port latest changes from SAMBA_3_0 tree

(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)

17 files changed, 850 insertions, 188 deletions

diff --git a/source3/libsmb/asn1.c b/source3/libsmb/asn1.c
index 09d4fbb6c9..576491dd3b 100644
--- a/source3/libsmb/asn1.c
+++ b/source3/libsmb/asn1.c
@@ -322,9 +322,9 @@ BOOL asn1_read_OID(ASN1_DATA *data, char **OID)
 	asn1_read_uint8(data, &b);
 
 	oid[0] = 0;
-	snprintf(el, sizeof(el), "%u",  b/40);
+	fstr_sprintf(el, "%u",  b/40);
 	pstrcat(oid, el);
-	snprintf(el, sizeof(el), " %u",  b%40);
+	fstr_sprintf(el, " %u",  b%40);
 	pstrcat(oid, el);
 
 	while (asn1_tag_remaining(data) > 0) {
@@ -333,7 +333,7 @@ BOOL asn1_read_OID(ASN1_DATA *data, char **OID)
 			asn1_read_uint8(data, &b);
 			v = (v<<7) | (b&0x7f);
 		} while (!data->has_error && b & 0x80);
-		snprintf(el, sizeof(el), " %u",  v);
+		fstr_sprintf(el, " %u",  v);
 		pstrcat(oid, el);
 	}
 
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index fa9af19bf5..94fe04a480 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -190,7 +190,7 @@ static BOOL cli_session_setup_plaintext(struct cli_state *cli, const char *user,
 	char *p;
 	fstring lanman;
 	
-	snprintf( lanman, sizeof(lanman), "Samba %s", VERSION );
+	fstr_sprintf( lanman, "Samba %s", VERSION );
 
 	set_message(cli->outbuf,13,0,True);
 	SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
@@ -301,7 +301,7 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user,
 				lm_response = data_blob(NULL, 24);
 				SMBencrypt(pass,cli->secblob.data, lm_response.data);
 			} else {
-				/* LM disabled, place NT# in LM feild instead */
+				/* LM disabled, place NT# in LM field instead */
 				lm_response = data_blob(nt_response.data, nt_response.length);
 			}
 
@@ -472,6 +472,7 @@ static DATA_BLOB cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 /****************************************************************************
  Use in-memory credentials cache
 ****************************************************************************/
+
 static void use_in_memory_ccache(void) {
 	setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 }
@@ -483,18 +484,23 @@ static void use_in_memory_ccache(void) {
 static BOOL cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 {
 	DATA_BLOB blob2, negTokenTarg;
-
+	unsigned char session_key_krb5[16];
+	DATA_BLOB null_blob = data_blob(NULL, 0);
+	
 	DEBUG(2,("Doing kerberos session setup\n"));
 
 	/* generate the encapsulated kerberos5 ticket */
-	negTokenTarg = spnego_gen_negTokenTarg(principal, 0);
+	negTokenTarg = spnego_gen_negTokenTarg(principal, 0, session_key_krb5);
 
-	if (!negTokenTarg.data) return False;
+	if (!negTokenTarg.data)
+		return False;
 
 #if 0
 	file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 #endif
 
+	cli_simple_set_signing(cli, session_key_krb5, null_blob); 
+			
 	blob2 = cli_session_setup_blob(cli, negTokenTarg);
 
 	/* we don't need this blob for kerberos */
@@ -551,7 +557,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 						  blob_in, &blob_out);
 		data_blob_free(&blob_in);
 		if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-			DATA_BLOB null = data_blob(NULL, 0);
+			DATA_BLOB null_blob = data_blob(NULL, 0);
 			if (turn == 1) {
 				/* and wrap it in a SPNEGO wrapper */
 				msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
@@ -562,7 +568,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 		
 			cli_simple_set_signing(cli, 
 					       ntlmssp_state->session_key.data, 
-					       null); 
+					       null_blob); 
 			
 			/* now send that blob on its way */
 			if (!cli_session_setup_blob_send(cli, msg1)) {
@@ -630,7 +636,7 @@ static BOOL cli_session_setup_spnego(struct cli_state *cli, const char *user,
 	BOOL got_kerberos_mechanism = False;
 	DATA_BLOB blob;
 
-	DEBUG(2,("Doing spnego session setup (blob length=%d)\n", cli->secblob.length));
+	DEBUG(2,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 
 	/* the server might not even do spnego */
 	if (cli->secblob.length <= 16) {
@@ -989,6 +995,11 @@ BOOL cli_negprot(struct cli_state *cli)
 
 	cli->protocol = prots[SVAL(cli->inbuf,smb_vwv0)].prot;	
 
+	if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) {
+		DEBUG(1,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
+		return False;
+	}
+
 	if (cli->protocol >= PROTOCOL_NT1) {    
 		/* NT protocol */
 		cli->sec_mode = CVAL(cli->inbuf,smb_vwv1);
@@ -1015,7 +1026,7 @@ BOOL cli_negprot(struct cli_state *cli)
 
 		if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) {
 			/* Fail if signing is mandatory and we don't want to support it. */
-			if (!lp_client_signing()) {
+			if (!cli->sign_info.allow_smb_signing) {
 				DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
 				return False;
 			}
@@ -1248,6 +1259,7 @@ NTSTATUS cli_full_connection(struct cli_state **output_cli,
 			     const char *service, const char *service_type,
 			     const char *user, const char *domain, 
 			     const char *password, int flags,
+			     int signing_state,
 			     BOOL *retry) 
 {
 	struct ntuser_creds creds;
@@ -1310,6 +1322,8 @@ again:
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
+	cli_setup_signing_state(cli, signing_state);
+
 	if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
 		cli->use_spnego = False;
 	else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
@@ -1480,7 +1494,7 @@ struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip,
 	
 	nt_status = cli_full_connection(&cli, myname, server, server_ip, 0, "IPC$", "IPC", 
 					user_info->username, lp_workgroup(), user_info->password, 
-					CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, NULL);
+					CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, Undefined, NULL);
 
 	if (NT_STATUS_IS_OK(nt_status)) {
 		return cli;
diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c
index 58c5ad8cd3..bc5f1462cc 100644
--- a/source3/libsmb/clientgen.c
+++ b/source3/libsmb/clientgen.c
@@ -141,7 +141,7 @@ BOOL cli_send_smb(struct cli_state *cli)
 	if (cli->fd == -1)
 		return False;
 
-	cli_caclulate_sign_mac(cli);
+	cli_calculate_sign_mac(cli);
 
 	len = smb_len(cli->outbuf) + 4;
 
@@ -157,6 +157,10 @@ BOOL cli_send_smb(struct cli_state *cli)
 		}
 		nwritten += ret;
 	}
+	/* Increment the mid so we can tell between responses. */
+	cli->mid++;
+	if (!cli->mid)
+		cli->mid++;
 	return True;
 }
 
@@ -209,6 +213,27 @@ void cli_init_creds(struct cli_state *cli, const struct ntuser_creds *usr)
 }
 
 /****************************************************************************
+ Set the signing state (used from the command line).
+****************************************************************************/
+
+void cli_setup_signing_state(struct cli_state *cli, int signing_state)
+{
+	if (signing_state == Undefined)
+		return;
+
+	if (signing_state == False) {
+		cli->sign_info.allow_smb_signing = False;
+		cli->sign_info.mandatory_signing = False;
+		return;
+	}
+
+	cli->sign_info.allow_smb_signing = True;
+
+	if (signing_state == Required) 
+		cli->sign_info.mandatory_signing = True;
+}
+
+/****************************************************************************
  Initialise a client structure.
 ****************************************************************************/
 
diff --git a/source3/libsmb/clierror.c b/source3/libsmb/clierror.c
index 9ee181a90f..c27e1955e2 100644
--- a/source3/libsmb/clierror.c
+++ b/source3/libsmb/clierror.c
@@ -108,7 +108,7 @@ const char *cli_errstr(struct cli_state *cli)
 				break;
 		        case READ_BAD_SIG:
 				slprintf(cli_error_message, sizeof(cli_error_message) - 1,
-					"Server packet had invalid SMB signiture!");
+					"Server packet had invalid SMB signature!");
 				break;
 		        default:
 				slprintf(cli_error_message, sizeof(cli_error_message) - 1,
@@ -371,6 +371,9 @@ BOOL cli_is_error(struct cli_state *cli)
 {
 	uint32 flgs2 = SVAL(cli->inbuf,smb_flg2), rcls = 0;
 
