r13924: Split more prototypes out of include/proto.h + initial work on header

file dependencies
(This used to be commit 122835876748a3eaf5e8d31ad1abddab9acb8781)

166 files changed, 280 insertions, 34 deletions

diff --git a/source4/auth/auth_developer.c b/source4/auth/auth_developer.c
index 14e005efc9..6cbba4ca7a 100644
--- a/source4/auth/auth_developer.c
+++ b/source4/auth/auth_developer.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "libcli/security/proto.h"
 
 /** 
  * Return an error based on username
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index f1ea2a783c..db683fda79 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -24,6 +24,8 @@
 #include "system/time.h"
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
+#include "libcli/security/proto.h"
 #include "libcli/ldap/ldap.h"
 
 static const char *user_attrs[] = {
diff --git a/source4/auth/auth_sam_reply.c b/source4/auth/auth_sam_reply.c
index 89b389aa83..5ba2ab4306 100644
--- a/source4/auth/auth_sam_reply.c
+++ b/source4/auth/auth_sam_reply.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "libcli/security/proto.h"
 
 NTSTATUS auth_convert_server_info_sambaseinfo(TALLOC_CTX *mem_ctx, 
 					      struct auth_serversupplied_info *server_info, 
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 1ff2f8ccc4..86f1573340 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -24,6 +24,8 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "libcli/security/proto.h"
+#include "libcli/auth/proto.h"
 
 /* this default function can be used by mostly all backends
  * which don't want to set a challlenge
diff --git a/source4/auth/config.mk b/source4/auth/config.mk
index 9c14528572..56bc28c840 100644
--- a/source4/auth/config.mk
+++ b/source4/auth/config.mk
@@ -7,9 +7,9 @@ include credentials/config.mk
 #######################
 # Start MODULE auth_sam
 [MODULE::auth_sam]
+PRIVATE_PROTO_HEADER = auth_sam.h
 INIT_FUNCTION = auth_sam_init
 SUBSYSTEM = AUTH
-NOPROTO = NO
 OBJ_FILES = \
 		auth_sam.o
 REQUIRED_SUBSYSTEMS = \
diff --git a/source4/auth/credentials/credentials.c b/source4/auth/credentials/credentials.c
index b1554cc9ef..4162c2a10a 100644
--- a/source4/auth/credentials/credentials.c
+++ b/source4/auth/credentials/credentials.c
@@ -25,6 +25,7 @@
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_samr.h" /* for struct samrPassword */
 #include "auth/gensec/gensec.h"
+#include "libcli/auth/proto.h"
 
 /**
  * Create a new credentials structure
diff --git a/source4/auth/credentials/credentials_files.c b/source4/auth/credentials/credentials_files.c
index 53350b8ed0..c4e384c2cd 100644
--- a/source4/auth/credentials/credentials_files.c
+++ b/source4/auth/credentials/credentials_files.c
@@ -27,6 +27,7 @@
 #include "librpc/gen_ndr/ndr_samr.h" /* for struct samrPassword */
 #include "passdb/secrets.h"
 #include "system/filesys.h"
+#include "db_wrap.h"
 
 /**
  * Read a file descriptor, and parse it for a password (eg from a file or stdin)
diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c
index 5068540a32..eafd5e00a2 100644
--- a/source4/auth/credentials/credentials_ntlm.c
+++ b/source4/auth/credentials/credentials_ntlm.c
@@ -25,6 +25,7 @@
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_samr.h" /* for struct samrPassword */
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/proto.h"
 
 void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, 
 					      const char **username, 
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index eab8211525..580b7a7be1 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -27,6 +27,7 @@
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "auth/auth.h"
+#include "auth/auth_sam.h"
 
 enum gensec_gssapi_sasl_state 
 {
diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index a52ea1b686..200822655d 100644
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -29,6 +29,7 @@
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "auth/auth.h"
+#include "auth/auth_sam.h"
 #include "system/network.h"
 #include "lib/socket/socket.h"
 
diff --git a/source4/auth/gensec/schannel_state.c b/source4/auth/gensec/schannel_state.c
index beaa8cfb08..b9cee49f5a 100644
--- a/source4/auth/gensec/schannel_state.c
+++ b/source4/auth/gensec/schannel_state.c
@@ -25,8 +25,9 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
 
-/*
+/**
   connect to the schannel ldb
 */
 struct ldb_context *schannel_db_connect(TALLOC_CTX *mem_ctx)
diff --git a/source4/auth/ntlm_check.c b/source4/auth/ntlm_check.c
index 5a08cf5f09..390caa0071 100644
--- a/source4/auth/ntlm_check.c
+++ b/source4/auth/ntlm_check.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "lib/crypto/crypto.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
+#include "libcli/auth/proto.h"
 
 /****************************************************************************
  Core of smb password checking routine.
diff --git a/source4/auth/ntlmssp/config.mk b/source4/auth/ntlmssp/config.mk
index 32b917e4ce..55a9e09971 100644
--- a/source4/auth/ntlmssp/config.mk
+++ b/source4/auth/ntlmssp/config.mk
@@ -4,6 +4,7 @@
 SUBSYSTEM = GENSEC
 NOPROTO = NO
 INIT_FUNCTION = gensec_ntlmssp_init
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = ntlmssp.o \
 		ntlmssp_sign.o \
 		ntlmssp_client.o \
diff --git a/source4/auth/ntlmssp/ntlmssp.h b/source4/auth/ntlmssp/ntlmssp.h
index 640d2d57fe..721d05149e 100644
--- a/source4/auth/ntlmssp/ntlmssp.h
+++ b/source4/auth/ntlmssp/ntlmssp.h
@@ -185,4 +185,4 @@ struct gensec_ntlmssp_state
 	struct auth_serversupplied_info *server_info;
 };
 
-
+#include "auth/ntlmssp/proto.h"
diff --git a/source4/auth/ntlmssp/ntlmssp_client.c b/source4/auth/ntlmssp/ntlmssp_client.c
index c2a1e1cde8..cc7a376643 100644
--- a/source4/auth/ntlmssp/ntlmssp_client.c
+++ b/source4/auth/ntlmssp/ntlmssp_client.c
@@ -26,6 +26,7 @@
 #include "auth/auth.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/proto.h"
 
 /*********************************************************************
  Client side NTLMSSP
diff --git a/source4/auth/ntlmssp/ntlmssp_server.c b/source4/auth/ntlmssp/ntlmssp_server.c
index 65956d0580..54eb7f9bff 100644
--- a/source4/auth/ntlmssp/ntlmssp_server.c
+++ b/source4/auth/ntlmssp/ntlmssp_server.c
@@ -28,6 +28,7 @@
 #include "lib/crypto/crypto.h"
 #include "pstring.h"
 #include "system/filesys.h"
+#include "libcli/auth/proto.h"
 
 /** 
  * Set a username on an NTLMSSP context - ensures it is talloc()ed 
diff --git a/source4/build/smb_build/TODO b/source4/build/smb_build/TODO
index 05893b62de..6b5ebbb8ba 100644
--- a/source4/build/smb_build/TODO
+++ b/source4/build/smb_build/TODO
@@ -1,3 +1,7 @@
+- for each subsystem:
+ - include line in Makefile
+ - rule in Makefile
+ - 
 - sonames
 - get rid of include/structs.h
 - add register function to smbtorture
diff --git a/source4/build/smb_build/main.pl b/source4/build/smb_build/main.pl
index 83befe7c67..bf11e8c896 100644
--- a/source4/build/smb_build/main.pl
+++ b/source4/build/smb_build/main.pl
@@ -77,6 +77,7 @@ foreach my $key (values %$OUTPUT) {
 	$mkenv->Header($key) if defined($key->{PUBLIC_HEADERS});
 	$mkenv->ProtoHeader($key) if defined($key->{PRIVATE_PROTO_HEADER});
 
+#	$mkenv->DependencyInfo($key) if $config::config{developer} eq "yes";
 }
 
 $mkenv->write("Makefile");
diff --git a/source4/build/smb_build/makefile.pm b/source4/build/smb_build/makefile.pm
index b7c3a27383..0638c0ac30 100644
--- a/source4/build/smb_build/makefile.pm
+++ b/source4/build/smb_build/makefile.pm
@@ -239,6 +239,18 @@ sub _prepare_list($$$)
 	$self->output("$ctx->{TYPE}\_$ctx->{NAME}_$var =$tmplist\n");
 }
 
+sub DependencyInfo($$)
+{
+	my ($self,$ctx) = @_;
+
+	$self->output("bin/deps/$ctx->{TYPE}_$ctx->{NAME}: \$($ctx->{TYPE}_$ctx->{NAME}_OBJ_LIST:.o=.c)");
+	$self->output("\n");
+	$self->output("\t\@echo \"Generating dependency info for $ctx->{NAME}\"\n");
+	$self->output("\t\@./script/cdeps.pl \$^ > \$@\n");
+	$self->output("\n");
+	$self->output("-include bin/deps/$ctx->{TYPE}_$ctx->{NAME}\n\n");
+}
+
 sub SharedLibrary($$)
 {
 	my ($self,$ctx) = @_;
diff --git a/source4/cldap_server/cldap_server.c b/source4/cldap_server/cldap_server.c
index 7270e01a4d..f522995bc4 100644
--- a/source4/cldap_server/cldap_server.c
+++ b/source4/cldap_server/cldap_server.c
@@ -26,6 +26,8 @@
 #include "lib/messaging/irpc.h"
 #include "smbd/service_task.h"
 #include "cldap_server/cldap_server.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   handle incoming cldap requests
@@ -95,7 +97,7 @@ static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, const char *addr
 /*
   setup our listening sockets on the configured network interfaces
 */
-NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd)
+static NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd)
 {
 	int num_interfaces = iface_count();
 	TALLOC_CTX *tmp_ctx = talloc_new(cldapd);
diff --git a/source4/cldap_server/netlogon.c b/source4/cldap_server/netlogon.c
index 476b9dfed5..45a6930451 100644
--- a/source4/cldap_server/netlogon.c
+++ b/source4/cldap_server/netlogon.c
@@ -28,6 +28,9 @@
 #include "cldap_server/cldap_server.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
+#include "db_wrap.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   fill in the cldap netlogon union for a given version
diff --git a/source4/client/client.c b/source4/client/client.c
index 077ca351c1..83a2b750b6 100644
--- a/source4/client/client.c
+++ b/source4/client/client.c
@@ -34,6 +34,8 @@
 #include "system/readline.h"
 #include "auth/gensec/gensec.h"
 #include "system/time.h" /* needed by some systems for asctime() */
+#include "libcli/resolve/resolve.h"
+#include "libcli/security/proto.h"
 
 static int io_bufsize = 64512;
 
diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c
index d886894483..60e914e677 100644
--- a/source4/dsdb/samdb/cracknames.c
+++ b/source4/dsdb/samdb/cracknames.c
@@ -30,7 +30,9 @@
 #include "auth/kerberos/kerberos.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/security/proto.h"
 #include "auth/auth.h"
+#include "db_wrap.h"
 
