs
+	to keep gcc happy.
+	* make_random_key.c (krb5_c_make_random_key): Ditto.
+	* old_api_glue.c (krb5_encrypt, krb5_decrypt, krb5_random_key,
+	krb5_calculate_checksum, krb5_verify_checksum, krb5_encrypt_data,
+	krb5_decrypt_data): Ditto.
+	* prng.c (krb5_c_random_make_octets): Ditto.
+	* string_to_key.c (krb5_c_string_to_key): Ditto.
+	* verify_checksum.c (krb5_c_verify_checksum): Ditto.
+
+	* make_checksum.c: Include dk.h.
+
+	* nfold.c (krb5_nfold): Delete unused variables.
 
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
diff --git a/src/lib/crypto/cksumtypes.c b/src/lib/crypto/cksumtypes.c
index 8f3d21175..ee5bc6101 100644
--- a/src/lib/crypto/cksumtypes.c
+++ b/src/lib/crypto/cksumtypes.c
@@ -29,7 +29,7 @@
 #include "keyhash_provider.h"
 #include "cksumtypes.h"
 
-struct krb5_cksumtypes krb5_cksumtypes_list[] = {
+const struct krb5_cksumtypes krb5_cksumtypes_list[] = {
     { CKSUMTYPE_CRC32, KRB5_CKSUMFLAG_NOT_COLL_PROOF,
       "crc32", "CRC-32",
       0, NULL,
@@ -73,6 +73,5 @@ struct krb5_cksumtypes krb5_cksumtypes_list[] = {
       &krb5_hash_sha1 },
 };
 
-int krb5_cksumtypes_length =
+const int krb5_cksumtypes_length =
 sizeof(krb5_cksumtypes_list)/sizeof(struct krb5_cksumtypes);
-
diff --git a/src/lib/crypto/cksumtypes.h b/src/lib/crypto/cksumtypes.h
index 900a7c891..dae70c8f2 100644
--- a/src/lib/crypto/cksumtypes.h
+++ b/src/lib/crypto/cksumtypes.h
@@ -26,6 +26,5 @@
 
 #include "k5-int.h"
 
-extern struct krb5_cksumtypes krb5_cksumtypes_list[];
-extern int krb5_cksumtypes_length;
-
+extern const struct krb5_cksumtypes krb5_cksumtypes_list[];
+extern const int krb5_cksumtypes_length;
diff --git a/src/lib/crypto/dk/ChangeLog b/src/lib/crypto/dk/ChangeLog
index d57857e82..90e34f87c 100644
--- a/src/lib/crypto/dk/ChangeLog
+++ b/src/lib/crypto/dk/ChangeLog
@@ -1,3 +1,12 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* checksum.c (krb5_dk_make_checksum): enc_providers are now
+	const.  Modify if(a=b) assignment/test constructs to silence gcc
+	warnings.
+	* dk_decrypt.c (krb5_dk_decrypt, krb5_marc_dk_decrypt): Ditto.
+	* dk_encrypt.c (krb5_dk_encrypt, krb5_marc_dk_encrypt): Ditto.
+	* stringtokey.c (krb5_dk_string_to_key): Ditto.  Include dk.h.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/dk/checksum.c b/src/lib/crypto/dk/checksum.c
index b9318d239..535ea7c04 100644
--- a/src/lib/crypto/dk/checksum.c
+++ b/src/lib/crypto/dk/checksum.c
@@ -39,7 +39,7 @@ krb5_dk_make_checksum(hash, key, usage, input, output)
      krb5_data *output;
 {
     int i;
-    struct krb5_enc_provider *enc;
+    const struct krb5_enc_provider *enc;
     size_t blocksize, keybytes, keylength;
     krb5_error_code ret;
     unsigned char constantdata[K5CLENGTH];
@@ -83,14 +83,14 @@ krb5_dk_make_checksum(hash, key, usage, input, output)
 
     datain.data[4] = 0x99;
 
-    if (ret = krb5_derive_key(enc, key, &kc, &datain))
+    if ((ret = krb5_derive_key(enc, key, &kc, &datain)) != 0)
 	goto cleanup;
 
     /* hash the data */
 
     datain = *input;
 
-    if (ret = krb5_hmac(hash, &kc, 1, &datain, output))
+    if ((ret = krb5_hmac(hash, &kc, 1, &datain, output)) != 0)
 	memset(output->data, 0, output->length);
 
     /* ret is set correctly by the prior call */
@@ -157,7 +157,7 @@ krb5_marc_dk_make_checksum(hash, key, usage, input, output)
 
     datain[0].data[4] = 0x99;
 
-    if (ret = krb5_derive_key(enc, key, &kc, &datain[0]))
+    if ((ret = krb5_derive_key(enc, key, &kc, &datain[0])) != 0)
 	goto cleanup;
 
     /* hash the data */
@@ -170,7 +170,7 @@ krb5_marc_dk_make_checksum(hash, key, usage, input, output)
 
     datain[1] = *input;
 
-    if (ret = krb5_hmac(hash, &kc, 2, datain, output))
+    if ((ret = krb5_hmac(hash, &kc, 2, datain, output)) != 0)
 	memset(output->data, 0, output->length);
 
     /* ret is set correctly by the prior call */
diff --git a/src/lib/crypto/dk/dk_decrypt.c b/src/lib/crypto/dk/dk_decrypt.c
index 71fdb80d0..d3077615f 100644
--- a/src/lib/crypto/dk/dk_decrypt.c
+++ b/src/lib/crypto/dk/dk_decrypt.c
@@ -89,12 +89,12 @@ krb5_dk_decrypt(enc, hash, key, usage, ivec, input, output)
 
     d1.data[4] = 0xAA;
 
-    if (ret = krb5_derive_key(enc, key, &ke, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ke, &d1)) != 0)
 	goto cleanup;
 
     d1.data[4] = 0x55;
 
-    if (ret = krb5_derive_key(enc, key, &ki, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ki, &d1)) != 0)
 	goto cleanup;
 
     /* decrypt the ciphertext */
@@ -105,7 +105,7 @@ krb5_dk_decrypt(enc, hash, key, usage, ivec, input, output)
     d2.length = enclen;
     d2.data = plaindata;
 
-    if (ret = ((*(enc->decrypt))(&ke, ivec, &d1, &d2)))
+    if ((ret = ((*(enc->decrypt))(&ke, ivec, &d1, &d2))) != 0)
 	goto cleanup;
 
     /* verify the hash */
@@ -113,7 +113,7 @@ krb5_dk_decrypt(enc, hash, key, usage, ivec, input, output)
     d1.length = hashsize;
     d1.data = cksum;
 