+	if (cli->fd == -1 && cli->smb_rw_error != 0)
+		return True;
+
         if (flgs2 & FLAGS2_32_BIT_ERROR_CODES) {
                 /* Return error is error bits are set */
                 rcls = IVAL(cli->inbuf, smb_rcls);
diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index fd5dd91325..beac8cb2c1 100644
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -305,7 +305,7 @@ cleanup_princ:
 /*
   get a kerberos5 ticket for the given service 
 */
-DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset)
+DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset, unsigned char session_key_krb5[16])
 {
 	krb5_error_code retval;
 	krb5_data packet;
@@ -345,13 +345,15 @@ DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset)
 	}
 
 	if ((retval = ads_krb5_mk_req(context, 
-				      &auth_context, 
-				      0, 
-				      principal,
-				      ccdef, &packet))) {
+					&auth_context, 
+					AP_OPTS_USE_SUBKEY, 
+					principal,
+					ccdef, &packet))) {
 		goto failed;
 	}
 
+	get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
+
 	ret = data_blob(packet.data, packet.length);
 /* Hmm, heimdal dooesn't have this - what's the correct call? */
 /* 	krb5_free_data_contents(context, &packet); */
@@ -365,17 +367,22 @@ failed:
 	return data_blob(NULL, 0);
 }
 
- BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16])
+ BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16], BOOL remote)
  {
 #ifdef ENCTYPE_ARCFOUR_HMAC
 	krb5_keyblock *skey;
 #endif
 	BOOL ret = False;
+	krb5_error_code err;
 
 	memset(session_key, 0, 16);
 
 #ifdef ENCTYPE_ARCFOUR_HMAC
-	if (krb5_auth_con_getremotesubkey(context, auth_context, &skey) == 0 && skey != NULL) {
+	if (remote)
+		err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
+	else
+		err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
+	if (err == 0 && skey != NULL) {
 		if (KRB5_KEY_TYPE(skey) ==
 		    ENCTYPE_ARCFOUR_HMAC
 		    && KRB5_KEY_LENGTH(skey) == 16) {
@@ -388,9 +395,22 @@ failed:
 
 	return ret;
  }
+
+
+#if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
+ const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
+{
+	static krb5_data kdata;
+
+	kdata.data = krb5_principal_get_comp_string(context, principal, i);
+	kdata.length = strlen(kdata.data);
+	return &kdata;
+}
+#endif
+
 #else /* HAVE_KRB5 */
  /* this saves a few linking headaches */
-DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset)
+DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset, unsigned char session_key_krb5[16])
  {
 	 DEBUG(0,("NO KERBEROS SUPPORT\n"));
 	 return data_blob(NULL, 0);
diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c
index 5bd1283ab7..7822987ada 100644
--- a/source3/libsmb/clilist.c
+++ b/source3/libsmb/clilist.c
@@ -101,13 +101,20 @@ static int interpret_long_filename(struct cli_state *cli,
 			   cheap to calculate, I suppose, as
 			   no DST tables will be needed */
 			
-			finfo->ctime = interpret_long_date(p); p += 8;
-			finfo->atime = interpret_long_date(p); p += 8;
-			finfo->mtime = interpret_long_date(p); p += 8; p += 8;
-			finfo->size = IVAL2_TO_SMB_BIG_UINT(p,0); p += 8;
+			finfo->ctime = interpret_long_date(p);
+			p += 8;
+			finfo->atime = interpret_long_date(p);
+			p += 8;
+			finfo->mtime = interpret_long_date(p);
+			p += 8;
+			p += 8;
+			finfo->size = IVAL2_TO_SMB_BIG_UINT(p,0);
+			p += 8;
 			p += 8; /* alloc size */
-			finfo->mode = CVAL(p,0); p += 4;
-			namelen = IVAL(p,0); p += 4;
+			finfo->mode = CVAL(p,0);
+			p += 4;
+			namelen = IVAL(p,0);
+			p += 4;
 			p += 4; /* EA size */
 			slen = SVAL(p, 0);
 			p += 2; 
@@ -138,7 +145,11 @@ static int interpret_long_filename(struct cli_state *cli,
 int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, 
 		 void (*fn)(file_info *, const char *, void *), void *state)
 {
+#if 0
+	int max_matches = 1366; /* Match W2k - was 512. */
+#else
 	int max_matches = 512;
+#endif
 	int info_level;
 	char *p, *p2;
 	pstring mask;
@@ -200,7 +211,12 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 				    &setup, 1, 0,           /* setup, length, max */
 				    param, param_len, 10,   /* param, length, max */
 				    NULL, 0, 
-				    cli->max_xmit /* data, length, max */
+#if 0
+				    /* w2k value. */
+				    MIN(16384,cli->max_xmit) /* data, length, max. */
+#else
+				    cli->max_xmit	    /* data, length, max. */
+#endif
 				    )) {
 			break;
 		}
@@ -214,7 +230,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 			uint8 eclass;
 			uint32 ecode;
 			cli_dos_error(cli, &eclass, &ecode);
-			if (eclass != ERRSRV || ecode != ERRerror) break;
+			if (eclass != ERRSRV || ecode != ERRerror)
+				break;
 			msleep(100);
 			continue;
 		}
@@ -222,7 +239,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
                 if (cli_is_error(cli) || !rdata || !rparam) 
 			break;
 
-		if (total_received == -1) total_received = 0;
+		if (total_received == -1)
+			total_received = 0;
 
 		/* parse out some important return info */
 		p = rparam;
@@ -245,8 +263,7 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 
 		/* we might need the lastname for continuations */
 		if (ff_lastname > 0) {
-			switch(info_level)
-				{
+			switch(info_level) {
 				case 260:
 					clistr_pull(cli, mask, p+ff_lastname,
 						    sizeof(mask), 
@@ -270,8 +287,9 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 		if (!tdl) {
 			DEBUG(0,("cli_list_new: Failed to expand dirlist\n"));
 			break;
+		} else {
+			dirlist = tdl;
 		}
-		else dirlist = tdl;
 
 		/* put in a length for the last entry, to ensure we can chain entries 
 		   into the next packet */
@@ -291,7 +309,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 		DEBUG(3,("received %d entries (eos=%d)\n",
 			 ff_searchcount,ff_eos));
 
-		if (ff_searchcount > 0) loop_count = 0;
+		if (ff_searchcount > 0)
+			loop_count = 0;
 
 		First = False;
 	}
diff --git a/source3/libsmb/cliprint.c b/source3/libsmb/cliprint.c
index bfa33bc514..f302c045a5 100644
--- a/source3/libsmb/cliprint.c
+++ b/source3/libsmb/cliprint.c
@@ -65,16 +65,16 @@ int cli_print_queue(struct cli_state *cli,
 	p = param;
 	SSVAL(p,0,76);         /* API function number 76 (DosPrintJobEnum) */
 	p += 2;
-	pstrcpy(p,"zWrLeh");   /* parameter description? */
+	pstrcpy_base(p,"zWrLeh", param);   /* parameter description? */
 	p = skip_string(p,1);
-	pstrcpy(p,"WWzWWDDzz");  /* returned data format */
+	pstrcpy_base(p,"WWzWWDDzz", param);  /* returned data format */
 	p = skip_string(p,1);
-	pstrcpy(p,cli->share);    /* name of queue */
+	pstrcpy_base(p,cli->share, param);    /* name of queue */
 	p = skip_string(p,1);
 	SSVAL(p,0,2);   /* API function level 2, PRJINFO_2 data structure */
 	SSVAL(p,2,1000); /* size of bytes of returned data buffer */
 	p += 4;
-	pstrcpy(p,"");   /* subformat */
+	pstrcpy_base(p,"", param);   /* subformat */
 	p = skip_string(p,1);
 
 	DEBUG(4,("doing cli_print_queue for %s\n", cli->share));
@@ -133,9 +133,9 @@ int cli_printjob_del(struct cli_state *cli, int job)
 	p = param;
 	SSVAL(p,0,81);		/* DosPrintJobDel() */
 	p += 2;
-	pstrcpy(p,"W");
+	pstrcpy_base(p,"W", param);
 	p = skip_string(p,1);
-	pstrcpy(p,"");
+	pstrcpy_base(p,"", param);
 	p = skip_string(p,1);
 	SSVAL(p,0,job);     
 	p += 2;
diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c
index bb48f57915..b0570b09b6 100644
--- a/source3/libsmb/clispnego.c
+++ b/source3/libsmb/clispnego.c
@@ -2,7 +2,7 @@
    Unix SMB/CIFS implementation.
    simple kerberos5/SPNEGO routines
    Copyright (C) Andrew Tridgell 2001
-   Copyright (C) Jim McDonough   2002
+   Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Luke Howard     2003
    
    This program is free software; you can redistribute it and/or modify
@@ -323,13 +323,13 @@ BOOL spnego_parse_krb5_wrap(DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2])
    generate a SPNEGO negTokenTarg packet, ready for a EXTENDED_SECURITY
    kerberos session setup 
 */
-DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset)
+DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset, unsigned char session_key_krb5[16])
 {
 	DATA_BLOB tkt, tkt_wrapped, targ;
 	const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_NTLMSSP, NULL};
 
-	/* get a kerberos ticket for the service */
-	tkt = cli_krb5_get_ticket(principal, time_offset);
+	/* get a kerberos ticket for the service and extract the session key */
+	tkt = cli_krb5_get_ticket(principal, time_offset, session_key_krb5);
 