 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 				   struct smb_krb5_context *smb_krb5_context,
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
index 4c680df3e6..24866a9e45 100644
--- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
+++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
@@ -35,6 +35,7 @@
 #include "ldb/include/ldb_errors.h"
 #include "ldb/include/ldb_private.h"
 #include "auth/auth.h"
+#include "libcli/security/proto.h"
 
 /* Kludge ACL rules:
  *
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 0530c63774..2abf060a0f 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -36,6 +36,7 @@
 #include "ldb/include/ldb_private.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "librpc/gen_ndr/ndr_samr.h"
+#include "libcli/auth/proto.h"
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "system/time.h"
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 3355df4e23..4be91a6cfb 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -38,6 +38,8 @@
 #include "lib/ldb/include/ldb_errors.h"
 #include "lib/ldb/include/ldb_private.h"
 #include "dsdb/samdb/samdb.h"
+#include "libcli/security/proto.h"
+#include "db_wrap.h"
 
 
 /* if value is not null also check for attribute to have exactly that value */
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index fe82b380c5..358f565283 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -25,6 +25,7 @@
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
+#include "libcli/security/proto.h"
 #include "system/time.h"
 #include "system/filesys.h"
 #include "db_wrap.h"
diff --git a/source4/dsdb/samdb/samdb_privilege.c b/source4/dsdb/samdb/samdb_privilege.c
index 33d53e56e8..0cf2e9c0a9 100644
--- a/source4/dsdb/samdb/samdb_privilege.c
+++ b/source4/dsdb/samdb/samdb_privilege.c
@@ -24,6 +24,8 @@
 #include "libcli/ldap/ldap.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
+#include "libcli/security/proto.h"
+#include "db_wrap.h"
 
 /*
   add privilege bits for one sid to a security_token
diff --git a/source4/heimdal_build/glue.c b/source4/heimdal_build/glue.c
index 819a395ca8..bf64360c43 100644
--- a/source4/heimdal_build/glue.c
+++ b/source4/heimdal_build/glue.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "system/network.h"
 #include "system/kerberos.h"
+#include "netif/netif.h"
 
 /*
   get the list of IP addresses for configured interfaces
diff --git a/source4/include/includes.h b/source4/include/includes.h
index 60e3fb034b..adf4d37016 100644
--- a/source4/include/includes.h
+++ b/source4/include/includes.h
@@ -105,7 +105,7 @@ enum brl_type {
 #include "lib/replace/replace.h"
 
 /* Lists, trees, caching, database... */
-#include "nt_status.h"
+#include "libcli/util/nt_status.h"
 #include "talloc/talloc.h"
 #include "core.h"
 #include "charset/charset.h"
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 5766a9acfa..742c067194 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -41,6 +41,8 @@
 #include "system/iconv.h"
 #include "librpc/gen_ndr/netlogon.h"
 #include "auth/auth.h"
+#include "auth/auth_sam.h"
+#include "db_wrap.h"
 #include "dsdb/samdb/samdb.h"
 
 enum hdb_ldb_ent_type 
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 8492d5a7eb..77ed9b6f15 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -25,6 +25,7 @@
 #include "includes.h"
 #include "smbd/service_task.h"
 #include "smbd/service_stream.h"
+#include "smbd/process_model.h"
 #include "lib/events/events.h"
 #include "lib/socket/socket.h"
 #include "kdc/kdc.h"
@@ -32,8 +33,8 @@
 #include "dlinklist.h"
 #include "lib/messaging/irpc.h"
 #include "lib/stream/packet.h"
-
 #include "librpc/gen_ndr/samr.h"
+#include "netif/netif.h"
 
 /* hold all the info needed to send a reply */
 struct kdc_reply {
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index a9c12b8ee6..ca5f37fa79 100644
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -28,6 +28,7 @@
 #include "heimdal/lib/krb5/krb5_locl.h"
 #include "librpc/gen_ndr/krb5pac.h"
 #include "auth/auth.h"
+#include "auth/auth_sam.h"
 
 /* Given the right private pointer from hdb_ldb, get a PAC from the attached ldb messages */
 static krb5_error_code samba_get_pac(krb5_context context, 
diff --git a/source4/ldap_server/config.mk b/source4/ldap_server/config.mk
index 826597cdcb..3b7cf04d68 100644
--- a/source4/ldap_server/config.mk
+++ b/source4/ldap_server/config.mk
@@ -3,6 +3,7 @@
 #######################
 # Start SUBSYSTEM LDAP
 [SUBSYSTEM::LDAP]
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = \
 		ldap_server.o \
 		ldap_backend.o \
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index a6786e2990..b1ef4ff006 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -36,6 +36,8 @@
 #include "lib/stream/packet.h"
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   close the socket and shutdown a server_context
diff --git a/source4/ldap_server/ldap_server.h b/source4/ldap_server/ldap_server.h
index f71c703088..10c93f6610 100644
--- a/source4/ldap_server/ldap_server.h
+++ b/source4/ldap_server/ldap_server.h
@@ -60,3 +60,5 @@ struct ldapsrv_service;
 struct ldapsrv_service {
 	struct tls_params *tls_params;
 };
+
+#include "ldap_server/proto.h"
diff --git a/source4/lib/basic.mk b/source4/lib/basic.mk
index b57de3f6ef..50ed8cc02f 100644
--- a/source4/lib/basic.mk
+++ b/source4/lib/basic.mk
@@ -22,6 +22,7 @@ include tdr/config.mk
 ##############################
 # Start SUBSYSTEM LIBNETIF
 [SUBSYSTEM::LIBNETIF]
+PRIVATE_PROTO_HEADER = netif/proto.h
 OBJ_FILES = \
 		netif/interface.o \
 		netif/netif.o
@@ -55,6 +56,7 @@ OBJ_FILES = \
 		gencache/gencache.o \
 
 [SUBSYSTEM::DB_WRAP]
+PRIVATE_PROTO_HEADER = db_wrap_proto.h
 OBJ_FILES = db_wrap.o \
 		gendb.o
 REQUIRED_SUBSYSTEMS = LIBLDB LIBTDB LDBSAMBA
diff --git a/source4/lib/db_wrap.h b/source4/lib/db_wrap.h
index 48e1bbc9e1..1af2cd2e2a 100644
--- a/source4/lib/db_wrap.h
+++ b/source4/lib/db_wrap.h
@@ -28,3 +28,4 @@ struct tdb_wrap {
 	struct tdb_wrap *next, *prev;
 };
 
+#include "db_wrap_proto.h"
diff --git a/source4/lib/ldb/samba/ldif_handlers.c b/source4/lib/ldb/samba/ldif_handlers.c
index df4b5e9c3b..e57cd970b1 100644
--- a/source4/lib/ldb/samba/ldif_handlers.c
+++ b/source4/lib/ldb/samba/ldif_handlers.c
@@ -28,6 +28,7 @@
 #include "librpc/gen_ndr/ndr_security.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "dsdb/samdb/samdb.h"
+#include "libcli/security/proto.h"
 
 /*
   convert a ldif formatted objectSid to a NDR formatted blob
diff --git a/source4/lib/ldb/tools/cmdline.c b/source4/lib/ldb/tools/cmdline.c
index 8f803c5118..2874818160 100644
--- a/source4/lib/ldb/tools/cmdline.c
+++ b/source4/lib/ldb/tools/cmdline.c
@@ -29,6 +29,7 @@
 #ifdef _SAMBA_BUILD_
 #include "lib/cmdline/popt_common.h"
 #include "auth/auth.h"
+#include "db_wrap.h"
 #endif
 
 /*
diff --git a/source4/lib/netif/interface.c b/source4/lib/netif/interface.c
index 8d738f6c41..019b05cfbb 100644
--- a/source4/lib/netif/interface.c
+++ b/source4/lib/netif/interface.c
@@ -25,7 +25,7 @@
 #include "lib/netif/netif.h"
 #include "dlinklist.h"
 
-/* used for network interfaces */
+/** used for network interfaces */
 struct interface {
 	struct interface *next, *prev;
 	struct ipv4_addr ip;
@@ -105,7 +105,7 @@ static void add_interface(struct in_addr ip, struct in_addr nmask)
 
 
 
-/****************************************************************************
+/**
 interpret a single element from a interfaces= config line 
 
 This handles the following different forms:
@@ -115,7 +115,7 @@ This handles the following different forms:
 3) IP/masklen
 4) ip/mask
 5) bcast/mask
-****************************************************************************/
+**/
 static void interpret_interface(const char *token, 
 				struct iface_struct *probed_ifaces, 
 				int total_probed)
@@ -184,9 +184,9 @@ static void interpret_interface(const char *token,
 }
 
 
-/****************************************************************************
+/**
 load the list of network interfaces
-****************************************************************************/
+**/
 static void load_interfaces(void)
 {
 	const char **ptr;
@@ -230,19 +230,19 @@ static void load_interfaces(void)
 }
 
