Introduce HAS_GETESPWNAM, HAS_GETPRPWNAM, and I_PROT

in case somebody wants to write an extension for more
shadow database interfaces.

p4raw-id: //depot/cfgperl@6166

17 files changed, 299 insertions, 64 deletions

diff --git a/Configure b/Configure
index 13a0aa226b..2159369ccd 100755
--- a/Configure
+++ b/Configure
@@ -20,7 +20,7 @@
 
 # $Id: Head.U,v 3.0.1.9 1997/02/28 15:02:09 ram Exp $
 #
-# Generated on Tue May 30 21:30:30 EET DST 2000 [metaconfig 3.0 PL70]
+# Generated on Wed May 31 01:00:52 EET DST 2000 [metaconfig 3.0 PL70]
 # (with additional metaconfig patches by perlbug@perl.com)
 
 cat >/tmp/c1$$ <<EOF
@@ -364,6 +364,7 @@ d_ftime=''
 d_gettimeod=''
 d_Gconvert=''
 d_getcwd=''
+d_getespwnam=''
 d_getfsstat=''
 d_getgrent=''
 d_getgrps=''
@@ -392,6 +393,7 @@ d_getprior=''
 d_getpbyname=''
 d_getpbynumber=''
 d_getprotoprotos=''
+d_getprpwnam=''
 d_getpwent=''
 d_getsent=''
 d_getservprotos=''
@@ -635,6 +637,7 @@ i_netinettcp=''
 i_niin=''
 i_sysin=''
 i_poll=''
+i_prot=''
 i_pthread=''
 d_pwage=''
 d_pwchange=''
@@ -9183,6 +9186,14 @@ esac
 set getcwd d_getcwd
 eval $inlibc
 
+: see if getespwnam exists
+set getespwnam d_getespwnam
+eval $inlibc
+
+: see if getespwnam exists
+set getespwnam d_getespwnam
+eval $inlibc
+
 
 : see if getfsstat exists
 set getfsstat d_getfsstat
@@ -9361,6 +9372,14 @@ echo " "
 set d_getprotoprotos getprotoent $i_netdb netdb.h
 eval $hasproto
 
+: see if getprpwnam exists
+set getprpwnam d_getprpwnam
+eval $inlibc
+
+: see if getprpwnam exists
+set getprpwnam d_getprpwnam
+eval $inlibc
+
 : see if getpwent exists
 set getpwent d_getpwent
 eval $inlibc
@@ -14335,6 +14354,14 @@ eval $inhdr
 set poll.h i_poll
 eval $inhdr
 
+: see if this is a prot.h system
+set prot.h i_prot
+eval $inhdr
+
+: see if this is a prot.h system
+set prot.h i_prot
+eval $inhdr
+
 echo " "
 $echo "Guessing which symbols your C compiler and preprocessor define..." >&4 
 $cat <<'EOSH' > Cppsym.know
@@ -15266,6 +15293,7 @@ d_fstatvfs='$d_fstatvfs'
 d_ftello='$d_ftello'
 d_ftime='$d_ftime'
 d_getcwd='$d_getcwd'
+d_getespwnam='$d_getespwnam'
 d_getfsstat='$d_getfsstat'
 d_getgrent='$d_getgrent'
 d_getgrps='$d_getgrps'
@@ -15290,6 +15318,7 @@ d_getpgrp='$d_getpgrp'
 d_getppid='$d_getppid'
 d_getprior='$d_getprior'
 d_getprotoprotos='$d_getprotoprotos'
+d_getprpwnam='$d_getprpwnam'
 d_getpwent='$d_getpwent'
 d_getsbyname='$d_getsbyname'
 d_getsbyport='$d_getsbyport'
@@ -15564,6 +15593,7 @@ i_neterrno='$i_neterrno'
 i_netinettcp='$i_netinettcp'
 i_niin='$i_niin'
 i_poll='$i_poll'
+i_prot='$i_prot'
 i_pthread='$i_pthread'
 i_pwd='$i_pwd'
 i_rpcsvcdbm='$i_rpcsvcdbm'
diff --git a/Porting/Glossary b/Porting/Glossary
index 1d6b1881ae..da89a02e2e 100644
--- a/Porting/Glossary
+++ b/Porting/Glossary
@@ -616,6 +616,10 @@ d_getcwd (d_getcwd.U):
 	indicates to the C program that the getcwd() routine is available
 	to get the current working directory.
 
