krb5/persistent_keyring.patch

Pared down from the git commits, with a local copy of k5memdup0() added in
to cc_keyring, and a wrapper 'run' in to k5test.py.

diff --git a/src/aclocal.m4 b/src/aclocal.m4
index 2c17e46..7be77c2 100644
--- a/src/aclocal.m4
+++ b/src/aclocal.m4
@@ -89,6 +89,7 @@ KRB5_AC_INITFINI
 KRB5_AC_ENABLE_THREADS
 KRB5_AC_FIND_DLOPEN
 KRB5_AC_KEYRING_CCACHE
+KRB5_AC_PERSISTENT_KEYRING
 ])dnl
 
 dnl Maintainer mode, akin to what automake provides, 'cept we don't
@@ -1664,3 +1659,12 @@ AC_DEFUN(KRB5_AC_KEYRING_CCACHE,[
       ]))
 ])dnl
 dnl
+dnl If libkeyutils supports persistent keyrings, use them
+AC_DEFUN(KRB5_AC_PERSISTENT_KEYRING,[
+  AC_CHECK_HEADERS([keyutils.h],
+    AC_CHECK_LIB(keyutils, keyctl_get_persistent,
+      [AC_DEFINE(HAVE_PERSISTENT_KEYRING, 1,
+                 [Define if persistent keyrings are supported])
+      ]))
+])dnl
+dnl
diff --git a/src/lib/krb5/error_tables/k5e1_err.et b/src/lib/krb5/error_tables/k5e1_err.et
index 98374ed..071b7f2 100644
--- a/src/lib/krb5/error_tables/k5e1_err.et
+++ b/src/lib/krb5/error_tables/k5e1_err.et
@@ -35,4 +35,7 @@ error_code KRB5_PLUGIN_BAD_MODULE_SPEC, "Invalid module specifier"
 error_code KRB5_PLUGIN_NAME_NOTFOUND, "Plugin module name not found"
 error_code KRB5KDC_ERR_DISCARD, "The KDC should discard this request"
 error_code KRB5_DCC_CANNOT_CREATE, "Can't create new subsidiary cache"
+error_code KRB5_KCC_INVALID_ANCHOR, "Invalid keyring anchor name"
+error_code KRB5_KCC_UNKNOWN_VERSION, "Unknown keyring collection version"
+error_code KRB5_KCC_INVALID_UID, "Invalid UID in persistent keyring name"
 end
diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c
index fd1bcec..795ccd6 100644
--- a/src/lib/krb5/ccache/cc_keyring.c
+++ b/src/lib/krb5/ccache/cc_keyring.c
@@ -56,17 +56,42 @@
  */
 
 /*
- * Implementation of a credentials cache stored in the Linux keyring facility
+ * This file implements a collection-enabled credential cache type where the
+ * credentials are stored in the Linux keyring facility.
  *
- * Some assumptions:
+ * A residual of this type can have three forms:
+ *    anchor:collection:subsidiary
+ *    anchor:collection
+ *    collection
  *
- *      - A credentials cache "file" == a keyring with separate keys
- *        for the information in the ccache (see below)
- *      - A credentials cache keyring will contain only keys,
- *        not other keyrings
- *      - Each Kerberos ticket will have its own key within the ccache keyring
- *      - The principal information for the ccache is stored in a
- *        special key, which is not counted in the 'numkeys' count
+ * The anchor name is "process", "thread", or "legacy" and determines where we
+ * search for keyring collections.  In the third form, the anchor name is
+ * presumed to be "legacy".  The anchor keyring for legacy caches is the
+ * session keyring.
+ *
+ * If the subsidiary name is present, the residual identifies a single cache
+ * within a collection.  Otherwise, the residual identifies the collection
+ * itself.  When a residual identifying a collection is resolved, the
+ * collection's primary key is looked up (or initialized, using the collection
+ * name as the subsidiary name), and the resulting cache's name will use the
+ * first name form and will identify the primary cache.
+ *
+ * Keyring collections are named "_krb_<collection>" and are linked from the
+ * anchor keyring.  The keys within a keyring collection are links to cache
+ * keyrings, plus a link to one user key named "krb_ccache:primary" which
+ * contains a serialized representation of the collection version (currently 1)
+ * and the primary name of the collection.
+ *
+ * Cache keyrings contain one user key per credential which contains a
+ * serialized representation of the credential.  There is also one user key
+ * named "__krb5_princ__" which contains a serialized representation of the
+ * cache's default principal.
+ *
+ * If the anchor name is "legacy", then the initial primary cache (the one
+ * named with the collection name) is also linked to the session keyring, and
+ * we look for a cache in that location when initializing the collection.  This
+ * extra link allows that cache to be visible to old versions of the KEYRING
+ * cache type, and allows us to see caches created by that code.
  */
 
 #include "cc-int.h"
@@ -101,7 +126,20 @@ debug_print(char *fmt, ...)
 #endif
 
 /*
- * We always use "user" key type
+ * We try to use the big_key key type for credentials except in legacy caches.
+ * We fall back to the user key type if the kernel does not support big_key.
+ * If the library doesn't support keyctl_get_persistent(), we don't even try
+ * big_key since the two features were added at the same time.
+ */
+#ifdef HAVE_PERSISTENT_KEYRING
+#define KRCC_CRED_KEY_TYPE "big_key"
+#else
+#define KRCC_CRED_KEY_TYPE "user"
+#endif
+
+/*
+ * We use the "user" key type for collection primary names, for cache principal
+ * names, and for credentials in legacy caches.
  */
 #define KRCC_KEY_TYPE_USER "user"
 
@@ -117,20 +155,6 @@ debug_print(char *fmt, ...)
 #define KRCC_SPEC_PRINC_KEYNAME "__krb5_princ__"
 
 /*
- * XXX The following two really belong in some external
- * header since outside programs will need to use these
- * same names.
- */
-/*
- * Special name for key to communicate key serial numbers
- * This is used by the Linux gssd process to pass the
- * user's keyring values it gets in an upcall.
- * The format of the contents should be
- *    <session_key>:<process_key>:<thread_key>
- */
-#define KRCC_SPEC_IDS_KEYNAME "_gssd_keyring_ids_"
-
-/*
  * Special name for the key to communicate the name(s)
  * of credentials caches to be used for requests.
  * This should currently contain a single name, but
@@ -139,26 +163,55 @@ debug_print(char *fmt, ...)
  */
 #define KRCC_SPEC_CCACHE_SET_KEYNAME "__krb5_cc_set__"
 
+/*
+ * This name identifies the key containing the name of the current primary
+ * cache within a collection.
+ */
+#define KRCC_COLLECTION_PRIMARY "krb_ccache:primary"
+
+/*
+ * If the library context does not specify a keyring collection, unique ccaches
+ * will be created within this collection.
+ */
+#define KRCC_DEFAULT_UNIQUE_COLLECTION "session:__krb5_unique__"
+
+/*
+ * Collection keyring names begin with this prefix.  We use a prefix so that a
+ * cache keyring with the collection name itself can be linked directly into
+ * the anchor, for legacy session keyring compatibility.
+ */
+#define KRCC_CCCOL_PREFIX "_krb_"
+
+/*
+ * For the "persistent" anchor type, we look up or create this fixed keyring
+ * name within the per-UID persistent keyring.
+ */
+#define KRCC_PERSISTENT_KEYRING_NAME "_krb"
+
+/*
+ * Keyring name prefix and length of random name part
+ */
+#define KRCC_NAME_PREFIX "krb_ccache_"
+#define KRCC_NAME_RAND_CHARS 8
+
+#define KRCC_COLLECTION_VERSION 1
+
+#define KRCC_PERSISTENT_ANCHOR "persistent"
+#define KRCC_PROCESS_ANCHOR "process"
+#define KRCC_THREAD_ANCHOR "thread"
+#define KRCC_SESSION_ANCHOR "session"
+#define KRCC_USER_ANCHOR "user"
+#define KRCC_LEGACY_ANCHOR "legacy"
+
 #define KRB5_OK 0
 
 /* Hopefully big enough to hold a serialized credential */
-#define GUESS_CRED_SIZE 4096
-
-#define ALLOC(NUM,TYPE)                         \
-    (((NUM) <= (((size_t)0-1)/ sizeof(TYPE)))   \
-     ? (TYPE *) calloc((NUM), sizeof(TYPE))     \
-     : (errno = ENOMEM,(TYPE *) 0))
+#define MAX_CRED_SIZE (1024*1024)
 
 #define CHECK_N_GO(ret, errdest) if (ret != KRB5_OK) goto errdest
 #define CHECK(ret) if (ret != KRB5_OK) goto errout
 #define CHECK_OUT(ret) if (ret != KRB5_OK) return ret
 
-typedef struct krb5_krcc_ring_ids {
-    key_serial_t        session;
-    key_serial_t        process;
-    key_serial_t        thread;
-} krb5_krcc_ring_ids_t;
-
 typedef struct _krb5_krcc_cursor
 {
     int     numkeys;
@@ -169,7 +222,7 @@ typedef struct _krb5_krcc_cursor
 
 /*
  * This represents a credentials cache "file"
- * where ring_id is the keyring serial number for
+ * where cache_id is the keyring serial number for
  * this credentials cache "file".  Each key
  * in the keyring contains a separate key.
  */
@@ -177,12 +230,11 @@ typedef struct _krb5_krcc_data
 {
     char   *name;               /* Name for this credentials cache */
     k5_cc_mutex lock;           /* synchronization */
-    key_serial_t parent_id;     /* parent keyring of this ccache keyring */
-    key_serial_t ring_id;       /* keyring representing ccache */
+    key_serial_t collection_id; /* collection containing this cache keyring */
+    key_serial_t cache_id;      /* keyring representing ccache */
     key_serial_t princ_id;      /* key holding principal info */
-    int     numkeys;            /* # of keys in this ring
-                                 * (does NOT include principal info) */
     krb5_timestamp changetime;
+    krb5_boolean is_legacy_type;
 } krb5_krcc_data;
 
 /* Passed internally to assure we don't go past the bounds of our buffer */
@@ -190,6 +242,7 @@ typedef struct _krb5_krcc_buffer_cursor
 {
     char   *bpp;
     char   *endp;
+    size_t  size;               /* For dry-run length calculation */
 } krb5_krcc_bc;
 
 /* Global mutex */
@@ -258,6 +311,29 @@ static krb5_error_code KRB5_CALLCONV krb5_krcc_lock
 static krb5_error_code KRB5_CALLCONV krb5_krcc_unlock
 (krb5_context context, krb5_ccache id);
 
+static krb5_error_code KRB5_CALLCONV krb5_krcc_ptcursor_new
+(krb5_context context, krb5_cc_ptcursor *cursor_out);
+
+static krb5_error_code KRB5_CALLCONV krb5_krcc_ptcursor_next
+(krb5_context context, krb5_cc_ptcursor cursor, krb5_ccache *cache_out);
+
+static krb5_error_code KRB5_CALLCONV krb5_krcc_ptcursor_free
+(krb5_context context, krb5_cc_ptcursor *cursor);
+
+static krb5_error_code KRB5_CALLCONV krb5_krcc_switch_to
+(krb5_context context, krb5_ccache cache);
+
+/* Like k5memdup, but add a final null byte. */
+static inline void *
+k5memdup0(const void *in, size_t len, krb5_error_code *code)
+{
+    void *ptr = k5alloc(len + 1, code);
+
+    if (ptr != NULL && len > 0)
+        memcpy(ptr, in, len);
+    return ptr;
+}
+
 /*
  * Internal utility functions
  */
@@ -266,8 +331,9 @@ static krb5_error_code krb5_krcc_clearcache
 (krb5_context context, krb5_ccache id);
 
 static krb5_error_code krb5_krcc_new_data
-(const char *, key_serial_t ring, key_serial_t parent_ring,
- krb5_krcc_data **);
+(const char *anchor_name, const char *collection_name,
+ const char *subsidiary_name, key_serial_t cache_id,
+ key_serial_t collection_id, krb5_krcc_data **datapp);
 
 static krb5_error_code krb5_krcc_save_principal
 (krb5_context context, krb5_ccache id, krb5_principal princ);
@@ -275,100 +341,480 @@ static krb5_error_code krb5_krcc_save_principal
 static krb5_error_code krb5_krcc_retrieve_principal
 (krb5_context context, krb5_ccache id, krb5_principal * princ);
 
-static int krb5_krcc_get_ring_ids(krb5_krcc_ring_ids_t *p);
-
 /* Routines to parse a key from a keyring into a cred structure */
 static krb5_error_code krb5_krcc_parse
-(krb5_context, krb5_ccache id, krb5_pointer buf, unsigned int len,
- krb5_krcc_bc * bc);
+(krb5_context, krb5_pointer buf, unsigned int len, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_cred
-(krb5_context context, krb5_ccache id, krb5_creds * creds,
- char *payload, int psize);
+(krb5_context context, krb5_creds * creds, char *payload, int psize);
 static krb5_error_code krb5_krcc_parse_principal
-(krb5_context context, krb5_ccache id, krb5_principal * princ,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_principal * princ, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_keyblock
-(krb5_context context, krb5_ccache id, krb5_keyblock * keyblock,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_keyblock * keyblock, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_times
-(krb5_context context, krb5_ccache id, krb5_ticket_times * t,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_ticket_times * t, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_krb5data
-(krb5_context context, krb5_ccache id, krb5_data * data,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_data * data, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_int32
-(krb5_context context, krb5_ccache id, krb5_int32 * i, krb5_krcc_bc * bc);
+(krb5_context context, krb5_int32 * i, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_octet
-(krb5_context context, krb5_ccache id, krb5_octet * octet,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_octet * octet, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_addrs
-(krb5_context context, krb5_ccache id, krb5_address *** a,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_address *** a, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_addr
-(krb5_context context, krb5_ccache id, krb5_address * a,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_address * a, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_authdata
-(krb5_context context, krb5_ccache id, krb5_authdata *** ad,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_authdata *** ad, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_authdatum
-(krb5_context context, krb5_ccache id, krb5_authdata * ad,
- krb5_krcc_bc * bc);
+(krb5_context context, krb5_authdata * ad, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_parse_ui_2
-(krb5_context, krb5_ccache id, krb5_ui_2 * i, krb5_krcc_bc * bc);
+(krb5_context, krb5_ui_2 * i, krb5_krcc_bc * bc);
 
 /* Routines to unparse a cred structure into keyring key */
 static krb5_error_code krb5_krcc_unparse
-(krb5_context, krb5_ccache id, krb5_pointer buf, unsigned int len,
- krb5_krcc_bc * bc);
-static krb5_error_code krb5_krcc_unparse_cred
-(krb5_context context, krb5_ccache id, krb5_creds * creds,
+(krb5_context, krb5_pointer buf, unsigned int len, krb5_krcc_bc * bc);
+static krb5_error_code krb5_krcc_unparse_cred_alloc
+(krb5_context context, krb5_creds * creds,
  char **datapp, unsigned int *lenptr);
+static krb5_error_code krb5_krcc_unparse_cred
+(krb5_context context, krb5_creds * creds, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_principal
-(krb5_context, krb5_ccache id, krb5_principal princ, krb5_krcc_bc * bc);
+(krb5_context, krb5_principal princ, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_keyblock
-(krb5_context, krb5_ccache id, krb5_keyblock * keyblock,
- krb5_krcc_bc * bc);
+(krb5_context, krb5_keyblock * keyblock, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_times
-(krb5_context, krb5_ccache id, krb5_ticket_times * t, krb5_krcc_bc * bc);
+(krb5_context, krb5_ticket_times * t, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_krb5data
-(krb5_context, krb5_ccache id, krb5_data * data, krb5_krcc_bc * bc);
+(krb5_context, krb5_data * data, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_int32
-(krb5_context, krb5_ccache id, krb5_int32 i, krb5_krcc_bc * bc);
+(krb5_context, krb5_int32 i, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_octet
-(krb5_context, krb5_ccache id, krb5_int32 i, krb5_krcc_bc * bc);
+(krb5_context, krb5_int32 i, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_addrs
-(krb5_context, krb5_ccache, krb5_address ** a, krb5_krcc_bc * bc);
+(krb5_context, krb5_address ** a, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_addr
-(krb5_context, krb5_ccache, krb5_address * a, krb5_krcc_bc * bc);
+(krb5_context, krb5_address * a, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_authdata
-(krb5_context, krb5_ccache, krb5_authdata ** ad, krb5_krcc_bc * bc);
+(krb5_context, krb5_authdata ** ad, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_authdatum
-(krb5_context, krb5_ccache, krb5_authdata * ad, krb5_krcc_bc * bc);
+(krb5_context, krb5_authdata * ad, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_ui_4
-(krb5_context, krb5_ccache id, krb5_ui_4 i, krb5_krcc_bc * bc);
+(krb5_context, krb5_ui_4 i, krb5_krcc_bc * bc);
 static krb5_error_code krb5_krcc_unparse_ui_2
-(krb5_context, krb5_ccache id, krb5_int32 i, krb5_krcc_bc * bc);
+(krb5_context, krb5_int32 i, krb5_krcc_bc * bc);
 static void krb5_krcc_update_change_time
 (krb5_krcc_data *);
 