 
-/*
+/**
   unload the interfaces list, so it can be reloaded when needed
 */
-_PUBLIC_ void unload_interfaces(void)
+void unload_interfaces(void)
 {
 	talloc_free(local_interfaces);
 	local_interfaces = NULL;
 }
 
-/****************************************************************************
+/**
   how many interfaces do we have
-  **************************************************************************/
-_PUBLIC_ int iface_count(void)
+  **/
+int iface_count(void)
 {
 	int ret = 0;
 	struct interface *i;
@@ -254,10 +254,10 @@ _PUBLIC_ int iface_count(void)
 	return ret;
 }
 
-/****************************************************************************
+/**
   return IP of the Nth interface
-  **************************************************************************/
-_PUBLIC_ const char *iface_n_ip(int n)
+  **/
+const char *iface_n_ip(int n)
 {
 	struct interface *i;
   
@@ -272,10 +272,10 @@ _PUBLIC_ const char *iface_n_ip(int n)
 	return NULL;
 }
 
-/****************************************************************************
+/**
   return bcast of the Nth interface
-  **************************************************************************/
-_PUBLIC_ const char *iface_n_bcast(int n)
+  **/
+const char *iface_n_bcast(int n)
 {
 	struct interface *i;
   
@@ -290,10 +290,10 @@ _PUBLIC_ const char *iface_n_bcast(int n)
 	return NULL;
 }
 
-/****************************************************************************
+/**
   return netmask of the Nth interface
-  **************************************************************************/
-_PUBLIC_ const char *iface_n_netmask(int n)
+  **/
+const char *iface_n_netmask(int n)
 {
 	struct interface *i;
   
@@ -308,11 +308,11 @@ _PUBLIC_ const char *iface_n_netmask(int n)
 	return NULL;
 }
 
-/*
+/**
   return the local IP address that best matches a destination IP, or
   our first interface if none match
 */
-_PUBLIC_ const char *iface_best_ip(const char *dest)
+const char *iface_best_ip(const char *dest)
 {
 	struct interface *iface;
 	struct in_addr ip;
@@ -327,10 +327,10 @@ _PUBLIC_ const char *iface_best_ip(const char *dest)
 	return iface_n_ip(0);
 }
 
-/*
+/**
   return True if an IP is one one of our local networks
 */
-_PUBLIC_ BOOL iface_is_local(const char *dest)
+BOOL iface_is_local(const char *dest)
 {
 	struct in_addr ip;
 
@@ -343,10 +343,10 @@ _PUBLIC_ BOOL iface_is_local(const char *dest)
 	return False;
 }
 
-/*
+/**
   return True if a IP matches a IP/netmask pair
 */
-_PUBLIC_ BOOL iface_same_net(const char *ip1, const char *ip2, const char *netmask)
+BOOL iface_same_net(const char *ip1, const char *ip2, const char *netmask)
 {
 	return same_net(interpret_addr2(ip1),
 			interpret_addr2(ip2),
diff --git a/source4/lib/netif/netif.c b/source4/lib/netif/netif.c
index 8256615ef2..0344febf38 100644
--- a/source4/lib/netif/netif.c
+++ b/source4/lib/netif/netif.c
@@ -77,6 +77,7 @@
 #endif
 
 #include <net/if.h>
+#define BOOL int
 #include "netif.h"
 
 #if HAVE_IFACE_IFCONF
diff --git a/source4/lib/netif/netif.h b/source4/lib/netif/netif.h
index 7efe5a9b19..77b7809685 100644
--- a/source4/lib/netif/netif.h
+++ b/source4/lib/netif/netif.h
@@ -28,3 +28,4 @@ struct iface_struct {
 
 #define MAX_INTERFACES 128
 
+#include "netif/proto.h"
diff --git a/source4/lib/samba3/group.c b/source4/lib/samba3/group.c
index eea70c8530..74190e24ea 100644
--- a/source4/lib/samba3/group.c
+++ b/source4/lib/samba3/group.c
@@ -24,6 +24,7 @@
 #include "lib/samba3/samba3.h"
 #include "lib/tdb/include/tdbutil.h"
 #include "system/filesys.h"
+#include "libcli/security/proto.h"
 
 #define DATABASE_VERSION_V1 1 /* native byte format. */
 #define DATABASE_VERSION_V2 2 /* le format. */
diff --git a/source4/lib/samba3/idmap.c b/source4/lib/samba3/idmap.c
index 205089f1cc..6958f8d004 100644
--- a/source4/lib/samba3/idmap.c
+++ b/source4/lib/samba3/idmap.c
@@ -27,6 +27,7 @@
 #include "lib/tdb/include/tdbutil.h"
 #include "lib/samba3/samba3.h"
 #include "system/filesys.h"
+#include "libcli/security/proto.h"
 
 /* High water mark keys */
 #define HWM_GROUP  "GROUP HWM"
diff --git a/source4/lib/socket/connect.c b/source4/lib/socket/connect.c
index dc64198caa..a74e2a67e6 100644
--- a/source4/lib/socket/connect.c
+++ b/source4/lib/socket/connect.c
@@ -26,6 +26,7 @@
 #include "lib/socket/socket.h"
 #include "lib/events/events.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
 
 
 struct connect_state {
diff --git a/source4/lib/socket/connect_multi.c b/source4/lib/socket/connect_multi.c
index 7396435075..9f060767af 100644
--- a/source4/lib/socket/connect_multi.c
+++ b/source4/lib/socket/connect_multi.c
@@ -26,6 +26,7 @@
 #include "lib/socket/socket.h"
 #include "lib/events/events.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
 
 #define MULTI_PORT_DELAY 2000 /* microseconds */
 
diff --git a/source4/libcli/auth/config.mk b/source4/libcli/auth/config.mk
index 0d8c21d527..c879c60956 100644
--- a/source4/libcli/auth/config.mk
+++ b/source4/libcli/auth/config.mk
@@ -1,6 +1,7 @@
 #################################
 # Start SUBSYSTEM LIBCLI_AUTH
 [SUBSYSTEM::LIBCLI_AUTH]
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = credentials.o \
 		session.o \
 		smbencrypt.o 
diff --git a/source4/libcli/auth/smbencrypt.c b/source4/libcli/auth/smbencrypt.c
index 12c5d2dfb6..0ebd78fa7f 100644
--- a/source4/libcli/auth/smbencrypt.c
+++ b/source4/libcli/auth/smbencrypt.c
@@ -27,6 +27,7 @@
 #include "smb.h"
 #include "auth/ntlmssp/ntlmssp.h"
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/proto.h"
 #include "pstring.h"
 
 /*
diff --git a/source4/libcli/cldap/cldap.c b/source4/libcli/cldap/cldap.c
index 490a03d50e..9e407ba200 100644
--- a/source4/libcli/cldap/cldap.c
+++ b/source4/libcli/cldap/cldap.c
@@ -38,6 +38,7 @@
 #include "libcli/ldap/ldap.h"
 #include "libcli/cldap/cldap.h"
 #include "lib/socket/socket.h"
+#include "libcli/security/proto.h"
 
 /*
   destroy a pending request
diff --git a/source4/libcli/cliconnect.c b/source4/libcli/cliconnect.c
index 8103208a26..8616e42cd4 100644
--- a/source4/libcli/cliconnect.c
+++ b/source4/libcli/cliconnect.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "libcli/libcli.h"
 #include "libcli/raw/libcliraw.h"
+#include "libcli/auth/proto.h"
 #include "libcli/smb_composite/smb_composite.h"
 
 /*
diff --git a/source4/libcli/composite/composite.h b/source4/libcli/composite/composite.h
index 26490f1c4a..d1299d77c1 100644
--- a/source4/libcli/composite/composite.h
+++ b/source4/libcli/composite/composite.h
@@ -60,3 +60,5 @@ struct composite_context {
 
 	BOOL used_wait;
 };
+
+#include "libcli/composite/proto.h"
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index b431922de7..71adaaa8c9 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -16,11 +16,13 @@ OBJ_FILES = util/clilsa.o
 REQUIRED_SUBSYSTEMS = RPC_NDR_LSA
 
 [SUBSYSTEM::LIBCLI_COMPOSITE]
+PRIVATE_PROTO_HEADER = composite/proto.h
 OBJ_FILES = \
 	composite/composite.o
 REQUIRED_SUBSYSTEMS = LIBEVENTS
 
 [SUBSYSTEM::LIBCLI_SMB_COMPOSITE]
+PRIVATE_PROTO_HEADER = smb_composite/proto.h
 OBJ_FILES = \
 	smb_composite/loadfile.o \
 	smb_composite/savefile.o \
@@ -80,6 +82,7 @@ OBJ_FILES = \
 REQUIRED_SUBSYSTEMS = NDR_WINSREPL SOCKET LIBEVENTS
 
 [SUBSYSTEM::LIBCLI_RESOLVE]
+PRIVATE_PROTO_HEADER = resolve/resolve.h
 OBJ_FILES = \
 	resolve/resolve.o \
 	resolve/nbtlist.o \
diff --git a/source4/libcli/dgram/browse.c b/source4/libcli/dgram/browse.c
index 25cee387c4..f67e561afc 100644
--- a/source4/libcli/dgram/browse.c
+++ b/source4/libcli/dgram/browse.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "libcli/dgram/libdgram.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
 
 NTSTATUS dgram_mailslot_browse_send(struct nbt_dgram_socket *dgmsock,
 				    struct nbt_name *dest_name,
diff --git a/source4/libcli/dgram/netlogon.c b/source4/libcli/dgram/netlogon.c
index 6ad4c28811..df8c63fa87 100644
--- a/source4/libcli/dgram/netlogon.c
+++ b/source4/libcli/dgram/netlogon.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "libcli/dgram/libdgram.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
 
 /* 
    send a netlogon mailslot request 
diff --git a/source4/libcli/dgram/ntlogon.c b/source4/libcli/dgram/ntlogon.c
index ecd6bd4587..84ad814fa0 100644
--- a/source4/libcli/dgram/ntlogon.c
+++ b/source4/libcli/dgram/ntlogon.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "libcli/dgram/libdgram.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
 