 	/* wrap that up in a nice GSS-API wrapping */
 	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
diff --git a/source3/libsmb/clitrans.c b/source3/libsmb/clitrans.c
index 3d3cd427d7..e6771ac688 100644
--- a/source3/libsmb/clitrans.c
+++ b/source3/libsmb/clitrans.c
@@ -40,6 +40,7 @@ BOOL cli_send_trans(struct cli_state *cli, int trans,
 	char *outdata,*outparam;
 	char *p;
 	int pipe_name_len=0;
+	uint16 mid;
 
 	this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 	this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
@@ -49,6 +50,7 @@ BOOL cli_send_trans(struct cli_state *cli, int trans,
 	SCVAL(cli->outbuf,smb_com,trans);
 	SSVAL(cli->outbuf,smb_tid, cli->cnum);
 	cli_setup_packet(cli);
+	mid = cli->mid;
 
 	if (pipe_name) {
 		pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
@@ -84,13 +86,19 @@ BOOL cli_send_trans(struct cli_state *cli, int trans,
 	cli_setup_bcc(cli, outdata+this_ldata);
 
 	show_msg(cli->outbuf);
-	if (!cli_send_smb(cli))
+
+	cli_signing_trans_start(cli);
+	if (!cli_send_smb(cli)) {
+		cli_signing_trans_stop(cli);
 		return False;
+	}
 
 	if (this_ldata < ldata || this_lparam < lparam) {
 		/* receive interim response */
-		if (!cli_receive_smb(cli) || cli_is_error(cli))
+		if (!cli_receive_smb(cli) || cli_is_error(cli)) {
+			cli_signing_trans_stop(cli);
 			return(False);
+		}
 
 		tot_data = this_ldata;
 		tot_param = this_lparam;
@@ -122,9 +130,15 @@ BOOL cli_send_trans(struct cli_state *cli, int trans,
 				memcpy(outdata,data+tot_data,this_ldata);
 			cli_setup_bcc(cli, outdata+this_ldata);
 			
+			/* Ensure this packet has the same MID as
+			 * the primary. Important in signing. JRA. */
+			cli->mid = mid;
+
 			show_msg(cli->outbuf);
-			if (!cli_send_smb(cli))
+			if (!cli_send_smb(cli)) {
+				cli_signing_trans_stop(cli);
 				return False;
+			}
 			
 			tot_data += this_ldata;
 			tot_param += this_lparam;
@@ -151,8 +165,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 
 	*data_len = *param_len = 0;
 
-	if (!cli_receive_smb(cli))
+	if (!cli_receive_smb(cli)) {
+		cli_signing_trans_stop(cli);
 		return False;
+	}
 
 	show_msg(cli->inbuf);
 	
@@ -161,6 +177,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		DEBUG(0,("Expected %s response, got command 0x%02x\n",
 			 trans==SMBtrans?"SMBtrans":"SMBtrans2", 
 			 CVAL(cli->inbuf,smb_com)));
+		cli_signing_trans_stop(cli);
 		return(False);
 	}
 
@@ -171,8 +188,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 	 */
 	status = cli_nt_error(cli);
 	
-	if (NT_STATUS_IS_ERR(status))
+	if (NT_STATUS_IS_ERR(status)) {
+		cli_signing_trans_stop(cli);
 		return False;
+	}
 
 	/* parse out the lengths */
 	total_data = SVAL(cli->inbuf,smb_tdrcnt);
@@ -183,6 +202,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		tdata = Realloc(*data,total_data);
 		if (!tdata) {
 			DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 		else
@@ -193,6 +213,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		tparam = Realloc(*param,total_param);
 		if (!tparam) {
 			DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 		else
@@ -206,6 +227,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		if (this_data + *data_len > total_data ||
 		    this_param + *param_len > total_param) {
 			DEBUG(1,("Data overflow in cli_receive_trans\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 
@@ -214,6 +236,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 				this_param + *param_len < this_param ||
 				this_param + *param_len < *param_len) {
 			DEBUG(1,("Data overflow in cli_receive_trans\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 
@@ -226,6 +249,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 					data_offset_out + this_data < data_offset_out ||
 					data_offset_out + this_data < this_data) {
 				DEBUG(1,("Data overflow in cli_receive_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 			if (data_offset_in > cli->bufsize ||
@@ -233,6 +257,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 					data_offset_in + this_data < data_offset_in ||
 					data_offset_in + this_data < this_data) {
 				DEBUG(1,("Data overflow in cli_receive_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 
@@ -247,6 +272,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 					param_offset_out + this_param < param_offset_out ||
 					param_offset_out + this_param < this_param) {
 				DEBUG(1,("Param overflow in cli_receive_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 			if (param_offset_in > cli->bufsize ||
@@ -254,6 +280,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 					param_offset_in + this_param < param_offset_in ||
 					param_offset_in + this_param < this_param) {
 				DEBUG(1,("Param overflow in cli_receive_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 
@@ -265,8 +292,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		if (total_data <= *data_len && total_param <= *param_len)
 			break;
 		
-		if (!cli_receive_smb(cli))
-			return False;
+		if (!cli_receive_smb(cli)) {
+			cli_signing_trans_stop(cli);
+			return False;	
+		}
 
 		show_msg(cli->inbuf);
 		
@@ -275,9 +304,11 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 			DEBUG(0,("Expected %s response, got command 0x%02x\n",
 				 trans==SMBtrans?"SMBtrans":"SMBtrans2", 
 				 CVAL(cli->inbuf,smb_com)));
+			cli_signing_trans_stop(cli);
 			return(False);
 		}
 		if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
+			cli_signing_trans_stop(cli);
 			return(False);
 		}
 
@@ -292,6 +323,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 		
 	}
 	
+	cli_signing_trans_stop(cli);
 	return(True);
 }
 
@@ -309,6 +341,7 @@ BOOL cli_send_nt_trans(struct cli_state *cli,
 	unsigned int i;
 	unsigned int this_ldata,this_lparam;
 	unsigned int tot_data=0,tot_param=0;
+	uint16 mid;
 	char *outdata,*outparam;
 
 	this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
@@ -319,6 +352,7 @@ BOOL cli_send_nt_trans(struct cli_state *cli,
 	SCVAL(cli->outbuf,smb_com,SMBnttrans);
 	SSVAL(cli->outbuf,smb_tid, cli->cnum);
 	cli_setup_packet(cli);
+	mid = cli->mid;
 
 	outparam = smb_buf(cli->outbuf)+3;
 	outdata = outparam+this_lparam;
@@ -347,13 +381,18 @@ BOOL cli_send_nt_trans(struct cli_state *cli,
 	cli_setup_bcc(cli, outdata+this_ldata);
 
 	show_msg(cli->outbuf);
-	if (!cli_send_smb(cli))
+	cli_signing_trans_start(cli);
+	if (!cli_send_smb(cli)) {
+		cli_signing_trans_stop(cli);
 		return False;
+	}	
 
 	if (this_ldata < ldata || this_lparam < lparam) {
 		/* receive interim response */
-		if (!cli_receive_smb(cli) || cli_is_error(cli))
+		if (!cli_receive_smb(cli) || cli_is_error(cli)) {
+			cli_signing_trans_stop(cli);
 			return(False);
+		}
 
 		tot_data = this_ldata;
 		tot_param = this_lparam;
@@ -384,9 +423,16 @@ BOOL cli_send_nt_trans(struct cli_state *cli,
 				memcpy(outdata,data+tot_data,this_ldata);
 			cli_setup_bcc(cli, outdata+this_ldata);
 			
+			/* Ensure this packet has the same MID as
+			 * the primary. Important in signing. JRA. */
+			cli->mid = mid;
+
 			show_msg(cli->outbuf);
-			if (!cli_send_smb(cli))
+
+			if (!cli_send_smb(cli)) {
+				cli_signing_trans_stop(cli);
 				return False;
+			}
 			
 			tot_data += this_ldata;
 			tot_param += this_lparam;
@@ -396,8 +442,6 @@ BOOL cli_send_nt_trans(struct cli_state *cli,
 	return(True);
 }
 
-
-
 /****************************************************************************
   receive a SMB nttrans response allocating the necessary memory
   ****************************************************************************/
@@ -416,8 +460,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 
 	*data_len = *param_len = 0;
 
-	if (!cli_receive_smb(cli))
+	if (!cli_receive_smb(cli)) {
+		cli_signing_trans_stop(cli);
 		return False;
+	}
 
 	show_msg(cli->inbuf);
 	
@@ -425,6 +471,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 	if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 		DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 			 CVAL(cli->inbuf,smb_com)));
+		cli_signing_trans_stop(cli);
 		return(False);
 	}
 
@@ -435,8 +482,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 	 */
 	if (cli_is_dos_error(cli)) {
                 cli_dos_error(cli, &eclass, &ecode);
-		if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata))
+		if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
+			cli_signing_trans_stop(cli);
 			return(False);
+		}
 	}
 
