diff --git a/aclocal/libevent.m4 b/aclocal/libevent.m4

index b5ac00ff..0ebcb524 100644

--- a/aclocal/libevent.m4

+++ b/aclocal/libevent.m4

@@ -4,9 +4,13 @@ AC_DEFUN([AC_LIBEVENT], [

   dnl Check for libevent, but do not add -levent to LIBS

   AC_CHECK_LIB([event], [event_dispatch], [LIBEVENT=-levent],

                [AC_MSG_ERROR([libevent not found.])])

+  AC_CHECK_LIB([event_core], [event_base_dispatch], [LIBEVENT=-levent_core],

+  	[AC_MSG_ERROR([libevent2 not found.])])

   AC_SUBST(LIBEVENT)

   AC_CHECK_HEADERS([event.h], ,

                    [AC_MSG_ERROR([libevent headers not found.])])

+  AC_CHECK_HEADERS([event2/event.h], ,

+                   [AC_MSG_ERROR([libevent headers not found.])])

 ])dnl

diff --git a/utils/gssd/gss_names.c b/utils/gssd/gss_names.c

index 2a7f3a13..982b96f4 100644

--- a/utils/gssd/gss_names.c

+++ b/utils/gssd/gss_names.c

@@ -110,10 +110,12 @@ get_hostbased_client_name(gss_name_t client_name, gss_OID mech,

 	/* For Kerberos, transform the NT_KRB5_PRINCIPAL name to

 	 * an NT_HOSTBASED_SERVICE name */

 	if (g_OID_equal(&krb5oid, mech)) {

-		if (get_krb5_hostbased_name(&name, &cname) == 0)

-			*hostbased_name = cname;

+		if (get_krb5_hostbased_name(&name, &cname) != 0)

+			goto out_rel_buf;

+		*hostbased_name = cname;

 	} else {

 		printerr(1, "WARNING: unknown/unsupport mech OID\n");

+		goto out_rel_buf;

 	}

 	res = 0;

diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c

index af66ed62..6f461fdf 100644

--- a/utils/gssd/gssd.c

+++ b/utils/gssd/gssd.c

@@ -64,7 +64,7 @@

 #include <fcntl.h>

 #include <dirent.h>

 #include <netdb.h>

-#include <event.h>

+#include <event2/event.h>

 #include "gssd.h"

 #include "err_util.h"

@@ -77,7 +77,7 @@ static char *pipefs_path = GSSD_PIPEFS_DIR;

 static DIR *pipefs_dir;

 static int pipefs_fd;

 static int inotify_fd;

-struct event inotify_ev;

+struct event *inotify_ev;

 char *keytabfile = GSSD_DEFAULT_KEYTAB_FILE;

 char **ccachesearch;

@@ -90,9 +90,9 @@ char *ccachedir = NULL;

 /* Avoid DNS reverse lookups on server names */

 static bool avoid_dns = true;

 static bool use_gssproxy = false;

-int thread_started = false;

-pthread_mutex_t pmutex = PTHREAD_MUTEX_INITIALIZER;

-pthread_cond_t pcond = PTHREAD_COND_INITIALIZER;

+pthread_mutex_t clp_lock = PTHREAD_MUTEX_INITIALIZER;

+static bool signal_received = false;

+static struct event_base *evbase = NULL;

 TAILQ_HEAD(topdir_list_head, topdir) topdir_list;

@@ -359,20 +359,28 @@ out:

 	free(port);

 }

+/* Actually frees clp and fields that might be used from other

+ * threads if was last reference.

+ */

 static void

-gssd_destroy_client(struct clnt_info *clp)

+gssd_free_client(struct clnt_info *clp)

 {

-	if (clp->krb5_fd >= 0) {

+	int refcnt;

+

+	pthread_mutex_lock(&clp_lock);

+	refcnt = --clp->refcount;

+	pthread_mutex_unlock(&clp_lock);

+	if (refcnt > 0)

+		return;

+

+	printerr(3, "freeing client %s\n", clp->relpath);

+

+	if (clp->krb5_fd >= 0)

 		close(clp->krb5_fd);

-		event_del(&clp->krb5_ev);

-	}

-	if (clp->gssd_fd >= 0) {

+	if (clp->gssd_fd >= 0)

 		close(clp->gssd_fd);

-		event_del(&clp->gssd_ev);

-	}

-	inotify_rm_watch(inotify_fd, clp->wd);

 	free(clp->relpath);

 	free(clp->servicename);

 	free(clp->servername);

@@ -380,6 +388,30 @@ gssd_destroy_client(struct clnt_info *clp)

 	free(clp);

 }

+/* Called when removing from clnt_list to tear down event handling.