-    if (ret = krb5_hmac(hash, &ki, 1, &d2, &d1))
+    if ((ret = krb5_hmac(hash, &ki, 1, &d2, &d1)) != 0)
 	goto cleanup;
 
     if (memcmp(cksum, input->data+enclen, hashsize) != 0) {
@@ -211,12 +211,12 @@ krb5_marc_dk_decrypt(enc, hash, key, usage, ivec, input, output)
 
     d1.data[4] = 0xAA;
 
-    if (ret = krb5_derive_key(enc, key, &ke, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ke, &d1)) != 0)
 	goto cleanup;
 
     d1.data[4] = 0x55;
 
-    if (ret = krb5_derive_key(enc, key, &ki, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ki, &d1)) != 0)
 	goto cleanup;
 
     /* decrypt the ciphertext */
@@ -227,7 +227,7 @@ krb5_marc_dk_decrypt(enc, hash, key, usage, ivec, input, output)
     d2.length = enclen;
     d2.data = plaindata;
 
-    if (ret = ((*(enc->decrypt))(&ke, ivec, &d1, &d2)))
+    if ((ret = ((*(enc->decrypt))(&ke, ivec, &d1, &d2))) != 0)
 	goto cleanup;
 
     /* verify the hash */
@@ -235,7 +235,7 @@ krb5_marc_dk_decrypt(enc, hash, key, usage, ivec, input, output)
     d1.length = hashsize;
     d1.data = cksum;
 
-    if (ret = krb5_hmac(hash, &ki, 1, &d2, &d1))
+    if ((ret = krb5_hmac(hash, &ki, 1, &d2, &d1)) != 0)
 	goto cleanup;
 
     if (memcmp(cksum, input->data+enclen, hashsize) != 0) {
diff --git a/src/lib/crypto/dk/dk_encrypt.c b/src/lib/crypto/dk/dk_encrypt.c
index 30212c443..8627353db 100644
--- a/src/lib/crypto/dk/dk_encrypt.c
+++ b/src/lib/crypto/dk/dk_encrypt.c
@@ -110,12 +110,12 @@ krb5_dk_encrypt(enc, hash, key, usage, ivec, input, output)
 
     d1.data[4] = 0xAA;
 
-    if (ret = krb5_derive_key(enc, key, &ke, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ke, &d1)))
 	goto cleanup;
 
     d1.data[4] = 0x55;
 
-    if (ret = krb5_derive_key(enc, key, &ki, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ki, &d1)))
 	goto cleanup;
 
     /* put together the plaintext */
@@ -123,7 +123,7 @@ krb5_dk_encrypt(enc, hash, key, usage, ivec, input, output)
     d1.length = blocksize;
     d1.data = plaintext;
 
-    if (ret = krb5_c_random_make_octets(/* XXX */ 0, &d1))
+    if ((ret = krb5_c_random_make_octets(/* XXX */ 0, &d1)))
 	goto cleanup;
 
     memcpy(plaintext+blocksize, input->data, input->length);
@@ -139,7 +139,7 @@ krb5_dk_encrypt(enc, hash, key, usage, ivec, input, output)
     d2.length = plainlen;
     d2.data = output->data;
 
-    if (ret = ((*(enc->encrypt))(&ke, ivec, &d1, &d2)))
+    if ((ret = ((*(enc->encrypt))(&ke, ivec, &d1, &d2))))
 	goto cleanup;
 
     /* hash the plaintext */
@@ -149,7 +149,7 @@ krb5_dk_encrypt(enc, hash, key, usage, ivec, input, output)
 
     output->length = enclen;
 
-    if (ret = krb5_hmac(hash, &ki, 1, &d1, &d2))
+    if ((ret = krb5_hmac(hash, &ki, 1, &d1, &d2)))
 	memset(d2.data, 0, d2.length);
 
     /* ret is set correctly by the prior call */
@@ -241,12 +241,12 @@ krb5_marc_dk_encrypt(enc, hash, key, usage, ivec, input, output)
 
     d1.data[4] = 0xAA;
 
-    if (ret = krb5_derive_key(enc, key, &ke, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ke, &d1)))
 	goto cleanup;
 
     d1.data[4] = 0x55;
 
-    if (ret = krb5_derive_key(enc, key, &ki, &d1))
+    if ((ret = krb5_derive_key(enc, key, &ki, &d1)))
 	goto cleanup;
 
     /* put together the plaintext */
@@ -254,7 +254,7 @@ krb5_marc_dk_encrypt(enc, hash, key, usage, ivec, input, output)
     d1.length = blocksize;
     d1.data = plaintext;
 
-    if (ret = krb5_c_random_make_octets(/* XXX */ 0, &d1))
+    if ((ret = krb5_c_random_make_octets(/* XXX */ 0, &d1)))
 	goto cleanup;
 
     (plaintext+blocksize)[0] = (input->length>>24)&0xff;
@@ -275,7 +275,7 @@ krb5_marc_dk_encrypt(enc, hash, key, usage, ivec, input, output)
     d2.length = plainlen;
     d2.data = output->data;
 
-    if (ret = ((*(enc->encrypt))(&ke, ivec, &d1, &d2)))
+    if ((ret = ((*(enc->encrypt))(&ke, ivec, &d1, &d2))))
 	goto cleanup;
 
     /* hash the plaintext */
@@ -285,7 +285,7 @@ krb5_marc_dk_encrypt(enc, hash, key, usage, ivec, input, output)
 
     output->length = enclen;
 
-    if (ret = krb5_hmac(hash, &ki, 1, &d1, &d2))
+    if ((ret = krb5_hmac(hash, &ki, 1, &d1, &d2)))
 	memset(d2.data, 0, d2.length);
 
     /* ret is set correctly by the prior call */
diff --git a/src/lib/crypto/dk/stringtokey.c b/src/lib/crypto/dk/stringtokey.c
index c033dc35a..8eddccdcf 100644
--- a/src/lib/crypto/dk/stringtokey.c
+++ b/src/lib/crypto/dk/stringtokey.c
@@ -24,7 +24,7 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#include "k5-int.h"
+#include "dk.h"
 
 static unsigned char kerberos[] = "kerberos";
 #define kerberos_len (sizeof(kerberos)-1)
@@ -80,7 +80,7 @@ krb5_dk_string_to_key(enc, string, salt, key)
     indata.length = kerberos_len;
     indata.data = kerberos;
 
-    if (ret = krb5_derive_key(enc, &foldkey, key, &indata))
+    if ((ret = krb5_derive_key(enc, &foldkey, key, &indata)))
 	memset(key->contents, 0, key->length);
 
