Merge branch 'master' of ssh://git.samba.org/data/git/samba

26 files changed, 188 insertions, 74 deletions

diff --git a/lib/util/fault.m4 b/lib/util/fault.m4
index bac553a158..c22976998e 100644
--- a/lib/util/fault.m4
+++ b/lib/util/fault.m4
@@ -9,6 +9,8 @@ if test x"$ac_cv_header_execinfo_h" = x"yes" -a x"$ac_cv_func_ext_backtrace" = x
 	EXECINFO_CPPFLAGS="$CPPFLAGS"
 	EXECINFO_LDFLAGS="$LDFLAGS"
 	LIB_REMOVE_USR_LIB(EXECINFO_LDFLAGS)
+	CFLAGS_REMOVE_USR_INCLUDE(EXECINFO_CFLAGS)
+	CFLAGS_REMOVE_USR_INCLUDE(EXECINFO_CPPFLAGS)
 else
 	SMB_ENABLE(EXECINFO,NO)
 fi
diff --git a/libcli/security/config.mk b/libcli/security/config.mk
index 56d8e138ff..7ade01510c 100644
--- a/libcli/security/config.mk
+++ b/libcli/security/config.mk
@@ -2,4 +2,4 @@
 PRIVATE_DEPENDENCIES = TALLOC
 
 LIBSECURITY_COMMON_OBJ_FILES = $(addprefix $(libclicommonsrcdir)/security/, \
-					dom_sid.o)
+					dom_sid.o display_sec.o secace.o secacl.o)
diff --git a/source3/lib/display_sec.c b/libcli/security/display_sec.c
index fe1ae77edd..bec657da86 100644
--- a/source3/lib/display_sec.c
+++ b/libcli/security/display_sec.c
@@ -19,12 +19,16 @@
 */
 
 #include "includes.h"
+#include "librpc/gen_ndr/security.h"
+#include "libcli/security/secace.h"
+#include "libcli/security/dom_sid.h"
+#include "librpc/ndr/libndr.h"
 
 /****************************************************************************
 convert a security permissions into a string
 ****************************************************************************/
 
-char *get_sec_mask_str(TALLOC_CTX *ctx, uint32 type)
+char *get_sec_mask_str(TALLOC_CTX *ctx, uint32_t type)
 {
 	char *typestr = talloc_strdup(ctx, "");
 
@@ -32,77 +36,77 @@ char *get_sec_mask_str(TALLOC_CTX *ctx, uint32 type)
 		return NULL;
 	}
 
-	if (type & GENERIC_ALL_ACCESS) {
+	if (type & SEC_GENERIC_ALL) {
 		typestr = talloc_asprintf_append(typestr,
 				"Generic all access ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & GENERIC_EXECUTE_ACCESS) {
+	if (type & SEC_GENERIC_EXECUTE) {
 		typestr = talloc_asprintf_append(typestr,
 				"Generic execute access");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & GENERIC_WRITE_ACCESS) {
+	if (type & SEC_GENERIC_WRITE) {
 		typestr = talloc_asprintf_append(typestr,
 				"Generic write access ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & GENERIC_READ_ACCESS) {
+	if (type & SEC_GENERIC_READ) {
 		typestr = talloc_asprintf_append(typestr,
 				"Generic read access ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & MAXIMUM_ALLOWED_ACCESS) {
+	if (type & SEC_FLAG_MAXIMUM_ALLOWED) {
 		typestr = talloc_asprintf_append(typestr,
 				"MAXIMUM_ALLOWED_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & SYSTEM_SECURITY_ACCESS) {
+	if (type & SEC_FLAG_SYSTEM_SECURITY) {
 		typestr = talloc_asprintf_append(typestr,
 				"SYSTEM_SECURITY_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & SYNCHRONIZE_ACCESS) {
+	if (type & SEC_STD_SYNCHRONIZE) {
 		typestr = talloc_asprintf_append(typestr,
 				"SYNCHRONIZE_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & WRITE_OWNER_ACCESS) {
+	if (type & SEC_STD_WRITE_OWNER) {
 		typestr = talloc_asprintf_append(typestr,
 				"WRITE_OWNER_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & WRITE_DAC_ACCESS) {
+	if (type & SEC_STD_WRITE_DAC) {
 		typestr = talloc_asprintf_append(typestr,
 				"WRITE_DAC_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & READ_CONTROL_ACCESS) {
+	if (type & SEC_STD_READ_CONTROL) {
 		typestr = talloc_asprintf_append(typestr,
 				"READ_CONTROL_ACCESS ");
 		if (!typestr) {
 			return NULL;
 		}
 	}
-	if (type & DELETE_ACCESS) {
+	if (type & SEC_STD_DELETE) {
 		typestr = talloc_asprintf_append(typestr,
 				"DELETE_ACCESS ");
 		if (!typestr) {
@@ -110,7 +114,7 @@ char *get_sec_mask_str(TALLOC_CTX *ctx, uint32 type)
 		}
 	}
 