 /* 
    send a ntlogon mailslot request 
diff --git a/source4/libcli/finddcs.c b/source4/libcli/finddcs.c
index 9caf9b5578..085aa352ac 100644
--- a/source4/libcli/finddcs.c
+++ b/source4/libcli/finddcs.c
@@ -27,6 +27,7 @@
 #include "librpc/gen_ndr/ndr_samr.h"
 #include "libcli/composite/composite.h"
 #include "libcli/libcli.h"
+#include "libcli/resolve/resolve.h"
 
 struct finddcs_state {
 	struct composite_context *ctx;
diff --git a/source4/libcli/raw/clisocket.c b/source4/libcli/raw/clisocket.c
index 40d9d2784a..4b1d70d8d2 100644
--- a/source4/libcli/raw/clisocket.c
+++ b/source4/libcli/raw/clisocket.c
@@ -26,6 +26,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "libcli/composite/composite.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
 
 struct sock_connect_state {
 	struct composite_context *ctx;
diff --git a/source4/libcli/resolve/bcast.c b/source4/libcli/resolve/bcast.c
index f8ea6b2b3b..1b58918ea7 100644
--- a/source4/libcli/resolve/bcast.c
+++ b/source4/libcli/resolve/bcast.c
@@ -21,6 +21,9 @@
 */
 
 #include "includes.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   broadcast name resolution method - async send
diff --git a/source4/libcli/resolve/nbtlist.c b/source4/libcli/resolve/nbtlist.c
index 3af40c1b24..e8473966b4 100644
--- a/source4/libcli/resolve/nbtlist.c
+++ b/source4/libcli/resolve/nbtlist.c
@@ -26,6 +26,8 @@
 
 #include "includes.h"
 #include "libcli/composite/composite.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 struct nbtlist_state {
 	struct nbt_name name;
diff --git a/source4/libcli/resolve/resolve.c b/source4/libcli/resolve/resolve.c
index d3d197e567..c3fdf4bc25 100644
--- a/source4/libcli/resolve/resolve.c
+++ b/source4/libcli/resolve/resolve.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "lib/events/events.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
 
 struct resolve_state {
 	struct nbt_name name;
diff --git a/source4/libcli/resolve/wins.c b/source4/libcli/resolve/wins.c
index b2e0ddae6f..f11033ae4f 100644
--- a/source4/libcli/resolve/wins.c
+++ b/source4/libcli/resolve/wins.c
@@ -21,6 +21,7 @@
 */
 
 #include "includes.h"
+#include "libcli/resolve/resolve.h"
 
 /*
   wins name resolution method - async send
diff --git a/source4/libcli/security/access_check.c b/source4/libcli/security/access_check.c
index 00275d8824..9d565363e6 100644
--- a/source4/libcli/security/access_check.c
+++ b/source4/libcli/security/access_check.c
@@ -21,6 +21,7 @@
 */
 
 #include "includes.h"
+#include "libcli/security/proto.h"
 
 
 /*
diff --git a/source4/libcli/security/config.mk b/source4/libcli/security/config.mk
index a8de499531..3202def26c 100644
--- a/source4/libcli/security/config.mk
+++ b/source4/libcli/security/config.mk
@@ -1,6 +1,7 @@
 #################################
 # Start SUBSYSTEM LIB_SECURITY
 [SUBSYSTEM::LIB_SECURITY]
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = security_token.o \
 		security_descriptor.o \
 		dom_sid.o \
diff --git a/source4/libcli/security/sddl.c b/source4/libcli/security/sddl.c
index c434072529..a1e9985edd 100644
--- a/source4/libcli/security/sddl.c
+++ b/source4/libcli/security/sddl.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "system/iconv.h"
+#include "libcli/security/proto.h"
 
 struct flag_map {
 	const char *name;
diff --git a/source4/libcli/security/security_descriptor.c b/source4/libcli/security/security_descriptor.c
index 64983e20d0..20cdeb0ba7 100644
--- a/source4/libcli/security/security_descriptor.c
+++ b/source4/libcli/security/security_descriptor.c
@@ -21,6 +21,7 @@
 */
 
 #include "includes.h"
+#include "libcli/security/proto.h"
 
 /*
   return a blank security descriptor (no owners, dacl or sacl)
diff --git a/source4/libcli/security/security_token.c b/source4/libcli/security/security_token.c
index 6774894a86..7760ee7c22 100644
--- a/source4/libcli/security/security_token.c
+++ b/source4/libcli/security/security_token.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "dsdb/samdb/samdb.h"
+#include "libcli/security/proto.h"
 
 /*
   return a blank security token
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index d15f370feb..b185ff7a88 100644
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -25,6 +25,7 @@
 #include "libcli/smb2/smb2.h"
 #include "libcli/smb2/smb2_calls.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
 
 struct smb2_connect_state {
 	struct cli_credentials *credentials;
diff --git a/source4/libcli/smb_composite/appendacl.c b/source4/libcli/smb_composite/appendacl.c
index c68c0a185d..0a5b56b90d 100644
--- a/source4/libcli/smb_composite/appendacl.c
+++ b/source4/libcli/smb_composite/appendacl.c
@@ -1,6 +1,7 @@
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
 #include "libcli/composite/composite.h"
+#include "libcli/security/proto.h"
 #include "libcli/smb_composite/smb_composite.h"
 
 /* the stages of this call */
diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c
index 785b0d076b..07da2d363a 100644
--- a/source4/libcli/smb_composite/connect.c
+++ b/source4/libcli/smb_composite/connect.c
@@ -26,6 +26,7 @@
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "lib/events/events.h"
+#include "libcli/resolve/resolve.h"
 
 /* the stages of this call */
 enum connect_stage {CONNECT_RESOLVE, 
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index bbe6a7edfb..9e345ab4f8 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -25,6 +25,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
+#include "libcli/auth/proto.h"
 #include "auth/auth.h"
 #include "version.h"
 
diff --git a/source4/libcli/smb_composite/smb_composite.h b/source4/libcli/smb_composite/smb_composite.h
index 7ab0127440..ac34ad40ac 100644
--- a/source4/libcli/smb_composite/smb_composite.h
+++ b/source4/libcli/smb_composite/smb_composite.h
@@ -170,3 +170,5 @@ struct smb_composite_connectmulti {
 		struct smbcli_socket *socket;
 	} out;
 };
+
+#include "libcli/smb_composite/proto.h"
diff --git a/source4/libcli/util/clilsa.c b/source4/libcli/util/clilsa.c
index bf5048b02a..97aa7e13ac 100644
--- a/source4/libcli/util/clilsa.c
+++ b/source4/libcli/util/clilsa.c
@@ -29,6 +29,7 @@
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
 #include "libcli/libcli.h"
+#include "libcli/security/proto.h"
 #include "librpc/gen_ndr/ndr_lsa.h"
 
 struct smblsa_state {
diff --git a/source4/include/nt_status.h b/source4/libcli/util/nt_status.h
index a805a1cfbd..a805a1cfbd 100644
--- a/source4/include/nt_status.h
+++ b/source4/libcli/util/nt_status.h
diff --git a/source4/libcli/wrepl/winsrepl.c b/source4/libcli/wrepl/winsrepl.c
index ba7203c33a..3fb142ea0b 100644
--- a/source4/libcli/wrepl/winsrepl.c
+++ b/source4/libcli/wrepl/winsrepl.c
@@ -27,6 +27,8 @@
 #include "libcli/wrepl/winsrepl.h"
 #include "lib/stream/packet.h"
 #include "libcli/composite/composite.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 static struct wrepl_request *wrepl_request_finished(struct wrepl_request *req, NTSTATUS status);
 
diff --git a/source4/libnet/libnet_join.c b/source4/libnet/libnet_join.c
index 5d1ba294c6..d5d5863f31 100644
--- a/source4/libnet/libnet_join.c
+++ b/source4/libnet/libnet_join.c
@@ -27,6 +27,8 @@
 #include "lib/ldb/include/ldb_errors.h"
 #include "passdb/secrets.h"
 #include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
+#include "libcli/security/proto.h"
 
 /*
  * complete a domain join, when joining to a AD domain:
diff --git a/source4/libnet/libnet_lookup.c b/source4/libnet/libnet_lookup.c
index 89974203f2..968b76763a 100644
--- a/source4/libnet/libnet_lookup.c
+++ b/source4/libnet/libnet_lookup.c
@@ -28,6 +28,7 @@
 #include "libcli/composite/composite.h"
 #include "lib/messaging/messaging.h"
 #include "lib/messaging/irpc.h"
+#include "libcli/resolve/resolve.h"
 
 struct lookup_state {
 	struct composite_context *resolve_ctx;
diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
index fe5239f4b6..3ccba754ea 100644
--- a/source4/libnet/libnet_passwd.c
+++ b/source4/libnet/libnet_passwd.c
@@ -23,6 +23,7 @@
 #include "smb.h"
 #include "libnet/libnet.h"
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/proto.h"
 
 /*
  * do a password change using DCERPC/SAMR calls
diff --git a/source4/libnet/libnet_samsync_ldb.c b/source4/libnet/libnet_samsync_ldb.c
index 4bedbbf119..8cc0cada83 100644
--- a/source4/libnet/libnet_samsync_ldb.c
+++ b/source4/libnet/libnet_samsync_ldb.c
@@ -29,6 +29,8 @@
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
 #include "librpc/gen_ndr/ndr_misc.h"
+#include "db_wrap.h"
+#include "libcli/security/proto.h"
 
 struct samsync_ldb_secret {
 	struct samsync_ldb_secret *prev, *next;
diff --git a/source4/libnet/libnet_vampire.c b/source4/libnet/libnet_vampire.c
index c76f8f7cde..b425926e99 100644
--- a/source4/libnet/libnet_vampire.c
+++ b/source4/libnet/libnet_vampire.c
@@ -24,6 +24,7 @@
 #include "includes.h"
 #include "libnet/libnet.h"
 #include "auth/gensec/schannel_proto.h"
+#include "libcli/auth/proto.h"
 
