diff --git a/security/mit-krb5/MESSAGE b/security/mit-krb5/MESSAGE
index 296f99bbf854..8729782cff13 100644
--- a/security/mit-krb5/MESSAGE
+++ b/security/mit-krb5/MESSAGE
@@ -1,5 +1,5 @@
 ===========================================================================
-$NetBSD: MESSAGE,v 1.1 2011/03/22 23:31:04 tez Exp $
+$NetBSD: MESSAGE,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Please beware that the Kerberized r-services, telnetd and ftpd services and
 the related client applications are no longer included in this package.
diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile
index a3b141bdd9c8..5455ca9bd6ef 100644
--- a/security/mit-krb5/Makefile
+++ b/security/mit-krb5/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.95 2017/10/10 21:22:53 tez Exp $
+# $NetBSD: Makefile,v 1.96 2018/06/15 20:46:01 tez Exp $
 
-DISTNAME=	krb5-1.14.6
+DISTNAME=	krb5-1.16.1
 PKGNAME=	mit-${DISTNAME}
 CATEGORIES=	security
 MASTER_SITES=	http://web.mit.edu/kerberos/dist/krb5/${PKGVERSION_NOREV:R}/
diff --git a/security/mit-krb5/PLIST b/security/mit-krb5/PLIST
index c813099c40d3..82ce9f406137 100644
--- a/security/mit-krb5/PLIST
+++ b/security/mit-krb5/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2016/03/15 15:16:39 tez Exp $
+@comment $NetBSD: PLIST,v 1.19 2018/06/15 20:46:01 tez Exp $
 bin/compile_et
 bin/gss-client
 bin/k5srvutil
@@ -45,10 +45,13 @@ include/kdb.h
 include/krad.h
 include/krb5.h
 include/krb5/ccselect_plugin.h
+include/krb5/certauth_plugin.h
 include/krb5/clpreauth_plugin.h
 include/krb5/hostrealm_plugin.h
+include/krb5/kadm5_auth_plugin.h
 include/krb5/kadm5_hook_plugin.h
 include/krb5/kdcpreauth_plugin.h
+include/krb5/kdcpolicy_plugin.h
 include/krb5/krb5.h
 include/krb5/localauth_plugin.h
 include/krb5/locate_plugin.h
@@ -131,3 +134,4 @@ share/examples/krb5/kdc.conf
 share/examples/krb5/krb5.conf
 share/examples/krb5/services.append
 share/locale/en_US/LC_MESSAGES/mit-krb5.mo
+share/locale/de/LC_MESSAGES/mit-krb5.mo
diff --git a/security/mit-krb5/buildlink3.mk b/security/mit-krb5/buildlink3.mk
index bbcedb48c5c7..18945cf7a667 100644
--- a/security/mit-krb5/buildlink3.mk
+++ b/security/mit-krb5/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.14 2013/10/26 05:28:43 richard Exp $
+# $NetBSD: buildlink3.mk,v 1.15 2018/06/15 20:46:01 tez Exp $
 
 BUILDLINK_TREE+=	mit-krb5
 
diff --git a/security/mit-krb5/builtin.mk b/security/mit-krb5/builtin.mk
index dc839a6060aa..2644e9de2fb2 100644
--- a/security/mit-krb5/builtin.mk
+++ b/security/mit-krb5/builtin.mk
@@ -1,4 +1,4 @@
-# $NetBSD: builtin.mk,v 1.13 2015/11/04 15:32:34 jperkin Exp $
+# $NetBSD: builtin.mk,v 1.14 2018/06/15 20:46:01 tez Exp $
 
 BUILTIN_PKG:=	mit-krb5
 
diff --git a/security/mit-krb5/distinfo b/security/mit-krb5/distinfo
index 7ba7e7832793..5ca429545261 100644
--- a/security/mit-krb5/distinfo
+++ b/security/mit-krb5/distinfo
@@ -1,33 +1,31 @@
-$NetBSD: distinfo,v 1.63 2018/05/25 13:46:40 jperkin Exp $
+$NetBSD: distinfo,v 1.64 2018/06/15 20:46:01 tez Exp $
 