 	/* parse out the lengths */
@@ -448,6 +497,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 		tdata = Realloc(*data,total_data);
 		if (!tdata) {
 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
+			cli_signing_trans_stop(cli);
 			return False;
 		} else {
 			*data = tdata;
@@ -458,6 +508,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 		tparam = Realloc(*param,total_param);
 		if (!tparam) {
 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
+			cli_signing_trans_stop(cli);
 			return False;
 		} else {
 			*param = tparam;
@@ -471,6 +522,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 		if (this_data + *data_len > total_data ||
 		    this_param + *param_len > total_param) {
 			DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 
@@ -479,6 +531,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 				this_param + *param_len < this_param ||
 				this_param + *param_len < *param_len) {
 			DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
+			cli_signing_trans_stop(cli);
 			return False;
 		}
 
@@ -491,6 +544,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 					data_offset_out + this_data < data_offset_out ||
 					data_offset_out + this_data < this_data) {
 				DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 			if (data_offset_in > cli->bufsize ||
@@ -498,6 +552,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 					data_offset_in + this_data < data_offset_in ||
 					data_offset_in + this_data < this_data) {
 				DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 
@@ -513,6 +568,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 					param_offset_out + this_param < param_offset_out ||
 					param_offset_out + this_param < this_param) {
 				DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 			if (param_offset_in > cli->bufsize ||
@@ -520,6 +576,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 					param_offset_in + this_param < param_offset_in ||
 					param_offset_in + this_param < this_param) {
 				DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
+				cli_signing_trans_stop(cli);
 				return False;
 			}
 
@@ -532,8 +589,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 		if (total_data <= *data_len && total_param <= *param_len)
 			break;
 		
-		if (!cli_receive_smb(cli))
+		if (!cli_receive_smb(cli)) {
+			cli_signing_trans_stop(cli);
 			return False;
+		}
 
 		show_msg(cli->inbuf);
 		
@@ -541,13 +600,15 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 		if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 			DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 				 CVAL(cli->inbuf,smb_com)));
+			cli_signing_trans_stop(cli);
 			return(False);
 		}
 		if (cli_is_dos_error(cli)) {
                         cli_dos_error(cli, &eclass, &ecode);
-			if(cli->nt_pipe_fnum == 0 || 
-                           !(eclass == ERRDOS && ecode == ERRmoredata))
+			if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
+				cli_signing_trans_stop(cli);
 				return(False);
+			}
 		}
 		/* parse out the total lengths again - they can shrink! */
 		if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
@@ -559,5 +620,6 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 			break;
 	}
 	
+	cli_signing_trans_stop(cli);
 	return(True);
 }
diff --git a/source3/libsmb/errormap.c b/source3/libsmb/errormap.c
index 8ee5ee3d31..3d99e3d5e5 100644
--- a/source3/libsmb/errormap.c
+++ b/source3/libsmb/errormap.c
@@ -1498,6 +1498,7 @@ const struct unix_error_map unix_dos_nt_errmap[] = {
 	{ ENFILE, ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES },
 	{ EMFILE, ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES },
 	{ ENOSPC, ERRHRD, ERRdiskfull, NT_STATUS_DISK_FULL },
+	{ ENOMEM, ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY },
 #ifdef EDQUOT
 	{ EDQUOT, ERRHRD, ERRdiskfull, NT_STATUS_DISK_FULL },
 #endif
diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c
index 157a2bb43c..6ee05f0104 100644
--- a/source3/libsmb/nmblib.c
+++ b/source3/libsmb/nmblib.c
@@ -1129,12 +1129,14 @@ char *dns_to_netbios_name(char *dns_name)
 
 
 /****************************************************************************
-interpret the weird netbios "name". Return the name type
+interpret the weird netbios "name" into a unix fstring. Return the name type
 ****************************************************************************/
-static int name_interpret(char *in,char *out)
+static int name_interpret(char *in, fstring name)
 {
   int ret;
   int len = (*in++) / 2;
+  fstring out_string;
+  char *out = out_string;
 
   *out=0;
 
@@ -1150,8 +1152,8 @@ static int name_interpret(char *in,char *out)
       in += 2;
       out++;
     }
-  *out = 0;
   ret = out[-1];
+  out[-1] = 0;
 
 #ifdef NETBIOS_SCOPE
   /* Handle any scope names */
@@ -1165,6 +1167,8 @@ static int name_interpret(char *in,char *out)
       in += len;
     }
 #endif
+  pull_ascii(name, out_string, sizeof(fstring), sizeof(out_string), STR_TERMINATE);
+
   return(ret);
 }
 
@@ -1245,9 +1249,9 @@ static char *name_ptr(char *buf,int ofs)
 }  
 
 /****************************************************************************
-extract a netbios name from a buf
+extract a netbios name from a buf (into a unix string) return name type
 ****************************************************************************/
-int name_extract(char *buf,int ofs,char *name)
+int name_extract(char *buf,int ofs, fstring name)
 {
   char *p = name_ptr(buf,ofs);
   int d = PTR_DIFF(p,buf+ofs);
diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c
index 66dc6e08eb..a50ae9b70f 100644
--- a/source3/libsmb/ntlmssp.c
+++ b/source3/libsmb/ntlmssp.c
@@ -279,8 +279,8 @@ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
 
 	data_blob_free(&sess_key);
 	
-	DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%d len2=%d\n",
-		 ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, ntlmssp_state->lm_resp.length, ntlmssp_state->nt_resp.length));
+	DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n",
+		 ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, (unsigned long)ntlmssp_state->lm_resp.length, (unsigned long)ntlmssp_state->nt_resp.length));
 
 #if 0
 	file_save("nthash1.dat",  &ntlmssp_state->nt_resp.data,  &ntlmssp_state->nt_resp.length);
diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c
index f53afcdcd0..3c6da349e4 100644
--- a/source3/libsmb/ntlmssp_parse.c
+++ b/source3/libsmb/ntlmssp_parse.c
@@ -2,7 +2,7 @@
    Unix SMB/CIFS implementation.
    simple kerberos5/SPNEGO routines
    Copyright (C) Andrew Tridgell 2001
-   Copyright (C) Jim McDonough   2002
+   Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Andrew Bartlett 2002-2003
    
    This program is free software; you can redistribute it and/or modify
diff --git a/source3/libsmb/ntlmssp_sign.c b/source3/libsmb/ntlmssp_sign.c
index 748c008963..ecaef808c9 100644
--- a/source3/libsmb/ntlmssp_sign.c
+++ b/source3/libsmb/ntlmssp_sign.c
@@ -102,7 +102,7 @@ enum ntlmssp_direction {
 	NTLMSSP_RECEIVE
 };
 
-static NTSTATUS ntlmssp_make_packet_signiture(NTLMSSP_CLIENT_STATE *ntlmssp_state,
+static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_CLIENT_STATE *ntlmssp_state,
 					      const uchar *data, size_t length, 
 					      enum ntlmssp_direction direction,
 					      DATA_BLOB *sig) 
@@ -148,7 +148,7 @@ NTSTATUS ntlmssp_client_sign_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state,
 					   const uchar *data, size_t length, 
 					   DATA_BLOB *sig) 
 {
-	NTSTATUS nt_status = ntlmssp_make_packet_signiture(ntlmssp_state, data, length, NTLMSSP_SEND, sig);
+	NTSTATUS nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, length, NTLMSSP_SEND, sig);
 
 	/* increment counter on send */
 	ntlmssp_state->ntlmssp_seq_num++;
@@ -169,11 +169,11 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state,
 	NTSTATUS nt_status;
 
 	if (sig->length < 8) {
-		DEBUG(0, ("NTLMSSP packet check failed due to short signiture (%u bytes)!\n", 
+		DEBUG(0, ("NTLMSSP packet check failed due to short signature (%u bytes)!\n", 
 			  sig->length));
 	}
 
-	nt_status = ntlmssp_make_packet_signiture(ntlmssp_state, data, 
+	nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, 
 						  length, NTLMSSP_RECEIVE, &local_sig);
 	
 	if (!NT_STATUS_IS_OK(nt_status)) {
@@ -188,7 +188,7 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state,
 		DEBUG(5, ("BAD SIG: got signature of\n"));
 		dump_data(5, sig->data, sig->length);
 
-		DEBUG(0, ("NTLMSSP packet check failed due to invalid signiture!\n"));
+		DEBUG(0, ("NTLMSSP packet check failed due to invalid signature!\n"));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -328,7 +328,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state)
 	} 
 	else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
 		if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 8) {
-			/* can't sign or check signitures yet */ 
+			/* can't sign or check signatures yet */ 
 			DEBUG(5, ("NTLMSSP Sign/Seal - cannot use LM KEY yet\n"));	
 			return NT_STATUS_UNSUCCESSFUL;
 		}
@@ -340,7 +340,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state)
 			     sizeof(ntlmssp_state->ntlmssp_hash));
 	} else {
 		if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 16) {
-			/* can't sign or check signitures yet */ 
+			/* can't sign or check signatures yet */ 
 			DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY yet\n"));
 			return NT_STATUS_UNSUCCESSFUL;
 		}
diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c
index d4f77bf07c..4167452953 100644
--- a/source3/libsmb/smb_signing.c
+++ b/source3/libsmb/smb_signing.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    SMB Signing Code
-   Copyright (C) Jeremy Allison 2002.
+   Copyright (C) Jeremy Allison 2003.
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2002-2003
    