+static krb5_error_code
+krb5_krcc_parse_index(krb5_context context, krb5_int32 *version,
+                      char **primary, void *payload, int psize);
+static krb5_error_code
+krb5_krcc_unparse_index(krb5_context context, krb5_int32 version,
+                        const char *primary, void **datapp, int *lenptr);
+
 /* Note the following is a stub function for Linux */
 extern krb5_error_code krb5_change_cache(void);
 
 /*
- * Determine how many keys exist in a ccache keyring.
- * Subtracts out the "hidden" key holding the principal information.
+ * GET_PERSISTENT(uid) acquires the persistent keyring for uid, or falls back
+ * to the user keyring if uid matches the current effective uid.
+ */
+
+static key_serial_t
+get_persistent_fallback(uid_t uid)
+{
+    return (uid == geteuid()) ? KEY_SPEC_USER_KEYRING : -1;
+}
+
+#ifdef HAVE_PERSISTENT_KEYRING
+#define GET_PERSISTENT get_persistent_real
+static key_serial_t
+get_persistent_real(uid_t uid)
+{
+    key_serial_t key;
+
+    key = keyctl_get_persistent(uid, KEY_SPEC_PROCESS_KEYRING);
+    return (key == -1 && errno == ENOTSUP) ? get_persistent_fallback(uid) :
+        key;
+}
+#else
+#define GET_PERSISTENT get_persistent_fallback
+#endif
+
+/*
+ * Find or create a keyring within parent with the given name.  If possess is
+ * nonzero, also make sure the key is linked from possess.  This is necessary
+ * to ensure that we have possession rights on the key when the parent is the
+ * user or persistent keyring.
+ */
+static krb5_error_code
+find_or_create_keyring(key_serial_t parent, key_serial_t possess,
+                       const char *name, key_serial_t *key_out)
+{
+    key_serial_t key;
+
+    *key_out = -1;
+    key = keyctl_search(parent, KRCC_KEY_TYPE_KEYRING, name, possess);
+    if (key == -1) {
+        if (possess != 0) {
+            key = add_key(KRCC_KEY_TYPE_KEYRING, name, NULL, 0, possess);
+            if (key == -1)
+                return errno;
+            if (keyctl_link(key, parent) == -1)
+                return errno;
+        } else {
+            key = add_key(KRCC_KEY_TYPE_KEYRING, name, NULL, 0, parent);
+            if (key == -1)
+                return errno;
+        }
+    }
+    *key_out = key;
+    return 0;
+}
+
+/* Parse a residual name into an anchor name, a collection name, and possibly a
+ * subsidiary name. */
+static krb5_error_code
+parse_residual(const char *residual, char **anchor_name_out,
+               char **collection_name_out, char **subsidiary_name_out)
+{
+    krb5_error_code ret;
+    char *anchor_name = NULL, *collection_name = NULL, *subsidiary_name = NULL;
+    const char *sep;
+
+    *anchor_name_out = 0;
+    *collection_name_out = NULL;
+    *subsidiary_name_out = NULL;
+
+    /* Parse out the anchor name.  Use the legacy anchor if not present. */
+    sep = strchr(residual, ':');
+    if (sep == NULL) {
+        anchor_name = strdup(KRCC_LEGACY_ANCHOR);
+        if (anchor_name == NULL)
+            goto oom;
+    } else {
+        anchor_name = k5memdup0(residual, sep - residual, &ret);
+        if (anchor_name == NULL)
+            goto oom;
+        residual = sep + 1;
+    }
+
+    /* Parse out the collection and subsidiary name. */
+    sep = strchr(residual, ':');
+    if (sep == NULL) {
+        collection_name = strdup(residual);
+        if (collection_name == NULL)
+            goto oom;
+        subsidiary_name = NULL;
+    } else {
+        collection_name = k5memdup0(residual, sep - residual, &ret);
+        if (collection_name == NULL)
+            goto oom;
+        subsidiary_name = strdup(sep + 1);
+        if (subsidiary_name == NULL)
+            goto oom;
+    }
+
+    *anchor_name_out = anchor_name;
+    *collection_name_out = collection_name;
+    *subsidiary_name_out = subsidiary_name;
+    return 0;
+
+oom:
+    free(anchor_name);
+    free(collection_name);
+    free(subsidiary_name);
+    return ENOMEM;
+}
+
+/*
+ * Return true if residual identifies a subsidiary cache which should be linked
+ * into the anchor so it can be visible to old code.  This is the case if the
+ * residual has the legacy anchor and the subsidiary name matches the
+ * collection name.
+ */
+static krb5_boolean
+is_legacy_cache_name(const char *residual)
+{
+    const char *sep, *aname, *cname, *sname;
+    size_t alen, clen, legacy_len = sizeof(KRCC_LEGACY_ANCHOR) - 1;
+
+    /* Get pointers to the anchor, collection, and subsidiary names. */
+    aname = residual;
+    sep = strchr(residual, ':');
+    if (sep == NULL)
+        return FALSE;
+    alen = sep - aname;
+    cname = sep + 1;
+    sep = strchr(cname, ':');
+    if (sep == NULL)
+        return FALSE;
+    clen = sep - cname;
+    sname = sep + 1;
+
+    return alen == legacy_len && clen == strlen(sname) &&
+        strncmp(aname, KRCC_LEGACY_ANCHOR, alen) == 0 &&
+        strncmp(cname, sname, clen) == 0;
+}
+
+/* If the default cache name for context is a KEYRING cache, parse its residual
+ * string.  Otherwise set all outputs to NULL. */
+static krb5_error_code
+get_default(krb5_context context, char **anchor_name_out,
+            char **collection_name_out, char **subsidiary_name_out)
+{
+    const char *defname;
+
+    *anchor_name_out = *collection_name_out = *subsidiary_name_out = NULL;
+    defname = krb5_cc_default_name(context);
+    if (defname == NULL || strncmp(defname, "KEYRING:", 8) != 0)
+        return 0;
+    return parse_residual(defname + 8, anchor_name_out, collection_name_out,
+                          subsidiary_name_out);
+}
+
+/* Create a residual identifying a subsidiary cache. */
+static krb5_error_code
+make_subsidiary_residual(const char *anchor_name, const char *collection_name,
+                         const char *subsidiary_name, char **residual_out)
+{
+    if (asprintf(residual_out, "%s:%s:%s", anchor_name, collection_name,
+                 subsidiary_name) < 0) {
+        *residual_out = NULL;
+        return ENOMEM;
+    }
+    return 0;
+}
+
+/* Retrieve or create a keyring for collection_name within the anchor, and set
+ * *collection_id_out to its serial number. */
+static krb5_error_code
+get_collection(const char *anchor_name, const char *collection_name,
+               key_serial_t *collection_id_out)
+{
+    krb5_error_code ret;
+    key_serial_t persistent_id, anchor_id, possess_id = 0;
+    char *ckname;
+    long uidnum;
+
+    *collection_id_out = 0;
+
+    if (strcmp(anchor_name, KRCC_PERSISTENT_ANCHOR) == 0) {
+        /*
+         * The collection name is a uid (or empty for the current effective
+         * uid), and we look up a fixed keyring name within the persistent
+         * keyring for that uid.  We link it to the process keyring to ensure
+         * that we have possession rights on the collection key.
+         */
+        if (*collection_name != '\0') {
+            errno = 0;
+            uidnum = strtol(collection_name, NULL, 10);
+            if (errno)
+                return KRB5_KCC_INVALID_UID;
+        } else {
+            uidnum = geteuid();
+        }
+        persistent_id = GET_PERSISTENT(uidnum);
+        if (persistent_id == -1)
+            return KRB5_KCC_INVALID_UID;
+        return find_or_create_keyring(persistent_id, KEY_SPEC_PROCESS_KEYRING,
+                                      KRCC_PERSISTENT_KEYRING_NAME,
+                                      collection_id_out);
+    }
+
+    if (strcmp(anchor_name, KRCC_PROCESS_ANCHOR) == 0) {
+        anchor_id = KEY_SPEC_PROCESS_KEYRING;
+    } else if (strcmp(anchor_name, KRCC_THREAD_ANCHOR) == 0) {
+        anchor_id = KEY_SPEC_THREAD_KEYRING;
+    } else if (strcmp(anchor_name, KRCC_SESSION_ANCHOR) == 0) {
+        anchor_id = KEY_SPEC_SESSION_KEYRING;
+    } else if (strcmp(anchor_name, KRCC_USER_ANCHOR) == 0) {
+        /* The user keyring does not confer possession, so we need to link the
+         * collection to the process keyring to maintain possession rights. */
+        anchor_id = KEY_SPEC_USER_KEYRING;
+        possess_id = KEY_SPEC_PROCESS_KEYRING;
+    } else if (strcmp(anchor_name, KRCC_LEGACY_ANCHOR) == 0) {
+        anchor_id = KEY_SPEC_SESSION_KEYRING;
+    } else {
+        return KRB5_KCC_INVALID_ANCHOR;
+    }
+
+    /* Look up the collection keyring name within the anchor keyring. */
+    if (asprintf(&ckname, "%s%s", KRCC_CCCOL_PREFIX, collection_name) == -1)
+        return ENOMEM;
+    ret = find_or_create_keyring(anchor_id, possess_id, ckname,
+                                 collection_id_out);
+    free(ckname);
+    return ret;
+}
+
+/* Store subsidiary_name into the primary index key for collection_id. */
+static krb5_error_code
+set_primary_name(krb5_context context, key_serial_t collection_id,
+                 const char *subsidiary_name)
+{
+    krb5_error_code ret;
+    key_serial_t key;
+    void *payload = NULL;
+    int payloadlen;
+
+    ret = krb5_krcc_unparse_index(context, KRCC_COLLECTION_VERSION,
+                                  subsidiary_name, &payload, &payloadlen);
+    if (ret)
+        return ret;
+    key = add_key(KRCC_KEY_TYPE_USER, KRCC_COLLECTION_PRIMARY,
+                  payload, payloadlen, collection_id);
+    free(payload);
+    return (key == -1) ? errno : 0;
+}
+
+/*
+ * Get or initialize the primary name within collection_id and set
+ * *subsidiary_out to its value.  If initializing a legacy collection, look
+ * for a legacy cache and add it to the collection.
+ */
+static krb5_error_code
+get_primary_name(krb5_context context, const char *anchor_name,
+                 const char *collection_name, key_serial_t collection_id,
+                 char **subsidiary_out)
+{
+    krb5_error_code ret;
+    key_serial_t primary_id, legacy;
+    void *payload = NULL;
+    int payloadlen;
+    krb5_int32 version;
+    char *subsidiary_name = NULL;
+
+    *subsidiary_out = NULL;
+
+    primary_id = keyctl_search(collection_id, KRCC_KEY_TYPE_USER,
+                               KRCC_COLLECTION_PRIMARY, 0);
+    if (primary_id == -1) {
+        /* Initialize the primary key using the collection name.  We can't name
+         * a key with the empty string, so map that to an arbitrary string. */
+        subsidiary_name = strdup((*collection_name == '\0') ? "tkt" :
+                                 collection_name);
+        if (subsidiary_name == NULL) {
+            ret = ENOMEM;
+            goto cleanup;
+        }
+        ret = set_primary_name(context, collection_id, subsidiary_name);
+        if (ret)
+            goto cleanup;
+
+        if (strcmp(anchor_name, KRCC_LEGACY_ANCHOR) == 0) {
+            /* Look for a cache created by old code.  If we find one, add it to
+             * the collection. */
+            legacy = keyctl_search(KEY_SPEC_SESSION_KEYRING,
+                                   KRCC_KEY_TYPE_KEYRING, subsidiary_name, 0);
+            if (legacy != -1 && keyctl_link(legacy, collection_id) == -1) {
+                ret = errno;
+                goto cleanup;
+            }
+        }
+    } else {
+        /* Read, parse, and free the primary key's payload. */
+        payloadlen = keyctl_read_alloc(primary_id, &payload);
+        if (payloadlen == -1) {
+            ret = errno;
+            goto cleanup;
+        }
+        ret = krb5_krcc_parse_index(context, &version, &subsidiary_name,
+                                    payload, payloadlen);
+        if (ret)
+            goto cleanup;
+
+        if (version != KRCC_COLLECTION_VERSION) {
+            ret = KRB5_KCC_UNKNOWN_VERSION;
+            goto cleanup;
+        }
+    }
+
+    *subsidiary_out = subsidiary_name;
+    subsidiary_name = NULL;
+
+cleanup:
+    free(payload);
+    free(subsidiary_name);
+    return ret;
+}
+
+/*
+ * Create a keyring with a unique random name within collection_id.  Set
+ * *subsidiary to its name and *cache_id_out to its key serial number.
  */
-static int KRB5_CALLCONV
-krb5_krcc_getkeycount(key_serial_t cred_ring)
+static krb5_error_code
+unique_keyring(krb5_context context, key_serial_t collection_id,
+               char **subsidiary_out, key_serial_t *cache_id_out)
 {
-    int res, nkeys;
+    key_serial_t key;
+    krb5_error_code ret;
+    char uniquename[sizeof(KRCC_NAME_PREFIX) + KRCC_NAME_RAND_CHARS];
+    int prefixlen = sizeof(KRCC_NAME_PREFIX) - 1;
+    int tries;
+
+    *subsidiary_out = NULL;
+    *cache_id_out = 0;
+
+    memcpy(uniquename, KRCC_NAME_PREFIX, sizeof(KRCC_NAME_PREFIX));
+    k5_cc_mutex_lock(context, &krb5int_krcc_mutex);
+
+    /* Loop until we successfully create a new ccache keyring with
+     * a unique name, or we get an error. Limit to 100 tries. */
+    tries = 100;
+    while (tries-- > 0) {
+        ret = krb5int_random_string(context, uniquename + prefixlen,
+                                    KRCC_NAME_RAND_CHARS);
+        if (ret)
+            goto cleanup;
+
+        key = keyctl_search(collection_id, KRCC_KEY_TYPE_KEYRING, uniquename,
+                            0);
+        if (key < 0) {
+            /* Name does not already exist.  Create it to reserve the name. */
+            key = add_key(KRCC_KEY_TYPE_KEYRING, uniquename, NULL, 0,
+                          collection_id);
+            if (key < 0) {
+                ret = errno;
+                goto cleanup;
+            }
+            break;
+        }
+    }
 
-    res = keyctl_read(cred_ring, NULL, 0);
-    if (res > 0)
-        nkeys = (res / sizeof(key_serial_t)) - 1;
-    else
-        nkeys = 0;
-    return(nkeys);
+    if (tries <= 0) {
+        ret = KRB5_CC_BADNAME;
+        goto cleanup;
+    }
+
+    *subsidiary_out = strdup(uniquename);
+    if (*subsidiary_out == NULL) {
+        ret = ENOMEM;
+        goto cleanup;
+    }
+    *cache_id_out = key;
+    ret = KRB5_OK;
+cleanup:
+    k5_cc_mutex_unlock(context, &krb5int_krcc_mutex);
+    return ret;
+}
+
+static krb5_error_code
+add_cred_key(const char *name, const void *payload, size_t plen,
+             key_serial_t cache_id, krb5_boolean legacy_type)
+{
+    key_serial_t key;
+
+    if (!legacy_type) {
+        /* Try the preferred cred key type; fall back if no kernel support. */
+        key = add_key(KRCC_CRED_KEY_TYPE, name, payload, plen, cache_id);
+        if (key != -1)
+            return 0;
+        else if (errno != EINVAL && errno != ENODEV)
+            return errno;
+    }
+    /* Use the user key type. */
+    key = add_key(KRCC_KEY_TYPE_USER, name, payload, plen, cache_id);
+    return (key == -1) ? errno : 0;
 }
 