-SHA1 (krb5-1.14.6.tar.gz) = ea7928a3368ae6d8ecf29a70f70598091f226740
-RMD160 (krb5-1.14.6.tar.gz) = 7e9f8192845d11108a3c48dd707d7d4bc5dd0a29
-SHA512 (krb5-1.14.6.tar.gz) = 8a88193e40aa60bb10dc57028a7c83aaac48cfded5d369b9f5383851854f1ea3df3587f7bce8b22d4e5cf2ce5825eb37c8d85684abad29da04db34e8f7962ca7
-Size (krb5-1.14.6.tar.gz) = 12326355 bytes
-SHA1 (patch-CVE-2017-11368) = 91551099d48690c051ada72889bc645706775eb1
-SHA1 (patch-Makefile.in) = 11ead9de708f4da99233b66df2cf906b156faa87
-SHA1 (patch-aa) = 941848a1773dfbe51dff3134d4b8504a850a958d
+SHA1 (krb5-1.16.1.tar.gz) = 8353f2d900a7d52499c7c2605d5e295f71dd5e67
+RMD160 (krb5-1.16.1.tar.gz) = 26a423032841a67974d377ad65d7361b51aa7058
+SHA512 (krb5-1.16.1.tar.gz) = fa4ec14a4ffe690861e2dd7ea39d7698af2058ce181bb733ea891f80279f4dde4bb891adec5ccb0eaddf737306e6ceb1fe3744a2946e6189a7d7d2dd3bc5ba84
+Size (krb5-1.16.1.tar.gz) = 9477480 bytes
+SHA1 (patch-Makefile.in) = adacbcb9d569107e6b7af9b0e7ee177f79a9103c
+SHA1 (patch-aa) = f94e587c4b3e15bcf7dde215cf146ba077202218
 SHA1 (patch-ae) = c7395b9de5baf6612b8787fad55dbc051a680bfd
 SHA1 (patch-aj) = 4ab922df1d86d86f9ef043f2c5cdf048c0477d3a
 SHA1 (patch-al) = 7445639b82eadf9b1feb1448c1654fa6ddc937aa
 SHA1 (patch-cf) = 806b089d3b12ea9a17c6caab59cbdeb6ec17bbc3
-SHA1 (patch-cg) = 30b1e8943b0cbe67f37bac6883f4bdd82776e6d1
+SHA1 (patch-cg) = 0c45e34ea8b5d0270c386d430b0d37469e8440ea
 SHA1 (patch-cj) = 78342f649f8e9d3a3b5a4f83e65b6c46f589586b
 SHA1 (patch-config_lib.in) = 974db26486b3239e4fcd53be7280b32c802f6007
 SHA1 (patch-config_libnover.in) = 53f539cf98a961483e2b4ccf278c7376dbcf52d9
-SHA1 (patch-config_pre.in) = 9b02fd3db8785ff570885eeca7ad377a315b6317
+SHA1 (patch-config_pre.in) = 255973132db9327190211214c3e33b4551bd283b
 SHA1 (patch-config_shlib.conf) = c47a647307e7d883e7c22528b7b0f5ad038cbcb3
-SHA1 (patch-configure.in) = 6675fa171d6e21ad71a58ce410d3b1ecb45add4d
+SHA1 (patch-configure.in) = 2b7de47c4da223670566c70ce1a9eaa27d49a984
 SHA1 (patch-include_osconf.hin) = d31a8164f417bc31a787c8e16d1bd24f27b7140d
 SHA1 (patch-kadmin_cli_ss_wrapper.c) = e32e6180f8d508cb2eb18489ce2fef0a1ad0f51d
-SHA1 (patch-lib_apputils_Makefile.in) = e001c7d0e9020c0e9feb5743805ef68e64012247
-SHA1 (patch-lib_apputils_net-server.c) = a10630940fc56062c1074fdc0c43a0527fa76105
+SHA1 (patch-lib_apputils_Makefile.in) = 085004041a2bb8c4bb3074c2e71e71f22f4f06d7
+SHA1 (patch-lib_apputils_udppktinfo.c) = 47ac861181faebfe5f95c28be329ce917ece872c
 SHA1 (patch-lib_krb5_asn.1_asn1buf.h) = 74d7d172ec4c8d7f68a093befc6b40c99b119e37
-SHA1 (patch-lib_krb5_ccache_Makefile.in) = 9a12f64c15bbca3dd55edeec16ef956e8cde9043
-SHA1 (patch-lib_krb5_os_timeofday.c) = db1686d25d6f56793f3e66ddee5513e93179979d
+SHA1 (patch-lib_krb5_ccache_Makefile.in) = 330ae21ec3b290ae16478c2c49a138acac5bf2fd
 SHA1 (patch-plugins_kdb_db2_Makefile.in) = f374fc5915b735075fbb751ef736f4ce54abc289
 SHA1 (patch-plugins_kdb_db2_libdb2_Makefile.in) = b4b7e8e4192b5e5318f1e42c49315789619f3ae9
 SHA1 (patch-plugins_preauth_otp_Makefile.in) = 8c779e3b37cab4138f300f4a09325387092c79f8
-SHA1 (patch-plugins_preauth_pkinit_Makefile.in) = ff56050dc6a31468977c16b192b4f5d2d79764c2
-SHA1 (patch-util_k5ev_verto-k5ev.c) = 4f148a369d1634234a90c348e6b8dc366cd6773d
-SHA1 (patch-util_ss_Makefile.in) = f561b3689021b2b2db895228c717b4cdf7fbc32a
+SHA1 (patch-plugins_preauth_pkinit_Makefile.in) = c778366d5bd1cae85424643a582013101fc9632d
+SHA1 (patch-util_k5ev_verto-k5ev.c) = 8f074ddccbaaa03576f0302437aed3aaad1b738d
+SHA1 (patch-util_ss_Makefile.in) = 5ca0bf7295a8f4c1d8e59097863940f88d224ee7
diff --git a/security/mit-krb5/files/kadmind.sh b/security/mit-krb5/files/kadmind.sh
index 57209823caa7..40acc6bf776f 100644
--- a/security/mit-krb5/files/kadmind.sh
+++ b/security/mit-krb5/files/kadmind.sh
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: kadmind.sh,v 1.2 2005/04/10 07:15:25 jlam Exp $
+# $NetBSD: kadmind.sh,v 1.3 2018/06/15 20:46:01 tez Exp $
 #
 # PROVIDE: kadmind
 # REQUIRE: kdc
diff --git a/security/mit-krb5/files/kdc.sh b/security/mit-krb5/files/kdc.sh
index cd35dbbaabaf..3ffc746ad087 100644
--- a/security/mit-krb5/files/kdc.sh
+++ b/security/mit-krb5/files/kdc.sh
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: kdc.sh,v 1.2 2005/04/10 07:15:25 jlam Exp $
+# $NetBSD: kdc.sh,v 1.3 2018/06/15 20:46:01 tez Exp $
 #
 # PROVIDE: kdc
 # REQUIRE: NETWORKING
diff --git a/security/mit-krb5/patches/patch-Makefile.in b/security/mit-krb5/patches/patch-Makefile.in
index 4b64c9cc0303..216dccda9811 100644
--- a/security/mit-krb5/patches/patch-Makefile.in
+++ b/security/mit-krb5/patches/patch-Makefile.in
@@ -1,32 +1,35 @@
-$NetBSD: patch-Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Don't build plugin examples & tests and avoid libtool problem.
 No idea why... copied from previous instance of this package.
 