    This program is free software; you can redistribute it and/or modify
@@ -28,9 +28,17 @@ struct outstanding_packet_lookup {
 	struct outstanding_packet_lookup *prev, *next;
 };
 
+/* Store the data for an ongoing trans/trans2/nttrans operation. */
+struct trans_info_context {
+	uint16 mid;
+	uint32 send_seq_num;
+	uint32 reply_seq_num;
+};
+
 struct smb_basic_signing_context {
 	DATA_BLOB mac_key;
 	uint32 send_seq_num;
+	struct trans_info_context *trans_info;
 	struct outstanding_packet_lookup *outstanding_packet_list;
 };
 
@@ -46,6 +54,8 @@ static void store_sequence_for_reply(struct outstanding_packet_lookup **list,
 	DLIST_ADD_END(*list, t, tmp);
 	t->mid = mid;
 	t->reply_seq_num = reply_seq_num;
+	DEBUG(10,("store_sequence_for_reply: stored seq = %u mid = %u\n",
+			(unsigned int)reply_seq_num, (unsigned int)mid ));
 }
 
 static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list,
@@ -56,12 +66,13 @@ static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list,
 	for (t = *list; t; t = t->next) {
 		if (t->mid == mid) {
 			*reply_seq_num = t->reply_seq_num;
+			DEBUG(10,("get_sequence_for_reply: found seq = %u mid = %u\n",
+				(unsigned int)t->reply_seq_num, (unsigned int)t->mid ));
 			DLIST_REMOVE(*list, t);
+			SAFE_FREE(t);
 			return True;
 		}
 	}
-	DEBUG(0, ("Unexpected incoming packet, it's MID (%u) does not match"
-		  " a MID in our outstanding list!\n", mid));
 	return False;
 }
 
@@ -81,7 +92,7 @@ static BOOL cli_set_smb_signing_common(struct cli_state *cli)
 	}
 	
 	if (cli->sign_info.free_signing_context)
-		cli->sign_info.free_signing_context(cli);
+		cli->sign_info.free_signing_context(&cli->sign_info);
 
 	/* These calls are INCOMPATIBLE with SMB signing */
 	cli->readbraw_supported = False;
@@ -94,42 +105,107 @@ static BOOL cli_set_smb_signing_common(struct cli_state *cli)
  SMB signing - Common code for 'real' implementations
 ************************************************************/
 
-static BOOL cli_set_smb_signing_real_common(struct cli_state *cli) 
+static BOOL set_smb_signing_real_common(struct smb_sign_info *si)
 {
-	if (cli->sign_info.mandatory_signing) {
+	if (si->mandatory_signing) {
 		DEBUG(5, ("Mandatory SMB signing enabled!\n"));
-		cli->sign_info.doing_signing = True;
 	}
 
+	si->doing_signing = True;
 	DEBUG(5, ("SMB signing enabled!\n"));
 
 	return True;
 }
 
-static void cli_mark_packet_signed(struct cli_state *cli) 
+static void mark_packet_signed(char *outbuf)
 {
 	uint16 flags2;
-	flags2 = SVAL(cli->outbuf,smb_flg2);
+	flags2 = SVAL(outbuf,smb_flg2);
 	flags2 |= FLAGS2_SMB_SECURITY_SIGNATURES;
-	SSVAL(cli->outbuf,smb_flg2, flags2);
+	SSVAL(outbuf,smb_flg2, flags2);
+}
+
+/***********************************************************
+ SMB signing - NULL implementation - calculate a MAC to send.
+************************************************************/
+
+static void null_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
+{
+	/* we can't zero out the sig, as we might be trying to send a
+	   session request - which is NBT-level, not SMB level and doesn't
+	   have the field */
+	return;
+}
+
+/***********************************************************
+ SMB signing - NULL implementation - check a MAC sent by server.
+************************************************************/
+
+static BOOL null_check_incoming_message(char *inbuf, struct smb_sign_info *si)
+{
+	return True;
 }
 
-static BOOL cli_signing_good(struct cli_state *cli, BOOL good) 
+/***********************************************************
+ SMB signing - NULL implementation - free signing context
+************************************************************/
+
+static void null_free_signing_context(struct smb_sign_info *si)
 {
-	DEBUG(10, ("got SMB signature of\n"));
-	dump_data(10,&cli->inbuf[smb_ss_field] , 8);
+	return;
+}
 
-	if (good && !cli->sign_info.doing_signing) {
-		cli->sign_info.doing_signing = True;
+/**
+ SMB signing - NULL implementation - setup the MAC key.
+
+ @note Used as an initialisation only - it will not correctly
+       shut down a real signing mechanism
+*/
+
+static BOOL null_set_signing(struct smb_sign_info *si)
+{
+	si->signing_context = NULL;
+	
+	si->sign_outgoing_message = null_sign_outgoing_message;
+	si->check_incoming_message = null_check_incoming_message;
+	si->free_signing_context = null_free_signing_context;
+
+	return True;
+}
+
+/**
+ * Free the signing context
+ */
+ 
+static void free_signing_context(struct smb_sign_info *si)
+{
+	if (si->free_signing_context) {
+		si->free_signing_context(si);
+		si->signing_context = NULL;
+	}
+
+	null_set_signing(si);
+}
+
+
+static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good) 
+{
+	if (good && !si->doing_signing) {
+		si->doing_signing = True;
 	}
 
 	if (!good) {
-		if (cli->sign_info.doing_signing) {
-			DEBUG(1, ("SMB signature check failed!\n"));
+		if (si->doing_signing) {
+			struct smb_basic_signing_context *data = si->signing_context;
+
+			/* W2K sends a bad first signature but the sign engine is on.... JRA. */
+			if (data->send_seq_num > 1)
+				DEBUG(1, ("signing_good: SMB signature check failed!\n"));
+
 			return False;
 		} else {
-			DEBUG(3, ("Server did not sign reply correctly\n"));
-			cli_free_signing_context(cli);
+			DEBUG(3, ("signing_good: Peer did not sign reply correctly\n"));
+			free_signing_context(si);
 			return False;
 		}
 	}
@@ -155,13 +231,15 @@ static void simple_packet_signature(struct smb_basic_signing_context *data,
 	 * We do this here, to avoid modifying the packet.
 	 */
 
+	DEBUG(10,("simple_packet_signature: sequence number %u\n", seq_number ));
+
 	SIVAL(sequence_buf, 0, seq_number);
 	SIVAL(sequence_buf, 4, 0);
 
 	/* Calculate the 16 byte MAC - but don't alter the data in the
 	   incoming packet.
 	   
-	   This makes for a bit for fussing about, but it's not too bad.
+	   This makes for a bit of fussing about, but it's not too bad.
 	*/
 	MD5Init(&md5_ctx);
 
@@ -179,82 +257,130 @@ static void simple_packet_signature(struct smb_basic_signing_context *data,
 	MD5Update(&md5_ctx, buf + offset_end_of_sig, 
 		  smb_len(buf) - (offset_end_of_sig - 4));
 
-	/* caclulate the MD5 sig */ 
+	/* calculate the MD5 sig */ 
 	MD5Final(calc_md5_mac, &md5_ctx);
 }
 
 
 /***********************************************************
- SMB signing - Simple implementation - send the MAC.
+ SMB signing - Client implementation - send the MAC.
 ************************************************************/
 
-static void cli_simple_sign_outgoing_message(struct cli_state *cli)
+static void client_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
 {
 	unsigned char calc_md5_mac[16];
-	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
+	struct smb_basic_signing_context *data = si->signing_context;
+	uint32 send_seq_num;
+
+	if (!si->doing_signing)
+		return;
+
+	/* JRA Paranioa test - we should be able to get rid of this... */
+	if (smb_len(outbuf) < (smb_ss_field + 8 - 4)) {
+		DEBUG(1, ("client_sign_outgoing_message: Logic error. Can't check signature on short packet! smb_len = %u\n",
+					smb_len(outbuf) ));
+		abort();
+	}
 
 	/* mark the packet as signed - BEFORE we sign it...*/
-	cli_mark_packet_signed(cli);
+	mark_packet_signed(outbuf);
 
-	simple_packet_signature(data, cli->outbuf, data->send_seq_num, 
-				calc_md5_mac);
+	if (data->trans_info)
+		send_seq_num = data->trans_info->send_seq_num;
+	else
+		send_seq_num = data->send_seq_num;
 