     /* ret is set correctly by the prior call */
diff --git a/src/lib/crypto/enc_provider/ChangeLog b/src/lib/crypto/enc_provider/ChangeLog
index 9154340ae..5f8ee63db 100644
--- a/src/lib/crypto/enc_provider/ChangeLog
+++ b/src/lib/crypto/enc_provider/ChangeLog
@@ -1,3 +1,11 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* des.c (mit_des_zeroblock): Now const, and using C default
+	initialization.
+	(krb5_enc_des): Now const.
+	* des3.c (mit_des_zeroblock, krb5_enc_des3): Similar.
+	* enc_provider.h (krb5_enc_des, krb5_enc_des3): Update decls.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/enc_provider/des.c b/src/lib/crypto/enc_provider/des.c
index 68c4e5b13..2a4af9032 100644
--- a/src/lib/crypto/enc_provider/des.c
+++ b/src/lib/crypto/enc_provider/des.c
@@ -28,7 +28,7 @@
 #include "des_int.h"
 #include "enc_provider.h"
 
-static mit_des_cblock mit_des_zeroblock[8] = {0,0,0,0,0,0,0,0};
+static const mit_des_cblock mit_des_zeroblock[8] /* = all zero */;
 
 static void
 k5_des_block_size(size_t *blocksize)
@@ -119,7 +119,7 @@ k5_des_make_key(krb5_const krb5_data *randombits, krb5_keyblock *key)
     return(0);
 }
 
-struct krb5_enc_provider krb5_enc_des = {
+const struct krb5_enc_provider krb5_enc_des = {
     k5_des_block_size,
     k5_des_keysize,
     k5_des_encrypt,
diff --git a/src/lib/crypto/enc_provider/des3.c b/src/lib/crypto/enc_provider/des3.c
index a27a4d414..d8ce569df 100644
--- a/src/lib/crypto/enc_provider/des3.c
+++ b/src/lib/crypto/enc_provider/des3.c
@@ -27,7 +27,7 @@
 #include "k5-int.h"
 #include "des_int.h"
 
-static mit_des_cblock mit_des_zeroblock[8] = {0,0,0,0,0,0,0,0};
+static const mit_des_cblock mit_des_zeroblock[8] /* = all zero */;
 
 static void
 k5_des3_block_size(size_t *blocksize)
@@ -127,7 +127,7 @@ k5_des3_make_key(krb5_const krb5_data *randombits, krb5_keyblock *key)
     return(0);
 }
 
-struct krb5_enc_provider krb5_enc_des3 = {
+const struct krb5_enc_provider krb5_enc_des3 = {
     k5_des3_block_size,
     k5_des3_keysize,
     k5_des3_encrypt,
diff --git a/src/lib/crypto/enc_provider/enc_provider.h b/src/lib/crypto/enc_provider/enc_provider.h
index 1488112ea..c71bdbd44 100644
--- a/src/lib/crypto/enc_provider/enc_provider.h
+++ b/src/lib/crypto/enc_provider/enc_provider.h
@@ -26,7 +26,5 @@
 
 #include "k5-int.h"
 
-extern struct krb5_enc_provider krb5_enc_des;
-extern struct krb5_enc_provider krb5_enc_des3;
-
-
+extern const struct krb5_enc_provider krb5_enc_des;
+extern const struct krb5_enc_provider krb5_enc_des3;
diff --git a/src/lib/crypto/etypes.c b/src/lib/crypto/etypes.c
index fe4b71033..8a03766c7 100644
--- a/src/lib/crypto/etypes.c
+++ b/src/lib/crypto/etypes.c
@@ -38,7 +38,7 @@
    that the keytypes are all near each other.  I'd rather not make
    that assumption. */
 
-struct krb5_keytypes krb5_enctypes_list[] = {
+const struct krb5_keytypes krb5_enctypes_list[] = {
     { ENCTYPE_DES_CBC_CRC,
       "des-cbc-crc", "DES cbc mode with CRC-32",
       &krb5_enc_des, &krb5_hash_crc32,
@@ -106,5 +106,5 @@ struct krb5_keytypes krb5_enctypes_list[] = {
 #endif
 };
 
-int krb5_enctypes_length =
+const int krb5_enctypes_length =
 sizeof(krb5_enctypes_list)/sizeof(struct krb5_keytypes);
diff --git a/src/lib/crypto/etypes.h b/src/lib/crypto/etypes.h
index 53d8b655a..ca94e56ff 100644
--- a/src/lib/crypto/etypes.h
+++ b/src/lib/crypto/etypes.h
@@ -26,5 +26,5 @@
 
 #include "k5-int.h"
 
-extern struct krb5_keytypes krb5_enctypes_list[];
-extern int krb5_enctypes_length;
+extern const struct krb5_keytypes krb5_enctypes_list[];
+extern const int krb5_enctypes_length;
diff --git a/src/lib/crypto/hash_provider/ChangeLog b/src/lib/crypto/hash_provider/ChangeLog
index 195d1ea66..f2908f298 100644
--- a/src/lib/crypto/hash_provider/ChangeLog
+++ b/src/lib/crypto/hash_provider/ChangeLog
@@ -1,3 +1,11 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* hash_crc32.c (krb5_hash_crc32): Now const.
+	* hash_md4.c (krb5_hash_md4): Now const.
+	* hash_md5.c (krb5_hash_md5): Now const.
+	* hash_sha1.c (krb5_hash_sha1): Now const.
+	* hash_provider.h: Updated decls.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/hash_provider/hash_crc32.c b/src/lib/crypto/hash_provider/hash_crc32.c
index 7c30b3d10..4606ba2b5 100644
--- a/src/lib/crypto/hash_provider/hash_crc32.c
+++ b/src/lib/crypto/hash_provider/hash_crc32.c
@@ -64,7 +64,7 @@ k5_crc32_hash(unsigned int icount, krb5_const krb5_data *input,
     return(0);
 }
 
-struct krb5_hash_provider krb5_hash_crc32 = {
+const struct krb5_hash_provider krb5_hash_crc32 = {
     k5_crc32_hash_size,
     k5_crc32_block_size,
     k5_crc32_hash
diff --git a/src/lib/crypto/hash_provider/hash_md4.c b/src/lib/crypto/hash_provider/hash_md4.c
index bfce845a4..09afa53ad 100644
--- a/src/lib/crypto/hash_provider/hash_md4.c
+++ b/src/lib/crypto/hash_provider/hash_md4.c
@@ -60,7 +60,7 @@ k5_md4_hash(unsigned int icount, krb5_const krb5_data *input,
     return(0);
 }
 
-struct krb5_hash_provider krb5_hash_md4 = {
+const struct krb5_hash_provider krb5_hash_md4 = {
     k5_md4_hash_size,
     k5_md4_block_size,
     k5_md4_hash
diff --git a/src/lib/crypto/hash_provider/hash_md5.c b/src/lib/crypto/hash_provider/hash_md5.c
index 98f934001..c030cbfa1 100644
--- a/src/lib/crypto/hash_provider/hash_md5.c
+++ b/src/lib/crypto/hash_provider/hash_md5.c
@@ -60,7 +60,7 @@ k5_md5_hash(unsigned int icount, krb5_const krb5_data *input,
     return(0);
 }
 