 /*
@@ -388,24 +834,40 @@ static krb5_error_code KRB5_CALLCONV
 krb5_krcc_initialize(krb5_context context, krb5_ccache id,
                      krb5_principal princ)
 {
+    krb5_krcc_data *data = (krb5_krcc_data *)id->data;
     krb5_error_code kret;
+    const char *cache_name, *p;
 
     DEBUG_PRINT(("krb5_krcc_initialize: entered\n"));
 
-    kret = k5_cc_mutex_lock(context, &((krb5_krcc_data *) id->data)->lock);
-    if (kret)
-        return kret;
+    k5_cc_mutex_lock(context, &data->lock);
 
     kret = krb5_krcc_clearcache(context, id);
     if (kret != KRB5_OK)
         goto out;
 
+    if (!data->cache_id) {
+        /* The key didn't exist at resolve time.  Check again and create the
+         * key if it still isn't there. */
+        p = strrchr(data->name, ':');
+        cache_name = (p != NULL) ? p + 1 : data->name;
+        kret = find_or_create_keyring(data->collection_id, 0, cache_name,
+                                      &data->cache_id);
+        if (kret)
+            goto out;
+    }
+
+    /* If this is the legacy cache in a legacy session collection, link it
+     * directly to the session keyring so that old code can see it. */
+    if (is_legacy_cache_name(data->name))
+        (void)keyctl_link(data->cache_id, KEY_SPEC_SESSION_KEYRING);
+
     kret = krb5_krcc_save_principal(context, id, princ);
     if (kret == KRB5_OK)
         krb5_change_cache();
 
 out:
-    k5_cc_mutex_unlock(context, &((krb5_krcc_data *) id->data)->lock);
+    k5_cc_mutex_unlock(context, &data->lock);
     return kret;
 }
 
@@ -460,14 +922,14 @@ krb5_krcc_clearcache(krb5_context context, krb5_ccache id)
 
     d = (krb5_krcc_data *) id->data;
 
-    DEBUG_PRINT(("krb5_krcc_clearcache: ring_id %d, princ_id %d, "
-                 "numkeys is %d\n", d->ring_id, d->princ_id, d->numkeys));
+    DEBUG_PRINT(("krb5_krcc_clearcache: cache_id %d, princ_id %d\n",
+                 d->cache_id, d->princ_id));
 
-    res = keyctl_clear(d->ring_id);
-    if (res != 0) {
-        return errno;
+    if (d->cache_id) {
+        res = keyctl_clear(d->cache_id);
+        if (res != 0)
+            return errno;
     }
-    d->numkeys = 0;
     d->princ_id = 0;
     krb5_krcc_update_change_time(d);
 
@@ -484,7 +946,7 @@ krb5_krcc_clearcache(krb5_context context, krb5_ccache id)
 static krb5_error_code KRB5_CALLCONV
 krb5_krcc_destroy(krb5_context context, krb5_ccache id)
 {
-    krb5_error_code kret;
+    krb5_error_code kret = 0;
     krb5_krcc_data *d;
     int     res;
 
@@ -492,30 +954,67 @@ krb5_krcc_destroy(krb5_context context, krb5_ccache id)
 
     d = (krb5_krcc_data *) id->data;
 
-    kret = k5_cc_mutex_lock(context, &d->lock);
-    if (kret)
-        return kret;
+    k5_cc_mutex_lock(context, &d->lock);
 
     krb5_krcc_clearcache(context, id);
-    free(d->name);
-    res = keyctl_unlink(d->ring_id, d->parent_id);
-    if (res < 0) {
-        kret = errno;
-        DEBUG_PRINT(("krb5_krcc_destroy: unlinking key %d from ring %d: %s",
-                     d->ring_id, d->parent_id, error_message(errno)));
-        goto cleanup;
+    if (d->cache_id) {
+        res = keyctl_unlink(d->cache_id, d->collection_id);
+        if (res < 0) {
+            kret = errno;
+            DEBUG_PRINT(("unlinking key %d from ring %d: %s",
+                         d->cache_id, d->collection_id, error_message(errno)));
+        }
+        /* If this is a legacy cache, unlink it from the session anchor. */
+        if (is_legacy_cache_name(d->name))
+            (void)keyctl_unlink(d->cache_id, KEY_SPEC_SESSION_KEYRING);
     }
-cleanup:
+
     k5_cc_mutex_unlock(context, &d->lock);
     k5_cc_mutex_destroy(&d->lock);
+    free(d->name);
     free(d);
     free(id);
 
     krb5_change_cache();
 
-    return KRB5_OK;
+    return kret;
 }
 
+/* Create a cache handle for a cache ID. */
+static krb5_error_code
+make_cache(key_serial_t collection_id, key_serial_t cache_id,
+           const char *anchor_name, const char *collection_name,
+           const char *subsidiary_name, krb5_ccache *cache_out)
+{
+    krb5_error_code ret;
+    krb5_ccache ccache = NULL;
+    krb5_krcc_data *d;
+    key_serial_t pkey = 0;
+
+    /* Determine the key containing principal information, if present. */
+    pkey = keyctl_search(cache_id, KRCC_KEY_TYPE_USER, KRCC_SPEC_PRINC_KEYNAME,
+                         0);
+    if (pkey < 0)
+        pkey = 0;
+
+    ccache = malloc(sizeof(struct _krb5_ccache));
+    if (!ccache)
+        return ENOMEM;
+
+    ret = krb5_krcc_new_data(anchor_name, collection_name, subsidiary_name,
+                             cache_id, collection_id, &d);
+    if (ret) {
+        free(ccache);
+        return ret;
+    }
+
+    d->princ_id = pkey;
+    ccache->ops = &krb5_krcc_ops;
+    ccache->data = d;
+    ccache->magic = KV5M_CCACHE;
+    *cache_out = ccache;
+    return 0;
+}
 
 /*
  * Requires:
@@ -538,101 +1037,42 @@ cleanup:
  */
 
 static krb5_error_code KRB5_CALLCONV
-krb5_krcc_resolve(krb5_context context, krb5_ccache * id, const char *full_residual)
+krb5_krcc_resolve(krb5_context context, krb5_ccache *id, const char *residual)
 {
-    krb5_ccache lid;
-    krb5_error_code kret;
-    krb5_krcc_data *d;
-    key_serial_t key;
-    key_serial_t pkey = 0;
-    int     nkeys = 0;
-    int     res;
-    krb5_krcc_ring_ids_t ids;
-    key_serial_t ring_id;
-    const char *residual;
+    krb5_error_code ret;
+    key_serial_t collection_id, cache_id;
+    char *anchor_name = NULL, *collection_name = NULL, *subsidiary_name = NULL;
 
-    DEBUG_PRINT(("krb5_krcc_resolve: entered with name '%s'\n",
-                 full_residual));
+    ret = parse_residual(residual, &anchor_name, &collection_name,
+                         &subsidiary_name);
+    if (ret)
+        goto cleanup;
+    ret = get_collection(anchor_name, collection_name, &collection_id);
+    if (ret)
+        goto cleanup;
 
-    res = krb5_krcc_get_ring_ids(&ids);
-    if (res) {
-        kret = EINVAL;
-        DEBUG_PRINT(("krb5_krcc_resolve: Error getting ring id values!\n"));
-        return kret;
+    if (subsidiary_name == NULL) {
+        /* Retrieve or initialize the primary name for the collection. */
+        ret = get_primary_name(context, anchor_name, collection_name,
+                               collection_id, &subsidiary_name);
+        if (ret)
+            goto cleanup;
     }
 
-    if (strncmp(full_residual, "thread:", 7) == 0) {
-        residual = full_residual + 7;
-        ring_id = ids.thread;
-    } else if (strncmp(full_residual, "process:", 8) == 0) {
-        residual = full_residual + 8;
-        ring_id = ids.process;
-    } else {
-        residual = full_residual;
-        ring_id = ids.session;
-    }
+    /* Look up the cache keyring ID, if the cache is already initialized. */
+    cache_id = keyctl_search(collection_id, KRCC_KEY_TYPE_KEYRING,
+                             subsidiary_name, 0);
+    if (cache_id < 0)
+        cache_id = 0;
 
-    DEBUG_PRINT(("krb5_krcc_resolve: searching ring %d for residual '%s'\n",
-                 ring_id, residual));
+    ret = make_cache(collection_id, cache_id, anchor_name, collection_name,
+                     subsidiary_name, id);
 
-    /*
-     * Use keyctl_search instead of request_key. If we're supposed
-     * to be looking for a process ccache, we shouldn't find a
-     * thread ccache.
-     * XXX But should we look in the session ring if we don't find it
-     * in the process ring?  Same goes for thread.  Should we look in
-     * the process and session rings if not found in the thread ring?
-     *
-     */
-    key = keyctl_search(ring_id, KRCC_KEY_TYPE_KEYRING, residual, 0);
-    if (key < 0) {
-        key = add_key(KRCC_KEY_TYPE_KEYRING, residual, NULL, 0, ring_id);
-        if (key < 0) {
-            kret = errno;
-            DEBUG_PRINT(("krb5_krcc_resolve: Error adding new "
-                         "keyring '%s': %s\n", residual, strerror(errno)));
-            return kret;
-        }
-        DEBUG_PRINT(("krb5_krcc_resolve: new keyring '%s', "
-                     "key %d, added to keyring %d\n",
-                     residual, key, ring_id));
-    } else {
-        DEBUG_PRINT(("krb5_krcc_resolve: found existing "
-                     "key %d, with name '%s' in keyring %d\n",
-                     key, residual, ring_id));
-        /* Determine key containing principal information */
-        pkey = keyctl_search(key, KRCC_KEY_TYPE_USER,
-                             KRCC_SPEC_PRINC_KEYNAME, 0);
-        if (pkey < 0) {
-            DEBUG_PRINT(("krb5_krcc_resolve: Error locating principal "
-                         "info for existing ccache in ring %d: %s\n",
-                         key, strerror(errno)));
-            pkey = 0;
-        }
-        /* Determine how many keys exist */
-        nkeys = krb5_krcc_getkeycount(key);
-    }
-
-    lid = (krb5_ccache) malloc(sizeof(struct _krb5_ccache));
-    if (lid == NULL)
-        return KRB5_CC_NOMEM;
-
-
-    kret = krb5_krcc_new_data(residual, key, ring_id, &d);
-    if (kret) {
-        free(lid);
-        return kret;
-    }
-
-    DEBUG_PRINT(("krb5_krcc_resolve: ring_id %d, princ_id %d, "
-                 "nkeys %d\n", key, pkey, nkeys));
-    d->princ_id = pkey;
-    d->numkeys = nkeys;
-    lid->ops = &krb5_krcc_ops;
-    lid->data = d;
-    lid->magic = KV5M_CCACHE;
-    *id = lid;
-    return KRB5_OK;
+cleanup:
+    free(anchor_name);
+    free(collection_name);
+    free(subsidiary_name);
+    return ret;
 }
 
 /*
@@ -653,47 +1093,37 @@ krb5_krcc_start_seq_get(krb5_context context, krb5_ccache id,
                         krb5_cc_cursor * cursor)
 {
     krb5_krcc_cursor krcursor;
-    krb5_error_code kret;
     krb5_krcc_data *d;
-    unsigned int size;
-    int     res;
+    void *keys;
+    long size;
 
     DEBUG_PRINT(("krb5_krcc_start_seq_get: entered\n"));
 
     d = id->data;
-    kret = k5_cc_mutex_lock(context, &d->lock);
-    if (kret)
-        return kret;
-
-    /*
-     * Determine how many keys currently exist and update numkeys.
-     * We cannot depend on the current value of numkeys because
-     * the ccache may have been updated elsewhere
-     */
-    d->numkeys = krb5_krcc_getkeycount(d->ring_id);
+    k5_cc_mutex_lock(context, &d->lock);
 
-    size = sizeof(*krcursor) + ((d->numkeys + 1) * sizeof(key_serial_t));
-
-    krcursor = (krb5_krcc_cursor) malloc(size);
-    if (krcursor == NULL) {
+    if (!d->cache_id) {
         k5_cc_mutex_unlock(context, &d->lock);
-        return KRB5_CC_NOMEM;
+        return KRB5_FCC_NOFILE;
     }
 
-    krcursor->keys = (key_serial_t *) ((char *) krcursor + sizeof(*krcursor));
-    res = keyctl_read(d->ring_id, (char *) krcursor->keys,
-                      ((d->numkeys + 1) * sizeof(key_serial_t)));
-    if (res < 0 || res > ((d->numkeys + 1) * sizeof(key_serial_t))) {
-        DEBUG_PRINT(("Read %d bytes from keyring, numkeys %d: %s\n",
-                     res, d->numkeys, strerror(errno)));
-        free(krcursor);
+    size = keyctl_read_alloc(d->cache_id, &keys);
+    if (size == -1) {
+        DEBUG_PRINT(("Error getting from keyring: %s\n", strerror(errno)));
         k5_cc_mutex_unlock(context, &d->lock);
         return KRB5_CC_IO;
     }
 
-    krcursor->numkeys = d->numkeys;
-    krcursor->currkey = 0;
+    krcursor = calloc(1, sizeof(*krcursor));
+    if (krcursor == NULL) {
+        free(keys);
+        k5_cc_mutex_unlock(context, &d->lock);
+        return KRB5_CC_NOMEM;
+    }
+
     krcursor->princ_id = d->princ_id;
+    krcursor->numkeys = size / sizeof(key_serial_t);
+    krcursor->keys = keys;
 
     k5_cc_mutex_unlock(context, &d->lock);
     *cursor = (krb5_cc_cursor) krcursor;
@@ -741,14 +1171,14 @@ krb5_krcc_next_cred(krb5_context context, krb5_ccache id,
     memset(creds, 0, sizeof(krb5_creds));
 
     /* If we're pointing past the end of the keys array, there are no more */
-    if (krcursor->currkey > krcursor->numkeys)
+    if (krcursor->currkey >= krcursor->numkeys)
         return KRB5_CC_END;
 
     /* If we're pointing at the entry with the principal, skip it */
     if (krcursor->keys[krcursor->currkey] == krcursor->princ_id) {
         krcursor->currkey++;
         /* Check if we have now reached the end */
-        if (krcursor->currkey > krcursor->numkeys)
+        if (krcursor->currkey >= krcursor->numkeys)
             return KRB5_CC_END;
     }
 
@@ -763,7 +1193,7 @@ krb5_krcc_next_cred(krb5_context context, krb5_ccache id,
     }
     krcursor->currkey++;
 
-    kret = krb5_krcc_parse_cred(context, id, creds, payload, psize);
+    kret = krb5_krcc_parse_cred(context, creds, payload, psize);
 
 freepayload:
     if (payload) free(payload);
@@ -787,19 +1217,24 @@ static krb5_error_code KRB5_CALLCONV
 krb5_krcc_end_seq_get(krb5_context context, krb5_ccache id,
                       krb5_cc_cursor * cursor)
 {
+    krb5_krcc_cursor krcursor = (krb5_krcc_cursor)*cursor;
     DEBUG_PRINT(("krb5_krcc_end_seq_get: entered\n"));
 
-    free(*cursor);
-    *cursor = 0L;
+    if (krcursor != NULL) {
+        free(krcursor->keys);
+        free(krcursor);
+    }
+    *cursor = NULL;
     return KRB5_OK;
 }
 
 /* Utility routine: Creates the back-end data for a keyring cache.
 