-	DEBUG(10, ("sent SMB signature of\n"));
+	simple_packet_signature(data, outbuf, send_seq_num, calc_md5_mac);
+
+	DEBUG(10, ("client_sign_outgoing_message: sent SMB signature of\n"));
 	dump_data(10, calc_md5_mac, 8);
 
-	memcpy(&cli->outbuf[smb_ss_field], calc_md5_mac, 8);
+	memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8);
 
 /*	cli->outbuf[smb_ss_field+2]=0; 
 	Uncomment this to test if the remote server actually verifies signatures...*/
 
+	if (data->trans_info)
+		return;
+
 	data->send_seq_num++;
 	store_sequence_for_reply(&data->outstanding_packet_list, 
-				 cli->mid, 
+				 SVAL(outbuf,smb_mid),
 				 data->send_seq_num);
 	data->send_seq_num++;
 }
 
 /***********************************************************
- SMB signing - Simple implementation - check a MAC sent by server.
+ SMB signing - Client implementation - check a MAC sent by server.
 ************************************************************/
 
-static BOOL cli_simple_check_incoming_message(struct cli_state *cli)
+static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si)
 {
 	BOOL good;
 	uint32 reply_seq_number;
 	unsigned char calc_md5_mac[16];
 	unsigned char *server_sent_mac;
 
-	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
+	struct smb_basic_signing_context *data = si->signing_context;
+
+	if (!si->doing_signing)
+		return True;
 
-	if (!get_sequence_for_reply(&data->outstanding_packet_list, 
-				    SVAL(cli->inbuf, smb_mid), 
+	if (smb_len(inbuf) < (smb_ss_field + 8 - 4)) {
+		DEBUG(1, ("client_check_incoming_message: Can't check signature on short packet! smb_len = %u\n", smb_len(inbuf)));
+		return False;
+	}
+
+	if (data->trans_info) {
+		reply_seq_number = data->trans_info->reply_seq_num;
+	} else if (!get_sequence_for_reply(&data->outstanding_packet_list, 
+				    SVAL(inbuf, smb_mid), 
 				    &reply_seq_number)) {
+		DEBUG(1, ("client_check_incoming_message: failed to get sequence number %u for reply.\n",
+					(unsigned int) SVAL(inbuf, smb_mid) ));
 		return False;
 	}
 
-	simple_packet_signature(data, cli->inbuf, reply_seq_number, calc_md5_mac);
+	simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac);
 
-	server_sent_mac = &cli->inbuf[smb_ss_field];
+	server_sent_mac = &inbuf[smb_ss_field];
 	good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0);
 	
 	if (!good) {
-		DEBUG(5, ("BAD SIG: wanted SMB signature of\n"));
+		DEBUG(5, ("client_check_incoming_message: BAD SIG: wanted SMB signature of\n"));
 		dump_data(5, calc_md5_mac, 8);
 		
-		DEBUG(5, ("BAD SIG: got SMB signature of\n"));
+		DEBUG(5, ("client_check_incoming_message: BAD SIG: got SMB signature of\n"));
 		dump_data(5, server_sent_mac, 8);
+#if 1 /* JRATEST */
+		{
+			int i;
+			reply_seq_number -= 5;
+			for (i = 0; i < 10; i++, reply_seq_number++) {
+				simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac);
+				if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) {
+					DEBUG(0,("client_check_incoming_message: out of seq. seq num %u matches.\n",
+							reply_seq_number ));
+					break;
+				}
+			}
+		}
+#endif /* JRATEST */
+
+	} else {
+		DEBUG(10, ("client_check_incoming_message:: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number));
+		dump_data(10, server_sent_mac, 8);
 	}
-	return cli_signing_good(cli, good);
+	return signing_good(inbuf, si, good);
 }
 
 /***********************************************************
  SMB signing - Simple implementation - free signing context
 ************************************************************/
 
-static void cli_simple_free_signing_context(struct cli_state *cli)
+static void simple_free_signing_context(struct smb_sign_info *si)
 {
-	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
+	struct smb_basic_signing_context *data = si->signing_context;
 	struct outstanding_packet_lookup *list = data->outstanding_packet_list;
 	
 	while (list) {
@@ -264,7 +390,11 @@ static void cli_simple_free_signing_context(struct cli_state *cli)
 	}
 
 	data_blob_free(&data->mac_key);
-	SAFE_FREE(cli->sign_info.signing_context);
+
+	if (data->trans_info)
+		SAFE_FREE(data->trans_info);
+
+	SAFE_FREE(si->signing_context);
 
 	return;
 }
@@ -284,18 +414,29 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[
 		return False;
 	}
 
-	if (!cli_set_smb_signing_real_common(cli)) {
+	if (!set_smb_signing_real_common(&cli->sign_info)) {
 		return False;
 	}
 
 	data = smb_xmalloc(sizeof(*data));
+	memset(data, '\0', sizeof(*data));
 
 	cli->sign_info.signing_context = data;
 	
 	data->mac_key = data_blob(NULL, response.length + 16);
 
 	memcpy(&data->mac_key.data[0], user_session_key, 16);
-	memcpy(&data->mac_key.data[16],response.data, response.length);
+
+	DEBUG(10, ("cli_simple_set_signing: user_session_key\n"));
+	dump_data(10, user_session_key, 16);
+
+	if (response.length) {
+		memcpy(&data->mac_key.data[16],response.data, response.length);
+		DEBUG(10, ("cli_simple_set_signing: response_data\n"));
+		dump_data(10, response.data, response.length);
+	} else {
+		DEBUG(10, ("cli_simple_set_signing: NULL response_data\n"));
+	}
 
 	/* Initialise the sequence number */
 	data->send_seq_num = 0;
@@ -303,73 +444,68 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[
 	/* Initialise the list of outstanding packets */
 	data->outstanding_packet_list = NULL;
 
-	cli->sign_info.sign_outgoing_message = cli_simple_sign_outgoing_message;
-	cli->sign_info.check_incoming_message = cli_simple_check_incoming_message;
-	cli->sign_info.free_signing_context = cli_simple_free_signing_context;
+	cli->sign_info.sign_outgoing_message = client_sign_outgoing_message;
+	cli->sign_info.check_incoming_message = client_check_incoming_message;
+	cli->sign_info.free_signing_context = simple_free_signing_context;
 
 	return True;
 }
 
 /***********************************************************
- SMB signing - NULL implementation - calculate a MAC to send.
+ Tell client code we are in a multiple trans reply state.
 ************************************************************/
 
-static void cli_null_sign_outgoing_message(struct cli_state *cli)
+void cli_signing_trans_start(struct cli_state *cli)
 {
-	/* we can't zero out the sig, as we might be trying to send a
-	   session request - which is NBT-level, not SMB level and doesn't
-	   have the field */
-	return;
-}
+	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
 
-/***********************************************************
- SMB signing - NULL implementation - check a MAC sent by server.
-************************************************************/
+	if (!cli->sign_info.doing_signing || !data)
+		return;
 
-static BOOL cli_null_check_incoming_message(struct cli_state *cli)
-{
-	return True;
+	data->trans_info = smb_xmalloc(sizeof(struct trans_info_context));
+	ZERO_STRUCTP(data->trans_info);
+
+	data->trans_info->send_seq_num = data->send_seq_num;
+	data->trans_info->mid = SVAL(cli->outbuf,smb_mid);
+	data->trans_info->reply_seq_num = data->send_seq_num+1;
+
+	DEBUG(10,("cli_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \
+data->send_seq_num = %u\n",
+			(unsigned int)data->trans_info->mid,
+			(unsigned int)data->trans_info->reply_seq_num,
+			(unsigned int)data->trans_info->send_seq_num,
+			(unsigned int)data->send_seq_num ));
 }
 
 /***********************************************************
- SMB signing - NULL implementation - free signing context
+ Tell client code we are out of a multiple trans reply state.
 ************************************************************/
 
-static void cli_null_free_signing_context(struct cli_state *cli)
+void cli_signing_trans_stop(struct cli_state *cli)
 {
-	return;
-}
+	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
 
-/**
- SMB signing - NULL implementation - setup the MAC key.
+	if (!cli->sign_info.doing_signing || !data)
+		return;
 
- @note Used as an initialisation only - it will not correctly
-       shut down a real signing mechanism
-*/
+	SAFE_FREE(data->trans_info);
+	data->trans_info = NULL;
 
-BOOL cli_null_set_signing(struct cli_state *cli)
-{
-	cli->sign_info.signing_context = NULL;
-	
-	cli->sign_info.sign_outgoing_message = cli_null_sign_outgoing_message;
-	cli->sign_info.check_incoming_message = cli_null_check_incoming_message;
-	cli->sign_info.free_signing_context = cli_null_free_signing_context;
-
-	return True;
+	data->send_seq_num += 2;
 }
 
 /***********************************************************
  SMB signing - TEMP implementation - calculate a MAC to send.
 ************************************************************/
 