+d_getespwnam (d_getespwnam.U):
+	This variable conditionally defines HAS_GETESPWNAM if getespwnam() is
+	available to retrieve enchanced (shadow) password entries by name.
+
 d_getfsstat (d_getfsstat.U):
 	This variable conditionally defines the HAS_GETFSSTAT symbol, which
 	indicates to the C program that the getfsstat() routine is available.
@@ -735,6 +739,10 @@ d_getprotoprotos (d_getprotoprotos.U):
 	prototypes for the various getproto*() functions.  
 	See also netdbtype.U for probing for various netdb types.
 
+d_getprpwnam (d_getprpwnam.U):
+	This variable conditionally defines HAS_GETPRPWNAM if getprpwnam() is
+	available to retrieve protected (shadow) password entries by name.
+
 d_getpwent (d_getpwent.U):
 	This variable conditionally defines the HAS_GETPWENT symbol, which
 	indicates to the C program that the getpwent() routine is available
@@ -2010,6 +2018,10 @@ i_poll (i_poll.U):
 	This variable conditionally defines the I_POLL symbol, and indicates
 	whether a C program should include <poll.h>.
 
+i_prot (i_prot.U):
+	This variable conditionally defines the I_PROT symbol, and indicates
+	whether a C program should include <prot.h>.
+
 i_pthread (i_pthread.U):
 	This variable conditionally defines the I_PTHREAD symbol,
 	and indicates whether a C program should include <pthread.h>.
diff --git a/Porting/config.sh b/Porting/config.sh
index 1da4de3489..b37bce4a15 100644
--- a/Porting/config.sh
+++ b/Porting/config.sh
@@ -8,7 +8,7 @@
 
 # Package name      : perl5
 # Source directory  : .
-# Configuration time: Mon May  8 19:17:48 EET DST 2000
+# Configuration time: Wed May 31 00:52:02 EET DST 2000
 # Configured by     : jhi
 # Target system     : osf1 alpha.hut.fi v4.0 878 alpha 
 
@@ -59,7 +59,7 @@ ccflags='-pthread -std -DLANGUAGE_C'
 ccsymbols='__alpha=1 __LANGUAGE_C__=1 __osf__=1 __unix__=1 _LONGLONG=1 _SYSTYPE_BSD=1 SYSTYPE_BSD=1 unix=1'
 cf_by='jhi'
 cf_email='yourname@yourhost.yourplace.com'
-cf_time='Mon May  8 19:17:48 EET DST 2000'
+cf_time='Wed May 31 00:52:02 EET DST 2000'
 charsize='1'
 chgrp=''
 chmod=''
@@ -159,6 +159,7 @@ d_fstatvfs='define'
 d_ftello='undef'
 d_ftime='undef'
 d_getcwd='define'
+d_getespwnam='define'
 d_getfsstat='define'
 d_getgrent='define'
 d_getgrps='define'
@@ -183,6 +184,7 @@ d_getpgrp='define'
 d_getppid='define'
 d_getprior='define'
 d_getprotoprotos='define'
+d_getprpwnam='define'
 d_getpwent='define'
 d_getsbyname='define'
 d_getsbyport='define'
@@ -457,6 +459,7 @@ i_neterrno='undef'
 i_netinettcp='define'
 i_niin='define'
 i_poll='define'
+i_prot='define'
 i_pthread='define'
 i_pwd='define'
 i_rpcsvcdbm='undef'
@@ -544,12 +547,12 @@ lib_ext='.a'
 libc='/usr/shlib/libc.so'
 libperl='libperl.so'
 libpth='/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /var/shlib'
-libs='-lgdbm -ldbm -ldb -lm -liconv -lpthread -lexc'
+libs='-lgdbm -ldbm -ldb -lm -lsecurity -laud -liconv -lpthread -lexc'
 libsdirs=' /usr/shlib /usr/ccs/lib'
-libsfiles=' libgdbm.so libdbm.a libdb.so libm.so libiconv.so libpthread.so libexc.so'
-libsfound=' /usr/shlib/libgdbm.so /usr/ccs/lib/libdbm.a /usr/shlib/libdb.so /usr/shlib/libm.so /usr/shlib/libiconv.so /usr/shlib/libpthread.so /usr/shlib/libexc.so'
+libsfiles=' libgdbm.so libdbm.a libdb.so libm.so libsecurity.so libaud.so libiconv.so libpthread.so libexc.so'
+libsfound=' /usr/shlib/libgdbm.so /usr/ccs/lib/libdbm.a /usr/shlib/libdb.so /usr/shlib/libm.so /usr/shlib/libsecurity.so /usr/shlib/libaud.so /usr/shlib/libiconv.so /usr/shlib/libpthread.so /usr/shlib/libexc.so'
 libspath=' /usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /var/shlib'
-libswanted='sfio socket bind inet nsl nm gdbm dbm db malloc dld ld sun m cposix posix ndir dir crypt sec ucb BSD x iconv pthread exc'
+libswanted='sfio socket bind inet nsl nm gdbm dbm db malloc dld ld sun m cposix posix ndir dir crypt sec security aud ucb BSD x iconv pthread exc'
 line=''
 lint=''
 lkflags=''
diff --git a/Porting/config_H b/Porting/config_H
index 17afce53f6..bb539e21ce 100644
--- a/Porting/config_H
+++ b/Porting/config_H
@@ -17,7 +17,7 @@
 /*
  * Package name      : perl5
  * Source directory  : .
- * Configuration time: Mon May  8 19:17:48 EET DST 2000
+ * Configuration time: Wed May 31 00:52:02 EET DST 2000
  * Configured by     : jhi
  * Target system     : osf1 alpha.hut.fi v4.0 878 alpha 
  */
@@ -1399,6 +1399,12 @@
  */
 #define HAS_GETCWD		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+#define HAS_GETESPWNAM		/**/
+
 /* HAS_GETFSSTAT:
  *	This symbol, if defined, indicates that the getfsstat routine is
  *	available to stat filesystems in bulk.
@@ -1529,6 +1535,12 @@
  */
 #define	HAS_GETPROTO_PROTOS	/**/
 