    Call with the global list lock held.  */
-static  krb5_error_code
-krb5_krcc_new_data(const char *name, key_serial_t ring,
-                   key_serial_t parent_ring, krb5_krcc_data ** datapp)
+static krb5_error_code
+krb5_krcc_new_data(const char *anchor_name, const char *collection_name,
+                   const char *subsidiary_name, key_serial_t cache_id,
+                   key_serial_t collection_id, krb5_krcc_data **datapp)
 {
     krb5_error_code kret;
     krb5_krcc_data *d;
@@ -814,17 +1249,18 @@ krb5_krcc_new_data(const char *name, key_serial_t ring,
         return kret;
     }
 
-    d->name = strdup(name);
-    if (d->name == NULL) {
+    kret = make_subsidiary_residual(anchor_name, collection_name,
+                                    subsidiary_name, &d->name);
+    if (kret) {
         k5_cc_mutex_destroy(&d->lock);
         free(d);
-        return KRB5_CC_NOMEM;
+        return kret;
     }
     d->princ_id = 0;
-    d->ring_id = ring;
-    d->parent_id = parent_ring;
-    d->numkeys = 0;
+    d->cache_id = cache_id;
+    d->collection_id = collection_id;
     d->changetime = 0;
+    d->is_legacy_type = (strcmp(anchor_name, KRCC_LEGACY_ANCHOR) == 0);
     krb5_krcc_update_change_time(d);
 
     *datapp = d;
@@ -846,82 +1282,73 @@ krb5_krcc_new_data(const char *name, key_serial_t ring,
 static krb5_error_code KRB5_CALLCONV
 krb5_krcc_generate_new(krb5_context context, krb5_ccache * id)
 {
-    krb5_ccache lid;
-    char uniquename[8];
+    krb5_ccache lid = NULL;
     krb5_error_code kret;
+    char *anchor_name = NULL, *collection_name = NULL, *subsidiary_name = NULL;
+    char *new_subsidiary_name = NULL, *new_residual = NULL;
     krb5_krcc_data *d;
-    key_serial_t ring_id = KEY_SPEC_SESSION_KEYRING;
-    key_serial_t key;
+    key_serial_t collection_id;
+    key_serial_t cache_id = 0;
 
     DEBUG_PRINT(("krb5_krcc_generate_new: entered\n"));
 
+    /* Determine the collection in which we will create the cache.*/
+    kret = get_default(context, &anchor_name, &collection_name,
+                       &subsidiary_name);
+    if (kret)
+        return kret;
+    if (anchor_name == NULL) {
+        kret = parse_residual(KRCC_DEFAULT_UNIQUE_COLLECTION, &anchor_name,
+                              &collection_name, &subsidiary_name);
+        if (kret)
+            return kret;
+    }
+    if (subsidiary_name != NULL) {
+        krb5_set_error_message(context, KRB5_DCC_CANNOT_CREATE,
+                               _("Can't create new subsidiary cache because "
+                                 "default cache is already a subsdiary"));
+        kret = KRB5_DCC_CANNOT_CREATE;
+        goto cleanup;
+    }
+
     /* Allocate memory */
     lid = (krb5_ccache) malloc(sizeof(struct _krb5_ccache));
-    if (lid == NULL)
-        return KRB5_CC_NOMEM;
+    if (lid == NULL) {
+        kret = ENOMEM;
+        goto cleanup;
+    }
 
     lid->ops = &krb5_krcc_ops;
 
-    kret = k5_cc_mutex_lock(context, &krb5int_krcc_mutex);
-    if (kret) {
-        free(lid);
-        return kret;
-    }
-
-/* XXX These values are platform-specific and should not be here! */
-/* XXX There is a bug in FC5 where these are not included in errno.h  */
-#ifndef ENOKEY
-#define ENOKEY          126     /* Required key not available */
-#endif
-#ifndef EKEYEXPIRED
-#define EKEYEXPIRED     127     /* Key has expired */
-#endif
-#ifndef EKEYREVOKED
-#define EKEYREVOKED     128     /* Key has been revoked */
-#endif
-#ifndef EKEYREJECTED
-#define EKEYREJECTED    129     /* Key was rejected by service */
-#endif
+    /* Make a unique keyring within the chosen collection. */
+    kret = get_collection(anchor_name, collection_name, &collection_id);
+    if (kret)
+        goto cleanup;
+    kret = unique_keyring(context, collection_id, &new_subsidiary_name,
+                          &cache_id);
+    if (kret)
+        goto cleanup;
 
-    /*
-     * Loop until we successfully create a new ccache keyring with
-     * a unique name, or we get an error.
-     */
-    while (1) {
-        kret = krb5int_random_string(context, uniquename, sizeof(uniquename));
-        if (kret) {
-            k5_cc_mutex_unlock(context, &krb5int_krcc_mutex);
-            free(lid);
-            return kret;
-        }
+    kret = krb5_krcc_new_data(anchor_name, collection_name,
+                              new_subsidiary_name, cache_id, collection_id,
+                              &d);
+    if (kret)
+        goto cleanup;
 
-        DEBUG_PRINT(("krb5_krcc_generate_new: searching for name '%s'\n",
-                     uniquename));
-        key = keyctl_search(ring_id, KRCC_KEY_TYPE_KEYRING, uniquename, 0);
-        /*XXX*/ DEBUG_PRINT(("krb5_krcc_generate_new: after searching for '%s', key = %d, errno = %d\n", uniquename, key, errno));
-        if (key < 0 && errno == ENOKEY) {
-            /* name does not already exist, create it to reserve the name */
-            key = add_key(KRCC_KEY_TYPE_KEYRING, uniquename, NULL, 0, ring_id);
-            if (key < 0) {
-                kret = errno;
-                DEBUG_PRINT(("krb5_krcc_generate_new: '%s' trying to "
-                             "create '%s'\n", strerror(errno), uniquename));
-                k5_cc_mutex_unlock(context, &krb5int_krcc_mutex);
-                return kret;
-            }
-            break;
-        }
-    }
+    lid->data = d;
+    krb5_change_cache();
 
-    kret = krb5_krcc_new_data(uniquename, key, ring_id, &d);
-    k5_cc_mutex_unlock(context, &krb5int_krcc_mutex);
+cleanup:
+    free(anchor_name);
+    free(collection_name);
+    free(subsidiary_name);
+    free(new_subsidiary_name);
+    free(new_residual);
     if (kret) {
         free(lid);
         return kret;
     }
-    lid->data = d;
     *id = lid;
-    krb5_change_cache();
     return KRB5_OK;
 }
 
@@ -1023,14 +1450,16 @@ krb5_krcc_store(krb5_context context, krb5_ccache id, krb5_creds * creds)
     krb5_krcc_data *d = (krb5_krcc_data *) id->data;
     char   *payload = NULL;
     unsigned int payloadlen;
-    key_serial_t newkey;
     char   *keyname = NULL;
 
     DEBUG_PRINT(("krb5_krcc_store: entered\n"));
 
-    kret = k5_cc_mutex_lock(context, &d->lock);
-    if (kret)
-        return kret;
+    k5_cc_mutex_lock(context, &d->lock);
+
+    if (!d->cache_id) {
+        k5_cc_mutex_unlock(context, &d->lock);
+        return KRB5_FCC_NOFILE;
+    }
 
     /* Get the service principal name and use it as the key name */
     kret = krb5_unparse_name(context, creds->server, &keyname);
@@ -1040,24 +1469,19 @@ krb5_krcc_store(krb5_context context, krb5_ccache id, krb5_creds * creds)
     }
 
     /* Serialize credential into memory */
-    kret = krb5_krcc_unparse_cred(context, id, creds, &payload, &payloadlen);
+    kret = krb5_krcc_unparse_cred_alloc(context, creds, &payload, &payloadlen);
     if (kret != KRB5_OK)
         goto errout;
 
     /* Add new key (credentials) into keyring */
     DEBUG_PRINT(("krb5_krcc_store: adding new key '%s' to keyring %d\n",
-                 keyname, d->ring_id));
-    newkey = add_key(KRCC_KEY_TYPE_USER, keyname, payload,
-                     payloadlen, d->ring_id);
-    if (newkey < 0) {
-        kret = errno;
-        DEBUG_PRINT(("Error adding user key '%s': %s\n",
-                     keyname, strerror(kret)));
-    } else {
-        d->numkeys++;
-        kret = KRB5_OK;
-        krb5_krcc_update_change_time(d);
-    }
+                 keyname, d->cache_id));
+    kret = add_cred_key(keyname, payload, payloadlen, d->cache_id,
+                        d->is_legacy_type);
+    if (kret)
+        goto errout;
+
+    krb5_krcc_update_change_time(d);
 
 errout:
     if (keyname)
@@ -1073,36 +1497,30 @@ static krb5_error_code KRB5_CALLCONV
 krb5_krcc_last_change_time(krb5_context context, krb5_ccache id,
                            krb5_timestamp *change_time)
 {
-    krb5_error_code ret = 0;
     krb5_krcc_data *data = (krb5_krcc_data *) id->data;
 
-    *change_time = 0;
-
-    ret = k5_cc_mutex_lock(context, &data->lock);
-    if (!ret) {
-        *change_time = data->changetime;
-        k5_cc_mutex_unlock(context, &data->lock);
-    }
-
-    return ret;
+    k5_cc_mutex_lock(context, &data->lock);
+    *change_time = data->changetime;
+    k5_cc_mutex_unlock(context, &data->lock);
+    return 0;
 }
 
 static krb5_error_code KRB5_CALLCONV
 krb5_krcc_lock(krb5_context context, krb5_ccache id)
 {
-    krb5_error_code ret = 0;
     krb5_krcc_data *data = (krb5_krcc_data *) id->data;
-    ret = k5_cc_mutex_lock(context, &data->lock);
-    return ret;
+
+    k5_cc_mutex_lock(context, &data->lock);
+    return 0;
 }
 
 static krb5_error_code KRB5_CALLCONV
 krb5_krcc_unlock(krb5_context context, krb5_ccache id)
 {
-    krb5_error_code ret = 0;
     krb5_krcc_data *data = (krb5_krcc_data *) id->data;
-    ret = k5_cc_mutex_unlock(context, &data->lock);
-    return ret;
+
+    k5_cc_mutex_unlock(context, &data->lock);
+    return 0;
 }
 
 
@@ -1112,7 +1530,7 @@ krb5_krcc_save_principal(krb5_context context, krb5_ccache id,
 {
     krb5_krcc_data *d;
     krb5_error_code kret;
-    char   *payload;
+    char *payload = NULL;
     key_serial_t newkey;
     unsigned int payloadsize;
     krb5_krcc_bc bc;
@@ -1121,14 +1539,19 @@ krb5_krcc_save_principal(krb5_context context, krb5_ccache id,
 
     d = (krb5_krcc_data *) id->data;
 
-    payload = malloc(GUESS_CRED_SIZE);
+    /* Do a dry run first to calculate the size. */
+    bc.bpp = bc.endp = NULL;
+    bc.size = 0;
+    kret = krb5_krcc_unparse_principal(context, princ, &bc);
+    CHECK_N_GO(kret, errout);
+
+    /* Allocate a buffer and serialize for real. */
+    payload = malloc(bc.size);
     if (payload == NULL)
         return KRB5_CC_NOMEM;
-
     bc.bpp = payload;
-    bc.endp = payload + GUESS_CRED_SIZE;
-
-    kret = krb5_krcc_unparse_principal(context, id, princ, &bc);
+    bc.endp = payload + bc.size;
+    kret = krb5_krcc_unparse_principal(context, princ, &bc);
     CHECK_N_GO(kret, errout);
 
     /* Add new key into keyring */
@@ -1140,14 +1563,14 @@ krb5_krcc_save_principal(krb5_context context, krb5_ccache id,
         rc = krb5_unparse_name(context, princ, &princname);
         DEBUG_PRINT(("krb5_krcc_save_principal: adding new key '%s' "
                      "to keyring %d for principal '%s'\n",
-                     KRCC_SPEC_PRINC_KEYNAME, d->ring_id,
+                     KRCC_SPEC_PRINC_KEYNAME, d->cache_id,
                      rc ? "<unknown>" : princname));
         if (rc == 0)
             krb5_free_unparsed_name(context, princname);
     }
 #endif
     newkey = add_key(KRCC_KEY_TYPE_USER, KRCC_SPEC_PRINC_KEYNAME, payload,
-                     payloadsize, d->ring_id);
+                     payloadsize, d->cache_id);
     if (newkey < 0) {
         kret = errno;
         DEBUG_PRINT(("Error adding principal key: %s\n", strerror(kret)));
@@ -1172,11 +1595,9 @@ krb5_krcc_retrieve_principal(krb5_context context, krb5_ccache id,
     int     psize;
     krb5_krcc_bc bc;
 
-    kret = k5_cc_mutex_lock(context, &d->lock);
-    if (kret)
-        return kret;
+    k5_cc_mutex_lock(context, &d->lock);
 
-    if (!d->princ_id) {
+    if (!d->cache_id || !d->princ_id) {
         princ = 0L;
         kret = KRB5_FCC_NOFILE;
         goto errout;
@@ -1191,7 +1612,7 @@ krb5_krcc_retrieve_principal(krb5_context context, krb5_ccache id,
     }
     bc.bpp = payload;
     bc.endp = (char *)payload + psize;
-    kret = krb5_krcc_parse_principal(context, id, princ, &bc);
+    kret = krb5_krcc_parse_principal(context, princ, &bc);
 
 errout:
     if (payload)
@@ -1200,57 +1621,195 @@ errout:
     return kret;
 }
 
-static int
-krb5_krcc_get_ring_ids(krb5_krcc_ring_ids_t *p)
-{
-    key_serial_t ids_key;
-    char ids_buf[128];
-    key_serial_t session, process, thread;
-    long val;
+struct krcc_ptcursor_data {
+    key_serial_t collection_id;
+    char *anchor_name;
+    char *collection_name;
+    char *subsidiary_name;
+    char *primary_name;
+    krb5_boolean first;
+    long num_keys;
+    long next_key;
+    key_serial_t *keys;
+};
 
-    DEBUG_PRINT(("krb5_krcc_get_ring_ids: entered\n"));
+static krb5_error_code KRB5_CALLCONV
+krb5_krcc_ptcursor_new(krb5_context context, krb5_cc_ptcursor *cursor_out)
+{
+    struct krcc_ptcursor_data *data;
+    krb5_cc_ptcursor cursor;
+    krb5_error_code ret;
+    long size;
+
+    *cursor_out = NULL;
+
+    cursor = k5alloc(sizeof(struct krb5_cc_ptcursor_s), &ret);
+    if (cursor == NULL)
+        return ENOMEM;
+    data = k5alloc(sizeof(struct krcc_ptcursor_data), &ret);
+    if (data == NULL)
+        goto error;
+    cursor->ops = &krb5_krcc_ops;
+    cursor->data = data;
+    data->first = TRUE;
+
+    ret = get_default(context, &data->anchor_name, &data->collection_name,
+                      &data->subsidiary_name);
+    if (ret)
+        goto error;
+
+    /* If there is no default collection, return an empty cursor. */
+    if (data->anchor_name == NULL) {
+        *cursor_out = cursor;
+        return 0;
+    }
 
-    if (!p)
-        return EINVAL;
+    ret = get_collection(data->anchor_name, data->collection_name,
+                         &data->collection_id);
+    if (ret)
+        goto error;
+
+    if (data->subsidiary_name == NULL) {
+        ret = get_primary_name(context, data->anchor_name,
+                               data->collection_name, data->collection_id,
+                               &data->primary_name);
+        if (ret)
+            goto error;
+
+        size = keyctl_read_alloc(data->collection_id, (void **)&data->keys);
+        if (size == -1) {
+            ret = errno;
+            goto error;
+        }
+        data->num_keys = size / sizeof(key_serial_t);
+    }
 
-    /* Use the defaults in case we find no ids key */
-    p->session = KEY_SPEC_SESSION_KEYRING;
-    p->process = KEY_SPEC_PROCESS_KEYRING;
-    p->thread = KEY_SPEC_THREAD_KEYRING;
+    *cursor_out = cursor;
+    return 0;
 