+ * Will then free clp if was last reference.

+ */

+static void

+gssd_destroy_client(struct clnt_info *clp)

+{

+	printerr(3, "destroying client %s\n", clp->relpath);

+

+	if (clp->krb5_ev) {

+		event_del(clp->krb5_ev);

+		event_free(clp->krb5_ev);

+		clp->krb5_ev = NULL;

+	}

+

+	if (clp->gssd_ev) {

+		event_del(clp->gssd_ev);

+		event_free(clp->gssd_ev);

+		clp->gssd_ev = NULL;

+	}

+

+	inotify_rm_watch(inotify_fd, clp->wd);

+	gssd_free_client(clp);

+}

+

 static void gssd_scan(void);

 static int

@@ -416,11 +448,21 @@ static struct clnt_upcall_info *alloc_upcall_info(struct clnt_info *clp)

 	info = malloc(sizeof(struct clnt_upcall_info));

 	if (info == NULL)

 		return NULL;

+

+	pthread_mutex_lock(&clp_lock);

+	clp->refcount++;

+	pthread_mutex_unlock(&clp_lock);

 	info->clp = clp;

 	return info;

 }

+void free_upcall_info(struct clnt_upcall_info *info)

+{

+	gssd_free_client(info->clp);

+	free(info);

+}

+

 /* For each upcall read the upcall info into the buffer, then create a

  * thread in a detached state so that resources are released back into

  * the system without the need for a join.

@@ -438,13 +480,13 @@ gssd_clnt_gssd_cb(int UNUSED(fd), short UNUSED(which), void *data)

 	info->lbuflen = read(clp->gssd_fd, info->lbuf, sizeof(info->lbuf));

 	if (info->lbuflen <= 0 || info->lbuf[info->lbuflen-1] != '\n') {

 		printerr(0, "WARNING: %s: failed reading request\n", __func__);

-		free(info);

+		free_upcall_info(info);

 		return;

 	}

 	info->lbuf[info->lbuflen-1] = 0;

 	if (start_upcall_thread(handle_gssd_upcall, info))

-		free(info);

+		free_upcall_info(info);

 }

 static void

@@ -461,12 +503,12 @@ gssd_clnt_krb5_cb(int UNUSED(fd), short UNUSED(which), void *data)

 			sizeof(info->uid)) < (ssize_t)sizeof(info->uid)) {

 		printerr(0, "WARNING: %s: failed reading uid from krb5 "

 			 "upcall pipe: %s\n", __func__, strerror(errno));

-		free(info);

+		free_upcall_info(info);

 		return;

 	}

 	if (start_upcall_thread(handle_krb5_upcall, info))

-		free(info);

+		free_upcall_info(info);

 }

 static struct clnt_info *

@@ -501,6 +543,7 @@ gssd_get_clnt(struct topdir *tdi, const char *name)

 	clp->name = clp->relpath + strlen(tdi->name) + 1;

 	clp->krb5_fd = -1;

 	clp->gssd_fd = -1;

+	clp->refcount = 1;

 	TAILQ_INSERT_HEAD(&tdi->clnt_list, clp, list);

 	return clp;

@@ -535,15 +578,15 @@ gssd_scan_clnt(struct clnt_info *clp)

 		clp->krb5_fd = openat(clntfd, "krb5", O_RDWR | O_NONBLOCK);

 	if (gssd_was_closed && clp->gssd_fd >= 0) {

-		event_set(&clp->gssd_ev, clp->gssd_fd, EV_READ | EV_PERSIST,

-			  gssd_clnt_gssd_cb, clp);

-		event_add(&clp->gssd_ev, NULL);