-	printf("\t\tSpecific bits: 0x%lx\n", (unsigned long)type&SPECIFIC_RIGHTS_MASK);
+	printf("\t\tSpecific bits: 0x%lx\n", (unsigned long)type&SEC_MASK_SPECIFIC);
 
 	return typestr;
 }
@@ -122,7 +126,7 @@ void display_sec_access(uint32_t *info)
 {
 	char *mask_str = get_sec_mask_str(NULL, *info);
 	printf("\t\tPermissions: 0x%x: %s\n", *info, mask_str ? mask_str : "");
-	TALLOC_FREE(mask_str);
+	talloc_free(mask_str);
 }
 
 /****************************************************************************
@@ -170,9 +174,9 @@ static void disp_sec_ace_object(struct security_ace_object *object)
 /****************************************************************************
  display sec_ace structure
  ****************************************************************************/
-void display_sec_ace(SEC_ACE *ace)
+void display_sec_ace(struct security_ace *ace)
 {
-	fstring sid_str;
+	char *sid_str;
 
 	printf("\tACE\n\t\ttype: ");
 	switch (ace->type) {
@@ -211,8 +215,9 @@ void display_sec_ace(SEC_ACE *ace)
 	printf(" (%d) flags: 0x%02x ", ace->type, ace->flags);
 	display_sec_ace_flags(ace->flags);
 	display_sec_access(&ace->access_mask);
-	sid_to_fstring(sid_str, &ace->trustee);
+	sid_str = dom_sid_string(NULL, &ace->trustee);
 	printf("\t\tSID: %s\n\n", sid_str);
+	talloc_free(sid_str);
 
 	if (sec_ace_object(ace->type)) {
 		disp_sec_ace_object(&ace->object.object);
@@ -223,7 +228,7 @@ void display_sec_ace(SEC_ACE *ace)
 /****************************************************************************
  display sec_acl structure
  ****************************************************************************/
-void display_sec_acl(SEC_ACL *sec_acl)
+void display_sec_acl(struct security_acl *sec_acl)
 {
 	int i;
 
@@ -238,54 +243,52 @@ void display_sec_acl(SEC_ACL *sec_acl)
 	}
 }
 
-void display_acl_type(uint16 type)
+void display_acl_type(uint16_t type)
 {
-	fstring typestr="";
-
-	typestr[0] = 0;
+	printf("type: 0x%04x: ", type);
 