-    /*
-     * Note that in the "normal" case, this will not be found.
-     * The Linux gssd creates this key while creating a
-     * context to communicate the user's key serial numbers.
-     */
-    ids_key = request_key(KRCC_KEY_TYPE_USER, KRCC_SPEC_IDS_KEYNAME, NULL, 0);
-    if (ids_key < 0)
-        goto out;
+error:
+    krb5_krcc_ptcursor_free(context, &cursor);
+    return ret;
+}
 
-    DEBUG_PRINT(("krb5_krcc_get_ring_ids: processing '%s' key %d\n",
-                 KRCC_SPEC_IDS_KEYNAME, ids_key));
-    /*
-     * Read and parse the ids file
-     */
-    memset(ids_buf, '\0', sizeof(ids_buf));
-    val = keyctl_read(ids_key, ids_buf, sizeof(ids_buf));
-    if (val > sizeof(ids_buf))
-        goto out;
+static krb5_error_code KRB5_CALLCONV
+krb5_krcc_ptcursor_next(krb5_context context, krb5_cc_ptcursor cursor,
+                        krb5_ccache *cache_out)
+{
+    krb5_error_code ret;
+    struct krcc_ptcursor_data *data;
+    key_serial_t key, cache_id = 0;
+    const char *first_name, *keytype, *sep, *subsidiary_name;
+    size_t keytypelen;
+    char *description = NULL;
+
+    *cache_out = NULL;
+
+    data = cursor->data;
+
+    /* No keyring available */
+    if (data->collection_id == 0)
+        return 0;
+
+    if (data->first) {
+        /* Look for the primary cache for a collection cursor, or the
+         * subsidiary cache for a subsidiary cursor. */
+        data->first = FALSE;
+        first_name = (data->primary_name != NULL) ? data->primary_name :
+            data->subsidiary_name;
+        cache_id = keyctl_search(data->collection_id, KRCC_KEY_TYPE_KEYRING,
+                                 first_name, 0);
+        if (cache_id != -1) {
+            return make_cache(data->collection_id, cache_id, data->anchor_name,
+                              data->collection_name, first_name, cache_out);
+        }
+    }
 
-    val = sscanf(ids_buf, "%d:%d:%d", &session, &process, &thread);
-    if (val != 3)
-        goto out;
+    /* A subsidiary cursor yields at most the first cache. */
+    if (data->subsidiary_name != NULL)
+        return 0;
+
+    keytype = KRCC_KEY_TYPE_KEYRING ";";
+    keytypelen = strlen(keytype);
+
+    for (; data->next_key < data->num_keys; data->next_key++) {
+        /* Free any previously retrieved key description. */
+        free(description);
+        description = NULL;
+
+        /*
+         * Get the key description, which should have the form:
+         *   typename;UID;GID;permissions;description
+         */
+        key = data->keys[data->next_key];
+        if (keyctl_describe_alloc(key, &description) < 0)
+            continue;
+        sep = strrchr(description, ';');
+        if (sep == NULL)
+            continue;
+        subsidiary_name = sep + 1;
+
+        /* Skip this key if it isn't a keyring. */
+        if (strncmp(description, keytype, keytypelen) != 0)
+            continue;
+
+        /* Don't repeat the primary cache. */
+        if (strcmp(subsidiary_name, data->primary_name) == 0)
+            continue;
+
+        /* We found a valid key */
+        data->next_key++;
+        ret = make_cache(data->collection_id, key, data->anchor_name,
+                         data->collection_name, subsidiary_name, cache_out);
+        free(description);
+        return ret;
+    }
 
-    p->session = session;
-    p->process = process;
-    p->thread = thread;
+    free(description);
+    return 0;
+}
 
-out:
-    DEBUG_PRINT(("krb5_krcc_get_ring_ids: returning %d:%d:%d\n",
-                 p->session, p->process, p->thread));
+static krb5_error_code KRB5_CALLCONV
+krb5_krcc_ptcursor_free(krb5_context context, krb5_cc_ptcursor *cursor)
+{
+    struct krcc_ptcursor_data *data = (*cursor)->data;
+
+    if (data != NULL) {
+        free(data->anchor_name);
+        free(data->collection_name);
+        free(data->subsidiary_name);
+        free(data->primary_name);
+        free(data->keys);
+        free(data);
+    }
+    free(*cursor);
+    *cursor = NULL;
     return 0;
 }
 
+static krb5_error_code KRB5_CALLCONV
+krb5_krcc_switch_to(krb5_context context, krb5_ccache cache)
+{
+    krb5_krcc_data *data = cache->data;
+    krb5_error_code ret;
+    char *anchor_name = NULL, *collection_name = NULL, *subsidiary_name = NULL;
+    key_serial_t collection_id;
+
+    ret = parse_residual(data->name, &anchor_name, &collection_name,
+                         &subsidiary_name);
+    if (ret)
+        goto cleanup;
+    ret = get_collection(anchor_name, collection_name, &collection_id);
+    if (ret)
+        goto cleanup;
+    ret = set_primary_name(context, collection_id, subsidiary_name);
+cleanup:
+    free(anchor_name);
+    free(collection_name);
+    free(subsidiary_name);
+    return ret;
+}
+
 /*
  * ===============================================================
  * INTERNAL functions to parse a credential from a key payload
@@ -1271,8 +1830,8 @@ out:
  * KRB5_CC_END - there were not len bytes available
  */
 static  krb5_error_code
-krb5_krcc_parse(krb5_context context, krb5_ccache id, krb5_pointer buf,
-                unsigned int len, krb5_krcc_bc * bc)
+krb5_krcc_parse(krb5_context context, krb5_pointer buf, unsigned int len,
+                krb5_krcc_bc * bc)
 {
     DEBUG_PRINT(("krb5_krcc_parse: entered\n"));
 
@@ -1290,8 +1849,8 @@ krb5_krcc_parse(krb5_context context, krb5_ccache id, krb5_pointer buf,
  * and parse it into a credential structure.
  */
 static  krb5_error_code
-krb5_krcc_parse_cred(krb5_context context, krb5_ccache id, krb5_creds * creds,
-                     char *payload, int psize)
+krb5_krcc_parse_cred(krb5_context context, krb5_creds * creds, char *payload,
+                     int psize)
 {
     krb5_error_code kret;
     krb5_octet octet;
@@ -1301,36 +1860,36 @@ krb5_krcc_parse_cred(krb5_context context, krb5_ccache id, krb5_creds * creds,
     /* Parse the pieces of the credential */
     bc.bpp = payload;
     bc.endp = bc.bpp + psize;
-    kret = krb5_krcc_parse_principal(context, id, &creds->client, &bc);
+    kret = krb5_krcc_parse_principal(context, &creds->client, &bc);
     CHECK_N_GO(kret, out);
 
-    kret = krb5_krcc_parse_principal(context, id, &creds->server, &bc);
+    kret = krb5_krcc_parse_principal(context, &creds->server, &bc);
     CHECK_N_GO(kret, cleanclient);
 
-    kret = krb5_krcc_parse_keyblock(context, id, &creds->keyblock, &bc);
+    kret = krb5_krcc_parse_keyblock(context, &creds->keyblock, &bc);
     CHECK_N_GO(kret, cleanserver);
 
-    kret = krb5_krcc_parse_times(context, id, &creds->times, &bc);
+    kret = krb5_krcc_parse_times(context, &creds->times, &bc);
     CHECK_N_GO(kret, cleanserver);
 
-    kret = krb5_krcc_parse_octet(context, id, &octet, &bc);
+    kret = krb5_krcc_parse_octet(context, &octet, &bc);
     CHECK_N_GO(kret, cleanserver);
     creds->is_skey = octet;
 
-    kret = krb5_krcc_parse_int32(context, id, &int32, &bc);
+    kret = krb5_krcc_parse_int32(context, &int32, &bc);
     CHECK_N_GO(kret, cleanserver);
     creds->ticket_flags = int32;
 
-    kret = krb5_krcc_parse_addrs(context, id, &creds->addresses, &bc);
+    kret = krb5_krcc_parse_addrs(context, &creds->addresses, &bc);
     CHECK_N_GO(kret, cleanblock);
 
-    kret = krb5_krcc_parse_authdata(context, id, &creds->authdata, &bc);
+    kret = krb5_krcc_parse_authdata(context, &creds->authdata, &bc);
     CHECK_N_GO(kret, cleanaddrs);
 
-    kret = krb5_krcc_parse_krb5data(context, id, &creds->ticket, &bc);
+    kret = krb5_krcc_parse_krb5data(context, &creds->ticket, &bc);
     CHECK_N_GO(kret, cleanauthdata);
 
-    kret = krb5_krcc_parse_krb5data(context, id, &creds->second_ticket, &bc);
+    kret = krb5_krcc_parse_krb5data(context, &creds->second_ticket, &bc);
     CHECK_N_GO(kret, cleanticket);
 
     kret = KRB5_OK;
@@ -1355,8 +1914,8 @@ out:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_principal(krb5_context context, krb5_ccache id,
-                          krb5_principal * princ, krb5_krcc_bc * bc)
+krb5_krcc_parse_principal(krb5_context context, krb5_principal * princ,
+                          krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     register krb5_principal tmpprinc;
@@ -1364,12 +1923,12 @@ krb5_krcc_parse_principal(krb5_context context, krb5_ccache id,
     int     i;
 
     /* Read principal type */
-    kret = krb5_krcc_parse_int32(context, id, &type, bc);
+    kret = krb5_krcc_parse_int32(context, &type, bc);
     if (kret != KRB5_OK)
         return kret;
 
     /* Read the number of components */
-    kret = krb5_krcc_parse_int32(context, id, &length, bc);
+    kret = krb5_krcc_parse_int32(context, &length, bc);
     if (kret != KRB5_OK)
         return kret;
 
@@ -1380,12 +1939,7 @@ krb5_krcc_parse_principal(krb5_context context, krb5_ccache id,
     if (tmpprinc == NULL)
         return KRB5_CC_NOMEM;
     if (length) {
-        size_t  msize = length;
-        if (msize != length) {
-            free(tmpprinc);
-            return KRB5_CC_NOMEM;
-        }
-        tmpprinc->data = ALLOC(msize, krb5_data);
+        tmpprinc->data = calloc(length, sizeof(krb5_data));
         if (tmpprinc->data == 0) {
             free(tmpprinc);
             return KRB5_CC_NOMEM;
@@ -1396,15 +1950,12 @@ krb5_krcc_parse_principal(krb5_context context, krb5_ccache id,
     tmpprinc->length = length;
     tmpprinc->type = type;
 
-    kret = krb5_krcc_parse_krb5data(context, id,
-                                    krb5_princ_realm(context, tmpprinc), bc);
+    kret = krb5_krcc_parse_krb5data(context, &tmpprinc->realm, bc);
     i = 0;
     CHECK(kret);
 
     for (i = 0; i < length; i++) {
-        kret = krb5_krcc_parse_krb5data(context, id,
-                                        krb5_princ_component(context, tmpprinc,
-                                                             i), bc);
+        kret = krb5_krcc_parse_krb5data(context, &tmpprinc->data[i], bc);
         CHECK(kret);
     }
     *princ = tmpprinc;
@@ -1412,16 +1963,16 @@ krb5_krcc_parse_principal(krb5_context context, krb5_ccache id,
 
 errout:
     while (--i >= 0)
-        free(krb5_princ_component(context, tmpprinc, i)->data);
-    free(krb5_princ_realm(context, tmpprinc)->data);
+        free(tmpprinc->data[i].data);
+    free(tmpprinc->realm.data);
     free(tmpprinc->data);
     free(tmpprinc);
     return kret;
 }
 
 static  krb5_error_code
-krb5_krcc_parse_keyblock(krb5_context context, krb5_ccache id,
-                         krb5_keyblock * keyblock, krb5_krcc_bc * bc)
+krb5_krcc_parse_keyblock(krb5_context context, krb5_keyblock * keyblock,
+                         krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_ui_2 ui2;
@@ -1430,26 +1981,22 @@ krb5_krcc_parse_keyblock(krb5_context context, krb5_ccache id,
     keyblock->magic = KV5M_KEYBLOCK;
     keyblock->contents = 0;
 
-    kret = krb5_krcc_parse_ui_2(context, id, &ui2, bc);
+    kret = krb5_krcc_parse_ui_2(context, &ui2, bc);
     CHECK(kret);
     keyblock->enctype = ui2;
 
-    kret = krb5_krcc_parse_int32(context, id, &int32, bc);
+    kret = krb5_krcc_parse_int32(context, &int32, bc);
     CHECK(kret);
     if (int32 < 0)
         return KRB5_CC_NOMEM;
     keyblock->length = int32;
-    /* Overflow check.  */
-    if (keyblock->length != int32)
-        return KRB5_CC_NOMEM;
     if (keyblock->length == 0)
         return KRB5_OK;
-    keyblock->contents = ALLOC(keyblock->length, krb5_octet);
+    keyblock->contents = malloc(keyblock->length);
     if (keyblock->contents == NULL)
         return KRB5_CC_NOMEM;
 
-    kret = krb5_krcc_parse(context, id, keyblock->contents,
-                           keyblock->length, bc);
+    kret = krb5_krcc_parse(context, keyblock->contents, keyblock->length, bc);
     CHECK(kret);
 
     return KRB5_OK;
@@ -1460,25 +2007,25 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_times(krb5_context context, krb5_ccache id,
-                      krb5_ticket_times * t, krb5_krcc_bc * bc)
+krb5_krcc_parse_times(krb5_context context, krb5_ticket_times * t,
+                      krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 i;
 
-    kret = krb5_krcc_parse_int32(context, id, &i, bc);
+    kret = krb5_krcc_parse_int32(context, &i, bc);
     CHECK(kret);
     t->authtime = i;
 
-    kret = krb5_krcc_parse_int32(context, id, &i, bc);
+    kret = krb5_krcc_parse_int32(context, &i, bc);
     CHECK(kret);
     t->starttime = i;
 
-    kret = krb5_krcc_parse_int32(context, id, &i, bc);
+    kret = krb5_krcc_parse_int32(context, &i, bc);
     CHECK(kret);
     t->endtime = i;
 
-    kret = krb5_krcc_parse_int32(context, id, &i, bc);
+    kret = krb5_krcc_parse_int32(context, &i, bc);
     CHECK(kret);
     t->renew_till = i;
 
@@ -1488,8 +2035,8 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_krb5data(krb5_context context, krb5_ccache id,
-                         krb5_data * data, krb5_krcc_bc * bc)
+krb5_krcc_parse_krb5data(krb5_context context, krb5_data * data,
+                         krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 len;
@@ -1497,12 +2044,12 @@ krb5_krcc_parse_krb5data(krb5_context context, krb5_ccache id,
     data->magic = KV5M_DATA;
     data->data = 0;
 
-    kret = krb5_krcc_parse_int32(context, id, &len, bc);
+    kret = krb5_krcc_parse_int32(context, &len, bc);
     CHECK(kret);
     if (len < 0)
         return KRB5_CC_NOMEM;
     data->length = len;
-    if (data->length != len || data->length + 1 == 0)
+    if (data->length + 1 == 0)
         return KRB5_CC_NOMEM;
 
     if (data->length == 0) {
@@ -1514,8 +2061,7 @@ krb5_krcc_parse_krb5data(krb5_context context, krb5_ccache id,
     if (data->data == NULL)
         return KRB5_CC_NOMEM;
 
-    kret = krb5_krcc_parse(context, id, data->data, (unsigned) data->length,
-                           bc);
+    kret = krb5_krcc_parse(context, data->data, (unsigned) data->length, bc);
     CHECK(kret);
 
     data->data[data->length] = 0;       /* Null terminate, just in case.... */
@@ -1527,13 +2073,12 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_int32(krb5_context context, krb5_ccache id, krb5_int32 * i,
-                      krb5_krcc_bc * bc)
+krb5_krcc_parse_int32(krb5_context context, krb5_int32 * i, krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     unsigned char buf[4];
 