+		clp->gssd_ev = event_new(evbase, clp->gssd_fd, EV_READ | EV_PERSIST,

+					 gssd_clnt_gssd_cb, clp);

+		event_add(clp->gssd_ev, NULL);

 	}

 	if (krb5_was_closed && clp->krb5_fd >= 0) {

-		event_set(&clp->krb5_ev, clp->krb5_fd, EV_READ | EV_PERSIST,

-			  gssd_clnt_krb5_cb, clp);

-		event_add(&clp->krb5_ev, NULL);

+		clp->krb5_ev = event_new(evbase, clp->krb5_fd, EV_READ | EV_PERSIST,

+					 gssd_clnt_krb5_cb, clp);

+		event_add(clp->krb5_ev, NULL);

 	}

 	if (clp->krb5_fd == -1 && clp->gssd_fd == -1)

@@ -649,7 +692,7 @@ gssd_scan_topdir(const char *name)

 		if (clp->scanned)

 			continue;

-		printerr(3, "destroying client %s\n", clp->relpath);

+		printerr(3, "orphaned client %s\n", clp->relpath);

 		saveprev = clp->list.tqe_prev;

 		TAILQ_REMOVE(&tdi->clnt_list, clp, list);

 		gssd_destroy_client(clp);

@@ -746,12 +789,16 @@ gssd_inotify_clnt(struct topdir *tdi, struct clnt_info *clp, const struct inotif

 	} else if (ev->mask & IN_DELETE) {

 		if (!strcmp(ev->name, "gssd") && clp->gssd_fd >= 0) {

 			close(clp->gssd_fd);

-			event_del(&clp->gssd_ev);

+			event_del(clp->gssd_ev);

+			event_free(clp->gssd_ev);

+			clp->gssd_ev = NULL;

 			clp->gssd_fd = -1;

 		} else if (!strcmp(ev->name, "krb5") && clp->krb5_fd >= 0) {

 			close(clp->krb5_fd);

-			event_del(&clp->krb5_ev);

+			event_del(clp->krb5_ev);

+			event_free(clp->krb5_ev);

+			clp->krb5_ev = NULL;

 			clp->krb5_fd = -1;

 		}

@@ -824,10 +871,15 @@ found:

 static void

 sig_die(int signal)

 {

-	if (root_uses_machine_creds)

-		gssd_destroy_krb5_machine_creds();

+	if (signal_received) {

+		gssd_destroy_krb5_principals(root_uses_machine_creds);

+		printerr(1, "forced exiting on signal %d\n", signal);

+		exit(0);

+	}

+

+	signal_received = true;

 	printerr(1, "exiting on signal %d\n", signal);

-	exit(0);

+	event_base_loopexit(evbase, NULL);

 }

 static void

@@ -884,9 +936,10 @@ main(int argc, char *argv[])

 	int rpc_verbosity = 0;

 	int opt;

 	int i;

+	int rc;

 	extern char *optarg;

 	char *progname;

-	struct event sighup_ev;

+	struct event *sighup_ev;

 	read_gss_conf();

@@ -1025,7 +1078,11 @@ main(int argc, char *argv[])

 	if (gssd_check_mechs() != 0)

 		errx(1, "Problem with gssapi library");

-	event_init();

+	evbase = event_base_new();

+	if (!evbase) {

+		printerr(0, "ERROR: failed to create event base\n");

+		exit(EXIT_FAILURE);

+	}

 	pipefs_dir = opendir(pipefs_path);

 	if (!pipefs_dir) {

@@ -1047,18 +1104,43 @@ main(int argc, char *argv[])

 	signal(SIGINT, sig_die);

 	signal(SIGTERM, sig_die);

-	signal_set(&sighup_ev, SIGHUP, gssd_scan_cb, NULL);

-	signal_add(&sighup_ev, NULL);

-	event_set(&inotify_ev, inotify_fd, EV_READ | EV_PERSIST, gssd_inotify_cb, NULL);

-	event_add(&inotify_ev, NULL);

+	sighup_ev = evsignal_new(evbase, SIGHUP, gssd_scan_cb, NULL);