 
 /**
diff --git a/source4/libnet/userinfo.c b/source4/libnet/userinfo.c
index c55eae4a37..8f473b862b 100644
--- a/source4/libnet/userinfo.c
+++ b/source4/libnet/userinfo.c
@@ -24,6 +24,7 @@
 
 #include "includes.h"
 #include "libcli/composite/composite.h"
+#include "libcli/security/proto.h"
 #include "libnet/composite.h"
 #include "libnet/userinfo.h"
 
diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h
index df70580db3..7f44feb0d9 100644
--- a/source4/librpc/rpc/dcerpc.h
+++ b/source4/librpc/rpc/dcerpc.h
@@ -24,8 +24,6 @@
 #ifndef __DCERPC_H__
 #define __DCERPC_H__
 
-#include <nt_status.h>
-
 enum dcerpc_transport_t {
 	NCACN_NP, NCACN_IP_TCP, NCACN_IP_UDP, NCACN_VNS_IPC, NCACN_VNS_SPP, 
 	NCACN_AT_DSP, NCADG_AT_DDP, NCALRPC, NCACN_UNIX_STREAM, NCADG_UNIX_DGRAM,
diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c
index 64cf6748e8..01b6d099aa 100644
--- a/source4/librpc/rpc/dcerpc_schannel.c
+++ b/source4/librpc/rpc/dcerpc_schannel.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "auth/auth.h"
+#include "libcli/auth/proto.h"
 
 /*
   get a schannel key using a netlogon challenge on a secondary pipe
diff --git a/source4/main.mk b/source4/main.mk
index 1920e047a8..141278ad6b 100644
--- a/source4/main.mk
+++ b/source4/main.mk
@@ -248,7 +248,7 @@ include/includes.h: \
 		libcli/nbt/libnbt.h \
 		lib/util/util_proto.h \
 		lib/charset/charset.h \
-		param/param.h
+		param/param.h \
 
 clean_pch: 
 	-rm -f include/includes.h.gch
diff --git a/source4/nbt_server/config.mk b/source4/nbt_server/config.mk
index 94c3e9efce..36fec2d87c 100644
--- a/source4/nbt_server/config.mk
+++ b/source4/nbt_server/config.mk
@@ -40,6 +40,7 @@ REQUIRED_SUBSYSTEMS = \
 #######################
 # Start SUBSYSTEM NBTD_DGRAM
 [SUBSYSTEM::NBTD_DGRAM]
+PRIVATE_PROTO_HEADER = dgram/proto.h
 OBJ_FILES = \
 		dgram/request.o \
 		dgram/netlogon.o \
diff --git a/source4/nbt_server/dgram/netlogon.c b/source4/nbt_server/dgram/netlogon.c
index 2c8ef5e772..eea36060dd 100644
--- a/source4/nbt_server/dgram/netlogon.c
+++ b/source4/nbt_server/dgram/netlogon.c
@@ -26,6 +26,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
+#include "db_wrap.h"
 
 /*
   reply to a GETDC request
diff --git a/source4/nbt_server/dgram/request.c b/source4/nbt_server/dgram/request.c
index 8dcd53b9b1..f28170c106 100644
--- a/source4/nbt_server/dgram/request.c
+++ b/source4/nbt_server/dgram/request.c
@@ -24,6 +24,8 @@
 #include "nbt_server/nbt_server.h"
 #include "smbd/service_task.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
+#include "nbt_server/dgram/proto.h"
 
 /*
   a list of mailslots that we have static handlers for
diff --git a/source4/nbt_server/interfaces.c b/source4/nbt_server/interfaces.c
index 36a65b1859..e51cd5c6f3 100644
--- a/source4/nbt_server/interfaces.c
+++ b/source4/nbt_server/interfaces.c
@@ -26,6 +26,9 @@
 #include "smbd/service_task.h"
 #include "lib/socket/socket.h"
 #include "nbt_server/wins/winsserver.h"
+#include "nbt_server/dgram/proto.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 
 /*
diff --git a/source4/nbt_server/irpc.c b/source4/nbt_server/irpc.c
index 8b9c4cfcaa..40ea2e5ef3 100644
--- a/source4/nbt_server/irpc.c
+++ b/source4/nbt_server/irpc.c
@@ -26,6 +26,7 @@
 #include "nbt_server/nbt_server.h"
 #include "nbt_server/wins/winsserver.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
 
 /*
   serve out the nbt statistics
diff --git a/source4/nbt_server/nbt_server.c b/source4/nbt_server/nbt_server.c
index ceeb565ffb..0d4940d459 100644
--- a/source4/nbt_server/nbt_server.c
+++ b/source4/nbt_server/nbt_server.c
@@ -24,6 +24,8 @@
 #include "smbd/service_task.h"
 #include "nbt_server/nbt_server.h"
 #include "nbt_server/wins/winsserver.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   startup the nbtd task
diff --git a/source4/nbt_server/wins/wins_dns_proxy.c b/source4/nbt_server/wins/wins_dns_proxy.c
index 540f4e2c38..da8b2195d3 100644
--- a/source4/nbt_server/wins/wins_dns_proxy.c
+++ b/source4/nbt_server/wins/wins_dns_proxy.c
@@ -27,6 +27,7 @@
 #include "system/time.h"
 #include "libcli/composite/composite.h"
 #include "smbd/service_task.h"
+#include "libcli/resolve/resolve.h"
 
 struct wins_dns_proxy_state {
 	struct nbt_name_socket *nbtsock;
diff --git a/source4/nbt_server/wins/wins_ldb.c b/source4/nbt_server/wins/wins_ldb.c
index 5efe6bd3ab..83b8d3f438 100644
--- a/source4/nbt_server/wins/wins_ldb.c
+++ b/source4/nbt_server/wins/wins_ldb.c
@@ -34,6 +34,8 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "lib/ldb/include/ldb_private.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /* add_record: do things with the sambaPassword attribute */
 static int wins_ldb_verify(struct ldb_module *module, struct ldb_request *req, const struct ldb_message *msg)
diff --git a/source4/nbt_server/wins/winsdb.c b/source4/nbt_server/wins/winsdb.c
index 60c2ab0e4f..7e726aedf2 100644
--- a/source4/nbt_server/wins/winsdb.c
+++ b/source4/nbt_server/wins/winsdb.c
@@ -27,6 +27,9 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "system/time.h"
+#include "db_wrap.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 uint64_t winsdb_get_maxVersion(struct winsdb_handle *h)
 {
diff --git a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
index 8135625734..c9b6a700aa 100644
--- a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
+++ b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
@@ -34,6 +34,8 @@
 #include "lib/ldb/include/ldb.h"
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
+#include "rpc_server/common/common.h"
 
 /*
   connect to the SPOOLSS database
diff --git a/source4/ntvfs/common/sidmap.c b/source4/ntvfs/common/sidmap.c
index e96d65e138..70f7dea955 100644
--- a/source4/ntvfs/common/sidmap.c
+++ b/source4/ntvfs/common/sidmap.c
@@ -26,6 +26,8 @@
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
 #include "libcli/ldap/ldap.h"
+#include "db_wrap.h"
+#include "libcli/security/proto.h"
 
 /*
   these are used for the fallback local uid/gid to sid mapping
diff --git a/source4/ntvfs/ipc/rap_server.c b/source4/ntvfs/ipc/rap_server.c
index b68f806ba1..9fa831dd4f 100644
--- a/source4/ntvfs/ipc/rap_server.c
+++ b/source4/ntvfs/ipc/rap_server.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "libcli/rap/rap.h"
 #include "librpc/gen_ndr/ndr_srvsvc.h"
+#include "rpc_server/common/common.h"
 
 /* At this moment these are just dummy functions, but you might get the
  * idea. */
diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index 33756bc8bc..a5cd919ba3 100644
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -24,6 +24,7 @@
 #include "auth/auth.h"
 #include "vfs_posix.h"
 #include "librpc/gen_ndr/ndr_xattr.h"
+#include "libcli/security/proto.h"
 
 
 /*
diff --git a/source4/ntvfs/posix/vfs_posix.c b/source4/ntvfs/posix/vfs_posix.c
index 3b52ff6237..e600be446a 100644
--- a/source4/ntvfs/posix/vfs_posix.c
+++ b/source4/ntvfs/posix/vfs_posix.c
@@ -29,6 +29,8 @@
 #include "librpc/gen_ndr/ndr_security.h"
 #include "smbd/service_stream.h"
 #include "lib/tdb/include/tdb.h"
+#include "db_wrap.h"
+#include "libcli/security/proto.h"
 
 
 /*
diff --git a/source4/rpc_server/common/common.h b/source4/rpc_server/common/common.h
index a43ca74530..d0807d849d 100644
--- a/source4/rpc_server/common/common.h
+++ b/source4/rpc_server/common/common.h
@@ -65,3 +65,5 @@
 
 #define DCESRV_PULL_HANDLE(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, NT_STATUS_INVALID_HANDLE)
 #define DCESRV_PULL_HANDLE_WERR(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, WERR_BADFID)
+
+#include "rpc_server/common/proto.h"
diff --git a/source4/rpc_server/config.mk b/source4/rpc_server/config.mk
index 13b5a4d1f5..ced4701e09 100644
--- a/source4/rpc_server/config.mk
+++ b/source4/rpc_server/config.mk
@@ -3,6 +3,7 @@
 ################################################
 # Start SUBSYSTEM DCERPC_COMMON
 [SUBSYSTEM::DCERPC_COMMON]
+PRIVATE_PROTO_HEADER = common/proto.h
 OBJ_FILES = \
 		common/server_info.o \
 		common/share_info.o
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 74f8dfe8d5..3e92ce0ef3 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -29,6 +29,7 @@
 #include "lib/events/events.h"
 #include "smbd/service_stream.h"
 #include "system/filesys.h"
+#include "libcli/security/proto.h"
 #include "build.h"
 