-    kret = krb5_krcc_parse(context, id, buf, 4, bc);
+    kret = krb5_krcc_parse(context, buf, 4, bc);
     if (kret)
         return kret;
     *i = load_32_be(buf);
@@ -1541,15 +2086,14 @@ krb5_krcc_parse_int32(krb5_context context, krb5_ccache id, krb5_int32 * i,
 }
 
 static  krb5_error_code
-krb5_krcc_parse_octet(krb5_context context, krb5_ccache id, krb5_octet * i,
-                      krb5_krcc_bc * bc)
+krb5_krcc_parse_octet(krb5_context context, krb5_octet * i, krb5_krcc_bc * bc)
 {
-    return krb5_krcc_parse(context, id, (krb5_pointer) i, 1, bc);
+    return krb5_krcc_parse(context, (krb5_pointer) i, 1, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_parse_addrs(krb5_context context, krb5_ccache id,
-                      krb5_address *** addrs, krb5_krcc_bc * bc)
+krb5_krcc_parse_addrs(krb5_context context, krb5_address *** addrs,
+                      krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 length;
@@ -1559,18 +2103,17 @@ krb5_krcc_parse_addrs(krb5_context context, krb5_ccache id,
     *addrs = 0;
 
     /* Read the number of components */
-    kret = krb5_krcc_parse_int32(context, id, &length, bc);
+    kret = krb5_krcc_parse_int32(context, &length, bc);
     CHECK(kret);
 
     /*
      * Make *addrs able to hold length pointers to krb5_address structs
      * Add one extra for a null-terminated list
      */
-    msize = length;
-    msize += 1;
-    if (msize == 0 || msize - 1 != length || length < 0)
+    msize = (size_t)length + 1;
+    if (msize == 0 || length < 0)
         return KRB5_CC_NOMEM;
-    *addrs = ALLOC(msize, krb5_address *);
+    *addrs = calloc(msize, sizeof(krb5_address *));
     if (*addrs == NULL)
         return KRB5_CC_NOMEM;
 
@@ -1580,7 +2123,7 @@ krb5_krcc_parse_addrs(krb5_context context, krb5_ccache id,
             krb5_free_addresses(context, *addrs);
             return KRB5_CC_NOMEM;
         }
-        kret = krb5_krcc_parse_addr(context, id, (*addrs)[i], bc);
+        kret = krb5_krcc_parse_addr(context, (*addrs)[i], bc);
         CHECK(kret);
     }
 
@@ -1592,7 +2135,7 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_addr(krb5_context context, krb5_ccache id, krb5_address * addr,
+krb5_krcc_parse_addr(krb5_context context, krb5_address * addr,
                      krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
@@ -1602,22 +2145,15 @@ krb5_krcc_parse_addr(krb5_context context, krb5_ccache id, krb5_address * addr,
     addr->magic = KV5M_ADDRESS;
     addr->contents = 0;
 
-    kret = krb5_krcc_parse_ui_2(context, id, &ui2, bc);
+    kret = krb5_krcc_parse_ui_2(context, &ui2, bc);
     CHECK(kret);
     addr->addrtype = ui2;
 
-    kret = krb5_krcc_parse_int32(context, id, &int32, bc);
+    kret = krb5_krcc_parse_int32(context, &int32, bc);
     CHECK(kret);
     if ((int32 & VALID_INT_BITS) != int32)      /* Overflow int??? */
         return KRB5_CC_NOMEM;
     addr->length = int32;
-    /*
-     * Length field is "unsigned int", which may be smaller
-     * than 32 bits.
-     */
-    if (addr->length != int32)
-        return KRB5_CC_NOMEM;   /* XXX */
-
     if (addr->length == 0)
         return KRB5_OK;
 
@@ -1625,7 +2161,7 @@ krb5_krcc_parse_addr(krb5_context context, krb5_ccache id, krb5_address * addr,
     if (addr->contents == NULL)
         return KRB5_CC_NOMEM;
 
-    kret = krb5_krcc_parse(context, id, addr->contents, addr->length, bc);
+    kret = krb5_krcc_parse(context, addr->contents, addr->length, bc);
     CHECK(kret);
 
     return KRB5_OK;
@@ -1636,8 +2172,8 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_authdata(krb5_context context, krb5_ccache id,
-                         krb5_authdata *** a, krb5_krcc_bc * bc)
+krb5_krcc_parse_authdata(krb5_context context, krb5_authdata *** a,
+                         krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 length;
@@ -1647,7 +2183,7 @@ krb5_krcc_parse_authdata(krb5_context context, krb5_ccache id,
     *a = 0;
 
     /* Read the number of components */
-    kret = krb5_krcc_parse_int32(context, id, &length, bc);
+    kret = krb5_krcc_parse_int32(context, &length, bc);
     CHECK(kret);
 
     if (length == 0)
@@ -1657,11 +2193,10 @@ krb5_krcc_parse_authdata(krb5_context context, krb5_ccache id,
      * Make *a able to hold length pointers to krb5_authdata structs
      * Add one extra for a null-terminated list
      */
-    msize = length;
-    msize += 1;
-    if (msize == 0 || msize - 1 != length || length < 0)
+    msize = (size_t)length + 1;
+    if (msize == 0 || length < 0)
         return KRB5_CC_NOMEM;
-    *a = ALLOC(msize, krb5_authdata *);
+    *a = calloc(msize, sizeof(krb5_authdata *));
     if (*a == NULL)
         return KRB5_CC_NOMEM;
 
@@ -1672,7 +2207,7 @@ krb5_krcc_parse_authdata(krb5_context context, krb5_ccache id,
             *a = NULL;
             return KRB5_CC_NOMEM;
         }
-        kret = krb5_krcc_parse_authdatum(context, id, (*a)[i], bc);
+        kret = krb5_krcc_parse_authdatum(context, (*a)[i], bc);
         CHECK(kret);
     }
 
@@ -1686,8 +2221,8 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_authdatum(krb5_context context, krb5_ccache id,
-                          krb5_authdata * a, krb5_krcc_bc * bc)
+krb5_krcc_parse_authdatum(krb5_context context, krb5_authdata * a,
+                          krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 int32;
@@ -1696,21 +2231,14 @@ krb5_krcc_parse_authdatum(krb5_context context, krb5_ccache id,
     a->magic = KV5M_AUTHDATA;
     a->contents = NULL;
 
-    kret = krb5_krcc_parse_ui_2(context, id, &ui2, bc);
+    kret = krb5_krcc_parse_ui_2(context, &ui2, bc);
     CHECK(kret);
     a->ad_type = (krb5_authdatatype) ui2;
-    kret = krb5_krcc_parse_int32(context, id, &int32, bc);
+    kret = krb5_krcc_parse_int32(context, &int32, bc);
     CHECK(kret);
     if ((int32 & VALID_INT_BITS) != int32)      /* Overflow int??? */
         return KRB5_CC_NOMEM;
     a->length = int32;
-    /*
-     * Value could have gotten truncated if int is
-     * smaller than 32 bits.
-     */
-    if (a->length != int32)
-        return KRB5_CC_NOMEM;   /* XXX */
-
     if (a->length == 0)
         return KRB5_OK;
 
@@ -1718,7 +2246,7 @@ krb5_krcc_parse_authdatum(krb5_context context, krb5_ccache id,
     if (a->contents == NULL)
         return KRB5_CC_NOMEM;
 
-    kret = krb5_krcc_parse(context, id, a->contents, a->length, bc);
+    kret = krb5_krcc_parse(context, a->contents, a->length, bc);
     CHECK(kret);
 
     return KRB5_OK;
@@ -1730,13 +2258,12 @@ errout:
 }
 
 static  krb5_error_code
-krb5_krcc_parse_ui_2(krb5_context context, krb5_ccache id, krb5_ui_2 * i,
-                     krb5_krcc_bc * bc)
+krb5_krcc_parse_ui_2(krb5_context context, krb5_ui_2 * i, krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     unsigned char buf[2];
 
-    kret = krb5_krcc_parse(context, id, buf, 2, bc);
+    kret = krb5_krcc_parse(context, buf, 2, bc);
     if (kret)
         return kret;
     *i = load_16_be(buf);
@@ -1756,9 +2283,15 @@ krb5_krcc_parse_ui_2(krb5_context context, krb5_ccache id, krb5_ui_2 * i,
  * system errors
  */
 static  krb5_error_code
-krb5_krcc_unparse(krb5_context context, krb5_ccache id, krb5_pointer buf,
-                  unsigned int len, krb5_krcc_bc * bc)
+krb5_krcc_unparse(krb5_context context, krb5_pointer buf, unsigned int len,
+                  krb5_krcc_bc * bc)
 {
+    if (bc->bpp == NULL) {
+        /* This is a dry run; just increase size and return. */
+        bc->size += len;
+        return KRB5_OK;
+    }
+
     if (bc->bpp + len > bc->endp)
         return KRB5_CC_WRITE;
 
@@ -1769,29 +2302,26 @@ krb5_krcc_unparse(krb5_context context, krb5_ccache id, krb5_pointer buf,
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_principal(krb5_context context, krb5_ccache id,
-                            krb5_principal princ, krb5_krcc_bc * bc)
+krb5_krcc_unparse_principal(krb5_context context, krb5_principal princ,
+                            krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_int32 i, length, tmp, type;
 
-    type = krb5_princ_type(context, princ);
-    tmp = length = krb5_princ_size(context, princ);
+    type = princ->type;
+    tmp = length = princ->length;
 
-    kret = krb5_krcc_unparse_int32(context, id, type, bc);
+    kret = krb5_krcc_unparse_int32(context, type, bc);
     CHECK_OUT(kret);
 
-    kret = krb5_krcc_unparse_int32(context, id, tmp, bc);
+    kret = krb5_krcc_unparse_int32(context, tmp, bc);
     CHECK_OUT(kret);
 
-    kret = krb5_krcc_unparse_krb5data(context, id,
-                                      krb5_princ_realm(context, princ), bc);
+    kret = krb5_krcc_unparse_krb5data(context, &princ->realm, bc);
     CHECK_OUT(kret);
 
     for (i = 0; i < length; i++) {
-        kret = krb5_krcc_unparse_krb5data(context, id,
-                                          krb5_princ_component(context, princ,
-                                                               i), bc);
+        kret = krb5_krcc_unparse_krb5data(context, &princ->data[i], bc);
         CHECK_OUT(kret);
     }
 
@@ -1799,67 +2329,65 @@ krb5_krcc_unparse_principal(krb5_context context, krb5_ccache id,
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_keyblock(krb5_context context, krb5_ccache id,
-                           krb5_keyblock * keyblock, krb5_krcc_bc * bc)
+krb5_krcc_unparse_keyblock(krb5_context context, krb5_keyblock * keyblock,
+                           krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
 
-    kret = krb5_krcc_unparse_ui_2(context, id, keyblock->enctype, bc);
+    kret = krb5_krcc_unparse_ui_2(context, keyblock->enctype, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_ui_4(context, id, keyblock->length, bc);
+    kret = krb5_krcc_unparse_ui_4(context, keyblock->length, bc);
     CHECK_OUT(kret);
-    return krb5_krcc_unparse(context, id, (char *) keyblock->contents,
+    return krb5_krcc_unparse(context, (char *) keyblock->contents,
                              keyblock->length, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_times(krb5_context context, krb5_ccache id,
-                        krb5_ticket_times * t, krb5_krcc_bc * bc)
+krb5_krcc_unparse_times(krb5_context context, krb5_ticket_times * t,
+                        krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
 
-    kret = krb5_krcc_unparse_int32(context, id, t->authtime, bc);
+    kret = krb5_krcc_unparse_int32(context, t->authtime, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_int32(context, id, t->starttime, bc);
+    kret = krb5_krcc_unparse_int32(context, t->starttime, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_int32(context, id, t->endtime, bc);
+    kret = krb5_krcc_unparse_int32(context, t->endtime, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_int32(context, id, t->renew_till, bc);
+    kret = krb5_krcc_unparse_int32(context, t->renew_till, bc);
     CHECK_OUT(kret);
     return 0;
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_krb5data(krb5_context context, krb5_ccache id,
-                           krb5_data * data, krb5_krcc_bc * bc)
+krb5_krcc_unparse_krb5data(krb5_context context, krb5_data * data,
+                           krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
 
-    kret = krb5_krcc_unparse_ui_4(context, id, data->length, bc);
+    kret = krb5_krcc_unparse_ui_4(context, data->length, bc);
     CHECK_OUT(kret);
-    return krb5_krcc_unparse(context, id, data->data, data->length, bc);
+    return krb5_krcc_unparse(context, data->data, data->length, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_int32(krb5_context context, krb5_ccache id, krb5_int32 i,
-                        krb5_krcc_bc * bc)
+krb5_krcc_unparse_int32(krb5_context context, krb5_int32 i, krb5_krcc_bc * bc)
 {
-    return krb5_krcc_unparse_ui_4(context, id, (krb5_ui_4) i, bc);
+    return krb5_krcc_unparse_ui_4(context, (krb5_ui_4) i, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_octet(krb5_context context, krb5_ccache id, krb5_int32 i,
-                        krb5_krcc_bc * bc)
+krb5_krcc_unparse_octet(krb5_context context, krb5_int32 i, krb5_krcc_bc * bc)
 {
     krb5_octet ibuf;
 
     ibuf = (krb5_octet) i;
-    return krb5_krcc_unparse(context, id, (char *) &ibuf, 1, bc);
+    return krb5_krcc_unparse(context, (char *) &ibuf, 1, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_addrs(krb5_context context, krb5_ccache id,
-                        krb5_address ** addrs, krb5_krcc_bc * bc)
+krb5_krcc_unparse_addrs(krb5_context context, krb5_address ** addrs,
+                        krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
     krb5_address **temp;
@@ -1872,10 +2400,10 @@ krb5_krcc_unparse_addrs(krb5_context context, krb5_ccache id,
             length += 1;
     }
 
-    kret = krb5_krcc_unparse_int32(context, id, length, bc);
+    kret = krb5_krcc_unparse_int32(context, length, bc);
     CHECK_OUT(kret);
     for (i = 0; i < length; i++) {
-        kret = krb5_krcc_unparse_addr(context, id, addrs[i], bc);
+        kret = krb5_krcc_unparse_addr(context, addrs[i], bc);
         CHECK_OUT(kret);
     }
 
@@ -1883,21 +2411,21 @@ krb5_krcc_unparse_addrs(krb5_context context, krb5_ccache id,
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_addr(krb5_context context, krb5_ccache id,
-                       krb5_address * addr, krb5_krcc_bc * bc)
+krb5_krcc_unparse_addr(krb5_context context, krb5_address * addr,
+                       krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
 
-    kret = krb5_krcc_unparse_ui_2(context, id, addr->addrtype, bc);
+    kret = krb5_krcc_unparse_ui_2(context, addr->addrtype, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_ui_4(context, id, addr->length, bc);
+    kret = krb5_krcc_unparse_ui_4(context, addr->length, bc);
     CHECK_OUT(kret);
-    return krb5_krcc_unparse(context, id, (char *) addr->contents,
+    return krb5_krcc_unparse(context, (char *) addr->contents,
                              addr->length, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_authdata(krb5_context context, krb5_ccache id,
+krb5_krcc_unparse_authdata(krb5_context context,
                            krb5_authdata ** a, krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
@@ -1909,47 +2437,45 @@ krb5_krcc_unparse_authdata(krb5_context context, krb5_ccache id,
             length++;
     }
 
-    kret = krb5_krcc_unparse_int32(context, id, length, bc);
+    kret = krb5_krcc_unparse_int32(context, length, bc);
     CHECK_OUT(kret);
     for (i = 0; i < length; i++) {
-        kret = krb5_krcc_unparse_authdatum(context, id, a[i], bc);
+        kret = krb5_krcc_unparse_authdatum(context, a[i], bc);
         CHECK_OUT(kret);
     }
     return KRB5_OK;
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_authdatum(krb5_context context, krb5_ccache id,
-                            krb5_authdata * a, krb5_krcc_bc * bc)
+krb5_krcc_unparse_authdatum(krb5_context context, krb5_authdata * a,
+                            krb5_krcc_bc * bc)
 {
     krb5_error_code kret;
 