---- Makefile.in.orig	2016-02-29 19:50:13.000000000 +0000
+--- Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ Makefile.in
-@@ -9,20 +9,11 @@ mydir=.
+@@ -9,23 +9,11 @@ mydir=.
  SUBDIRS=util include lib \
  	@sam2_plugin@ \
  	plugins/audit \
 -	plugins/audit/test \
  	@audit_plugin@ \
 -	plugins/kadm5_hook/test \
+-	plugins/kadm5_auth/test \
 -	plugins/hostrealm/test \
 -	plugins/localauth/test \
 -	plugins/pwqual/test \
 -	plugins/authdata/greet_server \
 -	plugins/authdata/greet_client \
+-	plugins/certauth/test \
  	plugins/kdb/db2 \
  	@ldap_plugin_dir@ \
 -	plugins/kdb/test \
+-	plugins/kdcpolicy/test \
  	plugins/preauth/otp \
  	plugins/preauth/pkinit \
 -	plugins/preauth/test \
  	plugins/tls/k5tls \
  	kdc kadmin slave clients appl tests \
  	config-files build-tools man doc @po@
-@@ -75,7 +66,7 @@ INSTALLMKDIRS = $(KRB5ROOT) $(KRB5MANROO
+@@ -76,7 +64,7 @@ INSTALLMKDIRS = $(KRB5ROOT) $(KRB5MANROO
  install-strip:
  	$(MAKE) install INSTALL_STRIP=-s
  
@@ -35,12 +38,12 @@ No idea why... copied from previous instance of this package.
  
  install-mkdirs:
  	@for i in $(INSTALLMKDIRS); do \
-@@ -86,7 +77,7 @@ install-headers-mkdirs:
+@@ -87,7 +75,7 @@ install-headers-mkdirs:
  	$(srcdir)/config/mkinstalldirs $(DESTDIR)$(KRB5_INCDIR)
  	$(srcdir)/config/mkinstalldirs $(DESTDIR)$(KRB5_INCDIR)/gssapi
  	$(srcdir)/config/mkinstalldirs $(DESTDIR)$(KRB5_INCDIR)/gssrpc
 -install-headers-prerecurse: install-headers-mkdirs
 +install-headers-prerecurse:
  
- # install::
- #	$(MAKE) $(MFLAGS) install.man
+ clean-:: clean-windows
+ clean-unix::
diff --git a/security/mit-krb5/patches/patch-aa b/security/mit-krb5/patches/patch-aa
index a591c5cf0c9d..25408718d554 100644
--- a/security/mit-krb5/patches/patch-aa
+++ b/security/mit-krb5/patches/patch-aa
@@ -1,20 +1,20 @@
-$NetBSD: patch-aa,v 1.5 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-aa,v 1.6 2018/06/15 20:46:01 tez Exp $
 
 Don't make sunpro warnings into errors (warnings are seen in gcc too)
 Add --enable-pkgsrc-libtool option
 
---- aclocal.m4.orig	2012-05-31 23:49:44.000000000 +0000
+--- aclocal.m4.orig	2018-05-03 14:34:47.000000000 +0000
 +++ aclocal.m4
-@@ -611,7 +611,7 @@ else
-     # works, but it also means that declaration-in-code warnings won't
-     # be issued.
-     # -v -fd -errwarn=E_DECLARATION_IN_CODE ...
--    WARN_CFLAGS="-errtags=yes -errwarn=E_BAD_PTR_INT_COMBINATION,E_BAD_PTR_INT_COMB_ARG,E_PTR_TO_VOID_IN_ARITHMETIC,E_NO_IMPLICIT_DECL_ALLOWED,E_ATTRIBUTE_PARAM_UNDEFINED"
-+    WARN_CFLAGS="-errtags=yes"
-     WARN_CXXFLAGS="-errtags=yes +w +w2 -xport64"
-   fi
- fi
-@@ -1038,6 +1038,9 @@ AC_SUBST(SHLIBVEXT)
+@@ -633,7 +633,7 @@ else
+     if test "x$krb5_ac_warn_cflags_set" = xset ; then
+       AC_MSG_NOTICE(not adding extra warning flags because WARN_CFLAGS was set)
+     else
+-      WARN_CFLAGS="-errtags=yes -errwarn=E_BAD_PTR_INT_COMBINATION,E_BAD_PTR_INT_COMB_ARG,E_PTR_TO_VOID_IN_ARITHMETIC,E_NO_IMPLICIT_DECL_ALLOWED,E_ATTRIBUTE_PARAM_UNDEFINED"
++      WARN_CFLAGS="-errtags=yes"
+     fi
+     if test "x$krb5_ac_warn_cxxflags_set" = xset ; then
+       AC_MSG_NOTICE(not adding extra warning flags because WARN_CXXFLAGS was set)
+@@ -1068,6 +1068,9 @@ AC_SUBST(SHLIBVEXT)
  AC_SUBST(SHLIBSEXT)
  AC_SUBST(DEPLIBEXT)
  AC_SUBST(PFLIBEXT)
@@ -24,7 +24,7 @@ Add --enable-pkgsrc-libtool option
  AC_SUBST(LIBINSTLIST)
  AC_SUBST(DYNOBJEXT)
  AC_SUBST(MAKE_DYNOBJ_COMMAND)
-@@ -1054,6 +1057,7 @@ AC_SUBST(OBJLISTS)
+@@ -1085,6 +1088,7 @@ AC_SUBST(OBJLISTS)
  AC_SUBST(STOBJEXT)
  AC_SUBST(SHOBJEXT)
  AC_SUBST(PFOBJEXT)
@@ -32,7 +32,7 @@ Add --enable-pkgsrc-libtool option
  AC_SUBST(PICFLAGS)
  AC_SUBST(PROFFLAGS)])
  