+	evsignal_add(sighup_ev, NULL);

+	inotify_ev = event_new(evbase, inotify_fd, EV_READ | EV_PERSIST,

+			       gssd_inotify_cb, NULL);

+	event_add(inotify_ev, NULL);

 	TAILQ_INIT(&topdir_list);

 	gssd_scan();

 	daemon_ready();

-	event_dispatch();

+	rc = event_base_dispatch(evbase);

-	printerr(0, "ERROR: event_dispatch() returned!\n");

-	return EXIT_FAILURE;

-}

+	printerr(0, "event_dispatch() returned %i!\n", rc);

+

+	gssd_destroy_krb5_principals(root_uses_machine_creds);

+

+	while (!TAILQ_EMPTY(&topdir_list)) {

+		struct topdir *tdi = TAILQ_FIRST(&topdir_list);

+		TAILQ_REMOVE(&topdir_list, tdi, list);

+		while (!TAILQ_EMPTY(&tdi->clnt_list)) {

+			struct clnt_info *clp = TAILQ_FIRST(&tdi->clnt_list);

+			TAILQ_REMOVE(&tdi->clnt_list, clp, list);

+			gssd_destroy_client(clp);

+		}

+		free(tdi);

+	}

+

+	event_free(inotify_ev);

+	event_free(sighup_ev);

+	event_base_free(evbase);

+

+	close(inotify_fd);

+	close(pipefs_fd);

+	closedir(pipefs_dir);

+	free(preferred_realm);

+	free(ccachesearch);

+

+	return rc < 0 ? EXIT_FAILURE : EXIT_SUCCESS;

+}

diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h

index f4f59754..1e8c58d4 100644

--- a/utils/gssd/gssd.h

+++ b/utils/gssd/gssd.h

@@ -62,13 +62,10 @@ extern int			root_uses_machine_creds;

 extern unsigned int 		context_timeout;

 extern unsigned int rpc_timeout;

 extern char			*preferred_realm;

-extern pthread_mutex_t ple_lock;

-extern pthread_cond_t pcond;

-extern pthread_mutex_t pmutex;

-extern int thread_started;

 struct clnt_info {

 	TAILQ_ENTRY(clnt_info)	list;

+	int			refcount;

 	int			wd;

 	bool			scanned;

 	char			*name;

@@ -79,9 +76,9 @@ struct clnt_info {

 	int			vers;

 	char			*protocol;

 	int			krb5_fd;

-	struct event		krb5_ev;

+	struct event		*krb5_ev;

 	int			gssd_fd;

-	struct event		gssd_ev;

+	struct event		*gssd_ev;

 	struct			sockaddr_storage addr;

 };

@@ -94,6 +91,7 @@ struct clnt_upcall_info {

 void handle_krb5_upcall(struct clnt_upcall_info *clp);

 void handle_gssd_upcall(struct clnt_upcall_info *clp);

+void free_upcall_info(struct clnt_upcall_info *info);

 #endif /* _RPC_GSSD_H_ */

diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c

index bfcf3f09..ae3ebe81 100644

--- a/utils/gssd/gssd_proc.c

+++ b/utils/gssd/gssd_proc.c

@@ -149,9 +149,10 @@ do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,

 	char    *buf = NULL, *p = NULL, *end = NULL;

 	unsigned int timeout = context_timeout;

 	unsigned int buf_size = 0;

+	pthread_t tid = pthread_self();

-	printerr(2, "doing downcall: lifetime_rec=%u acceptor=%.*s\n",

-		lifetime_rec, acceptor->length, acceptor->value);

+	printerr(2, "do_downcall(0x%x): lifetime_rec=%u acceptor=%.*s\n",

+		tid, lifetime_rec, acceptor->length, acceptor->value);

 	buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +

 		sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +

 		sizeof(context_token->length) + context_token->length +

@@ -177,7 +178,7 @@ do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,

 	return;

 out_err:

 	free(buf);

-	printerr(1, "Failed to write downcall!\n");

+	printerr(1, "do_downcall(0x%x): Failed to write downcall!\n", tid);

 	return;