-    kret = krb5_krcc_unparse_ui_2(context, id, a->ad_type, bc);
+    kret = krb5_krcc_unparse_ui_2(context, a->ad_type, bc);
     CHECK_OUT(kret);
-    kret = krb5_krcc_unparse_ui_4(context, id, a->length, bc);
+    kret = krb5_krcc_unparse_ui_4(context, a->length, bc);
     CHECK_OUT(kret);
-    return krb5_krcc_unparse(context, id, (krb5_pointer) a->contents,
+    return krb5_krcc_unparse(context, (krb5_pointer) a->contents,
                              a->length, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_ui_4(krb5_context context, krb5_ccache id, krb5_ui_4 i,
-                       krb5_krcc_bc * bc)
+krb5_krcc_unparse_ui_4(krb5_context context, krb5_ui_4 i, krb5_krcc_bc * bc)
 {
     unsigned char buf[4];
 
     store_32_be(i, buf);
-    return krb5_krcc_unparse(context, id, buf, 4, bc);
+    return krb5_krcc_unparse(context, buf, 4, bc);
 }
 
 static  krb5_error_code
-krb5_krcc_unparse_ui_2(krb5_context context, krb5_ccache id, krb5_int32 i,
-                       krb5_krcc_bc * bc)
+krb5_krcc_unparse_ui_2(krb5_context context, krb5_int32 i, krb5_krcc_bc * bc)
 {
     unsigned char buf[2];
 
     store_16_be(i, buf);
-    return krb5_krcc_unparse(context, id, buf, 2, bc);
+    return krb5_krcc_unparse(context, buf, 2, bc);
 }
 
 /*
@@ -1965,11 +2491,55 @@ krb5_krcc_unparse_ui_2(krb5_context context, krb5_ccache id, krb5_int32 i,
  * Caller is responsible for freeing returned buffer.
  */
 static  krb5_error_code
-krb5_krcc_unparse_cred(krb5_context context, krb5_ccache id,
-                       krb5_creds * creds, char **datapp, unsigned int *lenptr)
+krb5_krcc_unparse_cred(krb5_context context, krb5_creds * creds,
+                       krb5_krcc_bc *bc)
 {
     krb5_error_code kret;
-    char   *buf;
+
+    kret = krb5_krcc_unparse_principal(context, creds->client, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_principal(context, creds->server, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_keyblock(context, &creds->keyblock, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_times(context, &creds->times, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_octet(context, (krb5_int32) creds->is_skey, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_int32(context, creds->ticket_flags, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_addrs(context, creds->addresses, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_authdata(context, creds->authdata, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_krb5data(context, &creds->ticket, bc);
+    CHECK_OUT(kret);
+    CHECK(kret);
+
+    kret = krb5_krcc_unparse_krb5data(context, &creds->second_ticket, bc);
+    CHECK_OUT(kret);
+
+    /* Success! */
+    kret = KRB5_OK;
+
+errout:
+    return kret;
+}
+
+static  krb5_error_code
+krb5_krcc_unparse_cred_alloc(krb5_context context, krb5_creds * creds,
+                             char **datapp, unsigned int *lenptr)
+{
+    krb5_error_code kret;
+    char *buf = NULL;
     krb5_krcc_bc bc;
 
     if (!creds || !datapp || !lenptr)
@@ -1978,43 +2548,102 @@ krb5_krcc_unparse_cred(krb5_context context, krb5_ccache id,
     *datapp = NULL;
     *lenptr = 0;
 
-    buf = malloc(GUESS_CRED_SIZE);
+    /* Do a dry run first to calculate the size. */
+    bc.bpp = bc.endp = NULL;
+    bc.size = 0;
+    kret = krb5_krcc_unparse_cred(context, creds, &bc);
+    CHECK(kret);
+    if (bc.size > MAX_CRED_SIZE)
+        return KRB5_CC_WRITE;
+
+    /* Allocate a buffer and unparse for real. */
+    buf = malloc(bc.size);
     if (buf == NULL)
         return KRB5_CC_NOMEM;
-
     bc.bpp = buf;
-    bc.endp = buf + GUESS_CRED_SIZE;
+    bc.endp = buf + bc.size;
+    kret = krb5_krcc_unparse_cred(context, creds, &bc);
+    CHECK(kret);
 
-    kret = krb5_krcc_unparse_principal(context, id, creds->client, &bc);
-    CHECK_N_GO(kret, errout);
+    /* Success! */
+    *datapp = buf;
+    *lenptr = bc.bpp - buf;
+    buf = NULL;
+    kret = KRB5_OK;
 
-    kret = krb5_krcc_unparse_principal(context, id, creds->server, &bc);
-    CHECK_N_GO(kret, errout);
+errout:
+    free(buf);
+    return kret;
+}
 
-    kret = krb5_krcc_unparse_keyblock(context, id, &creds->keyblock, &bc);
-    CHECK_N_GO(kret, errout);
+static krb5_error_code
+krb5_krcc_parse_index(krb5_context context, krb5_int32 *version,
+                      char **primary, void *payload, int psize)
+{
+    krb5_error_code kret;
+    krb5_krcc_bc bc;
+    krb5_data data;
 
-    kret = krb5_krcc_unparse_times(context, id, &creds->times, &bc);
-    CHECK_N_GO(kret, errout);
+    bc.bpp = payload;
+    bc.endp = bc.bpp + psize;
 
-    kret = krb5_krcc_unparse_octet(context, id, (krb5_int32) creds->is_skey,
-                                   &bc);
-    CHECK_N_GO(kret, errout);
+    kret = krb5_krcc_parse_int32(context, version, &bc);
+    CHECK_OUT(kret);
 
-    kret = krb5_krcc_unparse_int32(context, id, creds->ticket_flags, &bc);
-    CHECK_N_GO(kret, errout);
+    kret = krb5_krcc_parse_krb5data(context, &data, &bc);
+    CHECK_OUT(kret);
 
-    kret = krb5_krcc_unparse_addrs(context, id, creds->addresses, &bc);
-    CHECK_N_GO(kret, errout);
+    *primary = (char *)data.data;
+    return KRB5_OK;
+}
 
-    kret = krb5_krcc_unparse_authdata(context, id, creds->authdata, &bc);
-    CHECK_N_GO(kret, errout);
+static krb5_error_code
+krb5_krcc_unparse_index_internal(krb5_context context, krb5_int32 version,
+                                 const char *primary, krb5_krcc_bc *bc)
+{
+    krb5_error_code kret;
+    krb5_data data;
 
-    kret = krb5_krcc_unparse_krb5data(context, id, &creds->ticket, &bc);
-    CHECK_N_GO(kret, errout);
+    data.length = strlen(primary) + 1;
+    data.data = (void *)primary;
 
-    kret = krb5_krcc_unparse_krb5data(context, id, &creds->second_ticket, &bc);
-    CHECK_N_GO(kret, errout);
+    kret = krb5_krcc_unparse_int32(context, version, bc);
+    CHECK_OUT(kret);
+
+    kret = krb5_krcc_unparse_krb5data(context, &data, bc);
+    CHECK_OUT(kret);
+
+    return KRB5_OK;
+}
+
+static krb5_error_code
+krb5_krcc_unparse_index(krb5_context context, krb5_int32 version,
+                        const char *primary, void **datapp, int *lenptr)
+{
+    krb5_error_code kret;
+    krb5_krcc_bc bc;
+    char *buf;
+
+    if (!primary || !datapp || !lenptr)
+        return EINVAL;
+
+    *datapp = NULL;
+    *lenptr = 0;
+
+    /* Do a dry run first to calculate the size. */
+    bc.bpp = bc.endp = NULL;
+    bc.size = 0;
+    kret = krb5_krcc_unparse_index_internal(context, version, primary, &bc);
+    CHECK_OUT(kret);
+
+    buf = malloc(bc.size);
+    if (buf == NULL)
+        return ENOMEM;
+
+    bc.bpp = buf;
+    bc.endp = buf + bc.size;
+    kret = krb5_krcc_unparse_index_internal(context, version, primary, &bc);
+    CHECK(kret);
 
     /* Success! */
     *datapp = buf;
@@ -2022,6 +2651,8 @@ krb5_krcc_unparse_cred(krb5_context context, krb5_ccache id,
     kret = KRB5_OK;
 
 errout:
+    if (kret)
+        free(buf);
     return kret;
 }
 
@@ -2065,15 +2696,15 @@ const krb5_cc_ops krb5_krcc_ops = {
     krb5_krcc_remove_cred,
     krb5_krcc_set_flags,
     krb5_krcc_get_flags,        /* added after 1.4 release */
-    NULL,
-    NULL,
-    NULL,
+    krb5_krcc_ptcursor_new,
+    krb5_krcc_ptcursor_next,
+    krb5_krcc_ptcursor_free,
     NULL, /* move */
     krb5_krcc_last_change_time, /* lastchange */
     NULL, /* wasdefault */
     krb5_krcc_lock,
     krb5_krcc_unlock,
-    NULL, /* switch_to */
+    krb5_krcc_switch_to,
 };
 
 #else /* !USE_KEYRING_CCACHE */
diff --git a/src/lib/krb5/ccache/t_cc.c b/src/lib/krb5/ccache/t_cc.c
index e14ae7f..6069cab 100644
--- a/src/lib/krb5/ccache/t_cc.c
+++ b/src/lib/krb5/ccache/t_cc.c
@@ -25,6 +25,7 @@
  */
 
 #include "k5-int.h"
+#include "cc-int.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include "autoconf.h"
@@ -331,14 +332,14 @@ check_registered(krb5_context context, const char *prefix)
     if(kret != KRB5_OK) {
         if(kret == KRB5_CC_UNKNOWN_TYPE)
             return 0;
-        com_err("Checking on credential type", kret,prefix);
+        com_err("Checking on credential type", kret, "%s", prefix);
         fflush(stderr);
         return 0;
     }
 
     kret = krb5_cc_close(context, id);
     if(kret != KRB5_OK) {
-        com_err("Checking on credential type - closing", kret,prefix);
+        com_err("Checking on credential type - closing", kret, "%s", prefix);
         fflush(stderr);
     }
 
@@ -425,8 +426,8 @@ main(void)
     test_misc(context);
     do_test(context, "");
 
-    if(check_registered(context, "KEYRING:"))
-        do_test(context, "KEYRING:");
+    if (check_registered(context, "KEYRING:process:"))
+        do_test(context, "KEYRING:process:");
     else
         printf("Skiping KEYRING: test - unregistered type\n");
 