 /*
diff --git a/source4/rpc_server/dcerpc_sock.c b/source4/rpc_server/dcerpc_sock.c
index 540332299d..d696b75b20 100644
--- a/source4/rpc_server/dcerpc_sock.c
+++ b/source4/rpc_server/dcerpc_sock.c
@@ -28,6 +28,8 @@
 #include "rpc_server/dcerpc_server.h"
 #include "smbd/service_stream.h"
 #include "lib/messaging/irpc.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 struct dcesrv_socket_context {
 	const struct dcesrv_endpoint *endpoint;
diff --git a/source4/rpc_server/dssetup/dcesrv_dssetup.c b/source4/rpc_server/dssetup/dcesrv_dssetup.c
index 61e560299c..9bd8be3223 100644
--- a/source4/rpc_server/dssetup/dcesrv_dssetup.c
+++ b/source4/rpc_server/dssetup/dcesrv_dssetup.c
@@ -27,6 +27,7 @@
 #include "rpc_server/common/common.h"
 #include "ldb/include/ldb.h"
 #include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
 /* 
   dssetup_DsRoleGetPrimaryDomainInformation 
 */
diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c
index b62e1abaef..5af1dc3f40 100644
--- a/source4/rpc_server/lsa/dcesrv_lsa.c
+++ b/source4/rpc_server/lsa/dcesrv_lsa.c
@@ -27,7 +27,10 @@
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/security/proto.h"
+#include "libcli/auth/proto.h"
 #include "ntvfs/ntvfs.h"
+#include "db_wrap.h"
 
 /*
   this type allows us to distinguish handle types
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 1b13548c6b..7696888249 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -28,6 +28,8 @@
 #include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
 #include "rpc_server/samr/proto.h"
+#include "db_wrap.h"
+#include "libcli/auth/proto.h"
 
 struct server_pipe_state {
 	struct netr_Credential client_challenge;
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index e8828a912f..156cf931fe 100644
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -32,7 +32,9 @@
 #include "ads.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/ldap/ldap.h"
+#include "libcli/security/proto.h"
 #include "rpc_server/samr/proto.h"
+#include "db_wrap.h"
 
 
 /*
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index 998005cb0e..00d2f589ae 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -32,6 +32,8 @@
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
 #include "rpc_server/samr/proto.h"
+#include "libcli/auth/proto.h"
+#include "db_wrap.h"
 
 /* 
   samr_ChangePasswordUser 
diff --git a/source4/scripting/ejs/config.mk b/source4/scripting/ejs/config.mk
index c3365388d2..6efa111949 100644
--- a/source4/scripting/ejs/config.mk
+++ b/source4/scripting/ejs/config.mk
@@ -10,6 +10,7 @@ NOPROTO = YES
 #######################
 # Start LIBRARY SMBCALLS
 [SUBSYSTEM::SMBCALLS]
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = \
 		smbcalls.o \
 		smbcalls_config.o \
diff --git a/source4/scripting/ejs/ejsrpc.c b/source4/scripting/ejs/ejsrpc.c
index c84f9eb6fb..3fb2ac0903 100644
--- a/source4/scripting/ejs/ejsrpc.c
+++ b/source4/scripting/ejs/ejsrpc.c
@@ -27,6 +27,7 @@
 #include "librpc/gen_ndr/ndr_lsa.h"
 #include "librpc/gen_ndr/ndr_winreg.h"
 #include "scripting/ejs/ejsrpc.h"
+#include "libcli/security/proto.h"
 
 /*
   set the switch var to be used by the next union switch
diff --git a/source4/scripting/ejs/mprutil.c b/source4/scripting/ejs/mprutil.c
index d8c44c2450..419cb4869e 100644
--- a/source4/scripting/ejs/mprutil.c
+++ b/source4/scripting/ejs/mprutil.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "lib/appweb/ejs/ejs.h"
 #include "lib/ldb/include/ldb.h"
+#include "scripting/ejs/smbcalls.h"
 
 /*
   return a default mpr object
diff --git a/source4/scripting/ejs/smbcalls.h b/source4/scripting/ejs/smbcalls.h
index 927c3ccf2f..f47d27643d 100644
--- a/source4/scripting/ejs/smbcalls.h
+++ b/source4/scripting/ejs/smbcalls.h
@@ -28,3 +28,5 @@ NTSTATUS mprGetVar(struct MprVar **v, const char *name);
 void mprAddArray(struct MprVar *var, int i, struct MprVar v);
 void mprSetCFunction(struct MprVar *obj, const char *name, MprCFunction fn);
 void mprSetStringCFunction(struct MprVar *obj, const char *name, MprStringCFunction fn);
+
+#include "scripting/ejs/proto.h"
diff --git a/source4/scripting/ejs/smbcalls_config.c b/source4/scripting/ejs/smbcalls_config.c
index b0b1420ba2..949dd0321a 100644
--- a/source4/scripting/ejs/smbcalls_config.c
+++ b/source4/scripting/ejs/smbcalls_config.c
@@ -24,6 +24,8 @@
 #include "scripting/ejs/smbcalls.h"
 #include "lib/appweb/ejs/ejs.h"
 #include "param/loadparm.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   return a list of defined services
diff --git a/source4/scripting/ejs/smbcalls_ldb.c b/source4/scripting/ejs/smbcalls_ldb.c
index 1a224605ee..9ba7668a38 100644
--- a/source4/scripting/ejs/smbcalls_ldb.c
+++ b/source4/scripting/ejs/smbcalls_ldb.c
@@ -27,6 +27,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "lib/ldb/include/ldb_errors.h"
 #include "lib/cmdline/popt_common.h"
+#include "db_wrap.h"
 
 /*
   get the connected db
diff --git a/source4/scripting/ejs/smbcalls_nbt.c b/source4/scripting/ejs/smbcalls_nbt.c
index f72b4b46ac..dcefd56a0c 100644
--- a/source4/scripting/ejs/smbcalls_nbt.c
+++ b/source4/scripting/ejs/smbcalls_nbt.c
@@ -25,6 +25,7 @@
 #include "lib/appweb/ejs/ejs.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
 #include "lib/events/events.h"
+#include "libcli/resolve/resolve.h"
 
 /*
   look up a netbios name
diff --git a/source4/scripting/ejs/smbcalls_sys.c b/source4/scripting/ejs/smbcalls_sys.c
index 1a876c9e87..b8382db296 100644
--- a/source4/scripting/ejs/smbcalls_sys.c
+++ b/source4/scripting/ejs/smbcalls_sys.c
@@ -25,6 +25,8 @@
 #include "lib/appweb/ejs/ejs.h"
 #include "lib/ldb/include/ldb.h"
 #include "system/time.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /*
   return the list of configured network interfaces
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index 6e517cd386..469f937219 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -26,6 +26,8 @@
 #include "lib/stream/packet.h"
 #include "libcli/smb2/smb2.h"
 #include "smb_server/smb2/smb2_server.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 static NTSTATUS smbsrv_recv_generic_request(void *private, DATA_BLOB blob)
 {
diff --git a/source4/smbd/process_model.h b/source4/smbd/process_model.h
index 2575adeccb..4080d2d4b6 100644
--- a/source4/smbd/process_model.h
+++ b/source4/smbd/process_model.h
@@ -61,3 +61,5 @@ struct process_model_critical_sizes {
 	int interface_version;
 	int sizeof_model_ops;
 };
+
+#include "smbd/process_model_proto.h"
diff --git a/source4/smbd/process_model.mk b/source4/smbd/process_model.mk
index b8f960215a..22083a7a87 100644
--- a/source4/smbd/process_model.mk
+++ b/source4/smbd/process_model.mk
@@ -34,6 +34,7 @@ REQUIRED_SUBSYSTEMS = EXT_LIB_PTHREAD
 ################################################
 # Start SUBSYSTEM PROCESS_MODEL
 [SUBSYSTEM::PROCESS_MODEL]
+PRIVATE_PROTO_HEADER = process_model_proto.h
 OBJ_FILES = \
 		process_model.o
 #
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index 1daf346a2d..9c45da302d 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -34,6 +34,7 @@
 #include "ntvfs/ntvfs.h"
 #include "ntptr/ntptr.h"
 #include "auth/gensec/gensec.h"
+#include "smbd/process_model.h"
 
 /*
   recursively delete a directory tree
diff --git a/source4/smbd/service.c b/source4/smbd/service.c
index 2057fc811a..5bced4eae4 100644
--- a/source4/smbd/service.c
+++ b/source4/smbd/service.c
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "dlinklist.h"
+#include "smbd/process_model.h"
 
 /*
   a linked list of registered servers
diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index 2554295af9..2e180bfa29 100644
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -27,6 +27,7 @@
 #include "auth/kerberos/kerberos.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "samba3/samba3.h"
+#include "libcli/security/proto.h"
 
 static BOOL torture_pac_self_check(void) 
 {
diff --git a/source4/torture/ldap/cldapbench.c b/source4/torture/ldap/cldapbench.c
index 806bf9b558..8d541325e8 100644
--- a/source4/torture/ldap/cldapbench.c
+++ b/source4/torture/ldap/cldapbench.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "lib/events/events.h"
 #include "libcli/cldap/cldap.h"
+#include "libcli/resolve/resolve.h"
 
 struct bench_state {
 	int pass_count, fail_count;
diff --git a/source4/torture/libnet/userinfo.c b/source4/torture/libnet/userinfo.c
index 744059760e..589b2ee288 100644
--- a/source4/torture/libnet/userinfo.c
+++ b/source4/torture/libnet/userinfo.c
@@ -23,6 +23,7 @@
 #include "torture/torture.h"
 #include "libnet/libnet.h"
 #include "libnet/userinfo.h"
+#include "libcli/security/proto.h"
 
 #define TEST_USERNAME  "libnetuserinfotest"
 
diff --git a/source4/torture/local/resolve.c b/source4/torture/local/resolve.c
index f86b4b726b..a52bfeeb48 100644
--- a/source4/torture/local/resolve.c
+++ b/source4/torture/local/resolve.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "lib/events/events.h"
+#include "libcli/resolve/resolve.h"
 
 static BOOL test_async_resolve(TALLOC_CTX *mem_ctx)
 {
diff --git a/source4/torture/local/sddl.c b/source4/torture/local/sddl.c
index 30ce424741..8d940093d1 100644
--- a/source4/torture/local/sddl.c
+++ b/source4/torture/local/sddl.c
@@ -21,6 +21,7 @@
 */
 