-@@ -1168,11 +1172,42 @@ else
+@@ -1199,11 +1203,42 @@ else
  	KDB5_PLUGIN_DEPLIBS=
  	KDB5_PLUGIN_LIBS=
  fi
diff --git a/security/mit-krb5/patches/patch-ae b/security/mit-krb5/patches/patch-ae
index f87ede6d8f71..0e97fbb08fbc 100644
--- a/security/mit-krb5/patches/patch-ae
+++ b/security/mit-krb5/patches/patch-ae
@@ -1,4 +1,4 @@
-$NetBSD: patch-ae,v 1.4 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-ae,v 1.5 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 
diff --git a/security/mit-krb5/patches/patch-aj b/security/mit-krb5/patches/patch-aj
index b5273eaeedff..8e391c11e8fb 100644
--- a/security/mit-krb5/patches/patch-aj
+++ b/security/mit-krb5/patches/patch-aj
@@ -1,4 +1,4 @@
-$NetBSD: patch-aj,v 1.4 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-aj,v 1.5 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 
diff --git a/security/mit-krb5/patches/patch-al b/security/mit-krb5/patches/patch-al
index 46c19df88cab..d2fc7d2ad478 100644
--- a/security/mit-krb5/patches/patch-al
+++ b/security/mit-krb5/patches/patch-al
@@ -1,4 +1,4 @@
-$NetBSD: patch-al,v 1.7 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-al,v 1.8 2018/06/15 20:46:01 tez Exp $
 
 Add DragonFly support. Fallback to LINE_MAX if BUFSIZ is not defined.
 
diff --git a/security/mit-krb5/patches/patch-cf b/security/mit-krb5/patches/patch-cf
index c75c9b402db5..7d3e83b2d6e9 100644
--- a/security/mit-krb5/patches/patch-cf
+++ b/security/mit-krb5/patches/patch-cf
@@ -1,4 +1,4 @@
-$NetBSD: patch-cf,v 1.3 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-cf,v 1.4 2018/06/15 20:46:01 tez Exp $
 
 Add needed headers
 
diff --git a/security/mit-krb5/patches/patch-cg b/security/mit-krb5/patches/patch-cg
index d531279e6eb7..eb15bc89c5ba 100644
--- a/security/mit-krb5/patches/patch-cg
+++ b/security/mit-krb5/patches/patch-cg
@@ -1,15 +1,15 @@
-$NetBSD: patch-cg,v 1.3 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-cg,v 1.4 2018/06/15 20:46:01 tez Exp $
 
 Add two files that need to be generated and otherwise are not
 
---- lib/kdb/Makefile.in.orig	2012-05-31 23:49:44.000000000 +0000
+--- lib/kdb/Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ lib/kdb/Makefile.in
-@@ -62,7 +62,7 @@ clean-unix:: clean-liblinks clean-libs c
- check-pytests:: t_stringattr
- 	$(RUNPYTEST) $(srcdir)/t_stringattr.py $(PYTESTFLAGS)
+@@ -63,7 +63,7 @@ check-pytests: t_stringattr
+ check-cmocka: t_sort_key_data
+ 	$(RUN_TEST) ./t_sort_key_data > /dev/null
  
 -generate-files-mac: darwin.exports
 +generate-files-mac: darwin.exports adb_err.h adb_err.c
  
- depend:: adb_err.h
+ depend: adb_err.h
  
diff --git a/security/mit-krb5/patches/patch-cj b/security/mit-krb5/patches/patch-cj
index c32fd33d01f6..c896d4339768 100644
--- a/security/mit-krb5/patches/patch-cj
+++ b/security/mit-krb5/patches/patch-cj
@@ -1,4 +1,4 @@
-$NetBSD: patch-cj,v 1.2 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-cj,v 1.3 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 
diff --git a/security/mit-krb5/patches/patch-config_lib.in b/security/mit-krb5/patches/patch-config_lib.in
index 6c70388cb08c..5095d6df5939 100644
--- a/security/mit-krb5/patches/patch-config_lib.in
+++ b/security/mit-krb5/patches/patch-config_lib.in
@@ -1,4 +1,4 @@
-$NetBSD: patch-config_lib.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-config_lib.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 (was patch-ad)
diff --git a/security/mit-krb5/patches/patch-config_libnover.in b/security/mit-krb5/patches/patch-config_libnover.in
index b20fc92feacd..92805ecea89e 100644
--- a/security/mit-krb5/patches/patch-config_libnover.in
+++ b/security/mit-krb5/patches/patch-config_libnover.in
@@ -1,4 +1,4 @@
-$NetBSD: patch-config_libnover.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-config_libnover.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 (was patch-ci)
diff --git a/security/mit-krb5/patches/patch-config_pre.in b/security/mit-krb5/patches/patch-config_pre.in
index 6768febde881..b2375b511e48 100644
--- a/security/mit-krb5/patches/patch-config_pre.in
+++ b/security/mit-krb5/patches/patch-config_pre.in
@@ -1,12 +1,12 @@
-$NetBSD: patch-config_pre.in,v 1.2 2016/06/21 14:58:17 fhajny Exp $
+$NetBSD: patch-config_pre.in,v 1.3 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 Use $(ROOT_USER) in place of root
 Make sure LDFLAGS are not ignored
 
---- config/pre.in.orig	2016-02-29 19:50:13.000000000 +0000
+--- config/pre.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ config/pre.in
-@@ -168,6 +168,7 @@ PTHREAD_LIBS = @PTHREAD_LIBS@
+@@ -171,6 +171,7 @@ PTHREAD_LIBS = @PTHREAD_LIBS@
  THREAD_LINKOPTS = $(PTHREAD_CFLAGS) $(PTHREAD_LIBS)
  CPPFLAGS = @CPPFLAGS@
  DEFS = @DEFS@
@@ -14,7 +14,7 @@ Make sure LDFLAGS are not ignored
  CC = @CC@
  CXX = @CXX@
  LD = $(PURE) @LD@
-@@ -177,11 +178,12 @@ LIBS = @LIBS@
+@@ -180,11 +181,12 @@ LIBS = @LIBS@
  