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+#define HAS_GETPRPWNAM		/**/
+
 /* HAS_GETPWENT:
  *	This symbol, if defined, indicates that the getpwent routine is
  *	available for sequential access of the passwd database.
@@ -1731,6 +1743,13 @@
 #define HAS_MMAP		/**/
 #define Mmap_t void *	/**/
 
+/* HAS_MODFL:
+ *	This symbol, if defined, indicates that the modfl routine is
+ *	available to split a long double x into a fractional part f and
+ *	an integer part i such that |f| < 1.0 and (f + i) = x.
+ */
+#define HAS_MODFL		/**/
+
 /* HAS_MPROTECT:
  *	This symbol, if defined, indicates that the mprotect system call is
  *	available to modify the access protection of a memory mapped file.
@@ -2323,6 +2342,12 @@
  */
 #define	I_POLL		/**/
 
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+#define	I_PROT		/**/
+
 /* I_PTHREAD:
  *     This symbol, if defined, indicates to the C program that it should
  *     include <pthread.h>.
@@ -3100,11 +3125,4 @@
 #define PERL_XS_APIVERSION "5.6.0"
 #define PERL_PM_APIVERSION "5.005"
 
-/* HAS_MODFL:
- *	This symbol, if defined, indicates that the modfl routine is
- *	available to split a long double x into a fractional part f and
- *	an integer part i such that |f| < 1.0 and (f + i) = x.
- */
-#define HAS_MODFL		/**/
-
 #endif
diff --git a/config_h.SH b/config_h.SH
index 609726fe5b..1781def436 100644
--- a/config_h.SH
+++ b/config_h.SH
@@ -1413,6 +1413,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$d_getcwd HAS_GETCWD		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+#$d_getespwnam HAS_GETESPWNAM		/**/
+
 /* HAS_GETFSSTAT:
  *	This symbol, if defined, indicates that the getfsstat routine is
  *	available to stat filesystems in bulk.
@@ -1543,6 +1549,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$d_getprotoprotos	HAS_GETPROTO_PROTOS	/**/
 
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+#$d_getprpwnam HAS_GETPRPWNAM		/**/
+
 /* HAS_GETPWENT:
  *	This symbol, if defined, indicates that the getpwent routine is
  *	available for sequential access of the passwd database.
@@ -1745,6 +1757,13 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
 #$d_mmap HAS_MMAP		/**/
 #define Mmap_t $mmaptype	/**/
 
+/* HAS_MODFL:
+ *	This symbol, if defined, indicates that the modfl routine is
+ *	available to split a long double x into a fractional part f and
+ *	an integer part i such that |f| < 1.0 and (f + i) = x.
+ */
+#$d_modfl HAS_MODFL		/**/
+
 /* HAS_MPROTECT:
  *	This symbol, if defined, indicates that the mprotect system call is
  *	available to modify the access protection of a memory mapped file.
@@ -2337,6 +2356,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$i_poll	I_POLL		/**/
 