 	if (type & SEC_DESC_OWNER_DEFAULTED)	/* 0x0001 */
-		fstrcat(typestr, "SEC_DESC_OWNER_DEFAULTED ");
+		printf("SEC_DESC_OWNER_DEFAULTED ");
 	if (type & SEC_DESC_GROUP_DEFAULTED)	/* 0x0002 */
-		fstrcat(typestr, "SEC_DESC_GROUP_DEFAULTED ");
+		printf("SEC_DESC_GROUP_DEFAULTED ");
 	if (type & SEC_DESC_DACL_PRESENT) 	/* 0x0004 */
-		fstrcat(typestr, "SEC_DESC_DACL_PRESENT ");
+		printf("SEC_DESC_DACL_PRESENT ");
 	if (type & SEC_DESC_DACL_DEFAULTED)	/* 0x0008 */
-		fstrcat(typestr, "SEC_DESC_DACL_DEFAULTED ");
+		printf("SEC_DESC_DACL_DEFAULTED ");
 	if (type & SEC_DESC_SACL_PRESENT)	/* 0x0010 */
-		fstrcat(typestr, "SEC_DESC_SACL_PRESENT ");
+		printf("SEC_DESC_SACL_PRESENT ");
 	if (type & SEC_DESC_SACL_DEFAULTED)	/* 0x0020 */
-		fstrcat(typestr, "SEC_DESC_SACL_DEFAULTED ");
+		printf("SEC_DESC_SACL_DEFAULTED ");
 	if (type & SEC_DESC_DACL_TRUSTED)	/* 0x0040 */
-		fstrcat(typestr, "SEC_DESC_DACL_TRUSTED ");
+		printf("SEC_DESC_DACL_TRUSTED ");
 	if (type & SEC_DESC_SERVER_SECURITY)	/* 0x0080 */
-		fstrcat(typestr, "SEC_DESC_SERVER_SECURITY ");
+		printf("SEC_DESC_SERVER_SECURITY ");
 	if (type & SEC_DESC_DACL_AUTO_INHERIT_REQ) /* 0x0100 */
-		fstrcat(typestr, "SEC_DESC_DACL_AUTO_INHERIT_REQ ");
+		printf("SEC_DESC_DACL_AUTO_INHERIT_REQ ");
 	if (type & SEC_DESC_SACL_AUTO_INHERIT_REQ) /* 0x0200 */
-		fstrcat(typestr, "SEC_DESC_SACL_AUTO_INHERIT_REQ ");
+		printf("SEC_DESC_SACL_AUTO_INHERIT_REQ ");
 	if (type & SEC_DESC_DACL_AUTO_INHERITED) /* 0x0400 */
-		fstrcat(typestr, "SEC_DESC_DACL_AUTO_INHERITED ");
+		printf("SEC_DESC_DACL_AUTO_INHERITED ");
 	if (type & SEC_DESC_SACL_AUTO_INHERITED) /* 0x0800 */
-		fstrcat(typestr, "SEC_DESC_SACL_AUTO_INHERITED ");
+		printf("SEC_DESC_SACL_AUTO_INHERITED ");
 	if (type & SEC_DESC_DACL_PROTECTED)	/* 0x1000 */
-		fstrcat(typestr, "SEC_DESC_DACL_PROTECTED ");
+		printf("SEC_DESC_DACL_PROTECTED ");
 	if (type & SEC_DESC_SACL_PROTECTED)	/* 0x2000 */
-		fstrcat(typestr, "SEC_DESC_SACL_PROTECTED ");
+		printf("SEC_DESC_SACL_PROTECTED ");
 	if (type & SEC_DESC_RM_CONTROL_VALID)	/* 0x4000 */
-		fstrcat(typestr, "SEC_DESC_RM_CONTROL_VALID ");
+		printf("SEC_DESC_RM_CONTROL_VALID ");
 	if (type & SEC_DESC_SELF_RELATIVE)	/* 0x8000 */
-		fstrcat(typestr, "SEC_DESC_SELF_RELATIVE ");
+		printf("SEC_DESC_SELF_RELATIVE ");
 	
-	printf("type: 0x%04x: %s\n", type, typestr);
+	printf("\n");
 }
 
 /****************************************************************************
  display sec_desc structure
  ****************************************************************************/
-void display_sec_desc(SEC_DESC *sec)
+void display_sec_desc(struct security_descriptor *sec)
 {
-	fstring sid_str;
+	char *sid_str;
 
 	if (!sec) {
 		printf("NULL\n");
@@ -306,12 +309,14 @@ void display_sec_desc(SEC_DESC *sec)
 	}
 
 	if (sec->owner_sid) {
-		sid_to_fstring(sid_str, sec->owner_sid);
+		sid_str = dom_sid_string(NULL, sec->owner_sid);
 		printf("\tOwner SID:\t%s\n", sid_str);
+		talloc_free(sid_str);
 	}
 