  INSTALL=@INSTALL@
  INSTALL_STRIP=
@@ -30,7 +30,7 @@ Make sure LDFLAGS are not ignored
  ## This is needed because autoconf will sometimes define @exec_prefix@ to be
  ## ${prefix}.
  prefix=@prefix@
-@@ -312,6 +314,10 @@ PROG_RPATH_FLAGS=@PROG_RPATH_FLAGS@
+@@ -315,6 +317,10 @@ PROG_RPATH_FLAGS=@PROG_RPATH_FLAGS@
  # depending on whether we're building with shared libraries.
  DEPLIBEXT=@DEPLIBEXT@
  
@@ -41,7 +41,7 @@ Make sure LDFLAGS are not ignored
  KDB5_PLUGIN_DEPLIBS = @KDB5_PLUGIN_DEPLIBS@
  KDB5_PLUGIN_LIBS = @KDB5_PLUGIN_LIBS@
  
-@@ -329,12 +335,12 @@ COM_ERR_DEPLIB-k5 = $(TOPLIBD)/libcom_er
+@@ -332,12 +338,12 @@ COM_ERR_DEPLIB-k5 = $(TOPLIBD)/libcom_er
  SUPPORT_LIBNAME=krb5support
  SUPPORT_DEPLIB	= $(TOPLIBD)/lib$(SUPPORT_LIBNAME)$(DEPLIBEXT)
  
@@ -57,7 +57,7 @@ Make sure LDFLAGS are not ignored
  
  KRB5_BASE_DEPLIBS	= $(KRB5_DEPLIB) $(CRYPTO_DEPLIB) $(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
  KDB5_DEPLIBS		= $(KDB5_DEPLIB) $(KDB5_PLUGIN_DEPLIBS)
-@@ -373,7 +379,7 @@ RL_LIBS		= @RL_LIBS@
+@@ -376,7 +382,7 @@ RL_LIBS		= @RL_LIBS@
  
  SS_LIB		= $(SS_LIB-@SS_VERSION@)
  SS_LIB-sys	= @SS_LIB@
@@ -66,17 +66,17 @@ Make sure LDFLAGS are not ignored
  KDB5_LIB	= -lkdb5 $(KDB5_PLUGIN_LIBS)
  
  VERTO_DEPLIB	= $(VERTO_DEPLIB-@VERTO_VERSION@)
-@@ -552,6 +558,9 @@ MAKE_DYNOBJ_COMMAND=@MAKE_DYNOBJ_COMMAND
+@@ -556,6 +562,9 @@ MAKE_DYNOBJ_COMMAND=@MAKE_DYNOBJ_COMMAND
  DYNOBJ_EXPDEPS=@DYNOBJ_EXPDEPS@
  DYNOBJ_EXPFLAGS=@DYNOBJ_EXPFLAGS@
  
 +# usually .la
 +LALIBEXT=@LALIBEXT@
 +
- # File with symbol names to be exported, both functions and data,
- # currently not distinguished.
- SHLIB_EXPORT_FILE=$(srcdir)/$(LIBPREFIX)$(LIBBASE).exports
-@@ -573,6 +582,7 @@ SHLIB_RPATH_FLAGS=@SHLIB_RPATH_FLAGS@
+ # For some platforms, a flag which causes shared library creation to
+ # check for undefined symbols.  Suppressed when using --enable-asan.
+ UNDEF_CHECK=@UNDEF_CHECK@
+@@ -587,6 +596,7 @@ SHLIB_RPATH_FLAGS=@SHLIB_RPATH_FLAGS@
  # flags for explicit libraries depending on this one,
  # e.g. "$(SHLIB_RPATH_FLAGS) $(SHLIB_SHLIB_DIRFLAGS) $(SHLIB_EXPLIBS)"
  SHLIB_EXPFLAGS=@SHLIB_EXPFLAGS@
@@ -84,7 +84,7 @@ Make sure LDFLAGS are not ignored
  
  ## Parameters to be set by configure for use in libobj.in:
  
-@@ -584,6 +594,11 @@ OBJLISTS=@OBJLISTS@
+@@ -598,6 +608,11 @@ OBJLISTS=@OBJLISTS@
  # the suffix substitution will break on some platforms!
  SHLIBOBJS=$(STLIBOBJS:.o=@SHOBJEXT@)
  PFLIBOBJS=$(STLIBOBJS:.o=@PFOBJEXT@)
diff --git a/security/mit-krb5/patches/patch-config_shlib.conf b/security/mit-krb5/patches/patch-config_shlib.conf
index d4921e4e1949..ce1a1a29d6eb 100644
--- a/security/mit-krb5/patches/patch-config_shlib.conf
+++ b/security/mit-krb5/patches/patch-config_shlib.conf
@@ -1,4 +1,4 @@
-$NetBSD: patch-config_shlib.conf,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-config_shlib.conf,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 (was patch-ag)
diff --git a/security/mit-krb5/patches/patch-configure.in b/security/mit-krb5/patches/patch-configure.in
index bfc2d03592cb..796ae6cbd017 100644
--- a/security/mit-krb5/patches/patch-configure.in
+++ b/security/mit-krb5/patches/patch-configure.in
@@ -1,15 +1,21 @@
-$NetBSD: patch-configure.in,v 1.2 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-configure.in,v 1.3 2018/06/15 20:46:01 tez Exp $
 
 Find the correct libcrypto.
 