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+#$i_prot	I_PROT		/**/
+
 /* I_PTHREAD:
  *     This symbol, if defined, indicates to the C program that it should
  *     include <pthread.h>.
@@ -3114,12 +3139,5 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
 #define PERL_XS_APIVERSION "$xs_apiversion"
 #define PERL_PM_APIVERSION "$pm_apiversion"
 
-/* HAS_MODFL:
- *	This symbol, if defined, indicates that the modfl routine is
- *	available to split a long double x into a fractional part f and
- *	an integer part i such that |f| < 1.0 and (f + i) = x.
- */
-#$d_modfl HAS_MODFL		/**/
-
 #endif
 !GROK!THIS!
diff --git a/epoc/config.sh b/epoc/config.sh
index f32e291c42..688ef87578 100644
--- a/epoc/config.sh
+++ b/epoc/config.sh
@@ -155,6 +155,7 @@ d_fstatfs='define'
 d_fstatvfs='undef'
 d_ftello='undef'
 d_ftime='undef'
+d_getespwnam='undef'
 d_getfsstat='undef'
 d_getgrent='undef'
 d_getgrps='undef'
@@ -178,6 +179,7 @@ d_getpgrp='undef'
 d_getppid='undef'
 d_getprior='undef'
 d_getprotoprotos='define'
+d_getprpwnam='undef'
 d_getpwent='undef'
 d_getsbyname='undef'
 d_getsbyport='undef'
@@ -433,6 +435,7 @@ i_neterrno='undef'
 i_netinettcp='define'
 i_niin='define'
 i_poll='undef'
+i_prot='undef'
 i_pthread='undef'
 i_pwd='undef'
 i_rpcsvcdbm='undef'
diff --git a/pp_sys.c b/pp_sys.c
index 5d5b92dfe9..97cd15b77f 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -21,13 +21,18 @@
 #ifdef I_SHADOW
 /* Shadow password support for solaris - pdo@cs.umd.edu
  * Not just Solaris: at least HP-UX, IRIX, Linux.
- * the API is from SysV. --jhi */
-#ifdef __hpux__
+ * The API is from SysV.
+ *
+ * There are at least two more shadow interfaces,
+ * see the comments in pp_gpwent().
+ *
+ * --jhi */
+#   ifdef __hpux__
 /* There is a MAXINT coming from <shadow.h> <- <hpsecurity.h> <- <values.h>
  * and another MAXINT from "perl.h" <- <sys/param.h>. */ 
-#undef MAXINT
-#endif
-#include <shadow.h>
+#       undef MAXINT
+#   endif
+#   include <shadow.h>
 #endif
 
 /* XXX If this causes problems, set i_unistd=undef in the hint file.  */
@@ -195,7 +200,7 @@ static char zero_but_true[ZBTLEN + 1] = "0 but true";
 #endif
 
 #if !defined(PERL_EFF_ACCESS_R_OK) && defined(HAS_EACCESS)
-#   if defined(I_SYS_SECURITY)
+#   ifdef I_SYS_SECURITY
 #       include <sys/security.h>
 #   endif
 #   ifdef ACC_SELF
@@ -4786,7 +4791,7 @@ PP(pp_gpwent)
      * There are at least two other shadow password APIs.  Many platforms
      * seem to contain more than one interface for accessing the shadow
      * password databases, possibly for compatibility reasons.
-     * The getsp*() is tby far he simplest one, the other two interfaces
+     * The getsp*() is by far he simplest one, the other two interfaces
      * are much more complicated, but also very similar to each other.
      *
      * <sys/types.h>
@@ -4794,7 +4799,8 @@ PP(pp_gpwent)
      * <prot.h>
      * struct pr_passwd *getprpw*();
      * The password is in
-     * char getprpw*(...).ufld.fd_encrypt[AUTH_MAX_CIPHERTEXT_LENGTH]
+     * char getprpw*(...).ufld.fd_encrypt[]
+     * Mention HAS_GETPRPWNAM here so that Configure probes for it.
      *
      * <sys/types.h>
      * <sys/security.h>
@@ -4802,24 +4808,29 @@ PP(pp_gpwent)
      * struct es_passwd *getespw*();
      * The password is in
      * char *(getespw*(...).ufld.fd_encrypt)
+     * Mention HAS_GETESPWNAM here so that Configure probes for it.
      *
-     * XXX Configure test needed for getprpwnam XXX
-     * XXX Configure test needed for getespwnam XXX
+     * Mention I_PROT here so that Configure probes for it.
      *
      * In HP-UX for getprpw*() the manual page claims that one should include
      * <hpsecurity.h> instead of <sys/security.h>, but that is not needed
      * if one includes <shadow.h> as that includes <hpsecurity.h>,
      * and pp_sys.c already includes <shadow.h> if there is such.
+     *
+     * Note that <sys/security.h> is already probed for, but currently
+     * it is only included in special cases.
      * 
      * In Digital UNIX/Tru64 if using the getespw*() (which seems to be
      * be preferred interface, even though also the getprpw*() interface
      * is available) one needs to link with -lsecurity -ldb -laud -lm.
+     * One also needs to call set_auth_parameters() in main() before
+     * doing anything else, whether one is using getespw*() or getprpw*().
+     *
+     * Note that accessing the shadow databases can be magnitudes
+     * slower than accessing the standard databases.
      *
      * --jhi
      */
-#   ifdef HAS_GETSPNAM
-    struct spwd   *spwent = NULL;
-#   endif
 