-static void cli_temp_sign_outgoing_message(struct cli_state *cli)
+static void temp_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
 {
 	/* mark the packet as signed - BEFORE we sign it...*/
-	cli_mark_packet_signed(cli);
+	mark_packet_signed(outbuf);
 
 	/* I wonder what BSRSPYL stands for - but this is what MS 
 	   actually sends! */
-	memcpy(&cli->outbuf[smb_ss_field], "BSRSPYL ", 8);
+	memcpy(&outbuf[smb_ss_field], "BSRSPYL ", 8);
 	return;
 }
 
@@ -377,7 +513,7 @@ static void cli_temp_sign_outgoing_message(struct cli_state *cli)
  SMB signing - TEMP implementation - check a MAC sent by server.
 ************************************************************/
 
-static BOOL cli_temp_check_incoming_message(struct cli_state *cli)
+static BOOL temp_check_incoming_message(char *inbuf, struct smb_sign_info *si)
 {
 	return True;
 }
@@ -386,7 +522,7 @@ static BOOL cli_temp_check_incoming_message(struct cli_state *cli)
  SMB signing - TEMP implementation - free signing context
 ************************************************************/
 
-static void cli_temp_free_signing_context(struct cli_state *cli)
+static void temp_free_signing_context(struct smb_sign_info *si)
 {
 	return;
 }
@@ -395,6 +531,15 @@ static void cli_temp_free_signing_context(struct cli_state *cli)
  SMB signing - NULL implementation - setup the MAC key.
 ************************************************************/
 
+BOOL cli_null_set_signing(struct cli_state *cli)
+{
+	return null_set_signing(&cli->sign_info);
+}
+
+/***********************************************************
+ SMB signing - temp implementation - setup the MAC key.
+************************************************************/
+
 BOOL cli_temp_set_signing(struct cli_state *cli)
 {
 	if (!cli_set_smb_signing_common(cli)) {
@@ -403,58 +548,427 @@ BOOL cli_temp_set_signing(struct cli_state *cli)
 
 	cli->sign_info.signing_context = NULL;
 	
-	cli->sign_info.sign_outgoing_message = cli_temp_sign_outgoing_message;
-	cli->sign_info.check_incoming_message = cli_temp_check_incoming_message;
-	cli->sign_info.free_signing_context = cli_temp_free_signing_context;
+	cli->sign_info.sign_outgoing_message = temp_sign_outgoing_message;
+	cli->sign_info.check_incoming_message = temp_check_incoming_message;
+	cli->sign_info.free_signing_context = temp_free_signing_context;
 
 	return True;
 }
 
-/**
- * Free the signing context
- */
- 
-void cli_free_signing_context(struct cli_state *cli) 
+void cli_free_signing_context(struct cli_state *cli)
 {
-	if (cli->sign_info.free_signing_context) 
-		cli->sign_info.free_signing_context(cli);
-
-	cli_null_set_signing(cli);
+	free_signing_context(&cli->sign_info);
 }
 
 /**
  * Sign a packet with the current mechanism
  */
  
-void cli_caclulate_sign_mac(struct cli_state *cli)
+void cli_calculate_sign_mac(struct cli_state *cli)
 {
-	cli->sign_info.sign_outgoing_message(cli);
+	cli->sign_info.sign_outgoing_message(cli->outbuf, &cli->sign_info);
 }
 
 /**
  * Check a packet with the current mechanism
  * @return False if we had an established signing connection
- *         which had a back checksum, True otherwise
+ *         which had a bad checksum, True otherwise.
  */
  
 BOOL cli_check_sign_mac(struct cli_state *cli) 
 {
+	if (!cli->sign_info.check_incoming_message(cli->inbuf, &cli->sign_info)) {
+		free_signing_context(&cli->sign_info);	
+		return False;
+	}
+	return True;
+}
+
+static BOOL packet_is_oplock_break(char *buf)
+{
+	if (CVAL(buf,smb_com) != SMBlockingX)
+		return False;
+
+	if (CVAL(buf,smb_vwv3) != LOCKING_ANDX_OPLOCK_RELEASE)
+		return False;
+
+	return True;
+}
+
+/***********************************************************
+ SMB signing - Server implementation - send the MAC.
+************************************************************/
+
+static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
+{
+	unsigned char calc_md5_mac[16];
+	struct smb_basic_signing_context *data = si->signing_context;
+	uint32 send_seq_number = data->send_seq_num;
+	BOOL was_deferred_packet = False;
+	uint16 mid;
+
+	if (!si->doing_signing) {
+		if (si->allow_smb_signing && si->negotiated_smb_signing) {
+			mid = SVAL(outbuf, smb_mid);
+
+			was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, 
+						    mid, &send_seq_number);
+			if (!was_deferred_packet) {
+				/*
+				 * Is this an outgoing oplock break ? If so, store the
+				 * mid in the outstanding list. 
+				 */
+
+				if (packet_is_oplock_break(outbuf)) {
+					store_sequence_for_reply(&data->outstanding_packet_list, 
+								 mid, data->send_seq_num);
+				}
+
+				data->send_seq_num++;
+			}
+		}
+		return;
+	}
+
+	/* JRA Paranioa test - we should be able to get rid of this... */
+	if (smb_len(outbuf) < (smb_ss_field + 8 - 4)) {
+		DEBUG(1, ("srv_sign_outgoing_message: Logic error. Can't send signature on short packet! smb_len = %u\n",
+					smb_len(outbuf) ));
+		abort();
+	}
+
+	/* mark the packet as signed - BEFORE we sign it...*/
+	mark_packet_signed(outbuf);
+
+	mid = SVAL(outbuf, smb_mid);
+
+	/* See if this is a reply for a deferred packet. */
+	was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, mid, &send_seq_number);
+
+	if (data->trans_info && (data->trans_info->mid == mid)) {
+		/* This is a reply in a trans stream. Use the sequence
+		 * number associated with the stream mid. */
+		send_seq_number = data->trans_info->send_seq_num;
+	}
+
+	simple_packet_signature(data, outbuf, send_seq_number, calc_md5_mac);
+
+	DEBUG(10, ("srv_sign_outgoing_message: seq %u: sent SMB signature of\n", (unsigned int)send_seq_number));
+	dump_data(10, calc_md5_mac, 8);
+
+	memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8);
+
+/*	cli->outbuf[smb_ss_field+2]=0; 
+	Uncomment this to test if the remote server actually verifies signatures...*/
+
+	if (!was_deferred_packet) {
+	       	if (!data->trans_info) {
+			/* Always increment if not in a trans stream. */
+			data->send_seq_num++;
+		} else if ((data->trans_info->send_seq_num == data->send_seq_num) || (data->trans_info->mid != mid)) {
+			/* Increment if this is the first reply in a trans stream or a
+			 * packet that doesn't belong to this stream (different mid). */
+			data->send_seq_num++;
+		}
+	}
+}
+
+/***********************************************************
+ SMB signing - Server implementation - check a MAC sent by server.
+************************************************************/
+
+static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si)
+{
 	BOOL good;
+	struct smb_basic_signing_context *data = si->signing_context;
+	uint32 reply_seq_number = data->send_seq_num;
+	unsigned char calc_md5_mac[16];
+	unsigned char *server_sent_mac;
+	uint mid;
+
+	if (!si->doing_signing)
+		return True;
 
-	if (smb_len(cli->inbuf) < (smb_ss_field + 8 - 4)) {
-		DEBUG(cli->sign_info.doing_signing ? 1 : 10, ("Can't check signature on short packet! smb_len = %u\n", smb_len(cli->inbuf)));
-		good = False;
+	if (smb_len(inbuf) < (smb_ss_field + 8 - 4)) {
+		DEBUG(1, ("srv_check_incoming_message: Can't check signature on short packet! smb_len = %u\n", smb_len(inbuf)));
+		return False;
+	}
+
+	mid = SVAL(inbuf, smb_mid);
+
+	/* Is this part of a trans stream ? */
+	if (data->trans_info && (data->trans_info->mid == mid)) {
+		/* If so we don't increment the sequence. */
+		reply_seq_number = data->trans_info->reply_seq_num;
 	} else {
-		good = cli->sign_info.check_incoming_message(cli);
+		/* We always increment the sequence number. */
+		data->send_seq_num++;
+		/* Oplock break requests store an outgoing mid in the packet list. */
+		if (packet_is_oplock_break(inbuf))
+			get_sequence_for_reply(&data->outstanding_packet_list, mid, &reply_seq_number);
 	}
 