-struct krb5_hash_provider krb5_hash_md5 = {
+const struct krb5_hash_provider krb5_hash_md5 = {
     k5_md5_hash_size,
     k5_md5_block_size,
     k5_md5_hash
diff --git a/src/lib/crypto/hash_provider/hash_provider.h b/src/lib/crypto/hash_provider/hash_provider.h
index d97e3c3ce..edf7b9d94 100644
--- a/src/lib/crypto/hash_provider/hash_provider.h
+++ b/src/lib/crypto/hash_provider/hash_provider.h
@@ -26,7 +26,7 @@
 
 #include "k5-int.h"
 
-extern struct krb5_hash_provider krb5_hash_crc32;
-extern struct krb5_hash_provider krb5_hash_md4;
-extern struct krb5_hash_provider krb5_hash_md5;
-extern struct krb5_hash_provider krb5_hash_sha1;
+extern const struct krb5_hash_provider krb5_hash_crc32;
+extern const struct krb5_hash_provider krb5_hash_md4;
+extern const struct krb5_hash_provider krb5_hash_md5;
+extern const struct krb5_hash_provider krb5_hash_sha1;
diff --git a/src/lib/crypto/hash_provider/hash_sha1.c b/src/lib/crypto/hash_provider/hash_sha1.c
index a7b886d5a..b430dfd9c 100644
--- a/src/lib/crypto/hash_provider/hash_sha1.c
+++ b/src/lib/crypto/hash_provider/hash_sha1.c
@@ -65,7 +65,7 @@ k5_sha1_hash(unsigned int icount, krb5_const krb5_data *input,
     return(0);
 }
 
-struct krb5_hash_provider krb5_hash_sha1 = {
+const struct krb5_hash_provider krb5_hash_sha1 = {
     k5_sha1_hash_size,
     k5_sha1_block_size,
     k5_sha1_hash
diff --git a/src/lib/crypto/hmac.c b/src/lib/crypto/hmac.c
index 7cf11a6c7..013e4eeae 100644
--- a/src/lib/crypto/hmac.c
+++ b/src/lib/crypto/hmac.c
@@ -96,7 +96,7 @@ krb5_hmac(hash, key, icount, input, output)
     hashout.length = hashsize;
     hashout.data = ihash;
 
-    if (ret = ((*(hash->hash))(icount+1, hashin, &hashout)))
+    if ((ret = ((*(hash->hash))(icount+1, hashin, &hashout))))
 	goto cleanup;
 
     /* create the outer padded key */
@@ -114,7 +114,7 @@ krb5_hmac(hash, key, icount, input, output)
 
     output->length = hashsize;
 
-    if (ret = ((*(hash->hash))(2, hashin, output)))
+    if ((ret = ((*(hash->hash))(2, hashin, output))))
 	memset(output->data, 0, output->length);
 
     /* ret is set correctly by the prior call */
diff --git a/src/lib/crypto/keyhash_provider/ChangeLog b/src/lib/crypto/keyhash_provider/ChangeLog
index 9fcdcada3..bfa5ba8b8 100644
--- a/src/lib/crypto/keyhash_provider/ChangeLog
+++ b/src/lib/crypto/keyhash_provider/ChangeLog
@@ -1,3 +1,22 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* descbc.c (mit_des_zeroblock): Now const, and using C default
+	initializer.
+	(krb5_keyhash_descbc): Now const.
+	* k5_md4des.c (mit_des_zeroblock): Now const, and using C default
+	initializer.
+	(k5_md4des_hash): Change if(a=b) constructs to silence gcc
+	warnings.
+	(k5_md4des_verify): Delete unused variable.
+	(krb5_keyhash_md4des): Now const.
+	* k5_md5des.c (mit_des_zeroblock): Now const, and using C default
+	initializer.
+	(k5_md5des_hash): Change if(a=b) constructs to silence gcc
+	warnings.
+	(k5_md5des_verify): Delete unused variable.
+	(krb5_keyhash_md5des): Now const.
+	* keyhash_provider.h: Updated krb5_keyhash_* decls.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/keyhash_provider/descbc.c b/src/lib/crypto/keyhash_provider/descbc.c
index 3258cb3b4..de9f8cb47 100644
--- a/src/lib/crypto/keyhash_provider/descbc.c
+++ b/src/lib/crypto/keyhash_provider/descbc.c
@@ -28,7 +28,7 @@
 #include "des_int.h"
 #include "keyhash_provider.h"
 
-static mit_des_cblock mit_des_zeroblock[8] = {0,0,0,0,0,0,0,0};
+static const mit_des_cblock mit_des_zeroblock[8] /* = all zero */;
 
 static void
 k5_descbc_hash_size(size_t *output)
@@ -69,7 +69,7 @@ k5_descbc_hash(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
     return(0);
 }
 
-struct krb5_keyhash_provider krb5_keyhash_descbc = {
+const struct krb5_keyhash_provider krb5_keyhash_descbc = {
     k5_descbc_hash_size,
     k5_descbc_hash,
     NULL
diff --git a/src/lib/crypto/keyhash_provider/k5_md4des.c b/src/lib/crypto/keyhash_provider/k5_md4des.c
index 26e34030d..7cefa98c3 100644
--- a/src/lib/crypto/keyhash_provider/k5_md4des.c
+++ b/src/lib/crypto/keyhash_provider/k5_md4des.c
@@ -34,7 +34,7 @@
 /* Force acceptance of krb5-beta5 md4des checksum for now. */
 #define KRB5_MD4DES_BETA5_COMPAT
 
-static mit_des_cblock mit_des_zeroblock[8] = {0,0,0,0,0,0,0,0};
+static const mit_des_cblock mit_des_zeroblock[8] /* = all zero */;
 
 static void
 k5_md4des_hash_size(size_t *output)
@@ -70,7 +70,7 @@ k5_md4des_hash(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
 
     data.length = CONFLENGTH;
     data.data = conf;
-    if (ret = krb5_c_random_make_octets(/* XXX */ 0, &data))
+    if ((ret = krb5_c_random_make_octets(/* XXX */ 0, &data)))
 	return(ret);
 
     /* create and schedule the encryption key */
@@ -114,7 +114,6 @@ k5_md4des_verify(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
 		 krb5_boolean *valid)
 {
     krb5_error_code ret;
-    krb5_data data;
     krb5_MD4_CTX ctx;
     unsigned char plaintext[CONFLENGTH+RSA_MD4_CKSUM_LENGTH];
     unsigned char xorkey[8];
@@ -190,7 +189,7 @@ k5_md4des_verify(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
     return(0);
 }
 