     switch (which) {
     case OP_GPWNAM:
@@ -4858,17 +4869,44 @@ PP(pp_gpwent)
 	sv_setpv(sv, pwent->pw_name);
 
 	PUSHs(sv = sv_mortalcopy(&PL_sv_no));
+	SvPOK_off(sv);
+	/* If we have getspnam(), we try to dig up the shadow
+	 * password.  If we are underprivileged, the shadow
+	 * interface will set the errno to EACCES or similar,
+	 * and return a null pointer.  If this happens, we will
+	 * use the dummy password (usually "*" or "x") from the
+	 * standard password database.
+	 *
+	 * In theory we could skip the shadow call completely
+	 * if euid != 0 but in practice we cannot know which
+	 * security measures are guarding the shadow databases
+	 * on a random platform.
+	 *
+	 * Resist the urge to use additional shadow interfaces.
+	 * Divert the urge to writing an extension instead.
+	 *
+	 * --jhi */
 #   ifdef HAS_GETSPNAM
-	spwent = getspnam(pwent->pw_name);
-	if (spwent)
-	    sv_setpv(sv, spwent->sp_pwdp);
-	else
-	    sv_setpv(sv, pwent->pw_passwd);
-#   else
-	sv_setpv(sv, pwent->pw_passwd);
+	{
+	    struct spwd *spwent;
+	    int saverrno; /* Save and restore errno so that
+			   * underprivileged attempts seem
+			   * to have never made the unsccessful
+			   * attempt to retrieve the shadow password. */
+
+	    saverrno = errno;
+	    spwent = getspnam(pwent->pw_name);
+	    errno = saverrno;
+	    if (spwent && spwent->sp_pwdp)
+		sv_setpv(sv, spwent->sp_pwdp);
+	}
 #   endif
+	if (!SvPOK(sv)) /* Use the standard password, then. */
+	    sv_setpv(sv, pwent->pw_passwd);
+
 #   ifndef INCOMPLETE_TAINTS
-	/* passwd is tainted because user himself can diddle with it. */
+	/* passwd is tainted because user himself can diddle with it.
+	 * admittedly not much and in a very limited way, but nevertheless. */
 	SvTAINTED_on(sv);
 #   endif
 
@@ -4885,7 +4923,11 @@ PP(pp_gpwent)
 #   else
 	sv_setuv(sv, (UV)pwent->pw_gid);
 #   endif
-	/* pw_change, pw_quota, and pw_age are mutually exclusive. */
+	/* pw_change, pw_quota, and pw_age are mutually exclusive--
+	 * because of the poor interface of the Perl getpw*(),
+	 * not because there's some standard/convention saying so.
+	 * A better interface would have been to return a hash,
+	 * but we are accursed by our history, alas. --jhi.  */
 	PUSHs(sv = sv_mortalcopy(&PL_sv_no));
 #   ifdef PWCHANGE
 	sv_setiv(sv, (IV)pwent->pw_change);
@@ -4899,7 +4941,8 @@ PP(pp_gpwent)
 #       endif
 #   endif
 