 	if (sec->group_sid) {
-		sid_to_fstring(sid_str, sec->group_sid);
+		sid_str = dom_sid_string(NULL, sec->group_sid);
 		printf("\tGroup SID:\t%s\n", sid_str);
+		talloc_free(sid_str);
 	}
 }
diff --git a/libcli/util/doserr.c b/libcli/util/doserr.c
index 5104c3ee02..1a7422e3f6 100644
--- a/libcli/util/doserr.c
+++ b/libcli/util/doserr.c
@@ -124,6 +124,7 @@ static const struct werror_code_struct dos_errs[] =
 	{ "WERR_DS_DRA_DB_ERROR", WERR_DS_DRA_DB_ERROR },
 	{ "WERR_DS_DRA_NO_REPLICA", WERR_DS_DRA_NO_REPLICA },
 	{ "WERR_DS_DRA_ACCESS_DENIED", WERR_DS_DRA_ACCESS_DENIED },
+	{ "WERR_DS_DRA_SOURCE_DISABLED", WERR_DS_DRA_SOURCE_DISABLED },
 	{ "WERR_DS_DNS_LOOKUP_FAILURE", WERR_DS_DNS_LOOKUP_FAILURE },
 	{ "WERR_DS_WRONG_LINKED_ATTRIBUTE_SYNTAX", WERR_DS_WRONG_LINKED_ATTRIBUTE_SYNTAX },
 	{ "WERR_DS_NO_MSDS_INTID", WERR_DS_NO_MSDS_INTID },
diff --git a/libcli/util/werror.h b/libcli/util/werror.h
index d92232706a..a69587f361 100644
--- a/libcli/util/werror.h
+++ b/libcli/util/werror.h
@@ -248,6 +248,7 @@ typedef uint32_t WERROR;
 #define WERR_DS_DRA_DB_ERROR W_ERROR(0x00002103)
 #define WERR_DS_DRA_NO_REPLICA W_ERROR(0x00002104)
 #define WERR_DS_DRA_ACCESS_DENIED W_ERROR(0x00002105)
+#define WERR_DS_DRA_SOURCE_DISABLED W_ERROR(0x00002108)
 #define WERR_DS_DNS_LOOKUP_FAILURE W_ERROR(0x0000214c)
 #define WERR_DS_WRONG_LINKED_ATTRIBUTE_SYNTAX W_ERROR(0x00002150)
 #define WERR_DS_NO_MSDS_INTID W_ERROR(0x00002194)
diff --git a/selftest/SocketWrapper.pm b/selftest/SocketWrapper.pm
index e63605b8df..ef8058da79 100644
--- a/selftest/SocketWrapper.pm
+++ b/selftest/SocketWrapper.pm
@@ -1,7 +1,21 @@
 #!/usr/bin/perl
 # Bootstrap Samba and run a number of tests against it.
 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
-# Published under the GNU GPL, v3 or later.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
 
 package SocketWrapper;
 
diff --git a/selftest/Subunit.pm b/selftest/Subunit.pm
index 05e51da541..19af636d0b 100644
--- a/selftest/Subunit.pm
+++ b/selftest/Subunit.pm
@@ -1,3 +1,19 @@
+# Simple Perl module for parsing the Subunit protocol
+# Copyright (C) 2008 Jelmer Vernooij <jelmer@samba.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
 package Subunit;
 
 require Exporter;
diff --git a/selftest/output/buildfarm.pm b/selftest/output/buildfarm.pm
index cee6c1e63a..77ea26621b 100644
--- a/selftest/output/buildfarm.pm
+++ b/selftest/output/buildfarm.pm
@@ -1,4 +1,19 @@
 #!/usr/bin/perl
+# Buildfarm output for selftest
+# Copyright (C) 2008 Jelmer Vernooij <jelmer@samba.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 package output::buildfarm;
 
diff --git a/selftest/output/html.pm b/selftest/output/html.pm
index 1049527129..e490765d06 100644
--- a/selftest/output/html.pm
+++ b/selftest/output/html.pm
@@ -1,5 +1,19 @@
 #!/usr/bin/perl
-
+# HTML output for selftest
+# Copyright (C) 2008 Jelmer Vernooij <jelmer@samba.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package output::html;
 use Exporter;
 @ISA = qw(Exporter);
diff --git a/selftest/output/plain.pm b/selftest/output/plain.pm
index 82a73ab932..5312a9e27b 100644
--- a/selftest/output/plain.pm
+++ b/selftest/output/plain.pm
@@ -1,5 +1,19 @@
 #!/usr/bin/perl
-
+# Plain text output for selftest
+# Copyright (C) 2008 Jelmer Vernooij <jelmer@samba.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package output::plain;
 use Exporter;
 @ISA = qw(Exporter);
diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index ef4c385d33..3653523541 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -2,7 +2,19 @@
 # Bootstrap Samba and run a number of tests against it.
 # Copyright (C) 2005-2008 Jelmer Vernooij <jelmer@samba.org>
 # Copyright (C) 2007-2009 Stefan Metzmacher <metze@samba.org>
-# Published under the GNU GPL, v3 or later.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 =pod
 