-struct krb5_keyhash_provider krb5_keyhash_md4des = {
+const struct krb5_keyhash_provider krb5_keyhash_md4des = {
     k5_md4des_hash_size,
     k5_md4des_hash,
     k5_md4des_verify
diff --git a/src/lib/crypto/keyhash_provider/k5_md5des.c b/src/lib/crypto/keyhash_provider/k5_md5des.c
index d1ac65710..788613904 100644
--- a/src/lib/crypto/keyhash_provider/k5_md5des.c
+++ b/src/lib/crypto/keyhash_provider/k5_md5des.c
@@ -34,7 +34,7 @@
 /* Force acceptance of krb5-beta5 md5des checksum for now. */
 #define KRB5_MD5DES_BETA5_COMPAT
 
-static mit_des_cblock mit_des_zeroblock[8] = {0,0,0,0,0,0,0,0};
+static const mit_des_cblock mit_des_zeroblock[8] /* = all zero */;
 
 static void
 k5_md5des_hash_size(size_t *output)
@@ -70,7 +70,7 @@ k5_md5des_hash(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
 
     data.length = CONFLENGTH;
     data.data = conf;
-    if (ret = krb5_c_random_make_octets(/* XXX */ 0, &data))
+    if ((ret = krb5_c_random_make_octets(/* XXX */ 0, &data)))
 	return(ret);
 
     /* create and schedule the encryption key */
@@ -114,7 +114,6 @@ k5_md5des_verify(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
 		 krb5_boolean *valid)
 {
     krb5_error_code ret;
-    krb5_data data;
     krb5_MD5_CTX ctx;
     unsigned char plaintext[CONFLENGTH+RSA_MD5_CKSUM_LENGTH];
     unsigned char xorkey[8];
@@ -188,7 +187,7 @@ k5_md5des_verify(krb5_const krb5_keyblock *key, krb5_const krb5_data *ivec,
     return(0);
 }
 
-struct krb5_keyhash_provider krb5_keyhash_md5des = {
+const struct krb5_keyhash_provider krb5_keyhash_md5des = {
     k5_md5des_hash_size,
     k5_md5des_hash,
     k5_md5des_verify
diff --git a/src/lib/crypto/keyhash_provider/keyhash_provider.h b/src/lib/crypto/keyhash_provider/keyhash_provider.h
index 12ace4432..6ccdde8cb 100644
--- a/src/lib/crypto/keyhash_provider/keyhash_provider.h
+++ b/src/lib/crypto/keyhash_provider/keyhash_provider.h
@@ -26,6 +26,6 @@
 
 #include "k5-int.h"
 
-extern struct krb5_keyhash_provider krb5_keyhash_descbc;
-extern struct krb5_keyhash_provider krb5_keyhash_md4des;
-extern struct krb5_keyhash_provider krb5_keyhash_md5des;
+extern const struct krb5_keyhash_provider krb5_keyhash_descbc;
+extern const struct krb5_keyhash_provider krb5_keyhash_md4des;
+extern const struct krb5_keyhash_provider krb5_keyhash_md5des;
diff --git a/src/lib/crypto/make_checksum.c b/src/lib/crypto/make_checksum.c
index 2c3947536..300f37535 100644
--- a/src/lib/crypto/make_checksum.c
+++ b/src/lib/crypto/make_checksum.c
@@ -27,6 +27,7 @@
 #include "k5-int.h"
 #include "cksumtypes.h"
 #include "etypes.h"
+#include "dk.h"
 
 KRB5_DLLIMP krb5_error_code KRB5_CALLCONV
 krb5_c_make_checksum(context, cksumtype, key, usage, input, cksum)
diff --git a/src/lib/crypto/make_random_key.c b/src/lib/crypto/make_random_key.c
index 391f56dfc..a4c3a6003 100644
--- a/src/lib/crypto/make_random_key.c
+++ b/src/lib/crypto/make_random_key.c
@@ -35,7 +35,7 @@ krb5_c_make_random_key(context, enctype, random_key)
 {
     int i;
     krb5_error_code ret;
-    struct krb5_enc_provider *enc;
+    const struct krb5_enc_provider *enc;
     size_t keybytes, keylength;
     krb5_data random;
     unsigned char *bytes;
@@ -62,7 +62,7 @@ krb5_c_make_random_key(context, enctype, random_key)
     random.data = bytes;
     random.length = keybytes;
 
-    if (ret = krb5_c_random_make_octets(context, &random))
+    if ((ret = krb5_c_random_make_octets(context, &random)))
 	goto cleanup;
 
     random_key->magic = KV5M_KEYBLOCK;
diff --git a/src/lib/crypto/md4/ChangeLog b/src/lib/crypto/md4/ChangeLog
index 2b40477f2..0c8a66b40 100644
--- a/src/lib/crypto/md4/ChangeLog
+++ b/src/lib/crypto/md4/ChangeLog
@@ -1,3 +1,10 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* md4.c (PADDING): Now const.
+	(krb5_MD4Update): Argument inBuf now points to const.
+	(ROTATE_LEFT): Change (a&b|c) construct to silence gcc warning.
+	* rsa-md4.h (krb5_MD4Update): Update decl.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/md4/md4.c b/src/lib/crypto/md4/md4.c
index fbfd25625..bedd84bcb 100644
--- a/src/lib/crypto/md4/md4.c
+++ b/src/lib/crypto/md4/md4.c
@@ -51,7 +51,7 @@ static void Transform (krb5_ui_4 FAR *, krb5_ui_4 FAR *);
 static void Transform ();
 #endif
 
-static unsigned char PADDING[64] = {
+static const unsigned char PADDING[64] = {
   0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -68,7 +68,7 @@ static unsigned char PADDING[64] = {
 #define H(x, y, z) ((x) ^ (y) ^ (z))
 
 /* ROTATE_LEFT rotates x left n bits */
-#define ROTATE_LEFT(x, n) (((x) << (n)) & 0xffffffff | ((x) >> (32-(n))))
+#define ROTATE_LEFT(x, n) ((((x) << (n)) & 0xffffffff) | ((x) >> (32-(n))))
 
 /* FF, GG and HH are MD4 transformations for rounds 1, 2 and 3 */
 /* Rotation is separate from addition to prevent recomputation */
@@ -102,7 +102,7 @@ krb5_MD4_CTX FAR *mdContext;
 void
 krb5_MD4Update (mdContext, inBuf, inLen)
 krb5_MD4_CTX FAR *mdContext;
-unsigned char FAR *inBuf;
+const unsigned char FAR *inBuf;
 unsigned int inLen;
 {
   krb5_ui_4 in[16];
diff --git a/src/lib/crypto/md4/rsa-md4.h b/src/lib/crypto/md4/rsa-md4.h
index 0970dcbae..5b331e8f4 100644
--- a/src/lib/crypto/md4/rsa-md4.h
+++ b/src/lib/crypto/md4/rsa-md4.h
@@ -88,7 +88,7 @@ typedef struct {
 