diff --git a/src/lib/krb5/ccache/t_cccol.c b/src/lib/krb5/ccache/t_cccol.c
new file mode 100644
index 0000000..444806e
--- /dev/null
+++ b/src/lib/krb5/ccache/t_cccol.c
@@ -0,0 +1,363 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* lib/krb5/ccache/t_cccol.py - Test ccache collection via API */
+/*
+ * Copyright (C) 2013 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <krb5.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+static krb5_context ctx;
+
+/* Check that code is 0.  Display an error message first if it is not. */
+static void
+check(krb5_error_code code)
+{
+    const char *errmsg;
+
+    if (code != 0) {
+        errmsg = krb5_get_error_message(ctx, code);
+        fprintf(stderr, "%s\n", errmsg);
+        krb5_free_error_message(ctx, errmsg);
+    }
+    assert(code == 0);
+}
+
+/* Construct a list of the names of each credential cache in the collection. */
+static void
+get_collection_names(char ***list_out, size_t *count_out)
+{
+    krb5_cccol_cursor cursor;
+    krb5_ccache cache;
+    char **list = NULL;
+    size_t count = 0;
+    char *name;
+
+    check(krb5_cccol_cursor_new(ctx, &cursor));
+    while (1) {
+        check(krb5_cccol_cursor_next(ctx, cursor, &cache));
+        if (cache == NULL)
+            break;
+        check(krb5_cc_get_full_name(ctx, cache, &name));
+        krb5_cc_close(ctx, cache);
+        list = realloc(list, (count + 1) * sizeof(*list));
+        assert(list != NULL);
+        list[count++] = name;
+    }
+    krb5_cccol_cursor_free(ctx, &cursor);
+    *list_out = list;
+    *count_out = count;
+}
+
+/* Return true if list contains name. */
+static krb5_boolean
+in_list(char **list, size_t count, const char *name)
+{
+    size_t i;
+
+    for (i = 0; i < count; i++) {
+        if (strcmp(list[i], name) == 0)
+            return TRUE;
+    }
+    return FALSE;
+}
+
+/* Release the memory for a list of credential cache names. */
+static void
+free_list(char **list, size_t count)
+{
+    size_t i;
+
+    for (i = 0; i < count; i++)
+        krb5_free_string(ctx, list[i]);
+    free(list);
+}
+
+/*
+ * Check that the cache names within the current collection begin with first
+ * (unless first is NULL), that the other elements match the remaining
+ * arguments in some order.  others must be the number of additional cache
+ * names.
+ */
+static void
+check_collection(const char *first, size_t others, ...)
+{
+    va_list ap;
+    char **list;
+    size_t count, i;
+    const char *name;
+
+    get_collection_names(&list, &count);
+    if (first != NULL) {
+        assert(strcmp(first, list[0]) == 0);
+        assert(count == others + 1);
+    } else {
+        assert(count == others);
+    }
+    va_start(ap, others);
+    for (i = 0; i < others; i++) {
+        name = va_arg(ap, const char *);
+        assert(in_list(list, count, name));
+    }
+    va_end(ap);
+    free_list(list, count);
+}
+
+/* Check that the name of cache matches expected_name. */
+static void
+check_name(krb5_ccache cache, const char *expected_name)
+{
+    char *name;
+
+    check(krb5_cc_get_full_name(ctx, cache, &name));
+    assert(strcmp(name, expected_name) == 0);
+    krb5_free_string(ctx, name);
+}
+
+/* Check that when collection_name is resolved, the resulting cache's name
+ * matches expected_name. */
+static void
+check_primary_name(const char *collection_name, const char *expected_name)
+{
+    krb5_ccache cache;
+
+    check(krb5_cc_resolve(ctx, collection_name, &cache));
+    check_name(cache, expected_name);
+    krb5_cc_close(ctx, cache);
+}
+
+/* Check that when name is resolved, the resulting cache's principal matches
+ * expected_princ, or has no principal if expected_princ is NULL. */
+static void
+check_princ(const char *name, krb5_principal expected_princ)
+{
+    krb5_ccache cache;
+    krb5_principal princ;
+
+    check(krb5_cc_resolve(ctx, name, &cache));
+    if (expected_princ != NULL) {
+        check(krb5_cc_get_principal(ctx, cache, &princ));
+        assert(krb5_principal_compare(ctx, princ, expected_princ));
+        krb5_free_principal(ctx, princ);
+    } else {
+        assert(krb5_cc_get_principal(ctx, cache, &princ) != 0);
+    }
+    krb5_cc_close(ctx, cache);
+}
+
+/* Check that krb5_cc_cache_match on princ returns a cache whose name matches
+ * expected_name, or that the match fails if expected_name is NULL. */
+static void
+check_match(krb5_principal princ, const char *expected_name)
+{
+    krb5_ccache cache;
+
+    if (expected_name != NULL) {
+        check(krb5_cc_cache_match(ctx, princ, &cache));
+        check_name(cache, expected_name);
+        krb5_cc_close(ctx, cache);
+    } else {
+        assert(krb5_cc_cache_match(ctx, princ, &cache) != 0);
+    }
+}
+
+int
+main(int argc, char **argv)
+{
+    krb5_ccache ccinitial, ccu1, ccu2;
+    krb5_principal princ1, princ2, princ3;
+    const char *collection_name, *typename;
+    char *initial_primary_name, *unique1_name, *unique2_name;
+
+    /*
+     * Get the collection name from the command line.  This is a ccache name
+     * with collection semantics, like DIR:/path/to/directory.  This test
+     * program assumes that the collection is empty to start with.
+     */
+    assert(argc == 2);
+    collection_name = argv[1];
+
+    /*
+     * Set the default ccache for the context to be the collection name, so the
+     * library can find the collection.
+     */
+    check(krb5_init_context(&ctx));
+    check(krb5_cc_set_default_name(ctx, collection_name));
+
+    /*
+     * Resolve the collection name.  Since the collection is empty, this should
+     * generate a subsidiary name of an uninitialized cache.  Getting the name
+     * of the resulting cache should give us the subsidiary name, not the
+     * collection name.  This resulting subsidiary name should be consistent if
+     * we resolve the collection name again, and the collection should still be
+     * empty since we haven't initialized the cache.
+     */
+    check(krb5_cc_resolve(ctx, collection_name, &ccinitial));
+    check(krb5_cc_get_full_name(ctx, ccinitial, &initial_primary_name));
+    assert(strcmp(initial_primary_name, collection_name) != 0);
+    check_primary_name(collection_name, initial_primary_name);
+    check_collection(NULL, 0);
+    check_princ(collection_name, NULL);
+    check_princ(initial_primary_name, NULL);
+
+    /*
+     * Before initializing the primary ccache, generate and initialize two
+     * unique caches of the collection's type.  Check that the cache names
+     * resolve to the generated caches and appear in the collection.  (They
+     * might appear before being initialized; that's not currently considered
+     * important).  The primary cache for the collection should remain as the
+     * unitialized cache from the previous step.
+     */
+    typename = krb5_cc_get_type(ctx, ccinitial);
+    check(krb5_cc_new_unique(ctx, typename, NULL, &ccu1));
+    check(krb5_cc_get_full_name(ctx, ccu1, &unique1_name));
+    check(krb5_parse_name(ctx, "princ1@X", &princ1));
+    check(krb5_cc_initialize(ctx, ccu1, princ1));
+    check_princ(unique1_name, princ1);
+    check_match(princ1, unique1_name);
+    check_collection(NULL, 1, unique1_name);
+    check(krb5_cc_new_unique(ctx, typename, NULL, &ccu2));
+    check(krb5_cc_get_full_name(ctx, ccu2, &unique2_name));
+    check(krb5_parse_name(ctx, "princ2@X", &princ2));
+    check(krb5_cc_initialize(ctx, ccu2, princ2));
+    check_princ(unique2_name, princ2);
+    check_match(princ1, unique1_name);
+    check_match(princ2, unique2_name);
+    check_collection(NULL, 2, unique1_name, unique2_name);
+    assert(strcmp(unique1_name, initial_primary_name) != 0);
+    assert(strcmp(unique1_name, collection_name) != 0);
+    assert(strcmp(unique2_name, initial_primary_name) != 0);
+    assert(strcmp(unique2_name, collection_name) != 0);
+    assert(strcmp(unique2_name, unique1_name) != 0);
+    check_primary_name(collection_name, initial_primary_name);
+
+    /*
+     * Initialize the initial primary cache.  Make sure it didn't change names,
+     * that the previously retrieved name and the collection name both resolve
+     * to the initialized cache, and that it now appears first in the
+     * collection.
+     */
+    check(krb5_parse_name(ctx, "princ3@X", &princ3));
+    check(krb5_cc_initialize(ctx, ccinitial, princ3));
+    check_name(ccinitial, initial_primary_name);
+    check_princ(initial_primary_name, princ3);
+    check_princ(collection_name, princ3);
+    check_match(princ3, initial_primary_name);
+    check_collection(initial_primary_name, 2, unique1_name, unique2_name);
+
+    /*
+     * Switch the primary cache to each cache we have open.  One each switch,
+     * check the primary name, check that the collection resolves to the
+     * expected cache, and check that the new primary name appears first in the
+     * collection.
+     */
+    check(krb5_cc_switch(ctx, ccu1));
+    check_primary_name(collection_name, unique1_name);
+    check_princ(collection_name, princ1);
+    check_collection(unique1_name, 2, initial_primary_name, unique2_name);
+    check(krb5_cc_switch(ctx, ccu2));
+    check_primary_name(collection_name, unique2_name);
+    check_princ(collection_name, princ2);
+    check_collection(unique2_name, 2, initial_primary_name, unique1_name);
+    check(krb5_cc_switch(ctx, ccinitial));
+    check_primary_name(collection_name, initial_primary_name);
+    check_princ(collection_name, princ3);
+    check_collection(initial_primary_name, 2, unique1_name, unique2_name);
+
+    /*
+     * Temporarily set the context default ccache to a subsidiary name, and
+     * check that iterating over the collection yields that subsidiary cache
+     * and no others.
+     */
+    check(krb5_cc_set_default_name(ctx, unique1_name));
+    check_collection(unique1_name, 0);
+    check(krb5_cc_set_default_name(ctx, collection_name));
+
+    /*
+     * Destroy the primary cache.  Make sure this causes both the initial
+     * primary name and the collection name to resolve to an uninitialized
+     * cache.  Make sure the primary name doesn't change and doesn't appear in
+     * the collection any more.
+     */
+    check(krb5_cc_destroy(ctx, ccinitial));
+    check_princ(initial_primary_name, NULL);
+    check_princ(collection_name, NULL);
+    check_primary_name(collection_name, initial_primary_name);
+    check_match(princ1, unique1_name);
+    check_match(princ2, unique2_name);
+    check_match(princ3, NULL);
+    check_collection(NULL, 2, unique1_name, unique2_name);
+
+    /*
+     * Switch to the first unique cache after destroying the primary cache.
+     * Check that the collection name resolves to this cache and that the new
+     * primary name appears first in the collection.
+     */
+    check(krb5_cc_switch(ctx, ccu1));
+    check_primary_name(collection_name, unique1_name);
+    check_princ(collection_name, princ1);
+    check_collection(unique1_name, 1, unique2_name);
+
+    /*
+     * Destroy the second unique cache (which is not the current primary),
+     * check that it is on longer initialized, and check that it no longer
+     * appears in the collection.  Check that destroying the non-primary cache
+     * doesn't affect the primary name.
+     */
+    check(krb5_cc_destroy(ctx, ccu2));
+    check_princ(unique2_name, NULL);
+    check_match(princ2, NULL);
+    check_collection(unique1_name, 0);
+    check_primary_name(collection_name, unique1_name);
+    check_match(princ1, unique1_name);
+    check_princ(collection_name, princ1);
+
+    /*
+     * Destroy the first unique cache.  Check that the collection is empty and
+     * still has the same primary name.
+     */
+    check(krb5_cc_destroy(ctx, ccu1));
+    check_princ(unique1_name, NULL);
+    check_princ(collection_name, NULL);
+    check_primary_name(collection_name, unique1_name);
+    check_match(princ1, NULL);
+    check_collection(NULL, 0);
+
+    krb5_free_string(ctx, initial_primary_name);
+    krb5_free_string(ctx, unique1_name);
+    krb5_free_string(ctx, unique2_name);
+    krb5_free_principal(ctx, princ1);
+    krb5_free_principal(ctx, princ2);
+    krb5_free_principal(ctx, princ3);
+    krb5_free_context(ctx);
+    return 0;
+}
diff --git a/src/lib/krb5/ccache/t_cccol.py b/src/lib/krb5/ccache/t_cccol.py
index 8c459dd..e762625 100644
--- a/src/lib/krb5/ccache/t_cccol.py
+++ b/src/lib/krb5/ccache/t_cccol.py
@@ -1,6 +1,46 @@
 #!/usr/bin/python
 from k5test import *
 
+realm = K5Realm(create_kdb=False)
+
+keyctl = which('keyctl')
+out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1)
+test_keyring = (keyctl is not None and
+                'Unknown credential cache type' not in out)
+
+# Run the collection test program against each collection-enabled type.
+realm.run(['./t_cccol', 'DIR:' + os.path.join(realm.testdir, 'cc')])
+if test_keyring:
+    # Use the test directory as the collection name to avoid colliding
+    # with other build trees.
+    cname = realm.testdir
+
+    # Remove any keys left behind by previous failed test runs.
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
+    realm.run(['keyctl', 'purge', 'keyring', cname])
+    out = realm.run(['keyctl', 'list', '@u'])
+    if ('keyring: _krb_' + cname + '\n') in out:
+        id = realm.run(['keyctl', 'search', '@u', 'keyring', '_krb_' + cname])
+        realm.run(['keyctl', 'unlink', id.strip(), '@u'])
+
+    # Run test program over each subtype, cleaning up as we go.  Don't
+    # test the persistent subtype, since it supports only one
+    # collection and might be in actual use.
+    realm.run(['./t_cccol', 'KEYRING:' + cname])
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
+    realm.run(['./t_cccol', 'KEYRING:legacy:' + cname])
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
+    realm.run(['./t_cccol', 'KEYRING:session:' + cname])
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
+    realm.run(['./t_cccol', 'KEYRING:user:' + cname])
+    id = realm.run(['keyctl', 'search', '@u', 'keyring', '_krb_' + cname])
+    realm.run(['keyctl', 'unlink', id.strip(), '@u'])
+    realm.run(['./t_cccol', 'KEYRING:process:abcd'])
+    realm.run(['./t_cccol', 'KEYRING:thread:abcd'])
+
+realm.stop()
+
+# Test cursor semantics using real ccaches.
 realm = K5Realm(create_host=False)
 
 realm.addprinc('alice', password('alice'))
@@ -11,12 +51,25 @@ dccname = 'DIR:%s' % ccdir
 duser = 'DIR::%s/tkt1' % ccdir
 dalice = 'DIR::%s/tkt2' % ccdir
 dbob = 'DIR::%s/tkt3' % ccdir
+dnoent = 'DIR::%s/noent' % ccdir
 realm.kinit('user', password('user'), flags=['-c', duser])
 realm.kinit('alice', password('alice'), flags=['-c', dalice])
 realm.kinit('bob', password('bob'), flags=['-c', dbob])
 
+if test_keyring:
+    cname = realm.testdir
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
+    krccname = 'KEYRING:session:' + cname
+    kruser = '%s:tkt1' % krccname
+    kralice = '%s:tkt2' % krccname
+    krbob = '%s:tkt3' % krccname
+    krnoent = '%s:noent' % krccname
+    realm.kinit('user', password('user'), flags=['-c', kruser])
+    realm.kinit('alice', password('alice'), flags=['-c', kralice])
+    realm.kinit('bob', password('bob'), flags=['-c', krbob])
+
 def cursor_test(testname, args, expected):
-    outlines = realm.run_as_client(['./t_cccursor'] + args).splitlines()
+    outlines = realm.run(['./t_cccursor'] + args).splitlines()
     outlines.sort()
     expected.sort()
     if outlines != expected:
@@ -30,21 +83,33 @@ cursor_test('file-default2', [realm.ccache], [fccname])
 cursor_test('file-default3', [fccname], [fccname])
 
 cursor_test('dir', [dccname], [duser, dalice, dbob])
+cursor_test('dir-subsidiary', [duser], [duser])
+cursor_test('dir-nofile', [dnoent], [])
+
+if test_keyring:
+    cursor_test('keyring', [krccname], [kruser, kralice, krbob])
+    cursor_test('keyring-subsidiary', [kruser], [kruser])
+    cursor_test('keyring-noent', [krnoent], [])
 
 mfoo = 'MEMORY:foo'
 mbar = 'MEMORY:bar'
 cursor_test('filemem', [fccname, mfoo, mbar], [fccname, mfoo, mbar])
 cursor_test('dirmem', [dccname, mfoo], [duser, dalice, dbob, mfoo])
+if test_keyring:
+    cursor_test('keyringmem', [krccname, mfoo], [kruser, kralice, krbob, mfoo])
 
 # Test krb5_cccol_have_content.
-realm.run_as_client(['./t_cccursor', dccname, 'CONTENT'])
-realm.run_as_client(['./t_cccursor', fccname, 'CONTENT'])
-realm.run_as_client(['./t_cccursor', realm.ccache, 'CONTENT'])
-realm.run_as_client(['./t_cccursor', mfoo, 'CONTENT'], expected_code=1)
+realm.run(['./t_cccursor', dccname, 'CONTENT'])
+realm.run(['./t_cccursor', fccname, 'CONTENT'])
+realm.run(['./t_cccursor', realm.ccache, 'CONTENT'])
+realm.run(['./t_cccursor', mfoo, 'CONTENT'], expected_code=1)
+if test_keyring:
+    realm.run(['./t_cccursor', krccname, 'CONTENT'])
+    realm.run(['keyctl', 'purge', 'keyring', '_krb_' + cname])
 
 # Make sure FILE doesn't yield a nonexistent default cache.
-realm.run_as_client([kdestroy])
+realm.run([kdestroy])
 cursor_test('noexist', [], [])
-realm.run_as_client(['./t_cccursor', fccname, 'CONTENT'], expected_code=1)
+realm.run(['./t_cccursor', fccname, 'CONTENT'], expected_code=1)
 
 success('Renewing credentials')
diff --git a/src/util/k5test.py b/src/util/k5test.py
index 3400154..aead832 100644
--- a/src/util/k5test.py
+++ b/src/util/k5test.py
@@ -142,6 +133,9 @@ Scripts may use the following functions and variables:
   added newline) in testlog, and write it to stdout if running
   verbosely.
 
+* which(progname): Return the location of progname in the executable
+  path, or None if it is not found.
+
 * password(name): Return a weakly random password based on name.  The
   password will be consistent across calls with the same name.
 
@@ -388,6 +374,16 @@ def output(msg, force_verbose=False):
         sys.stdout.write(msg)
 
 
+# Return the location of progname in the executable path, or None if
+# it is not found.
+def which(progname):
+    for dir in os.environ["PATH"].split(os.pathsep):
+        path = os.path.join(dir, progname)
+        if os.access(path, os.X_OK):
+            return path
+    return None
+
+
 def password(name):
     """Choose a weakly random password from name, consistent across calls."""
     return name + str(os.getpid())
@@ -880,6 +880,11 @@ class K5Realm(object):
         env['KPROP_PORT'] = str(self.portbase + 3)
         return env
 
+    def run(self, args, env=None, **keywords):
+        if env is None:
+            env = self.env_client
+        return _run_cmd(args, env, **keywords)
+
     def run_as_client(self, args, **keywords):
         return _run_cmd(args, self.env_client, **keywords)
 
diff --git a/src/lib/krb5/ccache/Makefile.in b/src/lib/krb5/ccache/Makefile.in
index f64226b..ad53e65 100644
--- a/src/lib/krb5/ccache/Makefile.in
+++ b/src/lib/krb5/ccache/Makefile.in
@@ -71,6 +66,7 @@ SRCS=	$(srcdir)/ccbase.c \
 
 EXTRADEPSRCS= \
 	$(srcdir)/t_cc.c \
+	$(srcdir)/t_cccol.c \
 	$(srcdir)/t_cccursor.c
 
 ##DOS##OBJS=$(OBJS) $(OUTPRE)ccfns.$(OBJEXT)
@@ -108,6 +104,10 @@ T_CC_OBJS=t_cc.o
 t_cc: $(T_CC_OBJS) $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o t_cc $(T_CC_OBJS) $(KRB5_BASE_LIBS)
 
+T_CCCOL_OBJS = t_cccol.o
+t_cccol: $(T_CCCOL_OBJS) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o $@ $(T_CCCOL_OBJS) $(KRB5_BASE_LIBS)
+
 T_CCCURSOR_OBJS = t_cccursor.o
 t_cccursor: $(T_CCCURSOR_OBJS) $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ $(T_CCCURSOR_OBJS) $(KRB5_BASE_LIBS)
@@ -116,11 +116,11 @@ check-unix:: t_cc
 	KRB5_CONFIG=$(srcdir)/t_krb5.conf ; export KRB5_CONFIG ;\
 	$(RUN_SETUP) $(VALGRIND) ./t_cc
 
-check-pytests:: t_cccursor
+check-pytests:: t_cccursor t_cccol
 	$(RUNPYTEST) $(srcdir)/t_cccol.py $(PYTESTFLAGS)
 
 clean-unix::
-	$(RM) t_cc t_cc.o t_cccursor t_cccursor.o
+	$(RM) t_cc t_cc.o t_cccursor t_cccursor.o t_cccol t_cccol.o
 
 ##WIN32## $(OUTPRE)cc_mslsa.$(OBJEXT): cc_mslsa.c $(top_srcdir)/include/k5-int.h $(BUILDTOP)/include/krb5/osconf.h $(BUILDTOP)/include/krb5/autoconf.h $(BUILDTOP)/include/krb5.h $(COM_ERR_DEPS)