---- configure.in.orig	2016-02-29 19:50:13.000000000 +0000
+--- configure.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ configure.in
-@@ -277,7 +277,7 @@ AC_MSG_NOTICE(pkinit will use '$withval'
- ], withval=$PKINIT_CRYPTO_IMPL)
- case "$withval" in
- builtin|openssl)
--  AC_CHECK_LIB(crypto, PKCS7_get_signer_info, PKINIT_CRYPTO_IMPL_LIBS=-lcrypto)
-+  AC_CHECK_LIB(crypto, PKCS7_get_signer_info, PKINIT_CRYPTO_IMPL_LIBS="-L${BUILDLINK_PREFIX_OPENSSL}/lib -lcrypto")
-   PKINIT_CRYPTO_IMPL=openssl
-   AC_CHECK_LIB(crypto, CMS_get0_content,
-                [AC_DEFINE([HAVE_OPENSSL_CMS], 1,
+@@ -287,12 +287,12 @@ AC_HELP_STRING([--with-tls-impl=IMPL],
+ case "$TLS_IMPL" in
+ openssl|auto)
+   AC_CHECK_LIB(ssl,SSL_CTX_new,[have_lib_ssl=true],[have_lib_ssl=false],
+-               -lcrypto)
++               "-L${BUILDLINK_PREFIX_OPENSSL}/lib -lcrypto")
+   AC_MSG_CHECKING([for OpenSSL])
+   if test x$have_lib_ssl = xtrue ; then
+     AC_DEFINE(TLS_IMPL_OPENSSL,1,[Define if TLS implementation is OpenSSL])
+     AC_MSG_RESULT([yes])
+-    TLS_IMPL_LIBS="-lssl -lcrypto"
++    TLS_IMPL_LIBS="-L${BUILDLINK_PREFIX_OPENSSL}/lib -lssl -lcrypto"
+     TLS_IMPL=openssl
+     AC_MSG_NOTICE([TLS module will use OpenSSL])
+   else
diff --git a/security/mit-krb5/patches/patch-include_osconf.hin b/security/mit-krb5/patches/patch-include_osconf.hin
index 63a8b10ce455..0510eb62fd0c 100644
--- a/security/mit-krb5/patches/patch-include_osconf.hin
+++ b/security/mit-krb5/patches/patch-include_osconf.hin
@@ -1,4 +1,4 @@
-$NetBSD: patch-include_osconf.hin,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-include_osconf.hin,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 prefer @SYSCONFDIR as location for krb5.conf
 (was patch-ah)
diff --git a/security/mit-krb5/patches/patch-kadmin_cli_ss_wrapper.c b/security/mit-krb5/patches/patch-kadmin_cli_ss_wrapper.c
index db9790abf475..0f3e37e093fb 100644
--- a/security/mit-krb5/patches/patch-kadmin_cli_ss_wrapper.c
+++ b/security/mit-krb5/patches/patch-kadmin_cli_ss_wrapper.c
@@ -1,4 +1,4 @@
-$NetBSD: patch-kadmin_cli_ss_wrapper.c,v 1.1 2016/10/28 20:56:14 tez Exp $
+$NetBSD: patch-kadmin_cli_ss_wrapper.c,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Fix build on OS X (missing time_t definition)
 
diff --git a/security/mit-krb5/patches/patch-lib_apputils_Makefile.in b/security/mit-krb5/patches/patch-lib_apputils_Makefile.in
index e9b362a65357..3dc482bf1c28 100644
--- a/security/mit-krb5/patches/patch-lib_apputils_Makefile.in
+++ b/security/mit-krb5/patches/patch-lib_apputils_Makefile.in
@@ -1,17 +1,17 @@
-$NetBSD: patch-lib_apputils_Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-lib_apputils_Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 libapputils is an internal library, so make it a convenience libtool archive.
 (was patch-ck)
 
---- lib/apputils/Makefile.in.orig	2016-02-29 19:50:13.000000000 +0000
+--- lib/apputils/Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ lib/apputils/Makefile.in
 @@ -14,6 +14,9 @@ SED = sed
  
- STLIBOBJS=net-server.o @LIBOBJS@
+ STLIBOBJS=net-server.o udppktinfo.o @LIBOBJS@
  LIBBASE=apputils
 +LIBTOOL_TAIL=
 +PROG_RPATH=	${KRB5_LIBDIR}
 +SHLIB_RDIRS=	${KRB5_LIBDIR}
  