 #if defined(__STDC__) || defined(_MSDOS) || defined(_WIN32)
 extern void krb5_MD4Init(krb5_MD4_CTX FAR *);
-extern void krb5_MD4Update(krb5_MD4_CTX FAR *, unsigned char FAR *, unsigned int);
+extern void krb5_MD4Update(krb5_MD4_CTX FAR *, const unsigned char FAR *, unsigned int);
 extern void krb5_MD4Final(krb5_MD4_CTX FAR *);
 #else
 void krb5_MD4Init ();
diff --git a/src/lib/crypto/md5/ChangeLog b/src/lib/crypto/md5/ChangeLog
index 6d421ac83..a812839f7 100644
--- a/src/lib/crypto/md5/ChangeLog
+++ b/src/lib/crypto/md5/ChangeLog
@@ -1,3 +1,10 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* md5.c (PADDING): Now const.
+	(krb5_MD5Update): Argument inBuf now points to const.
+	(ROTATE_LEFT): Change (a&b|c) construct to silence gcc warning.
+	* rsa-md5.h (krb5_MD5Update): Update decl.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/md5/md5.c b/src/lib/crypto/md5/md5.c
index 95efb77e4..d480d7e09 100644
--- a/src/lib/crypto/md5/md5.c
+++ b/src/lib/crypto/md5/md5.c
@@ -58,7 +58,7 @@
 /* forward declaration */
 static void Transform KRB5_PROTOTYPE((krb5_ui_4 FAR *buf, krb5_ui_4 FAR *in));
 
-static unsigned char PADDING[64] = {
+static const unsigned char PADDING[64] = {
   0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -76,7 +76,7 @@ static unsigned char PADDING[64] = {
 #define I(x, y, z) ((y) ^ ((x) | (~z)))
 
 /* ROTATE_LEFT rotates x left n bits */
-#define ROTATE_LEFT(x, n) (((x) << (n)) & 0xffffffff | ((x) >> (32-(n))))
+#define ROTATE_LEFT(x, n) ((((x) << (n)) & 0xffffffff) | ((x) >> (32-(n))))
 
 /* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4 */
 /* Rotation is separate from addition to prevent recomputation */
@@ -133,7 +133,7 @@ krb5_MD5_CTX FAR *mdContext;
 void
 krb5_MD5Update (mdContext, inBuf, inLen)
 krb5_MD5_CTX FAR *mdContext;
-unsigned char FAR *inBuf;
+const unsigned char FAR *inBuf;
 unsigned int inLen;
 {
   krb5_ui_4 in[16];
diff --git a/src/lib/crypto/md5/rsa-md5.h b/src/lib/crypto/md5/rsa-md5.h
index 9c799da32..484830c55 100644
--- a/src/lib/crypto/md5/rsa-md5.h
+++ b/src/lib/crypto/md5/rsa-md5.h
@@ -50,7 +50,7 @@ typedef struct {
 
 #if (defined(__STDC__) || defined(_MSDOS) || defined(_WIN32)) && !defined(KRB5_NO_PROTOTYPES)
 extern void krb5_MD5Init(krb5_MD5_CTX FAR *);
-extern void krb5_MD5Update(krb5_MD5_CTX FAR *,unsigned char FAR *,unsigned int);
+extern void krb5_MD5Update(krb5_MD5_CTX FAR *,const unsigned char FAR *,unsigned int);
 extern void krb5_MD5Final(krb5_MD5_CTX FAR *);
 #else
 extern void krb5_MD5Init();
diff --git a/src/lib/crypto/nfold.c b/src/lib/crypto/nfold.c
index 07c539ebe..3b1f5a0fd 100644
--- a/src/lib/crypto/nfold.c
+++ b/src/lib/crypto/nfold.c
@@ -50,8 +50,7 @@ krb5_nfold(inbits, in, outbits, out)
      int outbits;
      unsigned char *out;
 {
-    int a,b,c,gcd,lcm;
-    int reps;
+    int a,b,c,lcm;
     int byte, i, msbit;
 
     /* the code below is more readable if I make these bytes
diff --git a/src/lib/crypto/old/ChangeLog b/src/lib/crypto/old/ChangeLog
index ba4eadfd6..cada47302 100644
--- a/src/lib/crypto/old/ChangeLog
+++ b/src/lib/crypto/old/ChangeLog
@@ -1,3 +1,11 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* des_stringtokey.c (mit_des_string_to_key_int): Declare.
+	* old_decrypt.c (krb5_old_decrypt): Delete unused variable.
+	Change if(a=b) constructs to silence gcc warning.
+	* old_encrypt.c (krb5_old_encrypt): Change if(a=b) constructs to
+	silence gcc warning.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/old/des_stringtokey.c b/src/lib/crypto/old/des_stringtokey.c
index ed2b7339a..8aaac792e 100644
--- a/src/lib/crypto/old/des_stringtokey.c
+++ b/src/lib/crypto/old/des_stringtokey.c
@@ -27,6 +27,12 @@
 #include "k5-int.h"
 #include "old.h"
 
+/* XXX */
+extern krb5_error_code mit_des_string_to_key_int
+KRB5_PROTOTYPE ((krb5_keyblock FAR * keyblock,
+		 const krb5_data FAR * data,
+		 const krb5_data FAR * salt));
+
 krb5_error_code
 krb5_des_string_to_key(enc, string, salt, key)
      krb5_const struct krb5_enc_provider *enc;
diff --git a/src/lib/crypto/old/old_decrypt.c b/src/lib/crypto/old/old_decrypt.c
index 2d22648e2..1bcb0d38b 100644
--- a/src/lib/crypto/old/old_decrypt.c
+++ b/src/lib/crypto/old/old_decrypt.c
@@ -45,7 +45,7 @@ krb5_old_decrypt(enc, hash, key, usage, ivec, input, arg_output)
 {
     krb5_error_code ret;
     size_t blocksize, hashsize, plainsize;
-    unsigned char *plaintext, *cksumdata;
+    unsigned char *cksumdata;
     krb5_data output, cksum, crcivec;
     int alloced;
 
@@ -89,7 +89,7 @@ krb5_old_decrypt(enc, hash, key, usage, ivec, input, arg_output)
 	ivec = &crcivec;
     }
 
-    if (ret = ((*(enc->decrypt))(key, ivec, input, &output)))
+    if ((ret = ((*(enc->decrypt))(key, ivec, input, &output))))
 	goto cleanup;
 