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 1c9c0c1204..fd753128d4 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -831,7 +831,7 @@ PDBEDIT_OBJ = utils/pdbedit.o $(PASSWD_UTIL_OBJ) $(PARAM_OBJ) $(PASSDB_OBJ) @LIB
 
 SMBGET_OBJ = utils/smbget.o $(POPT_LIB_OBJ) $(LIBSMBCLIENT_OBJ1) @LIBWBCLIENT_STATIC@
 
-DISPLAY_SEC_OBJ= lib/display_sec.o
+DISPLAY_SEC_OBJ= ../libcli/security/display_sec.o
 
 RPCCLIENT_OBJ1 = rpcclient/rpcclient.o rpcclient/cmd_lsarpc.o \
 	         rpcclient/cmd_samr.o rpcclient/cmd_spoolss.o \
diff --git a/source3/lib/util_file.c b/source3/lib/util_file.c
index c5a9b7c29a..50ff844762 100644
--- a/source3/lib/util_file.c
+++ b/source3/lib/util_file.c
@@ -39,7 +39,7 @@ static char *file_pload(const char *syscmd, size_t *size)
 	total = 0;
 
 	while ((n = read(fd, buf, sizeof(buf))) > 0) {
-		p = (char *)SMB_REALLOC(p, total + n + 1);
+		p = talloc_realloc(NULL, p, char, total + n + 1);
 		if (!p) {
 		        DEBUG(0,("file_pload: failed to expand buffer!\n"));
 			close(fd);
diff --git a/source3/locking/locking.c b/source3/locking/locking.c
index bafb89522a..70841225a7 100644
--- a/source3/locking/locking.c
+++ b/source3/locking/locking.c
@@ -887,7 +887,8 @@ struct share_mode_lock *fetch_share_mode_unlocked(TALLOC_CTX *mem_ctx,
 	}
 
 	if (!fill_share_mode_lock(lck, id, servicepath, fname, data, NULL)) {
-		DEBUG(3, ("fill_share_mode_lock failed\n"));
+		DEBUG(10, ("fetch_share_mode_unlocked: no share_mode record "
+			   "around (file not open)\n"));
 		TALLOC_FREE(lck);
 		return NULL;
 	}
diff --git a/source3/nmbd/nmbd_elections.c b/source3/nmbd/nmbd_elections.c
index b50d215b91..1ed64f4059 100644
--- a/source3/nmbd/nmbd_elections.c
+++ b/source3/nmbd/nmbd_elections.c
@@ -130,9 +130,6 @@ void check_master_browser_exists(time_t t)
 	struct subnet_record *subrec;
 	const char *workgroup_name = lp_workgroup();
 
-	if (!lastrun)
-		lastrun = t;
-
 	if (t < (lastrun + (CHECK_TIME_MST_BROWSE * 60)))
 		return;
 
diff --git a/source3/samba4.m4 b/source3/samba4.m4
index b5c7c74689..568283cd87 100644
--- a/source3/samba4.m4
+++ b/source3/samba4.m4
@@ -69,14 +69,14 @@ AC_CONFIG_FILES(../source4/librpc/dcerpc_atsvc.pc)
 
 m4_include(../source4/min_versions.m4)
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= $TALLOC_MIN_VERSION,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= TALLOC_MIN_VERSION,
 	[],
 	[
 		SMB_INCLUDE_MK(../lib/talloc/config.mk)
 	]
 )
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= $TDB_MIN_VERSION,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= TDB_MIN_VERSION,
 	[],
 	[
 		m4_include(../lib/tdb/libtdb.m4)
@@ -86,13 +86,13 @@ SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= $TDB_MIN_VERSION,
 
 SMB_INCLUDE_MK(../lib/tdb/python.mk) 
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBTEVENT, tevent = $TEVENT_REQUIRED_VERSION,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBTEVENT, tevent = TEVENT_REQUIRED_VERSION,
 	[],[m4_include(../lib/tevent/samba.m4)]
 )
 