+	simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac);
+
+	server_sent_mac = &inbuf[smb_ss_field];
+	good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0);
+	
 	if (!good) {
-		if (cli->sign_info.doing_signing) {
-			return False;
-		} else {
-			cli_free_signing_context(cli);	
+
+		DEBUG(5, ("srv_check_incoming_message: BAD SIG: wanted SMB signature of\n"));
+		dump_data(5, calc_md5_mac, 8);
+		
+		DEBUG(5, ("srv_check_incoming_message: BAD SIG: got SMB signature of\n"));
+		dump_data(5, server_sent_mac, 8);
+
+#if 1 /* JRATEST */
+		{
+			int i;
+			reply_seq_number -= 5;
+			for (i = 0; i < 10; i++, reply_seq_number++) {
+				simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac);
+				if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) {
+					DEBUG(0,("srv_check_incoming_message: out of seq. seq num %u matches.\n",
+							reply_seq_number ));
+					break;
+				}
+			}
 		}
+#endif /* JRATEST */
+
+	} else {
+		DEBUG(10, ("srv_check_incoming_message: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number));
+		dump_data(10, server_sent_mac, 8);
 	}
+	return signing_good(inbuf, si, good);
+}
 
-	return True;
+/***********************************************************
+ SMB signing - server API's.
+************************************************************/
+
+static struct smb_sign_info srv_sign_info = {
+	null_sign_outgoing_message,
+	null_check_incoming_message,
+	null_free_signing_context,
+	NULL,
+	False,
+	False,
+	False,
+	False
+};
+
+/***********************************************************
+ Turn signing off or on for oplock break code.
+************************************************************/
+
+BOOL srv_oplock_set_signing(BOOL onoff)
+{
+	BOOL ret = srv_sign_info.doing_signing;
+	srv_sign_info.doing_signing = onoff;
+	return ret;
+}
+
+/***********************************************************
+ Called to validate an incoming packet from the client.
+************************************************************/
+
+BOOL srv_check_sign_mac(char *inbuf)
+{
+	/* Check if it's a session keepalive. */
+	if(CVAL(inbuf,0) == SMBkeepalive)
+		return True;
+
+	return srv_sign_info.check_incoming_message(inbuf, &srv_sign_info);
+}
+
+/***********************************************************
+ Called to sign an outgoing packet to the client.
+************************************************************/
+
+void srv_calculate_sign_mac(char *outbuf)
+{
+	/* Check if it's a session keepalive. */
+	/* JRA Paranioa test - do we ever generate these in the server ? */
+	if(CVAL(outbuf,0) == SMBkeepalive)
+		return;
+
+	srv_sign_info.sign_outgoing_message(outbuf, &srv_sign_info);
+}
+
+/***********************************************************
+ Called by server to defer an outgoing packet.
+************************************************************/
+
+void srv_defer_sign_response(uint16 mid)
+{
+	struct smb_basic_signing_context *data;
+
+	if (!srv_sign_info.doing_signing)
+		return;
+
+	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+
+	if (!data)
+		return;
+
+	store_sequence_for_reply(&data->outstanding_packet_list, 
+				 mid, data->send_seq_num);
+	data->send_seq_num++;
+}
+
+/***********************************************************
+ Called to remove sequence records when a deferred packet is
+ cancelled by mid. This should never find one....
+************************************************************/
+
+void srv_cancel_sign_response(uint16 mid)
+{
+	struct smb_basic_signing_context *data;
+	uint32 dummy_seq;
+
+	if (!srv_sign_info.doing_signing)
+		return;
+
+	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+
+	if (!data)
+		return;
+
+	DEBUG(10,("srv_cancel_sign_response: for mid %u\n", (unsigned int)mid ));
+
+	while (get_sequence_for_reply(&data->outstanding_packet_list, mid, &dummy_seq))
+		;
+}
+
+/***********************************************************
+ Called by server negprot when signing has been negotiated.
+************************************************************/
+
+void srv_set_signing_negotiated(void)
+{
+	srv_sign_info.allow_smb_signing = True;
+	srv_sign_info.negotiated_smb_signing = True;
+	if (lp_server_signing() == Required)
+		srv_sign_info.mandatory_signing = True;
+
+	srv_sign_info.sign_outgoing_message = temp_sign_outgoing_message;
+	srv_sign_info.check_incoming_message = temp_check_incoming_message;
+	srv_sign_info.free_signing_context = temp_free_signing_context;
+}
+
+/***********************************************************
+ Returns whether signing is active. We can't use sendfile or raw
+ reads/writes if it is.
+************************************************************/
+
+BOOL srv_is_signing_active(void)
+{
+	return srv_sign_info.doing_signing;
+}
+
+/***********************************************************
+ Tell server code we are in a multiple trans reply state.
+************************************************************/
+
+void srv_signing_trans_start(uint16 mid)
+{
+	struct smb_basic_signing_context *data;
+
+	if (!srv_sign_info.doing_signing)
+		return;
+
+	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+	if (!data)
+		return;
+
+	data->trans_info = smb_xmalloc(sizeof(struct trans_info_context));
+	ZERO_STRUCTP(data->trans_info);
+
+	data->trans_info->reply_seq_num = data->send_seq_num-1;
+	data->trans_info->mid = mid;
+	data->trans_info->send_seq_num = data->send_seq_num;
+
+	DEBUG(10,("srv_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \
+data->send_seq_num = %u\n",
+			(unsigned int)mid,
+			(unsigned int)data->trans_info->reply_seq_num,
+			(unsigned int)data->trans_info->send_seq_num,
+			(unsigned int)data->send_seq_num ));
+}
+
+/***********************************************************
+ Tell server code we are out of a multiple trans reply state.
+************************************************************/
+
+void srv_signing_trans_stop(void)
+{
+	struct smb_basic_signing_context *data;
+
+	if (!srv_sign_info.doing_signing)
+		return;
+
+	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+	if (!data || !data->trans_info)
+		return;
+
+	DEBUG(10,("srv_signing_trans_stop: removing mid = %u, reply_seq_num = %u, send_seq_num = %u \
+data->send_seq_num = %u\n",
+			(unsigned int)data->trans_info->mid,
+			(unsigned int)data->trans_info->reply_seq_num,
+			(unsigned int)data->trans_info->send_seq_num,
+			(unsigned int)data->send_seq_num ));
+
+	SAFE_FREE(data->trans_info);
+	data->trans_info = NULL;
+}
+
+/***********************************************************
+ Turn on signing from this packet onwards. 
+************************************************************/
+
+void srv_set_signing(const uchar user_session_key[16], const DATA_BLOB response)
+{
+	struct smb_basic_signing_context *data;
+
+	if (!user_session_key)
+		return;
+
+	if (!srv_sign_info.negotiated_smb_signing && !srv_sign_info.mandatory_signing) {
+		DEBUG(5,("srv_set_signing: signing negotiated = %u, mandatory_signing = %u. Not allowing smb signing.\n",
+			(unsigned int)srv_sign_info.negotiated_smb_signing,
+			(unsigned int)srv_sign_info.mandatory_signing ));
+		return;
+	}
+
+	/* Once we've turned on, ignore any more sessionsetups. */
+	if (srv_sign_info.doing_signing) {
+		return;
+	}
+	
+	if (srv_sign_info.free_signing_context)
+		srv_sign_info.free_signing_context(&srv_sign_info);
+	
+	srv_sign_info.doing_signing = True;
+
+	data = smb_xmalloc(sizeof(*data));
+	memset(data, '\0', sizeof(*data));
+
+	srv_sign_info.signing_context = data;
+	
+	data->mac_key = data_blob(NULL, response.length + 16);
+
+	memcpy(&data->mac_key.data[0], user_session_key, 16);
+	if (response.length)
+		memcpy(&data->mac_key.data[16],response.data, response.length);
+
+	/* Initialise the sequence number */
+	data->send_seq_num = 0;
+
+	/* Initialise the list of outstanding packets */
+	data->outstanding_packet_list = NULL;
+
+	srv_sign_info.sign_outgoing_message = srv_sign_outgoing_message;
+	srv_sign_info.check_incoming_message = srv_check_incoming_message;
+	srv_sign_info.free_signing_context = simple_free_signing_context;
 }
diff --git a/source3/libsmb/trustdom_cache.c b/source3/libsmb/trustdom_cache.c
index 8378125088..0128d08006 100644
--- a/source3/libsmb/trustdom_cache.c
+++ b/source3/libsmb/trustdom_cache.c
@@ -223,7 +223,7 @@ BOOL trustdom_cache_store_timestamp( uint32 t, time_t timeout )
 	if (!gencache_init()) 
 		return False;
 		
-	snprintf(value, sizeof(value), "%d", t );
+	fstr_sprintf(value, "%d", t );
 		
 	if (!gencache_set(TDOMTSKEY, value, timeout)) {
 		DEBUG(5, ("failed to set timestamp for trustdom_cache\n"));
diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c
index 77e63709aa..610f4b3c03 100644
--- a/source3/libsmb/trusts_util.c
+++ b/source3/libsmb/trusts_util.c
@@ -154,7 +154,7 @@ BOOL enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain,
 	/* setup the anonymous connection */
 
 	result = cli_full_connection( &cli, global_myname(), dc_name, &dc_ip, 0, "IPC$", "IPC",
-		"", "", "", 0, &retry);
+		"", "", "", 0, Undefined, &retry);
 	if ( !NT_STATUS_IS_OK(result) )
 		goto done;