 }

@@ -231,7 +232,7 @@ populate_port(struct sockaddr *sa, const socklen_t salen,

 	switch (sa->sa_family) {

 	case AF_INET:

 		if (s4->sin_port != 0) {

-			printerr(2, "DEBUG: port already set to %d\n",

+			printerr(4, "DEBUG: port already set to %d\n",

 				 ntohs(s4->sin_port));

 			return 1;

 		}

@@ -239,7 +240,7 @@ populate_port(struct sockaddr *sa, const socklen_t salen,

 #ifdef IPV6_SUPPORTED

 	case AF_INET6:

 		if (s6->sin6_port != 0) {

-			printerr(2, "DEBUG: port already set to %d\n",

+			printerr(4, "DEBUG: port already set to %d\n",

 				 ntohs(s6->sin6_port));

 			return 1;

 		}

@@ -544,7 +545,7 @@ krb5_use_machine_creds(struct clnt_info *clp, uid_t uid,

 		uid, tgtname);

 	do {

-		gssd_refresh_krb5_machine_credential(clp->servername, NULL,

+		gssd_refresh_krb5_machine_credential(clp->servername,

 						     service, srchost);

 	/*

 	 * Get a list of credential cache names and try each

@@ -726,7 +727,7 @@ handle_krb5_upcall(struct clnt_upcall_info *info)

 	printerr(2, "\n%s: uid %d (%s)\n", __func__, info->uid, clp->relpath);

 	process_krb5_upcall(clp, info->uid, clp->krb5_fd, NULL, NULL, NULL);

-	free(info);

+	free_upcall_info(info);

 }

 void

@@ -743,8 +744,10 @@ handle_gssd_upcall(struct clnt_upcall_info *info)

 	char			*enctypes = NULL;

 	char			*upcall_str;

 	char			*pbuf = info->lbuf;

+	pthread_t tid = pthread_self();

-	printerr(2, "%s: '%s' (%s)\n", __func__, info->lbuf, clp->relpath);

+	printerr(2, "\n%s(0x%x): '%s' (%s)\n", __func__, tid, 

+		info->lbuf, clp->relpath);

 	upcall_str = strdup(info->lbuf);

 	if (upcall_str == NULL) {

@@ -826,6 +829,6 @@ handle_gssd_upcall(struct clnt_upcall_info *info)

 out:

 	free(upcall_str);

 out_nomem:

-	free(info);

+	free_upcall_info(info);

 	return;

 }

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c

index 26e51edf..d675c3a4 100644

--- a/utils/gssd/krb5_util.c

+++ b/utils/gssd/krb5_util.c

@@ -126,9 +126,28 @@

 #include "gss_util.h"

 #include "krb5_util.h"

+/*

+ * List of principals from our keytab that we

+ * will try to use to obtain credentials

+ * (known as a principal list entry (ple))

+ */

+struct gssd_k5_kt_princ {

+	struct gssd_k5_kt_princ *next;

+	// Only protect against deletion, not modification

+	int refcount;

+	// Only set during creation in new_ple()

+	krb5_principal princ;

+	char *realm;

+	// Modified during usage by gssd_get_single_krb5_cred()

+	char *ccname;

+	krb5_timestamp endtime;

+};

+

+

 /* Global list of principals/cache file names for machine credentials */

-struct gssd_k5_kt_princ *gssd_k5_kt_princ_list = NULL;

-pthread_mutex_t ple_lock = PTHREAD_MUTEX_INITIALIZER;

+static struct gssd_k5_kt_princ *gssd_k5_kt_princ_list = NULL;

+/* This mutex protects list modification & ple->ccname */

+static pthread_mutex_t ple_lock = PTHREAD_MUTEX_INITIALIZER;

 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES

 int limit_to_legacy_enctypes = 0;

@@ -146,6 +165,18 @@ static int gssd_get_single_krb5_cred(krb5_context context,

 static int query_krb5_ccache(const char* cred_cache, char **ret_princname,

 		char **ret_realm);

+static void release_ple(krb5_context context, struct gssd_k5_kt_princ *ple)

+{

+	if (--ple->refcount)

+		return;

+

+	printerr(3, "freeing cached principal (ccname=%s, realm=%s)\n", ple->ccname, ple->realm);