 #include "includes.h"
+#include "libcli/security/proto.h"
 
 
 /*
diff --git a/source4/torture/local/socket.c b/source4/torture/local/socket.c
index 195354611f..66268f4f80 100644
--- a/source4/torture/local/socket.c
+++ b/source4/torture/local/socket.c
@@ -23,6 +23,8 @@
 #include "includes.h"
 #include "lib/socket/socket.h"
 #include "lib/events/events.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 #define CHECK_STATUS(status, correct) do { \
 	if (!NT_STATUS_EQUAL(status, correct)) { \
diff --git a/source4/torture/nbt/browse.c b/source4/torture/nbt/browse.c
index a231809ef0..1b2b698a23 100644
--- a/source4/torture/nbt/browse.c
+++ b/source4/torture/nbt/browse.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
+#include "libcli/resolve/resolve.h"
 
 /*
   test nbt dgram operations
diff --git a/source4/torture/nbt/dgram.c b/source4/torture/nbt/dgram.c
index db074ebeba..7e0058cd9f 100644
--- a/source4/torture/nbt/dgram.c
+++ b/source4/torture/nbt/dgram.c
@@ -26,6 +26,9 @@
 #include "lib/socket/socket.h"
 #include "lib/events/events.h"
 #include "torture/rpc/proto.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 #define TEST_NAME "TORTURE_TEST"
 
diff --git a/source4/torture/nbt/query.c b/source4/torture/nbt/query.c
index fbb4224b28..e9c302d89c 100644
--- a/source4/torture/nbt/query.c
+++ b/source4/torture/nbt/query.c
@@ -22,6 +22,7 @@
 
 #include "includes.h"
 #include "lib/events/events.h"
+#include "libcli/resolve/resolve.h"
 
 struct result_struct {
 	int num_pass;
diff --git a/source4/torture/nbt/register.c b/source4/torture/nbt/register.c
index cd7d3c7624..9b928fefcf 100644
--- a/source4/torture/nbt/register.c
+++ b/source4/torture/nbt/register.c
@@ -22,6 +22,9 @@
 
 #include "includes.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 #define CHECK_VALUE(v, correct) do { \
 	if ((v) != (correct)) { \
diff --git a/source4/torture/nbt/wins.c b/source4/torture/nbt/wins.c
index bcb52dc9b8..fe2ffeb36e 100644
--- a/source4/torture/nbt/wins.c
+++ b/source4/torture/nbt/wins.c
@@ -22,6 +22,9 @@
 
 #include "includes.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 #define CHECK_VALUE(v, correct) do { \
 	if ((v) != (correct)) { \
diff --git a/source4/torture/nbt/winsbench.c b/source4/torture/nbt/winsbench.c
index 5aa97f9ade..e629b842e7 100644
--- a/source4/torture/nbt/winsbench.c
+++ b/source4/torture/nbt/winsbench.c
@@ -23,6 +23,9 @@
 #include "includes.h"
 #include "lib/events/events.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 struct wins_state {
 	int num_names;
diff --git a/source4/torture/nbt/winsreplication.c b/source4/torture/nbt/winsreplication.c
index b53c55ca08..25056f7b9c 100644
--- a/source4/torture/nbt/winsreplication.c
+++ b/source4/torture/nbt/winsreplication.c
@@ -25,6 +25,9 @@
 #include "libcli/wrepl/winsrepl.h"
 #include "lib/events/events.h"
 #include "lib/socket/socket.h"
+#include "libcli/resolve/resolve.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 #define CHECK_STATUS(status, correct) do { \
 	if (!NT_STATUS_EQUAL(status, correct)) { \
diff --git a/source4/torture/raw/acls.c b/source4/torture/raw/acls.c
index 6450acab18..470477165f 100644
--- a/source4/torture/raw/acls.c
+++ b/source4/torture/raw/acls.c
@@ -24,6 +24,7 @@
 #include "torture/torture.h"
 #include "libcli/raw/libcliraw.h"
 #include "libcli/libcli.h"
+#include "libcli/security/proto.h"
 
 #define BASEDIR "\\testsd"
 
diff --git a/source4/torture/raw/composite.c b/source4/torture/raw/composite.c
index 6025c3d1e4..97c47acc7e 100644
--- a/source4/torture/raw/composite.c
+++ b/source4/torture/raw/composite.c
@@ -25,6 +25,7 @@
 #include "lib/events/events.h"
 #include "libcli/raw/libcliraw.h"
 #include "libcli/libcli.h"
+#include "libcli/security/proto.h"
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "lib/cmdline/popt_common.h"
diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 5d7ddc6c80..9b62faee8e 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -24,6 +24,8 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/ndr_lsa.h"
 #include "lib/events/events.h"
+#include "libcli/security/proto.h"
+#include "libcli/auth/proto.h"
 
 static void init_lsa_String(struct lsa_String *name, const char *s)
 {
diff --git a/source4/torture/rpc/lsa_lookup.c b/source4/torture/rpc/lsa_lookup.c
index 4bfe33baa1..aa36c63f29 100644
--- a/source4/torture/rpc/lsa_lookup.c
+++ b/source4/torture/rpc/lsa_lookup.c
@@ -23,6 +23,7 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/ndr_lsa.h"
 #include "lib/events/events.h"
+#include "libcli/security/proto.h"
 
 static BOOL open_policy(TALLOC_CTX *mem_ctx, struct dcerpc_pipe *p,
 			struct policy_handle **handle)
diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
index 79e85cce57..e786dd3898 100644
--- a/source4/torture/rpc/netlogon.c
+++ b/source4/torture/rpc/netlogon.c
@@ -29,6 +29,7 @@
 #include "smb.h"
 #include "lib/cmdline/popt_common.h"
 #include "torture/rpc/proto.h"
+#include "libcli/auth/proto.h"
 
 static const char *machine_password;
 
diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index 185a2a6870..9965e5ddbd 100644
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -29,6 +29,7 @@
 #include "lib/cmdline/popt_common.h"
 #include "torture/rpc/proto.h"
 #include "auth/gensec/schannel_proto.h"
+#include "libcli/auth/proto.h"
 
 #define TEST_MACHINE_NAME "samlogontest"
 #define TEST_USER_NAME "samlogontestuser"
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 3950942b54..6d1b507c2b 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -26,6 +26,8 @@
 #include "librpc/gen_ndr/ndr_samr.h"
 #include "smb.h"
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/proto.h"
+#include "libcli/security/proto.h"
 
 #define TEST_ACCOUNT_NAME "samrtorturetest"
 #define TEST_ALIASNAME "samrtorturetestalias"
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 68a5a4a2b6..6155b7ac1e 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -30,6 +30,8 @@
 #include "system/time.h"
 #include "torture/rpc/proto.h"
 #include "auth/gensec/schannel_proto.h"
+#include "libcli/auth/proto.h"
+#include "libcli/security/proto.h"
 
 #define TEST_MACHINE_NAME "samsynctest"
 #define TEST_WKSTA_MACHINE_NAME "samsynctest2"
diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index ee16d2de75..b5ff8bbfac 100644
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -25,6 +25,8 @@
 #include "torture/rpc/proto.h"
 #include "lib/cmdline/popt_common.h"
 #include "auth/gensec/schannel_proto.h"
+#include "libcli/auth/proto.h"
+#include "libcli/security/proto.h"
 
 #define TEST_MACHINE_NAME "schannel"
 
diff --git a/source4/torture/rpc/session_key.c b/source4/torture/rpc/session_key.c
index 26626c908e..b5f8889ded 100644
--- a/source4/torture/rpc/session_key.c
+++ b/source4/torture/rpc/session_key.c
@@ -25,6 +25,7 @@
 #include "librpc/gen_ndr/ndr_lsa.h"
 
 #include "torture/rpc/proto.h"
+#include "libcli/auth/proto.h"
 
 static void init_lsa_String(struct lsa_String *name, const char *s)
 {
diff --git a/source4/torture/rpc/testjoin.c b/source4/torture/rpc/testjoin.c
index 7a02ba24ca..9f39224b68 100644
--- a/source4/torture/rpc/testjoin.c
+++ b/source4/torture/rpc/testjoin.c
@@ -35,6 +35,8 @@
 #include "lib/ldb/include/ldb.h"
 
 #include "torture/rpc/proto.h"
+#include "libcli/security/proto.h"
+#include "libcli/auth/proto.h"
 
 struct test_join {
 	struct dcerpc_pipe *p;
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 2710215e60..293cba0ee1 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "librpc/gen_ndr/ndr_winreg.h"
+#include "libcli/security/proto.h"
 
 #define TEST_KEY_BASE "smbtorture test"
 #define TEST_KEY1 TEST_KEY_BASE "\\spottyfoot"
diff --git a/source4/torture/torture.c b/source4/torture/torture.c
index 067af257fa..2ce51407be 100644
--- a/source4/torture/torture.c
+++ b/source4/torture/torture.c
@@ -29,6 +29,7 @@
 #include "lib/ldb/include/ldb.h"
 #include "librpc/rpc/dcerpc_table.h"
 #include "lib/events/events.h"
+#include "libcli/resolve/resolve.h"
 
 #include "torture/basic/proto.h"
 #include "torture/raw/proto.h"
diff --git a/source4/utils/nmblookup.c b/source4/utils/nmblookup.c
index f7ec40d137..938fb02966 100644
--- a/source4/utils/nmblookup.c
+++ b/source4/utils/nmblookup.c
@@ -26,6 +26,8 @@
 #include "lib/cmdline/popt_common.h"
 #include "system/iconv.h"
 #include "lib/socket/socket.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 /* command line options */
 static struct {
diff --git a/source4/utils/ntlm_auth.c b/source4/utils/ntlm_auth.c
index d6b65d75d7..be5739eade 100644
--- a/source4/utils/ntlm_auth.c
+++ b/source4/utils/ntlm_auth.c
@@ -27,6 +27,7 @@
 #include "lib/cmdline/popt_common.h"
 #include "auth/auth.h"
 #include "pstring.h"
+#include "libcli/auth/proto.h"
 