-	/* pw_class and pw_comment are mutually exclusive. */
+	/* pw_class and pw_comment are mutually exclusive--.
+	 * see the above note for pw_change, pw_quota, and pw_age. */
 	PUSHs(sv = sv_mortalcopy(&PL_sv_no));
 #   ifdef PWCLASS
 	sv_setpv(sv, pwent->pw_class);
diff --git a/vms/subconfigure.com b/vms/subconfigure.com
index 00fbf3fc3f..ce291f8cba 100644
--- a/vms/subconfigure.com
+++ b/vms/subconfigure.com
@@ -69,6 +69,9 @@ $ myname = myhostname
 $ IF myname .EQS. "" THEN myname = F$TRNLNM("SYS$NODE")
 $!
 $! ##ADD NEW CONSTANTS HERE##
+$ perl_i_prot="undef"
+$ perl_d_getespwnam="undef"
+$ perl_d_getprpwnam="undef"
 $ perl_d_isnan= = "define"
 $ perl_sizesize = "4"
 $ perl_shmattype = ""
@@ -4260,6 +4263,9 @@ $ WC "d_frexpl='" + perl_d_frexpl + "'"
 $ WC "d_isnan='" + perl_d_isnan + "'"
 $ WC "d_isnanl='" + perl_d_isnanl + "'"
 $ WC "d_modfl='" + perl_d_modfl + "'"
+$ WC "d_getprpwnam='" + perl_d_getprpwnam + "'"
+$ WC "d_getespwnam='" + perl_d_getespwnam + "'"
+$ WC "i_prot='" + perl_i_prot + "'"
 $!
 $! ##WRITE NEW CONSTANTS HERE##
 $!
diff --git a/vos/config.def b/vos/config.def
index 1b375f56cd..f180e10790 100644
--- a/vos/config.def
+++ b/vos/config.def
@@ -73,6 +73,7 @@ $d_fstatvfs='undef'
 $d_ftello='undef'
 $d_Gconvert='sprintf((b),"%.*g",(n),(x))'
 $d_getcwd='define'
+$d_getespwnam='undef'
 $d_getfsstat='undef'
 $d_getgrent='undef'
 $d_getgrps='undef'
@@ -97,6 +98,7 @@ $d_getpgrp='define'
 $d_getppid='define'
 $d_getprior='undef'
 $d_getprotoprotos='define'
+$d_getprpwnam='undef'
 $d_getpwent='undef'
 $d_getsbyname='define'
 $d_getsbyport='define'
@@ -321,6 +323,7 @@ $i_neterrno='undef'
 $i_netinettcp='undef'
 $i_niin='define'
 $i_poll='undef'
+$i_prot='undef'
 $i_pthread='undef'
 $i_pwd='undef'
 $i_rpcsvcdbm='undef'
diff --git a/vos/config.h b/vos/config.h
index 9b2a0f2394..af79ff1459 100644
--- a/vos/config.h
+++ b/vos/config.h
@@ -2570,6 +2570,16 @@
 #define Netdb_name_t		char * /**/
 #define Netdb_net_t		long /**/
 
+/* PERL_OTHERLIBDIRS:
+ *	This variable contains a colon-separated set of paths for the perl
+ *	binary to search for additional library files or modules.
+ *	These directories will be tacked to the end of @INC.
+ *	Perl will automatically search below each path for version-
+ *	and architecture-specific directories.  See PERL_INC_VERSION_LIST
+ *	for more details.
+ */
+/*#define PERL_OTHERLIBDIRS ""		/**/
+
 /* IVTYPE:
  *	This symbol defines the C type used for Perl's IV.
  */
@@ -2638,7 +2648,7 @@
  */
 /* NV_PRESERVES_UV:
  *	This symbol, if defined, indicates that a variable of type NVTYPE
- *	can preserve all the bit of a variable of type UVSIZE.
+ *	can preserve all the bits of a variable of type UVTYPE.
  */
 #define	IVTYPE		int		/**/
 #define	UVTYPE		unsigned int		/**/
@@ -2696,16 +2706,6 @@
  */
 #define Pid_t pid_t		/* PID type */
 