 SMB_INCLUDE_MK(../lib/tevent/python.mk) 
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBLDB, ldb = $LDB_REQUIRED_VERSION,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBLDB, ldb = LDB_REQUIRED_VERSION,
 	[
 		SMB_INCLUDE_MK(lib/ldb/ldb_ildap/config.mk)
 		SMB_INCLUDE_MK(lib/ldb/tools/config.mk)
diff --git a/source4/auth/config.m4 b/source4/auth/config.m4
index fb9ee58c60..9735b17cac 100644
--- a/source4/auth/config.m4
+++ b/source4/auth/config.m4
@@ -28,6 +28,8 @@ if test x"$ac_cv_header_sasl_sasl_h" = x"yes" -a x"$ac_cv_lib_ext_sasl2_sasl_cli
 	SASL_CPPFLAGS="$CPPFLAGS"
 	SASL_LDFLAGS="$LDFLAGS"
 	LIB_REMOVE_USR_LIB(SASL_LDFLAGS)
+	CFLAGS_REMOVE_USR_INCLUDE(SASL_CPPFLAGS)
+	CFLAGS_REMOVE_USR_INCLUDE(SASL_CFLAGS)
 else
 	SMB_ENABLE(cyrus_sasl,NO)
 fi
diff --git a/source4/auth/credentials/credentials_krb5.h b/source4/auth/credentials/credentials_krb5.h
index 0d0e9f330f..5e56752eb4 100644
--- a/source4/auth/credentials/credentials_krb5.h
+++ b/source4/auth/credentials/credentials_krb5.h
@@ -24,6 +24,7 @@
 #define __CREDENTIALS_KRB5_H__
 
 #include <gssapi/gssapi.h>
+#include <gssapi/gssapi_krb5.h>
 #include <krb5.h>
 
 struct gssapi_creds_container {
diff --git a/source4/auth/kerberos/clikrb5.c b/source4/auth/kerberos/clikrb5.c
index cf87d13cf2..68e7eb90cc 100644
--- a/source4/auth/kerberos/clikrb5.c
+++ b/source4/auth/kerberos/clikrb5.c
@@ -74,13 +74,9 @@
 
  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 {
-#if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 	if (pdata->data) {
-		krb5_free_data_contents(context, pdata);
+		krb5_data_free(pdata);
 	}
-#else
-	SAFE_FREE(pdata->data);
-#endif
 }
 
  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
diff --git a/source4/build/m4/public.m4 b/source4/build/m4/public.m4
index bd98a400be..2bf63f0ca6 100644
--- a/source4/build/m4/public.m4
+++ b/source4/build/m4/public.m4
@@ -102,10 +102,12 @@ AC_DEFUN([SMB_EXT_LIB_FROM_PKGCONFIG],
 
 				ac_cv_$1_libs_only_other="`$PKG_CONFIG --libs-only-other '$2'` `$PKG_CONFIG --libs-only-L '$2'`"
 				LIB_REMOVE_USR_LIB(ac_cv_$1_libs_only_other)
+				ac_cv_$1_includedir_only="`$PKG_CONFIG --cflags-only-I '$2'`"
+				CFLAGS_REMOVE_USR_INCLUDE(ac_cv_$1_includedir_only)
 				SMB_EXT_LIB($1, 
 					[`$PKG_CONFIG --libs-only-l '$2'`], 
 					[`$PKG_CONFIG --cflags-only-other '$2'`],
-					[`$PKG_CONFIG --cflags-only-I '$2'`],
+					[$ac_cv_$1_includedir_only],
 					[$ac_cv_$1_libs_only_other])
 				ac_cv_$1_found=yes
 
diff --git a/source4/configure.ac b/source4/configure.ac
index 065a3300ca..3c23f27d68 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -44,14 +44,14 @@ AC_CONFIG_FILES(librpc/dcerpc_atsvc.pc)
 
 m4_include(min_versions.m4)
 
-SMB_INCLUDED_LIB_PKGCONFIG(LIBTALLOC, talloc >= $TALLOC_MIN_VERSION, [],
+SMB_INCLUDED_LIB_PKGCONFIG(LIBTALLOC, talloc >= TALLOC_MIN_VERSION, [],
 	[
 		m4_include(../lib/talloc/libtalloc.m4)
 		SMB_INCLUDE_MK(../lib/talloc/config.mk)
 	]
 )
 
-SMB_INCLUDED_LIB_PKGCONFIG(LIBTDB, tdb >= $TDB_MIN_VERSION,
+SMB_INCLUDED_LIB_PKGCONFIG(LIBTDB, tdb >= TDB_MIN_VERSION,
 	[],
 	[
 		m4_include(../lib/tdb/libtdb.m4)
@@ -67,7 +67,7 @@ SMB_INCLUDED_LIB_PKGCONFIG(LIBTEVENT, tevent = TEVENT_REQUIRED_VERSION,
 