     /* verify the checksum */
@@ -100,7 +100,7 @@ krb5_old_decrypt(enc, hash, key, usage, ivec, input, arg_output)
     cksum.length = hashsize;
     cksum.data = output.data+blocksize;
 
-    if (ret = ((*(hash->hash))(1, &output, &cksum)))
+    if ((ret = ((*(hash->hash))(1, &output, &cksum))))
 	goto cleanup;
 
     if (memcmp(cksum.data, cksumdata, cksum.length) != 0) {
@@ -131,4 +131,3 @@ cleanup:
     free(cksumdata);
     return(ret);
 }
-
diff --git a/src/lib/crypto/old/old_encrypt.c b/src/lib/crypto/old/old_encrypt.c
index 9470d8a06..d90d0f885 100644
--- a/src/lib/crypto/old/old_encrypt.c
+++ b/src/lib/crypto/old/old_encrypt.c
@@ -73,7 +73,7 @@ krb5_old_encrypt(enc, hash, key, usage, ivec, input, output)
     datain.length = blocksize;
     datain.data = output->data;
 
-    if (ret = krb5_c_random_make_octets(/* XXX */ 0, &datain))
+    if ((ret = krb5_c_random_make_octets(/* XXX */ 0, &datain)))
 	return(ret);
     memcpy(output->data+blocksize+hashsize, input->data, input->length);
 
@@ -82,7 +82,7 @@ krb5_old_encrypt(enc, hash, key, usage, ivec, input, output)
     datain.length = hashsize;
     datain.data = output->data+blocksize;
 
-    if (ret = ((*(hash->hash))(1, output, &datain)))
+    if ((ret = ((*(hash->hash))(1, output, &datain))))
 	goto cleanup;
 
     /* encrypt it */
@@ -94,7 +94,7 @@ krb5_old_encrypt(enc, hash, key, usage, ivec, input, output)
 	ivec = &crcivec;
     }
 
-    if (ret = ((*(enc->encrypt))(key, ivec, output, output)))
+    if ((ret = ((*(enc->encrypt))(key, ivec, output, output))))
 	goto cleanup;
 
 cleanup:
diff --git a/src/lib/crypto/old_api_glue.c b/src/lib/crypto/old_api_glue.c
index ff8921a75..429307e6f 100644
--- a/src/lib/crypto/old_api_glue.c
+++ b/src/lib/crypto/old_api_glue.c
@@ -41,7 +41,7 @@ krb5_encrypt(context, inptr, outptr, size, eblock, ivec)
     krb5_error_code ret;
 
     if (ivec) {
-	if (ret = krb5_c_block_size(context, eblock->key->enctype, &blocksize))
+	if ((ret = krb5_c_block_size(context, eblock->key->enctype, &blocksize)))
 	    return(ret);
 
 	ivecd.length = blocksize;
@@ -54,8 +54,8 @@ krb5_encrypt(context, inptr, outptr, size, eblock, ivec)
 
     /* The size of the output buffer isn't part of the old api.  Not too
        safe.  So, we assume here that it's big enough. */
-    if (ret = krb5_c_encrypt_length(context, eblock->key->enctype, size,
-				    &outlen))
+    if ((ret = krb5_c_encrypt_length(context, eblock->key->enctype, size,
+				     &outlen)))
 	return(ret);
 
     outputd.ciphertext.length = outlen;
@@ -80,7 +80,7 @@ krb5_decrypt(context, inptr, outptr, size, eblock, ivec)
     krb5_error_code ret;
 
     if (ivec) {
-	if (ret = krb5_c_block_size(context, eblock->key->enctype, &blocksize))
+	if ((ret = krb5_c_block_size(context, eblock->key->enctype, &blocksize)))
 	    return(ret);
 
 	ivecd.length = blocksize;
@@ -170,7 +170,7 @@ krb5_random_key(context, eblock, ptr, keyblock)
     if ((key = (krb5_keyblock *) malloc(sizeof(krb5_keyblock))) == NULL)
 	return(ENOMEM);
 
-    if (ret = krb5_c_make_random_key(context, eblock->crypto_entry, key))
+    if ((ret = krb5_c_make_random_key(context, eblock->crypto_entry, key)))
 	free(key);
 
     *keyblock = key;
@@ -245,7 +245,7 @@ krb5_calculate_checksum(context, ctype, in, in_length,
     key.length = seed_length;
     key.contents = seed;
 
-    if (ret = krb5_c_make_checksum(context, ctype, &key, 0, &input, &cksum))
+    if ((ret = krb5_c_make_checksum(context, ctype, &key, 0, &input, &cksum)))
 	return(ret);
 
     if (outcksum->length < cksum.length) {
@@ -286,8 +286,8 @@ krb5_verify_checksum(context, ctype, cksum, in, in_length,
     key.length = seed_length;
     key.contents = seed;
 
-    if (ret = krb5_c_verify_checksum(context, &key, 0, &input, cksum,
-				     &valid))
+    if ((ret = krb5_c_verify_checksum(context, &key, 0, &input, cksum,
+				      &valid)))
 	return(ret);
 
     if (!valid)
@@ -320,12 +320,12 @@ krb5_error_code krb5_encrypt_data(context, key, ivec, data, enc_data)
     size_t enclen, blocksize;
     krb5_data ivecd;
 
-    if (ret = krb5_c_encrypt_length(context, key->enctype, data->length,
-				    &enclen))
+    if ((ret = krb5_c_encrypt_length(context, key->enctype, data->length,
+				     &enclen)))
 	return(ret);
 
     if (ivec) {
-	if (ret = krb5_c_block_size(context, key->enctype, &blocksize))
+	if ((ret = krb5_c_block_size(context, key->enctype, &blocksize)))
 	    return(ret);
 
 	ivecd.length = blocksize;
@@ -339,7 +339,7 @@ krb5_error_code krb5_encrypt_data(context, key, ivec, data, enc_data)
     if ((enc_data->ciphertext.data = malloc(enclen)) == NULL)
 	return(ENOMEM);
 
-    if (ret = krb5_c_encrypt(context, key, 0, ivec?&ivecd:0, data, enc_data))
+    if ((ret = krb5_c_encrypt(context, key, 0, ivec?&ivecd:0, data, enc_data)))
 	free(enc_data->ciphertext.data);
 
     return(ret);
@@ -357,7 +357,7 @@ krb5_error_code krb5_decrypt_data(context, key, ivec, enc_data, data)
     size_t blocksize;
 
     if (ivec) {
-	if (ret = krb5_c_block_size(context, key->enctype, &blocksize))
+	if ((ret = krb5_c_block_size(context, key->enctype, &blocksize)))
 	    return(ret);
 
 	ivecd.length = blocksize;
@@ -368,7 +368,7 @@ krb5_error_code krb5_decrypt_data(context, key, ivec, enc_data, data)
     if ((data->data = (krb5_octet *) malloc(data->length)) == NULL)
 	return(ENOMEM);
 