-/* PERL_OTHERLIBDIRS:
- *	This variable contains a colon-separated set of paths for the perl
- *	binary to search for additional library files or modules.
- *	These directories will be tacked to the end of @INC.
- *	Perl will automatically search below each path for version-
- *	and architecture-specific directories.  See PERL_INC_VERSION_LIST
- *	for more details.
- */
-/*#define PERL_OTHERLIBDIRS ""		/**/
-
 /* PRIVLIB:
  *	This symbol contains the name of the private library for this package.
  *	The library is private in the sense that it needn't be in anyone's
@@ -3096,6 +3096,18 @@
 #define PERL_XS_APIVERSION "5.00563"
 #define PERL_PM_APIVERSION "5.00563"
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+/*#define HAS_GETESPWNAM		/**/
+
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+/*#define HAS_GETPRPWNAM		/**/
+
 /* HAS_MODFL:
  *	This symbol, if defined, indicates that the modfl routine is
  *	available to split a long double x into a fractional part f and
@@ -3103,4 +3115,10 @@
  */
 /*#define HAS_MODFL		/**/
 
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+/*#define	I_PROT		/**/
+
 #endif
diff --git a/vos/config_h.SH_orig b/vos/config_h.SH_orig
index 12a4350f62..1781def436 100755
--- a/vos/config_h.SH_orig
+++ b/vos/config_h.SH_orig
@@ -1413,6 +1413,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$d_getcwd HAS_GETCWD		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+#$d_getespwnam HAS_GETESPWNAM		/**/
+
 /* HAS_GETFSSTAT:
  *	This symbol, if defined, indicates that the getfsstat routine is
  *	available to stat filesystems in bulk.
@@ -1543,6 +1549,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$d_getprotoprotos	HAS_GETPROTO_PROTOS	/**/
 
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+#$d_getprpwnam HAS_GETPRPWNAM		/**/
+
 /* HAS_GETPWENT:
  *	This symbol, if defined, indicates that the getpwent routine is
  *	available for sequential access of the passwd database.
@@ -1745,6 +1757,13 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
 #$d_mmap HAS_MMAP		/**/
 #define Mmap_t $mmaptype	/**/
 
+/* HAS_MODFL:
+ *	This symbol, if defined, indicates that the modfl routine is
+ *	available to split a long double x into a fractional part f and
+ *	an integer part i such that |f| < 1.0 and (f + i) = x.
+ */
+#$d_modfl HAS_MODFL		/**/
+
 /* HAS_MPROTECT:
  *	This symbol, if defined, indicates that the mprotect system call is
  *	available to modify the access protection of a memory mapped file.
@@ -2337,6 +2356,12 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 #$i_poll	I_POLL		/**/
 
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+#$i_prot	I_PROT		/**/
+
 /* I_PTHREAD:
  *     This symbol, if defined, indicates to the C program that it should
  *     include <pthread.h>.
@@ -2666,7 +2691,7 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
  */
 /* NV_PRESERVES_UV:
  *	This symbol, if defined, indicates that a variable of type NVTYPE
- *	can preserve all the bit of a variable of type UVSIZE.
+ *	can preserve all the bits of a variable of type UVTYPE.
  */
 #define	IVTYPE		$ivtype		/**/
 #define	UVTYPE		$uvtype		/**/
@@ -3114,12 +3139,5 @@ sed <<!GROK!THIS! >config.h -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un-
 #define PERL_XS_APIVERSION "$xs_apiversion"
 #define PERL_PM_APIVERSION "$pm_apiversion"
 