- all-unix:: all-liblinks
+ all-unix: all-liblinks
  clean-unix:: clean-liblinks clean-libs clean-libobjs
diff --git a/security/mit-krb5/patches/patch-lib_apputils_net-server.c b/security/mit-krb5/patches/patch-lib_apputils_net-server.c
deleted file mode 100644
index b64b79f01116..000000000000
--- a/security/mit-krb5/patches/patch-lib_apputils_net-server.c
+++ /dev/null
@@ -1,23 +0,0 @@
-$NetBSD: patch-lib_apputils_net-server.c,v 1.3 2016/04/17 15:33:13 kamil Exp $
-
---- lib/apputils/net-server.c.orig	2016-02-29 19:50:13.000000000 +0000
-+++ lib/apputils/net-server.c
-@@ -960,7 +960,9 @@ routing_update_needed(struct rt_msghdr *
-             break;
- #endif
-         return 1;
-+#ifdef RTM_RESOLVE
-     case RTM_RESOLVE:
-+#endif
- #ifdef RTM_NEWMADDR
-     case RTM_NEWMADDR:
-     case RTM_DELMADDR:
-@@ -1276,7 +1278,7 @@ send_to_from(int s, void *buf, size_t le
-     msg.msg_controllen = 0;
- 
-     switch (from->sa_family) {
--#if defined(IP_PKTINFO)
-+#if defined(IP_PKTINFO) && !defined(__NetBSD__)
-     case AF_INET:
-         if (fromlen != sizeof(struct sockaddr_in))
-             goto use_sendto;
diff --git a/security/mit-krb5/patches/patch-lib_apputils_udppktinfo.c b/security/mit-krb5/patches/patch-lib_apputils_udppktinfo.c
new file mode 100644
index 000000000000..4d3ad47a681a
--- /dev/null
+++ b/security/mit-krb5/patches/patch-lib_apputils_udppktinfo.c
@@ -0,0 +1,16 @@
+$NetBSD: patch-lib_apputils_udppktinfo.c,v 1.1 2018/06/15 20:46:01 tez Exp $
+
+Don't use IP_PKTINFO on NetBSD, it doesn't support all required fields.
+(based on prior patch-lib_apputils_net-server.c)
+
+--- ./lib/apputils/udppktinfo.c.orig	2018-06-13 17:53:37.880688500 +0000
++++ ./lib/apputils/udppktinfo.c
+@@ -129,7 +129,7 @@ set_pktinfo(int sock, int family)
+     }
+ }
+ 
+-#if defined(HAVE_PKTINFO_SUPPORT) && defined(CMSG_SPACE)
++#if defined(HAVE_PKTINFO_SUPPORT) && defined(CMSG_SPACE) && !defined(__NetBSD__)
+ 
+ /*
+  * Check if a socket is bound to a wildcard address.
diff --git a/security/mit-krb5/patches/patch-lib_krb5_asn.1_asn1buf.h b/security/mit-krb5/patches/patch-lib_krb5_asn.1_asn1buf.h
index e2c7f9cdaf25..519b6475e59c 100644
--- a/security/mit-krb5/patches/patch-lib_krb5_asn.1_asn1buf.h
+++ b/security/mit-krb5/patches/patch-lib_krb5_asn.1_asn1buf.h
@@ -1,4 +1,4 @@
-$NetBSD: patch-lib_krb5_asn.1_asn1buf.h,v 1.2 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-lib_krb5_asn.1_asn1buf.h,v 1.3 2018/06/15 20:46:01 tez Exp $
 
 Clang does not like this kind of inlines.
 
diff --git a/security/mit-krb5/patches/patch-lib_krb5_ccache_Makefile.in b/security/mit-krb5/patches/patch-lib_krb5_ccache_Makefile.in
index f7415f93d52e..66aef097c597 100644
--- a/security/mit-krb5/patches/patch-lib_krb5_ccache_Makefile.in
+++ b/security/mit-krb5/patches/patch-lib_krb5_ccache_Makefile.in
@@ -1,16 +1,16 @@
-$NetBSD: patch-lib_krb5_ccache_Makefile.in,v 1.2 2016/10/31 17:15:36 tez Exp $
+$NetBSD: patch-lib_krb5_ccache_Makefile.in,v 1.3 2018/06/15 20:46:01 tez Exp $
 
 Fix build on OS X (missing kcmrpc.h)
 
 
---- lib/krb5/ccache/Makefile.in.orig	2016-09-13 14:59:44.000000000 -0500
-+++ lib/krb5/ccache/Makefile.in	2016-10-28 14:00:21.000000000 -0500
-@@ -93,6 +93,8 @@
+--- lib/krb5/ccache/Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
++++ lib/krb5/ccache/Makefile.in
+@@ -96,6 +96,8 @@ all-unix: all-libobjs
  
- all-windows:: subdirs $(OBJFILE) 
+ all-windows: subdirs $(OBJFILE)
  
 +generate-files-mac: $(KCMRPC_DEPS)
 +
- ##DOS##subdirs:: ccapi\$(OUTPRE)file.lst
+ ##DOS##subdirs: ccapi\$(OUTPRE)file.lst
  
- ##DOS##ccapi\$(OUTPRE)file.lst::
+ ##DOS##ccapi\$(OUTPRE)file.lst:
diff --git a/security/mit-krb5/patches/patch-lib_krb5_os_timeofday.c b/security/mit-krb5/patches/patch-lib_krb5_os_timeofday.c
deleted file mode 100644
index 4f5b21f37b90..000000000000
--- a/security/mit-krb5/patches/patch-lib_krb5_os_timeofday.c
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-lib_krb5_os_timeofday.c,v 1.1 2018/05/25 13:46:40 jperkin Exp $
-
-Avoid bogus -Wuninitialized warning.
-
---- lib/krb5/os/timeofday.c.orig	2017-09-25 16:29:00.000000000 +0000
-+++ lib/krb5/os/timeofday.c
-@@ -54,7 +54,7 @@ krb5_timeofday(krb5_context context, reg
- krb5_error_code KRB5_CALLCONV
- krb5_check_clockskew(krb5_context context, krb5_timestamp date)
- {
--    krb5_timestamp currenttime;
-+    krb5_timestamp currenttime = 0;
-     krb5_error_code retval;
- 
-     retval = krb5_timeofday(context, &currenttime);
diff --git a/security/mit-krb5/patches/patch-plugins_kdb_db2_Makefile.in b/security/mit-krb5/patches/patch-plugins_kdb_db2_Makefile.in
index ed5c207076df..94f9a1da6b09 100644
--- a/security/mit-krb5/patches/patch-plugins_kdb_db2_Makefile.in
+++ b/security/mit-krb5/patches/patch-plugins_kdb_db2_Makefile.in
@@ -1,4 +1,4 @@
-$NetBSD: patch-plugins_kdb_db2_Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-plugins_kdb_db2_Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 (was patch-ch)
diff --git a/security/mit-krb5/patches/patch-plugins_kdb_db2_libdb2_Makefile.in b/security/mit-krb5/patches/patch-plugins_kdb_db2_libdb2_Makefile.in
index 20728073f36c..f4c36c8aa7a5 100644
--- a/security/mit-krb5/patches/patch-plugins_kdb_db2_libdb2_Makefile.in
+++ b/security/mit-krb5/patches/patch-plugins_kdb_db2_libdb2_Makefile.in
@@ -1,4 +1,4 @@
-$NetBSD: patch-plugins_kdb_db2_libdb2_Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-plugins_kdb_db2_libdb2_Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 Add --enable-pkgsrc-libtool option
 