 #define SQUID_BUFFER_SIZE 2010
 
diff --git a/source4/web_server/http.c b/source4/web_server/http.c
index b2b75c8148..c90780a249 100644
--- a/source4/web_server/http.c
+++ b/source4/web_server/http.c
@@ -30,6 +30,7 @@
 #include "lib/appweb/ejs/ejsInternal.h"
 #include "dlinklist.h"
 #include "lib/tls/tls.h"
+#include "scripting/ejs/smbcalls.h"
 
 #define SWAT_SESSION_KEY "SwatSessionId"
 #define HTTP_PREAUTH_URI "/scripting/preauth.esp"
diff --git a/source4/web_server/web_server.c b/source4/web_server/web_server.c
index 57bb5c62b1..e1d418a682 100644
--- a/source4/web_server/web_server.c
+++ b/source4/web_server/web_server.c
@@ -26,6 +26,8 @@
 #include "web_server/web_server.h"
 #include "lib/events/events.h"
 #include "system/filesys.h"
+#include "system/network.h"
+#include "netif/netif.h"
 #include "lib/tls/tls.h"
 
 /* don't allow connections to hang around forever */
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk
index 1a91f7bee5..342007377d 100644
--- a/source4/winbind/config.mk
+++ b/source4/winbind/config.mk
@@ -28,6 +28,7 @@ REQUIRED_SUBSYSTEMS = WB_HELPER RPC_NDR_LSA RPC_NDR_SAMR
 ################################################
 # Start SUBYSTEM WB_HELPER
 [SUBSYSTEM::WB_HELPER]
+PRIVATE_PROTO_HEADER = wb_helper.h
 OBJ_FILES = \
 		wb_async_helpers.o
 REQUIRED_SUBSYSTEMS = RPC_NDR_LSA RPC_NDR_SAMR
diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c
index f4de7d4284..fbffebc092 100644
--- a/source4/winbind/wb_async_helpers.c
+++ b/source4/winbind/wb_async_helpers.c
@@ -28,6 +28,10 @@
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
 #include "libcli/auth/credentials.h"
+#include "libcli/security/proto.h"
+#include "libcli/auth/proto.h"
+
+#include "winbind/wb_helper.h"
 
 struct get_schannel_creds_state {
 	struct cli_credentials *wks_creds;
diff --git a/source4/winbind/wb_cmd_lookupname.c b/source4/winbind/wb_cmd_lookupname.c
index 3d894c0064..51d5c5a8d8 100644
--- a/source4/winbind/wb_cmd_lookupname.c
+++ b/source4/winbind/wb_cmd_lookupname.c
@@ -23,6 +23,8 @@
 #include "includes.h"
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
+#include "winbind/wb_async_helpers.h"
+#include "winbind/wb_helper.h"
 #include "smbd/service_task.h"
 
 struct cmd_lookupname_state {
diff --git a/source4/winbind/wb_cmd_lookupsid.c b/source4/winbind/wb_cmd_lookupsid.c
index 4733702583..fbc01d60b8 100644
--- a/source4/winbind/wb_cmd_lookupsid.c
+++ b/source4/winbind/wb_cmd_lookupsid.c
@@ -23,7 +23,9 @@
 #include "includes.h"
 #include "libcli/composite/composite.h"
 #include "winbind/wb_server.h"
+#include "winbind/wb_helper.h"
 #include "smbd/service_task.h"
+#include "libcli/security/proto.h"
 
 struct cmd_lookupsid_state {
 	struct composite_context *ctx;
diff --git a/source4/winbind/wb_cmd_userdomgroups.c b/source4/winbind/wb_cmd_userdomgroups.c
index a0ac939a1e..b118f9c9c5 100644
--- a/source4/winbind/wb_cmd_userdomgroups.c
+++ b/source4/winbind/wb_cmd_userdomgroups.c
@@ -22,7 +22,9 @@
 
 #include "includes.h"
 #include "libcli/composite/composite.h"
+#include "libcli/security/proto.h"
 #include "winbind/wb_server.h"
+#include "winbind/wb_helper.h"
 #include "smbd/service_task.h"
 
 struct cmd_userdomgroups_state {
diff --git a/source4/winbind/wb_cmd_usersids.c b/source4/winbind/wb_cmd_usersids.c
index 4c107824fb..4e2195d883 100644
--- a/source4/winbind/wb_cmd_usersids.c
+++ b/source4/winbind/wb_cmd_usersids.c
@@ -25,6 +25,7 @@
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
 #include "librpc/gen_ndr/ndr_samr.h"
+#include "libcli/security/proto.h"
 
 /* Calculate the token in two steps: Go the user's originating domain, ask for
  * the user's domain groups. Then with the resulting list of sids go to our
diff --git a/source4/winbind/wb_connect_sam.c b/source4/winbind/wb_connect_sam.c
index 1817785508..2c26ffe29a 100644
--- a/source4/winbind/wb_connect_sam.c
+++ b/source4/winbind/wb_connect_sam.c
@@ -25,6 +25,7 @@
 #include "libcli/composite/composite.h"
 
 #include "libcli/raw/libcliraw.h"
+#include "libcli/security/proto.h"
 #include "librpc/gen_ndr/ndr_samr.h"
 
 
diff --git a/source4/winbind/wb_dom_info.c b/source4/winbind/wb_dom_info.c
index 1b32788338..185457bcbf 100644
--- a/source4/winbind/wb_dom_info.c
+++ b/source4/winbind/wb_dom_info.c
@@ -23,6 +23,8 @@
 
 #include "includes.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
+#include "libcli/security/proto.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
diff --git a/source4/winbind/wb_dom_info_trusted.c b/source4/winbind/wb_dom_info_trusted.c
index 7c2ff0232c..652d646d86 100644
--- a/source4/winbind/wb_dom_info_trusted.c
+++ b/source4/winbind/wb_dom_info_trusted.c
@@ -22,6 +22,8 @@
 
 #include "includes.h"
 #include "libcli/composite/composite.h"
+#include "libcli/resolve/resolve.h"
+#include "libcli/security/proto.h"
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
diff --git a/source4/winbind/wb_init_domain.c b/source4/winbind/wb_init_domain.c
index b10b5458ba..4045ddc244 100644
--- a/source4/winbind/wb_init_domain.c
+++ b/source4/winbind/wb_init_domain.c
@@ -24,9 +24,12 @@
 #include "libcli/composite/composite.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "winbind/wb_server.h"
+#include "winbind/wb_async_helpers.h"
+#include "winbind/wb_helper.h"
 #include "smbd/service_task.h"
 
 #include "libcli/auth/credentials.h"
+#include "libcli/security/proto.h"
 
 #include "libcli/ldap/ldap_client.h"
 
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index f85cfd1f1a..b57f918669 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -26,6 +26,7 @@
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
 #include "libcli/auth/credentials.h"
+#include "libcli/auth/proto.h"
 
 /* Oh, there is so much to keep an eye on when authenticating a user.  Oh my! */
 struct pam_auth_crap_state {
diff --git a/source4/winbind/wb_samba3_cmd.c b/source4/winbind/wb_samba3_cmd.c
index fd36dde16d..39cee9baba 100644
--- a/source4/winbind/wb_samba3_cmd.c
+++ b/source4/winbind/wb_samba3_cmd.c
@@ -28,6 +28,7 @@
 #include "libcli/composite/composite.h"
 #include "version.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
+#include "libcli/security/proto.h"
 
 /* 
    Send off the reply to an async Samba3 query, handling filling in the PAM, NTSTATUS and string errors.
diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c
index 9c04558583..45684be0f4 100644
--- a/source4/winbind/wb_server.c
+++ b/source4/winbind/wb_server.c
@@ -25,6 +25,7 @@
 #include "dlinklist.h"
 #include "lib/events/events.h"
 #include "smbd/service_task.h"
+#include "smbd/process_model.h"
 #include "smbd/service_stream.h"
 #include "nsswitch/winbind_nss_config.h"
 #include "winbind/wb_server.h"
diff --git a/source4/winbind/wb_sid2domain.c b/source4/winbind/wb_sid2domain.c
index 837e491722..793445e73b 100644
--- a/source4/winbind/wb_sid2domain.c
+++ b/source4/winbind/wb_sid2domain.c
@@ -25,6 +25,7 @@
 #include "winbind/wb_server.h"
 #include "smbd/service_task.h"
 #include "winbind/wb_async_helpers.h"
+#include "libcli/security/proto.h"
 #include "include/dlinklist.h"
 
 static struct wbsrv_domain *find_domain_from_sid(struct wbsrv_service *service,
diff --git a/source4/wrepl_server/wrepl_in_connection.c b/source4/wrepl_server/wrepl_in_connection.c
index 80e443ace7..6e6d2db320 100644
--- a/source4/wrepl_server/wrepl_in_connection.c
+++ b/source4/wrepl_server/wrepl_in_connection.c
@@ -28,6 +28,9 @@
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/ndr_winsrepl.h"
 #include "wrepl_server/wrepl_server.h"
+#include "smbd/process_model.h"
+#include "system/network.h"
+#include "netif/netif.h"
 
 void wreplsrv_terminate_in_connection(struct wreplsrv_in_connection *wreplconn, const char *reason)
 {
diff --git a/source4/wrepl_server/wrepl_server.c b/source4/wrepl_server/wrepl_server.c
index a4dc6e2c74..29d3246d62 100644
--- a/source4/wrepl_server/wrepl_server.c
+++ b/source4/wrepl_server/wrepl_server.c
@@ -30,6 +30,7 @@
 #include "ldb/include/ldb.h"
 #include "ldb/include/ldb_errors.h"
 #include "auth/auth.h"
+#include "db_wrap.h"
 
 static struct ldb_context *wins_config_db_connect(TALLOC_CTX *mem_ctx)
 {