-/* HAS_MODFL:
- *	This symbol, if defined, indicates that the modfl routine is
- *	available to split a long double x into a fractional part f and
- *	an integer part i such that |f| < 1.0 and (f + i) = x.
- */
-#$d_modfl HAS_MODFL		/**/
-
 #endif
 !GROK!THIS!
diff --git a/win32/config.bc b/win32/config.bc
index 8024e3f8a1..0dfad540e0 100644
--- a/win32/config.bc
+++ b/win32/config.bc
@@ -148,6 +148,7 @@ d_fstatvfs='undef'
 d_ftello='undef'
 d_ftime='define'
 d_getcwd='undef'
+d_getespwnam='undef'
 d_getfsstat='undef'
 d_getgrent='undef'
 d_getgrps='undef'
@@ -172,6 +173,7 @@ d_getpgrp='undef'
 d_getppid='undef'
 d_getprior='undef'
 d_getprotoprotos='define'
+d_getprpwnam='undef'
 d_getpwent='undef'
 d_getsbyname='define'
 d_getsbyport='define'
@@ -445,6 +447,7 @@ i_neterrno='undef'
 i_netinettcp='undef'
 i_niin='undef'
 i_poll='undef'
+i_prot='undef'
 i_pthread='undef'
 i_pwd='undef'
 i_rpcsvcdbm='define'
diff --git a/win32/config.gc b/win32/config.gc
index 193333478e..a947e7933c 100644
--- a/win32/config.gc
+++ b/win32/config.gc
@@ -148,6 +148,7 @@ d_fstatvfs='undef'
 d_ftello='undef'
 d_ftime='define'
 d_getcwd='undef'
+d_getespwnam='undef'
 d_getfsstat='undef'
 d_getgrent='undef'
 d_getgrps='undef'
@@ -172,6 +173,7 @@ d_getpgrp='undef'
 d_getppid='undef'
 d_getprior='undef'
 d_getprotoprotos='define'
+d_getprpwnam='undef'
 d_getpwent='undef'
 d_getsbyname='define'
 d_getsbyport='define'
@@ -445,6 +447,7 @@ i_neterrno='undef'
 i_netinettcp='undef'
 i_niin='undef'
 i_poll='undef'
+i_prot='undef'
 i_pthread='undef'
 i_pwd='undef'
 i_rpcsvcdbm='define'
diff --git a/win32/config.vc b/win32/config.vc
index ef4bf76662..b2ee889e2d 100644
--- a/win32/config.vc
+++ b/win32/config.vc
@@ -148,6 +148,7 @@ d_fstatvfs='undef'
 d_ftello='undef'
 d_ftime='define'
 d_getcwd='undef'
+d_getespwnam='undef'
 d_getfsstat='undef'
 d_getgrent='undef'
 d_getgrps='undef'
@@ -172,6 +173,7 @@ d_getpgrp='undef'
 d_getppid='undef'
 d_getprior='undef'
 d_getprotoprotos='define'
+d_getprpwnam='undef'
 d_getpwent='undef'
 d_getsbyname='define'
 d_getsbyport='define'
@@ -445,6 +447,7 @@ i_neterrno='undef'
 i_netinettcp='undef'
 i_niin='undef'
 i_poll='undef'
+i_prot='undef'
 i_pthread='undef'
 i_pwd='undef'
 i_rpcsvcdbm='define'
diff --git a/win32/config_H.bc b/win32/config_H.bc
index a469a365f7..70fc4bfc98 100644
--- a/win32/config_H.bc
+++ b/win32/config_H.bc
@@ -1546,6 +1546,24 @@
  */
 /*#define HAS_GETSPNAM		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+/*#define HAS_GETESPWNAM		/**/
+
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+/*#define HAS_GETPRPWNAM		/**/
+
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+/*#define	I_PROT		/**/
+
 /* HAS_GETSERVBYNAME:
  *	This symbol, if defined, indicates that the getservbyname()
  *	routine is available to look up services by their name.
diff --git a/win32/config_H.gc b/win32/config_H.gc
index f712b2e65a..dcb495a940 100644
--- a/win32/config_H.gc
+++ b/win32/config_H.gc
@@ -1546,6 +1546,24 @@
  */
 /*#define HAS_GETSPNAM		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+/*#define HAS_GETESPWNAM		/**/
+
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+/*#define HAS_GETPRPWNAM		/**/
+
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+/*#define	I_PROT		/**/
+
 /* HAS_GETSERVBYNAME:
  *	This symbol, if defined, indicates that the getservbyname()
  *	routine is available to look up services by their name.
diff --git a/win32/config_H.vc b/win32/config_H.vc
index e748c97d3a..b23c1aad78 100644
--- a/win32/config_H.vc
+++ b/win32/config_H.vc
@@ -1546,6 +1546,24 @@
  */
 /*#define HAS_GETSPNAM		/**/
 
+/* HAS_GETESPWNAM:
+ *	This symbol, if defined, indicates that the getespwnam system call is
+ *	available to retrieve enchanced (shadow) password entries by name.
+ */
+/*#define HAS_GETESPWNAM		/**/
+
+/* HAS_GETPRPWNAM:
+ *	This symbol, if defined, indicates that the getprpwnam system call is
+ *	available to retrieve protected (shadow) password entries by name.
+ */
+/*#define HAS_GETPRPWNAM		/**/
+
+/* I_PROT:
+ *	This symbol, if defined, indicates that <prot.h> exists and
+ *	should be included.
+ */
+/*#define	I_PROT		/**/
+
 /* HAS_GETSERVBYNAME:
  *	This symbol, if defined, indicates that the getservbyname()
  *	routine is available to look up services by their name.