+	krb5_free_principal(context, ple->princ);

+	free(ple->ccname);

+	free(ple->realm);

+	free(ple);

+}

+

 /*

  * Called from the scandir function to weed out potential krb5

  * credentials cache files

@@ -352,12 +383,15 @@ gssd_get_single_krb5_cred(krb5_context context,

 	 * 300 because clock skew must be within 300sec for kerberos

 	 */

 	now += 300;

+	pthread_mutex_lock(&ple_lock);

 	if (ple->ccname && ple->endtime > now && !nocache) {

 		printerr(3, "INFO: Credentials in CC '%s' are good until %d\n",

 			 ple->ccname, ple->endtime);

 		code = 0;

+		pthread_mutex_unlock(&ple_lock);

 		goto out;

 	}

+	pthread_mutex_unlock(&ple_lock);

 	if ((code = krb5_kt_get_name(context, kt, kt_name, BUFSIZ))) {

 		printerr(0, "ERROR: Unable to get keytab name in "

@@ -410,6 +444,7 @@ gssd_get_single_krb5_cred(krb5_context context,

 	 * Initialize cache file which we're going to be using

 	 */

+	pthread_mutex_lock(&ple_lock);

 	if (use_memcache)

 	    cache_type = "MEMORY";

 	else

@@ -419,15 +454,18 @@ gssd_get_single_krb5_cred(krb5_context context,

 		ccachesearch[0], GSSD_DEFAULT_CRED_PREFIX,

 		GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm);

 	ple->endtime = my_creds.times.endtime;

-	if (ple->ccname != NULL)

+	if (ple->ccname == NULL || strcmp(ple->ccname, cc_name) != 0) {

 		free(ple->ccname);

-	ple->ccname = strdup(cc_name);

-	if (ple->ccname == NULL) {

-		printerr(0, "ERROR: no storage to duplicate credentials "

-			    "cache name '%s'\n", cc_name);

-		code = ENOMEM;

-		goto out;

+		ple->ccname = strdup(cc_name);

+		if (ple->ccname == NULL) {

+			printerr(0, "ERROR: no storage to duplicate credentials "

+				    "cache name '%s'\n", cc_name);

+			code = ENOMEM;

+			pthread_mutex_unlock(&ple_lock);

+			goto out;

+		}

 	}

+	pthread_mutex_unlock(&ple_lock);

 	if ((code = krb5_cc_resolve(context, cc_name, &ccache))) {

 		k5err = gssd_k5_err_msg(context, code);

 		printerr(0, "ERROR: %s while opening credential cache '%s'\n",

@@ -465,6 +503,7 @@ gssd_get_single_krb5_cred(krb5_context context,

 /*

  * Given a principal, find a matching ple structure

+ * Called with mutex held

  */

 static struct gssd_k5_kt_princ *

 find_ple_by_princ(krb5_context context, krb5_principal princ)

@@ -481,6 +520,7 @@ find_ple_by_princ(krb5_context context, krb5_principal princ)

 /*

  * Create, initialize, and add a new ple structure to the global list

+ * Called with mutex held

  */

 static struct gssd_k5_kt_princ *

 new_ple(krb5_context context, krb5_principal princ)

@@ -532,6 +572,7 @@ new_ple(krb5_context context, krb5_principal princ)

 			p->next = ple;

 	}

+	ple->refcount = 1;

 	return ple;

 outerr:

 	if (ple) {

@@ -550,13 +591,14 @@ get_ple_by_princ(krb5_context context, krb5_principal princ)

 {

 	struct gssd_k5_kt_princ *ple;

-	/* Need to serialize list if we ever become multi-threaded! */

-

 	pthread_mutex_lock(&ple_lock);

 	ple = find_ple_by_princ(context, princ);

 	if (ple == NULL) {

 		ple = new_ple(context, princ);

 	}

+	if (ple != NULL) {

+		ple->refcount++;

+	}

 	pthread_mutex_unlock(&ple_lock);

 	return ple;

@@ -721,6 +763,8 @@ gssd_search_krb5_keytab(krb5_context context, krb5_keytab kt,

 				retval = ENOMEM;

 				k5_free_kt_entry(context, kte);