-    if (ret = krb5_c_decrypt(context, key, 0, ivec?&ivecd:0, enc_data, data))
+    if ((ret = krb5_c_decrypt(context, key, 0, ivec?&ivecd:0, enc_data, data)))
 	free(data->data);
 
     return(0);
diff --git a/src/lib/crypto/prng.c b/src/lib/crypto/prng.c
index d86d81512..c0f106f0a 100644
--- a/src/lib/crypto/prng.c
+++ b/src/lib/crypto/prng.c
@@ -118,7 +118,7 @@ krb5_c_random_make_octets(krb5_context context, krb5_data *data)
 	    key.contents = KEYCONTENTS;
 
 	    /* fill it in */
-	    if (ret = ((*(enc->make_key))(&data1, &key)))
+	    if ((ret = ((*(enc->make_key))(&data1, &key))))
 		return(ret);
 
 	    /* encrypt the block */
@@ -126,7 +126,7 @@ krb5_c_random_make_octets(krb5_context context, krb5_data *data)
 	    data1.data = STATEBLOCK;
 	    data2.length = blocksize;
 	    data2.data = RANDBLOCK;
-	    if (ret = ((*(enc->encrypt))(&key, NULL, &data1, &data2)))
+	    if ((ret = ((*(enc->encrypt))(&key, NULL, &data1, &data2))))
 		return(ret);
 
 	    /* fold the new output back into the state */
diff --git a/src/lib/crypto/sha1/ChangeLog b/src/lib/crypto/sha1/ChangeLog
index 938307da1..a6a00f3fa 100644
--- a/src/lib/crypto/sha1/ChangeLog
+++ b/src/lib/crypto/sha1/ChangeLog
@@ -1,3 +1,10 @@
+2000-01-21  Ken Raeburn  <raeburn@mit.edu>
+
+	* shs.c (ROTL): Change (a&b|c) construct to make meaning clear,
+	and silence gcc warning.
+	(longReverse): Delete unused function.
+	(shsFinal): Delete unused variable.
+
 1999-10-26  Tom Yu  <tlyu@mit.edu>
 
 	* Makefile.in: Clean up usage of CFLAGS, CPPFLAGS, DEFS, DEFINES,
diff --git a/src/lib/crypto/sha1/shs.c b/src/lib/crypto/sha1/shs.c
index a5b5a53d5..358e6ba32 100644
--- a/src/lib/crypto/sha1/shs.c
+++ b/src/lib/crypto/sha1/shs.c
@@ -33,7 +33,7 @@
 
 /* 32-bit rotate left - kludged with shifts */
 
-#define ROTL(n,X)  (((X) << (n)) & 0xffffffff | ((X) >> (32 - n)))
+#define ROTL(n,X)  ((((X) << (n)) & 0xffffffff) | ((X) >> (32 - n)))
 
 /* The initial expanding function.  The hash function is defined over an
    80-word expanded input array W, where the first 16 are copies of the input
@@ -213,41 +213,6 @@ void SHSTransform(digest, data)
     digest[ 4 ] &= 0xffffffff;
 }
 
-/* When run on a little-endian CPU we need to perform byte reversal on an
-   array of longwords.  It is possible to make the code endianness-
-   independant by fiddling around with data at the byte level, but this
-   makes for very slow code, so we rely on the user to sort out endianness
-   at compile time */
-
-void longReverse( LONG *buffer, int byteCount )
-{
-    LONG value;
-    static int init = 0;
-    char *cp;
-
-    switch (init) {
-    case 0:
-	init=1;
-	cp = (char *) &init;
-	if (*cp == 1) {
-	    init=2;
-	    break;
-	}
-	init=1;
-	/* fall through - MSB */
-    case 1:
-	return;
-    }
-
-    byteCount /= sizeof( LONG );
-    while( byteCount-- ) {
-        value = *buffer;
-        value = ( ( value & 0xFF00FF00L ) >> 8  ) | 
-                ( ( value & 0x00FF00FFL ) << 8 );
-        *buffer++ = ( value << 16 ) | ( value >> 16 );
-    }
-}
-
 /* Update SHS for a block of data */
 
 void shsUpdate(shsInfo, buffer, count)
@@ -353,7 +318,6 @@ void shsFinal(shsInfo)
 {
     int count;
     LONG *lp;
-    BYTE *dataPtr;
 
     /* Compute number of bytes mod 64 */
     count = (int) shsInfo->countLo;
diff --git a/src/lib/crypto/string_to_key.c b/src/lib/crypto/string_to_key.c
index a569e4954..c9a3d33e9 100644
--- a/src/lib/crypto/string_to_key.c
+++ b/src/lib/crypto/string_to_key.c
@@ -37,7 +37,7 @@ krb5_c_string_to_key(context, enctype, string, salt, key)
 {
     int i;
     krb5_error_code ret;
-    struct krb5_enc_provider *enc;
+    const struct krb5_enc_provider *enc;
     size_t keybytes, keylength;
 
     for (i=0; i<krb5_enctypes_length; i++) {
@@ -59,7 +59,7 @@ krb5_c_string_to_key(context, enctype, string, salt, key)
     key->enctype = enctype;
     key->length = keylength;
 
-    if (ret = ((*(krb5_enctypes_list[i].str2key))(enc, string, salt, key))) {
+    if ((ret = ((*(krb5_enctypes_list[i].str2key))(enc, string, salt, key)))) {
 	memset(key->contents, 0, keylength);
 	free(key->contents);
     }
diff --git a/src/lib/crypto/verify_checksum.c b/src/lib/crypto/verify_checksum.c
index c25e921a8..c54007b40 100644
--- a/src/lib/crypto/verify_checksum.c
+++ b/src/lib/crypto/verify_checksum.c
@@ -62,7 +62,7 @@ krb5_c_verify_checksum(context, key, usage, data, cksum, valid)
 
     /* otherwise, make the checksum again, and compare */
 
-    if (ret = krb5_c_checksum_length(context, cksum->checksum_type, &hashsize))
+    if ((ret = krb5_c_checksum_length(context, cksum->checksum_type, &hashsize)))
 	return(ret);
 
     if (cksum->length != hashsize)
@@ -70,8 +70,8 @@ krb5_c_verify_checksum(context, key, usage, data, cksum, valid)
 
     computed.length = hashsize;
 
-    if (ret = krb5_c_make_checksum(context, cksum->checksum_type, key, usage,
-				   data, &computed)) {
+    if ((ret = krb5_c_make_checksum(context, cksum->checksum_type, key, usage,
+				   data, &computed))) {
 	free(computed.contents);
 	return(ret);
     }
-- 
2.26.2