diff --git a/security/mit-krb5/patches/patch-plugins_preauth_otp_Makefile.in b/security/mit-krb5/patches/patch-plugins_preauth_otp_Makefile.in
index a3a627ab2f5b..f1a1a6716173 100644
--- a/security/mit-krb5/patches/patch-plugins_preauth_otp_Makefile.in
+++ b/security/mit-krb5/patches/patch-plugins_preauth_otp_Makefile.in
@@ -1,4 +1,4 @@
-$NetBSD: patch-plugins_preauth_otp_Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-plugins_preauth_otp_Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
 --- plugins/preauth/otp/Makefile.in.orig	2016-03-02 15:29:43.595168500 +0000
 +++ plugins/preauth/otp/Makefile.in
diff --git a/security/mit-krb5/patches/patch-plugins_preauth_pkinit_Makefile.in b/security/mit-krb5/patches/patch-plugins_preauth_pkinit_Makefile.in
index 680d589d7ae9..060c91cde66c 100644
--- a/security/mit-krb5/patches/patch-plugins_preauth_pkinit_Makefile.in
+++ b/security/mit-krb5/patches/patch-plugins_preauth_pkinit_Makefile.in
@@ -1,8 +1,8 @@
-$NetBSD: patch-plugins_preauth_pkinit_Makefile.in,v 1.1 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-plugins_preauth_pkinit_Makefile.in,v 1.2 2018/06/15 20:46:01 tez Exp $
 
---- plugins/preauth/pkinit/Makefile.in.orig	2016-03-02 15:30:03.611463900 +0000
+--- plugins/preauth/pkinit/Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ plugins/preauth/pkinit/Makefile.in
-@@ -9,8 +9,8 @@ LIBMINOR=0
+@@ -8,8 +8,8 @@ LIBMINOR=0
  RELDIR=../plugins/preauth/pkinit
  # Depends on libk5crypto and libkrb5
  SHLIB_EXPDEPS = \
@@ -10,6 +10,6 @@ $NetBSD: patch-plugins_preauth_pkinit_Makefile.in,v 1.1 2016/03/15 15:16:39 tez
 -	$(TOPLIBD)/libkrb5$(SHLIBEXT)
 +	$(TOPLIBD)/libk5crypto$(DEPLIBEXT) \
 +	$(TOPLIBD)/libkrb5$(DEPLIBEXT)
- SHLIB_EXPLIBS= -lkrb5 -lcom_err -lk5crypto $(PKINIT_CRYPTO_IMPL_LIBS) $(DL_LIB) $(SUPPORT_LIB) $(LIBS)
- DEFINES=-DPKINIT_DYNOBJEXT=\""$(PKINIT_DYNOBJEXT)"\"
+ SHLIB_EXPLIBS= -lkrb5 -lcom_err -lk5crypto -lcrypto $(DL_LIB) $(SUPPORT_LIB) $(LIBS)
  
+ STLIBOBJS= \
diff --git a/security/mit-krb5/patches/patch-util_k5ev_verto-k5ev.c b/security/mit-krb5/patches/patch-util_k5ev_verto-k5ev.c
index 60eca2cce9d8..c479970157a2 100644
--- a/security/mit-krb5/patches/patch-util_k5ev_verto-k5ev.c
+++ b/security/mit-krb5/patches/patch-util_k5ev_verto-k5ev.c
@@ -1,8 +1,8 @@
-$NetBSD: patch-util_k5ev_verto-k5ev.c,v 1.3 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-util_k5ev_verto-k5ev.c,v 1.4 2018/06/15 20:46:01 tez Exp $
 
 Fix include file path
 
---- util/verto/verto-k5ev.c.orig	2016-02-29 19:50:13.000000000 +0000
+--- util/verto/verto-k5ev.c.orig	2018-05-03 14:34:47.000000000 +0000
 +++ util/verto/verto-k5ev.c
 @@ -35,7 +35,7 @@
  
@@ -10,6 +10,6 @@ Fix include file path
  #include <verto-module.h>
 -#include "rename.h"
 +#include "gssrpc/rename.h"
- #define EV_STANDALONE 1
- /* Avoid using clock_gettime, which would create a dependency on librt. */
- #define EV_USE_MONOTONIC 0
+ 
+ /* Ignore some warnings generated by the libev code, which the libev maintainer
+  * isn't interested in avoiding. */
diff --git a/security/mit-krb5/patches/patch-util_ss_Makefile.in b/security/mit-krb5/patches/patch-util_ss_Makefile.in
index c0a38d2d7da3..23fce144a036 100644
--- a/security/mit-krb5/patches/patch-util_ss_Makefile.in
+++ b/security/mit-krb5/patches/patch-util_ss_Makefile.in
@@ -1,8 +1,8 @@
-$NetBSD: patch-util_ss_Makefile.in,v 1.3 2016/03/15 15:16:39 tez Exp $
+$NetBSD: patch-util_ss_Makefile.in,v 1.4 2018/06/15 20:46:01 tez Exp $
 
 Only build a static library as this library is not installed.
 
---- util/ss/Makefile.in.orig	2016-02-29 19:50:13.000000000 +0000
+--- util/ss/Makefile.in.orig	2018-05-03 14:34:47.000000000 +0000
 +++ util/ss/Makefile.in
 @@ -13,6 +13,8 @@ LIBBASE=ss
  LIBMAJOR=1
@@ -12,4 +12,4 @@ Only build a static library as this library is not installed.
 +SHLIB_RDIRS=${KRB5_LIBDIR}
  
  clean-unix:: clean-liblinks clean-libs clean-libobjs
- install-unix:: install-libs
+ install-unix: install-libs