 			} else {

+				release_ple(context, ple);

+				ple = NULL;

 				retval = 0;

 				*found = 1;

 			}

@@ -796,12 +840,12 @@ find_keytab_entry(krb5_context context, krb5_keytab kt,

 	/* Compute the active directory machine name HOST$ */

 	krb5_appdefault_string(context, "nfs", NULL, "ad_principal_name", 

 		notsetstr, &adhostoverride);

-	if (strcmp(adhostoverride, notsetstr) != 0) {

-	        printerr (1, 

-				"AD host string overridden with \"%s\" from appdefaults\n", 

-				adhostoverride);

-	        /* No overflow: Windows cannot handle strings longer than 19 chars */

-	        strcpy(myhostad, adhostoverride);

+	if (adhostoverride && strcmp(adhostoverride, notsetstr) != 0) {

+		printerr(1,

+			 "AD host string overridden with \"%s\" from appdefaults\n",

+			 adhostoverride);

+		/* No overflow: Windows cannot handle strings longer than 19 chars */

+		strcpy(myhostad, adhostoverride);

 	} else {

 	        strcpy(myhostad, myhostname);

 	        for (i = 0; myhostad[i] != 0; ++i) {

@@ -928,7 +972,7 @@ find_keytab_entry(krb5_context context, krb5_keytab kt,

 					tried_upper = 1;

 				}

 			} else {

-				printerr(3, "Success getting keytab entry for '%s'\n",spn);

+				printerr(2, "Success getting keytab entry for '%s'\n",spn);

 				retval = 0;

 				goto out;

 			}

@@ -1053,6 +1097,93 @@ err_cache:

 	return (*ret_princname && *ret_realm);

 }

+/*

+ * Obtain (or refresh if necessary) Kerberos machine credentials

+ * If a ple is passed in, it's reference will be released

+ */

+static int

+gssd_refresh_krb5_machine_credential_internal(char *hostname,

+				     struct gssd_k5_kt_princ *ple,

+				     char *service, char *srchost)

+{

+	krb5_error_code code = 0;

+	krb5_context context;

+	krb5_keytab kt = NULL;;

+	int retval = 0;

+	char *k5err = NULL;

+	const char *svcnames[] = { "$", "root", "nfs", "host", NULL };

+

+	printerr(2, "%s: hostname=%s ple=%p service=%s srchost=%s\n",

+		__func__, hostname, ple, service, srchost);

+

+	/*

+	 * If a specific service name was specified, use it.

+	 * Otherwise, use the default list.

+	 */

+	if (service != NULL && strcmp(service, "*") != 0) {

+		svcnames[0] = service;

+		svcnames[1] = NULL;

+	}

+	if (hostname == NULL && ple == NULL)

+		return EINVAL;

+

+	code = krb5_init_context(&context);

+	if (code) {

+		k5err = gssd_k5_err_msg(NULL, code);

+		printerr(0, "ERROR: %s: %s while initializing krb5 context\n",

+			 __func__, k5err);

+		retval = code;

+		goto out;

+	}

+

+	if ((code = krb5_kt_resolve(context, keytabfile, &kt))) {

+		k5err = gssd_k5_err_msg(context, code);

+		printerr(0, "ERROR: %s: %s while resolving keytab '%s'\n",

+			 __func__, k5err, keytabfile);

+		goto out_free_context;

+	}

+

+	if (ple == NULL) {

+		krb5_keytab_entry kte;

+

+		code = find_keytab_entry(context, kt, srchost, hostname,

+					 &kte, svcnames);

+		if (code) {

+			printerr(0, "ERROR: %s: no usable keytab entry found "

+				 "in keytab %s for connection with host %s\n",

+				 __FUNCTION__, keytabfile, hostname);

+			retval = code;

+			goto out_free_kt;

+		}

+

+		ple = get_ple_by_princ(context, kte.principal);

+		k5_free_kt_entry(context, &kte);

+		if (ple == NULL) {

+			char *pname;

+			if ((krb5_unparse_name(context, kte.principal, &pname))) {

+				pname = NULL;