 SMB_INCLUDE_MK(../lib/tevent/python.mk) 
 
-SMB_INCLUDED_LIB_PKGCONFIG(LIBLDB, ldb = $LDB_REQUIRED_VERSION,
+SMB_INCLUDED_LIB_PKGCONFIG(LIBLDB, ldb = LDB_REQUIRED_VERSION,
 	[
 		SMB_INCLUDE_MK(lib/ldb/ldb_ildap/config.mk)
 		SMB_INCLUDE_MK(lib/ldb/tools/config.mk)
diff --git a/source4/heimdal_build/replace.c b/source4/heimdal_build/replace.c
index 41309fea6e..ba43dd9495 100644
--- a/source4/heimdal_build/replace.c
+++ b/source4/heimdal_build/replace.c
@@ -84,3 +84,7 @@
 	return -1;
 }
 #endif
+
+const char *heimdal_version = "samba-internal-heimdal";
+const char *heimdal_long_version = "samba-interal-heimdal";
+
diff --git a/source4/heimdal_build/roken.h b/source4/heimdal_build/roken.h
index 3edeb2fb2e..e3edd53872 100644
--- a/source4/heimdal_build/roken.h
+++ b/source4/heimdal_build/roken.h
@@ -41,6 +41,22 @@
 #define HAVE_STRNDUP
 #endif
 
+#ifndef HAVE_STRLCPY
+#define HAVE_STRLCPY
+#endif
+
+#ifndef HAVE_STRLCAT
+#define HAVE_STRLCAT
+#endif
+
+#ifndef HAVE_STRCASECMP
+#define HAVE_STRCASECMP
+#endif
+
+#ifndef HAVE_MKSTEMP
+#define HAVE_MKSTEMP
+#endif
+
 #ifndef HAVE_SETENV
 #define HAVE_SETENV
 #endif
@@ -84,4 +100,7 @@
 #undef SOCKET_WRAPPER_REPLACE
 #include "heimdal/lib/roken/roken.h.in"
 
+extern const char *heimdal_version;
+extern const char *heimdal_long_version;
+
 #endif
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 1cfe9852f0..3d11441062 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -345,7 +345,7 @@ static bool kdc_process(struct kdc_server *kdc,
 	}
 	if (k5_reply.length) {
 		*reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
-		krb5_free_data_contents(kdc->smb_krb5_context->krb5_context, &k5_reply);
+		krb5_data_free(&k5_reply);
 	} else {
 		*reply = data_blob(NULL, 0);	
 	}
diff --git a/source4/libcli/security/config.mk b/source4/libcli/security/config.mk
index d6d9ad5545..9d23fe9588 100644
--- a/source4/libcli/security/config.mk
+++ b/source4/libcli/security/config.mk
@@ -4,7 +4,5 @@ PUBLIC_DEPENDENCIES = LIBNDR LIBSECURITY_COMMON
 LIBSECURITY_OBJ_FILES = $(addprefix $(libclisrcdir)/security/, \
 					   security_token.o security_descriptor.o \
 					   access_check.o privilege.o sddl.o) \
-					   ../libcli/security/secace.o \
-					   ../libcli/security/secacl.o
 
 $(eval $(call proto_header_template,$(libclisrcdir)/security/proto.h,$(LIBSECURITY_OBJ_FILES:.o=.c)))
diff --git a/source4/min_versions.m4 b/source4/min_versions.m4
index eaefbd5148..1dd3501b99 100644
--- a/source4/min_versions.m4
+++ b/source4/min_versions.m4
@@ -1,6 +1,6 @@
 # Minimum and exact required versions for various libraries 
 # if we use the ones installed in the system.
-TDB_MIN_VERSION=1.1.3
-TALLOC_MIN_VERSION=1.3.0
-LDB_REQUIRED_VERSION=0.9.3
-TEVENT_REQUIRED_VERSION=0.9.5
+define(TDB_MIN_VERSION,1.1.3)
+define(TALLOC_MIN_VERSION,1.3.0)
+define(LDB_REQUIRED_VERSION,0.9.3)
+define(TEVENT_REQUIRED_VERSION,0.9.5)